Hacker News Reader

Comment by cal5k | Hacker News Reader

That's not really what happened here.

If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.

Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.

View on HN

If you know what's going on, MCAS is quite safe

No, it's not, and most of the regulatory agencies around the world agree. Pilots that Boeing handpicked to test out MCAS fixes (and thus knew what it was, what to do, and expected a problem) agree. And that whole runaway stab trim checklist is a red herring especially after Boeing has come out and said MCAS is a part of STS — itself a system that trims the stabilizer in a counterintuitive manner on the NG. The stabilizer operates in a counterintuitive manner on the NG and MCAS runaway doesn't meet Boeing's definition of runaway trim. Full. Stop.

https://www.nytimes.com/2019/03/25/business/boeing-simulatio...

Here's a relevant quote:

Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.

> If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.

> Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.

Not quite:

While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously).

So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back).

The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots.

We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured.

Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.

Some comments based on my understanding of the situation. I'm an engineer and I'm interested in the study of engineering failures. So, I have been following this. Initially I was thinking the blame was being unfairly placed on the MCAS system. However, now I understand more, I suspect it is a serious safety problem.

The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)?

Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.

> The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing.

Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component.

> Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.

It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum.

At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft

An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo...

> The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.

> Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high.

It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.

I understand, that's why I mentioned that the pilots didn't recognize that it was a runaway trim issue.

After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.

There is some cognitive limit of how many variants of procedures pilots can be expected to memorise and execute.

Detecting a classic constant runaway trim is an old drill for pilots.

Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern.

It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.

> MCAS is quite safe

A few hundred people who died as a result of MCAS would disagree. MCAS is not safe as currently implemented, or the 737 Max would still be flying.

MACS is safe but its not zero delta training as Boeing advertised. Pilots who were trained on it properly are able to recognize the problem and fix it when it occurs.

A problem of such potential severity should not be happening with anywhere remotely like the frequency we've seen.

I think you'd be surprised how often small problems can occur on planes. They all have _potentially_ huge severity, but none of them have huge consequences because they are expected problems that pilots are trained to respond to.

MCAS is safe in its current implementation like nuclear power is safe- it works well when you know exactly what you're doing at all times.

I disagree; modern nuclear power is way safer, and is a result of decades of continuous improvement.

MCAS on the other hand is basically a bad hack that was necessary for business reasons. It's a serious step backwards in safety from previous iterations, which has not happened with modern nukes.

I'd say MCAS is a predictable business hack that resulted from terrible regulatory pressure.

Airplane certification is expensive for both manufacturer and airlines that might want to fly it. So there is a quicker process if you just make minor revisions, a reasonable compromise on the surface. Certification is so expensive and not having to retrain pilots is such a huge selling feature it creates a pressure to make planes that meet the same type requirements rather than design new airframes.

Boeing is all set to design a new airframe to replace the 737 that will be more fuel efficient and be built for today's point to point flights. Along comes airbus with the a320neo (new engine option) that kills the 737-800 on fuel efficiency and Boeing panics. They scrap 2020 plans for a 737 replacement and design the MAX. Now the problems mount. Fuel efficiency needs turbines that spin slower but have more surface area and are therefore larger. 737 is a low slung plane, dating back to hub and spoke flight concepts where the 737 might land places that don't have jetways. Since the plane is so close to the ground, Boeing has to move the engines forward so they can raise them. This generates more lift than previous 737s, but to meet same type requirements the plan has to be the same. Not meeting same type means they can't sell to airlines like southwest who only fly a single type and any airlines who do commit will have to spend training dollars, raising the total cost of operation without adding anything to the bill of materials.

Enter MCAS, a system designed to meet the same type regulation with disastrous unintended side effects. Side effects made much worse by the fact pilots don't know the system even exists since this plane is the same as every other 737 as far as they know.

I don't think the same type regulation should be scrapped since it would stop things like fuel efficiency gains during an airframe's lifespan, but there needs to be a same type minimum training and documentation that has to be done even if the only thing you change is thickness of the paint. If anything the definition of what meets same type should be slightly expanded allowing more flexibility in what can be changed. Combined with mandatory training for all subtypes (but still much shorter than different type training) the perverse incentive to make the plane behave exactly the same is removed. That leaves room for the better technical fix to win the day rather than the one that will meet the regulation. Training costs will go up some, but less than full different type certification.

Boeing didn't panic at the NEO, their biggest customer(s) like Southwest wanted something ASAP that was competitive with the NEO. Airlines like EasyJet, Ryanair, and Southwest built their entire business on flying exactly one type. EasyJet with the A320 family and Ryanair + Southwest with 737. Southwest flies around 700 737s currently and retired their 737 Classics when it became clear that the FAA wouldn't sign off on pilots being rated on the Classic + NG + MAX at the same time (instead it Classic/NG or NG/MAX). You can build a profitable airline on a diverse fleet (look at Delta, they fly almost anything imaginable), but that's not where Southwest is now and it's an expensive road to diversify.

There's a nasty rumor that Boeing agreed to pay Southwest $1 million per plane if additional training was required. That's a lot of money just on the Southwest contract. If any other airlines (e.g. Ryanair) demanded similar that's a huge chunk of money.

Those regulations are written in blood. Thousands of airline passengers died to get those regulations where they are today, and lessening them would likely cause more deaths.

I see this entirely differently -- the FAA was being way too lenient/cozy with Boeing, and took their word that the airplane operated exactly the same (even if it didn't). This to me indicates that harsher regulations are needed, not less harsh ones! In what other industry do manufacturers self-certify such safety-critical machines?!

Relax regulations and we'll just start seeing more of those crashes that have killed so many airline passengers previously. It's a proven fact across all industries since time immemorial; companies don't make things safe out of the good of their hearts, and are OK with shockingly high body counts. Governments have routinely needed to rein in companies that were playing fast and loose with safety.

If it’s needed to be fixed then it’s not safe.

Saying that something requires training to be operated safely does not mean that it is unsafe. It means that it's a complex system that requires training to operate.

Place a random passenger into the cockpit of a modern commercial airliner without training and ask them to fly the thing safely and you'd probably have a 100% loss rate.

Of course it is unsafe. If it is activated, correctly or not, it operates covertly without indication or anunciation.

It retains no memory of being overridden by pilot input but will keep pitching down until cut-out of the loop or the aircraft exits what it thinks is the dangerous corner of the envelope. Unfortunately it often lacks the information to make that determination correctly, due to the poorly-designed sensor integration.

That sounds like something right out of the 'Catastrophic Failures' books we studied in uni.

> Saying that something requires training to be operated safely does not mean that it is unsafe.

This ultimately is not a training issue. Why was a system that can potentially plow the aircraft's nose into the ground utilizing only a single sensor without any redundancy in place? Boeing screwed up. Now both sensors will be used. Great, but sometimes 2 sensors fail. If pilots that operate these aircrafts are trusted with the lives of 150+ passengers, they should have an "easy button" to take complete manual control of the aircraft. My human sensors should trump any mechanical sensor(s) when my life is on the line.

They do have an "easy button": two highly visible switches right underneath the throttle. Bottom right here where it says "stab trim": http://www.sjap.nl/wp-content/uploads/IMG_0825-e146460235774...

Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.

But can the determination to perform the stab trim cut-off be done in seconds?

Are there other feedback mechanisms present that can interrupt that determination?

That appears to be the case in these scenarios. The MCAS doesn't perform the incorrect action continuously, it looks like initial corrective measures fix the problem until they suddenly don't.

Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.

And then what? How much longer will it take to manually move the stabilizer to a suitable position? How much time do the pilots have at under 7,000 ft AGL? Will the elevator have to be moved nose down to unload the stab before the stab can be retrimmed?

> Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.

That's great...if they'd understood that the system was malfunctioning...but they had no such indication because their airline didn't pay for the optional "feature."

While the same checklist fixes both runaway trim and faulty MCAS, pilots haven't been trained to recognize MCAS problems.

The two problems present themselves differently enough that it's confusing pilots (runaway trim is continuous trim movement. MCAS is 5 seconds on, 10 second off).

This is a systematic training issue. Pilots have been trained to recognize runaway trim but not faulty MCAS.

The only real solution is extensive simulator training until pilots reliably diagnose MCAS activations and start the correct checklist, something which Boeing and airlines don't want to pay for.

> one has to question why the pilots did not take this simple corrective action.

If that was the only issue, the plane would have not been grounded.

But it seems here on HN there's this persistent idea that it's just fine for the plane to start misbehaving and it's "only" a matter of the pilots fixing it.

Sure, why not, let's all run a cronjob that gets a random number, then beeps and wipes your computer every 1/100 times. But hey, it will beep and you'll have 1 second to fix it, sounds good, right?

This attitude killed 300 people

That is nominally the purpose of a pilot. To safely operate the machine within the envelope for which it is engineered.

There is always a trade-off with these types of decisions, and like it or not, every airframe certified airworthy has the potential to kill everyone on board without proper piloting.

I'm not saying that I'm letting Boeing off the hook personally, but as someone who has an avid interest in engineering things, I do understand the optimization points they were going for with the MAX, they found a physical design that could accommodate those optimizations, but they skimped or didn't put enough emphasis on communicating changes to pilots.

The pilots are the single most versatile safety system on the plane. Hiding or keeping from them the information they would need to form a checklist to handle this type of failure is the major failing here (given we assume there were no other physical configurations that could have been grandfathered in that wouldn't have involved an MCAS like system for certification). The root cause of that omission though may be traced to the minimal retraining requirement, which was absurd in the first place.

Looking at one component and saying it’s safe (qualified with ‘if you know what’s going on’) misses the point. In fact it’s an engineering style response because it shows some myopia.

Safety in an aircraft means getting passengers to their destination without injury or loss of life. Boeing failed here - blame lack of training, single sensor dependence or software if you like but there was certainly a failure.

Now no one really cares if MCAS is problematic - any solution needs to resolve the underlying fault.

The underlying fault unfortunately isn't 100% a Boeing problem. There are airworthyness regulations that specify how a passenger plane is to behave near stall that have had a precedent set where non-compliance can be remedied through flight envelope driven interlocks. (See stick-pushers and other piloting aids). Engineeringwise, the airframe was still not compliant; the airframe would still manifest aberrant behavior, but the action on the controls combined with a type certified pilot was considered enough to mitigate the problematic aerodynamics.

This practice, fortunately or unfortunately depending on who you ask, effectively normalized deviance, and short-circuited the protection offered by that airworthyness regulation. It went from being clearly spelled out to "or equivalent level of safety" which opens the door to all sorts of workarounds.

The alpha vanes need to be a high-priority maintenance item. They may also need to be redesigned/augmented such that they can be hardened against typical failure states, or subjected to in-flight remediation/diagnostics and graceful failover.

That isn't easy from my understanding. Doing something like hardening vs. freezing would require some form of heating element, which would potentially effect the calibration of the sensor while active, and increase maintenance complexity. Adding some sort of self contained calibration unit to the sensor could work too, however, the more complexity built into that, the more costly it becomes.

There is a point of diminishing returns, and I do think the plane can be rendered safe with MCAS and pilot retraining.

Unfortunately, that will still come bundled with an aircraft losing its airworthyness rating on Stab Trim cutout.

>MCAS is quite safe

FAA emergency airworthiness directive 2018-23-51 [1]

We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously

And what it describes previously is MCAS when receiving erroneous AOA sensor input.

Also, your post basically says MCAS is safe when disabled, because in the very same sentence you claim it's safe you also claim the pilots are supposed to know how to (indirectly) disable it. That's almost comedy.

>why the pilots did not take this simple corrective action

It's a valid question why they didn't take corrective action; it's insulting and asinine editorializing to call it simple.

[1] http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/...

They had 40 seconds to avert the accident from what I read. the memory items for runaway trim take about 1 minute in a relatively calm simulator with a professional 37 pilot to get to that point where they flip the switch[0]. They still had an incorrectly trimmed aircraft when they got to that point. also of note was that the pilots in the sim were at 3000' AGL where the other ones that crashed were at about 1000' AGL.

0. https://youtu.be/xixM_cwSLcQ?t=1016

To be frank, they shouldved went faster then. Emergency situation is no time to fool around. One of them was praying. Imagine if both people were trying at the same time. They could have finished two steps at a time.

Well, to be frank back, the steps are sequential not parallel. I haven't read anything about the CVR but if they were praying instead of flying that's a huge mistake. They didn't have much time though and they didn't have much altitude to work with(in fact, I just looked it up and they were 450' AGL when they started having some troubles but I couldn't find anything on the cvr transcript). the old adage of aviate, navigate, communicate in that order applies.

Because Boeing refused to provide them additional training that was needed to make these decisions. Boeing wanted to sell it as an add-on package. And the basic mandatory training they provided was on an iPad instead of simulator.

You’ve got it confused.

Boeing did not want to sell the training as an add on package, they didn’t want more training at all. This reduces the cost to purchase the 737 Max, because existing 737 pilots can fly the max without recertification.

What was sold as an add on was the system to detect the two AoA indicators disagreeing. This would help, but it probably would have been less effective than MCAS training would have been.

Better still would have MCAS read both sensors and disengage when they disagree, with an alarm.

How many aircraft that we know had an MCAS malfunction are currently not destroyed from a crash? 0.

So far, aircraft with malfunctioning MCAS has resulted in 100% loss of aircraft.

Wrong, the flight preceeding the Lion Air crash had the same issue, and the pilots managed it, by switching off the stab trim system as per the runaway trim checklist.

> Wrong, the flight preceeding the Lion Air crash had the same issue, and the pilots managed it, by switching off the stab trim system as per the runaway trim checklist.

Which, notably, they did not run right away. The need to run the runaway trim checklist was pure guesswork on the pilot in the jumpseat's part. It took them several minutes of fighting with the controls before they finally killed the trim. They even re-enabled the auto trim after killing it, not initially recognizing that that was what had fixed the issue.

Not even the flight that survived correctly identified the issue initially. This really isn't a case of "see, these other pilots got it right". They got lucky.

You'll note I said 'aircraft' versus 'flight'. That particular aircraft is no longer in service because it was destroyed in a catastrophic crash caused directly by the faulty MCAS system.

At first, everyone asserted it was 'faulty sensor reading,' but later it came out that there's also faulty programming and the MCAS system has way more authority than originally specified to the FAA.

And the pilots mismanaged it.

No, not mismanagement. Here’s my opinion:

There’s about 40 seconds before the aircraft becomes unrecoverable in these 2 crash scenarios. It’s not pilot error.

It’s design, software, certification subterfuge, lax FAA regulatory posture, and limited pilot awareness and superficial training. Roughly in that order.

Add to that desperation, in that Boeing was keen to catch up with the Airbus 320neo, and didn’t want to build (and certify) an entirely new aircraft.

Plus an extra sensor and related systems most US 737MAX’s have was an option, and at least the Lion Air aircraft didn’t have it.

Demonizing pilots or belittling the training of the LionAir and Ethiopian Air pilots is offensive and not supported by the facts.

This is going to get worse for Boeing. Their only saving grace is that the airlines and military need them too much.

<pilot; not ATP>

Why are you so quick to blame the pilots and no one else?

When hundreds of lives are at stake, defense in depth is critically important. Planes that crash unless the pilot does the exact right thing in some rarely occurring situation are not safe. It's bad design. That's like saying that airbags aren't necessary in cars because if everyone just drove perfectly there'd be no accidents. Well guess what, no one's perfect, and building systems that require human perfection are bad engineering.

I'm not blaming no one else. The MCAS implementation was clearly flawed, being vulnerable to a single point of failure in the AoA data (and by the way, that's where the real problem lies. Why is the MAX AoA system failing more than the prior generation of 737 where it's normally totally reliable?)

But here's the thing. It's impossible to train or have a checklist for every eventuality or combination of failures. In the end, it's up to the pilots to use good airmanship and fly the plane. If systems are interfering with that, disable them and fly the plane. Trim system doing something you don't want? Disable it and fly the plane. Instruments disagree? Set known good pitch and power and fly the plane. It was daylight in good weather. Look out the window. Fly the plane. Diagnostics can wait until the plane is flying again.

Those two aircraft were flyable. All they needed to do was flip a switch. And fly the plane.

I'm not in any way suggesting that the problems with MCAS or AoA data on the 737 MAX should not be fixed.

> The MCAS implementation was clearly flawed, being vulnerable to a single point of failure in the AoA data

I personally find the AoA sensors failure to be unlikely in the case of the Lion Air crash as they were replaced in between the two problematic flights.

I most interested in seeing the final results of the Ethiopian crash. My suspicion is the MCAS has terrible software and is a bug-ridden mess.

Ah, but the flight computer switches which AoA sensor it talks to every time it's booted.

If maintenance procedures for testing did not correctly specify that a retest must start, then restart the system to actually test that the repair was successful, then that replacement may have been tested while the computer was being fed data by the correctly operating sensor. They would have had to attempted a single boot between flights for the next flight to have flown with the untested replacement sensor. If they didn't test at all, then it's possible both sensors had a problem.

This is of course assuming that there is any retest procedure at all in the documentation given that the AoA sensor wasn't classified as safety-critical.

It really seems like the makings of a bad movie doesn't it?

In the end, it's up to the pilots to use good airmanship and fly the plane

That's why it's incumbent upon Boeing to let the pilots know about all of the systems.

Trim system doing something you don't want?

STS generally does this by design.

Disable it and fly the plane

Boeing claims that MCAS is a part of STS. Well, you can disable STS quite easily by pushing/pulling on the yoke. You cannot disable MCAS this way.

Because they were provided with zero additional training on the "unseen" MCAS system.

They had training on runaway trim. All they needed to do was follow the memory items.

6/7 pilots that encountered this situation were unable to identify it, and now 4 of them are dead.

Reply on news.ycombinator.com