Boeing software under scrutiny as Ethiopia prepares crash report
reuters.com
reuters.com
Title: Boeing software under scrutiny as Ethiopia prepares crash report
https://www.reuters.com/article/us-ethiopia-airplane-softwar...
I have numerous problems with Arstechnica's re-write, but suffice to say that nuance is lost and questionable conclusory statements added.
I will say in the case of BOTH articles, it sounds like we need to wait and see. Neither article has an answer for how auto-trim was re-actived, be it the pilots or something else. The answer to that question may have wide reaching implications.
https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi...
"the high speeds observed in ET302’s FlightRadar24 trace (Figure 1) were logical. It’s a consequence of following the Emergency checklist for “IAS disagree” (IAS is Indicated Airspeed, i.e. the dynamic air pressure experienced by the aircraft) after takeoff.
The combination of the preceding checklist followed by an MCAS Trim Runaway checklist could create a situation where manual trimming after a Trim Cut-Out would be difficult to impossible and would require non-checklist actions."
"At a miss-trimmed Stabilator, you either have to re-engage Electric trim or off-load the Stabilator jackscrew by stick forward, creating a nose-down bunt maneuver, followed by trim.
Stick forward to trim was not an option for ET302, they were at 1,000ft above ground. According to The Wall Street Journal, the ET302 crew re-engaged electrical trim to save the situation, to get the nose up. It was their only chance. But too late. The aggressive MCAS kicked in and worsened the situation before they could counter it."
The Airport elevation of Addis Ababa airport is 7625 feet AMSL. The highest point of the flight recorded by the flightradar24 is 8600 ft AMSL which gives the plane's altitude of around only 1000 ft at highest! The speeds relative to the ground recorded near the end were 380 kt, i.e. 640 ft/s. Obviously every second mattered, and at the above speeds, the plane was only a few seconds from crash away when the MCAS was pointing the nose down.
This is a talk by Professor Nancy Leveson that describes exactly this type of problem. Dangerous interactions between systems. I posted this before when a lot of people were engaging in low grade racism by blaming the Indonesian and Ethiopian pilots competence and training. Seems very topical at this point tho.
If I could push one book on all engineers (and not just programmers as it goes over entire systems failures), let it be this, I recommend it to everyone.
https://www.amazon.co.uk/Safeware-System-Safety-Computers-19...
I'll watch that link ASAP - thanks @Gibbon1!
Not to be pedantic, but altitude is the distance measured from MSL, height is measured from the ground. So their altitude was 8600ft, their height was ~1000ft.
If true, and more and more seems to point into this direction, we can pretty much lay the arguments of the "badly educated and overworked third world pilots who are too dumb to work a checklist" to rest.
I always found that reasoning rather bigoted and jingoistic.
It seems more that Boeing was selling a death trap certified by their cronies at the FAA.
What galls me most is the fact that they didn't ground that atrocity after the Lion Air crash, but used their energies to throw customers and pilots under the bus and developed a checklist, which, as it turns out, is actually counterproductive and does nothing to fix the inherent design problems of the plane. If anything, it serves the exact opposite.
The second crash is mass murder for commercial reasons, period. If not legally then at the very minimum morally.
I can imagine that being irrelevant in this case: Even if the pilots activated it, it doesn't mean they must have made any error, see my other comment here for the details.
In short, if the pilots turned the switch off, turning off much more than just the MCAS (as there's no switch "just turn MCAS off, keep the rest on"), but then the plane was already not possible to save (it was only 1000 ft above the ground!) and they turned the switch back on, hoping for obtaining more power/possibility to trim, and the faulty MCAS kicked in again (despite being the reason for the switch cutoff before) and even sped up the crash, then the pilots in fact did absolutely all that was possible to do.
And I can even imagine that the code which included the promised "fix" by Boeing until just a few days ago still had the built-in "obvious to implement by default" logic: "oh, I'm booting, now I can point the plane to the ground again because the sensors say so and I'm completely ignoring the fact that the pilots already turned me off shortly before" and that that was the reason the fix release is now delayed. But also note that that plane, the way it is constructed, certified and sold simply needs the MCAS and can't reliably fly without it, otherwise Boeing's fix would have been turning the feature off completely.
If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time.
I'm sorry, but your wording sounds like you're advocating taking revenge on engineers / managers for poor decisions made in good faith. That's barbaric, and I hope we as a society move beyond this sort of communal revenge. We'll all be psychologically better off if we encourage more healthy ways of seeking relief from tragedy.
An awful lot of mistakes are only "obvious" in hindsight; engineering is full of such.
But who actually proposed what here?
No.
It's you, KMag, who is creating a straw man against SolaceQuantum.
SolaceQuantum's actual wording is using "paid well in jail time." Which means the expectancy of the involvement of the judicial system (courts, lawyers etc.) which could also eventually produce such a sentence (jail time).
And that is certainly not "advocating taking revenge."
SolaceQuantum also never mentions "engineers." It's again your straw man construction and a false claim.
It's already clear that in this case the "fox was guarding the hen house" (As reported in (1)): "The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes." Note: FAA "is a governmental body of the United States with powers to regulate all aspects of civil aviation." Also note, just as an example: "The FAA has been cited as an example of regulatory capture, in which the airline industry openly dictates to its regulators its governing rules, arranging for not only beneficial regulation, but placing key people to head these regulators." (3)
1) https://www.seattletimes.com/business/boeing-aerospace/faile... )
Also (2):
2) https://www.seattletimes.com/business/boeing-aerospace/senat...
3) https://en.wikipedia.org/wiki/Federal_Aviation_Administratio...
All that is certainly not about the "engineers." And the Senate Committee already investigates.
Mob vengeance intermediated by the state is still mob vengeance.
> SolaceQuantum also never mentions "engineers."
The decision makers certainly included management and engineers, and the OP was ambiguous about which decision makers should be punished. I think my statement is just as true if amended to just read "management".
> It's already clear that in this case the "fox was guarding the hen house"
A conflict of interest is not proof that one is making decisions in bad faith. We should certainly strive to eliminate conflicts of interest.
On the other hand, to jump to the conclusion that decision makers are likely deserving of prison time shows a lack of perspective and empathy. I'm sure a lot of people at Boeing will carry a lot of guilt with them for the rest of their lives over this.
Maybe there were decisions made in bad faith, but I think we have far far too little information (and too much hindsight bias in the balance) at this point to determine if those making poor decisions were making them in bad faith, even if there was a clear conflict of interest.
It's comforting to believe that most tragedies are the result of evil people making decisions in bad faith, and that most tragedies can be avoided by identifying and punishing these evil people. The real world is seldom so black-and-white, and I strongly oppose our society's common knee-jerk reaction to quickly reach for imprisonment as the solution to the latest tragedy. By all means, punish people who make conscious decisions to harm their fellow humans, but many tragedies don't fit this simple narrative.
Negligence in critical safety infrastructure is bad faith.
The poor design of the system is directly stated as the reason the OP hopes people are imprisoned.
I'm al for an investigation. Publicly calling for jail time so prematurely, in a case that would surely be highly publicized and politicized, makes it even harder to conduct an impartial investigation and trial.
When the public puts pressure on the courts to hand down a predetermined verdict and punishement and they are successful in their efforts to bias the process, that is mob vengeance.
Causing death of 350 people due to "intended" ("it's good for our business") negligence is enough to deserve an evaluation of the decisions made and the evaluation if the punishment is warranted (including the "jail time"). Especially the Boeing's top executives behavior after the first crash can't be defended, given everything we already know.
My basic point is that when ther's a tragedy, there's a knee-jerk reaction to punish people regardless of mens rea. Putting pressure on courts for predetermined outcomes, particularly without regard to intent of the accused, is the slightly civilized version of getting out the torches and pitchforks.
Deterrence requires interrupting the ill-intentioned thought process. If there are no ill intentions, then jail time has no deterrent effect. We may feel better if someone is punished, but if the public's feelings are the only positive outcome of punishing someone, then punishing them is barbaric. (Note that restitution is separate from punishment. Restitution, if possible, is still called for if there's no ill intent.)
"Knew or should have known" is the standard. Boeing management knew or should have known that selling an essential safety system relying on a single sensor is categorically unsafe.
All blame to management unless the programmers knowingly miscoded the software.
System integration is a known common source of errors, and what is less formally specified than the effective limits of a human being? If the human(s) are fully in the loop, then the buck stops with them and we know how to socially characterize and educate about failure modes. A pure-computer portion of the loop is characterizable by straight engineering.
But rather, we've got human pilots physically fighting against electrical motors. Either the pilot is right and the computer is wrong (in which case any physical effort expended is a further detriment), or the computer is right and the pilot is wrong (in which case letting the pilot effectively sabotage the computer is wrong). There is no middle ground between these two - weighing the input of a human versus the input of a computer based on them physically fighting is not a sound methodology.
Either powered drive of the trim is necessary or it is not. As it seems to be necessary due to the forces involved, the sensible design is to declare the actuator a critical part of the plane, and make the human input go through the actuator rather than around it.
Glad I didn't pick up Boeing shares on the cheap just yet.
No, the possibility that it reenabled itself is being investigated, but there's no reason to conclude that yet.
People form a version of events in their head and then cling to it for dear life. This whole thing should also serve as a reminder why we don't rely on internet mobs to investigate important things.
I'm more inclined to take it as a warning on regulatory capture, especially after it took most of the rest of the world grounding the craft to get the FAA to do so.
Unfortunately, it's a focus on profits over people that likely led to these disasters. I don't know how you can stop or dissuade from people making a buck off of a tragedy, but it might be worth putting our attention on the human element of this mess. Something about merging this safety issue with an opportunity to "buy low" and make some cash just doesn't sit right.
That said, in the FDA regulated industry, every change was signed by not only the engineer, but by the QA person, by the engineering manager, and by her. So in fairness to her, SHE would have been one of the people going to jail if the software told a doctor to take out the wrong kidney because of a bug in the calculation of an ortho normal basis or something. So I didn't blame her one bit.
Look at a six month graph, Boeing is trending up and the stock price is back to where it was at the end of January 2019. Yeah, gross.
* disabled the trim motor
* realized they were unable to trim back to level flight without it, probably due to aerodynamic load on the stabilizer
* turned it back on
* MCAS was still enabled -- it can't be disabled directly -- and used the trim motor itself to nose-down more, making the situation unrecoverable.
I predict that there will be a split in the industry between "software engineer" and "software laborer" where there are specific certifications you need to have before being called an "engineer". "Software engineers" will be held responsible, like civil engineers are, for mistakes that result in accidents. Companies that write safety critical software like auto, air, and space industries where human lives or huge $$$ are on the line will hire engineers, e-commerce companies will continue to hire "code laborers".
Maybe they will even give you a fancy ring to wear?
The problem here was that the process got too expensive, so Boeing was pressured into skipping it.
Not all software has the same consequences for failure. The highest level is when failure is catastrophic, i.e. "Failure may cause deaths, usually with loss of the airplane." This requires the highest "Level A" assurance level.
Presumably MCAS was not originally evaluated as needing to meet the highest level. If it were, the single AoA input would have immediately disqualified the design right off the bat.
There's some speculation that the delays on the "fix" are because if they have to redevelop the software at a "Level A" standard that means basically a complete reimplementation with full tracability of requirements from design to source code through compilation to executable, with independent verification. That won't happen in a few weeks.
No, because most companies aren't developing life-critical software.
I would imagine most companies that are developing life-critical software are familiar with those requirements.
Hmmmm. Interesting. Is it legally required to use this standard for these critical softwares?
And are developers legally required to be licensed, in the same way that civil engineers are?
1) It mutates it a few degrees at a time in a non-terminating loop, so it effectively has control authority of the entire stabilizer.
2) Even DAL C would require using more than a single input!
I once bought a domain called "paleolithic-computing" (neolithic wasn't available, even though I used the stonehenge picture), to use as a blog.
We are indeed in the caveman stage. In fact, in some ways, we seem to have regressed. There is a pressure to release features faster and faster, and everyone knows you can achieve anything in a sprint, right? Then just get 'devops' to deploy.
It helps that most other (or proper) engineering disciplines have been around for far longer. We are not even comparable to egyptians building pyramids, we are still figuring out how to build huts (and rebuilding them every few years with new tech).
Give it time.
Not saying it's strictly that way, just different trade-offs.
For example, most health insurance systems around the world have a value they place on one year of "quality" human life, and won't cover medical treatments that cost more than that amount per year. In 2008, that number was about $50k [1]. I don't know what it is now.
When considering whether the monetary costs of a regulation are worth it in the US the EPA used about $9 million as the worth of a life saved in 2010, and the FDA used about $8 million. The DoT used almost $10 million in 2016. Cites for those are in this Wikipedia article [2].
[1] http://content.time.com/time/health/article/0,8599,1808049,0...
I fully agree (even expanded to all fields/areas/industries/activities - but let's try not to over-regulate everything, if possible :) ).
What do you believe are some examples of things that are over regulated?
Ok, this is a very good question.
Thinking about it, I cannot think of any area I know about that is regulated, as a baseline, too much for my taste.
BUT:
E.g. 2 years ago I thought that the logs of my app (whiĉh is SOX-relevant - https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act ) weren't nice, so after talking to the other team members I slightly changed them to e.g. align strings (using tabs instead of fixed chars) and posting more informative/detailed messages.
When the auditors performed their review they saw that the new logs did not match the old ones (aaargh - string mismatch!!!) therefore we had to go over each change, checking why-it-was-done-by-whom-based_on_which_request_and_did_it_get_the_approval_to_go_live_and_was_it_reviewed_and_signed_off_by_business_after_go_live etc..., so an infinite pain. This is what over-regulation means technically for me :)
This logic makes me really sad. You're complaining about overregulation when under-regulation just killed 300 people because you had to make a few changes in an app once. Please think about this more deeply than, "I know a few hundred people died, but lets not respond too harshly and have me spend a few more hours on my apps".
Please do that next time.
Thx :)
From the OP: "I CANT THINK OF ANYTHING"
"Haircuts seem overregulated"
"The drug approval process might move too slowly"
So on one side we have "planes not crashing", "electrical codes being followed", "air quality not as bad as in Shanghai".
On the other side we have "haircuts are over-regulated".
Hmm, not sure which side I'm on here...
That is exactly right and exactly why they need to be nailed for this.
No hindsight is required to know Boeing was focused on making sure the welfare of Boeing and it's shareholders was taken care of, with little or no regard to the welfare of the flying public.
Now that we see that training and procedural changes appear to be a less effective mitigant than expected, we can say that with a high degree of certainty that the risk of increased road deaths does not offset the risks of continuing to fly the aircraft.
Call me a skeptic but I have no doubt Boeing was well aware of the issue with the MCAS well before that first data point.
Even before that first crash, there have been reports in the media that claim many pilots had complained about the dangers of the MCAS.
I don't think this is true - the newspaper that first made this claim overstated their findings. Pilots, in general, did not know about MCAS before the Lion Air crash.
Consider this link:
https://www.abc.net.au/news/2019-03-13/737-max-pilots-report...
From that link:
Airline pilots on at least two US flights have reported that an automated system seemed to cause their Boeing 737 MAX 8 planes to tilt down suddenly.
That reporting suggests problems were known well in advance of the first crash.
Such a consideration (while valid) is not Boeing's to make.
After the first crash, Boeing certainly knew that it had hooked up MCAS to a single AoA vane. I don't think they could sincerely argue that hooking up a single sensor to a primary control surface with no backup sensor is airworthy -- either practically or legally. There are regulations about it, and that's why Airbus has three AoA vanes and uses majority quorum. That's why I think the grounding should have happened earlier.
I guess that I agree at least partially with you (even without the 2nd incident, for which no official facts have been presented - but therefore I cannot upvote you as there is no confirmation yet, sorry), thinking about the facts that e.g. MCAS is not intuitive to understand/use for the pilots and that it relies on only 1 sensor (at least the original version) (any other flaw?).
About the consequences:
I just hope that the whole investigation won't boil down to just some "crazy" engineers that implemented that system because they were having a bad day or had no clue about what they were doing etc... .
Top-management must have known (at least implicitly/indirectly) the risks associated to a tight deadline and/or a miracle-like re-engineering of an old airplane and/or not having airplane-hackers available during the re-engineering phase and/or etc... because one of the roles of top management is to ask questions when something out of the ordinary happens especially when A LOT of money is involved.
Of course if top-mgmt puts enough pressure to achieve something, no questions will arise from both ends (and here we can probably optimistically go into the area of whistleblowers :) ).
I think that the same thing can be applied to Volkswagen (e.g. impossible that some engineer came up with "and here we have a Diesel engine outputting half as much noxious gas as everybody else on the planet" and nobody else asked questions because the mgmt wasn't pressuring those departments to get exactly such results) and other previous scandals.
[1] https://flightaware.com/live/flight/BOE1/history/20190403/17...
Edit: Checked flightaware, it was Boing itself flying it.
1. https://www.faa.gov/news/updates/media/Emergency_Order.pdf
Isn't it only the 737 MAX 8 + 9s that are grounded?
According to this article it is just the 8s and 9s.
> The United States will follow much of the rest of the world in grounding Boeing 737 Max 8 and 9 jets after the models were involved in two deadly plane crashes in five months.
The Boeing 737 MAX 8s and 9s are the ones with the bigger engines and single sensor MCAS that is essentially a single point of failure.
The 737 MAX 8 and 9 are essentially new planes, they should have just made new versions but they wanted to squeeze this into existing certifications and training to cut costs for Boeing and airliners. No idea why the FAA allowed them to do this. It has some blowback for Boeing as now people think all 737s are bad.
[1] https://www.vox.com/policy-and-politics/2019/3/13/18264348/t...
Because Boeing essentially is the FAA.
> The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.
https://www.seattletimes.com/business/boeing-aerospace/faile...
Only 8s and 9s have been produced so far. I'm not even sure that anyone other than Southwest has ordered the MAX 7 (it's less of an improvement over the -700 than the 8 and 9 are over the -800 and -900/-900ER). There are no big conspiracies here just no sense in grounding planes that don't exist (or haven't been delivered).
https://www.planespotters.net/production-list/Boeing/737/737...
https://www.planespotters.net/production-list/Boeing/737/737...
> Effective immediately, this Order prohibits the operation of Boeing Company Model 737-8 and Boeing Company Model 737-9 airplanes by U.S. certificated operators. This Order also prohibits the operation of Boeing Company Model 737-8 and Boeing Company Model 737-9 series airplanes in the territory of the United States.
https://www.google.com/maps/place/47%C2%B044'04.6%22N+122%C2...
When the stabilizer is extended and is being counteracted by elevator inputs, the forces on the control column make manually trimming stabilizers difficult or impossible. Boeing instructs that elevator input on the stick must be eased back in order to manually adjust the stabilizers.
If you object to people discussing the technical details of a plane w.r.t. the observed behaviour of that plane in an accident prior to the final report on the accident being released might I suggest....not clicking on the comment section, rather than trolling the comments on news items complaining that people are using the website for its stated purpose: to discuss the news being linked to?
Isn't speculation one of the things that characterizes us as humans?
I still don't understand why the trim is "stronger" on these planes than a fully pulled back column. Is this necessary on large planes?
On the 737 the trim adjusts the entire rear stabilizer (the entire horizontal structure of the tail), while the elevator is a sub-component of that stabilizer.
So, when you adjust the trim, it's a much larger surface area that is moving. Ultimately, the stabilizer just has more aerodynamic control that the elevator, due to the larger surface area.
I have no idea why the design is that way, though.
Cost, maintenance, weight, etc., probably. The only jet airliner I can think of that uses an "all-flying tail" is the Lockheed L-1011. Nearly every other plane you'd be riding on will have a big stabilizer and a smaller elevator.
If both redundant hydraulic systems to the elevator fail, or the elevator gets stuck for other reasons, the emergency procedure is to control pitch with just the stablizer trim alone.
It would be one more layer of complexity, but perhaps when the column trim switches are operated, all computer control could stop until it (autopilot, etc) is re-enabled by a human. The cutout switches in the center are still there if two column switches short out (used to be a single up-down switch, but it was single point of failure to runaway so now there are separate enable and direction switches).
(In case it's unclear, I don't support Boeing's position here.)
More likely is that the pilots turned the electric trim back on because as the aircraft gained airspeed (a normal thing when dealing with unreliable airspeed indications), the manual trim was not effective enough. This has been tried in the simulator:
https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi...
Generally, the manual trim and elevator can both overcome a nose-down trimmed stabilizer at the speeds seen just after takeoff. But if you don't rapidly trim back, and you let the airspeed build, you're now in a tricky situation. The manual trim is now too hard to move, increasing back pressure on the yoke is needed to counter the trim, and you don't want to throttle back, because the pitch up from the engines is all that's keeping you from diving. At this point, really your only course of action might be to re-enable electric trim.
This does lead to the worrying question as to whether a runaway nose-down trim in an older 737 just after takeoff could result in the same outcome.
Sure could but there are parts of the MAX that make it worse. The uncommanded stab trim movement on the MAX came about because of faulty angle-of-attack data. The bad AoA data meant that the pilots were faced with a "indicated airspeed disagree" warning (and on at least one of the Lion Air flights an "elevator feel system non-op" warning). The supposition here by MentourPilot is that the IAS disagree checklist dictated that the pilots increase their speed to the point where trimming manually is difficult or impossible. On an NG or Classic I don't think there's anything that would cause both IAS disagree and uncommanded stabilizer trim.
"[MCAS intervention] can be stopped by the pilot counter-trimming on the yoke or by him hitting the CUTOUT switches on the center pedestal. It’s not stopped by the pilot pulling the yoke, which for normal trim from the autopilot or runaway manual trim triggers trim hold sensors. This would negate why MCAS was implemented, the pilot pulling so hard on the yoke that the aircraft is flying close to stall." [1] [my emphasis.]
So it seems we may have several issues here:
1) Prior to MCAS, trim stab cutout was almost the last-ditch option against trim runaway (there was one more: grab the trim wheels and physically prevent it), but it became the only way to deal with an MCAS-commanded runaway (other than grabbing the trim wheel.)
2) Boeing did not reveal this prior to the inquiry into the Lion Air crash, despite the fact that it introduced a new experience of trim runaway that differed from what pilots had been trained to expect.
3) The Boeing / FAA response to the Lion Air inquiry was an Airworthiness Directive that basically said "pay attention to what we said before about handling trim runaway" (though, whether or not Boeing / FAA made a point of it, pilots may well have become aware of how MCAS runaway differed from their prior training -- that seems to be the case for the Ethiopian Airlines captain, who did use the cutout switches.)
4) No one seems to have connected the dots to realize that one cause of MCAS failure (AofA sensor failure) would also cause other problems, for which the prescribed mitigation procedure made dealing with the consequent trim runaway very difficult, especially when close to the ground.
I would be interested in learning, from one of the 737 pilots here, how frequently the 'grab the trim wheel' situation is presented in simulator training.
[1] https://leehamnews.com/2018/11/14/boeings-automatic-trim-for...
That doesn't jive with the Indonesian Air crash or how MCAS works. MCAS makes repeated minor adjustments and the pilots can compensate for them. Which the Indonesian pilots did 20 some times before inexplicably stopping. You can see it pretty clearly in this image:
https://spectrum.ieee.org/image/MzE4Mjg2OQ.jpeg
So I don't see how the Ethiopian air gets into a situation where they can't manually trim. They should have been able to get back to a neutral stabilizer position, disabled electronic control, and manually trim from there.
The Ethiopian flight was flying dramatically faster than a typical flight at that altitude would. If they followed the IAS disagree checklist that would explain the increased air speed as the general idea is to give the airplane enough thrust avoid a stall until you figure out which side has the correct air speed. Higher airspeed = more difficult to manually trim.
They should have been able to get back to a neutral stabilizer position, disabled electronic control, and manually trim from there.
They were barely 1,000 ft above the ground (if that). You could easily lose 1,000 ft fiddling with the elevator to unload the stabilizer to manually trim it into a safe position.
The Lion Air crew had far more altitude to work with (they were at 6,000-7,000 ft at their highest IIRC).
FWIW I think whoever's downvoting some of these comments is really hindering the discourse here. I think what you've posted is factually wrong, but not worthy of a downvote because it mostly seems to be wrong due to missing pieces from the puzzle (and not out of malice).
The point, which I think you missed, is that you don't need to manually trim. Look at the image I linked to. It's MCAS down 2.5 degrees. Pilots up 2.5 degrees. MCAS down 2.5 degrees. Pilots up 2.5 degrees. It's a repeated cycle of the pilots getting trim to where they want it and the MCAS kicking in to nose them down.
I suppose if you wait until the MCAS has trimmed all the way you might find yourself in an unrecoverable situation. But I'm not sure how that would happen and doesn't reflect what we saw in the Indoneisa Air crash.
Yeah that's what the Lion Air crew did, and it worked until it didn't (lost control in a turn?). But counter the trim with the push buttons and then hit the cutout is not in any Boeing QRH (yet?). As a non-pilot this seems like a reasonable option, but there may be something glaringly obvious as to why it's a bad idea. Even if this is the ultimate solution it's quite different to how you'd react in an NG and will come with extra training. Basically a bad situation all around.
If I've parsed everything appropriately the Ethiopian crew did try to turn the stab trim motors back on presumably to regain control over the stabilizer and we saw how that worked out. There's just not a lot of room for diagnostic work at that altitude.
IIRC the pilot handed control over to the copilot so that he could investigate the issue. The copilot stopped counteracting the trim.
Part of the reason that the MCAS got passed regulators is that it was not given enough authority to override the pilots. It can send you on a wild ride, but it can't crash the plane unless the pilot doesn't counter act the trim when the MCAS is paused.
From what I saw on that graph someone was trimming up as the plane nosedived. Take a look starting at the 23:30:53 mark. Someone was hitting the trim up button and MCAS was continuing to input trim down until the crash. The big problem with the preliminary report is the X axis, IMO. It's different on the graphs between the two flights, and there's not enough precision... but to me it looks like either hardware failure or the FO was simply not inputting enough trim up. They fought that plane all the way into the ground.
Part of the reason that the MCAS got passed regulators is that it was not given enough authority to override the pilots.
From what I've read MCAS as described to the FAA (relatively low limit on the down trim) was different than MCAS as implemented (about 4x larger movements allowed). Additionally it's not clear if the repeated down trim was by design or by bug.
I think that even MCAS in its current state is probably something most pilots could recover from as long as they know what to expect. The way MCAS works now (both in terms of the amount of authority as well as the misdirection from "unrelated" warnings) combined with zero documentation is a recipe for additional crashes.
Yes. But that's not what the checklist in Boeing's MCAS bulletin said.
It said, disable the electric trim motor then trim manually.
In hindsight, prehaps it should have said "return stabilizer to neutral then disable electric trim motor".
I wonder if Boeing did that deliberately, because a bulletin with a modified checklist would have undercut Boeing's implied narrative that a procedure already existed and it was the Lion Air pilots fault for not using the existing runaway stab trim checklist. Or did Boeing simply not test the procedure in a simulator?
https://spectrum.ieee.org/image/MzE4Mjg2OQ.jpeg
They were successfully doing trim up commands for at least 21 cycles to counter the MCAS trim down commands. Then after the last few activations, they try pressing trim up again, but the button presses are shorter and the stabiliser barely moves up.
Did MCAS push the stabiliser down past a point the aerodynamic forces were so strong that even the electric trim motor was having problems trimming up?
That could explain why the last 4 trim up commands were so short, if the pilots heard a large electric motor stuck noise they might have stopped holding the button.
If you think this is outlandish, read "They Write The Right Stuff" https://www.fastcompany.com/28121/they-write-right-stuff
It can be done, but it is simply expensive. Boeing should hang for this.