13 ms·

The Case Against Boeing

107 points by axiomdata316 7y ago

WalterBright 7y ago
It's true that if the MCAS software requirements weren't inadequate, the accidents would not have happened. It's also true that if the pilots had followed the runaway trim procedure, like the first Lion Air pilots did, like was reiterated to all MAX crews by Airworthiness Directive, the accidents would not have happened. But I don't see why the shortcomings in the MCAS software design requirements were the result of cost savings.
- jacobush 7y ago
  Because the training deviates enough from old 737 that you couldn’t grandfather the new into the same rating? Am I missing something obvious here?
  - WalterBright 7y ago
    Pilots are already supposed to be trained in runaway trim procedure. That's a reasonable evaluation to make, and the FAA agreed with it. One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing. Note that each of the three crews used the column trim switches to restore normal trim, why two did not think to then use the cutoff switches is something for the NTSB to determine. If you watch "Air Disasters" on the Smithsonian Channel, many many crashes have an inadequate pilot training component, and/or pilots who did not do what they were trained to do.
    - et2o 7y ago
      In Indonesia this was not even in the manual, and the pilots were never even told MCAS existed. That’s beside the point. In the story they discuss how airplanes are not intended to require this level of superhuman ability to stay airborne. You are avoiding that this was a combination of an engineering flaw (reading from a single AOA sensor guiding MCAS, when in reality it should have been redundant) and a regulatory flaw (the role of MCAS was increased despite it being initially regulated as a much milder intervention).
      - WalterBright 7y ago
        > In Indonesia this was not even in the manual, and the pilots were never even told MCAS existed. It wasn't necessary to know MCAS existed - the procedure for runaway trim is in the manual and is the correct response to MCAS failure as MCAS failure exhibits itself as runaway trim. > superhuman ability to stay airborne. Turning off the stab trim with the cutoff switches is part of the memory procedure to deal with runaway trim, and no superhuman abilities are required. Just remembering to do it. > You are avoiding Not at all. I just take issue with the claim that pilots had no role in the accidents, and take issue with the bad design of the MCAS software being a cost saving measure. Note that the fix is redesigning the MCAS software.
        et2o 7y ago
        Did you read in the article where Captain Sullenberger said he couldn’t do it in time in a simulator, even expecting it? Have you seen the YouTube videos? It’s a disaster.
        WalterBright 7y ago
        > Did you read in the article where Captain Sullenberger said he couldn’t do it in time in a simulator I did read the article, and that isn't what he said. Furthermore, Captain Sullenberger is an Airbus pilot and hasn't flown 737s in a long time and is not rated on the 737NG. I don't know what runaway trim procedures are on Airbus airplanes.
        et2o 7y ago
        Alright, is it possible you’re being a bit of a keyboard warrior here.
        WalterBright 7y ago
        I'd really like to see the NTSB report on this when it is released. I've read some of them, they're far more detailed and contain a lot of pertinent facts that were omitted from the usual clickbait sensationalist journalism.
    - WalterBright 7y ago
      Also, the stab trim runaway procedure is a "memory" item, meaning the pilots are supposed to memorize it rather than digging out a checklist and referring to it. Since each crew did restore normal trim more than once, they did have more time than just seconds.
    - salawat 7y ago
      >One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing. Note that the penultimate flight of Lion Air had an extra airman deadheading in the cockpit. That is a CRM luxury most normal crews would not have.
    - erokar 7y ago
      Sorry, but this is a naive understanding of aviation safety. Have a look at "the Swiss cheese model" as a starting point to gain insight. Of course many accidents have a "pilot error" component, the central issue is what made the pilots do the wrong thing. This needs to be analyzed on a systemic level, i.e. was the training good enough, did the pilots receive adequate information, did the aircraft system provide the pilots understandable feedback, etc. For the pilots to do the right thing, they first need to identify the problem. That can be very difficult when a lot of visual and auditory alarms -- sometimes contradicting each other -- goes off at the same time. The aircraft manufacturer has to account for the human factors. Boeing failed miserably in this regard: 1) MCAS didn't work as intended, 2) they deliberately left out essential info about the system from flight manuals. In addition the FAA failed in their oversight of Boeing. The deaths are on them, not the pilots.
      - WalterBright 7y ago
        > Sorry, but this is a naive understanding of aviation safety. Very few aviation crashes are the result of a single failure. Usually, they are a combination of failures, all of which were required to produce the crash. These crashes are no different: 1. the design shortcomings of MCAS 2. the refurbished AOA sensor on the LA airplane was not calibrated properly 3. LA put the plane back in service despite the failed AOA sensor 4. The crew of the LA flight were not informed of the failed AOA sensor 5. The flight crews did not follow the memory runaway trim procedure All of these had to happen. A typical NTSB crash report dispassionately identifies all the contributing factors to an accident and issues corrective action recommendations for each of them.
        tempguy9999 7y ago
        I was curious about point 3; was lion air responsible for detecting the failed AOA sensor or someone else? I can't exactly say but a quick read comes up with some relevant points: "According to the reports presented to the Indonesian parliament, a Florida-based aerospace company performed the repair of the faulty AOA sensor." https://airlinerwatch.com/broken-aoa-sensor-in-lion-air-737-max-8-crash-linked-to-a-florida-based-aerospace-company/ https://airlinerwatch.com/broken-aoa-sensor-in-lion-air-737-... [from april 2019] So possibly it's not LA's fault, however "On Nov. 5, CNN published an update on the crash investigation from Capt. Nurcahyo Utomo of Indonesia's National Transportation Safety Committee (KNKT) noting that the FDR review also concluded that the aircraft's airspeed indicator had been malfunctioning on four consecutive flights prior to the crash. Utomo also indicated the pilots should have recognized the malfunction when it occurred on flight JT610." https://www.aviationtoday.com/2018/11/07/faa-issues-boeing-737-aoa-directive-amid-lion-air-crash/ https://www.aviationtoday.com/2018/11/07/faa-issues-boeing-7... [from nov 2018]
    - duk3luk3 7y ago
      Sully Sullenberger's opinions is that the MCAS failure is not a "normal" trim runaway failure: > These emergencies did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS. http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/ http://www.sullysullenberger.com/my-letter-to-the-editor-of-... He bases that opinion on having flown the scenario in a professional full motion simulator (explained in the rest of his letter). What's your response to that?
      - WalterBright 7y ago
        I replied to this in another message here.
      - briandear 7y ago
        Sully isn’t type rated in the airplane in question. An Airbus that he normally flies is much different than a 737NG.
    - dlgeek 7y ago
      That's not true. The EA crew DID follow the proceedure and DID uss the cutout switches. See the report: https://flightsafety.org/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://flightsafety.org/wp-content/uploads/2019/04/Prelimin... Timeline: "At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out." Initial Findings: "The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working." What happened was by the time they did, they were trimmed nose down really far and it took all their effort on the controls to keep the nose up. The aerodynamic forces prevented them from being able to manually trim. They eventually turned the trim back on because they had to use the electric manual control to try to get the nose up because it was physically impossible for them to do so manually. They adjusted the trim in the ANU direction electrically, but then "an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds" which caused them to lose control completely.
      - WalterBright 7y ago
        Read the Airworthiness Directive sent to all MAX crews after the first crash: https://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdfhttps://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdf https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA... which deals specifically with that: "Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."
        jacobush 7y ago
        Funny, that reads to me “you are screwed. Manually jackscrewed”
      - benrjackson 7y ago
        To the best of my understanding, this is an accurate summation of events. With the MAX it isn't possible to have electric trim without MCAS, so if MCAS is malfunctioning pilots have to trim manually. The problem with the EA flight is that it occurred shortly after takeoff, so they lacked altitude (unlike the LA flight). A complicating factor was that they were flying east out of Addis Ababa (i.e uphill). (from wikipedia): Two minutes into the flight, the plane's MCAS system activated, pitching the plane into a dive toward the ground. The pilots struggled to control it and managed to prevent the nose from diving further, but the plane continued to lose altitude. The MCAS then activated again, dropping the nose even further down. The pilots then flipped a pair of switches to disable the electrical trim tab system, which also disabled the MCAS software. However, in shutting off the electrical trim system, they also shut off their ability to trim the stabilizer into a neutral position with the electrical switch located on their yokes. The only other possible way to move the stabilizer would be by cranking the wheel by hand, but because the stabilizer was located opposite to the elevator, strong aerodynamic forces were pushing on it. As the pilots had inadvertently left the engines on full takeoff power, which caused the plane to accelerate at high speed, there was further pressure on the stabilizer. The pilots' attempts to manually crank the stabilizer back into position failed. Three minutes into the flight, with the aircraft continuing to lose altitude and accelerating beyond its safety limits, the captain instructed the first officer to request permission from air traffic control to return to the airport. Permission was granted, and the air traffic controllers diverted other approaching flights. Following instructions from air traffic control, they turned the aircraft to the east, and it rolled to the right. The right wing came to point down as the turn steepened. At 8:43, having struggled to keep the plane's nose from diving further by manually pulling the yoke, the captain asked the first officer to help him, and turned the electrical trim tab system back on in the hope that it would allow him to put the stabilizer back into neutral trim. However, in turning the trim system back on, he also reactivated the MCAS system, which pushed the nose further down. The captain and first officer attempted to raise the nose by manually pulling their yokes, but the aircraft continued to plunge toward the ground.[8][9]
- elygre 7y ago
  Whether the runaway trim procedure would be sufficient is disputed. For example https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP https://www.reuters.com/article/us-ethiopia-airplane-regulat...
  - WalterBright 7y ago
    "In the deadly Lion Air crash in October, the pilots lost control after initially countering the Maneuvering Characteristics Augmentation System (MCAS)" They successfully countered it 25 times before the crash, meaning they had 25 opportunities to remember to use the cutoff switches. "Boeing advised the airline about it after the crash." An Airworthiness Directive was issued to all MAX flight crews after the Lion Air crash specifically laying out the procedure of countering with the trim switches and then throwing the cutoff switches.
    - tempguy9999 7y ago
      I'm not an expert here at all but > An Airworthiness Directive was issued [...] and then throwing the cutoff switches So the response was "there's a known-lethal fault in our product X, when it happens, do Y" but not "there's a known-lethal fault in our product X, withdraw X from use immediately" Edit: given C programmers have many, many of opportunity to learn "not to do that" in an unsafe language, instead you wrote D. That's silly, why not continue to tell C programmers "don't do <dangerous thing>"? I mean, you could have completely saved yourself year of your time writing a new language which makes it hard to do <dangerous thing>, right? Just tell them not to make mistakes is better, right?
      - WalterBright 7y ago
        Oh, I quite agree that Boeing screwed up the MCAS software design and needs to fix it. My experience with designing safe systems at Boeing has led to a lot of design decisions in D. I often look at lists of common bugs in programs to see if I can find a way to design such bugs out of the programming language. I also regularly tell people that if you don't have a plan for when your software fails, you're going to be sorry. In this case, the plan is for the pilots to follow the runaway trim procedure. As for software people, do you have a backup plan for when the software goes berserk? No? Well, someday it will go berserk and delete all your files. Have a backup plan. Suing the software maker won't get your files back. About 90% of pilot training is dealing with emergencies that are never supposed to happen. One of them is runaway trim. Nobody has a plan to dispense with pilots and rely totally on automation.
- sho 7y ago
  This is pure Boeing apologism. Why was it even necessary to follow the "runaway trim procedure" in the first minutes of a flight, in a brand new plane? Yes, it's possible expert pilots could have gotten out of the jam - as they did in the first Lion Air incident. But Boeing's shoddy workmanship, and the FAA's total lack of oversight, created the jam in the first place. Boeing's victim-blaming can be understood, if not excused, from a liability perspective. It baffles me why anyone would take on that point of view otherwise.
  - et2o 7y ago
    Exactly. The suggestion that it is acceptable that a well engineered system would require heroic intervention with 4-10 seconds as the plane rapidly points nose down is baffling.
    - sho 7y ago
      You said it better than I could.
    - WalterBright 7y ago
      They had a lot more that 4-10 seconds. The second LA crew corrected the trim 25 times over several minutes. The EA crew corrected it twice. The runaway trim procedure is also a "memory" procedure, meaning the pilots have it memorized in order to save time.
      - et2o 7y ago
        In the article they clearly state that adjustments need to be made within 10 seconds. Boeing suggests not doing this would be “catastrophic.”
        WalterBright 7y ago
        Both the LA and EA did make the adjustments within 10 seconds. They then did not throw the cutoff switches.
- fsh 7y ago
  This claim is being disputed by Chesley Sullenberger who is undoubtedly a great pilot and who has actually witnessed the MCAS behaviour in a simulator: http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/ http://www.sullysullenberger.com/my-letter-to-the-editor-of-...
  - WalterBright 7y ago
    "These emergencies did not present as a classic runaway stabilizer problem" Since the LA and EA crews both successfully countered the runaway trim with the electric trim switches, this statement by Captain Sullenberger is inadequate. Furthermore, I have no idea what "classic runnaway stabilizer" is. When the trim starts erroneously pointing the airplane down, it's runaway trim. There is no other kind. BTW, I worked for three years on the 757 stabilizer trim system. I know what runaway trim is.
    - mchristen 7y ago
      I think your definition of 'success' is flat out wrong. Where are those pilots now?
      - atdrummond 7y ago
        They did it over two dozen times on one of the flights. It's a tragedy they did not hit the cutout but that's SOP and went by the wayside.
    - pdonis 7y ago
      > When the trim starts erroneously pointing the airplane down, it's runaway trim. No, "runaway trim" as it was defined for every 737 variant prior to the MAX was more specific than that: it meant the trim system would continuously adjust the trim in an erroneous direction. The continuously is key. In the 737 MAX during erroneous MCAS operation, the trim is not adjusted continuously: it is adjusted intermittently. An adjustment of a given fixed increment is made; then nothing happens. Then, a short time later, another adjustment of a given fixed increment is made; then nothing happens. Then... This presentation is not at all the same as normal runaway trim that 737 pilots are trained to deal with. So what is inadequate is not Capt. Sullenberger's statement, but yours.
- hn_throwaway_99 7y ago
  Your arguments are simply baffling due to a very simple reason: two planes crashed! Even if everything you say is true and the pilots were at "fault", it means that Boeing is designing planes where some significant percentage of pilots flying today will crash it. Do you want to fly on that plane? This is basic Human Factors 101. Designing something where some percentage (even a small percentage, and especially when tragic consequences are involved) of properly trained people will be confused by the design means the design is at fault, not the people.
  - CydeWeys 7y ago
    And equally importantly, other planes don't crash nearly as much. Boeing managed to make a new plane that's much more deadly than existing planes on the market. It doesn't even matter so much why it's more deadly, just that it is. Placing blame on pilots misses the point, when those same pilots would not have crashed in those same conditions in a different plane.
    - hinkley 7y ago
      Didn’t we manage a few years ago to go an entire calendar year with no commercial airline fatalities?
    - kortilla 7y ago
      Well it can matter if it turns out the issue wasn’t engineering so much as clearly communicating that it’s a different aircraft so the pilots can be trained correctly.
      - jacobush 7y ago
        The whole point was to reuse the 737 typing. Boeing messed up. (Other parties messed up too, but Boeing started this.)
      - CydeWeys 7y ago
        It's still unacceptably dangerous even if this difference is communicated. To be safe, at a very minimum you would need triply redundant AoA sensors, an MCAS engaged notification, and an MCAS cutoff switch.
- mopsi 7y ago
  > It's also true that if the pilots had followed the runaway trim procedure The aircraft did not act how the manuals define runaway trim condition. MCAS was intermittent, runaway trim is constant. Checklist: https://i.imgur.com/K7El4K4.jpg https://i.imgur.com/K7El4K4.jpg Nevertheless, the preliminary report says that crew identified the issue and followed the runaway trim procedure, but it still left them struggling to maintain control. Report: https://flightsafety.org/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://flightsafety.org/wp-content/uploads/2019/04/Prelimin...
  - mopsi 7y ago
    Video demo of where the checklist left them after completion: https://youtu.be/aoNOVlxJmow?t=606 https://youtu.be/aoNOVlxJmow?t=606 (preceded by explanation)
  - WalterBright 7y ago
    > The aircraft did not act how the manuals define runaway trim condition. I'm curious. How do the manuals define runaway trim? I'll tell you what actual flight controls engineers consider is runaway trim who actually worked on the 757 system - the trim running when it is not supposed to. All imagined faults that could result in trim running when it wasn't supposed to were accounted for and blocked. But STILL the backstop is the trim cutoff switches, which were deliberately and prominently put on the console within easy reach just in case. All three crews knew it was the trim repeatedly running because they successfully countered it with the electric trim switches. All 737s bracket the center console with a pair of large wheels with a white stripe on it that are directly connected to the stabilizer jackscrew and spin when the trim is running, making a loud clacking sound. This is deliberate to make it clear to pilots when the trim is running. The trim running can also be stopped by simply grasping that wheel hard.
    - mopsi 7y ago
      737 quick reference handbook: "Runaway stabilizer. Condition: uncommanded stabilizer trim movement occurs continuously." Source: https://i.imgur.com/K7El4K4.jpg https://i.imgur.com/K7El4K4.jpg It advises turning off the autopilot after first uncommanded movement and pulling the yoke firmly (triggers trim hold), and hitting trim cutoff switches after the second. That's what they did, but by then MCAS had moved the stabilizer so much that they were struggling to maintain control. Aerodynamic forces from their speed rendered manual trim ineffective. Checklist offered nothing beyond this point. When they restored electric trim three minutes later in an attempt to trim the nose up, everything was normal for 30 seconds, but then MCAS kicked in for the third time and put the aircraft into a 40-degree nosedive. All they needed was a bit of electric trim. It's possible they confused 737MAX with older 737NGs, considering the virtually non-existent retraining. Older ones have two cutoff switches, one for pilot-controlled electric trim and the other for automated systems. MAX retains two switches for commonality, but they have the same function: both turn off all power to stabilizer trim, it's impossible to isolate automated systems without losing all electric assist.
- snarf21 7y ago
  The thing that you are missing is that they said it flew EXACTLY like all other 737s. The same thousands of 737s that have been flown around the world for years. The fact that you are saying they didn't follow the "proper runway trim procedures" doesn't hold water. Not following the trim procedures caused ZERO crashes in the last (what?) million 737 flights!!! Whether that was the proper procedure is completely irrelevant. The pilots were given 30 minutes on an iPad and sent on their way being told they needed to do nothing different. Two crashes in (what?) a few hundred flights is the result of pure greed. Lots of people should be in jail.
  - WalterBright 7y ago
    The procedure for dealing with MCAS runaway trim failure is the same as dealing with runaway trim for previous 737 models.
  - briandear 7y ago
    The Lion Air maintenance department should be in jail then. They let a plane in the air when they knew they had a bad AOA sensor. That sensor is required by the Type Certificate and they allowed the plane to fly knowing it was faulty.
    - jacobush 7y ago
      Yes. Them too.
- hef19898 7y ago
  Maybe one general remark, from one engineer who spent half his professional life in aerospace to another. Aerospace is, rightly so, proud of the whole industries relentless pursuit to eliminate errors, improve systems and learn from accidents. Your argumentation, in the whole discussion, conveys a different image and does no favour to the sector in general. Some people are already afraid to fly, so the very least we all can do is to be open and honest about errors in the system and the actions taken to prevent the same accident from happening twice. And generally on engineering. If a system, regardless of the application, fails I consider it bad engineer behavior to single out the user. Systems, especially in aerospace, include everything from design over manufacturing, software, the parts to maintenance, logistics and ultimately training. Failure in any single one of these means failure of the system. Which directly implies all entities involved in development and certification. Failure in more than one is catastrophic. Defending it is bad engineering. Just my 5 cents. EDIT: MCAS relied on a single AoA sensor. Non-redundant safety critical systems in an aircraft? Seriously?
  - kortilla 7y ago
    MCAS isn’t a safety critical system. If it was turning it off wouldn’t really be an option.
    - hef19898 7y ago
      It is in so far as the 737 MAX had an inherent stability issue due to the mounting position of the larger engines. And every system that can directly affect the control of the aircraft is by definition safety critical. Otherwise the majority of aircraft systems wouldn't be as all modern passenger aircraft can glide without engines pretty well. Following your logic engines wouldn't be safety critical neither.
      - WalterBright 7y ago
        > It is in so far as the 737 MAX had an inherent stability issue due to the mounting position of the larger engines. I haven't heard it characterized as an instability by any reputable source. Just that the behavior in certain unusual circumstances did not match the earlier 737 behavior.
- petilon 7y ago
  Cost savings came from not retraining pilots and not requiring airports to be redesigned, and so on. Boeing needed to use a larger engine for the new plane because larger, hotter engines burn less fuel. When the engine is made larger the wings and fuselage have to raised to accommodate the larger engine, which means jet bridges at airports have to be modified to accommodate the new plane. Boeing wanted to avoid this, so they designed the airframe such that the overall geometry of the plane is still compatible with existing infrastructure at airports, but this meant that the airframe was unstable---it has a tendency to tilt up when accelerating. Boeing compensated for this hardware flaw with a software fix. The two serious mistakes Boeing made are (1) designing a multilayer system where bottom layers rely on upper layers for safe operation (i.e., airframe relies on software for stability) and (2) lack of redundant sensors.
  - jacobush 7y ago
    The upward tilt behaviour is not a flaw, as much as it is a quirk. Had they kept it unmitigated, they would have had to retrain pilots before they could fly the plane. (Their software fix was also a cost saving measure, and it didn't work.)
salawat 7y ago
>Good people in a bad system is still a bad system. That line right there is essentially the same response I had for the Langewiesche's piece. It is not an excuse to pawn off the accountability for a catastrophic loss to the pilot when even the basic design is as fraught with failures to deliver even basic sanity checks as the MCAS system was. Make no mistake either, the issues that were found were basic. FMEA was not performed once, but never updated because it wasn't legally required, nor was a full fault-tree enumerated or kept consistent through the system's lifetime. Either of which would have forced a consideration of what would happen in the event of a sensor failure. Furthermore, the overall architecture of the flight computer failed to comply with design requirements that require no single point-of-failure which would have been revealed by doing what amounts to a textbook case of "what is the worst conceivable bit flip that could possibly happen right now?" This is one of the few points I tend to respectfully differ from WalterBright on. I don't give a damn if every pilot were a Chuck Yaeger or Sully clone. That plane was dangerous by design. A dangerous plane flown by a Good pilot is still a dangerous plane. There is no place in something manufactured to be deployed in a careless or cavalier manner, and the MAX rollout checks every box for organizational negligence in my book. I'll let blame rest with the pilot in so much measure as it is do, but a machine that will actively frustrate its operator, while endangering the lives of everyone using it is a machine whose place is in a scrapyard; not in the sky.
- WalterBright 7y ago
  We are in agreement that the MCAS design was dangerous. I don't think we disagree at all on the points you mentioned.
supportlocal4h 7y ago
This is off-topic, but WalterBright's participation here has reminded me of my own weaknesses. Everything I have read about the 737Max has put a pitchfork in my hands to go after Boeing. Walter's are the first comments I have read that make me think perhaps Boeing wasn't completely, utterly, criminally unjustified. It is interesting that Walter has chosen to jump in like this, and to hold his position so firmly so publicly. He must realize that this action threatens to paint him very unfavorably to a lot of people. There seems to be no reason for him to speak out and take such a risk. To do this seems to me to require either a certain level of stupidity or a certain level of conviction and courage. My impression is that Walter has considerable courage and some motivation to try to counteract public ignorance. FWIW, Walter's courage has given at least one person pause. I'm going to put the pitchfork down for a little bit. Boeing still isn't on my good list, but now I admit that I don't know as much about this as I thought I did.
- deleted 7y ago
  [deleted]
- lisper 7y ago
  Can you be a little more specific about what WalterBright said that changed your mind? Because the only thing I see that could possibly be considered a mitigating factor is this: > Both the LA and EA did make the adjustments within 10 seconds. They then did NOT throw the cutoff switches (Emphasis added, because I missed this the first time I read it.) If I squint hard enough I guess I can see a tiny hint of merit in the argument that the fault for the two crashes lies at least in part with the pilots because they failed to throw the cutoff switches. But that seems like a mighty thin reed to me. Have I missed something?
  - throwanem 7y ago
    I don't think you have. Bright's arguments have focused entirely on the design of the MCAS software, and have as far as I can tell completely ignored the fact that that software, driven by input from a single AoA sensor, creates a very short critical failure path which requires immediate and precise human intervention to avert a fatal accident. That such human intervention was imperfectly performed in two cases does not indict the humans in question, so much as it indicts a design which errs so far on the side of unsafety that perfection in human behavior is required to prevent it killing everyone on board a commercial aircraft. Any competent engineer knows that a design which requires human perfection for safety is a design not only doomed to failure, but a failed design in itself. At least one Boeing engineer raised this very concern during the 737 MAX design process, only to be quashed by management. It would be invidious to suggest that at least one ex-Boeing engineer should argue in the defense of that design out of any motivation other than a genuine conviction of the merit in his argument. But conviction alone doesn't suffice to render that argument meritorious, and I'm surprised and disappointed to see anyone here or elsewhere claim otherwise.
ReptileMan 7y ago
>Boeing instructed pilots to deal with excessive downward pitching That is my favorite newspeak so far.
- EddieCPU 7y ago
  @ReptileMan >> Boeing instructed pilots to deal with excessive downward pitching > That is my favorite newspeak so far Going by the faded out aspect of your post, someone here doesn't like you quoting facts.
throw7 7y ago
When the FAA Chief of Aviation Safety says there was "nothing he could have done", that is sign of deep systemic problems where someone else is to blame.
6gvONxR4sf7o 7y ago
This reminds me of the debate around not-quite-self-driving cars. Saying the product is safe to use, but that the user must be ready to do X immediately, despite evidence that the users you're selling to won't be ready to do X immediately. Then when people die you get to say it was totally safe, if they'd just done what they were supposed to do. Or we could just design products that will be safe in the real world, rather than ones that could have been safe in a utopia of perfect people.
- ChuckNorris89 7y ago
  At least most car manufacturers, apart from one(guess who that is) are honest in the marketing about what the features is, a more advanced lane assist and don't sell it as self driving.
- ScalaFan 7y ago
  Certain items just have a danger level that requires an elevated sense of responsibility and awareness and I don't just mean firearms. Workshop tools like power saws or table saws need to be handled with respect and care and those that cannot provide it should just not use them. Those that have worked in some kinds of environments know what I mean. Some factories or manufacturing places have lots of extra safety regulations. Those that have been in the military also know of dynamic and changing circumstances of their operating environment with all the specific equipment they use. Even on a sailboat you need to be aware of the boom.
  - puzzledobserver 7y ago
    As do cars. Which is why people need licenses to drive them. The question being asked is whether it is ethical for a company to market auto-pilot low-awareness chainsaws, designed to give the user only a half-second heads-up, and then disclaim responsibility when accidents happen. Maybe the solution is for licensing authorities to call these auto-manual chimeras unlicenseable.
    - dredmorbius 7y ago
EddieCPU 7y ago
“Boeing decided to place the engines farther forward, just in front of the wing. The new position, and the greater thrust of the engines, produced an aerodynamic challenge during a maneuver called a windup turn — a steep, banked spiral that brings a plane to the point of stall, which is required for safety tests, though it’s rarely used in typical flying.” This is a curiously disingenuous statement. Not only at ‘windup turn’ and not only for “safety tests”, but most importantly when the engines were at maximum thrust such as at take off. Causing the air-frame to experience a pronounced nose-up attitude. The nacelles adding even more upward thrust. ‘Boeing settled on a software feature called the Maneuvering Characteristics Augmentation System. As the nose of the jet approached a high angle, suggesting an oncoming stall, MCAS would adjust the stabilizer on the plane’s tail, pushing the nose down, to alleviate the slackness in the control column. “They were trying to make it feel the same, so the pilots wouldn’t require training,”’ No, they didn't tell the pilots as this would require retraining and this would require re-certification. “Boeing considered the MCAS feature to be so minor that it removed mention of it from the 737 MAX’s pilot manual.” Boeing lied by omission, that's why when MCAS kicked in on those two crashes the pilots were unaware of MCAS and had no way of knowing how to recover from an MCAS induced nose dive. It was Boeing executive decisions killed those people. If this had happened in the US there would have been uproar by now.
kpU8efre7r 7y ago
If Boeing had a dick Walter Bright would be sucking it. Boeing makes planes that kill pilots and passengers. I don't know why that's so hard to say.
- dang 7y ago
  We've banned this account for breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future.
V_Terranova_Jr 7y ago
I'm an Aerospace Engineer, currently working for the U.S. Gov, but have spent time on the Industry side. I don't have a thesis per se after reading this, but several thoughts: - I don't think it's unfair to vilify Boeing's accumulated divergence from "doing the right thing". On the other hand, it's quite sad that it takes significant events like this to force anyone to act against the long-term pressure of corporate behavior that leads to such events. - As per a thread I had with WalterBright, https://news.ycombinator.com/item?id=21037522 https://news.ycombinator.com/item?id=21037522 , I agree Airbus has a number of significant flaws in their vehicle management systems for which there has been insufficient criticism and action. - It's not easy being on the side of the gov/regulators. There is continuous pressure from industry, and from up the management/political chain, to be a cooperative partner. Especially in light of how quickly industry can execute tasks, it's very hard to say "we need to take a pause" or "we need to go back, do some more homework, and be deliberative about this". If the gov/regulator is excessively slow, there are concrete costs that industry incurs. These realities, with the continued pressure, have trended in the U.S. to lead to ultimately less effective oversight. - The U.S. Government insufficiently values in-house technical expertise. In the aerospace realm, NASA is the principal exception. But within the DoD and FAA, while there is is technical expertise, much heavy-duty technical lifting is done by FFRDCs (e.g., Aerospace Corp., MITRE's CAASD, the national labs) or UARCs (e.g., Johns Hopkins Univ's Applied Physics Lab). In my view, the DoD and FAA should build in-house engineering capability sufficient to properly oversee and advise major programs without having to outsource as much as they do. You cannot do an effective job overseeing complex engineering developments if you are insufficiently technically-competent. The DoD is starting to realize this and places like AFRL are starting to swing back toward that direction, but there's a very very long way to go. If you are going to effectively push back against industry pressure, you have to be equipped to make strong technical arguments, not just appeals to precedent or vague statements about risk. - If you can find people with the right mindset and competence levels, it's better, in my view to have ex-Industry engineers working for the government. Those that go straight from school to government don't often have direct experience as practitioners, and as per my previous point, that often makes them less effective than they could be. - "Follow the plan," from the article, sounds exactly like what I've heard from Boeing. The article captured well the context and implications of that kind of talk. - "... engineers had to accept that they were no longer the center of the universe" really resonated with my own experience at another (non-Boeing) large American aerospace company. I was told by the man in charge of a major subsystem discipline that "engineering is out of favor [with the company management]". He was an engineer and on the side of engineers, he was just telling it the way it was. I couldn't believe what I heard then, and decades later, still can't believe it. How can engineering be "out of favor" in a company that specifically engineers systems at the edge of what humans can accomplish in hardware? I think you will find most large American aerospace companies helmed by people who really see no irony in making statements like that. - The aerospace industry is not one I would encourage my children to work in. I'm driven heavily by my passion for aerospace - it's an integral part of my identity. But it's really hard in industry to find job security, avoid rampant pigeonholing, avoid corporate mistreatment, work on multiple well-executed flight programs in your career (the equivalent of "shipping" software), and generally work somewhere where there is a strong corporate motivation to "do the right thing". It's a lot harder than in software for the corporate culture to not permeate everything around you because of how capital-intensive the field is. Also, the U.S. Government sucks as a customer, which makes it harder for small companies to thrive in the field. The job security issue can go away if you work in government, but then your ability to be an implementer (why a lot of people become engineers) also diminishes.

107 points by axiomdata316 7y ago

It's true that if the MCAS software requirements weren't inadequate, the accidents would not have happened. It's also true that if the pilots had followed the runaway trim procedure, like the first Lion Air pilots did, like was reiterated to all MAX crews by Airworthiness Directive, the accidents would not have happened. But I don't see why the shortcomings in the MCAS software design requirements were the result of cost savings.

jacobush 7y ago
Because the training deviates enough from old 737 that you couldn’t grandfather the new into the same rating? Am I missing something obvious here?
- WalterBright 7y ago
  Pilots are already supposed to be trained in runaway trim procedure. That's a reasonable evaluation to make, and the FAA agreed with it. One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing. Note that each of the three crews used the column trim switches to restore normal trim, why two did not think to then use the cutoff switches is something for the NTSB to determine. If you watch "Air Disasters" on the Smithsonian Channel, many many crashes have an inadequate pilot training component, and/or pilots who did not do what they were trained to do.
  - et2o 7y ago
    In Indonesia this was not even in the manual, and the pilots were never even told MCAS existed. That’s beside the point. In the story they discuss how airplanes are not intended to require this level of superhuman ability to stay airborne. You are avoiding that this was a combination of an engineering flaw (reading from a single AOA sensor guiding MCAS, when in reality it should have been redundant) and a regulatory flaw (the role of MCAS was increased despite it being initially regulated as a much milder intervention).
    - WalterBright 7y ago
      > In Indonesia this was not even in the manual, and the pilots were never even told MCAS existed. It wasn't necessary to know MCAS existed - the procedure for runaway trim is in the manual and is the correct response to MCAS failure as MCAS failure exhibits itself as runaway trim. > superhuman ability to stay airborne. Turning off the stab trim with the cutoff switches is part of the memory procedure to deal with runaway trim, and no superhuman abilities are required. Just remembering to do it. > You are avoiding Not at all. I just take issue with the claim that pilots had no role in the accidents, and take issue with the bad design of the MCAS software being a cost saving measure. Note that the fix is redesigning the MCAS software.
      - et2o 7y ago
        Did you read in the article where Captain Sullenberger said he couldn’t do it in time in a simulator, even expecting it? Have you seen the YouTube videos? It’s a disaster.
        WalterBright 7y ago
        > Did you read in the article where Captain Sullenberger said he couldn’t do it in time in a simulator I did read the article, and that isn't what he said. Furthermore, Captain Sullenberger is an Airbus pilot and hasn't flown 737s in a long time and is not rated on the 737NG. I don't know what runaway trim procedures are on Airbus airplanes.
        et2o 7y ago
        Alright, is it possible you’re being a bit of a keyboard warrior here.
        WalterBright 7y ago
        I'd really like to see the NTSB report on this when it is released. I've read some of them, they're far more detailed and contain a lot of pertinent facts that were omitted from the usual clickbait sensationalist journalism.
  - WalterBright 7y ago
    Also, the stab trim runaway procedure is a "memory" item, meaning the pilots are supposed to memorize it rather than digging out a checklist and referring to it. Since each crew did restore normal trim more than once, they did have more time than just seconds.
  - salawat 7y ago
    >One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing. Note that the penultimate flight of Lion Air had an extra airman deadheading in the cockpit. That is a CRM luxury most normal crews would not have.
  - erokar 7y ago
    Sorry, but this is a naive understanding of aviation safety. Have a look at "the Swiss cheese model" as a starting point to gain insight. Of course many accidents have a "pilot error" component, the central issue is what made the pilots do the wrong thing. This needs to be analyzed on a systemic level, i.e. was the training good enough, did the pilots receive adequate information, did the aircraft system provide the pilots understandable feedback, etc. For the pilots to do the right thing, they first need to identify the problem. That can be very difficult when a lot of visual and auditory alarms -- sometimes contradicting each other -- goes off at the same time. The aircraft manufacturer has to account for the human factors. Boeing failed miserably in this regard: 1) MCAS didn't work as intended, 2) they deliberately left out essential info about the system from flight manuals. In addition the FAA failed in their oversight of Boeing. The deaths are on them, not the pilots.
    - WalterBright 7y ago
      > Sorry, but this is a naive understanding of aviation safety. Very few aviation crashes are the result of a single failure. Usually, they are a combination of failures, all of which were required to produce the crash. These crashes are no different: 1. the design shortcomings of MCAS 2. the refurbished AOA sensor on the LA airplane was not calibrated properly 3. LA put the plane back in service despite the failed AOA sensor 4. The crew of the LA flight were not informed of the failed AOA sensor 5. The flight crews did not follow the memory runaway trim procedure All of these had to happen. A typical NTSB crash report dispassionately identifies all the contributing factors to an accident and issues corrective action recommendations for each of them.
      - tempguy9999 7y ago
        I was curious about point 3; was lion air responsible for detecting the failed AOA sensor or someone else? I can't exactly say but a quick read comes up with some relevant points: "According to the reports presented to the Indonesian parliament, a Florida-based aerospace company performed the repair of the faulty AOA sensor." https://airlinerwatch.com/broken-aoa-sensor-in-lion-air-737-max-8-crash-linked-to-a-florida-based-aerospace-company/ https://airlinerwatch.com/broken-aoa-sensor-in-lion-air-737-... [from april 2019] So possibly it's not LA's fault, however "On Nov. 5, CNN published an update on the crash investigation from Capt. Nurcahyo Utomo of Indonesia's National Transportation Safety Committee (KNKT) noting that the FDR review also concluded that the aircraft's airspeed indicator had been malfunctioning on four consecutive flights prior to the crash. Utomo also indicated the pilots should have recognized the malfunction when it occurred on flight JT610." https://www.aviationtoday.com/2018/11/07/faa-issues-boeing-737-aoa-directive-amid-lion-air-crash/ https://www.aviationtoday.com/2018/11/07/faa-issues-boeing-7... [from nov 2018]
  - duk3luk3 7y ago
    Sully Sullenberger's opinions is that the MCAS failure is not a "normal" trim runaway failure: > These emergencies did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS. http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/ http://www.sullysullenberger.com/my-letter-to-the-editor-of-... He bases that opinion on having flown the scenario in a professional full motion simulator (explained in the rest of his letter). What's your response to that?
    - WalterBright 7y ago
      I replied to this in another message here.
    - briandear 7y ago
      Sully isn’t type rated in the airplane in question. An Airbus that he normally flies is much different than a 737NG.
  - dlgeek 7y ago
    That's not true. The EA crew DID follow the proceedure and DID uss the cutout switches. See the report: https://flightsafety.org/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://flightsafety.org/wp-content/uploads/2019/04/Prelimin... Timeline: "At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out." Initial Findings: "The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working." What happened was by the time they did, they were trimmed nose down really far and it took all their effort on the controls to keep the nose up. The aerodynamic forces prevented them from being able to manually trim. They eventually turned the trim back on because they had to use the electric manual control to try to get the nose up because it was physically impossible for them to do so manually. They adjusted the trim in the ANU direction electrically, but then "an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds" which caused them to lose control completely.
    - WalterBright 7y ago
      Read the Airworthiness Directive sent to all MAX crews after the first crash: https://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdfhttps://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdf https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA... which deals specifically with that: "Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."
      - jacobush 7y ago
        Funny, that reads to me “you are screwed. Manually jackscrewed”
    - benrjackson 7y ago
      To the best of my understanding, this is an accurate summation of events. With the MAX it isn't possible to have electric trim without MCAS, so if MCAS is malfunctioning pilots have to trim manually. The problem with the EA flight is that it occurred shortly after takeoff, so they lacked altitude (unlike the LA flight). A complicating factor was that they were flying east out of Addis Ababa (i.e uphill). (from wikipedia): Two minutes into the flight, the plane's MCAS system activated, pitching the plane into a dive toward the ground. The pilots struggled to control it and managed to prevent the nose from diving further, but the plane continued to lose altitude. The MCAS then activated again, dropping the nose even further down. The pilots then flipped a pair of switches to disable the electrical trim tab system, which also disabled the MCAS software. However, in shutting off the electrical trim system, they also shut off their ability to trim the stabilizer into a neutral position with the electrical switch located on their yokes. The only other possible way to move the stabilizer would be by cranking the wheel by hand, but because the stabilizer was located opposite to the elevator, strong aerodynamic forces were pushing on it. As the pilots had inadvertently left the engines on full takeoff power, which caused the plane to accelerate at high speed, there was further pressure on the stabilizer. The pilots' attempts to manually crank the stabilizer back into position failed. Three minutes into the flight, with the aircraft continuing to lose altitude and accelerating beyond its safety limits, the captain instructed the first officer to request permission from air traffic control to return to the airport. Permission was granted, and the air traffic controllers diverted other approaching flights. Following instructions from air traffic control, they turned the aircraft to the east, and it rolled to the right. The right wing came to point down as the turn steepened. At 8:43, having struggled to keep the plane's nose from diving further by manually pulling the yoke, the captain asked the first officer to help him, and turned the electrical trim tab system back on in the hope that it would allow him to put the stabilizer back into neutral trim. However, in turning the trim system back on, he also reactivated the MCAS system, which pushed the nose further down. The captain and first officer attempted to raise the nose by manually pulling their yokes, but the aircraft continued to plunge toward the ground.[8][9]
elygre 7y ago
Whether the runaway trim procedure would be sufficient is disputed. For example https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP https://www.reuters.com/article/us-ethiopia-airplane-regulat...
- WalterBright 7y ago
  "In the deadly Lion Air crash in October, the pilots lost control after initially countering the Maneuvering Characteristics Augmentation System (MCAS)" They successfully countered it 25 times before the crash, meaning they had 25 opportunities to remember to use the cutoff switches. "Boeing advised the airline about it after the crash." An Airworthiness Directive was issued to all MAX flight crews after the Lion Air crash specifically laying out the procedure of countering with the trim switches and then throwing the cutoff switches.
  - tempguy9999 7y ago
    I'm not an expert here at all but > An Airworthiness Directive was issued [...] and then throwing the cutoff switches So the response was "there's a known-lethal fault in our product X, when it happens, do Y" but not "there's a known-lethal fault in our product X, withdraw X from use immediately" Edit: given C programmers have many, many of opportunity to learn "not to do that" in an unsafe language, instead you wrote D. That's silly, why not continue to tell C programmers "don't do <dangerous thing>"? I mean, you could have completely saved yourself year of your time writing a new language which makes it hard to do <dangerous thing>, right? Just tell them not to make mistakes is better, right?
    - WalterBright 7y ago
      Oh, I quite agree that Boeing screwed up the MCAS software design and needs to fix it. My experience with designing safe systems at Boeing has led to a lot of design decisions in D. I often look at lists of common bugs in programs to see if I can find a way to design such bugs out of the programming language. I also regularly tell people that if you don't have a plan for when your software fails, you're going to be sorry. In this case, the plan is for the pilots to follow the runaway trim procedure. As for software people, do you have a backup plan for when the software goes berserk? No? Well, someday it will go berserk and delete all your files. Have a backup plan. Suing the software maker won't get your files back. About 90% of pilot training is dealing with emergencies that are never supposed to happen. One of them is runaway trim. Nobody has a plan to dispense with pilots and rely totally on automation.
sho 7y ago
This is pure Boeing apologism. Why was it even necessary to follow the "runaway trim procedure" in the first minutes of a flight, in a brand new plane? Yes, it's possible expert pilots could have gotten out of the jam - as they did in the first Lion Air incident. But Boeing's shoddy workmanship, and the FAA's total lack of oversight, created the jam in the first place. Boeing's victim-blaming can be understood, if not excused, from a liability perspective. It baffles me why anyone would take on that point of view otherwise.
- et2o 7y ago
  Exactly. The suggestion that it is acceptable that a well engineered system would require heroic intervention with 4-10 seconds as the plane rapidly points nose down is baffling.
  - sho 7y ago
    You said it better than I could.
  - WalterBright 7y ago
    They had a lot more that 4-10 seconds. The second LA crew corrected the trim 25 times over several minutes. The EA crew corrected it twice. The runaway trim procedure is also a "memory" procedure, meaning the pilots have it memorized in order to save time.
    - et2o 7y ago
      In the article they clearly state that adjustments need to be made within 10 seconds. Boeing suggests not doing this would be “catastrophic.”
      - WalterBright 7y ago
        Both the LA and EA did make the adjustments within 10 seconds. They then did not throw the cutoff switches.
fsh 7y ago
This claim is being disputed by Chesley Sullenberger who is undoubtedly a great pilot and who has actually witnessed the MCAS behaviour in a simulator: http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/ http://www.sullysullenberger.com/my-letter-to-the-editor-of-...
- WalterBright 7y ago
  "These emergencies did not present as a classic runaway stabilizer problem" Since the LA and EA crews both successfully countered the runaway trim with the electric trim switches, this statement by Captain Sullenberger is inadequate. Furthermore, I have no idea what "classic runnaway stabilizer" is. When the trim starts erroneously pointing the airplane down, it's runaway trim. There is no other kind. BTW, I worked for three years on the 757 stabilizer trim system. I know what runaway trim is.
  - mchristen 7y ago
    I think your definition of 'success' is flat out wrong. Where are those pilots now?
    - atdrummond 7y ago
      They did it over two dozen times on one of the flights. It's a tragedy they did not hit the cutout but that's SOP and went by the wayside.
  - pdonis 7y ago
    > When the trim starts erroneously pointing the airplane down, it's runaway trim. No, "runaway trim" as it was defined for every 737 variant prior to the MAX was more specific than that: it meant the trim system would continuously adjust the trim in an erroneous direction. The continuously is key. In the 737 MAX during erroneous MCAS operation, the trim is not adjusted continuously: it is adjusted intermittently. An adjustment of a given fixed increment is made; then nothing happens. Then, a short time later, another adjustment of a given fixed increment is made; then nothing happens. Then... This presentation is not at all the same as normal runaway trim that 737 pilots are trained to deal with. So what is inadequate is not Capt. Sullenberger's statement, but yours.
hn_throwaway_99 7y ago
Your arguments are simply baffling due to a very simple reason: two planes crashed! Even if everything you say is true and the pilots were at "fault", it means that Boeing is designing planes where some significant percentage of pilots flying today will crash it. Do you want to fly on that plane? This is basic Human Factors 101. Designing something where some percentage (even a small percentage, and especially when tragic consequences are involved) of properly trained people will be confused by the design means the design is at fault, not the people.
- CydeWeys 7y ago
  And equally importantly, other planes don't crash nearly as much. Boeing managed to make a new plane that's much more deadly than existing planes on the market. It doesn't even matter so much why it's more deadly, just that it is. Placing blame on pilots misses the point, when those same pilots would not have crashed in those same conditions in a different plane.
  - hinkley 7y ago
    Didn’t we manage a few years ago to go an entire calendar year with no commercial airline fatalities?
  - kortilla 7y ago
    Well it can matter if it turns out the issue wasn’t engineering so much as clearly communicating that it’s a different aircraft so the pilots can be trained correctly.
    - jacobush 7y ago
      The whole point was to reuse the 737 typing. Boeing messed up. (Other parties messed up too, but Boeing started this.)
    - CydeWeys 7y ago
      It's still unacceptably dangerous even if this difference is communicated. To be safe, at a very minimum you would need triply redundant AoA sensors, an MCAS engaged notification, and an MCAS cutoff switch.
mopsi 7y ago
> It's also true that if the pilots had followed the runaway trim procedure The aircraft did not act how the manuals define runaway trim condition. MCAS was intermittent, runaway trim is constant. Checklist: https://i.imgur.com/K7El4K4.jpg https://i.imgur.com/K7El4K4.jpg Nevertheless, the preliminary report says that crew identified the issue and followed the runaway trim procedure, but it still left them struggling to maintain control. Report: https://flightsafety.org/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://flightsafety.org/wp-content/uploads/2019/04/Prelimin...
- mopsi 7y ago
  Video demo of where the checklist left them after completion: https://youtu.be/aoNOVlxJmow?t=606 https://youtu.be/aoNOVlxJmow?t=606 (preceded by explanation)
- WalterBright 7y ago
  > The aircraft did not act how the manuals define runaway trim condition. I'm curious. How do the manuals define runaway trim? I'll tell you what actual flight controls engineers consider is runaway trim who actually worked on the 757 system - the trim running when it is not supposed to. All imagined faults that could result in trim running when it wasn't supposed to were accounted for and blocked. But STILL the backstop is the trim cutoff switches, which were deliberately and prominently put on the console within easy reach just in case. All three crews knew it was the trim repeatedly running because they successfully countered it with the electric trim switches. All 737s bracket the center console with a pair of large wheels with a white stripe on it that are directly connected to the stabilizer jackscrew and spin when the trim is running, making a loud clacking sound. This is deliberate to make it clear to pilots when the trim is running. The trim running can also be stopped by simply grasping that wheel hard.
  - mopsi 7y ago
    737 quick reference handbook: "Runaway stabilizer. Condition: uncommanded stabilizer trim movement occurs continuously." Source: https://i.imgur.com/K7El4K4.jpg https://i.imgur.com/K7El4K4.jpg It advises turning off the autopilot after first uncommanded movement and pulling the yoke firmly (triggers trim hold), and hitting trim cutoff switches after the second. That's what they did, but by then MCAS had moved the stabilizer so much that they were struggling to maintain control. Aerodynamic forces from their speed rendered manual trim ineffective. Checklist offered nothing beyond this point. When they restored electric trim three minutes later in an attempt to trim the nose up, everything was normal for 30 seconds, but then MCAS kicked in for the third time and put the aircraft into a 40-degree nosedive. All they needed was a bit of electric trim. It's possible they confused 737MAX with older 737NGs, considering the virtually non-existent retraining. Older ones have two cutoff switches, one for pilot-controlled electric trim and the other for automated systems. MAX retains two switches for commonality, but they have the same function: both turn off all power to stabilizer trim, it's impossible to isolate automated systems without losing all electric assist.
snarf21 7y ago
The thing that you are missing is that they said it flew EXACTLY like all other 737s. The same thousands of 737s that have been flown around the world for years. The fact that you are saying they didn't follow the "proper runway trim procedures" doesn't hold water. Not following the trim procedures caused ZERO crashes in the last (what?) million 737 flights!!! Whether that was the proper procedure is completely irrelevant. The pilots were given 30 minutes on an iPad and sent on their way being told they needed to do nothing different. Two crashes in (what?) a few hundred flights is the result of pure greed. Lots of people should be in jail.
- WalterBright 7y ago
  The procedure for dealing with MCAS runaway trim failure is the same as dealing with runaway trim for previous 737 models.
- briandear 7y ago
  The Lion Air maintenance department should be in jail then. They let a plane in the air when they knew they had a bad AOA sensor. That sensor is required by the Type Certificate and they allowed the plane to fly knowing it was faulty.
  - jacobush 7y ago
    Yes. Them too.
hef19898 7y ago
Maybe one general remark, from one engineer who spent half his professional life in aerospace to another. Aerospace is, rightly so, proud of the whole industries relentless pursuit to eliminate errors, improve systems and learn from accidents. Your argumentation, in the whole discussion, conveys a different image and does no favour to the sector in general. Some people are already afraid to fly, so the very least we all can do is to be open and honest about errors in the system and the actions taken to prevent the same accident from happening twice. And generally on engineering. If a system, regardless of the application, fails I consider it bad engineer behavior to single out the user. Systems, especially in aerospace, include everything from design over manufacturing, software, the parts to maintenance, logistics and ultimately training. Failure in any single one of these means failure of the system. Which directly implies all entities involved in development and certification. Failure in more than one is catastrophic. Defending it is bad engineering. Just my 5 cents. EDIT: MCAS relied on a single AoA sensor. Non-redundant safety critical systems in an aircraft? Seriously?
- kortilla 7y ago
  MCAS isn’t a safety critical system. If it was turning it off wouldn’t really be an option.
  - hef19898 7y ago
    It is in so far as the 737 MAX had an inherent stability issue due to the mounting position of the larger engines. And every system that can directly affect the control of the aircraft is by definition safety critical. Otherwise the majority of aircraft systems wouldn't be as all modern passenger aircraft can glide without engines pretty well. Following your logic engines wouldn't be safety critical neither.
    - WalterBright 7y ago
      > It is in so far as the 737 MAX had an inherent stability issue due to the mounting position of the larger engines. I haven't heard it characterized as an instability by any reputable source. Just that the behavior in certain unusual circumstances did not match the earlier 737 behavior.
petilon 7y ago
Cost savings came from not retraining pilots and not requiring airports to be redesigned, and so on. Boeing needed to use a larger engine for the new plane because larger, hotter engines burn less fuel. When the engine is made larger the wings and fuselage have to raised to accommodate the larger engine, which means jet bridges at airports have to be modified to accommodate the new plane. Boeing wanted to avoid this, so they designed the airframe such that the overall geometry of the plane is still compatible with existing infrastructure at airports, but this meant that the airframe was unstable---it has a tendency to tilt up when accelerating. Boeing compensated for this hardware flaw with a software fix. The two serious mistakes Boeing made are (1) designing a multilayer system where bottom layers rely on upper layers for safe operation (i.e., airframe relies on software for stability) and (2) lack of redundant sensors.
- jacobush 7y ago
  The upward tilt behaviour is not a flaw, as much as it is a quirk. Had they kept it unmitigated, they would have had to retrain pilots before they could fly the plane. (Their software fix was also a cost saving measure, and it didn't work.)

salawat 7y ago

>Good people in a bad system is still a bad system. That line right there is essentially the same response I had for the Langewiesche's piece. It is not an excuse to pawn off the accountability for a catastrophic loss to the pilot when even the basic design is as fraught with failures to deliver even basic sanity checks as the MCAS system was. Make no mistake either, the issues that were found were basic. FMEA was not performed once, but never updated because it wasn't legally required, nor was a full fault-tree enumerated or kept consistent through the system's lifetime. Either of which would have forced a consideration of what would happen in the event of a sensor failure. Furthermore, the overall architecture of the flight computer failed to comply with design requirements that require no single point-of-failure which would have been revealed by doing what amounts to a textbook case of "what is the worst conceivable bit flip that could possibly happen right now?" This is one of the few points I tend to respectfully differ from WalterBright on. I don't give a damn if every pilot were a Chuck Yaeger or Sully clone. That plane was dangerous by design. A dangerous plane flown by a Good pilot is still a dangerous plane. There is no place in something manufactured to be deployed in a careless or cavalier manner, and the MAX rollout checks every box for organizational negligence in my book. I'll let blame rest with the pilot in so much measure as it is do, but a machine that will actively frustrate its operator, while endangering the lives of everyone using it is a machine whose place is in a scrapyard; not in the sky.

WalterBright 7y ago
We are in agreement that the MCAS design was dangerous. I don't think we disagree at all on the points you mentioned.

supportlocal4h 7y ago

This is off-topic, but WalterBright's participation here has reminded me of my own weaknesses. Everything I have read about the 737Max has put a pitchfork in my hands to go after Boeing. Walter's are the first comments I have read that make me think perhaps Boeing wasn't completely, utterly, criminally unjustified. It is interesting that Walter has chosen to jump in like this, and to hold his position so firmly so publicly. He must realize that this action threatens to paint him very unfavorably to a lot of people. There seems to be no reason for him to speak out and take such a risk. To do this seems to me to require either a certain level of stupidity or a certain level of conviction and courage. My impression is that Walter has considerable courage and some motivation to try to counteract public ignorance. FWIW, Walter's courage has given at least one person pause. I'm going to put the pitchfork down for a little bit. Boeing still isn't on my good list, but now I admit that I don't know as much about this as I thought I did.

deleted 7y ago
[deleted]
lisper 7y ago
Can you be a little more specific about what WalterBright said that changed your mind? Because the only thing I see that could possibly be considered a mitigating factor is this: > Both the LA and EA did make the adjustments within 10 seconds. They then did NOT throw the cutoff switches (Emphasis added, because I missed this the first time I read it.) If I squint hard enough I guess I can see a tiny hint of merit in the argument that the fault for the two crashes lies at least in part with the pilots because they failed to throw the cutoff switches. But that seems like a mighty thin reed to me. Have I missed something?
- throwanem 7y ago
  I don't think you have. Bright's arguments have focused entirely on the design of the MCAS software, and have as far as I can tell completely ignored the fact that that software, driven by input from a single AoA sensor, creates a very short critical failure path which requires immediate and precise human intervention to avert a fatal accident. That such human intervention was imperfectly performed in two cases does not indict the humans in question, so much as it indicts a design which errs so far on the side of unsafety that perfection in human behavior is required to prevent it killing everyone on board a commercial aircraft. Any competent engineer knows that a design which requires human perfection for safety is a design not only doomed to failure, but a failed design in itself. At least one Boeing engineer raised this very concern during the 737 MAX design process, only to be quashed by management. It would be invidious to suggest that at least one ex-Boeing engineer should argue in the defense of that design out of any motivation other than a genuine conviction of the merit in his argument. But conviction alone doesn't suffice to render that argument meritorious, and I'm surprised and disappointed to see anyone here or elsewhere claim otherwise.

ReptileMan 7y ago

>Boeing instructed pilots to deal with excessive downward pitching That is my favorite newspeak so far.

EddieCPU 7y ago
@ReptileMan >> Boeing instructed pilots to deal with excessive downward pitching > That is my favorite newspeak so far Going by the faded out aspect of your post, someone here doesn't like you quoting facts.

throw7 7y ago

When the FAA Chief of Aviation Safety says there was "nothing he could have done", that is sign of deep systemic problems where someone else is to blame.

6gvONxR4sf7o 7y ago

This reminds me of the debate around not-quite-self-driving cars. Saying the product is safe to use, but that the user must be ready to do X immediately, despite evidence that the users you're selling to won't be ready to do X immediately. Then when people die you get to say it was totally safe, if they'd just done what they were supposed to do. Or we could just design products that will be safe in the real world, rather than ones that could have been safe in a utopia of perfect people.

ChuckNorris89 7y ago
At least most car manufacturers, apart from one(guess who that is) are honest in the marketing about what the features is, a more advanced lane assist and don't sell it as self driving.
ScalaFan 7y ago
Certain items just have a danger level that requires an elevated sense of responsibility and awareness and I don't just mean firearms. Workshop tools like power saws or table saws need to be handled with respect and care and those that cannot provide it should just not use them. Those that have worked in some kinds of environments know what I mean. Some factories or manufacturing places have lots of extra safety regulations. Those that have been in the military also know of dynamic and changing circumstances of their operating environment with all the specific equipment they use. Even on a sailboat you need to be aware of the boom.
- puzzledobserver 7y ago
  As do cars. Which is why people need licenses to drive them. The question being asked is whether it is ethical for a company to market auto-pilot low-awareness chainsaws, designed to give the user only a half-second heads-up, and then disclaim responsibility when accidents happen. Maybe the solution is for licensing authorities to call these auto-manual chimeras unlicenseable.
  - dredmorbius 7y ago

EddieCPU 7y ago

“Boeing decided to place the engines farther forward, just in front of the wing. The new position, and the greater thrust of the engines, produced an aerodynamic challenge during a maneuver called a windup turn — a steep, banked spiral that brings a plane to the point of stall, which is required for safety tests, though it’s rarely used in typical flying.” This is a curiously disingenuous statement. Not only at ‘windup turn’ and not only for “safety tests”, but most importantly when the engines were at maximum thrust such as at take off. Causing the air-frame to experience a pronounced nose-up attitude. The nacelles adding even more upward thrust. ‘Boeing settled on a software feature called the Maneuvering Characteristics Augmentation System. As the nose of the jet approached a high angle, suggesting an oncoming stall, MCAS would adjust the stabilizer on the plane’s tail, pushing the nose down, to alleviate the slackness in the control column. “They were trying to make it feel the same, so the pilots wouldn’t require training,”’ No, they didn't tell the pilots as this would require retraining and this would require re-certification. “Boeing considered the MCAS feature to be so minor that it removed mention of it from the 737 MAX’s pilot manual.” Boeing lied by omission, that's why when MCAS kicked in on those two crashes the pilots were unaware of MCAS and had no way of knowing how to recover from an MCAS induced nose dive. It was Boeing executive decisions killed those people. If this had happened in the US there would have been uproar by now.

kpU8efre7r 7y ago

If Boeing had a dick Walter Bright would be sucking it. Boeing makes planes that kill pilots and passengers. I don't know why that's so hard to say.

dang 7y ago
We've banned this account for breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future.

V_Terranova_Jr 7y ago

I'm an Aerospace Engineer, currently working for the U.S. Gov, but have spent time on the Industry side. I don't have a thesis per se after reading this, but several thoughts: - I don't think it's unfair to vilify Boeing's accumulated divergence from "doing the right thing". On the other hand, it's quite sad that it takes significant events like this to force anyone to act against the long-term pressure of corporate behavior that leads to such events. - As per a thread I had with WalterBright, https://news.ycombinator.com/item?id=21037522 https://news.ycombinator.com/item?id=21037522 , I agree Airbus has a number of significant flaws in their vehicle management systems for which there has been insufficient criticism and action. - It's not easy being on the side of the gov/regulators. There is continuous pressure from industry, and from up the management/political chain, to be a cooperative partner. Especially in light of how quickly industry can execute tasks, it's very hard to say "we need to take a pause" or "we need to go back, do some more homework, and be deliberative about this". If the gov/regulator is excessively slow, there are concrete costs that industry incurs. These realities, with the continued pressure, have trended in the U.S. to lead to ultimately less effective oversight. - The U.S. Government insufficiently values in-house technical expertise. In the aerospace realm, NASA is the principal exception. But within the DoD and FAA, while there is is technical expertise, much heavy-duty technical lifting is done by FFRDCs (e.g., Aerospace Corp., MITRE's CAASD, the national labs) or UARCs (e.g., Johns Hopkins Univ's Applied Physics Lab). In my view, the DoD and FAA should build in-house engineering capability sufficient to properly oversee and advise major programs without having to outsource as much as they do. You cannot do an effective job overseeing complex engineering developments if you are insufficiently technically-competent. The DoD is starting to realize this and places like AFRL are starting to swing back toward that direction, but there's a very very long way to go. If you are going to effectively push back against industry pressure, you have to be equipped to make strong technical arguments, not just appeals to precedent or vague statements about risk. - If you can find people with the right mindset and competence levels, it's better, in my view to have ex-Industry engineers working for the government. Those that go straight from school to government don't often have direct experience as practitioners, and as per my previous point, that often makes them less effective than they could be. - "Follow the plan," from the article, sounds exactly like what I've heard from Boeing. The article captured well the context and implications of that kind of talk. - "... engineers had to accept that they were no longer the center of the universe" really resonated with my own experience at another (non-Boeing) large American aerospace company. I was told by the man in charge of a major subsystem discipline that "engineering is out of favor [with the company management]". He was an engineer and on the side of engineers, he was just telling it the way it was. I couldn't believe what I heard then, and decades later, still can't believe it. How can engineering be "out of favor" in a company that specifically engineers systems at the edge of what humans can accomplish in hardware? I think you will find most large American aerospace companies helmed by people who really see no irony in making statements like that. - The aerospace industry is not one I would encourage my children to work in. I'm driven heavily by my passion for aerospace - it's an integral part of my identity. But it's really hard in industry to find job security, avoid rampant pigeonholing, avoid corporate mistreatment, work on multiple well-executed flight programs in your career (the equivalent of "shipping" software), and generally work somewhere where there is a strong corporate motivation to "do the right thing". It's a lot harder than in software for the corporate culture to not permeate everything around you because of how capital-intensive the field is. Also, the U.S. Government sucks as a customer, which makes it harder for small companies to thrive in the field. The job security issue can go away if you work in government, but then your ability to be an implementer (why a lot of people become engineers) also diminishes.