4 ms·

The EAD was unfortunately and unnecessarily ambiguous. A couple of paragraphs before noting "Electric stabilizer trim can be used to neutralize control column p

The EAD was unfortunately and unnecessarily ambiguous. A couple of paragraphs before noting "Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT", it says "In the event an uncommanded nose down stabilizer trim is experienced on the 737-8/-9, in conjunction with one or more of the indications or effects listed below, do the existing AFM Runaway Stabilizer procedure above, ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight." [my emphasis.] Furthermore, the instructions that this EAD amend do not state that there are any circumstances where it is important to reestablish trim electrically before performing the cutout; in fact, they explicitly say to cut out the electric trim and trim manually if disengaging the autopilot fails to correct the problem - and in the case of MCAS runaway, it will not. This is particularly relevant in the context of another issue: when the EAD's authors wrote "Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT", they missed an opportunity to point out that if the airplane is significantly out of trim (which is what tended to happen when MCAS went rogue), the load on the stabilizer jackscrew made it difficult or impossible to trim manually. Elsewhere in the AFM, and not referenced by either the original runaway trim procedure or this EAD, it says "Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming." Note that, in the case of an MCAS-initiated mis-trim, "aerodynamically relieve the airloads" means "stop pulling on the yoke to hold the nose up", and if you are already descending and close to the ground, this makes the situation worse before you can hope to make it better. There were other missed opportunities here. Firstly, the authors did not mention that in an MCAS-caused trim runaway, the rate of change of stabilizer angle was much higher than in the case of autopilot-caused runaways (significantly, at the time of this EAD, the FAA did not know how fast that was, as it had been increased after flight testing without the FAA being informed.) They also did not mention that, unlike in the case of an autopilot-caused runaway, one caused by MCAS cannot be stopped by opposing it with the yoke. Technically, the EAD gave pilots sufficient information to handle MCAS runaways, but it was the bare minimum, poorly presented, which lies somewhere on the shoddy - negligence - malfeasance axis when it comes to safety. Did Boeing keep it to the bare minimum to minimize the possibility of more pilot training being re-raised? I don't know, and maybe we never will.

WalterBright 5y ago
The EAD indeed reads like it was edited by more than one person. But if the EAD was not clear to a pilot, the pilot should request clarification. It's his job to understand it. Note also that all three crews repeatedly were able to override MCAS and restore normal trim.
- mannykannot 5y ago
  > But if the EAD was not clear to a pilot, the pilot should request clarification. It's his job to understand it. It is not surprising that neither the community of pilots, nor that of those responsible for training them, noticed that there was a problem here, given that relevant information was being withheld in some cases and downplayed in others, in order to give cover for the fiction that everything was the same as before. And even without Boeing putting itself into a conflict of interests, the policy implied by your comment is not how it works, and it would be a very bad policy if it were implemented. We did not get to the generally excellent safety record of airline operations we have today by manufacturers giving minimal or ambiguous instructions and partial information, and then leaving the pilots and operators to figure it out from there. > Note also that all three crews repeatedly were able to override MCAS and restore normal trim. And if they had gone through some training on how trim runaway caused by MCAS differs from other cases, such as that caused by the autopilot, they may well not have crashed.
- ceejayoz 5y ago
  That a document is unclear is not always detectable at the time of reading. Lots of us have had the experience of reading code, thinking we understand it, and later finding out a subtle but important bug.
  - salawat 5y ago
    This is why when dealing with something that can carry 300 souls, you need to be more worried about making sure you unambiguously resolve the context in question; even if it means you have to embed a system description as an attachment. Boeing had a conflict of interest there. They were deliberately attempting to not tip off regulators or pilots that the thing was implemented the way it was. Anyone reasonable faced with the actual set of tradeoffs made that resulted in the tooling for mass production of that particular assembly of systems would be appalled. I can't even blame anyone who worked there in good faith for not necessarily making the intuitive leap that there was something smelly in the works. When you're in the weeds, if you aren't a systems integrator, or a nutjob like me who must absolutely be able to reasonably model the thing under test in one's own head before feeling confident on signing off on something, you have to have a degree of faith in your process. I don't. Ever. That's why everyone I've met thinks I'm nuts. I replace parts of myself with models of business processes so I can reason about where highly complex systems/machines/networks of human understanding and machine interaction will break down. Even from a rank amateur's point of view, the communication failure was stark and eclipsed only by the realization that someone forced an infrastructure to mass produce the same potential miscommunication error/ constellation of communication failures as "an existential risk the business had to take" and a justified tradeoff in the race to remain competitive.

WalterBright 5y ago

The EAD indeed reads like it was edited by more than one person. But if the EAD was not clear to a pilot, the pilot should request clarification. It's his job to understand it. Note also that all three crews repeatedly were able to override MCAS and restore normal trim.

mannykannot 5y ago
> But if the EAD was not clear to a pilot, the pilot should request clarification. It's his job to understand it. It is not surprising that neither the community of pilots, nor that of those responsible for training them, noticed that there was a problem here, given that relevant information was being withheld in some cases and downplayed in others, in order to give cover for the fiction that everything was the same as before. And even without Boeing putting itself into a conflict of interests, the policy implied by your comment is not how it works, and it would be a very bad policy if it were implemented. We did not get to the generally excellent safety record of airline operations we have today by manufacturers giving minimal or ambiguous instructions and partial information, and then leaving the pilots and operators to figure it out from there. > Note also that all three crews repeatedly were able to override MCAS and restore normal trim. And if they had gone through some training on how trim runaway caused by MCAS differs from other cases, such as that caused by the autopilot, they may well not have crashed.
ceejayoz 5y ago
That a document is unclear is not always detectable at the time of reading. Lots of us have had the experience of reading code, thinking we understand it, and later finding out a subtle but important bug.
- salawat 5y ago
  This is why when dealing with something that can carry 300 souls, you need to be more worried about making sure you unambiguously resolve the context in question; even if it means you have to embed a system description as an attachment. Boeing had a conflict of interest there. They were deliberately attempting to not tip off regulators or pilots that the thing was implemented the way it was. Anyone reasonable faced with the actual set of tradeoffs made that resulted in the tooling for mass production of that particular assembly of systems would be appalled. I can't even blame anyone who worked there in good faith for not necessarily making the intuitive leap that there was something smelly in the works. When you're in the weeds, if you aren't a systems integrator, or a nutjob like me who must absolutely be able to reasonably model the thing under test in one's own head before feeling confident on signing off on something, you have to have a degree of faith in your process. I don't. Ever. That's why everyone I've met thinks I'm nuts. I replace parts of myself with models of business processes so I can reason about where highly complex systems/machines/networks of human understanding and machine interaction will break down. Even from a rank amateur's point of view, the communication failure was stark and eclipsed only by the realization that someone forced an infrastructure to mass produce the same potential miscommunication error/ constellation of communication failures as "an existential risk the business had to take" and a justified tradeoff in the race to remain competitive.