I had my first flight on the Max [to] ZZZ1. We found out we were scheduled to fly the aircraft on the way to the airport in the limo. We had a little time [to] review the essentials in the car. Otherwise we would have walked onto the plane cold.My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely. The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).We were unable to navigate to systems pages and lacked the knowledge of what systems information was available to us in the different phases of flight. Our weather radar competency was inadequate to safely navigate significant weather on that dark and stormy night. These are just a few issues that were not addressed in our training.I recommend the following to help crews w/ their introductory flight on the Max:Email notification the day before the flight (the email should include: Links - Training Video, PSOB and QRG and all relevant updates/FAQ's)SME (Subject Matter Expert) Observer - the role of the SME is to introduce systems navigation, display management, answer general questions and provide standardized best practices to the next generation aircraft.Additionally, the SME will collect de-identified data to provide to the training department for analysis and dissemination to the line pilots regarding FAQs and know systems differences as well best practices in fly the new model aircraft.
The problem is that if they had invested so much effort in training crews for the differences in the Max, it would be an admission that the Max and NG aren't so similar after all.
Making it look like a quick and easy switch is only making the problem more serious.
This is why corporations cannot police themselves and it's where the FAA dropped the ball.
I have no idea why many government websites (not just US) are like this; making things that are obviously not stateful (like viewing a report or search criteria) session-wide state. It almost feels somewhat intentional to prevent linking to resources.
The facts so far are that two new aircraft of the same model have crashed in a very short period of time, in the same stage of flight and exhibiting the same problem as evidenced by ATC recordings: loss of flight control.
We should not focus only on the software aspect, even though a very questionable (and dangerous in my opinion) decision was made to not communicate to the pilots the existence and operation of the software with no additional pilot training.
The software relied on input from sensors at least in the Lion Air crash and the fact is the sensors failed on new aircraft.
I would trust the NTSB as much as the European counterparts. I have read some of their reports and they are very dilligent and fair.
We should avoid placing blame now on anyone whether it is Boeing, pilots, national agencies, until the full reports are available. The grounding of the aircraft was perfectly justified with the available data from a security point of view.
The air industry has been focused on avoiding a blame culture. Even I, as a passenger sometimes look for the lowest price, so the pressure for cost cutting may come from us as well.
Reminds me of a story of a budget airliner cutting costs by buying used parts and patching them up. Now nobody had actually tried to do something so nuts/genius before so there weren't any clear cut regulations. Eventually there was an accident and the FAA started to put screws under the microscope and interrogate maintenance crew.
Thankfully the aviation industry nowadays out of self interest cares about safety.
In the likely event that this is another MCAS related crash, I see only two possible reasons:
1. Boeing's suggested process (including flipping the two trim switches and spinning a wheel) does not work for some reason.
2. The Ethiopian pilots did not follow this process.
I see #1 as putting a huge, huge amount of blame on Boeing and the FAA - especially given their months of "safe plane" reaction after Lion Air and their cavalier few days after Ethopian.
I see #2 as still keeping a good deal of blame on Boeing, but also adding a significant training+capability element to Ethiopian and the pilots. Since Lion Air, how much had Boeing done to specify that the 737-MAX and the 737-NG are not the same plane and require different things to be aware of? Could a 737-MAX pilot really not have run through in their head a thousand times what MCAS related issues look like and what they would do if they started having those issues?
I think both end up with blame on Boeing. If a discussion in world news isn't enough to prepare an experienced 737 pilot (ten years!) to counteract spurious MCAS, then nothing is, at least to the level of safety expected in airline travel.
A plausible explanation for (1) that I've seen discussed is that, after disabling the auto trim, it may be impossible to manually re-trim while the yoke's pulled back, without first relieving aerodynamic stress on the elevator -- in this case by pointing the nose even farther down temporarily, which no sane pilot is going to want to do close to the ground.
(I don't know whether it could actually happen this way.)
I think it's unlikely that this crash will be attributed to the same set of circumstances as the lion air crash. I don't find it credible that an experienced pilot would fail to catch what, in essence, is a trim runaway event. There is a reason trim runaway is a memory item on almost all aircraft. Even in the Lion air case the previous flight experienced difficulty with the system and dealt with it. This was before the publication and a great deal of publicity of the details around MCAS. I don't think we've heard anything yet to suggest this particular aircraft had a fault in previous flights. Another failure in the AoA sensor on a brand new aircraft seems unlikely.
I don't find 1 particularly compelling, it would have been noted by now if it was impossible to trim the aircraft using the manual trim wheels. Unless this is very specific to the MAX.
That said, I think it's entirely possible there is something else wrong in the control of the MAX.
> I don't find 1 particularly compelling, it would have been noted by now if it was impossible to trim the aircraft using the manual trim wheels.
It has been noted:
737 Flight Crew Training Manual, chapter Non-Normal Operations/Flight Controls, sub heading Manual Stabilizer trim:
"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the air loads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually."
In this case the excessive air load would be caused by the yoke control pulling the elevator up while the trim controlled stabilizer is doing the opposite.
Like you say, it's hard to know whether this actually happened.
What would it have to say? It says you might have to do X before Y, where Y is a thing that you need to do quickly while at low altitude to avoid dying and X is a thing that gives you even less time to do it in and makes the problem worse.
Let's work through an example. You are in level, trimmed, manual flight and the trim system suddenly starts pitching the nose down. As a consequence, the aircraft will begin descending and accelerating. Your first response, even before you have recognized that you have a trim runaway situation rather than just some turbulence, is to pull back, to restore level flight level and bring the speed down to where it is supposed to be. In other words, you are decelerating towards the in-trim speed, which is precisely what the quoted section of the manual is saying you should do.
Unfortunately I think you may be misinterpreting that section in the manual.
From your senario when the trim moves nose down. You apply nose up on the elevator which makes the trailing edge of the elevator go up which applies a downwards force on the trailing edge of the stabilizer. In order to move the trim back towards neural you need to lift the trailing edge against this force.
If the trim is extreme you may have to relax back pressure to reduce that force.
By in trim speed they mean the speed at which the aircraft would naturally settle at given the current trim setting.
You have a point, but I am not sure that this is a complete analysis of the situation, because it does not consider the changing moments as the centers of pressure of the wing and stabilizer move in response to the changing airspeed. Furthermore, when one moves the elevator of a subsonic airplane, it does not just change the force generated by the elevator, but also the force generated by the stabilizer it is attached to (by affecting the airflow over it), so that is another potential source of changing moments.
Perhaps the phrase "aerodynamically relieve the air loads" means to minimize the aerodynamic force generated by the stabilizer? The stabilizer of a conventional airplane will invariably generate a downwards force when the aircraft is in pitch equilibrium at high speed, but it may be upwards at low speed, even with the C of G within limits. In such cases, the speed at which it has no load will be an intermediate one, and therefore could be either above or below the speed to which the airplane is currently (mis-)trimmed.
The quoted passage says it is referring to correcting what it calls a mis-trim, so if your interpretation is correct, then where it says "in-trim speed", it actually means "the speed to which the airplane is mis-trimmed", while the general usage of the term "in trim" means trimmed to fly at the intended speed, and I would take the phrase "in-trim speed" to refer to that speed - the speed that the pilots intend to fly at, or, in other words, the speed that this out-of-trim airplane would tend to fly at when put back in trim.
Furthermore, if things are as you describe, then the rule could have been more simply and clearly phrased as "reduce your pressure on the control yoke". Maybe your interpretation is correct, but if so, it seems to me to be an unnecessarily confusing way to describe it.
Ok let's look at it another way. Do you think it's even remotely likely that Boeing haven't had one of their 737 Max aircraft try this out at a safe altitude? They staked the future of the aircraft by saying they believe they are safe to fly.
I've never suggested having a trim runaway close to the ground is trivial. It's certainly going to result in brown trousers when it happens, but it should be within the abilities of a well trained crew to handle.
Following the outcry over Lion air I just don't believe a pilot on type wouldn't have known the procedures for getting the aircraft to a safe altitude and disabling the stab trim.
As a pilot your hands are on the controls. You notice pretty instantly that your having to pull the nose up. You instinctively reach for the trim control on the yoke. This disables the MCAS system for 5 seconds. You get the pitch forces under control. A few seconds later MCAS decides you've still got the nose too high because of a faulty sensor and tries to trim it back down once more.
How many times before you remember that fatal bug from that crash a few months ago. Maybe twice? Three times tops.
I mean, the answer could be that you do that three times, then you remember that the emergency AD said that you should trip STAB TRIM CUTOUT when this happens, so you do, and then you realize that you're mistrimmed at less than 1000ft AGL, you just disabled the motor that was allowing you to fix the trim, and now you can't fix it without losing 600ft in the process while you release the yoke.
I am not saying this is likely to be what happened! But given that Boeing didn't even mention any of this in the manual before Lion Air, it seems plausible that they either didn't test it carefully, or tested it at high altitude and imagined that it would never happen at low altitude?
so I just happened to see the dramatization of this crash yesterday, and here boeing suggestion for a thrust reversal engaging in flight was likewise simple: cut throttle and fuel to engines. that was based under specific assumption of limited testing, while in the crash the pilot had 6 seconds between the engagement and total irrecoverable loss of control.
assuming that just because there's a process the plane is safe is somewhat disingenuous, as it is placing the blame as an 'either/or' preposition. it might be that training is insufficient, but pilots don't control the training material. and following a checklist is somewhat hard if the plane constantly pulls down.
> 1 can only be done after the problem is detected, which by then your plane is pointing dangerously down.
If you are referring to the documented procedure for recovering from a trim runaway, then all 737s would be dangerous, as this is the same procedure for trim runaway recovery as it is for the prior versions, and regardless of whether it is caused by an MCAS fault or for any other reason. The pilot is not expected to determine whether it is an MCAS fault before acting, because the recovery from runaway trim is the same, regardless of cause.
I was thinking about what you call '#2' the other day, when a family member remarked that the FAA was right to keep the planes in the sky because US airline unions felt like their pilots had received adequate advice and information from Boeing.
I'm not sure where they got that from, but why would it be okay if the US pilots got training immediately, while others had to wait?
It would be extremely irregular for an aviation company to give training / instruction to exclusive clubs.
The reality is that occident pilots tend to be a cut above the rest of the world. American Airline pilots tend to have military aviation experience and/or thousands of hours of experience. Pilots in less developed nations tend to have significantly less training, I heard the copilot of the lion air flight only had a few hundred hours of experience.
To have some idea about the possible time span, we can estimate some "typical" flight frequency and length: if the average flight is 2.5 hours there, and if the pilot flights both to the destination and back in the same day (which is reasonable to expect) 6000 hours means 1200 flights to the destination and back, and if only one such is done per day (with the times on the ground it's surely more than 8 hours) then assuming 4 of such per week and 48 working weeks per year, that gives 6.5 years for the pilot and 5.2 years for the co-pilot.
There is always option 3. Delay in processing of information and conflict resolution. It is possible the captains took to long to understand what is wrong, training or not and do the appropriate maneuvers to get the plane under control again.
Option 3 happening at 40,000 feet has a very much better chance of a positive outcome than at 4,000 feet
I think there is a certain amount of hindsight in your response to scenario 1. While there is a good case to be made that Boeing was wrong to minimize the differences between the latest models and their predecessors, the Lion Air crash investigation did not produce any evidence that an MCAS fault could not be remedied by following the published procedure, and as far as I can tell, no other incidents prior to the Ethiopian Airlines crash have suggested that that, either. Up until possibly this crash, there has been no evidence that an MCAS fault presents any more risk, with a properly informed pilot at the controls, than would a trim runaway in the prior models. That is considered to be an acceptable risk, and the issue with properly informing pilots seemed to have been addressed.
They should have reacted faster after the latest crash, but fortunately this delay has had no consequences.
One would hope that the question of MCAS not being triply redundant will be reassessed, but the argument that it could do no more harm than a fault in the existing trim mechanism is not an unreasonable one, again if considered without hindsight.
Perhaps it's just because I've been trying in vain to make similar points but I don't understand why you've been down voted here. It seems the only acceptable response is that Boeing deliberately killed people by trying to subvert the certification requirements and/or failing to inform pilots of a new system.
Let's preface this by saying I am aware that cause of the accident has not been determined. Seeing reports of experienced pilots being assigned to 737 MAXs without prior flight experience of this precise model, prompts me to make this comment.
As a passenger I expect pilots to fully know the plane they are flying and to previously have flown this exact type and model of aircraft in training sessions without any passengers whatsoever. 737 MAXs seem to have significant differences compared to other 737 models and airlines appear criminally negligent in the use of these aircraft.
I used to be a mere bus driver as a college job and I _had_ to train on all models before transporting any sort of organism with a central nervous system.
But apparently, flying hundreds of people at hundreds of mph at several thousand feet above the ground doesn't require this sort of familiarity with the machine. Having flown other 737s and skimming a manual 20mins before departure was often deemed sufficient, resulting in flabbergasted and overwhelmed pilots.
Boeing, FAA, airlines... whoever is ultimately blamed in all of this, the crash has revealed some scary stories in regards to aviation - all for the sake of cutting costs because people demand to fly across continents for $100.
To clarify, I meant passengers. Copilots and engineers are fine and likely even necessary to properly train and deal with the new challenges.
As a daily driver of your own car, if you do own one, then it might be apparent how different they can be. I constantly switch between automatic Mercedes and BMWs.
Both have a near identical handle on the right side of the steering wheel. One turns on wipers (BMW), the other one shifts gears... (Benz). Imagine that on a plane with worse consequences than accidentally shifting into neutral when it rains.
You don't do non-revenue training flights on full-size jetliners. It's way too expensive. You learn to fly (period) on small planes that can't hold passengers at all, then you train in simulators for a specific model, and then finally you're paired up with a more experienced pilot once you start flying it for real.
They definitely did not do the proper training that was merited here, but the proper training is not and never was flying a large jetliner empty.
Funny enough, I remember seeing a 737 doing circuits at Prestwick airport. I believe there is (or used to be) some requirement for an airline to do a minimum number of circuits on a new type. Kinda fun to see. Apparently a lot of fun for pilots to do.
That makes a lot of sense, but shouldn't simulators be updated/upgraded for significantly different models?
One would expect that X hours in a simulator help you adapt to a new aircraft type.
I didn't intend to demand economically stupid things like flying an large aircraft empty for training, just wanted to express that as a passenger I want my pilot to know their way around the machine that keeps me 10km above ground at 600km/h.
I work in the simulation industry, and once a simulator is certified for training, you cant "update it" to another model. The customer has to buy a new 737 MAX sim. However, since the 737ng and 737 MAX are common type (meaning that in the eyes of the authorities, if you're licensed for one, you're licensed for both) customers aren't REQUIRED to get a 737 MAX sim granted that they already have a 737ng sim.
Just to clarify: you can udpate a simulator and recertifie it. e.g. in regard to the motion or visual systems etc etc. But to transform a simulator into another aircraft would be beyond economically sane.
"I had my first flight on the Max [to] ZZZ1. We found out we were scheduled to fly the aircraft on the way to the airport in the limo. We had a little time [to] review the essentials in the car. Otherwise we would have walked onto the plane cold. My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely.
The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material)."
FAA is not responsible for the crashes but for not taking any precautionary measure in the US even with reports as the one linked above coming in. Their role isn't just reactive but also proactive. The report above is coming from a US pilot:
> State Reference : US
> B737 MAX First Officer reported feeling unprepared for first flight in the MAX, citing inadequate training.
From another comment below (a simulator industry insider):
> However, since the 737ng and 737 MAX are common type (meaning that in the eyes of the authorities, if you're licensed for one, you're licensed for both) customers aren't REQUIRED to get a 737 MAX sim granted that they already have a 737ng sim.
This is where the FAA could have intervened. Pilots consider them different enough to warrant training so it should have been clear for the FAA too. But they accept this compromise to allow companies to cut costs.
And the scary thing is that a new pilot will also get to train on an old NG sim before flying a (different) MAX plane. Unlike experience pilots, a new one would have little flying experience to fall back on and the FAA allows them to fly a plane after being trained on what might as well be a sim for a different plane.
>> As a passenger I expect pilots to fully know the plane they are flying
Never going to happen. Modern aircraft are far too complex for anyone to have this sort of complete knowledge, let alone be able to use it properly in a crisis. This one reason, of many, that pilots work from checklists created by the manufacturer.
archive.is/fo basically doesn't work with cloudflare DNS due to a misconfiguration by whomever runs the archive.today service. It has been reported by multiple people to the site operator and at this point it seems likely intentional.
Ah ok, didn't try that. All good, I made it past the big beautiful paywall. At work I don't use ad blockers etc.
What they could do is allow everyone in, but reveal each paragraph progressively by viewing ads right there between the paragraphs. Or feeding the meter coins.
Time delayed progressively revealed articles. Pay the fee to unlock all paragraphs.
Or they need granular payment, yes I would pay 1 cent for the next 10 paragraphs. But I don't want to create an account with the publisher to do that. Kind of how I don't sign up to the parking block company to buy a spot for 5 hours in their car park.
Before the wild speculation, here's some words from an actual aviation expert, Greg Feith:
It is sad to hear some of the “junior investigator” talking heads make a storyline out of factoids or no facts about the 737 MAX. They embellish their credentials to sound smart when in fact they have no clue and say things about analyzing data that doesn’t exist....
A good friend of mine who is a former airline captain and flight safety professional ant be the following:
“The VAST majority of the inane comments and knee jerk industry reactions on FB and AV Herald are based on no valid nor substantiated information regarding the MAX aircraft.
However, NO one is talking about the pilots, nor the airlines involved, nor the training, nor the experience of the pilots. It IS WELL BEYOND time that these direct factors are understood, investigated and considered a possible contributor to the two distinct MAX accidents.
The accident information in news articles dated 11/28/2018 indicated that the previous crew at Lion Air had experienced the MCAS issue but CORRECTLY dealt with it by disconnecting the stab trim cutouts - as expected in the NNC (non-normal checklist) yet the accident crew could not figure it out. Why the plane was dispatched in an unairworthy condition needs to be addressed and why one crew did and the accident crew did not figure it out the system issues needs to be explored because the deficiencies with the accident flight crew can be traced back to inadequate or deficient training and like suspect pilot qualifications!”
EDIT: Given the rain of downvotes, it looks like a lot of HNers are convinced that mustache twirling villains at Boeing are responsible for the crash, which is extraordinarily unlikely.
Your edit breaks the site guidelines, which ask: Please don't comment about the voting on comments. It never does any good, and it makes boring reading.
Yes it can sting when one's comment is downvoted, but the guidelines ask all of us not to react in the usual tedious and sarcastic ways. A better approach is to take a moment to reflect on what in your comment might have attracted downvotes; if you notice anything to improve in the future, note it; and if you don't, just move on.
It’s boring to read HN wildly speculate on the crash and trash Boeing as if they know what went wrong. Historically speaking, early speculation has nearly always been notoriously bad at predicting what went wrong in a given crash scenario. Despite this happening twice it is still a sixth sigma event, there is no reason to think the exact same set of circumstances occurred twice, especially after pilots were well aware of the MCAS system post Lion-air. I’m sure Boeing deserves a large part of the blame in the end, but I’m also sure that unanticipated pilot error is at the nexus of both events. You can’t anticipate every pilot failure mode, and since this wasn’t lost at sea we have the luxury of waiting for the final report. For all we know it wasn’t a design defect, but an improperly maintained sensor, or pilots who failed to look at the logbook. I see people already talking about how “capitalism has failed” and “lets imprison Boeing execs” which sounds more like Chinese astroturfing than good-faith posting. It could even turn out the two events were independent, a statistical analysis across all jets probably shows the likelihood of two planes of the same type crashing within 6 months of each other is more likely than our intuition suggests, because the Pareto distribution applies to every plane type in the entire world.
No doubt many people will turn out to be wrong about this. You simply need to make your points without breaking the site guidelines, as do we all.
You've unfortunately broken them again just now. It's explicitly against the guidelines to insinuate that people you disagree with are astroturfers. Would you mind re-reading https://news.ycombinator.com/newsguidelines.html and following them carefully when posting here? We don't need you to change your views, just express them within the limits specified. We have those limits because we're trying to preserve the commons for everyone.
Nice to see HN finally has a semi-active moderator. As you can see I’ve taken quite the hiatus from HN because the noise to signal ratio got really bad.
I don’t care about downvotes, if I did I wouldn’t post my actual opinions here, I just found it silly that people were trying to bury a comment that wasn’t the standard doom and gloom and ignorance I see around the crash.
Interestingly as soon as I edited my post the downvotes stopped and I started getting upvotes so some people found the edit interesting. :thinking emoji:
If you care to hear from someone who has been part of this community since early days, too many people are able to vote on comments. They don’t lurk, they are attracted here from a controversial link and stick around, reflexively treating upvotes/downvotes as a disagree/agree button instead of interesting/not-interesting like it used to be. Maybe the eternal September has finally arrived for good, or perhaps I’ve drifted from the core values of your typical HNer while this site stayed the same or drifted in a different direction. Only you would have the traffic and usage stats to know. I’m curious what percent of active HNers have an account created within a standard deviation of mine.
Ethiopian has ~100 planes flying around on any given day, and hasn't had a serious crash in 9 years. Presumably the skill of their pilots and maintenance crews is pretty similiar across MAX and non-MAX planes.
If their maintenance crew and pilots were solely to blame, I would expect to see a good deal more Ethiopian planes crashing.
Of course, it could be (and maybe even is likely) that a properly trained maintenance crew won't let the AoA sensor fly in a bad state. And of course it could be (and maybe even is likely) that a properly trained pilot will be able to correct the issue in flight.
But that doesn't pass the blame. The truth is that Ethiopian pilots and maintenance crews seem totally capable of keeping the rest of their planes in the air. Why has Boeing made a plane that is so much harder for them to fly safely? Is there any argument that the MAX is easier or safer to maintain/fly than the other planes Ethiopian flies?
The same chassis, but with larger engines, placed higher on the wing giving rise to different handling characteristics, especially at the edges of the performance envelope. The instrument layout is different and center panel control locations differ. Both of these changes lead to different instrument scan procedures and in the event of a high-stress condition --when seconds count, as instincts and muscle-memory kick in-- it feels like a different aircraft.
> Ethiopian has ~100 planes flying around on any given day, and hasn't had a serious crash in 9 years
They had one last week.
Southwest, by comparison, has been flying since 1967. They operate over 700 aircraft, all of them 737s including the new MAX variant. They've never had a serious crash and in their history have had 3 deaths as a result of accidents or incidents.
1. The standard for pilots and their training worldwide is very high and the safety records of the Lion Air crew and the Ethiopian crew reflects this. Training and metrics for pilots is similar around the globe, airline companies are worldwide and pilots often work overseas. We absolutely should not think of pilots and their training standards as being associated with nationality or location because that doesn't reflect reality.
2. The sentiment that some pilots can figure it out and others can't so we need better screening/training to deal with faulty equipment is wrong-headed. Pilots shouldn't have to waste any of their attention during flight dealing with engineering failures. Furthermore they should be informed of any changes that are made to their equipment, which it seems Boeing didn't do when they updated the pitch override software.
The wild speculation presumably includes British and Australian authorities — who have exemplary safety records, are nobody’s fools, and are very definitely run by very very senior and experienced people — banning the planes.
ASRS reports describing similar incidents and complaints about insufficient training and incomplete manuals. It looks like Boeing was able to get 737-Max pass as 737-NG variant without good differences training and better manuals.
He is right about one thing - looking at the maintenance logbook is a standard part of any preflight. If you looked at the logbook and saw that the maintenance team had been dueling with the MCAS system and that it had activated inappropriately on four prior occasions, that really should have been at the front of their minds.
It seriously is a standard heads-up to alert you to any potential issues that might occur with the aircraft. Inoperative systems, etc.
Even in general aviation, if you look at the logbook and see this is the first time this aircraft has flown since an engine teardown, you want to be aware of that in the light of monitoring your engine's readouts. If you suddenly see that the oil pressure is dropping or something, that's something you would immediately want to take seriously. Recent maintenance can be the difference between "I'll have the mechanic look at that when I get back" and immediately taking corrective action.
There was a plane (Cessna iirc) nearby me that went down from a similar issue. When you change the oil there is a drain tube and some leftover oil tends to drip out all over the cowling. The mechanic apparently got in the habit of rolling up some paper towel and shoving it in the drain tube to absorb the drips. Well, this time he forgot to close the drain cock. It held enough pressure to take off apparently, then blew out in-flight and the engine seized. You gotta watch for that stuff, first person to fly an aircraft after a maintenance issue needs to be aware of it.
(immediately taking corrective action is safer but planes are complex and if you immediately turned around the first time an engine ran a little hot you'd never get anywhere. They have redundant systems for a reason, and if anything commercial airliners are even more redundant and even more willing to fly with inoperative non-essential equipment, because there's so much money on the line. Commercial airliners fly with equipment that's broken literally all the time, there is very probably broken equipment on any given flight you take... more like probably several pieces broken.)
Not to say that the pilots here didn't do everything right... we don't know yet either way. Boeing certainly has some 'splaining to do regardless, there are design flaws here that apparently have caused this problem to occur quite frequently. Just because you hope the pilots would have caught it doesn't mean you want to tempt fate repeatedly.
He is right about one thing - looking at the maintenance logbook is a standard part of any preflight. If you looked at the logbook and saw that the maintenance team had been dueling with the MCAS system and that it had activated inappropriately on four prior occasions, that really should have been at the front of their minds.
You're absolutely right. Unfortunately the crew read the logbook and saw an STS (speed trim system) issue written up. When flight 610's crew looked at the logbook, nobody outside the Brazilian authorities knew what MCAS was or to expect anything like it.
STS trims the stabilizer under different conditions than MCAS and typically trims in a counter-intuitive manner, conditioning pilots to non-intuitive trim adjustments in normal flight. STS can be turned off for the duration by applying pressure in the opposite direction on the yoke, MCAS cannot.
With that in mind, yeah, the crew on flight 610 had a malfunction at the front of their minds. Just not the kind that was going to transpire.
It's bewildering how even 2 would be sufficient. You'd expect some kind of 3 way setup where a single sensor failure is detected via majority quorum. Especially for anything that directly has the ability to alter control planes on the aircraft.
Having optional safety features on an airplane (i.e. not standard equipment) strikes me as being significantly more egregious (Edit: more so than on vehicles like cars/trucks for the general population). Considering how complex these things are already, how does this not unnecessarily increase the cognitive load on pilots? "Oh, I guess I'm flying the basic trim level airplane today, I better be cognizant of the fact that it lacks features X, Y and Z"
I agree with you. I think in practise the feature choices are made per-airline, perhaps to avoid the pilot confusion you mention. "AOA disagree" specifically seems to have been purchased by only the North American airlines that use the MAX.
I'm still trying to wrap my head around the fact that an error warning can be an optional paid extra, even when the error being reported is that sensors are malfunctioning in a way that will cause the plane to override stick input and fly itself into the ground.
There is some complicated explanation: the AOA disagree alert requires the presence of the visual AOA indicators, and it's those indicators that are the paid upgrade, and the alert comes along for the ride with them.
Why would AOA indicators be a paid upgrade? Isn't that a pretty fundamental display needed to safely fly the plane? And wouldn't having disparities here between planes create more confusion among pilots?
Airlines and general aviation aircraft have totally ignored AoA as a relevant indicator until very recently. You won't find an AoA indicator in even a modern Cessna.
As a student pilot you're taught about unsafe low airspeeds instead, even though AoA can technically cause a wing to stall at any airspeed, and even though that memorized stall airspeed ($V_s1$) actually varies with factors like plane weight.
AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation.
Of course, if your commercial aircraft has a tendency towards stall, that changes the calculus on how important AoA is..
AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation
ISTR that after a carrier catapult takeoff, Naval aviators have 10 seconds for AoA to get into the "green zone." Otherwise it's an automatic eject. Forgot where I read that and if it's only for specific aircraft types, though.
A pilot might fire up that inference engine between his ears and make a very well educated guess when two sensors disagree, based on which one reacts more in line with how it should react to some exploratory control inputs or the recent control history.
A control loop cannot do that, it is a stupid fact processor that we prefer to do one simple thing reliably than to venture off on inscrutably deep reasoning adventures. A general flight AI would be an entirely different beast than the arsenal of pilot assistance systems currently employed. And just two sensors, simply disengaging the control loop when they disagree, seem insufficient to me when we deemed the control loop necessary in the first place. And this is the easily overlooked bit here: disengaging the MCAS isn't the final step, then you still need to fly the plane that it's manufacturer did not trust pilots to safely operate unassisted by MCAS.
(a general flight AI able to do the sensor trust inference could be an interesting game of adversarial programming though: plug it into a flight simulator, then try to down it with the smallest set of simulated malfunctions and weather)
> It appears that the AOA disagree alert exists on the plane but is an optional paid feature (!).
Oh, that is just crazy. And considering that a bad safe record is just as damaging for Boeing as for the airline, it doesn't seem particularly clever to leave that choice to the customers. Do you have an easily digestible source for that?
It is even worse than that, those 2 are independent each connected to one of the two FMS so the FMS has no idea there is another sensor at all, they are supposed to be alternated between flights. Also there is an indicator somewhere that lights up if AoA sensors are in disagreement but again FMS does not know this. How did this design got approved I have no idea.
Investigators including Boeing are going to have to determine whether or not this crew is properly trained and of course, Boeing is going to have to focus on whether or not they have a software or technical issue.
Probably? He's very famous in the ACI community. And as he always says, a plane never goes down for a single reason. The Airbus that crashed into the Atlantic ocean could've been saved if they made the design decision not to "average" inputs from the sticks. Is that a design flaw? Or bad pilot training?
Crashes are always the nexus of a chain of unfortunately and unlucky events. I have no reason to suspect this crash is any different. The only thing I'm confident of is that no matter what the problem is, Boeing will make changes and pilots will receive additional training, and perhaps be required to do simulator time.
Once the 737-MAX is ungrounded I will have no qualms getting inside of one.
>The only thing I'm confident of is that no matter what the problem is, Boeing will make changes ...
Yeah, but it doesn't take Nostradamus to make that prediction. If Boeing doesn't fix their issues, they won't sell planes.
So, say we blame the pilot for incorrectly deactivating the faulted system within a time-frame that allows for recovery; which I think is a silly thing to do : at what level of added complexity and extended abnormal checklists do we transfer the blame from the pilot being unable to follow a checklist thoroughly and quickly enough, to the airframe manufacturer for producing a product with so many potential failure vectors that were added primarily as a cost-savings or for-profit desire?
The 737 MAX is unstable inherently for the sake of mileage, to reduce the overall cost per ticket, and increase corporate profit. I understand the importance of cost/benefit analysis, but at what point are corporations liable for teetering towards the profit side at the sake of safety?
> The 737 MAX is unstable inherently for the sake of mileage
This is blatantly false. The MCAS system isn't running a PID control loop or anything like that. It's applying stupidly simple logic to its inputs and giving equally simple outputs.
At worst you could claim the aircraft is less stable than the original 737. But more specifically I'd say the 737 Max exhibits undesirable control behaviours at the approach to the stall. The MCAS system was required to make this behaviour certifiable.
As the plane "approaches a stall" the plane is actually in danger. Traditionally, the pilot is trained (on the simulator) to reflexively (every second matters) move the controls to avoid the danger in case of any problems (the different actual problems are simulated and separately trained for).
But the new Boeing 737 Max planes exactly at that dangerous moment behave differently to the pilot's input than what the pilot was trained for, because these new planes have different geometry. They are new, but being sold as the "same old." Selling point: "no pilot's retraining needed."
Boeing of course knew that planes behave differently, but actively tried to hide that, as much as not even reporting and documenting to the pilots that there's a new device built-in ("MCAS") to "move the controls itself" differently than what the pilot would do based on this training.
Now, if the MCAS misbehaves, the pilot is supposed to recognize that the "moved controls" are undesired, manage to turn the MCAS off fast enough (even using a circuit breaker! according to the Boeing's explanation after the first crash), and then again rescue the plane which behaves differently than the plane for which he's trained to have built-in reflexes!"
The pilots are supposed to be trained in the simulators to be prepared for the behavior in extreme situations, not to have a new plane that behaves by-design exactly not as they are trained.
The way they were trained, when some undesired movement occur, their reflex reaction corrects the problem. Not so in this case. Their trained reflexes didn't help. Instead, the faulty MCAS continues. That's why even the circuit breaker step is mentioned. But even after turning the MCAS off, the plane still behaves differently because it is actually of different geometry.
All that can happen at the moment the plane is not high enough to be safe to do enough maneuvering instead of hitting the ground.
EDIT: responding to the answer under this post:
> you seem to be assigning a lot of weight to a very minor system
"I" seem? At this very moment there is a world-wide belief that what you name "very minor" issues lead to death of 350 people in only 5 months time-span, to the point of grounding all the MAX planes.
It literally went from a "steam gauge" aircraft to glass panels before. There are aircraft which are much more different and are on the same type rating, for example the 757 and 767. That's literally a widebody and a narrow body.
I'm not sure why you've edited your response rather than responding.
It's a minor system. There is no firm evidence yet that it was responsible for this crash other than some ADS-B data which only really shows that the aircraft was having control difficulties.
Pilots are trained not to get near the stall. Unless something has gone seriously wrong an Airliner will never go near that region of flight in normal service. Most airliners have stall behaviour which is likely to enter a spin or otherwise difficult to recover from, that is why most are fitted with stick pushers which prevent a stall ever occurring.
There are lots of other systems which can control trim on an airliner (the Mach trim system, the auto autopilot etc). Each of these have failure modes that can lead to a runaway trim situation.
The MCAS system is trivial. It may have a flaw which led to both of these accidents but it isn't the world is falling and Boeing tried to patch it with different software.
You've said a lot but I'm unclear what actual point you are trying to make. I'm fairly certain you have no actual flight training because you seem to be assigning a lot of weight to a very minor system.
It's a well acknowledged fact that 90% of professional pilots online have only piloted their computer desk. The other 10% may never have piloted the aircraft in question or are 'shooting the shit' rather than presenting their professional opinion.
>on MCAS triviality
A system that takes an external input and directly translates that to control surface deflection without checking with or notifying an operator, is not trivial.
The AoA sensor, previously largely irrelevant in civilian aviation as posted by an earlier poster, became a deadly concern seeing as a malfunctionimg sensor pumping inaccurate data to a downstream control unit with seemingly no way to validate or reject incoming bad data would respond just as happily to a reading 20 degrees off of where it should be. That this happened in a manner completely foreign to someone thoroughly experienced with a 737 just exacerbates the risk. Especially when said response is no longer overriden in the traditional response in old airframes. This is a usability regression, and should have been explicitly documented.
You seem very convinced that MCAS is some trivial system when it is very clear physically and legally speaking that that +/- 2.5 degree stabilizer movement at the right time is what the air-worthiness certification is dependent on.
>on re-cert as 737, and failure to train
Just because the damn thing flies doesn't mean basic automation system architecture, design, and ethical principles stop applying. You do not make a decision for an operator/user and not communicate the importance to them ahead of time. Doing so fundamentally changes the nature of the device.
To put it another way:
>"If you change the working parts, you make a different machine."-The Protomen, Father of Death
Or if you prefer someone a bit more established here's Edward W. Demmings view on it:
>"Every system is perfectly designed to get the results it gets."
From which comes the corollary:
>"Given two systems, if one produces results irreproducible in the other, then the systems are not the same."
>On Software that has the potential to kill people
Has no one learned from the lessons of THERAC-25? How many more need to die before "hide interlocks in software and skimp on training" stops claiming lives?
I fight the attitude that leads to these types of poorly thought through decisions every day in far less life threatening systems. Seeing it happen in such a high stakes industry just makes it all the more painful to have to endure.
>on appeals to occupation/authority
You don't need a pilot's license to connect the dots. You just need time, the right skill set and exposure to engineering in multiple contexts, and enough exposure to human social dynamics to realize that the MCAS augmentation is exactly the type of innocuous looking change to have slipped through the cracks. When you're in the trenches developing highly complex systems, you are in a highly faith based environment in the sense that while you are working from empirical measurements and simulations you have to have faith that all the relevant questions have been asked and answered. Engineers frequently discount the impetus of Sales/Business pressure, then turn around and don't question the deadlines those commitments made elsewhere, and accept the consequences thereof (I.e. questions not asked/answered due to time constraints).
As I said before. I'm waiting for more data. Even if MCAS isn't involved, the above mentioned issues are gross failures of system implementation that need to be remedied or otherwise addressed.
I'm not arguing it's one and done, but even if it turns out leprechauns swarmed the plane en masse disassembling it in flight, enough information has come to light that anyone can see there has been some serious ball dropping going down; ball dropping so serious that uninitiated customers are speaking out in discomfort instead of simply "leaving it to the eggheads".
I am very vocal on issues like this. I have been told I have a knack for the highly technical subjects, the inquisitivenes to run down things I don't know, and a bullish propensity to follow the facts wherever they lead. I see it as my responsibility to ask and find answers to the questions others don't even know how to ask, and to present them as best I can so that others may understand and come to their own judgements. Hell, I even learn something every now and again.
> You seem very convinced that MCAS is some trivial system when it is very clear physically and legally speaking that that +/- 2.5 degree stabilizer movement at the right time is what the air-worthiness certification is dependent on.
If that is your definition of non-triviality then the ash tray in the toilet is also a non-trivial system since the certification is dependent upon it being there.
MCAS is only there to compensate for one part of the flight envelope where normal operations shouldn't be taking place.
Point being, without that system the aircraft would still fly. In fact Lion air wouldn't have happened without it.
Of course there could be a fault (beyond the nonsense of it not being triple redundant). Or it could be something unrelated to MCAS which is my own pet theory (partly based on the reports of pitch excursions with the autopilot engaged where MCAS is irrelevant).
You’re talking about this incident as if Boeing anticipated a crash per year but it is happening at an unacceptable 2 crashes per year. We don’t know what went wrong. We don’t know what went wrong. Inherently “stable” planes have been crashing for decades, it’s a little early to be mad at Boeing for a design decision considering we know almost nothing at this point. I’m not blaming the pilots, I’m not blaming anyone, I’m advising we wait for the report before getting out the pitchforks.
Honest question, why are people being so aggressive about saying that the human aspects should be considered first and foremost? If there was no problem with the aircraft, that would surely lead us to the conclusion that it was a training/pilot problem anyway. What's the point of pushing the human narrative so hard?
This kind of accident doesn't happen for just a single reason, they happen for a SERIES of reasons all together. Some of those reasons are technical, some are environmental, and some are human factor. Blaming any single of them is bullshit... and so is forgetting about any of them.
1) boeing changing geometry 2) boeing adding a new system that takes over control without documenting 3) pushing very hard to classify a new plane as an older type so now retraining happens 4) using only 2 sensors instead of 3, and using just one to control parts of the plane.
We know the mustache twirlling villians- we see them every day at our own software projects. People who will shortcut to meet deadlines at all costs.
People who will knowingly ducttape horrible solutions together and ship that to the customer, blaming the customer when the ducttape falls apart.
Boeings denial and redirect statements reek of the the usual spokesman boolshit we have so often in my industry.