3 ms·

You can also read the Boeing documents. The hazard analysis listed MCAS as hazardous. By Boeing process controls, that should have mandated redundant sensors.

by bumby 2y ago

You can also read the Boeing documents. The hazard analysis listed MCAS as hazardous. By Boeing process controls, that should have mandated redundant sensors. Why were they optional? Because that could increase profits. (Seattle Times has done good reporting on this).

WalterBright 2y ago
Boeing indeed has a failure here, and is responsible for it. But as the first LA incident confirms, the pilots, by following their training, were able to deal with it. It was the subsequent flight on the same airplane that crashed. This remains omitted by the mass media, which contraindicates any of the reporting on it as "good". There is also responsibility in the production of a faulty AOA sensor, and the failure of LA to fix the known faulty sensor, or inform the crew, before authorizing the next, fatal, flight.
- bumby 2y ago
  I disagree. The media has covered the training (or lack of it) extensively. It seems like you want to point to a singular cause. As with most mishaps with complex systems, it’s the result of a cascade of failures. Training is only one part of the problem. Fixing that is still only an administrative mitigation which is the least desirable form of mitigation when designing a safety system. Even if the pilots had additional training, it wouldn’t fix the root cause of the issue and is just asking for trouble because administrative fixes “only” require humans to act perfectly in accordance with their training, all the time.
  - WalterBright 2y ago
    > The media has covered the training (or lack of it) extensively. I've never seen it in the media. Not knowing what the stab trim cutoff switch does is a massive failure either on the part of the pilot or the training. Not reading the Emergency Airworthiness Directive is a failure of the pilot. > It seems like you want to point to a singular cause Au contraire. It seems that everyone but me wants to blame a singular cause - Boeing. There was a cascade of failure here: 1. A defective AOA sensor was manufactured and installed 2. After the first LA incident landed safely, LA failed to correct the problem before sending the airplane aloft again 3. Single path MCAS inputs could not detect failure 4. Pilots failed to apply known emergency procedures > require humans to act perfectly in accordance with their training, all the time. Of course we try to design airplanes so they do not cause emergencies. But we still need pilots to train to react to emergencies. You don't put a person in the pilot seat who is not well-trained in emergency procedures. Making airplane travel safe means identify and correct ALL causes in the cascade of failures. Most accidents are a combination of airplane failure and pilot failure. Sometimes pilots make deadly mistakes. That's why we have copilots, they check each other. But in the MAX crashes, both pilot and copilot failed to follow known emergency procedures. Why they didn't, I have no idea.
    - bumby 2y ago
      "Boeing" is not a cause. Things like their safety culture can be a cause, or lack of good process control can be a cause. The reason why Boeing is catching a lot of flack is because they deviated substantially from best practices. This is related to your other comment so I'll just respond here. There is a general hierarchy when it comes to controlling hazards (remember, Boeing already identified MCAS as hazardous): remove the hazard, engineering controls, administrative controls, and PPE. We can apply a little thought experiment to see the gaps in what you're advocating when it comes to the MCAS issue. (Admittedly, this is contrived to just illustrate the point within the confines of a forum reply). 1) Remove the hazard: They could have redesigned the airframe to adjust the center-of-gravity to remove the stall issue that MCAS was developed in the first place. Why didn't Boeing do this? Because of cost and schedule pressure to have a new plane ready, after threats that American Airlines would take their business elsewhere. 2) Engineering controls: MCAS was an engineering control, but an incomplete one. Because MCAS was listed as "hazardous" in the hazard analysis it required redundant sensors. Why didn't they put on redundant sensors as the default? I can only speculate, but considering they were sold as optional, profit motive seems likely. (This also ignores the fact that MCAS should have been categorized as 'catastrophic' meaning they didn't fully understand the impacts of their system) 3) Administative controls: this was the training piece that you're hanging your hat on. This has multiple problems. For one, even though MCAS changed the handling dynamics of the airframe, Boeing pushed hard to reuse the same certification to avoid additional pilot training. Again, this was a business decision to make the airframe more competitive. Secondly, administrative controls are an inherently weak because of human factors. There's a lot that can go wrong if your plan is to have humans follow an administatrive procedure. You claim "it's not hard". Sorry, this is just a bad mindset. Usually when I hear people say things like "it's not hard" or "all you've gotta do" when they're talking about complex systems, it indicates they take an overly simplified mental model. In this case, you may be ignoring the chaos in the cockpit, the fact that the plane has handling characteristics different from what the pilots were trained on, human factors related to stab trim force at speed, conflicting or confusing information (like why the MCAS comes on at changing timeframes, time criticality, etc. Having adminstrative controls as your main mitigation is bad practice, and setting the system up for failure. 4) PPE: this isn't particularly relevant to this case, but a silly example of PPE control is giving everyone parachutes and helmets in case things went south. You can obviously see PPE is an absurd control. But your main point is that the main control should be administrative, which is the next worst option. Boeing ignored good safety practice to pursue profit. So they probably deserve some of the heat they are getting.

by bumby 2y ago

WalterBright 2y ago

Boeing indeed has a failure here, and is responsible for it. But as the first LA incident confirms, the pilots, by following their training, were able to deal with it. It was the subsequent flight on the same airplane that crashed. This remains omitted by the mass media, which contraindicates any of the reporting on it as "good". There is also responsibility in the production of a faulty AOA sensor, and the failure of LA to fix the known faulty sensor, or inform the crew, before authorizing the next, fatal, flight.

bumby 2y ago
I disagree. The media has covered the training (or lack of it) extensively. It seems like you want to point to a singular cause. As with most mishaps with complex systems, it’s the result of a cascade of failures. Training is only one part of the problem. Fixing that is still only an administrative mitigation which is the least desirable form of mitigation when designing a safety system. Even if the pilots had additional training, it wouldn’t fix the root cause of the issue and is just asking for trouble because administrative fixes “only” require humans to act perfectly in accordance with their training, all the time.
- WalterBright 2y ago
  > The media has covered the training (or lack of it) extensively. I've never seen it in the media. Not knowing what the stab trim cutoff switch does is a massive failure either on the part of the pilot or the training. Not reading the Emergency Airworthiness Directive is a failure of the pilot. > It seems like you want to point to a singular cause Au contraire. It seems that everyone but me wants to blame a singular cause - Boeing. There was a cascade of failure here: 1. A defective AOA sensor was manufactured and installed 2. After the first LA incident landed safely, LA failed to correct the problem before sending the airplane aloft again 3. Single path MCAS inputs could not detect failure 4. Pilots failed to apply known emergency procedures > require humans to act perfectly in accordance with their training, all the time. Of course we try to design airplanes so they do not cause emergencies. But we still need pilots to train to react to emergencies. You don't put a person in the pilot seat who is not well-trained in emergency procedures. Making airplane travel safe means identify and correct ALL causes in the cascade of failures. Most accidents are a combination of airplane failure and pilot failure. Sometimes pilots make deadly mistakes. That's why we have copilots, they check each other. But in the MAX crashes, both pilot and copilot failed to follow known emergency procedures. Why they didn't, I have no idea.
  - bumby 2y ago
    "Boeing" is not a cause. Things like their safety culture can be a cause, or lack of good process control can be a cause. The reason why Boeing is catching a lot of flack is because they deviated substantially from best practices. This is related to your other comment so I'll just respond here. There is a general hierarchy when it comes to controlling hazards (remember, Boeing already identified MCAS as hazardous): remove the hazard, engineering controls, administrative controls, and PPE. We can apply a little thought experiment to see the gaps in what you're advocating when it comes to the MCAS issue. (Admittedly, this is contrived to just illustrate the point within the confines of a forum reply). 1) Remove the hazard: They could have redesigned the airframe to adjust the center-of-gravity to remove the stall issue that MCAS was developed in the first place. Why didn't Boeing do this? Because of cost and schedule pressure to have a new plane ready, after threats that American Airlines would take their business elsewhere. 2) Engineering controls: MCAS was an engineering control, but an incomplete one. Because MCAS was listed as "hazardous" in the hazard analysis it required redundant sensors. Why didn't they put on redundant sensors as the default? I can only speculate, but considering they were sold as optional, profit motive seems likely. (This also ignores the fact that MCAS should have been categorized as 'catastrophic' meaning they didn't fully understand the impacts of their system) 3) Administative controls: this was the training piece that you're hanging your hat on. This has multiple problems. For one, even though MCAS changed the handling dynamics of the airframe, Boeing pushed hard to reuse the same certification to avoid additional pilot training. Again, this was a business decision to make the airframe more competitive. Secondly, administrative controls are an inherently weak because of human factors. There's a lot that can go wrong if your plan is to have humans follow an administatrive procedure. You claim "it's not hard". Sorry, this is just a bad mindset. Usually when I hear people say things like "it's not hard" or "all you've gotta do" when they're talking about complex systems, it indicates they take an overly simplified mental model. In this case, you may be ignoring the chaos in the cockpit, the fact that the plane has handling characteristics different from what the pilots were trained on, human factors related to stab trim force at speed, conflicting or confusing information (like why the MCAS comes on at changing timeframes, time criticality, etc. Having adminstrative controls as your main mitigation is bad practice, and setting the system up for failure. 4) PPE: this isn't particularly relevant to this case, but a silly example of PPE control is giving everyone parachutes and helmets in case things went south. You can obviously see PPE is an absurd control. But your main point is that the main control should be administrative, which is the next worst option. Boeing ignored good safety practice to pursue profit. So they probably deserve some of the heat they are getting.