Pilot Who Hitched a Ride Saved Lion Air 737 on the Day Before Deadly Crash
bloomberg.com
bloomberg.com
> The presence of a third pilot in the cockpit wasn’t contained in Indonesia’s National Transportation Safety Committee’s Nov. 28 report on the crash and hasn’t previously been reported.
So the NTSC explicitly chose to exclude this and then two whistleblowers went to Bloomberg? That is fucking wild.
They did include in the report that on a previous flight the same sensor error occurred and the pilots resolved it by disabling auto-trim. The fact there was a third pilot there is definitely interesting, but they didn't make anyone less safe by not including it in the report.
There's no bombshell here. Previous problems were well known/reported before today.
Edited to add it’s a training amendment
A single data point is still a data point.
That doesn't tell us that it's reasonable to expect pilots in command under stress to always figure it out. And they have to figure it out 100% of the time to avoid statistically unacceptable crashes. So I don't agree that pilot training is an acceptable answer given what we know so far.
The pilots were stressed in part because they didn't know -- they had plenty of time to recognize the issue and take action had they known, but they didn't, so no amount of time would have helped them. We don't know if one more thing to know about would too much, but I rather doubt that.
What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency procedure training is a major part of pilot training curriculum.
What goes away first under stress is capability for complex reasoning, which is what one would need to figure out what the heck is going on and take appropriate action. In this case an a/c doing uncommanded dive can be a result of three things: elevator controls malfuncion (unlikely in modern jets, the mechanisms for transmitting control forces from the yoke to the elevator are multiply redundant and well-understood to be critical), structural breakdown (empennage falling off would do that), or run-away elevator or stabilizer trim.
In most a/c the runaway trim can be only caused by malfunctioning auto-pilot (that's why APs have multiple redundant ways to disable them), so the pilots faced this situation react by trying to disable AP in all available ways and then immediately jumping to conclusion that there's something catastrophically wrong with elevator system or even airframe integrity. The thought that there could be yet another system which can do major trim adjustment doesn't even enter their consciousness.
Training (and/or being in a position where there's no immediate stress of wrangling misbehaving a/c) would help to get to the correct solution (disabling trim motor by pulling the circuit breaker).
That said, flying an a/c seriously out of trim is hard, and can cause an accident on its own (the fine pitch control is gone, and you can even be so far out of trim that you cannot do landing flare no matter how hard you pull up, which in heavy jets would result in structural breakdown when the plane slams into runway).
You could almost certainly disable just about anything by pulling the appropriate circuit breaker. You don't want to do that because the plane may be left in a state where you can't control it manually and you only have a few thousand feet of altitude to recover.
There are, in fact, two switches to turn off the electronic control of the horizontal stabilizer. The previous Lion Air crew used them after the pilot riding in the jumpseat went back and grabbed his copy of what I'd assume was the flight manual and had an ah-hah moment[1]. The flight 610 crew were pouring over something (quick reference handbook?) but didn't express any awareness of the stabilizer being trimmed[2].
Depending on how bad things got there are a few problems with this. First, electrically moving the stabilizer is much faster than moving it manually. MCAS can operate at two speeds, IIRC both are slower than the speed dictated by the buttons on the yoke (plus the buttons on the yoke will pause MCAS). But even MCAS will move the stabilizer much faster than a pilot could by cranking the manual wheels. I believe that moving the stabilizer from one extreme at the fastest speed to the other takes about a minute. You can find videos of the stabilizer mechanism on a 777 on youtube, it's just not something that's designed to move quickly.
The next problem is that if the stabilizer is pitched down sufficiently (perhaps by MCAS), your first instinct may be to pull back on the yoke (to move the elevator) to regain pitch. Well, once you've done that the aerodynamic forces may be such that you can't move the stabilizer into a nose up position until you let go of the yoke and let the plane pitch down further (Boeing references needing to unload the stabilizer in some documents). That's something you've gotta have cat-like reflexes for when you're already flying so low.
The really sad part is that the pilots could have disabled MCAS and retained electric control over the stabilizer by extending the flaps. But how are the pilots going to know this when Boeing refused to document anything?
0: http://avherald.com/h?article=419f2f9e
1: https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d...
2: https://www.straitstimes.com/asia/se-asia/cockpit-voice-reco...
I can't help thinking things would be safer and the Ethiopian crash may not have happened if they just published all the info rather leaving this kind of thing to anonymous leaks to the press.
Remember, a few fatal crashes are worth it as long as it means higher corporate profits.
https://www.flightglobal.com/news/articles/faa-order-tells-h...
https://www.youtube.com/watch?v=3pPRuFHR1co
The specifics of MCAS weren't out there because Boeing expected the pre-existing procedure to have been sufficient. That procedure wasn't sufficient, or the Lion and Ethiopian Air pilots were somehow not aware of it, or they forgot their training in a stressful situation.
To be clear: the planes should not have put these pilots into the situation they were in, but unless the recovery procedure doesn't work, these planes should not have crashed.
[One thing I've been wondering: somehow the pilots were able to bring the nose back up... it was only (apparently) after multiple nose downs that they eventually failed to recover the plane. What was going on there? It's as if they understood how to correct the stabilizer trim, but weren't aware of the cut-off switches.]
Both cause the stabilizer to tilt. Both cause the stabilizer wheels next to the pilot/co-pilot to turn. If the plane is pitching down, and you pull back the yoke and that still doesn't recover, don't you at some point check the stabilizer angle? If it's wrong, you use the stabilizer trim switch on the yoke under your thumb to correct it. Won't you see the stabilizer wheel turn when you do that? If you let go and the wheel immediately starts turning again the wrong way (pitching the plane down), doesn't that look like runaway stabilizer?
Also, how did the off-duty pilot figure it out if they are nothing alike?
BTW, when you write "runaway stabilizer feels nothing like MCAS" are you speaking from personal experience?
Pilots are trained well for runaway stabilizer, MCAS was essentially the same thing, but it didn't FEEL like the same thing, so a stressed pilot's mind may not immediately go to that solution/memory item.
Now things are starting to make sense.
Boeing claimed (and F.A.A agreed) that pilots didn't need training because they already had training for a memory procedure which would have solved the issue.
They both appear to have overlooked is the MCAS symptoms were sufficiently different to the runaway stabiliser scenarios pilots trained on, that pilots are having problems knowing which procedure to apply.
Besides obviously making the sensors used by MCAS truely redundant and limiting its extreme behavior of moving the trim up to the stops, a large part of fixing the MAX might be just having a big warning light for MCAS operating.
My assumption is that the jupmseat guy took a very generous interpretation of the checklist. But there may have been more panic about the trim on the earlier flight. If you compare trim inputs on flight 610 to the previous flight, the pilots on the earlier flight were making much shorter, more rapid inputs than the pilots on flight 610. The plane also pitched down far more dramatically than on flight 610.
The graphs for flight 610 seem to indicate that the pilots thought they had the trim situation under control (and they did right up until they didn't).
https://reports.aviation-safety.net/2018/20181029-0_B38M_PK-...
First he’s gonna be behind the throttle quadrant. The stabilizer wheels are roughly in the center of his vision, so he will notice them moving and when they start and stop. The pilots have them down near their thighs, so they’re not even necessarily in their peripheral vision. They will be less likely to notice every time they start and stop.
Second the jumpseat guy has no flight responsibilities. He can focus on thinking about what’s wrong without dealing with all of the other stuff you’re doing on departure. Radio calls, navigation, performance monitoring, configuration changes or being agitated by the stick shaker.
Winner, winner, chicken dinner. The existing runaway stabilizer trim checklist does not fit the MCAS failure to a T. The procedure dictates that you stop if the trimming action stops when you counter it with the switches (MCAS pauses when you do this). Unfortunately when you're taught to only think inside the box, you'll go as far down that checklist as you need to and no further.
Beyond that, just after takeoff is one of the busiest part of the flight. In fact, if you look at the graphs you'll see that the stick shaker on the left side was going crazy almost immediately after takeoff (and before MCAS kicked in as a result of retracting the flaps). The pilots of flight 610 were able to reign in MCAS with the trim buttons and almost certainly continued to do so in order to focus on the other failures and their relevant checklists (stick shaker, unreliable airspeed, elevator feel system non-op).
[One thing I've been wondering: somehow the pilots were able to bring the nose back up... it was only (apparently) after multiple nose downs that they eventually failed to recover the plane. What was going on there? It's as if they understood how to correct the stabilizer trim, but weren't aware of the cut-off switches.]
Yep, to me, that looks an awful lot like some sort of hardware failure. Something to look for in the subsequent and final reports.
My understanding is that every time the MCAS activated, its effect was incremental. It could command only a limited deflection of the relevant control surface each time -- less than 1 degree? -- but the cumulative effect of multiple activations would eventually exceed the ability of the manual controls to override it.
The MCAS activated several times, each time ratcheting the stabilizer down by 2.5 degrees. Every time the pilots tried to correct for it, it would engage again. That is what caused the characteristic up/down flight pattern.
There are a lot of details in this story: https://www.seattletimes.com/business/boeing-aerospace/faile...
What it seems like happened is MCAS ran the stabilizer to 2.5°, but the pilot didn't reset it back to 0, but just back enough he could counter with the elevator. So MCAS keeps cranking the stab each time a bit further nose down and the pilot keeps only partially countering MCAS, instead of running the stab fully back to 0.
The pilot was clearly aware stab trim had something to do with the situation because there were stab adjustments from the pilot. What I can't make sense of is the pilot only partially countering MCAS. I realize the Lion pilots didn't know about MCAS and so their mental model must have been flawed. I'm even more confused about the Ethiopian Air pilots who should have known about MCAS.
edit: also this - https://news.ycombinator.com/item?id=19442160
This was argued by Boeing to the FAA, who accepted the reasoning.
It should be noted that, if it had been determined the pre-existing procedure wasn't sufficient, then all pilots on the 737 Max would've had to undergo re-training. This would have been expensive, and probably hurt adoption of the new airframe.
Am I the only one hoping that in the end, the costs for Boeing will be more expensive than the global re-training would have been?
What alternative did the airlines have though? The A320neo? Cause that would've required re-training too.
Probably Boeing should've pushed back against the airlines: we've made you a more fuel efficient 737, but it's going to require re-training.
Someone or someones may have thought: "MCAS is the only thing that requires retraining? Can't we fudge that?"
And the thing is, it still seems like MCAS is a reasonable solution, if poorly implemented.
Later, it quotes claims that it "isn't in the documentation".
I would consider that published, official checklists are the most imminently critical form of documentation.
500 people are already dead. Boeing should be brought to the coals. It probably takes longer to go through the checklist than it does for everyone to die.
I promise if the audio recordings are ever released from CVR they will be absolutely damning. Pilots trying to make it through a loss of control checklist as they dive to their doom. A lot of those checklists have 50+ steps. Imagine trying to make it through that while fighting the plane and descending at over 3x "maximum design descent rate".
I'm sure the fucking alarms we're blaring and pilots cursing the system carrying them toward certain death.
It is extremely unlikely that the pilots were trying to work through the checklist. More likely they simply did not know what to do.
The MCAS system apparently increased downward trim without any speed considerations, to over 2.5 degrees in 10 seconds. I don't have the full flight control details but it sure sounds like pilots would lose control within minutes at most. In the LionAir crash the pilot reported control problems and asked to return to airport within 3 minutes, and they slammed into the ocean in 12.
Not sure where you're getting this info but I'm more than sure they knew something was wrong in the last 2 minutes (while they were heading into the earth at almost the speed of sound).
You really think they have ten minutes to react when by then everyone on LionAir was doomed to die?
It seems that lack of training and documentation was the reason these planes crashed though. The pilots didn’t know how to recognize the issue or resolve it.
What the hell did Boeing think was going to happen?
I think Boeing has handled the aftermath (and much of the lead up since the release of the plane) very, very poorly. I, as a layman to aviation, am not willing to bet that Boeing knew the true likelihood of a problem and didn't tell anyone or had a whistle blower over it.
However, if the issue with a non-redundant hydraulic value in the original 737 didn't teach us the lesson, this should: no matter the likelihood of failure, safety critical systems should always be redundant.
(Also, Boeing didn't handle that original issue very well either.)
That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. Something where without it you can't fly the plane sure, that make sense. The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker. The Lion Air crash wouldn't have happened had the pilots disabled MCAS instead of fighting it into the drink.
The same thing can be said for literally tons of components on a plane. You can't have them all be redundant. At some point you have to pick and choose. A sensor for an obviously supplemental feature seems like a pretty obvious one to choose not to be redundant.
>I'm not sure what redundancy has to do with this,
I think the part in the GP comment where he/she state that "no matter the likelihood of failure, safety critical systems should always be redundant" has something to do with it.
Why not?
"Cockpit displays and a warning light intended to flag problems with angle-of-attack sensors in flight were optional on the Lion Air jet that crashed, according to people familiar with the matter. The carrier, like some others, chose not to purchase the feature, people familiar with the matter said, so pilots didn’t receive any such alerts."
https://www.wsj.com/articles/maintenance-lapse-identified-as...
In any case, the actual regulations in play here would have required redundancy if the consequences of failure had been properly categorized:
> [I]n normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.
[..]
> He said virtually all equipment on any commercial airplane, including the various sensors, is reliable enough to meet the “major failure” requirement, which is that the probability of a failure must be less than one in 100,000. Such systems are therefore typically allowed to rely on a single input sensor.
> But when the consequences are assessed to be more severe, with a “hazardous failure” requirement demanding a more stringent probability of one in 10 million, then a system typically must have at least two separate input channels in case one goes wrong.
https://www.seattletimes.com/business/boeing-aerospace/faile...
From a certain perspective, the flaps give the plane redundant wings. One pair for low and slow, and another pair for high and fast.
In flight entertainment, non-emergency lighting, food prep, &c aren't "safety critical" any more than the TVs in hospital rooms are.
As a layman, I'd've imagined that all avionics and control surface control was redundant. Don't most large planes have redundant hydraulic systems and even a deployable wind turbine to run avionics and hydraulic systems under total power loss scenarios? (And hasn't that turbine been used a few times?)
Yes, weight is always a factor, but that doesn't mean that there aren't already multiple redundant, heavy, systems on aircraft.
What puzzels me is that there are 2 angle of attack sensors, but they're only connected to one of the flight computers each, with the other flight computer being the redundant one. What's more Southwest ordered the optional disagree alert, so there is some way to tie and compare these sensors.
Edit:
> The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker.
It controls the control surfaces; I'm not sure how it wouldn't count.
It's still controlling control surfaces.
> Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened against failure because you can just switch them off.
I'm not quite sure where to begin. Just because the absence of something would make the plane flight worthy doesn't mean the addition of it keeps the plane flight worthy.
Take your lane following example. Sure, they can be turned off, but that didn't help the person whose Tesla ran straight into a jersey barrier because it got confused by it and where the lane was. (https://www.popularmechanics.com/technology/infrastructure/a...)
If a mechanisms can control the vehicle, it is safe critical. It needs to fail safe under all conditions. The requirement to fail safe is part of what makes it a safety critical system.
In the most extreme of examples, adding a lane following module to a car that randomly swerves into jersey barriers once at speed and if the barrier is close enough would be a clear example of a situation where the automatic controls can cause a situation that a human could not possibly react to; hence, the system itself needs to be held to much higher standards.
Nope, MCAS is required to meet the requirements set forth by the FAA. That's not a convenience thing. Various nannies may seem like convenience things in a well balanced car, but they become far more important in a powerful, poorly balanced car like a Porsche 911 or Dodge Viper — cars that have earned reputations as widowmakers.
> [Boeing self-assessed] a failure of the [MCAS] system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed.
-- https://www.seattletimes.com/business/boeing-aerospace/faile...
Even at Boeing's understated safety risk, redundancy is required. And the system actually has much more risk than they stated, since it will eventually totally deflect the stabilizer -- as happened to both fatal flights, with the jackscrews found in their farthest position in the wrecks.
Even if we suppose that is true and a fair comparison (which I wouldn't), the way failure modes are handled is key. If there is uncertainty about the sensors that control the feature which controls the avionics the system needs to halt. This is like keeping the lane control active when the computer vision algorithm used to detect the lanes is uncertain about where the lane is. Chances are it'll steer you into the next available tree and kill you.
I don't think any aviation expert would agree that the case for requiring redundancy in the MCAS system is weak.
1. https://aviation.stackexchange.com/questions/58798/why-doesn...
Pilot input works... then MCAS silently does it again with up to +2.5 degrees additional adjustment, until after enough times it's maxed out the full rotation of the tail flap. See: https://www.seattletimes.com/business/boeing-aerospace/faile...
But the normal way of stopping it (the yoke) doesn't necessarily work, and the pilots wouldn't necessarily think to physically stop the wheel with their hands.
Well, no. Pulling on the yoke traditionally moves the elevator. MCAS adjusts the horizontal stabilizer. You can adjust the stabilizer with switches on the yoke or with the trim wheels by your knee. MCAS will pause for five seconds if the pilot hits one of the switches on the yoke (and the Lion Air pilots did this until that stopped working).
They were saying you cannot counteract MCAS's control inputs with the elevator alone. Which is a somewhat unconventional design, in a lot of aircraft the elevator can overpower the horizontal stabilizer, whereas with a bad sensor MCAS will continue to move the stabilizer until you cannot overcome it.
To use a bad analogy, in a car the break is stronger than the accelerator, so if the peddle sticks you can still stop. In other aircraft the elevator is more powerful than the horizontal stabilizer.
Pulling on the yoke is not how you counteract a runaway stabilizer on the 737. I've pasted the relevant part of the QRH in a few previous comments. Yes, the stabilizer ultimately has more pitch authority under some circumstances. That may be what happened here, but if I'm interpreting the graphs on the preliminary report correctly I wonder about mechanical failure of some sort.
This gets a bit more complex with the 737 because moving the yoke WILL actually stop one of the stabilizer trim algorithms, but not MCAS.
It is how pilots learn to counteract nose down day one of pilot training. In many aircraft hard elevation will overpower even a faulty horizontal stabilizer. If the QRH was a panacea we would have 348 fewer loses today.
> That may be what happened here, but if I'm interpreting the graphs on the preliminary report correctly I wonder about mechanical failure of some sort.
There was a mechanical failure, the AoA sensor. I'm skeptical there needs to be more going on than MCAS due to the "repeated correction" unauthorized change Boeing made.
> “The FAA believed the airplane was designed to the 0.6 limit, and that’s what the foreign regulatory authorities thought, too,” said an FAA engineer. “It makes a difference in your assessment of the hazard involved.”
In the 737 you can get into situations where the elevator has insufficient authority to overcome a stabilizer. Excessive pitch up (leading to a potential stall) that you can't counter by pushing on the yoke is exactly what MCAS is designed to prevent.
There was a mechanical failure, the AoA sensor.
A fixed offset from reality is an interesting failure mode, especially in two separate sensors (Lion Air replaced the alpha vane before flight 610), and even more interesting as it's the same alpha vane used in the 737 NG. The left alpha vane was being interpreted as almost exactly twenty degrees higher than the right.
Is that because the plane was in a banking maneuver at the time maybe? I dont know anything about planes but I heard that when you're turning the two sensors will disagree by some amount
The difference in angle of attack was consistent throughout the entire flight (well up until the crash where the values began to converge). The threshold for the optional 'angle-of-attack disagree' warning is, I think, ten degrees. It seems very unlikely that the plane had a twenty degree bank angle for two entire flights.
I don't get why the plane doesn't just say what it's doing, and why it's doing it, and have a big red button to put the plane into a safe-mode alternate law. 737s already say warnings like "BANK ANGLE", couldn't it just say "DANGEROUS CLIMB DETECTED, TRIMMING NOSE DOWN. PRESS RED BUTTON TO CANCEL."
https://theaircurrent.com/aviation-safety/southwest-airlines...
It probably wouldn’t have mattered. Lion Air couldn’t even maintain their planes properly; assuming an extra indicator would help would be charitable at best.
A detailed explanation should not be required since they should know what the different warning lights mean and what can cause them to be lit.
I personally would like to see a list of the airlines that bought the more expensive 737 max that included the additional safety features.
Even the current training does not tell pilots to know that an AoA disagree light is an emergency because it can cause the plane to enter an uncommanded nosedive via MCAS. I really don't think it's reasonable to expect the pilots to know things that Boeing is not even trying to tell them.
The crew monitor the central EICAS display for fault indications, not random locations around the cockpit.
If you start bolting-on additional check locations you increase crew workload, particularly if it's not a 'dark cockpit' like an Airbus type.
https://twitter.com/trevorsumner/status/1106934369158078470?...
I mean there are only two 737MAXes that have crashed in total, right? It's not like we have such a huge sample to work with for this to carry that much weight.
Not necessarily true. If that F-16 is flying over a populated area, it can kill numerous people on the ground when it crashes.
The black boxes will be very illuminating on this respect, especially since we never recovered the Lion Air black box voice recorder.
https://www.reuters.com/article/us-indonesia-crash/no-public...
This implies that 'normal' runaway trim can be stopped by pulling the control yoke. Maybe pilots simply have no idea what is going on once they realise that action has no effect with the MCAS?
I suspect the other factors will answered when this question is answered too.
Pulling on the yoke will only stop the 737's computers from moving the stabilizer IF it's the speed trim system (STS) that's moving the stabilizer. Otherwise the yoke is intended to adjust the elevator not the stabilizer
https://www.seattletimes.com/business/boeing-aerospace/faile...
It seems the MCAS had a flawed design where it would move the trim further than expected and would also trigger multiple times. Based on my understanding, the MCAS would have been quite safe if it didn't have these flaws (pilots deal with a failed AoA sensor as another case of "runaway trim").
No, they're not.
When you hit the trim buttons on the yoke MCAS stops for five seconds. What Boeing considers runaway trim would not stop when you counter with the trim buttons.
Smoke testing could have been performed such that all possible combinations of transducer input could be considered and evaluated thoroughly for closed-loop effect at runtime.
These types of integration tests should have been performed repeatedly, seemingly endlessly in the quest for bugs and analysis of the full spectrum of runtime results and effects.
In my experience in the software industry, I've always done this for applications that have infinitely more trivial effect and results than an airliner at altitude containing hundreds of souls.
One potential counterpart to the seemingly infinite greed we see exponentially increasing could be the old adage that karma is a bitch.
Yes, you can test control loops -- you can even turn it into a unit test. At least in theory.
The problem is that to do the test you need either a working, physical system or a good model. So if you're making a shutdown valve for a chemical plant, you need a physical build of that control valve. Even on that scale, you're talking about something that could potentially fill an engineering lab, be quite noisy and have a considerable amount of stored pneumatic or hydraulic energy. It's possible, but not exactly practical.
The alternative is to model the system, but now the question changes: how can you be certain that your model is accurate and models all the variables? Say your valve is slower when it's cold and you don't model that -- now you have a false positive result ("it works" -- but nobody realised that "temperature" was a dependent variable).
So you take the middle ground - you can have the test jig for a week, so you record the inputs and outputs for a week under varying software conditions. But those recordings are only valid for that specific timing -- if you change the software and change the timing (maybe you move the trim motor slower), you get a model change and a false positive or negative.
It's certainly possible, but it's only possible with a good sized team, and supportive management who realise that the test is absolutely necessary.
Even with the best modeling and virtualization, a true and thorough, 100% 1:1 approximation with the real world at runtime can likely never be attained for a myriad of reasons.
However, when lives are on the line, this gap must be closed in some manner so as to provide a greater degree of confidence.
Even the most thirsty organizations with lesser consequences for their failures are usually conservative enough and risk-averse enough to know better than to release without thorough (and relatively inexpensive) testing.
My old boss used to tell stories about back in the mainframe days whereby he would send customers fancy, branded and shrink-wrapped finished-product but containing blank tapes for the latest release in order to buy a couple of weeks of extra dev time if he thought the software wasn't ready to escape.
Agreed. According to other sources [1], management rushed the development work so they could come out ahead of one of their competitors.
"But several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing."
[1]: https://www.seattletimes.com/business/boeing-aerospace/faile...
https://www.nytimes.com/2019/03/19/podcasts/the-daily/boeing...
I don't know how avionics hardware engineers do it, but in this neighborhood of the Internet, we don't trust inputs, and especially human user inputs. Because every unverified, unsanitized input is an attack vector for bringing down our software and the system it runs on.
From what I have seen, the MCAS in the crashed planes relies on a single sensor--the AOA vane in the nose--and was almost solely responsible for catastrophic loss of altitude. This model of passenger jet has a paid upgrade option to add a second sensor, with disagreement detection.
My question is why don't the yoke inputs from the pilots count as disagreement with the AOA sensor? If the yoke is consistently counteracting the action of the MCAS, why can't it disable itself automatically and illuminate a light to indicate it has failed?
I'm guessing the pilots would have more time to search through manuals in-flight to clear the fault and re-enable the system than they would trying to disable it while it's stubbornly trying to crash the plane due to a single point of failure.
It's not hard to adopt the defensive mindset that your users (or your professional testers) are maliciously trying to destroy your beautiful program with a combination of stupidity and cleverly designed unanticipated inputs. When hardware gets involved, one can personify Entropy as a being that is trying to destroy everything you love and kill you.
How would Entropy take down a plane and kill all passengers? How about it freezes the AOA sensor in the "nose is at +90 degrees pitch" position? How do we defend against that attack vector? Pilot training? Oops! Entropy also made them forget that page out of thousands of possible pages of procedural training during the critical seconds they needed to remember it. The only way to fight Entropy is by making random events more independent, rather than causally linked in a failure cascade.
I don't think this course towards blaming Boeing's lack of documentation and/or pilot training is helpful. I don't think there's any option for Boeing but to immediately recall and retrofit all aircraft to the multiple AOA-sensor option, at their expense, and refund every airline that actually paid extra for it.
That is ridiculous logic to implement in a "safety" system. An automated system should never cause a plane to dive unless it also knows that it has enough altitude to safely do so - much less in a way that makes it difficult for pilots to override.
A computer should never assume it knows better than a pilot. A computer is only as good as the data it gets and the software it runs. Sensors fail. Data gets corrupted. In the current state of the industry, software bugs are inevitable.
Airplane software is supposed to help pilots, not hinder them. In light of these events, I'm thinking twice about wanting a self-driving car in the near future.
I'm a pilot (former CFII) and the whole automation fail danger strikes me as terrible. John Q Public says "I want the automation to override the pilot's mistakes!" What? OK fine. What about Asiana Airlines Flight 214 where the pilot advanced throttles, an explicit intent input, and yet autothrottles were set so the automation said nope. And then John Q Public are all, well the pilot should have KNOWN!
It's like it's a game where the pilot is only there as the last resort to be blamed if they too fail, even after a sequence of automation failures. Automation betraying pilots at low altitude is in my view functionally equivalent to an in-flight breakup. And automation in the cockpit mentality in the face of failures has been, for 20+years, "add another button, add another feature, add another routine" to tack on all the others.
And yes this absolutely makes me think of autonomous driving as total b.s. Airplanes are in a standardized system, with far bigger budgets for automation and yet we still have to fall back to human pilots for routine procedures like parking, taxiing, VFR approaches and landings, and telling the automation literally every detail it needs to do, ATC communication. It's ripe for end to end automation and yet we still don't do that. Driving cars is wildly more complicated for automation: non-standard streets, paint, signage, laws, pedestrian behavior, bicycles, cars still driven by humans, weather - haha. Sounds nice, great idea, keep trying, but it's complete bullshit.
I expect this will be included in the accident report. Hopefully NTSB will conduct their own first hand interview with this pilot. (I can't think of why they wouldn't.)
Self-certification has a place, but it should always be accompanied by random checks and shouldn't be for anything large, critical, or first time through.
Edit: Better in that it helps solve what is largely a political and not an engineering problem.
It lies with the managers who wrote the specification that said that for business reasons the new plane must not require any additional training or type certifications, and cut costs by implementing the required systems with a non-redundant sensor.
Unfortunately, correctly apportioning all of the blame won’t bring back the souls lost.
If we just let these people off scot-free, then you can count on more similar things happening.
The desire to assign fault to one individual and punish them is a very emotional response to this situation, it means people will not accept that it was an unforseen or systemic issue (people familiar with air crashes have seen in the past some systemic issues, where everyone did everything how they were supposed to but things still went south) without some individuals to blame. Typically crash investigations try to ferret out all points of failure, you might read "pilot error" in the news, but rarely is that the only cause in the crash report.
For example, this crash: https://en.wikipedia.org/wiki/American_Airlines_Flight_965
It identifies some training issues (automation dependence, speedbrakes still being applied while executing terrain avoidance maneuver) but also identifies issues with the FMS in how it manages waypoints and how they are named.
So, for the current situation there are obviously many aspects to be addressed:
1. MCAS software appears to do more than specified, this is apparently what the software update (delayed by the government shutdown apparently) is to fix.
2. Pilots need to be trained or retained on stabilizer trim runaway.
3. The 3 AoA sensor option might need to be mandatory on the 737 MAX.
4. The FAA may need to review their effective supervision of both Boeing and the air carriers.
I can only think of one CEng I know, and he works in civil engineering. I've never met a Chartered/Certified software or electronics engineer (that I know of).
> The Aviation Safety Reporting System, or ASRS, is the US Federal Aviation Administration's (FAA) voluntary confidential reporting system that allows pilots and other aircraft crew members to confidentially report near misses and close calls in the interest of improving air safety.
To play devil's advocate anyway, as someone who has not been following this actively, I find this article to cement the idea in this reader's mind that a Boeing malfunction is involved in all three incidents. Is this even conclusively established? Would Boeing want this spin at this point?
The suggestion that an extra brain might randomly have averted two multi-fatal crashes and that this error mode has occurred at least three times seems like it would be a bit pyrrhic for the PR people at this juncture, no?
While I can sometimes like trump for not submitting to anybody - even he bows to MIC
1. I am glad that 737 MAX has been grounded. May it stay that way, globally, until this issue is provably resolved.
2. The entire Boeing chain of management that resulted in these crashes should be publicly flogged, their remuneration & benefits clawed back & subject to a mandatory minimum prison sentence.
Who the hell am I kidding! Neither is very likely to happen in the present day US. Carry on then, I guess. Just make sure to sign your Last Will & Testament before taking that next flight.
Stock is down 15% since March 1. Hard to know what an executives there are thinking, but I hope some folks in the organization genuinely feels some sort of empathy for the families of the deceased on these flights.
The top 3 officials at FAA are unfilled, with seat-warmers there in an "acting" capacity. I wonder if that's related. https://www.faa.gov/about/key_officials/
Not to comment specifically on this as FAA isn't my area, but if the secdef doesn't come to work tomorrow the undersecretary is going to take the same actions he would have. I'd imagine most of those orgs trend that way.
DOD has far more "expert leadership" in the form of the FO/GO community than the other gov agencies as well -- the secretaries exist to implement policy, not run day to day operations.
The US government is a complex system, and like most complex systems it works best when you, a non-expert, don’t randomly yank out pieces and declare them unnecessary.
That said, generally the undersecretaries are appointed and confirmed as well, as their role is to step in and backfill if the primary is not available, so that answers that issue.
I think your notion that career personnel have as much DC political clout as unconfirmed career officials is one of those things that sounds good if one is trying to win a debate, but is unlikely to represent the actual facts on the ground.
https://www.americanshipper.com/news/?autonumber=67974&sourc...
Political clout in DC isn't what runs organizations and gets the day to day business done. It's what plays well on the hill in pointless back and forth BS sessions that a totally ineffective congress likes to have, it probably helps to some extent in budgeting discussions, but it's more posturing than anything else in a lot of ways.
Anywhere you go in the military you'll find all the GOs who are in charge, and powerful, and senate confirmed, and all that good stuff, and they've got a Chief of Staff and an aide who actually run everything, and can continue to do so if their GO walks in front of a bus. It's no different in any huge bureaucracy -- sure, CEOs make decisions, but the day to day business doesn't stop if they don't answer the phone for a while. I would actually posit that if it did the whole organization is dysfunctional to the point of ineffectivity. But I'm being redundant in describing DC that way perhaps.
Oh well.
"Legal action" against bad decisions is a must. However, mandatory prison sentence for accidents is a terrible idea.
The planes seem eminently airworthy, so far it appears they weren't brought down by anything that's terribly difficult to engineer out of. Unfortunately for Boeing and the FAA, nothing is more costly than an accident, it will take years to earn back the public's trust. Even if it's found the pilots were downright negligent in their handling of the MCAS failure, that won't make the general flying public feel any better about it, and it won't bring back the dead, may they rest in peace.
> The planes seem eminently airworthy
An uncontrolled nosedive caused by a single sensor failure is not in anyone's definition of airworthy. It must be fixed. This lack of airworthiness was not the pilots' fault.
And all Airbus types have three or four. Boeings only have two, even on the 787 ( on which one is vulnerable to damage from jetbridges ).
It is disappointing that a manufacturer would cut corners on sensors for a $100 million aircraft.
People hunger for someone to blame, rattling off a long list of maladies that should befall that person, until they have been thoroughly satisfied, but they are never satisfied. They always feel there should be someone else, something more, something deserved.
The truth is, there is no point to such a punishment here. It is unlikely that any individual plotted to kill people by pushing some faulty code out of malice. These were people simply doing their best and they failed.
I remember that the aircraft in question was tweaked beyond stability in order to reuse the existing type certificate. This procedure need scrutiny, likely both on Boeing's and FAA sides.
Where were the glaring safety warnings to the airlines, their customers?
No, it should stay grounded permanently. Who wants to risk their lives in one of these things now, with the reputation that Boeing has now earned? The airlines should be able to return these things to Boeing and get their money back. If that means Boeing goes under, then so be it.
It would have been clearer if they had written something simpler, like "Lion Air 737 Nearly Crashed One Day Before Deadly Accident"
Am I missing something here? Isn't it normal for off-duty pilots to ride in the jump-seat?
Being in the right place, and happening to know exactly how to deal with what would otherwise kill the pilot and all the passengers, is incredibly fortunate.
Check out the Asiana crash at SFO for an example of where CRM failed hard. The pilot flying in that case was told by the other two pilots in the cockpit how to avoid the crash and he STILL flew a perfectly serviceable plane into the ground in perfect weather on an extremely easy visual approach.
It's good the pilots took advice -- but they should not have needed that advice because they should have been trained to operate the system properly.
The whole thing reflects very poorly overall:
- The pilots were not trained properly on the new system, and a third pilot who happened to be hitching a ride had to tell them how to operate the plane.
- The plane was allowed to fly again the next day despite the malfunction, none of the pilots flying it were properly trained, and everybody died.
- The incident was not reported properly at the time, nor was it reported after the same plane had crashed the next day.
It's hard to train for something that doesn't exist according to Boeing
The plane was allowed to fly again the next day despite the malfunction
The plane was serviced between flights, and assuming that Lion Air actually did what they claimed, Lion Air maintenance followed the Boeing instructions by the book.
The incident was not reported properly at the time
The malfunction was written up in the maintenance log and the issues were addressed. Unfortunately because Boeing refused to disclose the existence of MCAS the pilots wrote it up both as what they saw (EFS non-op, IAS disagree), and if memory serves, they also suspected the one algorithm they knew about (STS)[1].
From the article:
> The so-called dead-head pilot on the earlier flight from Bali to Jakarta told the crew to cut power to the motor driving the nose down, according to the people familiar, part of a checklist that all pilots are required to memorize.
Clearly only one of the pilots memorized the checklist, but they were all required to do so. Presumably the pilots who crashed the plane the next day didn't memorize it either.
I've already posted the checklist. If you've memorized the checklist you'd know that it says to stop if the trimming stops once you hit the push buttons on the yoke. MCAS stops trimming when you manually input opposite trim (and you can see this on the black box graphs from the preliminary report).
Downvote away...
So yes, I will try not to break the site guidelines again (I agree this is a clear case of breaking site guidelines). It just makes me sad how HN used to be a place where people could ask genuine questions and not be downvoted to invisibility, for whatever reason.
Absolutely not, I know several airline pilots and they deadhead in economy seats.
Lots of blame for Boeing, but the real criminals are Lion Air who apparently don’t know how to maintain airplanes. Compare their safety record with Southwest Airlines. Lion Air shouldn’t be allowed to fly.
Say what you will about Boeing, but this could have been avoided if the airline had better safety practices. Every pilot on that plane should have been trained on the new system. And the malfunction, if reported properly, should have caused that particular plane to be grounded for a mechanical inspection. Instead it flew again and hundreds of people died because they weren’t lucky enough to have one of the pilots who was trained properly.
How is that supposed to work when Boeing didn't inform any of the airlines of this system?
"This is the first description you, as 737 pilots, have seen,” the message from the pilots association at American reads. “It is not in the American Airlines 737 Flight Manual … nor is there a description in the Boeing FCOM (Flight Crew Operations Manual). It will be soon.”
It doesn't seem unreasonable to me that the jumpseat rider made an educated guess based on some prior experience. Aided by the fact that he didn't have other things to do besides observing.
Or he went back into the cabin and pulled out a copy of the FCOM to do some emergency diagnostic work.
https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d...
2 pilots crash the plane...
"Why didn't you learn how to fly with the new system?!?!"