Ralph Nader: Greedy Boeing’s Avoidable Design and Software Time Bombs
nader.org
nader.org
So, yeah, a manufacturer tried to game the certification process to save a few bucks (and months) on a new aircraft design. That's a failure. But it's not an unforseen one!
The safety value for manufacturer shenannigans is supposed to have been the certification process itself. And I gotta say the worst failings here are with the FAA. At any point someone could have looked at the process and seen:
1. They changed the engine
2. They had to move it because it was too close to the ground, but they couldn't stretch the landing gear and keep the type certification.
3. So they moved the engines forward and up
4. But now the aircraft was less stable, and they couldn't change the tail design and keep the type certification.
5. So they did software-managed stability augmentation instead
6. But (that's right) they couldn't change the autopilot and keep the type certification.
7. So they did it with the trim, which had never operated under autonomous control before.
I'm sure I have a few of those details wrong, but the point is that any bureaucrat familiar with the aircraft could have seen that this was a ridiculous house of cards they were playing with the type certificate. I mean, one change with one workaround, sure. But a cascade like this is just obviously a perversion of the process.
Yet no one said something. Or if they did they were overruled.
The way the built-in incentives work, it's not feasible to rely on 100% forthright and honorable manufacturers. So we have a regulatory body to catch those failures for us, and it failed.
It's sad, but I think many corporations, and in general most human organizations, go through this lifecycle.
Obviously, none of this discharges FAA from all the very likely negligences they committed when reviewing the new MAX certification you have explained so well.
The FAA is underfunded to do their job properly. The major consequence of this is that to properly certify the changes from Boeing would have taken a long time. A long time would mean that Airbus would win more contracts compared to Boeing. With a pro-business administration in place, there was significant pressure put on the FAA to complete the certification quickly. They were actively encouraged to outsource safety work back to Boeing's engineers to keep pace on the timeline.
The ODA program, devolving certification work to industry, started in 2007 and followed an earlier trial called DSA.
Cessna has full type self-certification authority, too, but seem to behave responsibly. Perhaps because the bizjet market is truly competitive and if they are caught taking shortcuts then EMBRAER, Dassault, Raytheon, Bombardier etc will take their customers.
Whereas if an airline cancels their 737 Max now, they'll be waiting eight years for an A320Neo
That's not an excuse to rubber stamp a design.
It's a weird balance.
Aside, we all know safety and security are important, but we complain the other way too. How many people complain about how much we spend on defense as a country? The budget is reflective of the number of ways we need to defend ourselves and the number of ways we would need to overcome an adversary's defenses when we are on the offensive. That number grows as technology gets more advanced. The people involved in developing solutions are increasingly more specialized and salaries are getting higher. If we did nothing, somebody might drop a bomb on our head and we'd all wonder why we never spent money developing a defense.
TLDR: The world is funny and people complain about everything.
There's nothing wrong with relaxed stability, autopilots are 60 year old technology and have been keeping people safe since our grandparents were flying. And the certification process has for the most part produced very safe aircraft.
But in this case, the certification process was seen as too expensive. Boeing wanted to market a tweaked, high-efficiency 737 with newer engines, and didn't have the time to spend on certifying a whole new aircraft. So it used the same old one and the faster regulatory process.
But that assumes that the regulatory process worked. Clearly that cascade of changes was not in the spirit of "just small modifications to existing designs". But the FAA didn't squawk and certified it anyway.
And as it happened, just one of those choices (using the trim for stability control) turned out to be unsafe in unexpected ways. One was that the AoA sensor driving the thing was glitchy. But more importantly, the trim was originally certified on the assumption that a trim control failure could be overridden by the pilot, but no one realized that pilots weren't trained to think of trim as being a computer controlled thing and didn't understand what was happening when the MCAS started fighting them.
Not just that, but also pilots would need new training if it were a new type certificate. This was a huge marketing advantage for Boeing because their end customers could avoid the cost of re-training their pilots on a new airplane.
The FAA is underfunded. A pro-business administration applied pressure to help Boeing certify more rapidly. Due to time and money pressures, many things that should have been performed by the FAA safety inspectors were actually performed by Boeing engineers. The safety assessment was performed on incorrect numbers! (Boeing estimated some parameters and performed safety assessment. Then those parameters were updated after flight testing, but the safety assessment was not re-performed with the updated numbers! That's a huge problem in the process.)
A trade off too far is real a thing.
> The changes that were made were not inherently dangerous
A few hundred dead people and hundreds of grounded planes say no to this.
> The FAA is underfunded.
This is a feature not a bug. Under the neoliberal orthodoxy this is as things should be. The free market is the most effective and efficient way to regulate corporations. The FDA is a drain on the economy.
They couldn't stretch the main gear because then it could not have properly retracted into the fuselage. They were able to extend the nose gear a few inches and still allow it to retract.
The espionage against Lockheed Space that lead to the ULA formation
The rudder denials with 737 before this current crisis.
The 767 lease debacle.
I’m sure I’ve forgotten more.
They keep getting away with it and it needs to stop.
https://www.brandeis.edu/investigate/political-social-justic...
https://www.aljazeera.com/programmes/peopleandpower/2010/12/...
Flying is complex and exposing the correct instrumentation, controls, and training to pilots is a hard problem. There will be mistakes and the important thing is to learn from them. The industry and regulators are very good at this.
What's scariest about this is that it highlights the fact that many pilots are just regular schmoes. Average intelligence, adequate training. That's fine 99.9% of the time, when equipment failure isn't catastrophic. But it's crazy how many, when they're actually faced with catastrophic failure, forget how to fly the damn plane.
The runaway trim problem has been happening for 50 years. This isn't new, or unique to the MAX (same thing can happen on the small jets I fly). Anytime something like this (or any other autopilot failure) happens, every pilot is trained to disengage the system and fly the goddamn plane. Apparently the pilots on these flights didn't know how to do that. It's tragic.
For some more reading on the other end of the spectrum, see: https://www.aopa.org/news-and-media/all-news/2019/march/20/c... (this is probably equally as bombastic as Nader's article, but offers some good perspective from that side)
edit: Apparently Nader's niece died in one the crashes, which would certainly explain his outrage: https://www.cnbc.com/video/2019/03/22/ralph-naders-niece-die...
Your comment makes me sad. Especially since there will be many other people who come to a similar conclusion without adequate information.
The runaway trim problem and the new MCAS problem are superficially similar, but the symptoms are distinctly different. The runaway trim manifests itself with a continuous deflection of the trim. Pilots are trained to recognize this symptom and compensate. The new MCAS also affects the trim, but it is engaged in repeated nose-down commands. It has fundamentally different symptoms compared to the older and more widely known runaway condition.
There is no absolute reference on the position of the stabilizer. It is a wheel that turns, so a pilot must watch that wheel continuously to know if it keeps turning or if it turns periodically.
The controls column has force feedback. The pilot was pulling back with ~50 lbs of force to fight the angle of the trim. Imagine holding a 50 lb dog while simultaneously trying to review emergency procedures to find the source of the problem. The pilot was flying the damn plane, and the symptoms of this problem were different.
There’s an indicator right next to the wheel:
https://qph.fs.quoracdn.net/main-qimg-1dc99dbe662c71d7c470cf...
And the pilots must have recognized it was a trim issue because they countered it multiple times. Why they didn’t flip the stab trim cut off switch is a mystery.
An earlier crew was able to fly the plane. I agree the pilots should have been made aware of MCAS (though either the Ethiopian pilot was shockingly not aware of it or being aware didn’t help him). But at the end of the day the pilots are there to fly the plane, not manage automation:
> Why they didn’t flip the stab trim cut off switch is a mystery.
Not really. In the previous incarnations of the 737, a hard pull on the yolk by a pilot disengaged the automatic trim system. In the 737 MAX, the yolk pull method to disengaged the trim was disabled. What the pilots did would have worked on the previous version of the plane, but not on the MAX.
Boeing really tried to claim that the MAX was just like the previous version, and that pilots didn't need new training to fly it. I think the data shows that more pilot training is appropriate for this plane.
And there are two ways to look at that. One is to say "obviously this means that this failure mode is too hard to diagnose". Another is to say "holy shit Lion Air pilots are fucking incompetent, I'm never going to fly any sort of third world budget airline if any of them are like this".
The truth is probably somewhere in the middle, of course.
> What the pilots did would have worked on the previous version of the plane, but not on the MAX.
And yet the checklist continues past that point, because guess what? The "control inputs disengage trim" component can also fail, and Boeing planned for that.
Boeing fucked up big time on this one. FAA also fucked up. Pilots were inadequately trained, and some delivered info was false (Boeing said MCAS could only bring the nose down 0.6 degrees, in fact, it was unbounded)
The MCAS system was designated "hazardous" by Boeing in their own safety assessment. A system that is labeled hazardous can not be reliant on a single system failure. MCAS is reliant on a single sensor. That's already a major error in the safety analyses. As we can clearly see from two accidents, MCAS system should have been designated "catastrophic", one step more dangerous in that scale, with even more stringent redundancy requirements.
Nader's article title makes his bias and agenda clear.
If the engine placement and weight distribution caused an inherent problem with the stability of the aircraft, a rule like that might have given Boeing pause, no?
If I don't pay for the $3K automated emergency braking upgrade for my car, is it Honda's fault if I rear-end someone and die? It doesn't cost them $3K for what's mostly software and a couple hundred dollars of sensors, should they have bundled that obvious safety feature into the price of the car and not made it an optional upgrade?
Instead it's like all cars like yours have their stock automated emergency braking system malfunction, didn't illuminate the "check engine" light (that's was the extra 100 bucks), and preventing the brakes from working at all despite you slamming furiously on the pedal. My guess is you'd be a lot angrier about that if you lived.
If I have enough experience to know (or happen to have another driver with me that knows) what to do when I press the brake pedal and nothing happens, it's recoverable, otherwise I'm going to keep stomping on the brakes and fighting it without knowing that all I have to do is flip the switch to disable the broken braking system.
So it's not that I had no way to know how to get out of the situation, I didn't have the specific training to recognize it, and if I'd just paid the extra $100 for the light, it would have been much more obvious.
The real solution would be to inhibit trim if the AoA vanes disagreed. This is typically the policy for stick shakers and stick pushers.
My guess is they justified this policy because:
-the trim wheel is obviously moving, so a pilot will recognize this as a runaway trim (and perform correct memory items to disable trim)
-the system will only activate when flaps are retracted. So when the plane starts doing something wrong (nose down), the pilot will undo the last thing they changed (flaps), which prevents further nose down trim
The tactile response friction device in the electronic accelerator pedal was the point of failure. I doubt people buying the car even knew the accelerator was some electronic gadget rather than connected by a cable to the engine as per grand-dad's Toyota. Nobody was given special training on how to react should the electronic accelerator go wrong.
Now, if you are a driving instructor you can specify a second set of pedals. They might be in the other seat but you can specify them and have someone sat there to use them.
Anyway, that is as far as the auto analogy goes, tenuously...
There's a cost to human lives. We can quibble about what it is, but there's clearly a point where it is unreasonable and worse for society as a whole to make planes safer but more expensive.
They got it wrong here. But it's non-trivial to figure out without hindsight.
And I doubt American et al. were clamoring for more extensive mandatory retraining.
That's $4M across a fleet of 50 jets (Ethiopean's 737 order size) - so it's not exactly insignificant.
Japanese authorities required the feature, while the FAA and others did not. Should all of the onus be on the manufacturer? There's definitely an argument to be made that Boeing didn't reveal the full nature of MCAS to the FAA, but if that weren't true, is it Boeing's fault that they didn't bundle the feature, or is it the FAA's fault? And why did the Japanese require it, did they have information that the FAA did not have?
From a purely business case I can see why Boeing did what they did but I'm just philosophically opposed to profit being the only goal. Even if it was the only goal, this case pretty clearly shows that it wasn't 'worth it' for Boeing to skimp on safety features with what, 20B wiped off their valuation.
On a total order of $5000 million.
The problem with this is as that $4m sounds like a lot of money to pretty much everyone on the planet but if you are buying 50 medium size commercial jets it's literally a rounding error.
We can have a discussion about how de-regulations and profit motives may have contributed to this disaster, we have even throw in ideas about regulations and corporate responsibility, but we have to recognize that software at this scale and or these purposes is hard, and there's no reason why the govt may be better at it than Boeing, and the discussion about what the risk/reward ratio should be for society as a whole is super complicated and we don't nec have a way to have it.
TLDR: I'm an anarcho-socialist programmer. Boeing may or may not be evil and de-regulation and the profit motive probably eff things up in the current socio-economic sphere, but Ralph Nader doesn't lend much to the conversation here.
This is a curious and very sad bit of history I was unaware of.
9/11 was a game changer becasue it was a completely new kind of hijacking where the hijackers have no demands and everybody dies quickly if the hijacking goes according to plan. Reinforced doors are useful there, becasue threats to the passengers don’t hold weight when you know they’ll all die anyway if you open the door. That was very much not the case in the 70s.
E.g. the cited Cuba hijackers didn't very often kill people. Some of them might have given up when unable to get to flight crew, but others might have used more force to get what they wanted.
https://edition.cnn.com/2015/03/26/europe/france-germanwings...
What's been lost in this discussion is that the 737 is based on the 1958-era 707 in it's major configuration -- with its circular fuselage it is not built with compatibility with the human body in mind so of course you are going to feel like flying is hell after a transcontinental trip on what was originally intended as a regional jet.
Even if you survive the flight on a 737 you are going feel like you're dead. Since the 737 and A330 represent the vast bulk of planes built, anyone concerned about the environmental impacts of air travel (e.g. climate change, noise) would want to see the 737 get a clean sheet design like the 787.
I've flown the 3-4-3 one and will never fly it again, it is super cramped, and even the few inches of extra leg room in economy plus can't make up for the narrow seats.
So being a wide/narrow body jet doesn't really relate to seat width, it's all based on how many seats the carrier can cram in.
https://www.seatguru.com/airlines/United_Airlines/United_Air... https://www.seatguru.com/airlines/United_Airlines/United_Air...
Delta could have easily decided to fill Economy seats on their 737's with 18.5" wide seats... and then had a 2-and-2 configuration instead of 3-and-2 or 3-and-3.
Same is true for the 777, they could go with smaller seats and pack in more seats per row. Likely, the 777 is used for longer flights and they decided a more comfortable seat for an 8-16 hour flight is worth a few less passengers. Or, the 777 might be overweight if filled with too many passengers, so larger seats are justified.
At the end of the day, it's the economics of making these flights - airlines run on notoriously thin margins, and flying a passenger jet is very expensive.
Also, a modern 737 can be very comfortable - it depends on the interior layout and choices the Airline (not Boeing) made when leasing the aircraft. Airlines are responsible for the interiors...
If you had 777 flights from DC to SF and SF to DC at 6:00AM and 6:00PM, I'd be content, and I think you would satisfy most needs if everyone could fit on those flights. But then you have a 777 idle for 16 hours a day.
If, instead, you had CRJ200s (that can't handle the morning and evening rush) running all day as fast as you can turn them around, they're never idle.
I guess the final point is that people vote with their wallets and fly on the airline with the cheaper CRJ200 tickets...but I wish it wasn't that way.
Big planes rarely idle much. The domestic legs are generally tacked onto longer haul flights to/from Europe and Asia.
You'll be a fan of the new midmarket airplane Boeing is planning at the moment then.
It's really hard to think of an ideal time that Boeing could reasonably have done a clean sheet 737. They're constrained in how many programs they can run at a time. After the 777, we had the huge 787 program which pushed boundaries a lot.
Then we run into this situation now where a clean sheet 737 was not going to sell and airlines didn't want to wait and retrain their pilots, so they would've switched to the A320 making a replacement 737 untenable at this time.
It seems Boeing would've needed to somehow go back in time and do a clean sheet 737 around the same time as the 757/767 program. Which would've been amazing if they'd done it, but the 737 was still a perfectly viable aircraft back then so how could they justify it.
Also regarding the climate change, as I understand it, the MAX 9 changes were designed to _increase_ fuel efficiency.