Boeing delays 737 MAX software fix delivery
arstechnica.com
arstechnica.com
It's not until some poor, senior engineer, who is probably one of their best staff, has a stellar reputation, and genuinely cares about their job, their team, the product, and the company ... they have to fall on the sword and TELL management what's going happen: we're not shipping this yet, IT IS NOT SAFE. Then that goes all the way up the chain, management at every level wrings their hands, "how oh how did this happen?" (although they specifically are talking about the missed deadline, not the safety concerns). It gets high enough that feeling is overcome by senior leadership wrath, which flows back down, and ultimately that engineer and their entire team is punished.
What a dumpster fire.
If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.
Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Boeing did not want to sell the training as an add on package, they didn’t want more training at all. This reduces the cost to purchase the 737 Max, because existing 737 pilots can fly the max without recertification.
What was sold as an add on was the system to detect the two AoA indicators disagreeing. This would help, but it probably would have been less effective than MCAS training would have been.
Better still would have MCAS read both sensors and disengage when they disagree, with an alarm.
A few hundred people who died as a result of MCAS would disagree. MCAS is not safe as currently implemented, or the 737 Max would still be flying.
MCAS on the other hand is basically a bad hack that was necessary for business reasons. It's a serious step backwards in safety from previous iterations, which has not happened with modern nukes.
Airplane certification is expensive for both manufacturer and airlines that might want to fly it. So there is a quicker process if you just make minor revisions, a reasonable compromise on the surface. Certification is so expensive and not having to retrain pilots is such a huge selling feature it creates a pressure to make planes that meet the same type requirements rather than design new airframes.
Boeing is all set to design a new airframe to replace the 737 that will be more fuel efficient and be built for today's point to point flights. Along comes airbus with the a320neo (new engine option) that kills the 737-800 on fuel efficiency and Boeing panics. They scrap 2020 plans for a 737 replacement and design the MAX. Now the problems mount. Fuel efficiency needs turbines that spin slower but have more surface area and are therefore larger. 737 is a low slung plane, dating back to hub and spoke flight concepts where the 737 might land places that don't have jetways. Since the plane is so close to the ground, Boeing has to move the engines forward so they can raise them. This generates more lift than previous 737s, but to meet same type requirements the plan has to be the same. Not meeting same type means they can't sell to airlines like southwest who only fly a single type and any airlines who do commit will have to spend training dollars, raising the total cost of operation without adding anything to the bill of materials.
Enter MCAS, a system designed to meet the same type regulation with disastrous unintended side effects. Side effects made much worse by the fact pilots don't know the system even exists since this plane is the same as every other 737 as far as they know.
I don't think the same type regulation should be scrapped since it would stop things like fuel efficiency gains during an airframe's lifespan, but there needs to be a same type minimum training and documentation that has to be done even if the only thing you change is thickness of the paint. If anything the definition of what meets same type should be slightly expanded allowing more flexibility in what can be changed. Combined with mandatory training for all subtypes (but still much shorter than different type training) the perverse incentive to make the plane behave exactly the same is removed. That leaves room for the better technical fix to win the day rather than the one that will meet the regulation. Training costs will go up some, but less than full different type certification.
There's a nasty rumor that Boeing agreed to pay Southwest $1 million per plane if additional training was required. That's a lot of money just on the Southwest contract. If any other airlines (e.g. Ryanair) demanded similar that's a huge chunk of money.
I see this entirely differently -- the FAA was being way too lenient/cozy with Boeing, and took their word that the airplane operated exactly the same (even if it didn't). This to me indicates that harsher regulations are needed, not less harsh ones! In what other industry do manufacturers self-certify such safety-critical machines?!
Relax regulations and we'll just start seeing more of those crashes that have killed so many airline passengers previously. It's a proven fact across all industries since time immemorial; companies don't make things safe out of the good of their hearts, and are OK with shockingly high body counts. Governments have routinely needed to rein in companies that were playing fast and loose with safety.
Place a random passenger into the cockpit of a modern commercial airliner without training and ask them to fly the thing safely and you'd probably have a 100% loss rate.
This ultimately is not a training issue. Why was a system that can potentially plow the aircraft's nose into the ground utilizing only a single sensor without any redundancy in place? Boeing screwed up. Now both sensors will be used. Great, but sometimes 2 sensors fail. If pilots that operate these aircrafts are trusted with the lives of 150+ passengers, they should have an "easy button" to take complete manual control of the aircraft. My human sensors should trump any mechanical sensor(s) when my life is on the line.
Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.
Are there other feedback mechanisms present that can interrupt that determination?
That appears to be the case in these scenarios. The MCAS doesn't perform the incorrect action continuously, it looks like initial corrective measures fix the problem until they suddenly don't.
That's great...if they'd understood that the system was malfunctioning...but they had no such indication because their airline didn't pay for the optional "feature."
And then what? How much longer will it take to manually move the stabilizer to a suitable position? How much time do the pilots have at under 7,000 ft AGL? Will the elevator have to be moved nose down to unload the stab before the stab can be retrimmed?
It retains no memory of being overridden by pilot input but will keep pitching down until cut-out of the loop or the aircraft exits what it thinks is the dangerous corner of the envelope. Unfortunately it often lacks the information to make that determination correctly, due to the poorly-designed sensor integration.
That sounds like something right out of the 'Catastrophic Failures' books we studied in uni.
If that was the only issue, the plane would have not been grounded.
But it seems here on HN there's this persistent idea that it's just fine for the plane to start misbehaving and it's "only" a matter of the pilots fixing it.
Sure, why not, let's all run a cronjob that gets a random number, then beeps and wipes your computer every 1/100 times. But hey, it will beep and you'll have 1 second to fix it, sounds good, right?
This attitude killed 300 people
There is always a trade-off with these types of decisions, and like it or not, every airframe certified airworthy has the potential to kill everyone on board without proper piloting.
I'm not saying that I'm letting Boeing off the hook personally, but as someone who has an avid interest in engineering things, I do understand the optimization points they were going for with the MAX, they found a physical design that could accommodate those optimizations, but they skimped or didn't put enough emphasis on communicating changes to pilots.
The pilots are the single most versatile safety system on the plane. Hiding or keeping from them the information they would need to form a checklist to handle this type of failure is the major failing here (given we assume there were no other physical configurations that could have been grandfathered in that wouldn't have involved an MCAS like system for certification). The root cause of that omission though may be traced to the minimal retraining requirement, which was absurd in the first place.
So far, aircraft with malfunctioning MCAS has resulted in 100% loss of aircraft.
At first, everyone asserted it was 'faulty sensor reading,' but later it came out that there's also faulty programming and the MCAS system has way more authority than originally specified to the FAA.
There’s about 40 seconds before the aircraft becomes unrecoverable in these 2 crash scenarios. It’s not pilot error.
It’s design, software, certification subterfuge, lax FAA regulatory posture, and limited pilot awareness and superficial training. Roughly in that order.
Add to that desperation, in that Boeing was keen to catch up with the Airbus 320neo, and didn’t want to build (and certify) an entirely new aircraft.
Plus an extra sensor and related systems most US 737MAX’s have was an option, and at least the Lion Air aircraft didn’t have it.
Demonizing pilots or belittling the training of the LionAir and Ethiopian Air pilots is offensive and not supported by the facts.
This is going to get worse for Boeing. Their only saving grace is that the airlines and military need them too much.
<pilot; not ATP>
When hundreds of lives are at stake, defense in depth is critically important. Planes that crash unless the pilot does the exact right thing in some rarely occurring situation are not safe. It's bad design. That's like saying that airbags aren't necessary in cars because if everyone just drove perfectly there'd be no accidents. Well guess what, no one's perfect, and building systems that require human perfection are bad engineering.
But here's the thing. It's impossible to train or have a checklist for every eventuality or combination of failures. In the end, it's up to the pilots to use good airmanship and fly the plane. If systems are interfering with that, disable them and fly the plane. Trim system doing something you don't want? Disable it and fly the plane. Instruments disagree? Set known good pitch and power and fly the plane. It was daylight in good weather. Look out the window. Fly the plane. Diagnostics can wait until the plane is flying again.
Those two aircraft were flyable. All they needed to do was flip a switch. And fly the plane.
I'm not in any way suggesting that the problems with MCAS or AoA data on the 737 MAX should not be fixed.
I personally find the AoA sensors failure to be unlikely in the case of the Lion Air crash as they were replaced in between the two problematic flights.
I most interested in seeing the final results of the Ethiopian crash. My suspicion is the MCAS has terrible software and is a bug-ridden mess.
If maintenance procedures for testing did not correctly specify that a retest must start, then restart the system to actually test that the repair was successful, then that replacement may have been tested while the computer was being fed data by the correctly operating sensor. They would have had to attempted a single boot between flights for the next flight to have flown with the untested replacement sensor. If they didn't test at all, then it's possible both sensors had a problem.
This is of course assuming that there is any retest procedure at all in the documentation given that the AoA sensor wasn't classified as safety-critical.
It really seems like the makings of a bad movie doesn't it?
That's why it's incumbent upon Boeing to let the pilots know about all of the systems.
Trim system doing something you don't want?
STS generally does this by design.
Disable it and fly the plane
Boeing claims that MCAS is a part of STS. Well, you can disable STS quite easily by pushing/pulling on the yoke. You cannot disable MCAS this way.
Which, notably, they did not run right away. The need to run the runaway trim checklist was pure guesswork on the pilot in the jumpseat's part. It took them several minutes of fighting with the controls before they finally killed the trim. They even re-enabled the auto trim after killing it, not initially recognizing that that was what had fixed the issue.
Not even the flight that survived correctly identified the issue initially. This really isn't a case of "see, these other pilots got it right". They got lucky.
The two problems present themselves differently enough that it's confusing pilots (runaway trim is continuous trim movement. MCAS is 5 seconds on, 10 second off).
This is a systematic training issue. Pilots have been trained to recognize runaway trim but not faulty MCAS.
The only real solution is extensive simulator training until pilots reliably diagnose MCAS activations and start the correct checklist, something which Boeing and airlines don't want to pay for.
> Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Not quite:
While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously).
So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back).
The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots.
We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured.
Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.
After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.
Detecting a classic constant runaway trim is an old drill for pilots.
Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern.
It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.
The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)?
Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component.
> Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum.
At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft
An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo...
> The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.
> Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high.
It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.
FAA emergency airworthiness directive 2018-23-51 [1]
We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously
And what it describes previously is MCAS when receiving erroneous AOA sensor input.
Also, your post basically says MCAS is safe when disabled, because in the very same sentence you claim it's safe you also claim the pilots are supposed to know how to (indirectly) disable it. That's almost comedy.
>why the pilots did not take this simple corrective action
It's a valid question why they didn't take corrective action; it's insulting and asinine editorializing to call it simple.
[1] http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/...
Safety in an aircraft means getting passengers to their destination without injury or loss of life. Boeing failed here - blame lack of training, single sensor dependence or software if you like but there was certainly a failure.
Now no one really cares if MCAS is problematic - any solution needs to resolve the underlying fault.
This practice, fortunately or unfortunately depending on who you ask, effectively normalized deviance, and short-circuited the protection offered by that airworthyness regulation. It went from being clearly spelled out to "or equivalent level of safety" which opens the door to all sorts of workarounds.
The alpha vanes need to be a high-priority maintenance item. They may also need to be redesigned/augmented such that they can be hardened against typical failure states, or subjected to in-flight remediation/diagnostics and graceful failover.
That isn't easy from my understanding. Doing something like hardening vs. freezing would require some form of heating element, which would potentially effect the calibration of the sensor while active, and increase maintenance complexity. Adding some sort of self contained calibration unit to the sensor could work too, however, the more complexity built into that, the more costly it becomes.
There is a point of diminishing returns, and I do think the plane can be rendered safe with MCAS and pilot retraining.
Unfortunately, that will still come bundled with an aircraft losing its airworthyness rating on Stab Trim cutout.
No, it's not, and most of the regulatory agencies around the world agree. Pilots that Boeing handpicked to test out MCAS fixes (and thus knew what it was, what to do, and expected a problem) agree. And that whole runaway stab trim checklist is a red herring especially after Boeing has come out and said MCAS is a part of STS — itself a system that trims the stabilizer in a counterintuitive manner on the NG. The stabilizer operates in a counterintuitive manner on the NG and MCAS runaway doesn't meet Boeing's definition of runaway trim. Full. Stop.
https://www.nytimes.com/2019/03/25/business/boeing-simulatio...
Here's a relevant quote:
Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.
> I don't see why it matters if they are airliners as long as instability does not translate to a higher safety risk
We don't know what the extra safety issue might be.
> I don't know if any other airliners are unstable or how unstable they might be.
We don't know if anyone has ever done this before, or how completely unusual it might be.
> In this case the instability appears to have been far less significant than the faulty corrective mechanisms.
And finally we don't even know the level of instability. The system was there possibly correcting for huge issues. After all the fleet is grounded instead of just disabling the system.
It'd approach criminal liability if the FAA certified a plane they didn't know the level of instability of. This is why test flights are performed.
As the other commenter mention, something that gets lost in this discussion is the fact that MCAS was there to make the control feel approximate other airframes.
The same aero adjustments could be accomplished by the pilot, but regulations prohibit their being necessary. So, MCAS.
We're talking 'stability that adheres to control forces required by regulation' rather than 'F-117 drop out of the sky' instability.
The question isn't if they didn't know, it's if this is an unusual level of instability for an airliner.
>We're talking 'stability that adheres to control forces required by regulation' rather than 'F-117 drop out of the sky' instability.
Hopefully yes, but we don't know how much instability there is. If you assume the answer there's no point having the discussion.
Because we don't. You've only corrected a strawman, that we know this plane isn't a fully aerodynamic unstable design like an F-16. No one thought that.
I never even specifically said aerodynamically unstable, just that we don't know the level of instability MCAS is correcting for to know if it is unusual for an airliner design. From what I had read I had assumed it was actually a power-on issue and not aerodynamic. But as it turns out the issue is indeed apparently aerodynamic from the engine shape generating more lift at higher angle of attack and thus leading to pitch up.
And no, we don't know. We the public at least. We don't know how big the flight envelope is where MCAS is needed or how much of an issue it would be if MCAS didn't exist. From public information we don't know if without MCAS the plane wouldn't enter an unrecoverable pitch up attitude in normal flying conditions. That's not knowing if the plane isn't inherently unstable.
I’m not responding to a straw man, I’m responding to what you wrote. If it’s not what you meant, well, I can’t really do anything about that.
Hopefully yes, but we don't know how much instability there is. If you assume the answer there's no point having the discussion.
I was making the point that we don't know what was actually certified. Having F-117 level instability is obviously not the case but apparently the instability it does have is actually aerodynamic so your argument doesn't even work. The actual opposite is happening. The non-fly-by-wire design was modified with an automatic control adjustment to fix an aerodynamic issue. All your argument proves is that the MAX didn't magically turn the 737 into an inherently unstable design which is not relevant to the issue of if the MCAS is covering up a large or small instability.
- Boeing did a good enough job with the airframe that the plane flies mostly fine but there are no miracles and some specific angle-of-attack and airspeed situations make it fall outside the rules.
- To bring the plane back into compliance they implemented a fairly simplistic solution in MCAS. Because the situation that is being fixed was fairly benign they didn't engineer it with triple redundancies.
- The lack of redundancy was understood to not be a big issue because the worst possible outcome is runaway trim and that's something pilots already train for anyway.
- The MCAS runaway trim presents itself in such a unique way that even experience pilots that are already warned about issues with the plane fail to diagnose it.
It's in this context that I would then like to know how unusual this situation is. If modern airliners all have these kinds of issues solved by control software then this is just another failure mode that needs to be fixed. If instead it was indeed unusual to fix the aerodynamic issue with control systems then the discussion about Boeing forcing through with the 737 instead of redesigning becomes more important.
McDonnell Douglas also implemented something similar one of their DC' family of jets. I believe it was either the 9, 10, or 11. In that case it was to accommodate a smaller tailplane to decrease drag.
"I don't know" certainly does not translate to we don't know. Plenty of people know.
That is FUD. The level of instability was absolutely known to the manufacturer and certifying agencies before delivery, and even before first flight. The reason why I said "appears to have been far less" is because the summaries of this instability I have read did not describe it as major, and even now, nobody is pointing to the instability as a significant issue. The issue is with how it has been dealt with. Until information comes to light contradicting the information known publicly so far, it is unreasonable for me to be afraid of something I have zero evidence is an issue when evidence to the contrary exists.
In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't. Some more people will have their eyes on it, but again, we still won't know. That is the way most science and technology works. Everyone has their small domain of expertise and must trust others in their own. Mistakes were made, and most mistakes look stupid/obvious on hindsight, but they don't negate the capacities of the parties involved. All car manufacturers have safety recalls extremely regularly and we don't make them out to be criminals, nor do we make the certifying agencies pariahs. I personally find it an exaggerated response to lose all trust in everyone involved - especially since new models of planes regularly have more accidents in their first few years of flight, because they are hard to make and they have bugs. It also seems unreasonable for me to criticize a manufacturer for taking economic/market concerns into account when historically even the largest manufacturers are on the verge of bankruptcy semi-regularly. Realistically, they must. At the same time this specific decision does not appear to have been the correct one, but I don't demonize them for making it and even at my most cynical, they obviously did not think people would be dying because of it.
> Since there is no evidence the problems you are bringing up are actually problems
I didn't bring up any problems. I just said that the things you were claiming were true are not things we actually know to be true.
>In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't.
This is precisely true. Which is why I responded to you by describing the bunch of things we don't know. Chances are this will be fully fixed and we will get a very nice detailed report on how that was done. The actual engineering tradeoff of more inherent stability versus more control is something we don't even know enough to conjecture well about. That's what I responded to in your comment.
Recent 737 models, including the MAX 8, make partial use of fly-by-wire systems, such as the MCAS that's elicited so many hot takes recently. Airbus aircraft, by comparison, make heavy use of fly-by-wire systems, and have for years. In terms of functionality, it's perhaps the single largest difference between their product line and Boeing's.
On the other hand, the widebody 777 is the first Boeing product to go fully fly-by-wire, completely separating the pilots' control inputs from the aircraft's control surfaces in the way that all modern Airbus aircraft do.
If fly-by-wire is the problem - if, as you seem to suspect, these systems exist to compensate for the inherent flaws of aircraft designs which otherwise would not be able to stay safely in the sky - then these Airbus models, and the 777, should have pretty rough safety records, shouldn't they? We should expect to see these other aircraft fail due to problems of the same sort as affected the 737 MAX 8's MCAS, right?
Luckily, we don't actually need to expect anything in this case, because we have good information on the frequency, severity, and causes of airliner accidents more or less all over the world. Indeed, that information is so good, and so available, that it's a major scandal, and a fecund ground for conspiracy theories, in the rare case where it's not available, as with Malaysia Airlines flight 370.
Thanks to that information, we know that the safest airliner on the planet, by flying hours, is the Airbus A340, which has not yet had a fatal accident. Second is the Boeing 777, which has seen only 541 fatalities in its almost quarter century of revenue service - and that's counting the 298 souls aboard MH 17, shot down five years ago over Ukraine.
Both of these aircraft are about 25 years old. Both have full fly-by-wire control systems. And both are, by any measure, among the safest commercial airliners in the world. If fly-by-wire were intended to cover up for the deficiencies in basic aerodynamic design you seem to lump into the term "instability", is this the safety record you'd expect to see?
I also am unconvinced computers can mediate an airplanes aerodynamic design in order to achieve certification under this part, because again by my reading the expectation is that we (pilots and the flying public) can expect static and dynamic stability dynamic stability, laterally and longitudinally. Can computer control improve these behaviors? Sure. Can computer control make them more linear or consistent or docile or predictable? All of those things. But is it acceptable to have negative static stability, naturally occurring by design, in transport category aircraft moderated by computer? I don't think that's allowed but then I'm not deep diving these regulations either. What happens if all computer control goes down? You can't fall back on the natural static and dynamic stability of the airplane, because it doesn't exhibit those characteristics? That seems bad and not consistent with FAR 25.
However, if any such computer safeguards can be disabled (either by the computer itself becoming confused and removing those safeguards; or by pilots disabling them explicitly), I expect the pilot to be trained as part of the type certification requirements, how the airplane behaves when the safeguards are enabled and disabled.
I'm quite sure Boeing knows the answer to these questions. I suspect the FAA knows the answer to these questions. And when you say "we don't know" I think you mean HNer's engaged in discussion, who maybe aren't even aware that quite a lot of things are mandatory for obtaining transport category aircraft airworthiness certification.
I mean that the general public doesn't know that indeed. And thanks for the references, I'll look them up. The original post I replied to was specifically saying that what you are now describing is not allowed (these types of planes being unstable) should be acceptable.
The only really stable commercial aircraft are, perhaps, the bushplanes. They are not fast and not fuel efficient over any real distance.
This doesn't follow. Not even fighter jets were inherently unstable before modern control electronics. Using the electronics to make the flight characteristics better is not the same as the airframe being inherently unstable.
Fighter jets are also, in comparison to airliners, not very aerodynamically efficient. They can be fast but burn lots of fuel while doing so. They are like a motorcycle compared to a bus.
Until they hit an AOA that puts the tail in the wind shadow of the wings. Then some will pancake. They can slip sideways into scary turns/dives and will not recover on their own. And they are delicate. It doesn't take too much force to twist them out of shape.
In a deep stall you can’t recover from, it’s because the aircraft’s stability is greater than its control authority, not because it’s unstable.
Other airliners have had undesirable parts of the flight envelope. The 727 for example has a high T tail, and it's possible to get into a deep stall, which is not recoverable because at very high angles of attack the elevators are in the turbulent air behind the wings. In the UK, the CAA required 727s to be equipped with stick pushers to prevent them ever getting close to this regime. This was due to their experience with a BAC 111 that deep-stalled and crashed in 1963. I don't think the FAA ever required this though.
(For those who don't know, a Deep Stall happens when the horizontal stabilizer gets in the "air shadow" of the wings, hence you can't get airflow there to move the plane)
Some interesting discussion on t-tails and deep stalls http://www.rbogash.com/Safety/deep_stall.html
It won't "take itself" but possibly just a very light pull would stall the plane in some situations, and that is the very safety problem which Boeing tried to solve with MCAS, while keeping silent on its existence, because the plane is behaving differently than the one for which the pilots trained. Which is the opposite of how the plane was advertised and sold.
So any time when the MCAS is off the plane behaves differently than the one for which the pilots trained, therefore "just keep it turned off" was also not an option.
And we don't know how "light" is light, it can really be the case that it's even dangerously light.
Was the need for MCAS really so infrequent ("never during the pilot's career" -- are you aware how seldom it is?) the planes would simply have MCAS completely disabled and fly as we speak. That would be the full content of the Boeing's "software fix.
It's obvious that MCAS has to be kept turned on as soon as no autopilot is activated. (I'd also like to know how non-redundant (i.e. max 2) faulty AoA sensors affect the autopilot, by the way -- having just read that the modern Airbuses have four of combined AoA-speed sensors).
"But it's just because of the regulations" -- don't forget these regulations are there to minimize the number of crashes. And the regulations eventually in this case reduce to as simple as "the pilots have to be trained for the plane if the plane behaves differently." Which they weren't, and the latest Boeing claimed on that topic, after the two crashes was that the "one hour iPad training" will be enough(!?) And we now even know that Boeing was even allowed to do the certification process for themselves instead of FAA doing this.
Actually... Wasn't there a famous case where the pilots managed to save a plane without engines by just gliding to an airport? Would such a thing even work on the MAX design?
Ah yes, here it is: https://en.wikipedia.org/wiki/Air_Transat_Flight_236
Yes, because the problem with the MAX is that the engines provide an off-center-of-gravity thrust. If the engines weren't running, the MAX would glide just like any other 737.
There is also the case of the Gimli Glider [1], and any commercial airliner is certainly capable of "gliding" for at least some time, but I think the GP was adhering more to the actual definition of "glider" [2], which is an aircraft that can fly entirely without power from any engines at all.
MCAS has one function: give the MAX 8 flight characteristics that are similar enough to previous versions to not require significant training.
In fact, it's only when the engines are actually working that you'd need this... they're more powerful and further forward, meaning that at high thrust the aircraft will have more of a tendency to pitch up.
List of airline flights that required gliding
https://en.wikipedia.org/wiki/List_of_airline_flights_that_r...
including several 737's (plain ones, not "MAX"), most notably:
An open question I haven't yet been able to determine is to what degree software is an acceptable mediator to compel such behaviors. But I'm very skeptical that it's acceptable at all, let alone by something that can be intentionally disabled with two switches as a troubleshooting/override, and then also not require any difference training for the new behavior that ensues.
Whether MCAS exists strictly for FAR 25 airworthiness, or to avoid a different type rating for the pilot under FAR 61.31 from any other 737, it's questionable how you get around either of those things once it's disabled on purpose as a emergency/troubleshooting technique.
Which is worse upon setting STAB TRIM to cutoff? That the airplane isn't legally airworthy? Or that the pilot isn't legally type rated? Or even possibly both? And was either the case with the previous 737 models? Definitely not.
Sorry, but this isn't a credible comment.
Modern engines run bigger slower fans to reduce fuel consumption and noise. Bigger engines don't fit under the wing.
The engine fitment issue has been around since the 737 went from JT8D -> CFM56, hence the punched in the jaw look of most current non MAX 737s.
New generation, bigger engines, same form factor. Sure they could've redesigned the half of the plane but then it's not really a 737.
That is exactly the budget and time bit - lots of time and money for Boeing spent designing a new airframe, then the "not really a 737" part means lots more time and money spent by Boeing getting it certified, and lots of time and money for their customers in getting their pilots trained for the new plane.
A factor of 10 cost difference 'if they had only done x' isn't realistic.
Completely agree with your additional point though, the competition was the A320neo and the us vs them economics look better if you don't have to pay pilots to sit in a simulator and re cert.
https://www.flightglobal.com/news/articles/boeing-disputes-7...
Or does Boeing sell MAXes without that screen altogether? The Boeing update page (https://www.boeing.com/commercial/737max/737-max-software-up...) says it is the "baseline primary flight display" , so sounds like it would be included in all MAXes already, so no physical change may be necessary.
This blows my mind and reeks like other product management decisions I’ve faced in my particular industry where someone said “make that a feature we can enable so we can charge for it”. And they did charge more for it. Now everyone will get it free.
Edit: here’s a source for the claim that there’s always two physical AoA sensors installed anyway: https://aviation.stackexchange.com/a/61109
For example the vital computer compares a coded key compiled in the executable code with one read from a physical dongle. If it does not match, the system refuses to start. The dongle must be replaced separately by the person installing the software.
It’s just an example. There are plenty of variants possible.
There are usually also check lists, where the running version is displayed and verified on a safety related display to confirm the upgrade succeeded.
I definitely agree that the MCAS system should have required two AOA sensors, and been automatically disabled when there was a disagree. I agree that Boeing should have briefed airlines and pilots about the MCAS system, the AOA disagree indicator, and potentially required new training.
I find it interesting how airplanes jam as much information as possible in wherever they can.
Google search for "737 yoke checklist" reveals a variety.
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/960x600/ao...
I'd be more concerned about flying particular airlines than the aircraft model.
Certainly there have been reports of pilots complaining that they didn't find out they'd be flying a MAX 8 until the last minute, and having to get "trained" on it during their ride to the airport.
Boeing doesn't get a pass, and the Ethiopian Air pilot was just as capable if only a bit less informed.
If you cannot safely deploy your product/documentation, then you aren't done. Boeing should have known and recognized that.
The certification process is meant to be proof against a failure like this, which goes to show that there are deeper problems in the organization that need remediation.
But in the end I suppose the reality is that even an un-fixed MAX-8 is orders of magnitude safer than your car ride to the airport. So before picking aircraft models, ensure you ride the train to the airport and not a taxi...
Of the 346 people that died in the last two plane crashes, not a single one of them died in a car on the way to the airport.
https://airwaysmag.com/airlines/delta-orders-100-airbus-a321...