Similarities Between the Lion Air and Ethiopian 737 Max Crashes
thepointsguy.com
thepointsguy.com
Many of us have heard the phrase "If it ain't Boeing, I ain't going." In reference to Boeing's perceived safe planes. This phrase has lost any meaning to me, and in fact, I'm feeling the opposite way right now.
Boeing's response to the first 737-Max Lion Air crash was abhorrent, in my opinion. While they were taking the time to blame the Lion Air pilots reaction to the plane's issue, and stating how safe the 737-max was, they were also working on urgent patches to their software. The patch is still not yet deployed, but the planes continue to fly.
If initial info of this crash points to a related cause to the Lion Air crash, anything less than a full grounding of all 737-Max aircraft seems incredibly dangerous. I get the feeling that Boeing executives have checked their better moral judgement at the door and are thinking solely in terms of dollars.
I can't help but feel that Boeing and US regulators would have taken the issue identified after Lion Air much more seriously and been much more likely to take action and responsibility if it was a US flight. That thought leaves me with incredibly sour taste in my stomach.
For those who may come to Boeing's defense, take a look at how pilots of the 737 Max responded to the Lion air crash - often with anger.
[1] https://www.nytimes.com/2019/02/03/world/asia/lion-air-plane...
[2] https://www.washingtonpost.com/business/2018/11/13/pilots-un...
[3] https://www.fullwsj.com/articles/regulators-push-for-clarity...
[4] https://www.fullwsj.com/articles/boeing-and-regulators-delay...
The last true engineering-led Boeing was the 777. Chaotic mess of 787 development or apparent stretch-too-far Max are pure McDD.
If there’s a recent case of an airline with a solid track record of following safety recommendations and Boeing not responding appropriately to a crash then that would be different.
We need to wait for the investigation before we jump to conclusions.
I think that is a good point.
The 737 Max is the same type rating as all other 737. That means the pilots and crew switch back and forth between the Max and non-Max planes — despite the fact that they act very different in certain circumstances.
This was intentional, it saves airlines money to have fewer type ratings.
Besides, so soon after take off there’s very little time to recover when your plane is overriding you attempts to keep it from nose diving into the ground. It’s not as simple as flipping a single switch.
Did the pilots of the Lion Air flight and possibly the Ethiopian Air flight understand what was wrong in-flight and were unable to fix it due to an inability to override aircraft controls?
This is what I am getting out of the discussion so far but maybe I am gravely misunderstanding what's happening? So as a passenger without any knowledge of aviation systems my question is merely whether the pilot gets control over the aircraft when he demands it? Fly-by-wire should at least never lead to autopilot suicide, even if it has to ensure flight integrity to a certain degree due to the technical nature of large, modern aircraft.
Thanks for reading it :) . As you phrased it specifically, I can't disagree with you. But in these systems, the devil is in the details. For Boeing's MCAS, which is like an add-on piece of functionality to the core control system, it seems like an obvious piece which should have a manual override - and it does. The criticism, as I understand it based on Lion Air, is that the override functionality is not obvious and if you were previously a 737 pilot on non-Max variants, you might not know about this or have practiced its use.
However, consider safety systems such as Automatic Ground Collision Avoidance System ("Auto GCAS") or Automatic Air Collision Avoidance System ("Auto ACAS"). These systems are designed as reactions to multiple known cases of human error that have resulted in otherwise under-control aircraft being flown into the ground or other aircraft. They are specifically designed to override a mistaken human. Technically, it's not impossible that pathological failures or spoofing could trigger these automated systems, which would wrest control away from pilots. Should such systems be overridable at all times?
Resolving these kinds of issues does involve some judgment and adopting a philosophy prior to the implementation. Airbus and Boeing, for example, have historically differed in their philosophies, each with reasonable rationale.
I personally favor the approach Boeing has historically used, with AF447 and QF32 illustrating some of the pitfalls of Airbus' approach. For example, as pointed out by ggreer in https://news.ycombinator.com/item?id=19355402 , being susceptible to common mode faults.
However, I still fly on either manufacturer's aircraft without hesitation.
Except that's exactly what it is and then manually setting the trim. The NY times had an excellent article about the procedure:
> The crucial step, would be to reach across to the central console to a pair of switches, and flip the switches off. Those switches disable electric control of the motor that moves the stabilizers up and down, preventing the anti-stall system from exerting control over their position.
https://www.nytimes.com/interactive/2018/11/16/world/asia/li...
You really should watch this video just to get an idea of how catastrophic this error is:
The lion air pilots had 15 mins to disable the automatic trim system and simply set the trim manually. It's turning off a switch and spinning a wheel. Manually setting trim is second nature to student pilots.
They should also have read the log prior to departure and seen the previous four flights had this problem that did exactly this. Quite sure pilot error will be the outcome for lion air.
There's absolutely no difference in procedure here a normal 737. Unsure where you got that idea from.
The procedure to set the trim manually was the same, but I assume that in most flights the actual flywheel is never turned by hand (and thus rarely deactivated). I'm sure most pilots use the fly-by-wire systems or autopilot.
The procedure which was different was the automated MCAS system - pilots who have logged significant hours flying the previous model of 737 would be unprepared for this during an extremely busy phase of the flight.
Ultimately, yes, it was the pilots error when they didn't take the proper actions when the problem first occurred. Nevertheless, we must first take into account why the automated system failed to begin with, and why the pilots made the error (lack of training, sleep, preparation).
This isn't binary, and the fact Boeing is issuing a patch for the software systems as a direct result of Lion Air tells me there is more to the story than just "pilot error".
After the Airfrance airbus incident they also introduced a "patch" to protect the aircraft from erroneous pilot actions leading to stalls when indicators are incorrect, those fixes were certainly not indicative of guilt but just another layer to stop pilots making mistakes.
To put it bluntly only a fool is going to start flipping switches willy nilly. Boeing has a procedure out to handle runaway stabilizer trim, and that's to flip the switches, but the Lion Air pilots did not encounter a runaway stabilizer so why would they go down that checklist and potentially add to their troubles? In the case of the cutout switches, those switches do different things on the NG and MAX (and are thus labeled differently) which potentially adds to the confusion and reduces the incentive to experiment. You're talking about counteracting a system that Boeing hid from pilots — hardly pilot error.
In fact if you look at the FDR data you'll see that the pilots were able to temporarily disable MCAS with the trim buttons on the yoke. Every time MCAS trimmed down, the pilot trimmed up and was able to maintain appropriate trim. That worked, and it seemed like the plane was largely under control (until it wasn't).
Meanwhile the unreliable airspeed indicators were illuminated and one of the stick shakers was going off, and there was probably an EICAS message about the elevator feel system but no actual indication of the underlying problem with AoA was given because Boeing charges extra for that. So, with the assumption that you had the stabilizer trim under control, why would you add to the significant workload by disabling the electrical control of the stabilizer?
I'm struggling to see how you think having to make manual adjustments every 30 seconds is "under control". Check the flight profile, it was never under control.
> the Lion Air pilots did not encounter a runaway stabilizer
What did the pilots on the four previous flights encounter? Did they not follow procedure correctly by overriding it? The trim stabiliser had to be adjusted 23 times during the the fatal flight, this is a solid fact. After a few times it should have been very apparent that there was a problem related to the automatic trim system and switched to manual.
Manual trim would only get adjusted a only few times during a regular flight, it's a very basic skill and the trim wheel itself takes up a huge amount of real estate in modern cockpits.
Sorry but you've written a lot of terribly inaccurate stuff here. Let's see what the report says.
There are dozens of design flaws in modern aircraft, a miniscule amount are unrecoverable following procedure.
The process to manually override trim on a 737 that should have been followed:
https://www.nytimes.com/interactive/2018/11/16/world/asia/li...
Every time MCAS trimmed down, the pilot trimmed up which resulted in two things: MCAS stopped trimming down, and the stabilizer was adjusted up. That's not a runaway situation.
What did the pilots on the four previous flights encounter?
The previous pilots ran into MCAS trimming the stabilizer down inappropriately. They wrote it up as a speed trim (STS) failure. The crew on the fatal flight read STS and was probably thinking STS when they crashed. Unlike the undocumented MCAS inputs, STS can be disabled by moving the control column.
Did they not follow procedure correctly by overriding it?
There was no procedure, MCAS was undocumented.
Manual trim would only get adjusted a only few times during a regular flight
You're almost never going to crank the trim wheels by hand but an NG pilot may be used to having to add input to counter STS.
The process to manually override trim on a 737 that should have been followed:
The pilots were presented with more than just uncommanded trim adjustments, they were presented with multiple, seemingly unrelated, failures. The failed AoA measurement meant they had no idea how fast they were going (new behavior on the MAX, see the repeated queries they made to the ATC), one of the stick shakers was going off (unsure if plane is going to stall and fall out of the sky), and there was probably a warning about the "elevator feel" system on EICAS like on the previous flight.
When faced only with uncommanded trim, sure, they probably would've thought STS because that's the only system Boeing bothered to document. In an ideal world the pilots would've recognized that this wasn't STS. In reality the pilots were busy triaging a variety of symptoms because Boeing did not make appropriate warning / status indications standard equipment on the MAX nor did Boeing actually document that MCAS exists (except in Brazil).
The only error that the Lion Air crew made was in not being clairvoyant.
Dissemination of information about a risk is an entirely separate issue from creating a solution to the underlying flaw.
Flight 610 should never have taken off.
> Flight 610 should never have taken off.
A repaired aircraft should not take off?
The AoA attack sensor was replaced prior to flight LNI043 (he flight prior to 610), in which the pilots declared pan-pan and had to manually override the auto trim systems (which include MCAS). Between 043 and 610, there was further maintenance that included flushing the pilot valves and cleaning electrical connectors, but the AoA sensor was not replaced between 043 and 610.
An aircraft that was repaired followed by one flight in which the pilots declared abnormal operation and performed 3 non-normal checklists should probably not fly again until they figured out what happened, and the next flight should definitely be aware of the incident on the flight prior. 043 faced and overcame the exact same malfunction as 610 - to me that indicates a clear failure. If you keep flying an aircraft that malfunctions on each flight, you're pressing your luck.
They followed Boeing's procedure in attempting to address the issue again (after already replacing the sensor). That's a completely appropriate action.
> the next flight should definitely be aware of the incident on the flight prior.
It is in the log book. Is this a reference to something particular?
> 043 faced and overcame the exact same malfunction as 610 - to me that indicates a clear failure.
I agree, that's why maintenance conducted a repair.
> If you keep flying an aircraft that malfunctions on each flight, you're pressing your luck.
They attempted two repairs in accordance to the manufacturer's procedures within that time in order to resolve the malfunctions.
This post references the report and you clearly read it enough to know your original conclusion was mistaken, but are still arguing you're right by trying to shift the discussion. You've gone from "they flew a broken aircraft" to "alight, so they repaired it twice, but you cannot ever trust a malfunctioning aircraft again." By that logic every single commercial aircraft would be in the junkyard... Repairing malfunctioning systems is normal, attempting two different repairs isn't uncommon either.
If you think I've changed my argument, you misunderstood my comments. I still think that they flew a broken aircraft.
I'll stand by my statement that 610 should never have taken off, and I'm somewhat surprised that it is contentious. I don't care if all the protocols were followed and the logs made (though obviously the pilots of 610 didn't understand what the previous pilots had done to respond to their incident) - in retrospect, we know that the aircraft was not airworthy going into flight 610, so something needs to change so that next time that is detected before takeoff. Whether that is better observation of the protocols or better protocols, I'm not sure.
I understand that with physical systems, the cost and complexity of detecting is higher, but if you're putting other people on the line, you damn well better do a live test of your vehicle before another living soul not certified as a pilot or flight engineer is allowed on board.
The more I read about this, the more it appears to me that excessive trust is placed on filed paperwork. Nothing says a fix is done like a successful test flight that specifically attempts to recreate the conditions surrounding the original failure.
At some point, the complexity of system integrations requires that you do something more than bare minimum component retesting.
Probable cause should be a sufficient standard.
Two crashes in similar circumstances is probable cause to take them all out of service until they figure out what the hell is going on.
For myself and my family, we won't wait for regulators and airlines to act. We will not fly the 737 Max.
I'll fly 737 max.
I won't fly Lion Air or Ethiopian Airlines.
Southwest: fleet size 754, founded 1967, total of seven accidents with 3 deaths.
Ethiopian Airlines: fleet size 107, 64 accidents with 459 deaths since 1965.
The FAA issued an emergency operation directive for the 737 Max due to inaccurate sensors which could lead to a crash. I'm not entirely sure why you're ignoring that fact and deflecting to something unrelated.
I don't think it is unrelated that the only accident thus far of a plane with a failure mode that is more difficult for pilots to respond to was on an airline with a notoriously bad safety record.
I fully recognize the fact that airlines and pilots were not informed well enough about MCAS, but I'm also not ignoring the other circumstances of lion air 610
Safety in depth - a single failure should not be a problem. 610 crashed as a result of MCAS, but also a number of other operational failures of Lion Air and the pilots.
Boeing informed the FAA of the changes, and the FAA decided that the pilots and airlines did not need to be informed. Criminal charges for Boeing would be extremely surprising.
I don't understand how a software update can override a completely manual override.
Yes, it's a small sample size, but if you look at the fatal accident rate per flight leg of a 737 MAX 8, I'm sure it's much higher rate than any other modern aircraft.
Boeing 717 (formerly the MD95)
Bombardier CRJ700/900/1000 regional jet family
Airbus A380
Boeing 787
Boeing 747-8
Airbus A350
Airbus A340
[1] https://www.airfleets.net/crash/stat_plane.htm
[2] http://www.travelvivi.com/the-safest-aircrafts-in-the-world/
And indeed, the 787, 747-8, A350 and arguably the A380 are all new planes that have not accumulated the decades of flight history with huge fleets that the 737 has.
> And indeed, the 787, 747-8, A350 and arguably the A380 are all new planes that have not accumulated the decades of flight history with huge fleets that the 737 has.
The 787's first commercial flight was in 2011. The 747-8 in 2012. A350: 2015. A380: 2007. All predate the 737 MAX 8 by years, and have better safety records.
So while having two MAXes crash after takeoff mere months apart is indeed statistically unlikely, I wouldn't necessarily leap to the conclusion that the two accidents are related just yet.
Let's say there are 40,000 commercial aircraft worldwide and 350 of these are the Boeing 737 Max [0].
If all aircraft are equally likely to crash, then the probability of a given crash being a 737 Max is 350/40000 = 0.00875.
The probability that two crashes are both 737 Max is 0.00875 * 0.00875 = 0.0000766
It's extremely unlikely that an aircraft representing less than 1% of the global fleet would crash twice in a short period of time unless there is a serious defect with that aircraft.
That's well past probable cause at this point. This aircraft should be grounded until they figure this out.
[0] https://en.wikipedia.org/wiki/List_of_Boeing_737_MAX_orders_...
You need to multiply this by every combination of two crashes in the observed time period with starting and endpoints not cherry picked to include 737 max crashes though.
With an average of 175 737's operating since launch, 4K total widebody commercial aircraft and over a dozen widebody crashes in that period, you get over 10%. Some estimates there but you still have the endpoint issue as well.
And that includes the crash of a cargo flight with no passengers where the crew was killed.
The 737 Max 8 was involved in 2 of those 5 disasters.
There are between 25,000 and 39,000 commercial aircraft in service depending on who you ask [1].
With 350 737 Maxes delivered so far, that's at most 1.4% of the total today, probably less than half that this time last year. Let's call it 1% on average for 2018 and 2019 combined.
There are 10 ways you can have 2 Max crashes out of 5 total crashes. So the probability is 10 * 0.01^2 * 0.99^2 = 0.00098
Even accounting for n choose k and longer endpoints, it's still an infinitesimal probability that we'd see two catastrophes with the same rare aircraft -- unless that aircraft contributed to the catastrophe.
It should be grounded.
[0] https://en.wikipedia.org/wiki/List_of_accidents_and_incident...
[1] https://www.telegraph.co.uk/travel/travel-truths/how-many-pl...
https://theaircurrent.com/aviation-safety/southwest-airlines...
I have no idea where your Ethiopian stats come from because I’ve heard nothing but great things about them. Feel free to rebut.
“Or how about Ethiopian Airlines? Here is another impoverished country surrounded by rugged terrain. Yet the record of its national carrier — three fatal events, one of them a hijacking, in over seventy years of operation — is exceptional. Ethiopian is one of the proudest and arguably one of the safest airlines in the world.”
http://www.askthepilot.com/questionanswers/foreign-airline-s...
Regardless, Ethiopian Air is considered a top tier safe carrier.
I think you are completely free to avoid the 737 MAX as long as you like, but it seems like panic and hysteria to call for a widespread public reaction before any actual crash data is available.
There was, IIRC, a similar incident in an 737 Classic (go around in England that achieved a dramatic nose up pitch IIRC — not the Tailwind incident) but I can't seem to find the entry on avhearld.
https://www.gov.uk/aaib-reports/aar-3-2009-boeing-737-3q8-g-...
Or Airbus.
Do people out there really think Airbus have such lower safety standards that they won't fly on them? They must struggle to get around even the US domestic routes these days.
Not really sure what you're on about - Airbus' passenger jets started only a decade after McDonnell Douglas and Boeing's. A300 flew around 1970. DC-8 flew around 1960, same as the Boeing 707.
Th grandfathers of some people on this site would have been flying on Airbus.
I like the image, but I think you can make it much stronger. The grandfathers of many users of this site are still flying on Airbus (as well as all other current planes), so I think you being at least a couple generations to conservative. Instead, I think it's safe to say that the "great-great-grandfathers" of some of the users of this site almost certainly flew on an Airbus.
For ease of math, assume an 18 year-old-user born in 2000, 25 years per generation, and a 75 year lifespan. Their father was born in 1975, their grandfather in 1950, their great-grandfather in 1925, and their great-great-grandfather in 1900. That great-great-grandfather died in 1975, and thus assuming they flew in the last years of their life, would likely have flown on an A300.
Given that these assumptions might be closer to average rather than extreme, I don't think it would be unreasonable to bet that at least one user's great-great-great-grandfather flew on an Airbus as well.
No one actually says that. Even Boeing itself, when arranging corporate travel for employees, picks whatever flight is available with reasonable airfare regardless of aircraft type.
https://theaircurrent.com/aviation-safety/what-is-the-boeing...
Basically pretty shitty system design.
I have mostly had the reverse sentiment; my experience is mainly based on 777-xxx planes, but I find the experience in those so horrible that I try to avoid Boeing in favor of Airbus. Every time when I cannot (like last week when I flew with a 777-300er) I get reminded how crap these things really are. Not talking safety but general feel and comfort; basically everything is worse; noise, seating, effects of turbulence etc. And I have noticed this across multiple premium airlines.
> An eyewitness told AFP the plane came down in flames. “The plane was already on fire when it crashed to the ground. The crash caused a big explosion,” Tegegn Dechasa recounted at the site. “I was near the river near the crash site. Shortly after the crash police and a fire crew from a nearby air force camp came and extinguished the plane’s flames on the ground.”
> He added: “The plane was in flames in its rear side shortly before the crash. The plane was swerving erratically before the crash.”
Source: https://www.theguardian.com/world/2019/mar/10/ethiopian-airl...
“ According to the National Transportation Safety Board, which announced this month that it had gathered 349 eyewitness accounts through interviews or written statements, 52 percent said they saw a fire while the plane was in the air. The largest number (22 percent) said the fire was in the fuselage, but a majority cited other locations, including the left engine, the right engine, the left wing, the right wing or an unspecified engine or wing. Nearly one of five witnesses said they saw the plane make a right turn; an equal number said it was a left turn. Nearly 60 percent said they saw something fall off the plane; of these, 13 percent said it was a wing. (In fact, it was the vertical portion of the tail.)”
https://web.archive.org/web/20130518210525/http://www.nytime...
With 2 accidents the rate is now 4/million. That's at least an order of magnitude difference more than the average of the modern jetliners [2]
Of course, with two events it might be just bad luck but the similarities are concerning, as pretty much everyone observes here
[1] https://randy.newairplane.com/2018/05/22/737-max-a-year-of-s... [2] http://www.airsafe.com/events/models/rate_mod.htm
https://www.reddit.com/r/aviation/comments/azds6k/ethiopian_...
https://www.21stcentech.com/bad-software-boeing-737-max-comm...
"Those 189 who died were victims of Boeing’s redesign of its successful 737 aircraft, all about putting a bigger engine on it and trying to come up with a solution to correct the airplane’s changed aerodynamics. Boeing realized the redesign could lead to potential stalls. MCAS was the answer"
"Software combined with sensors would ensure the airplane would not tilt upward at an unsafe rate. The combination of the two would keep the nose at the precise right angle during all aspects of flight to prevent a potential stall.
Was this, in the end, a good design decision? No based on what occurred to this nearly brand new aircraft"
"Pilots can manually override the MCAS but cannot switch it off without switching off the flight computer. This fact in and of itself proved fatal to Flight 610, its crew, and passengers."
"Since the crash Boeing has sent out a safety warning with a procedure for cutting off MCAS in the event of an AOA sensor malfunction. A description of what a pilot would experience should the MCAS receive false data has been included so that he or she would know when to disengage the flight computer and manually take over flying the plane."
Moreover, bad software effectively working against the pilots, again connected to the stalls, was also the cause of this famous accident some 10 years ago:
https://en.wikipedia.org/wiki/Air_France_Flight_447
"In an article in Vanity Fair, William Langewiesche noted that once the angle of attack was so extreme, the system rejected the data as invalid and temporarily stopped the stall warnings. However, "this led to a perverse reversal that lasted nearly to the impact: each time Bonin happened to lower the nose, rendering the angle of attack marginally less severe, the stall warning sounded again—a negative reinforcement that may have locked him into his pattern of pitching up", which increased the angle of attack and thus prevented the aircraft from getting out of its stall.[25]"
Having multiple sensors doesn't always help, as failures are correlated. For example, there was an Airbus A321 that had 2 of its 3 sensors get stuck in the same position due to icing.[1] The computer thought that the one working sensor was malfunctioning and disregarded it. It then engaged stall protection, dipping the nose and causing the plane to dive at 4,000ft per minute.
> The captain continued to hold “more than 50%” rearward stick in stable flight for a period, but with help from technicians on the ground, the crew was able to reconfigure the automation into the aircraft’s alternate control law, rather than its normal “direct” law. The action removed the alpha-protection checks and canceled the nose-down input. The aircraft then continued to its destination.
These failure modes tend to happen more with Airbus planes because their flight control systems default to overriding human input if the computer deems it unsafe. Boeing's flight computers will give more resistance in the controls, but they mostly won't prevent the pilot from doing what they want to do. The exceptions (such as auto-trim and stall prevention) can be disabled with by flipping a couple of switches.
1. https://aviationweek.com/commercial-aviation/german-investig...
But I’m not an expert on the subject so I’ll defer to the reports and more knowedgable people.
This is caused by the larger engine nacelles covering the higher bypass LEAP-1B engines."
Boeing only told pilots MCAS existed following the Lion crash, almost 18 months after the plane entered service
https://leehamnews.com/2018/11/14/boeings-automatic-trim-for...
I think that all what MCAS does could've been achieved by telling pilots to set certain trim at the takeoff, when the thrust is maximal, and let the regular "hard" anti-stall system handle that in level flight. Again, software people trying to "think" for their users.
This immediately struck me as completely negligent insanity. The thought of flying on a commercial airliner with no inherent stability, akin to a fighter jet, is horrifying to me. How this got past regulators is just mindblowing.
> MCAS is “activated without pilot input” and “commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall.
> Since it operates in situations where the aircraft is under relatively high g load and near stall, a pilot should never see the operation of MCAS.
In other words, the aircraft does not need MCAS for stability during flight in anything but exceptional circumstances. Normal flights should never have MCAS active.
This is not remotely similar to the aerodynamics of a fighter jet.
MCAS is a software mechanism designed to prevent stalls in extreme circumstances that can be overridden with the same method used to disable auto trim on previous models of the 737. The A320 has software to prevent phugiod motion in exceptional scenarios, except the A320's mechanism cannot be overridden by the pilot.
I don't care if you choose to never fly on a plane again, but don't spread this misinformed hysteria.
What hysteria. Relaxed static stability, or some degree of longitudinal static instability (not the same as "no inherent stability") is one potential option for reducing fuel consumption and emissions in future aircraft configurations (as correctly pointed out by multiple commenters, the 737 Max is not designed this way). To what degree that's safe depends on how the artificial stability is maintained in the presence of individual and common-mode failures. For a long time, orthodoxy and knee-jerk thinking precluded long-range transport on only two engines, or fly-by-wire, or primarily composite airframes. With decades of engineering and actual data behind them, these have now become standard.
Michael Crichton's Airframe treats this kind of knee-jerk thinking, and the dangers inherent in using terms like "stability" that have a huge gap between laypersons' perception and engineers' understanding.
https://www.youtube.com/watch?v=WBktiCyPLo4
If you don't want to watch an hour long video, she says most serious accidents and near misses happen not because something failed (and lets face it software 'bugs' are just another type of failure). But because bad interactions between properly functioning systems[1].
One of her comments is you need a system that watches for stuff like that. Lion Air Flight 610 crash happened because there wasn't a system that could make a determination that the pilots needed hard control over the aircraft. A safety system being repeatably overridden by the pilots for 11 minutes should have resulted in that system being shut down.
[1] One thing I got beat into me over the last 20 years developing sensor networks is how little information is actually available to systems like a MCAS system. That makes it's reasoning about the world brittle. Humans are better at managing path dependent state based on inane sources of information. The pilots utterly knew the aircraft wasn't stalling just by feel. While the MCAS 'knew' it was based on a messed up sensor.
...except when the pilots get it wrong like they did on AF447 which crashed into the Atlantic Ocean when 'the crew failed to recognize the aircraft had stalled and consequently did not make inputs that would have made it possible to recover from the stall.' [1]. That accident was caused by a combination of equipment failure - iced up Pitot tubes - in combination with an erroneous reaction by the pilots.
It's not really the same situation. In one the aircraft was absolutely flyable without instruments. The other it was not flyable without instruments.
[1] Absolutely last thing you want in that situation.
It's highly unusual for a plane that has been in operation for only 3 years to have two crashes shortly after takeoff.
I certainly won't be taking any flights in them until a thorough explanation emerges of what happened on these two flights.
And Boeing PR should stop saying that the planes are safe (they recently put out a statement affirming it's safety). At best, they should say "we don't yet know, and are investigating".
Going on a non-737 MAX plane: Y% chance of dying
Given these two accidents, X > Y
Why sign up for a higher chance of dying?
I think this is a classic case of people overreacting to dramatic but unlikely risk. And to be clear, I support grounding the fleet.
That is: If both X and Y are low enough, it's not worth the inconvenience to get Y instead of X.
Thats not the case with structural or civic engineering say. The more I know about that the safer I feel.
https://www.airlinepilotforums.com/safety/120514-ethiopian-7...
The only example I know is DC-10.
The incident in Paris may have sped up the process of decomissioning the plane, but it would have happened anyway eventually.
All was not lost. A lot of the more visionary aspects of that plane, were implented into later Airbus models (i.e. the glass cockpit derives directly from the Concorde).
An outstanding (if slightly outdated) discussion about all things Concorde can be found here: https://www.pprune.org/tech-log/423988-concorde-question.htm...
OTOH, I've also seen independent analysis that suggests Boeing was to blame due to the poor disclosure of important changes in the system.
What can explain such a difference in the primary messages from investigators and from analysts?
If the EA flight was caused by the same sensor problem as the LA flight, then it would appear that Boeing's changes were the primary (and superseding) cause of the earlier crash, rendering Lion Air's non-maintenance moot from a legal point of view (in the US, for purposes of assigning damages).
Wouldn't Lion Air processes still remain relevant as a third contributing factor, since fixing any of these factors could have reduced the probability of the accident?
Your own links say no such thing, and directly contradict your claims e.g.:
> One of the angle-of-attack sensors on the airplane's fuselage was replaced after the airplane's penultimate flight - from Bali to Jakarta - after the Lion Air plane experienced malfunctioning data readings. Investigators therefore said the plane had not been airworthy during its last two flights.
How did you get from repaired to "wasn't airworthy?" Also the actual report doesn't "blame" Lion Air, it simply lists the facts. It is far too early to be assigning blame, and I'm sure there will be enough to go around (including the regulators themselves).
One of the engineering improvements that (as an armchair viewer) believe needs to be made is better communication of auto-pilot state to the crew. ANY deviation from designated human input needs to be clearly communicated to the pilots so they know what the hell is doing it and if necessary which system(s) to disable to regain full manual control.
[0] http://www.aopa.org/asf/publications/inst_reports2.cfm?artic...
But the final report of the first crash isn’t even out yet. Which I find interesting considering all the finger pointing going around (even by arm chair “concerned citizens” in this thread).
Assuming we even know what happened I doubt the solution will end up being a training thing and most likely updates to the software, UX, and/or the addition of back up AoA sensors.
If a supposedly-very-safe type of hardware kills a bunch of people twice in similar-looking incidents, that is very worrying.
It's a rational reaction to look at these incidents and go "yeaah, I'm going to try and avoid those planes" regardless of whether official reports are out or not.
But when we think forward to the inevitable autonomous vehicle accidents that will occur, the conversation turns to how many lives they’ll have saved, and how much safer they’ll be.
Is there a known psychological phenomenon for “negative hindsight, positive foresight” that I can go learn more about?
So if the MCAS is indeed the cause of that crash, I expect fleet grounding until the system is fixed. Assuming it is fixable, which I think it is, but might require more than just a software fix.
Driving to the airport is orders of magnitude less safe than flying. If a malfunctioning automatic system is decreasing the reliability of flying, that's a huge problem. However, I'd wager that even an autonomous car that's only just able to pass a driver's exam would be significantly safer than a human driver because it would _follow the rules_ and _not be distracted_. Even if that system isn't perfect, it's probably still better than an experienced driver.
At some point your designs start breaking into envelopes where the machine cannot be considered safe once the automated systems fail, making your pilot/highly trained human being powerless in the face of catastrophic system failure.
An uncontrollable tool is not a tool, but a coffin waiting to happen. I don't think any type of "routine" transit system should be designed in a manner such that it so thoroughly overwhelms a human crew's workload that it should be so dependent on automation that it cannot be certified otherwise.
To reword: if it can't be safely flown with the computers off, it probably should not be a design we allow for people transport. Markets be damned. When your margins include human lives lost, economy needs to stop being your primary optimization. Dollars should only be important after you stop being a corpse factory.
I guess whether it’s human error at the hands of the pilot/driver, or human error at the hands of the engineer/designer, we can never fully remove it from the equation.
Should we just give up? Seems the best we can do is try and mitigate risk, and automated systems condense this risk down into fewer points of failure (i.e., there are less engineers than users!).
https://static01.nyt.com/newsgraphics/2018/11/15/lionair-737...
Suppose that steering in a new car model tends to drift from the straight line slightly more than usual.
Attentive drivers would easily correct for it, and would merely find it annoying. For them the accident rate would increase very little if at all.
OTOH, the accident rate might go up more noticeably for those who text while driving, since they often won't notice the drift until it's too late.
When you look at the accident reports where steering drift was a factor, you'll see that most of them involved distracted drivers.
If Boeing were to give the 737 the 787 treatment the benefit to the flying public, airlines, environment, etc. will be huge but as long as Boeing can sell the 737 without a real upgrade it is a cash cow for them and they'll never stop making it.
The MAX 8 is very literally the 737 being given the 787 treatment. What are you asking for here? 10 abreast seating? Then it would just be a 787...
Carbon fiber could change some of the economics around that, but I'm not sure if the airframes wear out from stress before or after efficiency gains make new planes more desirable.
Not even close. The MAX is as basic a re-engining of the 737 NG as possible. It was an explicit design goal to minimize differences, to the point where pilots don’t even need simulator work to be approved for the MAX. (This was the purpose of the MCAS system that doomed the Lion Air fight, to make the MAX handle as similar as possible to the NG even in almost-stall conditions).
And the 737 NG is itself a refresh of the late-60s 737. Much about the aircraft is unchanged since the 60s: the fuselage cross-section (slightly smaller than the late-80s A320), door arming/opening, lack of RAT, etc.
Much of the cockpit improvements since the 80s (integrated EICAS) are missing from even the MAX, and none of the 787 innovations (composite fuselage, bigger windows, no bleed air/all-electric) were even close to coming to the MAX.
I don’t see why that warrants mentioning, in the context of the article, where both planes are 737 MAX. Given that ”More than 320 of the 350 Boeing MAX aircraft delivered through January 31, 2019, are of the MAX 8 variety”, it would be more surprising if they weren’t both a MAX 8 (probability of the latter is about 1:6, if we assume all variants are equally safe)