Ethiopian Airlines Boeing 737 pilots 'could not stop nosedive' | Hacker News Reader

Ethiopian Airlines Boeing 737 pilots 'could not stop nosedive'

bbc.co.uk

203 pointsjfk13266 comments

I’d love to see those people who accused the airline and crew of being incompetent to apologize in the light of these reports.

It was shameful to see Boeing actively encouraging that narrative behind the scenes. Especially considering it plays on racist stereotypes equating „Africa“ with bad training/bad safety record/…. The idea of „dingy third world airline“ was ridiculous on its face, considering how bad a fit flying the most modern airliner is with it.

And it was also contradicted by the factual record of Ethopian being a competent airline on par with any in Europe or North America. Their safety rating is better than easyjet, Ryanair, Spirit, WOW, and Southwest: https://www.airlineratings.com/safety-rating-tool/

While I agree with your sentiment on stereotypes, looking at the link your comment seems misleading.

The airlines you mention score lower on 'Safety Rating' due to lack of IOSA certification.

"Registering for IOSA certification and auditing is not mandatory therefore an airline that does not have IOSA certification may have either failed the IOSA audit or alternatively chosen not to participate."

For a budget airline I can see them not participating for cost reasons. Does this make them less safe?

Safety incidents in air travel are thankfully low. Therefore, it is impossible to find meaningful differences in that primary data alone. You have to find some proxies, and certification schemes seem at least defensible in that regard.

In any case, not being a „budget“ airline that has to cut such costs would seem to fit rather well with my argument that Ethopian is not some gravel-airstrip bush operation flying leftover Sowiet machinery.

Agreed, it's clear that a proxy is needed. Also that Ethiopian is not a sub-par operation.

My issue is that a 'safety rating' based on an optional certification is being used to compare airlines as more/less safe.

Why not stick to what I believe to be the universal measures of EU allowed, FAA endorsed and ICAO country audit.

The libertarian answer would be that government requirements mere represent a necessary minimum. In any case, it would seem irrefutable that no matter the requirements, there is always room to go above & beyond, and to have such efforts certified by a third party to maximize their use for PR purposes.

In a wild application of signaling theory, certification may even be a useful signal without regard to the actual substance of that certification, as long as it is expensive. Just like a peacock shows his abundance of resources by wasting some of them on jazzy plumage.[0]

I think you’re sort of sympathizing with the airlines here, who are somewhat pressured into spending that, from their perspective, is wasteful: after all, they know they are doing all that stuff they are getting certified for.

I would say (a) don’t anthromorphize corporations—they may be people, but not ones deserving sympathy. And, (b), certification schemes are one of the many often disregarded frictional costs of a market economy. They are unnecessary only in a mythical benevolent economic system that has so far eluded us.

[0] also a good reason to justify flying only with airlines that offer free peanuts.

> not some gravel-airstrip bush operation flying leftover Sowiet machinery.

just wanted to say I appreciate the imagery. this is exactly how I interpreted US media to be framing Ethiopian

I can also see them to be less safe for cost reasons. Getting the certification would have helped to alleviate this concern.

>Their safety rating is better

was better. sucks cause its not even their fault.

Excuse me, no.

This incident was decidedly not their fault.

The blame lies 100% with Boing.

This event doesn’t not count toward their safety rating.

Some ratings count events regardless of whose fault it is unfortunately.

The airline chose to trust the safety of Boeing's planes. They deserve a greater than zero amount of blame if it turns out that it was a poor choice.

Yes but assigning responsibility is a complex process, it would make the issue more complex, even if it is a systemic issue with the equipment.

> It was shameful to see Boeing actively encouraging that narrative behind the scenes.

Is it shameful because we suspect that it was an intentional lie on their behalf, or is it shameful even if it was honest opinion of these Boeing representatives at the time?

Either. Deeply seated racist beliefs are often honestly held, but that doesn't make them less shameful.

Why do you think that racism would be the only reason to hold such a belief in this particular situation?

I think in this case it probably wasn't meant to be racism on Boeing's part--Boeing just has a history of immediately blaming the pilots for every crash.

Latent racism may have helped some people believe it was the pilots' fault, but I wouldn't ascribe the actual racism part to Boeing in this case.

Pilot error is the leading cause of airplane crashes. If someone offers you an even money wager that pays you if the next crash will have pilot error as a significant cause, take the wager.

I am at least twice as likely to kill my airplane than my airplane is to kill me.

How many accidents blamed on "pilot error" are a result of the pilot not being given enough information to make the right decision, or given the wrong information? I'm not saying that pilots are completely faultless but if they're making mistakes we should look to improve the systems and procedures that allow them to make the right decisions, not start pointing fingers.

I'd wager that pilots, like any other professionals, make mistakes all the time.

This, however, is mitigated by a regulatory, technological and cultural safety net, which usually corrects such mistakes.

For example: There's an important cultural understanding that pilots admit safety relevant issues, even if they made a mistake in the process and not getting punished for it. The effect is that all involved entities learn from that and correct it in the future.

When something really bad happens pilot error is mostly part of the puzzle, but the bad outcome is a sequence of problems, which lead to catastrophy.

A great example is the worst disaster in civil aviation history ever[1], which ultimately was triggered by the error of a very experienced pilot. But there were a lot of small puzzle pieces, which needed to fall into place for this catastrophy to happen.

[1] https://en.wikipedia.org/wiki/Tenerife_airport_disaster

edit : spello

I agree with CaptainZapp’s comments next to this one.

The process you describe does happen, but IMO, clearly articulating the facts and assigning findings of probable cause (the latter is what you term pointing fingers) is an essential element of that improvement process.

The is a strong safety culture in aviation overall. It’s rare for one isolated mistake to result in a hull loss, but rather is usually a series of issues where the “holes in the Swiss cheese all line up”.

No doubt Boeing and others are going to improve technical and human factors elements from this crash. It doesn’t help anyone in this process to not assign probable cause, IMO.

> Is it shameful because we suspect that it was an intentional lie on their behalf

Exactly this.

> or is it shameful even if it was honest opinion of these Boeing representatives at the time?

It seems fairly obvious Boeing was aware the 737-MAX had some serious faults, but instead of admitting those faults it seems fairly obvious they went out of their way to deflect blame way from their failed aircraft onto the now dead pilots.

This is because of Product Liability law.

If they admit in any way to releasing a known dangerous product they open themselves to massive damages.

But don't Boeing still find themselves in that exact same position, if not worse only because of all the deaths involved?

When the Lockerbie bombing brought down Pan Am Flight 103, the relatives sued PA AM over those deaths.

In that case a jury found Pan Am was liable for damages because it's poor security procedures had failed to protect the passengers.

I would imagine lawyers would be salivating at the though of suing Boeing over these two disasters in what would appear to be a much easier case to win.

I'm really surprised they didn't go ahead and blame the pilot's "ethnic culture" like the did with Asiana 214 [1]

1. https://www.cnbc.com/id/100869966

I'm extremely critical with Boeing's responses in general and the smearing and throwing pilots and airlines under the bus.

But in that case they had a point.

Seniority is super important in Asian culture. You just! don't! criticize! your! superiors! period.

That's extremely diametral for resources management and crew communication in a cockpit.

The first officer may tend to say nothing, even if he believes the plane should pull up in order not to offend the senior person.

That said, Asian airlines learned from this and put a lot of effort to rectify this issue.

That's absolutely no excuse for Boeing's despicable behavior on those last two crashes.

The actual vocabulary used when speaking to superiors in many asian languages also tends to be more verbose and subdued in meaning, as opposed to sharp and concise.

It actually seems to be normal practice to quickly allocate blame, even when its quite clear that little if any investigation has actually taken place.

One of the effects of allocating blame is that large swathes of the general public will "switch off" and not ask questions of their politicians, who in turn apply little pressure to improve or advocate for improved standards (which big business and comfortable institutions see as too much government interference).

I can't recall any such incident where it wasn't implied that the it was the pilots fault, implying incompetence. The fact that most of us may have inherent and often unconscious racial biases (black and white and other actually display the exactly the same biases) just makes this play damage control that much easier.

>It actually seems to be normal practice to quickly allocate blame, even when its quite clear that little if any investigation has actually taken place.

Readers would do well to remember this also applies to all the people who were 100% sure it was MCAS related before the wreckage even stopped smoldering.

I don't think anyone claimed to be 100% certain that was the cause (feel free to correct me if that's wrong).

Given the obvious similarities between the two incidents (same phase of flight, same apparent pitch control problems, known issue that would result in that behavior, etc), I don't think it was unreasonable for people to point out the likely connection.

No points for being correct? Why play the game then!!

However since Boeing is a multi-billion dollar corporation perfectly capable of defending itself, I think it is best if HN readers focus on defending the dead pilots who unfortunately are not in the same position.

I am pretty sure any mistaken criticism of Boeing will be swiftly responded to and corrected at HN or elsewhere by Boeing's PR lackeys.

It is called controlling the narrative.

And can brutally backfire.

"First and foremost, our deepest sympathies are with the families and loved ones of those onboard Ethiopian Airlines Flight 302."

and

"Safety is our highest priority as we design, build and support our airplanes."[1]

Yeah, sure! We believe you.

[1] http://www.boeing.com/commercial/737max/737-max-update.page

I've never seen anyone blame the crew, as it was recognized from the start that this was probably MCAS. I've seen, and personally believe, that a more experienced crew could have saved the flight, but that's different from calling this crew incompetent.

I wish the article was clearer on what procedures were followed that didn't work. Did the crew follow the runaway stab trim checklist? If so, then that's really bad for Boeing, but I can't find anything specific yet.

> I've seen, and personally believe, that a more experienced crew could have saved the flight, but that's different from calling this crew incompetent.

I think this jump is unfair. It's easy to say this but the reality of the matter is that all public information we have points to a system that should have been redundant wasn't, a system that was in place (MCAS) was not as well known or understood as it should have been to pilots, and we also know Boeing (just like Volkswagen) made an explicit choice to cheat with the explicit goal of profits. Except in this case Boeing's choice directly led to hundreds of immediate deaths. This last point is why I, personally, think your comment is unfair. You're dismissing Boeing's mistakes but accepting all of the pilot's.

Someone at Boeing in executive ranks, like Volkswagen, needs to go to prison if they are found guilty of neglect. As should the employees of the FAA who approved flightworthiness.

Totally agree.

Some of the sentiments expressed here was borderline racist. (badly trained, overworked cluelless third world pilots not even capable to follow a checklist).

One of the worst smear jobs was actually by the New York Times accusing the captain of the Ethiopian plane not having trained in a 787-MAX simulator.

Hello? Wasn't that the whole sales pitch that the plane requires no training at all for certified 787 pilots? In addition the MCAS crash scenario was neither part of the manuals nor of simulator training.

Great smear job, NYT! I'm sure Boeing will thank you with a ton of ads.

This[1] fascinating piece outlines what happened to a US pilot who felt uncomfortable with the minimal training provided and wanted additional simulator training or at least an instructor on his first flight. Spoiler: It was not a great carreer move.

If I sound angry as hell, I am. That Boeing didn't ground the plane after the Lion Air crash (they were busy smearing the airline an the pilots instead) is nothing short of criminal.

What a disgusting company!

[1] https://qz.com/1584233/boeing-737-max-what-happened-when-one...

You really shouldn’t ever trust the NYT. They haven’t been trustworthy for a while.

Their report merely states that a simulator was available, and that the crew did not train it it. It even includes the fact that Boeing did not consider such training necessary.

How is it untrustworthy to report these uncontested facts? You are drawing a conclusion that the article does not make, namely that the lack of simulator use was the singular cause of the accident.

It takes some gall to accuse the Times of a false conclusion that happens entirely in your head.

My bad. It was me drawing the conclusion.

And granted: That was mainly from the headlines, which were also picked up by other publications.

I would remove my comment, but that kills the flow of the thread so I let it stand and apologise for my making the unfounded comment.

I was under the impression (probably not unreasonable if you look at Boeing's reaction in the last few weeks) that the company was actively smearing the pilots and using their press connections to actively do that.

Mea culpa!

Thanks for having the grace of changing your mind.

And you weren’t entirely incorrect: my assertion in the top post in is thread that Boeing was working on blaming the pilots was based on something I remember reading in either the NYT or Atlantic. But that article was very explicitly saying that it was narrative being pushed by Boeing.

Pilot error is always assumed for pilots of all races. The French pilot who was allegedly responsible for crashing an Airbus during a flyover for an air show fought decades for clearing his name.

He also claimed that the system had "artificial stupidity", that was the time when pilots first had the fun of encountering the many Airbus "flight laws".

But in this case the pilots and airlines were accused to be a lower tier then the american pilots. So on top of the regular accusations if this would have been an american airplane the third world country accusations were added on top as an extra.

There was definitely an air of superiority of American pilots. The problem is that there is a grain of truth to it.

A big part of this is that the American Airforce train a huge number of pilots to an incredibly high standard who eventually leave the military and become civilian pilots. Any pilot who isn't naturally gifted in the art of flying an aeroplane will be flunked before finishing their training. They are tested in ways that a 200 hour civilian CPL just never will be.

Even the increasing numbers of pilots coming to flying through a civilian tract in the US have a number of benefits. Classically they flew cancelled cheques around the US in beaten up twin engine aircraft in all weathers while building the required number of hours. Even in modern times, due to a culture of GA flying, they've got a lot more opportunities to fly different aircraft types (taildragger, floatplanes, gliders), fly aerobatics etc.

So, do you know as a fact that plots in other countries are less passionate or have less training?

It would be interesting if you have a source of how many civilian pilots are ex-military pilots, as an non-expert I would say that having experience with a fighter plane is not better then having same hours of experience with a civilian plane, it is not like fighter plane experience is much better then other planes when considering you will fly a big commercial plane in the end.

Apparently somewhere around 30% if this is to be believed.

https://www.washingtonpost.com/news/wonk/wp/2018/04/20/the-o...

"A grain of truth" doesn't mean it's provably true. But it's hard to argue that flying a plane load of passengers on autopilot from the same 4 airports for hours on end remotely gives you the same skill level as flying low level, in high performance and often in formation with other aircraft would.

But it's hard to argue that flying a plane load of passengers on autopilot from the same 4 airports for hours on end remotely gives you the same skill level as flying low level, in high performance and often in formation with other aircraft would.

Fine, I'll argue that. Southwest pilots do just that because Southwest is primarily a short haul airline. They do more takeoffs and landings on a daily basis than nearly any other airline and often from relatively small airports. If you're flying for them you're going to routinely practice the most dangerous parts of the flight. IIRC Southwest is less draconian about mandating autopilot usage than many other airlines.

They have a reputation for being aggressive about timing (as my friend put it, you never want to be stuck in front of a Southwest pilot) and yet they have an enviable safety record.

Sure, but southwest already has US pilots, many of them ex-military, who have all of the advantages I've mentioned.

So, do you know as a fact that plots in other countries are less passionate or have less training?

Option C: crew resource management and by extension culture. Take a look at one of (if not the) worst aviation wrecks in history: the Tenerife disaster. A Dutch 747 (KLM) and American 747 (PanAm) collided and became engulfed in a gigantic fireball. The biggest factor was that nobody was willing to speak up or acknowledge in either cockpit that there was uncertainty and an unsafe situation. Yes these are two western countries, but after the wreck western aviation culture changed dramatically as a significant emphasis was put on what amounts to "see something? say something!!" (a.k.a. crew resource management, CRM).

CRM has been very slow to trickle down to, for instance, East Asian airlines where deference to authority has a much stronger hold. Take a look at the Asiana wreck at SFO. Two pilots in the cockpit were repeatedly calling out significant mistakes, but the pilot flying ignored them. Neither of the other pilots took control of the situation and the plane was flown straight into the ground.

Training, as well, seems to be something American pilots are pretty prickly about. After a Continental regional airline (Colgan Air) wrecked the solution was deemed to be requiring more pilot training (despite the fact that experience was NOT the problem in this crash). For all the belly aching about the guy in the left set of the Ethiopian Air jet having only a few hundred hours — up until 2013 the FAA only required 250 hours of experience to get a certificate allowing commercial flight (ATP). The requirement now is 1,500 hours, but it sure doesn't seem like American air travel has become dramatically safer since 2013.

I don't think passion is the right word, but the USA has a much stronger general aviation culture than many other counties. Someone living in America is going to have many more opportunities to fly a civilian plane than someone living in, for instance, South Korea. The military experience may even be detrimental as it's often going to focus on strict hierarchies (see CRM) when this may create safety problems.

Edit: I want to add that Indonesian aviation is notoriously unsafe and most Indonesian airlines have been banned from EU airspace (with some allowed back more recently). Lion Air, in particular, has a bad record of wrecking planes and lots of allegations about falsifying maintenance records. Hell, there is that one Lion Air captain who posts cockpit videos on youtube (including at least one showing some startlingly sloppy behavior). But if you look at flight 610 specifically you'll start to see a lot of things that would put even the best pilots in a bad situation. Even looking at the data from flightaware should've provoked a bit of an "are these pilots REALLY that bad?" response. A certain amount of initial suspicion was warranted, especially since pilot error is an extremely common cause of crashes even in western countries. A more continued drive to vilify the JT610 pilots or excuse Boeing's behavior is, IMO, out of line.

It is hard to imagine how any 737 pilot would be unaware of the problem and resulting Boeing advice given the massive amount of attention this has reviewed. Regardless of training issues I find it hard to believe that any pilot would be so indifferent as to ignore this.

So you blame the pilot that he is not training itself in the new hidden changes of the airplane? Isn't Boeing duty to create the checklists/procedures for the possible issue ? or we let this work for the pilots internet forums?

Though from the article it appears that pilots followed all the official procedures,

Of course it is Boeing and airlines responsibility. But if for some reason that training was absent I would expect pilot to seek the information themselves. To suggest otherwise is an insult to their intelligence and professionalism. Of course pilots are going to take an interest in crashes on the aeroplane they fly! Particularly when it is the biggest aviation story in years. Porbably something that they discuss regularly with other pilots. That is why I think the poor training angle is implausible for this particular issue and just prejudice.

But if for some reason that training was absent I would expect pilot to seek the information themselves.

Here[1]'s a rather sobering read for you what happened to a pilot who tried exactly that.

Spoiler alert: It was not a smart carreer move at that time.

[1] https://qz.com/1584233/boeing-737-max-what-happened-when-one...

I was just having this discussion with my team yesterday. Easier to blame the pilot when they are dead. I use to believe most NTSB reports and that most errors were pilot errors. Probably true, but probably not as high either.

>the Lion Air crash (they were busy smearing the airline an the pilots instead)

In a rush to put to blame on Boeing everyone seems to have forgotten that Lion Air badly screwed up:

(1) The aircraft exhibited the same failure on its previous flight. Not fixing it before the next flight is a huge maintenance screw up.

(2) That failure and the steps to correct it should have been in the log book and the next pilots should have been keenly aware of the potential issue and how to fix it

(3) The pilots counteracted MCAS some 20 times by using the electronic trim control but never switched over to manual control.

A better designed plane might not have tested the mettle of Lion Air as sternly as this issue did. However, that doesn't change that the fact that when tested the pilots and Lion Air performed terribly.

It wasn't just Boeing defending their plane. Pilots unions also came out and said that they saw no issue with the plane and that their members felt like they could handle any issue.

I think it's pretty disgusting that you're still smearing the Lion Air Pilots despite all the facts that came to light after the Ethiopian crash.

Namely that Boeing didn't even bother to document MCAS, let alone deem it necessary to provide training for purely commercial reasons.

Turns out that their documented emergency procedure also isn't helpful once the plane becomes unstable due to their design fuck-up.

Way to go!

>I think it's pretty disgusting that you're still smearing the Lion Air Pilots despite all the facts that came to light after the Ethiopian crash.

Thank you for your personal attack.

Besides that, I'll just note that you didn't actually address any of my points.

He didn't attack you personally. He attacked your action, which was smearing the pilots (which is indeed disgusting).

As we have now learned, switching to the manual control is useless when the aircraft is in this condition (high speed, stab down, elevator up).

The Ethiopian pilots turned off the electric trim control, only to have to turn it back on again.

>As we have now learned, switching to the manual control is useless when the aircraft is in this condition (high speed, stab down, elevator up).

That wasn't the position the Lion Air flight was in.

I don't think there is much debate that the Lion Air flight was recoverable since the pilots on the previous flight recovered from the same issue:

>As the Lion Air crew fought to control their diving Boeing Co. 737 Max 8, they got help from an unexpected source: an off-duty pilot who happened to be riding in the cockpit.

>That extra pilot, who was seated in the cockpit jumpseat, correctly diagnosed the problem and told the crew how to disable a malfunctioning flight-control system and save the plane, according to two people familiar with Indonesia’s investigation.

>The next day, under command of a different crew facing what investigators said was an identical malfunction, the jetliner crashed into the Java Sea killing all 189 aboard.

https://www.bloomberg.com/news/articles/2019-03-19/how-an-ex...

It was recoverable in a similar situation. That does not mean it was recoverable in both situations.

Any incident like this is a chain of events (which in this case started back with the original design decisions). Many links in that chain aren't obvious, and no two chains are identical. Just because the chain was broken in one case doesn't mean it was reasonable to expect it to be broken in all of them.

>It was recoverable in a similar situation. That does not mean it was recoverable in both situations.

Similarly, because it was unrecoverable in one situation [based solely on speculation at this point] doesn't mean it was unrecoverable in another.

>Any incident like this is a chain of events (which in this case started back with the original design decisions). Many links in that chain aren't obvious, and no two chains are identical. Just because the chain was broken in one case doesn't mean it was reasonable to expect it to be broken in all of them.

I'll note here that you have at best addressed one of my three points. To add color:

>Airline mechanics tried four times to fix related issues on the plane starting Oct. 26, according to the Indonesia preliminary report.

Do you think that's ok?

>However, the pilots on the harrowing Oct. 28 flight [the flight before the crash] from Bali to Jakarta didn’t mention key issues with the flight after they landed, according to the report.

Do you think that's ok?

https://www.bloomberg.com/news/articles/2019-03-19/how-an-ex...

The original comment you were replying to referenced Boeing's smear of the pilots, not Lion Air the company. The pilots would have no knowledge of the first two items on your list (the ones I did not address, as they weren't relevant to the comment you were replying to).

You're absolutely correct that Lion Air might have had the opportunity to prevent Boeing's design failure from bringing down this plane (this time). That still leaves the biggest share of the blame squarely in Boeing's lap.

>The original comment you were replying to referenced Boeing's smear of the pilots, not Lion Air the company.

I responded to:

>the Lion Air crash (they were busy smearing the airline an the pilots instead)

Which clearly references Lion Air the company.

>You're absolutely correct that Lion Air might have had the opportunity to prevent Boeing's design failure from bringing down this plane (this time). That still leaves the biggest share of the blame squarely in Boeing's lap.

Blame is not a competition and having a more at fault party doesn't excuse your failures. Lion Air failed badly and the pilots didn't take an obvious step to correct their issue. They merit the blame they are getting.

> Which clearly references Lion Air the company.

Ah, yep, I misread that (can I blame the typo...? ;) )

My point is that is that it is appropriate to call out Boeing for their attempt at deflecting blame. The pilots apparently did not take an action that _may_ have saved the plane (we now know it may not have). That doesn't change the fact that the issue they failed to correct was a faulty design in the first place, and would have resulted in a crash at some point.

>My point is that is that it is appropriate to call out Boeing for their attempt at deflecting blame.

Sure, but that doesn't mean going the other way and deflecting blame from Lion Air and the pilots.

>The pilots apparently did not take an action that _may_ have saved the plane (we now know it may not have).

Disabling electric trim would have absolutely saved the Lion Air flight just like it did when the same issue cropped up on the previous flight. Some speculated (which appears to be incorrect) that the Ethiopian Air flight was in a situation that they couldn't recover from, but the Lion Air flight was not in that situation.

The Lion Air pilots identified that the trim was incorrect and reset it at least 20 times. It's fair to fault them for not coming to the conclusion that the electric trim system was malfunctioning and that they should disable it.

Slight correction, they turned off the stab trim and tried to manually re-trim the plane, but the aerodynamic loading on the stabilizer was so great that they couldn't turn the trim wheel by hand. So, sadly, they re-engaged the stab trim and began to use the switches to trim up, but the MCAS came back 5 seconds later, trimmed down again, and flew them into the ground.

Please stop looking for racism in each and every aspect of public discourse, it does way more harm than it has the potential to do good. The harm lies in the ever larger focus on things which have the potential to divide people, be they race or sex or gender or religion or any other section. In this case there may have been a suggestion of the pilots having undergone less rigorous training and the aircraft being maintained at a lower standard than would be the case for 1st world airlines. These things may be true or they may not be, the airline safety records are among the potential ways to ascertain the veracity of such statements. This has nothing whatsoever to do with race so it does not make sense to try to draw this in as a factor unless someone made explicit claims in that direction. I have not seen any such claims, if you can point at them - and I do mean explicit claims, not so-called 'dog whistles' as those are subjective - please do so, otherwise keep race out of this discussion.

Fine. Not racism then.

Can we agree on xenophobic and bigoted?

The discussions here provide ample evidence for that.

Just check the bottom of this threat with “show all comments” enabled in your preferences.

I think a lot of people still have this idea that everyone in Africa is poor. The reality is that Africa has flagship carriers that are as old and prestigious as those found in the West and that the African economy is booming.

The first officer on that flight was extremely inexperienced. He only had 200 hours of total flight time. In the U.S., you need 1500 to sit in the right seat of an airliner in scheduled service. While I would not put the blame on the pilots for the accident, it's impossible to know if it might have turned out differently had there been two experienced pilots in the cockpit.

There were two experienced pilots in Lion Air 610.

In the case where prescribed procedures are followed, and don't work well enough (i.e. you're still stuck in a bad situation that continues to degrade), you're basically asking for experience to manufacturer an alternative on the spot. That's rather like a Hail Mary pass, in terms of logic. It's a 'well maybe maybe not'.

I'm not sure how that progresses the conversation, and yet people on HN keep bringing this up as if it's relevant without actually showing any new dots let alone connecting them. Setting aside hard evidence proving experience is a factor, you don't even have a hypothesis of how it might be a factor.

He had only 200 hours of flight time. Well so fucking what? You have to make the case. It doesn't make its own case. The reason why the U.S. has a higher regulatory requirement for experience is because of Colgan Air 3407, in part, even though the experienced pilot in command showed the same incorrect response to stall warning as the second in command, both of which were contrary to training, and also the training itself was inadequate.

I've got quite a lot more total time experience than the second in command of the Ethiopian airlines pilot. I can't tell you with any meaningful certainty I would have done anything different.

I'd say my life experience is more relevant than my flight hours experience. And my life experience when encountering either human or computer confusion at only 1000 feet above the ground, is to consider it somewhere between incompetency and sabotage. I would not be diagnosing that shit either way, I'd disconnect all of it.

And I would be irate at discovering a form of autopilot (MCAS is a safeguard, or control law) that I was not previously informed of by either my airline, or regulator, or the airplane manufacturer. And in fact, U.S. pilots are pissed at exactly that. Including or even in particular the ones with 1500+ hours.

As I said, I would not put the blame on the pilots. That is clear. Boeing made an unsafe airplane. Airline safety is a layered thing though. Even if it's Boeing's fault, it's possible that the pilots could have recovered, even though it looks like recovery is not necessarily easy.

I also have a fair bit more than 200 hours, and I can't say whether I would have made a smoking hole in the ground or not either. Still, if I were put in that position, I would much rather have an experienced pilot sitting to the right of me.

Having an inexperienced pilot that probably hasn't ever experienced a real emergency is a significant liability when you're trying to troubleshoot something like this without a lot of extra time. In this case, they would have had a better chance of surviving if they had identified that the problem was MCAS before the plane got so wildly out of trim, or they had made the decision to turn the electric trim back on sooner. This is a lot easier if you've got two fully fledged pilots instead of effectively a captain and an apprentice.

Say what you will about the 1500 hour rule, but there has been precisely one fatality in all of U.S. aviation in the ten years since the Colgan flight.

I am one of those people. If in fact the stab trim cutout switches were set to cutout early in the incident sequence, as required by the memory items on the checklist, I will absolutely retract my criticism of the crew and the blame falls much more squarely/exclusively on Boeing.

I’ll make it a point to retract and apologize on all three forums where I made those comments (two tech and one aviation).

I don’t read the minister’s comments today as unequivocally stating that.

Shouldn't that be the other way around?

You're the one making the claim that the pilots acted inappropriately. Now you're saying you require evidence contradicting your claim before you retract it?

IMO, no. There is a released fact (via photographs) that the jackscrew on the stab trim was run to the extreme. That's strong evidence to suggest that the non-normal checklist for stab trim runaway was not correctly followed.

The aviation minister's comment today does not carry weight in excess of the photographic, factual evidence, IMO. There are too many "loopholes" that she could be exploiting without leaving her statement technically incorrect.

The good thing, such as it is, is that the facts are almost surely going to emerge here. The CVR transcript, FDR dump, and analysis of whether there's a mechanism for the electric trim to run even with the stab trim cutout switches in cutout and whether that can exceed the crew's ability to stop and reverse the trim setting manually will be telling. I do admit that the minister has greater access to that information than you or I do at this time. It is possible, but not decided, that she's had time to review all that information, knows with certainty the crew is blameless, and has chosen to not make a specific enough statement to support that for any number of valid reasons.

The explanation put forward (which seems reasonable) is that the cutouts were disengaged because the aerodynamic forces were stronger than could be overcome by the manual control, so they had to turn the electrics back on in an attempt to move it (which allowed the MCAS to continue pushing the stabilizer to the extreme)

>The explanation put forward (which seems reasonable) is that the cutouts were disengaged because the aerodynamic forces were stronger than could be overcome by the manual control, so they had to turn the electrics back on in an attempt to move it (which allowed the MCAS to continue pushing the stabilizer to the extreme)

But the only way it would end at the total extreme is if they were within 2.5 degrees of max when they re-enabled electric trim and they crashed within 5 seconds. Otherwise, they should have been able to at least get some adjustment.

>Boeing’s anti-stall software on a doomed Ethiopian Airlines jet re-engaged up to four times after the crew initially turned it off due to suspect data from an airflow sensor, two people familiar with the matter have said.

https://www.theguardian.com/business/2019/apr/03/ethiopian-a...

4 cycles should have gotten them to 7-10 degrees away from the extreme. So something else was going on.

Ah. They'd have had to "roller coaster" the airplane (pitch up, then move the elevator surface towards neutral [so a net nose down]) to get the trim to move manually [the last step on the checklist]. Repeat as needed until the stab is trimmed within a range where it can move manually in unaccelerated flight.

That's an interesting possibility, which if they didn't know about it (I don't blame them), they may have felt they had no choice but to go "off checklist" and re-engage the electric trim system. I'd expect that would be in the context of "PF commands nose up pitch trim continuously while PNF engages the trim cutout to normal and monitors."

That's a tougher hand dealt the crew than I previously contemplated and if that's what they did, it's one for which I will owe them a retraction.

They never had the altitude to do that...

It's a shame that MCAS behavior wasn't fully explained after the first crash. If it had, they might have remembered that flaps disable MCAS. If I had to go "off checklist", I'd go: stab trim off -> flaps 1st detent -> stab trim on -> trim to neutral -> stab trim off for duration of flight -> flaps up -> manual flight for the duration. Still, that's all while you're pulling on the column like mad, all the indicators are lit, all the annunciations are going on, the stick shaker is going, you're going like a bat out of hell, and the ground is coming up at you. In the final seconds of flight, there was so much nose-down that they were pulling -2g.

Another thing we know now about MCAS is that it's locked out for 5 seconds after each trim switch operation. So, if you never have stab trim engaged for longer than 5 seconds a shot, you should be able to trim up the plane.

> The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working

This is on page 25 of the report.

I don't know about formal accusations and it is always dangerous to disagree with someone's view of "those people who"..... but speculation about pilot error has high rate of being generally accurate.

Agreed.

After the Lion Air crash, Boeing basically asserted the plane was perfectly safe, and that the pilots should have followed the runaway trim process - this means turning off the electric motor which moves the trim, and having the pilots move it manually using a wheel provided for the purpose. Boeing has tried to imply that in the midst of an emergency which looks very different from a runaway trim, pilots should have followed this procedure and this was in some way their fault.

The Ethiopian Airlines crash has shown that Boeing was being disingenous. The problem is that turning off the trim motors at this stage of the flight leaves the pilots unable to move the trim fast enough manually before they crash and they are forced to switch on the electric trim - which again allows the MCAS to kick in. When pilots who are fully informed of MCAS still were unable to control the plane following Boeing's procedures then imagine the plight of the Lion Air pilots who recovered from the fault 26 times before crashing but had no idea anything called MCAS even existed. An honest admission by Boeing after the first crash would have prevented the second crash and the loss of further lives.

There's a major difference between the Lion Air and Ethiopian Airlines crashes though - altitude and incident duration. Things that are recoverable from 5000' AGL might not be from 1000' AGL. Speed is life, and altitude is life insurance after all.

From my reading, the Lion Air pilots could have disabled electronic trim anytime after those 26 recoveries and been fine. But the Ethiopian Airlines pilots only had 1000' of altitude to recover in, and that wasn't enough. Which leads to the question of why MCAS was triggering at 1000' AGL, since it isn't supposed to activate when flaps are deployed... I don't think MCAS is going to end up being the sole hardware issue on that flight.

Could have disable it, but didn't? We don't actually know yet whether they did or when they did, and if they did if it was already too late. Critically we don't know their mental state, as we don't have transcripts yet.

If the pilots are reactive or even panicked at the unexpected uncommanded pitch behavior, they may have been doomed right from that moment. The previous flight, Lion Air 34, the pilots likewise did not immediately cutoff autotrim. We have no transcript from that flight either. None of these pilots have been told of, or simulator trained, an MCAS upset scenario. Startle factor is relevant and can cause total cockpit breakdown. The 737 PCU design flaw and subsequent accidents show this. Can problem specific training mitigate crashes? Sure. How would these pilots have received MCAS upset training when they don't even know MCAS exists and the simulators didn't have such an failure option? And should they now be required to have such training? Including simulator training?

As for why MCAS is triggered below 1500' AGL in the Ethiopian Airlines case, that is a very good question. I have not seen the altitude above which MCAS is supposed to apply, and I haven't discovered how that trigger altitude is determined, radar altimeter?

Most of the facts we still don't know.

> Could have disable it, but didn't? We don't actually know yet whether they did or when they did, and if they did if it was already too late. Critically we don't know their mental state, as we don't have transcripts yet.

'Could have' in the purely mechanical "we think this would have been possible and allowed the aircraft to survive" sense, not the "the pilots knew how to do this" sense.

> As for why MCAS is triggered below 1500' AGL in the Ethiopian Airlines case, that is a very good question. I have not seen the altitude above which MCAS is supposed to apply, and I haven't discovered how that trigger altitude is determined, radar altimeter?

It's not altitude limited, but flaps limited - so would have engaged when flaps were retracted sometime after reaching 1000' AGL. (at least, 1000' seems to be the altitude mentioned in the procedure summaries I've seen for other 737 models - things might be different for high altitude takeoffs) And as it turns out, ET-302 reached FL 140 ~5 minutes into the flight, so there goes that theory.

> Most of the facts we still don't know.

And hopefully we'll eventually learn them, and write some new rules with them.

The report is now available at https://www.documentcloud.org/documents/5793877-Preliminary-...

Flaps-up was commanded about a minute after take-off, which seems about right. The AGL altitude of the plane is hard to determine from the graphs as they only list pressure altitude. It's a high airport with, I believe, rising terrain. I'm not sure if the 1000' AGL cited is supposed to be at first MCAS engagement, or the last one, or at some other point in between.

Ryanair doesn't have a single crash with fatalities in their history and they're worse? They fly more frequently yet they're safer. That safety rating seems not that reliable.

Will be interesting to see the details when the report is actually public. It does sound like the scenario that Mentourpilot explored in the simulator is close to what happened, namely:

Bad AoA probe causes MCAS to trim down, and also to indicate IAS disagree. Pilots increase throttle as per non-normal checklist to reduce the risk of stalling due to unreliable airspeed. Pilots disable electric stabilizer trim, as per Boeing's advice, without trimming back to neutral trim. Plane is now low, accelerating, and trimmed nose down. Pilots likely started to trim up with the manual trim wheels, but that's very slow, and gets harder as airspeed increases. And you don't want to reduce power, because that will cause a pitch-down, and you're close to the ground. At this point you've run out of options that are recommended by Boeing. The only remaining option is to re-enable electric stabilizer trim, and use that to trim nose-up.

Now, from what I understand, appying nose-up electric trim should override MCAS, and so this course of action should be possible. However, at this point, you're basically a test pilot - this is not on any of Boeing's checklists or training. Why didn't it work? We'll have to wait for the full report for that I think.

Does anyone have a mirror of that video?

This was posted on PPrune:

"Originally Posted by infrequentflyer789

Since this video may not be coming back I'll post a sort of transcript from memory since I was lucky enough to get to watch it. I'll try and just describe what I saw and keep my commentary/speculation to a minimum - in <italic>. Bear in mind this is a non-pilot observer's take on it from flaky memory:

There is a fair bit of intro talk then the sim.

They are in NG sim, not MAX, no surprise there. Mentour in left seat.

They start at low altitude, I think it was commented on, not at takeoff, I can't remember if they showed putting flaps up or started with flaps up and said it was just after flaps up.

No stick shaker, that I saw. <presume means no elevator feel shift either, and that actual AOA error is not being simulated>

IAS disagree then simulated - or they just did the memory items, I didn't notice warning light (not that I would) and he didn't note it, there was an aural alarm but I think that was for AP disconnect <I don't think this is exactly what the accident flights faced, they had shaker and IAS disagree from takeoff>

IAS disagree memory items, AP/AT OFF, FDs OFF, 75% N1, 4degrees

Throttles are pushed forward to get 75%, he comments that at low alt with denser air this is a lot of thrust and hence speed will increase

Trim runs, obviously sim doesn't have MCAS so not sure if they are simulating runaway or if he is doing it with the column switches

Comment is made that he was _expecting_ trim to run, because speed is changing, he says it will take a couple of cycles of fighting it with the switches before being definite that it is wrong

They discuss (he raises) that he is having flight control issue, they conclude it is trim that is the problem, they now run the stab trim runaway memory items finishing by hitting the switches. At this point he is clearly holding quite a bit of pressure on the column, but not obviously losing control of pitch

Now he points out that trim has only got down to (I think) 3 degrees on the indicator (zero being full nose down, I think) and that they are now going to "try something" - video captions say "don't try this at home", like we've all got a FFS in our shed or a 737 on the drive :-)

At this point the guy in the right seat uses the handle to wind the trim further _forward_. He stops when he clearly cannot wind it further - but they point out that it's still not at full nose down

Mentour is obviously struggling to keep the nose up at this point. I noticed he didn't seem to have the shoulder straps on (right seat did), possibly because he was frequently turning round to talk to the camera. That probably didn't help, but on the other hand he didn't have stick shaker or feel shift to cope with either.

Now, with Mentour pulling back, the right seat guy tries to wind the trim back with the handle - and he struggles to move it at all

They stop the sim, I think it was after stopping that he noted that at that point they were at 310 (maybe he said 340) knots.

I think there was then some further commentary, at one point I think he mentioned the rollercoaster to unload the stab and allow trimming, but commented that close to the ground the instinct is to pull back - I may be imagining that or remembering it from another video though.

And that was about it. I can try to answer questions on the video if anyone has any. The eye-opener for me wasn't the force on the control column (which was held anyway), it was that the trim couldn't be moved, in either direction. From somewhere I had got the impression that those wheels had a lot of leverage, due to the gearing, which was why a lot of turns would be required, but it seems that a lot of turns would be required and a gorilla to make them..."

Was the video pulled? Who did that, and why?

The speculation is that his employer, which flies a lot of 737s, didn't like him using a company simulator to illustrate a safety issue with the 737.

He pulled it himself.

https://twitter.com/MenTourPilot/status/1113723580284583936

His channel is worth following. He often posts insightful stuff related to incidents with 737s or just general information. He had a nice video about emergency procedures with a total engine failure in (probably) the same simulator just a few weeks ago.

Is anybody here capable of calculating the force required to move the trim tabs on a 737MAX at 310 knots at low altitude?

I imagine at that speed there would be quite some force on the elevator and trim tabs.

There's no trim tab on a 737 - the whole horizontal stabilizer is moved to trim the aircraft in pitch. Normally this is done electrically, but the stabilizer jackscrew can also be moved using manual trimwheels that move the jackscrew using physical cables. Whether this is possible at high airspeed while the stabilizer is trimmed nose down, and the elevator is being pulled up as hard as you can to avoid diving - that's the question that is being raised.

Edit: this shows the jackscrew in operation: https://www.youtube.com/watch?v=rxPa9A-k2xY

Something else I've started to wonder about is what the manouvering speed is on a 737.

I can't find a good reference but 280 knots is suggested as a turbulent air penetration speed which should be in the same ballpark

Applying full back elevator above this speed can bend the airplane (cyclic movements even more so).

The rudder / vertical stabiliser snapped off this one https://en.wikipedia.org/wiki/American_Airlines_Flight_587

Incidentally, I was just checking the Lion Air report for something else and noticed that Boeing helpfully suggest neutralising stick forces using the manual electric trim before activating the trim cutout switches.

Not that video, but at least it shows the automatic trim system in action - and is rather educational:

https://youtu.be/l62NvkRWa5E .

Even better: https://youtu.be/xixM_cwSLcQ

The official report will make for interesting reading. The speculation over the last few days is starting to fill in some questions I've had:

- Why didn't the pilots identify the issue as MCAS malfunction and follow the guidence?

They did and it didn't work for some reason. Possibly because of the air loads on the stabilizer.

- Why did the AoA sensor on a new aircraft fail?

Suspected bird strike.

- They did and it didn't work for some reason. Possibly because of the air loads on the stabilizer.

Has the CVR transcript been released? I can't find any source on the procedures taken in the cockpit prior to the crash.

I believe the media have been briefed on the the contents of the report but it isn't yet publicly available. It's annoying because I don't trust the media to get the details correct on this type of thing.

Why is nobody looking at the manufacturer of the sensor?

If someone connected a big industrial stop switch to a solenoid and pointed that solenoid at the trigger of a rifle aimed at the person pressing the button I don't think you would expect anyone to look particularly hard at the person who manufactured the switch.

If it was indeed a bird strike which took out the sensor then they seem to be completely beyond all possible blame. Even if it wasn't I'm sure they could point at a host of documentation regarding the usual MTBF of their sensors and why this application was inappropriate.

So you are saying this was probably not spec'd for this criticality? I guess I'm curious for more information on this. Obviously don't blame the sensor manufacturer without cause but why are these things so buggy?

The sibling comment says it better than I ever could. It's a mechanical device exposed to 500mph wind speeds and temperatures from 40c to -50c. It's a wonder that they work at all.

I don't think they are particularly prone to failure though. MCAS aside, having the stick shaker activate along with a host of other indications would probably be cause for a precautionary diversion by most pilots.

Having no autopilot and / or an unreliable altitude would most likely disqualify the aircraft from entering RVSM airspace which is where these aircraft would normally operate.

Yes and no.

Yes, the sensor is appropriate for use as an input to a safety critical system.

No, it is not appropriate for a safety critical system to behave in such a manner where if that one vane failed, to kill everyone on board.

While the sensor caused the cascade via it's input, it was the implementation of the listening system that allowed the rest to happen.

Safety critical systems are designed with graceful degradation in mind. The fewer sources of information the system has, the more conservative it's contribution to the overall state of the system should become.

There should have been integration with the second AoA sensor, pilot notification of disagree, and a lessening of the authority of the system in favor of the pilots.

The pilots could then have turned the plane around, and landed it.

Boeing is also on the hook for not highlighting the compounding risk presented by an airspeed unreliable failure compared with a stab trim runaway.

I'd also wager they should have had an MCAS disable separate from the stab trim cutout as a result.

For reasons similar to those often cited not to blame a single operator when they accidentally drop the production database.

It seems these sensors, and also pitot tubes, are notoriously unreliable. That is likely to be function of them being mechanical (moving parts) systems in rather unaccomodating environments, I. e. freezing cold, strong winds, etc.

In such a scenario, one has to acknowledge the shortcomings, instead of denying them and expecting unreachable perfection. That means building systems that expect failure and have enough redundancy to mitigate them.

Makes sense, I guess I wonder what the stated demands were of these sensors and whether they were built to reliably meet that demand.

Disclaimer: I'm not an aeronautical engineer, just a software "engineer".

But between harsh atmospheric conditions, bird strikes, hornets deciding to nest where they should not [1] and mundane human/maintenance errors, sensors can and do fail. I've been taught that reliability is not achieved by building bug-free systems on top of can-never-fail hardware. Quite the opposite actually: reliability is achieved by assuming that everything and anything can and will fail. I would recommend learning Erlang to understand what a system designed from the beginning for fault-tolerance and nine nine reliability looks like.

So to answer your question, nobody is looking at the manufacturer of the sensor because an AoA sensor failing should not cause a plane to crash.

[1] Although not the sensor at hand in these crashes, turns out hornet nesting in a pitot tube prevents it from functioning. And they can nest very fast, while your aircraft is just lying there waiting for the next trip...

Thanks that makes sense.

Why speculate here's memory item (pilot should know without looking at the manual) for all 737s for runaway stabilizer. Do you have any information they followed this. All published information we had was specifically that they did not follow the procedure:

CONTROL COLUMN - HOLD FIRMLY

AUTOPILOT (if engaged) - DISENGAGE

Do not re-engage the autopilot. Control airplane pitch attitude manually with control column and main electric trim as needed

If the Runaway Continues

STAB TRIM CUTOUT SWITCHES (both) - CUTOUT

If the Runaway Continues

STABILIZER TRIM WHEEL - GRASP and HOLD

From today's Ethiopian Airlines press release:

"The preliminary report clearly showed that the Ethiopian Airlines Pilots who were commanding FlightET 302/10 March have followed the Boeing recommended and FAA approved emergency procedures to handle the most difficult emergency situation created on the airplane. Despite their hard work and full compliance with the emergency procedures, it was very unfortunate that they could not recover the airplane from the persistence of nose diving. As the investigation continues with more detailed analysis, as usual we will continue with our full cooperation with the investigation team."

Edit: perhaps you're refering to the LionAir crash, where they didn't disable stabilzer trim?

Thats a press release there is cockpit audio pilots vocalize actions when they take them the cutout switches were never turned off. Would you point to the part of the actual report that says the position of cutout switches was off?

The preliminary report is not yet public - Ethiopian have seen it, hence their press release, and some of the media have been briefed on its contents, hence the BBC article, but it's not yet public.

Ok on other resources with more details from the report it does look like pilots followed the full procedure

OK it looks like pilots actually followed the procedure but could not manually trim stabilizer back to neutral.

A bad AoA probe wouldn't trigger IAS disagreement alert ( that is fed from the separate pitot tubes ) but could activate the corresponding stick-shaker which may make the pilots consider the possibility of IAS uncertainty.

Just a minor quibble.

Also increasing airspeed isn't a panacea for avoiding a stall, it is entirely possible to enter a high-speed stall if the AoA isn't managed. And in fact as mentioned speed can make recovery more difficult due to airloads on non-FBW aircaft.

From the AD issued after the Lion Air accident:

Additionally, pilots are reminded that an erroneous AoA can cause some or all of the following indications and effects:

- Continuous or intermittent stick shaker on the affected side only.

- Minimum speed bar (red and black) on the affected side only.

- Inability to engage autopilot.

- Automatic disengagement of autopilot - IAS DISAGREE alert.

- ALT DISAGREE alter.

- AOA DISAGREE alert (if the AOA indication option is installed)

- FEEL DIFF PRESS light

Thank you for the corrections!

The bad AoA probe can cause IAS disagree, according to the FAA Emergency Airworthyness Directive:

http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/...

Take a look at the graphs from the LionAir crash:

http://nrg.cs.ucl.ac.uk/mjh/lionair.png

You can see that both airspeed and altitude misread, in addition to AoA. If I understand correctly, the AoA is used by the ADIRU to correct misreading of the static pressure measured by the pitot-static tubes at high angles of attack. Thus one bad AoA probe can cause lots of symptoms simultaneously.

I'm an armchair non-expert at best: but shouldn't planes always be controllable by the column so long as the plane is mechanically OK? I.e. max power + pull stick should always just take the plane up, regardless of any amount of misconfiguration such as being out-of-trim etc?

Isn't that a reasonable expectation? That is: a pilot in panic at low altitude should never be required to do anything more than he basically can with hands on throttle and stick, to avoid disaster?

> but shouldn't planes always be controllable by the column so long as the plane is mechanically OK?

The problem is that you can easily exceed the aircraft flight specifications if you enable unlimited control. If you pull the stick back at max power you can seriously risk the creation of a stall, which is why MCAS exists in the first place. The whole goal Boeing had was to create a safe plane by letting software ensure it was always flying within the safe envelope for mechanical stress.

> That is: a pilot in panic at low altitude should never be required to do anything more than he basically can with hands on throttle and stick, to avoid disaster?

You would hope this, but what makes the determination that the pilot is at a low altitude? The altimeter tells you where you are in relation to sea level, not the nearest distance to terrain. You could be 10,000 feet above sea level but only 1,000 above a mountain. There's a lot of sensor data you'd have to take into account if you were to try to enable a higher degree of control based on how safe/dangerous it is to give that control.

>what makes the determination that the pilot is at a low altitude?

Give the pilot an emergency override button and let him make the judgment call. The whole point of parent comment is that too many sensors and software have removed the pilot's final discretion over the aircraft.

> You would hope this, but what makes the determination that the pilot is at a low altitude

Radar altimeter. Any aircraft with autoland capability should have three of them.

That's manifestly wrong.

MCAS was introduced because of the design decision to place the larger and more powerfull power plants further in front and higher up.

The reason for this was that Boeing wanted to grandfather the 737 certification into this model and wanted to avoid pilot retraining in the simulator, which was an important sales argument.

The problem with this redesign was that the airframe tended to point the nose up, since its aerodynamical characteristics changed due to the redesign.

MCAS was introduced in order to simulate the same behavioral characteristics of the older 737s.

This is proven by the fact that the system was neither documented nor was it part of the scenarios in the 737 MAX simulator. The idea was that the functionality is completely transparent to the pilots so that the could fly the new plane after a minimal presentation on an iPad, which was less thank one hour if they were already 737 certified.

The problem was not pilots pulling the nose too high. The problem, which MCAS tried to correct was the tendency of the plane to pull the nose high and correct for it.

Boeing tried to cram a 50 year old airframe into a new plane with engines too big to fit that airframe and wanted to avoid recertification and retraining.

That's the whole issue we're discussing here.

edit: clarification

> The problem with this redesign was that the airframe tended to point the nose up, since its aerodynamical characteristics changed due to the redesign.

Alas, I do appreciate your comment. This is what I was attempting (but failing) to say.

>MCAS was introduced in order to simulate the same behavioral characteristics of the older 737s.

Sounds plausible, but something with the story is still super screwy because a nose down "push" every 15 seconds is nothing like older 737 approach to stall behavior. If the idea is you want the same stick forces at approach to stall as 737NG, then you need some kind of motor or brake in the yoke mechanics to simulate it on a MAX.

If it were really simulating the 737NG stick forces, and this were erroneously triggered in an appropriate angle of attack state, the pilot would simply be getting weird/unexpected control stick forces - rather than a fight to the death, possibly at low altitude.

And if that simulation were to fail when needed (real high angle of attack), well yeah you're fucked if it's a necessary simulation to help the pilot avoid a developed stall. But at least in that case I would expect even slightly delayed recovery from stall is a better scenario than forcing the nose down.

I just don't like this feature pretty much as designed when working, when it's disabled, and when it's confused. It all smells like bullshit. Now I could easily be wrong and it's actually duck farts. But something stinks. I don't see how it gets around either FAR 25 airworthiness certification requirements, because it can be disabled. Or around FAR 61.31 type rating requirement, because it can be disabled. Disable it, and now your airplane is not airworthy and your pilot possibly not suitably type rated? Come on.

But something stinks. I don't see how it gets around either FAR 25 airworthiness certification requirements, because it can be disabled.

That's easy. When the manufacturer rubberstamps his own ariworthyness certification this is not really a problem.

Disable it, and now your airplane is not airworthy and your pilot possibly not suitably type rated?

That's the exact crux of the issue. Boeing panically wanted to avoid recertification of the plane and the pilots in order to be competitive with Airbus' A320 NEO.

Trim is much more important in a large jet than it is in a Cessna because of the speed range it operates over. At lower speeds with flaps up, you need a high angle of attack to maintain altitude. This entails a very high stick load in a manual aircraft like a 737 unless you trim nose-up for it. With flaps down, you need much less angle of attack, so less nose-up trim. At higher speeds, flaps up, you need a low angle of attack, so trimmed much further down. At higher speeds still, you start to get mach tuck, and need to trim up a little. So that's quite a large range of angle of attack, and so trimming needs to be very effective.

Now, at the same time, the airframe is not rated for aerobatics. So, you don't want to fit a huge elevator, because then it would be too easy to pull high-G maneouvers, and damage the airframe. It's all a compromise - very effective trim is a necessity in a large jet, and the elevator should be just large enough to give the control needed. The limitation then is that there may be parts of the flight envelope where the aircraft can be so far out of trim that the elevator struggles to overcome the trim. Normally well trained pilots would go nowhere near these parts of the flight envelope. This is why it's really not helpful when the automatics go awry, and put you there.

Short answer: it's complicated. But there's this small detail of more accidents in the past than in the present. Without doing a breakdown, this is due to better and more reliable components, better and more reliable pilot training (including CRM), and better and more reliable safeguards provided by computer automation.

In your example, max power + pull stick does almost always take the plane up. Pull back more, rate of climb increases. Pull back more, rate of climb increases. Pull back more, and rate of climb decreases. Pull back more, and you're no longer climbing. Pull back more, and you're sinking. Pull back more, and you crash. So... what went wrong? A pilot induced unrecoverable stall spin. The only inexpensive way of prevention is training. A more expensive system will place safeguards: stick shaker, or in fly by wire flat out ignore nose up input when approaching the critical angle of attack. So that means such systems must know about angle of attack, and that in effect a computer can second guess pilot inputs in certain cases. And that ship has sailed a while ago.

For a few decades now, incident and accident response always includes discussions of "add another button, add another indicator, add another software routine" to add more protections. As far as I'm aware, the pilot is trained about all of those safeguards. How the plane behaves with them. How the plane behaves without them.

What makes me angry about MCAS is not the single fail point (which I leave up to engineers to fight over) but the lack of training.

In the working case, at high angle of attack, this thing is going to cause the plane to exhibit a completely different behavior than prior 737s. It's going to do this rather odd duck nose down push every 10-15 seconds or whatever it is, in addition to stick shaker? That is not aerodynamic abstraction by software. That's like a silent flight instructor who just pushes on the yoke every 15 seconds for no goddamn reason. At first it will seem transient until you pick up on the pattern. And I can turn that shit off? I should know about the consequences of turning it off! There are consequences with it on, and off, and if it's confused! I need at least three kinds of training on this new feature.

I'd love to see this iPad difference training program, and go through this specific part of that training. Or even if a 737 pilot has made a youtube video of that training.

Me: pilot < 1000 hours total flight time, ex-flight instructor, and maybe 20 minutes of 737 sim time in a full motion sim that you get to record as actual flight time in your log book, which is fun to say but does not add to my credibility!

> Now, from what I understand, appying nose-up electric trim should override MCAS, and so this course of action should be possible.

I'm not so sure. Will have to wait for the final report to be sure, but I feel like the Lion Air flight should have survived if the pilot's trim up commands took priority over MCAS's trim down commands. They were fighting it with trim up commands and they lost. I fail to see how they could have lost this fightunless MCAS takes probity.

I know MCAS activates in 5 second on, 10 second off cycles and I'm getting the impression that the pilots can only trim up during the 10 second gap.

You're right, but since 10 > 5 the pilot should always be able to "win". You can see it happening in the Lion Air flight:

https://spectrum.ieee.org/image/MzE4Mjg2OQ.jpeg

I count 20 cycles of MCAS -> Pilot correction. It's not clear why the pilots lost the 21st cycle. It could be that they stopped making corrections or another yet to be identified airplane failure.

The MCAS activation just after 23:33:53 pushes the stabiliser down slightly further than it did at any point previously.

After this point, the stabiliser looks like it stops responding to trim up commands. The pilots do a few more trim up commands, but the is never a significant upwards response again. Perhaps this is because the pilot's trim up commands appear to be shorter, or perhaps the pilots are pressing the trim up button, hearing a loud girding noise from the electric trim motor as nothing moves, so they stop holding trim up.

With all this talk about aerodynamic forces being too strong on the Ethiopian Airlines flight for pilots to manually trim up, I'm wondering if the Lion Air flight experienced aerodynamic forces so strong that even the electric motor was struggling to trim up.

>Pilots increase throttle as per non-normal checklist to reduce the risk of stalling due to unreliable airspeed. Pilots disable electric stabilizer trim, as per Boeing's advice, without trimming back to neutral trim. Pilots likely started to trim up with the manual trim wheels, but that's very slow, and gets harder as airspeed increases.

I can see that at extreme trim and high speed that it could be difficult to manually trim. What I don't see is how MCAS puts you into that situation. MCAS is supposed to be limited to 2.5 degrees (out of the ~17 degree range) change every 10 seconds. So if you identify a MCAS issue and hit the trim switch, you should still be in a relatively normal flying envelope. I find it hard to believe that manual trim is impossible then. It would have to be a monumental design flaw.

In the specific case of the Ethiopian flight, unless I'm mistaken they went through at least a couple cycles of MCAS -> Pilot Correction -> MCAS. Even if they timed their cutoff switch to the end of the MCAS cycle they should only be 2.5 degrees off where they wanted. I would be surprised if that position wouldn't be level flight let alone a situation where they can't manually trim.

I wonder if there is a second issue cropping up. The Lion Air crash saw a similar cycle of MCAS -> Pilot Correction -> MCAS that eventually stopped.

IIRC the problem with MCAS is that it will "reset" the maximum of 2.5 deg every time it kicks in, so it goes: MCAS kicks in -> apply max 2.5 deg -> pilot correction -> MCAS kick in -> ANOTHER +2.5 deg max, and it goes cycling every 10-20 seconds.

At least I recall reading this from some comment here in HN from someone well versed with the 737 MAX.

Official report is now out: http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+...

This scenario does indeed appear to be what happened. It just looks like when they re-enabled electric trim, they didn't trim up enough, and then left it turned on. 5 seconds later, MCAS kicked in again, and then it was all over.

It sounds like they did almost everything right. There are two fateful moments:

>At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working

At this point they were in stable flight and the trim wasn't that extreme. It's not clear whether "manually" here means manual electric trim or trying to physically turn the trim wheel. Up until this point they had correctly diagnosed the issue and taken the proper steps.

>At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units. >At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.

They re-activated electric trim control but only slightly adjusted it. MCAS kicks in to send them nose down. There's no further pilot correction recorded. Unclear here if there is an airplane issue preventing them from adjusting trim or a pilot error.

When they did that final electric trim up, the right (more reliable) ASI indicates 365 knots. VMO is 340, so they were already in real trouble. It's not at all clear that even electric trim could overcome the air loads at that point to trim up, though it does look from the graph like it responded slightly.

At 05:40:30 you can see that the trim did change in response to pilot inputs at roughly the same speed. It should have been able to respond when they re-enabled electric trim unless there was some other failure. It will be interesting to see the full report with more detail about what the pilots did and why.

The other noteworthy thing is that it does look like the angle of attack sensor failed catastrophically. It was reading 10ish degrees before immediately jumping to 75. Boeing really screwed the pooch here. A 75 degree AoA is obviously impossible and should be disregarded. Let alone a situation where it goes from 10 to 75 in seconds.

I thought this was a software failure initially, but upon following the case, I have come to realize it's not. I still see plenty of people saying this is a software failure in this thread. This is not a software failure. This is a system/process failure on many level.

The plane was rushed to beat a competitor.

A mismatch between the plane & engine happened which can cause it to be off balance.

A system was added in place to correct it, but this system only used one sensor instead of 2.

The display could have displayed angle of attack which is a safety gauge, but it's optional and was charged for. $80k on a $120 million plane. It's now standard.

The display could also display a disagree light if the 2 sensors disagree, but that is also an optional feature, which will now be made standard.

The MCSA was only suppose to adjust for .5 degrees and when Boeing & FAA worked together, this was the agreed parameter, but Boeing changed it after the fact to I believe 2.5 and never informed the FAA. FAA only discovered this after the Lion crash.

This new system was not documented. It was not in the flight manual or training.

Boeing lied to pilots when they asked if there's any new system they should know about.

FAA wasn't through in certification process and allowed Boeing to sign off some things themselves.

The failure was on so many levels it's ridiculous. It's a whole collapse of a system.

Boeing, FAA, certification, QA, hardware design, etc.

If anything I won't even blame the software team much, software has no choice but to rely on the signal it's reading from the sensor if invalid. My concern is that the plane wasn't tested with faulty sensor. A happy path was followed. Testing with faulty sensor data might have shown the tug of war that would have happened between the pilot & plane. All in all, failure is across so many levels, it's terrible.

This has been just about my exact conclusion. I've just been checking things off as the evidence rolls in.

Funny how people were saying that it was just a matter of pilots shutting off the system...

Looks like 1) Ethiopian pilots were up to date in training (good for them) 2) MCAS should have never been shipped

With such new evidence, how FAA which refused to ground the 737 Max should be allowed to walk away from all these for nothing?

The FAA did ground the 737 Max.

FAA defended 737 Max to the very last minute, FAA is nothing else but a cheap tool for big corporations like Boeing.

The last minute when they grounded them?

I don't recall them "defending" anything, anyway, they simply held off grounding them until they got a little bit of data to back it up.

> they simply held off grounding them until they got a little bit of data to back it up

In my dictionary I have the following term which FAA and Boeing both actively ignored/violated.

pre·cau·tion /prəˈkôSH(ə)n/ noun a measure taken in advance to prevent something dangerous, unpleasant, or inconvenient from happening.

You have to balance "precaution" with "knee-jerk".

Maybe this is a naive question, but why can't the automated controls on plane be designed such that: 1. They can be independently disabled? 2. For MCAS in particular, disabling it will automatically revert to the previous trim level before it shuts off? 3. They can rely on sensors that are kept in enclosed storage (thus much less likely to fail due to freezing, etc) and immediately deployed when there is a problem with the usual sensors? Like the RAM air turbine? Most auto-pilot malfunctions seem to be due to sensors going bad.

Edit: Sorry I wasn't clearer the first time, but I meant the enclosed redundant sensors would be brought outside when needed, and retracted when not in use. Even the pitot tube could benefit from such a scheme

I guess it would be the complexity of the troubleshooting procedures involved if every feature had it's own disabler. You only have a short time under high pressure to resolve these issues so I can see that fewer, broader stroke options would be better.

Implementor of similar systems here.

1. It's possible, but you have to understand that a pilot, however bright he may be, cannot be overloaded with too many modes of operations. You can't always have Neil Armstrong driving...

2. We have to wait for the conclusions of the investigation. There is obviously still a lot of question marks about what /should/ occur and what /did/ occur, so it's difficult to speculate (at least for me) on what a correct implementation of the system should have been.

3. Each sensor has pros and cons. For an AOA, I am not an expert, but well, it's supposed to measure the lift under the wing, so I don't see how you can avoid being outdoor to get a direct measure of this quantity. I believe someone on HN more expert could give more insight here, but my experience when you try to use indirect sensors is that it générâtes the need for /more/ computational complexity to deduce the intended measure from indirect sources.

For your last comment, I would complement that auto pilots malfunction due to sensors going bad /unnoticed/.

We should take "going bad" very broadly: either the sensor is broken, or it is not picking up something that it should because, well, the designer just did not think about it.

This is a software screwup. It's buggy software due to rush to market. I hope they do an analysis of the whole project. We can all learn from it.

At the cost of 300 lives.

The software did what it was supposed to, the issue was the specification necessitated by the design change.

Yep, the issues started way earlier than the software. In fact the software is at the very end of the chain here, unless you also want to insert "no training". It all started when they wanted those big engines crammed into an airframe not designed to hold them, so as to try to quickly catch up to shifting market demands being met by Airbus.

How can you say “no training” caused this second crash after reading the article? Did you read the article?

(Edited) They had training (and sundvor didn't say otherwise), but still, remember Boeing's decision that little or no re-training for the Max was needed for pilots already having 737 training.

See e.g. https://edition.cnn.com/2019/03/22/politics/boeing-737-manua...

Thanks, that was what I was referring to. Cheers.

They said no such thing

I'm talking about a chain of causes here. There are clearly multiple factors at play.

I just sounds like nobody really thought about the consequences of MCAS triggering due to faulty AOA sensor input. There should be a dedicated switch to disable MCAS without completely disabling the electric trim motors.

> I just sounds like nobody really thought about the consequences of MCAS triggering due to faulty AOA sensor input.

They did know at least two years before the first crash and decided to not do anything about it.

https://www.reuters.com/article/us-ethiopia-airplane-regulat...

That article is terrible. It's a complete mischaracterisation of what it's sources actually said wrapped up in an attempt to make it relevant to the current MCAS drama.

The software did what it was supposed to

I'm pretty sure that it's a reasonable assumption that an implies requirement of any type of aircraft control software is "don't fly the aircraft into the ground"

This sort of buck passing is what kills people. The software may have performed according to its specification but it didn't do what it was supposed to, or it wouldn't have crashed the plane. Now sure, we could identify where things went awry in the chain of steps from "make the plane fly right" to a detailed functional spec, but when it comes down to it, the software was meant to "make the plane fly right" and it did not.

Not really, see https://news.ycombinator.com/item?id=19570691 for a good analysis

It's worse than that. When they refitted the 737 with newer, larger engines to create the 737 Max there wasn't enough room, so they were shifted forwards (look at the pictures - the engines are almost in front of the wings). This created a setup where the thrust could make the plane pitch up in certain cituations - the system isn't in balance anymore. Thus the sensor to detect pitch-up and the software to try to compensate for that. A hack to fix a hack. The whole airplane should be redesigned to balance as an 'old' 737. I for one won't set my feet in any 737 Max, whatever software or sensor upgrades they put in. No way.

> This created a setup where the trust could make the plane pitch up

No, not related to thrust. All underwing-engined airliners pitch with thrust. I wish we could stamp out this falsehoid.

The nacelles added aerodynamic effects at high AoA.

Pointing only at thrust is probably inaccurate, I agree. However, several sources point to the shifted center of gravity as a cause of the pitch, not just aerodynamic effects. For example an analyst at Leeham Co. (https://www.latimes.com/business/la-fi-boeing-737-max-crash-...)

Definitely a software QA issue. People are blaming the engines but we couldn't have known, a priori, that software is incapable of compensating for the change in balance. Process should have been in place preventing the delivery of an inadequate solution.

Software is involved, yes, but the problems are ultimately of management, risks (both underestimated and externalised on airlines, pilots, passengers, and the public), cutting corners, and complexity debt.

Every time I read about these plane accidents, I wonder why planes don't have any emergency features to save these people. Couldn't you build a plane that would eject the cabin as a parachute module or something. Yes, I'm sure this is naive, but why?

Edit: My point is that almost anything is better than crashing down with the plane.

Can you imagine the scale of parachute that would be needed to safely bring an airliner cabin to earth? Could a parachute on that scale actually be made sufficiently strong (and light), and successfully deployed? I doubt it.

Yes. It would be expansive though.

I want a wingsuit on my ticket. If I die at least I'll be superman-like for 30minutes

Imagine 500m wide parachute. Would probably weight few tonnes, be very complex to deploy (say only above 1-2km altitude), very hard to inspect regularly etc.

The other problem is, a lot of death/damage is done after plane hits the ground and starts to burn. You wouldn't be able to prevent that, since emergency parachute falls are hard ones. So you might still end up killing everybody on plane.

costs and motivation I suppose

some air vehicles have whole frame parachutes but not the scale of 737.

I was wondering if a plane could not be made out of separate cabins coupled together (I can hear engineers die of laughter) so that they could be break loose with their own parachute.

Yes, that splitting up would be one of the follow-up questions.

Hard engineering problem - where do you open up the fuselage to get the people out? It's a tube so you can't weaken it.

You also can't open a hole at the back and let them slide out backwards, you'd need a cylindrical tube in a tube which can then slide out. That's a HUGE amount of extra weight and complexity.

Planes are so so much safer than cars. Before we parachute people out of passenger planes we should be ejecting people out of the roofs of cars if an imminent collision is detected :)

Maybe just jettison wings+engines+cargo?

Though I agree that broadly safety is solved. And obviously we must heavily reduce air travel to combat global warming.

The question then becomes are can a plane fly with each of those attached by structural bulkheads & explosive bolts.

The remaining ‘crew and passenger capsule’ would need to remain sealed.

Maybe solid forms could be explosively or electrically welded off.

No.

This speculation is just pointless. It's simply not a solution given the engineering practicalities and cost constraints.

It's also not a good way to solve what is essentially a software problem.

Well-designed planes are ridiculously safe compared to almost any other mode of transport. And it's completely possible to design planes that handle all but the most extreme and unlikely edge cases.

The problem here isn't that passengers didn't have a Rube-Goldberg escape route, but that Boeing made some serious design errors - and then apparently tried to cover them up.

I don't think speculating about the possibility of an emergency solution or escape route that is outside the reach of errors made in software/hardware/you name it is pointless. Speculating about this particular idea could be, if the idea doesn't expand to other directions. Saying that problems should be solved only within their respective domains, I don't agree with.

So let's say you've successfully engineered a plane with detachable wings. Congratulations!

Now what happens when this system malfunctions and one wing pops off for no reason in normal flight?

You pop the remaining parts and deploy the parachute ;)

Rear exits aren't absolutely unheard of: the 727 and the DC-9 family had rear stair exits, and the 727 one was used in flight at least once (by 'DB Cooper' - probably not successfully though).

I don't fancy the chances of the crew getting the whole cabin of a 737 out of a single door, in flight, after fitting parachutes, but without parachute training, before hitting the ground, though. Even leaving aside the weight and bulk of the parachutes.

As you say, not a great idea.

> Before we parachute people out of passenger planes we should be ejecting people out of the roofs of cars if an imminent collision is detected :)

I'd be "accidentally" driving into a lot of trees if cars had that. Sounds like major fun!

Have fun! Me personally, I'm going to pass on the concussion and 1/2 inch of permanent spinal compression that comes with pulling 20 G's

Imagine this happening in the tunnel

Not really, fighter pilots can do 2 or 3 of those and then have to retire due to compressive damage on their spines. The Gs involved are not benign, since it needs to also cover the case of pilot ejecting on land quickly.

Go look up some of the recent airliner incidents. It doesn't appear that parachutes would have helped very many, if any. To make matters worse, such a feature would greatly cut down on passenger numbers per plane, which means more flights, which means more accidents.

https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

True. Quite many incidents / accidents during the takeoff. Also, crashes into mountains seem common as well. Not sure what the reaction time is in those cases.

Halfbaked idea: perhaps you could make an airbag that you can wear as a garment, and which you inflate if a crash is imminent.

Of course, if everybody in the plane wears one, you could have a space problem, but it would provide extra protection by compartmentalization.

The mass involved is far too great to be practical for parachute descent. Also, when are you going to "eject" this parachute module? Most serious accidents happen in the phases of flight very close to the ground, take off and landing. But just deploying a parachute won't work when you're so close to the ground. Try it for yourself if you like, buy a parachute, attach it, and jump off a ten story building. Your corpse will be surrounded by as-yet undeployed parachute fabric at the bottom.

A fighter jet gets around the being too close to the ground problem by adding a rocket motor. When you "eject" the rocket shoots the pilot's entire seat into the sky first. If you want to eject the entire cabin you're going to need a very big rocket.

Not crashing the plane is better. The goal is to not crash the plane whereupon this is all irrelevant. If you're wondering why that wasn't enough for fighter jets the answer is that the other guy's fighter jet is trying to shoot yours out of the sky. Planes don't fly once you put enough bullets into them. How many is "enough"? Well it may be prudent to eject before getting a firm answer.

Small prop planes can fit parachutes that try to save the whole fuselage, these have been seen to work at least sometimes, but they're very much a last ditch, they are expensive and they're only "practical" (if that's even the right word for something so expensive and relatively ineffective) for small planes.

Because said system would be very heavy, and probably on balance it would result in more crashes due to an increased number of failure modes.

I think zero-zero ejection seats are a good point of comparison here. These are the state-of-the-art ejection seats used by US fighters and bombers, designed to function from a dead stop on a runway. That's what you'd need for this to be useful in the flight regime most accidents occur in.

Unfortunately, ejection seats suck to use. Like, mild chance of killing you, very high chance of breaking bones, almost certain to make you a few inches shorter from compressing your spine levels of suck. This is assuming that you don't hit anything on the way out, of course - and don't land in the fireball. And that's with trained, fit pilots who are expecting the ejection. Can you imagine what happens to Grandma who's started to lose bone density? Or the baby on their mother's lap? And that's before you start considering the issues with having that many parachutes and rockets in close proximity, or the weight.

So that's why planes don't have features to save these people.

pilots should not have to fight the system. can there not be a simple button, "switch to manual"?

Airline safety has increased by a factor of 100 in the last 50 years, in terms of fatalities / miles travelled. Both in the past and now, far more accidents are the result of pilot error than failure of any system.

Gloryfing the good old days of pilot jocks just isn’t supported by the actual data, this incident nonewithstanding.

Isn't that orthogonal to the previous statement? The ideal situation would be to have fly-by-wire and a single hands-off button instead of HAL saying "Sorry Dave, but I cannot do that".

Of course, commercial pilots would need to have an actual interest in flying manually. The Gimli glider pilot was an enthusiastic pilot outside professional aviation.

I don't know if such an interest is still possible with modern exploitative labor practices.

I’d go beyond an “off switch” and argue that any software that’s smart enough to turn itself on without being asked needs to turn itself off if it’s obvious that the pilot is fighting against it. It’s like a classic Bayesian probability problem where the chance of a false positive is high. The software has to take into account that the stall scenario it thinks is happening is rare, and that happening followed by a pilot yanking back on the stick is vanishingly rare, accept that it was probably wrong and undo its actions.

at least you're not in charge of anything.

the plane's crashing, and you're telling the pilots (who you think might be jocks which makes you feel...even less safe?), "No don't turn it off, I have 50 years of data that says systems are safe." perfect example of doing data wrong. crazy dangerous arrogant ideas like this contributed to this tragedy.

when the systems are failing, you better hope you have some pilot jocks / true fixed wing enthusiasts at the controls, who know how to make the systems work for them, or take control if they fail, rather than some data jocks, with blinkered faith in the systems, who count cost of lives as "notwithstanding".

flyers deserve competence from their systems and data, not just from their pilots. we need pilots who have earned their capabilities, and systems that have earned their impression of reliability. current MCAS occupies a privileged position in charge of safety it has not earned.

Naive question, but is the plane actually possible to fly in "manual"?

The 737 is still mostly 1960s technology, despite all the tweaks over the years. With autopilot off, autothrottle off, and electric trim disabled, which is the situation the Ethopian pilots would have ended up in from following the checklists, all the main flight controls are entirely manual. Only the engine FADECs can't be turned off, and you wouldn't want to because modern engines rely on computised controls.

Not sure about that particular plane, but it should be. Contrary to jet fighters they are made to be aerodynamically stable.

You can fly (glide) them and even land with most systems switched off, including engines and main power.

https://www.boldmethod.com/learn-to-fly/aerodynamics/3-types...

https://en.wikipedia.org/wiki/Gimli_Glider

https://en.wikipedia.org/wiki/British_Airways_Flight_9

http://www.internationalskeptics.com/forums/showpost.php?p=1...

there is a manual override but once you are fully trimmed down manually trimming up takes time and time is something you don't have much of with the plane pitching down near the ground.

If it takes too long to adjust trim to a desired position, why can’t the pilots still pitch up by pulling back on the yoke?

the control surfaces have less authority than the trim. original spec called for less mcas authority, but it was increased later without much consideration.

I see, thanks for the info.

MCAS can be disabled, but pilots says this may not help in some situations:

> On the simulator when the stabilizer was "on a dive" at maximum angle, me and my colleagues weren't able to recover a plane.

> If you follow Boeing bulletin, but start the procedure too late, it will only make things worse. Simpler solution (in case of problems right after takeoff) is to release the flaps at least to the first position. This will disable MCAS and give you an additional time.

Source: https://denokan.livejournal.com/204046.html (Russian)

Google translate: https://translate.google.com/translate?sl=ru&tl=en&u=https%3...

MCAS can't really be disabled.

They procedure just disables the electric motor that MCAS is using to adjust the trim down. MCAS will still be sitting there sending trim down commands that get ignored.

Problem is, that electric motor is used by the manual trim adjust buttons too, so they stop functioning too. Following the procedure results in a nose down trim that pilots have to correct by manually turning the trim wheel, and it turns out the aerodynamic forces may be too strong for that procedure.

Some other info aggregated here https://www.theverge.com/2019/4/4/18294317/boeing-737-max-et...

Clear to most that the software has/had an appalling design for error-handling, with tragic results, and blame from Boeing to deflect that

There you have it, folks, programmers killing people. No, it wasn't on-purpose, but that doesn't mean it didn't happen.

This, of course, has been happening for a long time, it's just getting more and more obvious now. I feel strongly that AF 447 was an example.

It's important to understand that this is the natural result of two trends. One, software/hardware systems continue to become more and more complex, many times leading to unforeseen interactions. Two, programmers and programming management teams love to bunch up the work by things not related to the end-users: hardware component, new modules, architectural tier, underlying technology involved.

It doesn't take very much of that at all before you have a whole bunch of people all doing work of various quality in small enough isolated silos such that everybody can do a wonderful job -- and the system still kill people.

There's a lot more to add here. It's nothing new, and there are a ton of ways we've tried to fix this. My belief is that we've failed because we don't understand exactly what goes into making successful software at scale. I am quite concerned about it and I have been writing on this topic for several years. If you're interested in more, see my profile.

Why is this a software problem? Even if there is a software “fix,” doesn’t it seem that this tells us more about regulatory capture than using software to patch over bad hardware decisions?

It's a bad mechanical design, Boeing didn't want to spend money on retraining pilots, they asked software to fix it, software fixed it so that it remained the same, software had a bug, training didn't incorporate new system, because that was the point of the software, to not require a new type rating.

I think this is process failure from start to finish. Any sufficiently complex system will have bugs in it, whether it's software or not. I think the other failures are much worse. You have to account for your system maybe failing and your pilots have to be trained to deal with this failure.

And yes, software kills people, but no software kills even more people. Just look at how airplanes, cars etc. have improved safety through assistance systems.

It is bad mechanical design and the planes need to be renamed and rerated imho. That is now it should be fixed. It will cost Boeing 100s of millions but they deserve that by now.

I really didn't want to flame the room. As a commercially-rated small plane pilot and coder, I have a passion here and it both hurts me and makes me really angry.

I said this was a programmers problem, not a software problem, and I identified one of the key causes as programmers being isolated from user outcomes. Probably not a big deal if your user can't get to the website for 10 minutes. Different thing entirely here.

So this is a complexity * project organization problem. Yep, I think there's regulatory capture, and it may or may not have added to the problem. But you could repeat the factors I've listed in any country or industry you like and get the same results. So this isn't a "Boeing has corrupted the FAA" thing. Sure, it might have, and that's a good thing to talk about. But that's not it.

In fact, if you look at it that way, you're just continuing to silo off responsibility. This is another way of saying "Let's create yet another component that has oversight of all these other components that interact in ways we can't predict so that it can be the arbiter of what's safe or not" That's not a bad idea per se. It becomes bad because "the arbiter of what's safe or not" can mean all kinds of freaking things, many of which may be inconsistent or missing.

So really it just makes it worse. Let's say you make changes A, B, and C. Then it happens again with other systems. We come back in five years with another crash and sure enough, we've got the same clusterfuck as everybody points at one another saying that they've done their job but the other guy screwed up. Is it possible to black box test extremely complex systems? A lot of engineers have pretended that for a long time that you could. We are reaching the limit of how politically plausible that is.

I don't have an easy answer to the question "What do we do right now as programmers?" but I know that programmers, as a group of people, are in a unique spot to understand this problem and try to get attention for it.

A lot of us have worked on subsystems that eventually got used in ways we might find horrible and immoral. In that case you make a judgment call on whether the overall good beats the damage you may cause. In this case, however, these components and systems were built and integrated for no other purpose than this particular airplane. And bad things are happening. Joe Programmer can't be responsible for fixing Boeing, but he sure as hell can be responsible for having Boeing and other entities that build complex systems understand the horrible results of what they're doing and why.

ADD: Look at the comments here. It's a software thing. It's a hardware thing. Yesterday it was a training thing. A few days ago it was a distracted crew. Now we're talking about regulatory capture. Systemic problems are problems such that each piece can work in good faith and do a good job -- yet the overall results of the system gets worse and worse. A good sign of a systemic problem is when intelligent, well-meaning people end up pointing fingers all over the place. This is not a programming problem because it's in the program. It's a programming problem because we're in a spot to understand what got us here -- and I believe we have a moral responsibility to help others understand. A second sign is when new components are suggested as answers to problems the existing components are manifesting.

I agree with much of what you say here. I don’t agree that programmers are at fault or are particularly well suited or intervene, since the core is not a software problem. This is the nature of systems problems. Nevertheless, I think that we have a core agreement.

I wrote this two years ago -- the first chapter of a book (which I'm trying really hard _not_ to pump here)

https://wiki.info-ops.org/index.php/Main_Page#Info-Ops

There's a link to the first ten pages.

I find it difficult to write an intro like that and then see this happen again.

It's to early to conclude it's only a software bug. And blaming programmers is the absolutely not the way to avoid issues. Humans makes errors, always. Programmers or not. Some errors are unfortunately dramatic (talk about this to surgeons for example).

Now to remove the human factor as much as possible, there is processes and engineering techniques. If the failure was indeed caused by the software, and not by other defects in the plane design, the real question is how could it pass any safety check. For me, in any scenario, the first really wrong thing is how the plane passed all safety checks without the defect being detected, internally at Boeing as well as externally.

As more information unveil, it seems that the prime suspect is the pressure to release a plane too quickly.

It is bad hardware design with a software bandaid rushed in to maximize profits.

I agree with you though; I have said for many years that the way we write software (move fast, break things and shittier languages and infra like js and node) will eventually kill more people than most other man made disasters. Simply because the push for cheaper juniors in places where they do not belong.

Less bad but still potentially life altering I see every day in healthcare, insurance and payments: software is so horribly patched together that money just gets lost or misdirected.

I am biased as I was raised by a pupil of Dijkstra and studied under 2 of them as well, but for me there are solutions; tla+, Coq and languages with static typing. Not because these are silver bullets in their own right, but more because you cannot ‘move fast, break things’ in them; you have to think and plan a lot more as refactoring is very hard. Companies like Amazon uses tla+ a lot so I wonder why it is not standard practice in any place where lives are affected (aviation but also money and healthcare).

I am pretty sure the software here did exactly what it was supposed to do. There was no buffer overrun, no NullPointerException, not any other kind of bug. There was just software that reacted exactly as specified.

The problem is: those specifications were bad. It's a bad idea to just rely on one single sensor when you actually have two, it's a bad idea to write software that disengages on manual input counteracting its decisions, then resume overriding pilot decisions out of the blue with a delay of a few seconds again. And it's an absurdly bad idea to do all of this while not telling the humans that will have to operate the machinery in the end ANYTHING about how all of this works.

I totally get why Boeing thought all of those obviously bad ideas were "good" - because they helped their bottom line. It wouldn't be possible to completely hide the existence of the MCAS if there was a potential for a sensor disagreement that has to be solved manually by pilots, and if it hadn't been possible to completely hide the existence of MCAS, it wouldn't have been possible to get the new plane out on the market without requiring expensive re-training. And that would have made a very convenient marketing claim of Boeing impossible to make: "this new plane can be flown by all those pilots familiar with the old plane, no re-training necessary, just read these few pages on an iPad and you're good!".

But this clearly makes this disaster not a "programmers killing people" incident. If any "xxx killing people" classification is to be made here, it's "managers killing people".

Bad programming was not the sole or root cause but it was a cause, and people died. You can't punt on that unless you want software engineer to actually mean code monkey. The same way a building architect has to sign off on the design demands of a a client, a software engineer on safety-critical systems must evaluate the spec and consider the effects of edge cases.

What do you suppose the spec was here and how did the Engineer neglect to fulfill it? These specs are very compartmentalized, you think the Engineer is responsible for the big picture understanding and gets to take it up with the VP? No.

Yea, at a company like Boeing. They compartmentalize the fuck out of the engineering perhaps a bit too far.

While a SW engineer isn’t a code monkey, they are probably the last line in a chain that started with someone saying let’s bolt some oversized engines on this plane, and really even if there is a SWE who spotted the problem and pushed back, the only way to effectively make this software safe is to not need it, I.e design a new plane, and the only way to make that happen is to blow the whistle. So yeah a SWE could have done this but so could anyone involved earlier in the chain.

I do not think all blame should be removed from the programmers that easily. Programmers should think about the ramification of their code and not just blindly implement bad specifications which will get people killed. Now it is possible that Boeing is such a toxic place that any disagreement is silenced, but I do not think we should automatically give the programmers a pass just because it is a specification issue.

The question is who is going to blow the whistle because that is what it comes down to. It’s just not a simple case of doing a better job. It’s going to need someone prepared to lose their job. If it was a simple case of “hey boss I think something is wrong here” and they listened and acted I think that would have happened. Something must be culturally wrong I am guessing.

> There you have it, folks, programmers killing people

In fact it is more like "unscrupulous capitalists killing people", though. The more we know about the incident the clearer it becomes.

How can we be sure that this is programmers killing people, and not merely a busted angle of attack sensor, or an inadequate specification for how the plane should be designed (number of sensors or sensor robustness) or how the software should behave? This conclusion feels premature.

> There you have it, folks, programmers killing people.

Programmers were killing people since before we had electronic computers.

IBM did punch-card system for mechanical computers for managing people in nazi death camps.

Old news https://www.bloomberg.com/news/articles/2018-03-08/american-...

Just retire the whole plane

Has anyone checked if there is MCAS on the 787?

No there isn't

But there is on the KC-46 tanker for the USAF, but unlike the MAX it cuts-out upon pilot control input:

http://www.airforcemag.com/Features/Pages/2019/March%202019/...

Again it derives from trying to push an older non-FBW design to new limits; a 767 wasn't designed for the large shifts in CoG which occur when offloading fuel in flight. A FBW type like the A330 that was its rival for the USAF contract can just subtly command constant minir trim changes.

Interesting, I didn't know this. Maybe the KC-46 was the prototype (though it might be checking other inputs) to the MAX system?

> The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.

> Moreover, while the MAX 8 MCAS will reset and come back on automatically, the KC-46’s system is “disengaged if the pilot makes a stick input,” according to the Air Force

So it seems someone did their homework in this case (well hadn't they done, it would have gotten very ugly as well)

I’m a social capitalist. IMO, it seldom happens that the free market does not punish companies who make serious errors. For those times, logic, common sense & societal regulation should step in, punish the company with fines ratcheting up until free market clearly loses confidence.

With this kind of publicity I don't see how can Boeing can possibly not punished by the market itself. Even before 737 Max fleet was grounded, I already started hearing, from a lot of different people, that they wouldn't fly on that plane.

Can one even accurately know what plane they will be on until mere hours before? Does flightradar help with this?

If this was indeed MCAS, it is my understanding they 'could have' stopped this by turning off power to the electronic stabilizer trim.

Per the friendly article, "Pilots "repeatedly" followed procedures recommended by Boeing before the crash, according to the first official report into the disaster."

Exactly.

I find it embarrassing for the society as whole how many people these days comment on articles or posts by just reading the title.

I read the article, hence my reaction. Because to me, the claims of the article do not match my understanding of the procedures defined for dealing with a failing MCAS.

I'm interested to see what the report says about this. My understanding is that the procedure is "turn off electric trim and don't turn it back on". Not a procedure that you can follow "repeatedly".

Maybe you're right, but were they trained to know about this?

Ah yes ofcourse. Just hit pause to stop time, mute the people screaming in the rear, get a cup of coffee, sit back and think out of the box.

Not saying that we could've expected this of the pilots, just doubting the claim 'could not stop nosedive'. Specifically stating that the claim

"The crew performed all the procedures repeatedly [that were] provided by the manufacturer but were not able to control the aircraft."

Does not match MCAS as it has been explained to me.

But when the electric trim is completely shut down, manually restoring a sane trim position takes a very long time and time can be limited while close to the ground.

I think that what they would have needed was an intermediate mode, "disable the decisionmaking, but keep the power-assist". But that would only make the checklists even more complicated, at the cost of valuable time and more possibilities for user error.

Reply on news.ycombinator.com