Boeing Believed a 737 Max Warning Light Was Standard
nytimes.com
nytimes.com
If I am to read this correctly, the angle-of-attack disagree light is installed on all Boeing 737-MAX aircraft. For customers who did not buy on optional additional indicator, the angle-of-attack disagree light was always off, even if there is a disagreement between to sensors of the angle of attack of the aircraft.
Doesn't this seem dangerous in-and-of itself? If a pilot assumes that the light is off because there is not a disagreement, instead of because there is no information available, she is acting on incorrect information, and might try to address problems unrelated to the actual problem.
Also, pilot may switch aircraft and expect the same functionality of safety features and may make incorrect assumptions about the functioning of this light.
http://www.boeing.com/resources/boeingdotcom/commercial/737m...
They're absolutely different. If you're a pilot and you expect to see an error message when the two alpha vanes disagree, you'll be lulled into a false sense of security when that text never appears even in the case of a failure.
A pilot needs to be able to trust all of the instruments in the plane.
It also reminds me of a time years ago when a team I was on had to extend a Memcache client library, as it couldn't differentiate between the following two conditions:
- "I tried to retrieve a key from cache but was unsuccessful (due to connection error, etc)"
- "I tried to retrieve a key from cache but determined conclusively that key does not exist in the cache"
If it was important for a caching layer on our silly social game, the same thing is clearly important in aviation.
But the display which displays raw AoA readings to the pilots is an optional extra, only 20% of 737 maxes ship with it enabled. Normally pilots (or at least commercial pilots) are trained to fly without referencing the AoA by staying well within the safety margins.
So, if the AoA isn't shown anywhere in the default configuration, there is no way for the pilots to crosscheck them and see the fault. Which is why you need the AoA disagree warning message.
Unfortunately, Boeing messed up and the AoA disagree warning was only enabled on the planes with the AoA display option enabled.
But the article buried the lede!
There is much bigger problem reported now in this article:
The warning wouldn't have helped even when flying with those companies that paid extra for it!
Note:
"“We were told that if the A.O.A. vane, like on Lion Air, was in a massive difference, we would receive an alert on the ground and therefore not even take off,” said Dennis Tajer, a spokesman for the union representing American Airlines pilots. “That gave us additional confidence in continuing to fly that aircraft.”
But in the last several weeks, Boeing has been saying something different. Mr. Tajer said the company recently told American pilots that the system would not alert pilots about any sensor disagreement until the aircraft is 400 feet above the ground."
Note what happens then: at the moment you are above the ground, and the MCAS activates, we already know that if you "just follow the procedure" the forces against pilot corrections could be too big to do anything. That's what can be concluded from the analysis of the Ethiopian crash.
That means the plane from the "20%" with "paid option" would still eventually crash as soon as AoA vanes fail, just there would be one more of many alerts in the cockpit for some short time before everybody dies.
The sense of "security" Boeing gave the American pilots flying for the companies who paid for that additional feature was completely false. They would have been doomed too as soon as a single AoA vane that the MCAS depended on failed: The warning worked only at the moment it was completely useless.
The U.S. MAX planes were grounded the last, yet they were in the same danger as the other planes.
This is about adding to the narrative of Boeing's "general mismanagement" of the aircraft. Not about adding to the particular 737-800 crash investigation story (directly).
So the warning message could have potentially prevented both crashes and anything like it (assuming it activated during the takeoff roll, before V1 and the pilots were trained to abort take off when it happened)
Though you are right, if the AoA sensor had failed halfway though a flight, they still would have had problems.
Conversely, if your airline has not ordered the optional AoA indicators, and you'd really want the "AoA disagreement" warning light/message, you don't get it.
https://www.quora.com/Is-the-moon-there-when-nobody-looks-If...
I think this is the wish of very a many physicist as they drink their morning tea and contemplate the day.
Electricity suddenly stops working.
Which is why there's a threshold that much be crossed (IIRC ten degrees) before the disagree warning appears.
If you're slipping without flaps I guess it could still be a problem if the disagreement is outside the epsilon spec. I'm not sure if [normal] slip could ever cause that much disagreement.
(I've had the controls of a 172 and a Tiger Moth briefly, but have never _really_ flown a "real plane". I have flat spinned many many rc planes, mostly recovered fine, but also to their occasional doom...)
As a UXer I would _assume_ error messages would be in a consistent section of UI real estate. However, even if this is not the case I would expect both experience and training to mitigate the "can't find the error message among all das blinkenlights"
The pilot flying has eyes on the PFD continuously, only looking away for a few seconds at a time if handling other systems. Essentially when flying instruments you "scan" the 4 primary pieces of information in the middle of that screen every few seconds.
On top of that there is an audible reminder when a new failure annunciator appears, so even if they were on autopilot and not paying attention (rare so early after takeoff) they would hear it and look.
I'd expect building safe, efficient, high quality planes to be the answer. Whereas in their minds it's probably generate record profits by maximising ROI on past investments, protecting profit margin at all times having priority over things that might improve quality. Oh and with a complete spaghetti monster of responsibility layers.
I just keep getting more and more disgusted they are getting away with manslaughter.
- "We planned for, and certified, an MCAS operating within certain boundaries, but then delivered a plane that exceeds these limitations multiple times."
- "To save money, we built a plane whose handling characteristics are so crappy that we could not certify it, unless we put in an extra system interfering with primary flight controls, but let's not tell anyone about it."
- "We've added this powerful system interfering with primary flight controls, and it depends crucially on AoA data, which we receive from two sensors. Well, let's just pick one of them and ignore the other one. It'll be fine."
Managerial marvel? I assume you're not sarcastic, so what do you mean?
It's a managerial "marvel" because they managed to certify and deliver that mutant flying turd adding billions to their bottom-line, earning their bonus while spending Boeing's good name and capitalize their decades-long "investment" on FAA.
That's top-notch management right there...
If a pilot knows or believes it's installed, then they might discount a theory because the instrument appears to disagree.
To me, more dangerous, is that some safety systems are considered optional. Surely the plane either needs a safety feature or not, and it shouldn't be down to someone at an airline to make a decision on?
Who should make the decision whether an airplane is "safe enough"? Should it be the buyer who wants the safest plane? If you did that then rich airlines could keep out new competition by specifying safety features that make airplanes more expensive than they need to be. Should it be the country where the airline is based? But different airlines are based in different countries. Should there be options so that one country can specify higher standards than others?
Basically, that's how you get where we are I think. I'm not sure how you avoid that.
How about these guys? https://en.wikipedia.org/wiki/International_Aviation_Safety_...
I think that changes the calculus of "Do you pay 10x the price of an aircraft to reduce the chances a problem so that it goes from happening once every 100 years to once every 1000 years"
They had already invested the money to develop the feature. Delivering a plane with or without it to a customer had the same cost. If the customer paid more, they got the safety feature turned on, the end.
Not exactly, surely. The ongoing/recurring costs to Boeing would be increased with the feature enabled - it's another thing that can go wrong and must be monitored, it changes support requirements and the overall software runtime complexity. I assume that would get factored in, somehow...
People should have paid for the "warning when auto-crash enabled" option and I'm sure Boeing advertised their plane as absolutly unsafe without it...
Someone being pitched 30 different $1 million safety options?
In manuals that Boeing gave to Southwest Airlines — the biggest operator of both the MAX and 737s in general — the warning light was depicted as a standard feature just as it is on older 737s, according to Southwest spokeswoman Brandy King.
After the Lion Air crash, Ms King said, Boeing notified Southwest that it had discovered the lights did not work without the optional angle-of-attack indicators, so Southwest began adding the optional feature too.
(quotes from https://www.abc.net.au/news/2019-05-06/boeing-knew-737-probl... )
For example, airbags on your car may be mandatory but automatic emergency braking not so much.
Given that thanks to Boeing, the Lion Air crew didn’t even know the MCAS subsystem existed, and that MCAS would continue to rely on the single faulty sensor however many extra redundancies were installed, the decision not to buy seems kind of irrelevant.
This is the part I was trying to clarify. I don't know Boeing's internal processes, but there certainly could be options that are safety-critical but still optional because they are ranked low enough on the severity/probability/detectability scale.
I agree that it's wrong to blame Lion Air as the consumer. The fault seems to be in Boeing misapplying the risk categorization.
You're the one who made the factual statement. I'm not the one that's obliged to back that up.
Wikipedia lists the customers, and the number of aircraft delivered to US airlines is a good match for the 20% of aircraft that are said to have that feature. However, that assumption implies that 0% of leasing companies ordered it, that 0% of Canadian customers did, that the American airlines bought all their aircraft and didn't lease any, etc. Might all be true but you can see why I asked for a citation.
https://en.wikipedia.org/wiki/List_of_Boeing_737_MAX_orders_...
Does everyone know this delicious skit? "Clarke and Dawe - The Front Fell Off"
https://www.seattletimes.com/business/boeing-aerospace/faile...
Fuel loads, critical airspeeds, and maneuvering characteristics are indeed governed by weight and balance. That has nothing to do with AoA reading mismatch indicators.
Was there a separate question about automatic weight and balance measurement as a feature?
To you own the safest car that is available?
However, I'm not transporting passengers for money and accepting liability for passengers' lives; airlines do, so their financial calculation should be very different from Joe Blow private car buyer.
Finally, if I understand correctly, these extra safety features were software only, meaning they don't cost the manufacturer anything to add on, so there's no excuse to not make them standard. On cars, the extra safety features require expensive sensors, so they really do add to the BOM cost of the car, and putting them on an economy car really could push the price too high for buyers to afford, so carmakers put them in higher-cost models to help make them more commonplace and then move them into lower-cost models as the volumes increase and economies of scale make costs lower.
I would describe it as extreme criminal negligence with wanton disregard for human life.
Edit (as seeing downvote due to the possible tone of the comment): What I am saying is basically this should have been flagged by the FAA during the certification process. Maybe that was not part of the process but making sure to check which optional features offered are safety related could be absolutely critical for air safety.
Edit 2: I meant ON-OFF Light here
I don't think a light (rather than annunciator) can be a very serious safety feature in any case, simply because in an emergency pilots aren't going to be looking at random places throughout the cockpit to see which small lights are on. They're going to be looking at the central EICAS display, which is what they're trained to do.
I guess I shouldn't be surprised, this makes sense as a money-maker, and is how software is (necessarily) sold. When you have to pay extra for certain software features, whether or not they were actually included in the binary you have as a lesser-payer, it could have been, software is intangible and has no extra per-unit cost to include the "mechanism" once developed. This makes sense as a business model for selling software, in that that's how software works.
But yeah, I hadn't realized planes were sold that way. When we're talking about "features" that are pilot dashboard indicators... it really doesn't seem wise. Are there any pilot dashboard indicators that would be sold as add-ons that wouldn't increase safety were they there? I mean, what's a dashboard indicator for if not making it easier for the pilot to fly the plane? If you have to pay extra for some actual physical device, that's one thing, the physical device has to be installed. But when they're just holding back safety features with no extra per-unit cost that could simply be switched on if you paid... does not make me feel great about flying.
Is this some kind of airplane DLC and can I get the season pass for less money?
Then when someone else finds out a few months later, suddenly alarm bells start ringing, and everyone up to the CTO is called into an emergency meeting because there is a huge security vulnerability.
Yeah, no shit.
sigh
I've found this also happens for good things. "I've found this amazing thing that will save us millions of $". "It'll never work and as soon as I understand what you are talking about, I'll tell you why".
What's absolutely horrible about this is that I've caught myself having the same attitude! I've been trying to stop myself from doing it, but man is it difficult. The default, "My coworkers are brilliant" point of view is just so contrary to my cultural upbringing ;-)
It's not just cultural upbringing. It's difficult to really realize that the intelligence/competency distribution at work is vastly different than in the rest of your life and all those years before work. Especially if you work for a highly selective employer in a high-skill job market. We learn from experience afterall and encounter a lot of incompetency throughout life. We also tend to weight negate experiences much higher than expected ones.
I still catch myself being happy and surprised, if I encounter someone competent and usually expect incompetency. It's rude and on average probably wrong, but trained from experience.
This hits so close to home.
And yes, it requires a lot of mental energy to avoid falling for the same trap.
I guess the "responsible disclosure" culture is partly to blame here. If you get 90+ days to fix any vulnerability, then software that ships with (internally) known security issues is much more viable.
When other people or audit start noticing too, the potential for fines and PR disaster will go up orders of magnitude. Resolutions that were previously impossible can be evaluated again.
Before somebody says that it is a trivial fix to turn on a light. It is not. That would have to be retrofitted in the few existing planes and future planes, starting by notifying clients and regulators. A long and costly fix, creating a long paper trail of something being wrong.
Seniority in a position (imo) is the soft skills, and communication chops to either present a better argument, make sure there are written email statements of it not being a problem, or not take no for an answer.
It's easy to throw up your arms and say, well I said it in some meeting.
> As a result, Boeing said it did not inform airlines or the Federal Aviation Administration about the mistake for a year.
There was a warning light installed in the cockpits which was completely non-functional in 80% of the 737 max fleet, and Boeing did not notify the airlines for an entire year? Did they honestly think that "lack of a warning light" is equal to "lack of working warning light"?
http://www.boeing.com/resources/boeingdotcom/commercial/737m...
So there was no non-functional physical light on the cockpit.
It sounds like the software accidentally coupled functionality of this light to another feature. It is in fact a software bug. To fix the bug would have required a software redeploy -- which is definitely non-trivial thing in safety-critical software, and may have required some kind of recertification, or at any rate significant expense.
Instead, they could have done what they in fact _have done_ only _after_ people died:
> In the months after the Lion Air crash, Boeing quietly worked to appease some customers, according to a person briefed on the matter. In several instances, it activated the angle of attack indicator for free, which then turned on the disagree alert.
Well, quietly, for some customers, who know to insist on it and have the purchasing power to get what they insist on.
All Boeing had to do was flip a switch to turn the software feature on, without charging for it.
https://apstraining.com/the-angle-of-attack-debate/
>"From day one, pilots should be—and in most cases are—taught that stall occurs when the critical angle of attack is exceeded. They are then told to memorize the stall speeds in various configurations. By the time they have become proficient, they relate stall to a certain airspeed, and don’t really relate it to an AOA anymore."
Let's plan a theoretical test case. At a minimum, you'd need two maintenance guys, maybe one and a pair of tools. One guy to tweak the sensor outside (as several hundred mile per hour airstreams aren't exactly in plentiful supply, or easy and trivial to reconfigure in a hangar near you), and a guy in the cockpit, reading off the measurement on the computer against some sort of calibration chart.
The "tweaking" part would probably be done with some sort of precision test mount (that I doubt they even build into the plane.)
Also, odds are, you'd only detect very specific types of disagrees on the ground. Bad springs should be trivially deducible from the forces required to create measurable deflections.
Bad potentiometer connections should be deduceable from checking output voltage against the component spec sheet while deflecting.
Unfortunately, this dive into Electrical Engineering won't stop until you've taken into account every length of wire and eventually, every circuit board and line of code between that sensor and the avionics suite. If some FOD for instance, was slowly wearing through the wiring and insulation leading from the sensor to the computer, or an inductive cross-talk event occurred, or something shorted. Etc, etc.
And all of this work and diagnostics would need to be done by someone whose documentation told them the AoA sensor was a non-critical component so the manufacturer could cut corners.
Oh yes. <double facepalm> Been here before. Way. Too. Many. Times.
Not in safety critical systems , mind, but oh the web's I've seen woven.
I feel like it’s all about reading documents and never trying to use their brain.
A lot of my bubble about diagnosing things and connecting information together has been bursted.
I'm pretty sure that small aerobatic planes don't have an angle of attack indicator, while the pilot would know everything there is to know about attitude control, having a number is not useful.
An in the aftermath of the Lion Air crash, Boeing were telling pilots that this warning message would alert them to that kind of problem before takeoff.
I doubt that, the alpha vanes aren't particularly useful until the plane is actually moving at a fairly decent clip.
And I hope that also means "before V1".
I know the DC 8 couldn't do it's elevator check until it was moving quite fast, as there was no direct connection between the pilots controls and the elevator and it couldn't respond without airflow.
Instead of activating the indicator for all customers, Boeing only activated it for customers that explicitly asked. Greedy until the end.
This PR is helpful in that it reminds me that there are actually people paid to take a simple set of information and mix in with a ton of PR bullshit so that you have to read it 4 times before you actually understand that yes, they screw up.
https://www.volkswagenag.com/en/news/2019/03/VW_Group_delive...
It is unlike Boeing, that only sells planes under the Boeing name. When airlines buy an Airbus instead, the money ain't going to Boeing.
In the original design they had designed the MCAS to be able to make drastic changes which then caused the crash.
Now they are trying to fix that by making the system less intrusive, but didn't the engineers design the system to be so strong for a reason (because of the changed position of the engines)?
This seems to me like going through a codebase from someone else because there were errors and just deleting stuff that made problems. Even if the initial version had problems, it was designed that way for a reason?
This sounds like the "indicator" and "warning light" are not physical devices that must be installed at extra cost, but rather are software features that can be "activated" by changing some configuration file.
If so, then Boeing has blood on their hands. The active control system is already a cost-cutting hack. Charging extra for zero-cost safety features related to the new, unproven control system is an act of appalling greed.
As many have noted, AoA is not commonly used in non-military piloting in the United States, so its no surprise its not commonly ordered.
I am also under the impression that the AoA Disagree indication was new on the 737 MAX, I haven't checked the 737 NG manuals for it.
It's Limited Liability in it's purest, most distilled form.
Strikes me as subversive in this current environment: language reminding you that a corporation's decisions are made by actual people.
I didn't say what should happen. The company is just publicly waffling about it's own behavior. I find that annoying is all even if it's kind of expected.
One study claims "1200 premature deaths" in Europe alone: http://news.mit.edu/2017/volkswagen-emissions-premature-deat...
The current CEO is an engineer did come up from inside the company, and was in charge as CEO from June 2015. The first commercial flight according to wikipedia of the MAX 8 was in May 2017.
It makes one wonder.
I've seen this so many times in industry. Some decision on high comes through that costs need to be cut, which means cutting corners. It always means cutting corners, because the only way they have to measure costs is Salary × Butts-In-Seats. So they hire lower cost people (i.e. less experienced, often off-shore where there is no oversight on process) and cut the number of people (often several key roles that would put the brakes on bad plans).
They make a short-staffed team of people who don't know any better, then look around confused when things go wrong. "But the PowerPoints said we'd be successful. The management consultants said everything was on track".
When it's a website for a government bureau, people just throw up their hands and act like this is normal. The customer eats the cost of the useless product and they start over, usually with the same contractor on an extension, often not learning any lessons in the process (how could they? They can't imagine a world in which any of this is their fault).
It should never happen for any project. It should be a damn crime, upwards of fraud, with massive fines. But stuff that can kill people, this should be sending people to jail.
I can hear the meetings in my head, I've been through them so many times. "Who knew this was a problem?" "Uhhh, I brought it up at the outset, you said it wasn't my place to bring it up." "You're on report for your negative attitude."
Why is this review not done by a third party auditor? The cynical view is that corporations have a conflict of interest. They are only incentivized to act ethically up to the point that the cost of ethical behavior exceeds the damage done by unethical behavior... These costs do include future fines/penalties, but these are often woefully disproportionate to the damage done as evidenced by the fraudulent NASA metal supplier incident.
Remember, to regulate something, you need to be 10% smarter than what you are regulating. Which means you have to be able to make sure you can attract the best talent possible.
As a regulator, you have to be on your game all the time. The regulated just need to get lucky once to get away with what they shouldn't.
This is retrospective ass-covering, to distract us from the fact that the the pilots were never informed as to the existence of MCAS (Maneuvering Characteristics Augmentation System) and therefore could not even know how to disable it. The presence of or lack thereof of a warning light being rendered specious. And MCAS read only the one AoA sensor, from the captains side.
So to summarize, the pilots don't know about MCAS, MCAS is still engaged even when the auto-pilot is disengaged. A single AoA sensor failed, triggering the MCAS into a nose-down mode, the pilots begin ignorant of this, repeatedly tried to regain level flight using the trim wheel. This they failed at.
“The warning light notifies pilots of a disagreement in the sensors that measure which direction the plane is pointed”
This wouldn't even work in the way described, in a two sensor system, the computer can't tell which sensor is giving false readings. That's why they hooked up MCAS to only the one sensor. And Boeing didn't tell the FFC or the pilots as they would of had to get the plane re-certified and the pilots retrained.
In my own view, leadership should be held criminally responsible for the loss of lives. Of course it will never happen, but that's what ought to happen.
Hopefully they'll at least be responsible for liability in a lawsuit by the victims' families. They deserve being taken to the cleaners, well and proper.
However, given the amount of Boeing planes out there, and the number of employees, the company dying would be harsh. What needs to happen is a fundamental shift of culture; this is why I think that leadership should be held responsible for what's happened, and that this (with leaders in jail, new ones would have to take their place) would help force the changes that need to happen for safety and engineering quality again to be the number one drivers - not just profits and bean counting.
It's an opportunity for them to fully reset the company. Fingers crossed, it will happen.
346 dead from wilful incompetence, followed by utter bullshittery, half-truths, outright lies and finally, when it has to admit what it has been doing, a desperate insistance that executives could not possibly have known.
And all the while fighting against them being grounded.
Break the damn thing up already.
I dont think any US politician has the guts to take down Boeing, if it goes down there wont be any major US aircraft manufacturer.
It would be, but it needs to happen. And it wouldn't be as bad as people think.
The same thing happened when GM was on the verge of going under 10+ years ago. Why does everyone somehow think a giant manufacturer going out of business somehow means that thousands of employees will suddenly be destitute and unable to find another job? Do people really think that enormous manufacturing facilities are somehow going to go unused forevermore?
No, what happens is the company's competitors swoop and and buy up all the assets for cheap, and put them to work, because now there's suddenly not enough manufacturing capacity to meet global demand, but there's all these assets and a highly-skilled workforce suddenly available to be put to use.
For the same reason bailing out Chrysler and GM was wrong, Boeing should not be allowed to survive. The company can be broken up and all its assets sold to (hopefully foreign) competitors, who can then build better planes with them.
If you read the article, that's not what happened.
The warning message was meant to be supplied by default. Boeing though it was supplied by default. The airlines thought they were receiving it.
But they later discovered they had a bug which disabled the warning message unless another feature (an optional luxury feature) was enabled.
This situation is still bad. Boeing should have done something back when they discovered this bug: released a software update, given everyone the optional feature for free, or at the very least notified the pilots.
But it's not "charging for safety features" bad.
> This situation is still bad. Boeing should have done something back when they discovered this bug: released a software update, given everyone the optional feature for free, or at the very least notified the pilots.
Do you feel like the failure to do this qualifies as malicious behavior?
Edit: tense.
I still feel like a distinction needs to be made. According to this article, at no point before the grounding were airlines aware that they needed to pay extra to get this safety feature. Infact, they thought they already had it.
Boeing got no benefit, it was clearly a mistake.
Maybe you could argue the coverup was malicious behaviour, but such coverups can also result from incompetence.
The reason I think a distinction is necessary, is I think incompetence is much more dangerous than maliciousness.
A Malicious company evaluated each corner it cuts. It decides "Can I get away with this particular thing" and it will only cut the corners it thinks it can gets away with, leaving the more dangerous corners un-cut. A Malicious company will have notes on each corner they cut, or at least people who remember, so we can go in later and re-evaluate everything.
On the other-hand, an Incompetent company has no idea where it went wrong. It made random mistakes without realising. The mistakes could be anywhere along the risk-spectrum. They aren't documented. Nobody knows where they are. The only way to be sure you caught all these mistakes it to completely re-examine the whole design.
Plus, even if their attention does wander there are other safety systems (like stall alerts) that will kick in to help them.
It's not like the MCAS disengagement makes the plane uncontrollable.
Hopefully it doesn't disable itself when it's needed.
It depends, I think:
1. Did the AoA sensor malfunction occur before the takeoff roll?
2. Would the AoA disagree indicator come on early enough to abandon takeoff?
3. Would the crew reject takeoff once the AoA disagree indication comes on?
If it's a "yes" on all three questions, then presumably the accidents would not have happened.
Once you're in the air, and all hell breaks loose (stick shaker etc.) while MCAS tries to dive you in the ground, I doubt that the indication would have made any difference: before the Lion Air crash, crews didn't even know about MCAS. After, they did know, and the Ethiopian Airlines crew, from what I gather, diagnosed the problem, though maybe too late - but again, I doubt whether the AoA disagree indication would have helped.
That leaves above questions.
1. For the Lion Air crash, the AoA malfunctioning was there before takeoff. For Ethiopian, I'm not sure.
2. I'd think yes.
3. Don't know. Anyone an idea? (Today, presumably you'd abort with a MAX and AoA issues. Back then?)
But you can't shut off the AoA measurement "system", AFAIK. And the system causing the trouble (under wrong AoA information), the MCAS, can be shut off by setting the Stab Trim switch to Cut Out, but how should the crew know the connection between AoA and MCAS when they weren't even briefed about MCAS in the first place?
For the Ethiopian flight, you're right. They likely wouldn't have known what to do with that information. But it might have prompted them to get on the radio and ask someone, or consult a certain part of the manual (assuming there was any relevant information there.. I don't know).
It certainly seems like crucial information. And even in the small chance it could have made a difference, the absence of it is critical
Big difference. Still didn't do anything for the fellows on the next flight.
At any rate, having had that AoA disagree warning (limited to above 400 ft) would not have saved these planes, it seems to me. Having had an AoA disagree warning on the ground might have.
EDIT to add:
Hm, Boeing states:
"During rotation, pitch angle is the critical parameter that ensures tail clearance. Once the airplane is airborne and at a sufficient altitude where ground effect and crosswinds do not affect the sensor reading, AOA will provide valid information."
https://www.boeing.com/commercial/aeromagazine/aero_12/attac...
[1]http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+...
But even if the pilot notices the warning, if they don't know about MCAS, then they don't know about "MCAS upset" which can result when MCAS acts on bogus AoA information. And this particular variety of "MCAS upset" quickly induces a mistrim, and high airspeed. So I'm unconvinced the indicator is a "safety" feature in-flight that will result in any different behavior on the part of pilots in an "MCAS upset" situation.
It is a mistake to think that trim is only about attitude (nose up or down relative to the horizon), it also implies an airspeed. Nose down trim effectively translates into a higher airspeed, all other things being equal. If you reduce power, the plane will nose down (this is a function of positive static stability, a FAR 25 certification requirement for transport category airplanes), and the plane will stabilize to maintain the airspeed implied by that trim. Add power and it will climb, to maintain the airspeed implied by the trim.
The central problem is still that the pilots weren't trained about MCAS in either it's intended working condition, or "MCAS upset", or how the airplane behaves with autotrim disabled and therefore without the benefit of MCAS. The pilot not being aware of these three of these behaviors is just flat out wrong. It's bad enough they weren't also required to demonstrate competency (knowledge and practical test) for all three.
1. The A320neo really caught Boeing off guard. The 737 MAX was a panicked reaction to something that they thought would threaten their business to a significant degree. The A320neo and A320 have a common type rating too. Googling seems to suggest the differences are fairly minor however. I guess Airbus benefits in the A320 being a newer airframe than the 737 (which is ~50 years old now)?
2. Somewhere along the line this is a management failure of gigantic proportions. That management would risk Boeing's reputation on something that, in hindsight, is so incredibly foolish is mind-blowing. And the buck stops with the CEO. If this ends with anything less than the CEO deciding to spend more time with his family it's a joke. And whoever replaces him should clean house with anyone remotely responsible for this.
This isn't unprecedented either. Through this fiasco I came to learn about the 1990s 737 rudder issue [1] and it's scary how similar the reaction is. "The planes are fine". "There is no issue". You know, until there is.
I expect the only thing stopping a lot of airlines from cancelling their 737 MAX orders and buying A320neos instead is at this point they'd probably have to get in the back of the line and wait years. They really have no choice but to stick with the 737 MAX now.
Actually I guess airlines like Southwest (who are 100% 737 IIRC) are kind of stuck anyway. It's the likes of American Airlines who has such a large and diverse fleet that really bet on the wrong horse.
I really hope this ends in a court case or even better, a criminal case. I really want to know who signed off on this plan and at what point warnings were given and ignored.
> Googling seems to suggest the differences are fairly minor however.
> I guess Airbus benefits in the A320 being a newer airframe than the 737 (which is ~50 years old now)?
The 737 is uniquely low to the ground among modern aircraft. (This was an advantage at airports without jetways high off the ground a long time ago.) Which means for every other model there’s plenty of space for new larger style engines under almost all of the existing planes. This makes airbus’s neo programs comparatively simple and reasonable for keeping the same type rating. The 737 doesn’t have the space, so they moved the engine location and came up with the MCAS as a workaround. It was clever, but unfortunately, too clever.
Specifically after more and more of the incestuous relationship between the FAA and Boeing comes to light.
Including claims that experienced engineers, which were in charge for certain certifications were demoted or fired if they were too critical or outright refused to certify certain sub systems as was reported in the Seattle Times[1]
It seems that since 2004 engineers in charge of certification were stopped to communicate directly with techies at the FAA, but reported to their managers, which in turn communicated with the FAA.
He who pays the piper calls the tune.
[1] https://www.seattletimes.com/business/boeing-aerospace/engin...
American Airlines (a life long Boeing customer) placing a massive order of 320NEO put Boeing into full throttle panic mode and triggered the unfortunate decision to apply yet a number of hacks to an airframe, which was not suitable for the purpose.
I was about to snark, "Sometime prior to people dying as a result of the debt."
But then I considered that (potentially) the $X dollars saved by allowing the technical debt to live on, could probably be invested in some other way that saves far more lives. I.e., obesity reduction, smoking cessation programs, etc. So perhaps the issue isn't that simple.
There are multiple lawsuits against Boeing going already, but don’t forget the FAA signed off on the plan, and some time ago formally adopted a policy of trust whatever the airlines say without checking carefully. Why even have a federal regulatory agency for air safety if they’re not going to independently scrutinize what the airlines do?
Your point about Ethiopia's and Indonesia's agencies (and airlines) is reasonable, they ought to do their own due diligence on the aircraft that they use & allow on their turf. Smaller countries and agencies with fewer resources than us have tended to trust our FAA and the aircraft manufacturers to assess these risks. In that sense, the FAA's failure to regulate the Max and it's policy of outsourcing regulations to the manufacturers themselves is (rightly so) truly embarrassing for the FAA, is resulting in loss of trust of the US FAA globally, and maybe on the bright side is going to cause all other countries to start doing more of their own due diligence.
The last thing Boeing or Airbus wants is to have to prove their aircraft for every country in the world.
American Airlines was going to place a major order with Airbus for the A320neo, Boeing promised AA that they will deliver a new aircraft quickly which will be better than A320neo if they cancel the A320neo order.
So during the cross-over period, you will need two completely independent fleets of pilots, one to operate the old 737s and one to operate the new A320-NEOs.
Each fleet needs to have different spare pilots to cover absences or overtime emergencies. And the pilots who currently are training for the new type rating can't be in either fleet.
The airline will have to temporally increase the number of pilots until the whole switch-over finishes.
You can have endorsements for multiple ratings but you will need to renew each independently, which costs. It would cost twice as much if you want to maintain two type ratings.
Airbus have designed their A320, A330/A340/A350 planes with almost identical cockpits and handling characteristics to allow cross-crew qualification.
A pilot with an A320 type rating can take a 7 day course to become qualified on the A330 (instead of the 40 day course normally required). And they can maintain the type rating on both types simultaneously.
Since the A330 shares a type rating with the A340 and A350, this allows a pilot to fly quite a few airbus planes.
Given the Max is so close to older 737s, I see no reason why Boeing and the FAA couldn't come to a similar arrangement, were pilots can be cross-trained with a 1 week course and maintain simultaneous type ratings on both the Max and Older 737s.
Boeing does have a few common type ratings: The 757 and 767 share one; The 777 and 787 share another. But as far as I'm aware, pilots can only be qualified on one Boeing type rating at a time.
[1] https://qz.com/india/1527728/india-places-checks-on-airbus-a...
> after the crash of Lion Air Flight 610 […] conducted another review and again found the missing alert did not pose a safety threat
How was it possible to come to this conclusion? Twice!? Even after it caused a crash!?
(In case there's doubt: I am not joking, I think this is seriously the argument.)
haha wow. If that's representative of how pilots feel then Boeing is in trouble.
https://beta.washingtonpost.com/business/2019/05/06/safety-w...
This video was both hilarious and terrifying.
The analysis is interesting but of limited value to consideration of the sensors and MCAS system on the Boeing 737 MAX.
I wonder what percentage of customers will do the same and how that will impact airline's bottom line.
I don't care if I sound lunatic or alarmist. If Boeing was astute enough to take this kind of shortcut to rush the 737 MAX, who knows what other shortcuts linger in that project, hidden.
This doesn't protect you from an aircraft change and I don't know how I would deal with it if it happened.
I wonder how software testing will change (if at all) in the industry post this revelation. There was an old joke during 777 development (Boeing’s first full fbw) about the difference between airbus and Boeing software testing architecture - airbus used formal techniques and Boeing put the software engineers on the first flight.
On another note; am I the only person that these AOA vanes seem so hokey and inelegant to? I am not a pilot, nor a designer, but if I was buying and flying something that had these sticking out like an after thought; I'd be like WTF are you kidding me?!
Planes should be as safe as they can possibly be. Full stop. Premium should be for things like comfort and things you can do with out.
It economically (to the car industry) may make sense (opt ups, recover costs, etc), but it's sad in a way.
Boeing spent the money adding this to their design. They spent the money adding the capability to every plane they had. And they thought it was important enough that they shouldn't be charging airlines for it, unlike the addition of a backup sensor (which wasn't considered important enough to be delivered standard).
What was the thinking when doing the review? Hey, here's this feature we thought was important enough that we added several costs without charging airlines for it, while we were nickel and diming them on backup sensors, but actually it was all a big mistake. We were just being generous on this for no reason at all?
I watched it last night in the same state that he apparently films his vidjeos, and I enjoyed it. YMMV.
Ignoring the complex system they have created is their fault
The anti-stall system, created to compensate for the Max’s large new engines, will push down the nose of the plane if the angle of attack sensors indicate the plane is dangerously close to stalling.
But the system relied on only one of the two angle of attack sensors, introducing a potential single point of failure into a critical flight system. And the anti-stall system was also changed late in the design process to make it much more powerful.
Idiots. How the hell do they not have a robust system to validate the correct application of instrumentation rules?
It was only later that Boeing discovered they messed up and had made the warning light dependant on another feature which was optional.
And then Boeing didn't tell airlines about the broken warning light until just a few months ago.
F Boeing
The autopilot systems cannot cope with AoA disagree, that's why MCAS came into play. The Ethiopian pilots (for some reason) kept trying to engage autopilot. Unfortunately for them MCAS is only needed when autopilot is disabled.
Factual errors in this post include:
- MCAS wasn't designed because "autopilot systems cannot cope with AoA disagree." MCAS couldn't handle AoA disagree, that's the whole crux of the problem.
- MCAS wasn't enabled at all when autopilot was. Only manual flying.
- MCAS was designed to simulate the non-Max 737's thrust curve to maintain a similar type rating FOR PILOTS. It had nothing to do with autopilot at all.
- The Ethiopian Airline pilots never tried to enable autopilot, and didn't "keep trying to engage autopilot" that's pure fiction.
MCAS used trim to counter-act an overeager upwards angle during key parts of the flight like take-off. It used electronic trim to accomplish this and a single AoA sensor to determine when.
The Ethiopian Airline pilots, per the initial crash report, correctly disabled the electronic trim system (both disabling the yoke trim switch and MCAS). However were unable to manually re-trim the aircraft using the trim wheels due to the aerodynamic forces placed on the aircraft (via hard trim counteracted by hard elevator).
This forced the Ethiopian Airline pilots into a difficult choice; and they ultimately decided to re-enable electronic trim and use the yoke trim switch (which is more powerful) to fix the trim. Unfortunately MCAS trimmed the aircraft further, they lost control, and the aircraft crashed.
At no point did autopilot play any role in the crash.
>- MCAS wasn't enabled at all when autopilot was. Only manual flying
Correct.
- MCAS was designed to simulate the non-Max 737's thrust curve to maintain a similar type rating FOR PILOTS. It had nothing to do with autopilot at all.
Incorrect. Ish.
MCAS has squat to do with thrust curves, it has to do wit control force curves. Namely bringing the amount of control column force at high AoA needed to achieve further increases in AoA in line with the expectations of a trained 737 pilot. The rest of that point is accurate though.
>MCAS used trim to counter-act an overeager upwards angle during key parts of the flight like take-off. It used electronic trim to accomplish this and a single AoA sensor to determine when.
Incorrect-ish.
Yes, take-off would be one of the more likely places to run into an MCAS activation, but generally speaking, even that rotation doesn't come anywhere near the AoA MCAS was meant to deal with, and to boot, flaps being engaged disables the MCAS system.
>This forced the Ethiopian Airline pilots into a difficult choice; and they ultimately decided to re-enable electronic trim and use the yoke trim switch (which is more powerful) to fix the trim. Unfortunately MCAS trimmed the aircraft further, they lost control, and the aircraft crashed.
Trim switch is higher priority, but not more powerful per se. the trim switch was clearly overwhelmed in terms of MCAS's ability to command trim changes in 2.5 degree increments five seconds after the release of the yoke trim switch as long as it detected the high AoA. Not sure whether those trim switches are continuous direct drive (I.e. jackscrew turned as long as the switch is held down) or discrete (updates the jackscrew motors to move to next position over time, only to be overridden by MCAS five seconds later).
Other than that, that looks like a fairly good summary.
At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.
At 05:38:58 and about 400 ft radio altitude, the flight director pitch mode changed to VNAV SPEED and Captain called out “Command” (standard call out for autopilot engagement) and an autopilot warning is recorded.
At 05:39:00, Captain called out “Command”.
At 05:39:01 and about 630 ft radio altitude, a second autopilot warning is recorded
At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted and the pitch trim position decreased to 4.6 units. Six seconds after the autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes. These oscillations continued also after the autopilot was disengaged.
At 05:39:55, Autopilot disengaged,
At 05:39:57, the Captain advised again the First-Officer to request to maintain runway heading and that they are having flight control problems.
At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested and the aircraft descended slightly.
Autopilot was enabled for a short period after take-off, then disabled at 05:39:55 due to turbulence and never re-enabled.
If you look at the graph in Appendix 1/page 26 -- FDR Data you'll see that the first MCAS command occurred at 05:39:30. Once autopilot was disabled it remained disabled until impact.
The information you're quoting above is just included for informational reasons, it likely won't play a part in what caused this accident.
Great post, but minor correction: At take-off flaps are set which disables MCAS.
Reread what I wrote.
MCAS wasn't enabled at all when autopilot was. Only manual flying.
Quite literally what I wrote.
The Ethiopian Airline pilots never tried to enable autopilot, and didn't "keep trying to engage autopilot" that's pure fiction.
I'm not sure what you're going on about. You can see plain as day that the captain engaged the autopilot — there are five AP warnings on the graphs in the preliminary report. You can also see the position of the AP master switch (which, yes, they engaged autopilot with the stick shaker going off). You can even read through the transcripts where they're fiddling with the autopilot throughout the whole flight.
> The autopilot systems cannot cope with AoA disagree, that's why MCAS came into play.
And:
> Unfortunately for them MCAS is only needed when autopilot is disabled.
Pick one. Either MCAS "came into play" to "cope with AoA disagree" because "the autopilot systems cannot" or "MCAS is only needed when autopilot is disabled."
The statements aren't mutually exclusive. Not even a little bit.
Autopilot eventually disengaged because there was an AoA disagree. MCAS was active because the autopilot was disabled. That's how MCAS works. That's the only situation in which MCAS could be engaged. And that doesn't mean that MCAS was designed to mitigate the problems related to an AoA disagreement.
It's not unusual to engage autopilot during climbout, I only see one explicit instance in the preliminary report for autopilot engagement, and two warnings, and two disconnects.
Really, it's Boeing, and governmental oversight bodies, who were in the best position to know if the plane was dangerous without a warning light, and therefore to make sure all planes have a warning light.
Required safety features should not randomly be present if I don't buy extra packages.
Edit What if they also forgot to enable other things, it is possible that this warning is one of a couple of things that got rushed and not properly tested.
it was indeed American Airlines who pushed Boeing into making another shortcut warmed up 60 year old design plane with the 737max by asking for a quick lower cost plane. Lower cost that could only be achieved by lower kerosine sucking engines (which didn’t fit under the 737) and by ‘oh god forbid we do not want to train pilots’ type rating commonality. Let’s not forget that the whole “we only got training via an iPad lesson” is exactly what American et al wanted. They wanted to save money on simulator lessons / new typerating training.