Boeing altered key switches in 737 MAX cockpit limiting ability to shut off MCAS
seattletimes.com
seattletimes.com
Boeing keeps talking about fixing them and putting them back in the air, but I dunno. At this point, it should be agreed the fundamental design flaws are serious, and Boeing should have simply made a brand new plane, with much more modern controls and predictable maneuvering. Yes, pilots would have to be certified for these new plans, but that cost pails to the money lost from these grounded fleets.
I'd honestly like to see the 737 MAX taken out of service and Boeing simply ending this line. The old planes should be stripped for parts and as much recycled as possible. It's going to cost them a lot of money, and it should. Their mistakes lead to the deaths of two whole planeloads of passengers. Airbus, Bombardier and others will probably make a lot out of this disaster, and that's probably a good thing and will help competition in this small/narrow market.
The bugs will be addressed and they'll still fly. Airlines have no choice, there's a limited capacity in the world for airplane construction, several thousands of orders on the books for the 737 and 320 waiting to be filled. What can an airline do? They can cut back some orders but not all orders.
> I'd honestly like to see the 737 MAX taken out of service and Boeing simply ending this line.
I have an alternate history fantasy where instead of going with the MAX and then trying to kill the C-series as they did, they instead bought into the C-series. Swapping the cockpit for a Boeing cockpit design. Built the -500 stretch of the C-series, and then used the C-series to replace the 737 line in the <165 pax market. And moved ahead on the 797/NMA for which they'd have a shorter version covering the 200-270 pax market as a pure passenger mover as it's proposed.
A) Adding two more angle-of-attack sensors so a pilot can be reasonably sure of auto-adjust will work. Retrofitting those would be expensive, of course. B) Put the two buttons back the way they were and add a "light" indicator an angle-of-attack sensor failure. C) More pilot simulator training so pilots know what to expect in the unusual situation that the system fails.
I suspect the answer would be: "Even now we're not willing to bite the bullet and pay all the expenses we were dodging before".
Searching, it seems Southwest already did something like this (after the first crash, in fact). The problem might be that if Boeing does this on their dime then Boeing would be essentially giving every one of their "bargain" customers the features of their "luxury" customers, which I would speculate might be a vastly expensive proposition especially if it sets precedent going forward.
https://theaircurrent.com/aviation-safety/southwest-airlines...
And it's worth pointing out that 737s already have two of these sensors, but don't use them both for MCAS (?!?!).
0.00001 * 0.99 = 0.0000099
0.99999 * 0.01 ~= 0.01
P(failure|alarm) = P(alarm|failure)*P(failure)
---------------------------
P(alarm)
= 0.99 * 0.00001
----------------
0.0000099 + 0.01
~= 0.001
For the noise sensor scenario, is the sensor failing or is the ancillary (and single point of failure) noise sensor failing? What happens when you have a false positive like that and a false negative on another sensor?
For the correlation scenario, when you have two systems that disagree, how do you determine which one is failing? Are their precisions and tolerances sufficiently close that you’ll get a warning at a useful point in time?
This system is critical to the Max 8 remaining classified to 'fly the same' as the 50+ year old 737 air frame design so it's critical to pilots being certified to fly the plane at all. Ergo it is a critical system and needs more redundancy or the Max 8 needs to just have a new type certificate and pilots certified to fly it as well.
Boeing REALLY REALLY doesn't want to do this because it would require airlines to retrain their pilots to use it in their fleets making them less attractive to airlines. The whole fiasco is a confluence of 1) Cost of retraining pilots on a new air frame 2) need from airlines for a more efficient plane 3) the old 737 design not having any more room below the wing for a bigger engine (which is pretty much the main way we get more efficiency these days).
While true I don't think that airlines and regulators will go for it, if there's even the slightest risk of an additional accident. No matter what.
And Boeing's "communcation strategy" after the incidents doesn't really help to instill confidence in the plane.
There's also the possible hardware fix to add an additional AoA sensor and change the software to limit the total deflection allowed + add a way to disable the MCAS only while keeping the electronic trim. The plane itself isn't irredeemable by a long shot though.
The engines are mounted incorrectly, so much so that Boeing believed pilots need the assistance of MCAS on take-off now.
The bug isn't with its algorithms, rather the need for MCAS to begin with. They can't "address" it. That's why I'll be very careful not to ever book a flight on a 737 Max, probably easier to simply stick to Airbus-only airlines: Jetblue, Alaska/Virgin, etc.
This overstates the issue. The engine mounting changes the flight characteristics enough that the MAX 8 needs to be flown differently in certain corners of the flight envelope. The MCAS was added to avoid having to re-train pilots or trigger a new type certification.
The engine mounting certainly does not make the plane unsafe.
I don't think this is a very...'precise' statement. what is "safe" in the context of aviation? If you had no MCAS, then this plane has a very bad propensity to stall. I hope we can both agree that's an unsafe airplane. You can't just say "don't do that [pull up too much] and then you're fine". The aircraft "wants" to pitch up too high and stall, which predicated the MCAS system itself. So to me, yeah the engine mounting (in and of itself) makes this plane quite unsafe.
Now, with a properly functioning MCAS it may be "safe", but when the MCAS is itself another point of failure, my opinion is that the aircraft is only safe on paper, while in practice it's just got too many hacks and kludges for it to be practically safe for the millions of safe flight hours that these things are expect to deliver.
Airbus aircraft are “safe” despite the fact that dual conflicting pilot input is averaged without stick feedback (see the Airfrance flight from Brazil). If electronics being used to fly the aircraft upsets you, you’re going to be in for a real shocker on any airbus.
The parent comment and entire thread is 100% correct. There is nothing inherently unstable or unsafe about the MAX 8. It has a pitch-up characteristic that's mild compared to some other commercial jets like the 757.
The only reason MCAS was put on that plane was to allow the MAX 8 to share a type rating with the rest of the 737 family, to make it so that it handles like any other 737 despite the pitch-up characteristic.
Go ask any commercial pilot, go watch any of the commercial pilots on youtube who have commented on this, go look on stackexchange. The notion that the MAX 8 is inherently unstable, or unsound, or dangerous, is a laughable myth to anyone in the industry. I get that the news cycle is financially rewarded for fearmongering, but I really expected people who frequent HN to know better and do some cursory research into the topic rather than posting comments that perpetuate bullshit.
There are several major issues with what boeing has done, such as the alleged failure to reclassify MCAS as a critical system after flight testing. But instead of discussing these legitimate issues, public debate seems to have been directed towards a bullshit myth about the airframe being inherently unstable. This has been eye-opening and dispelled my notion that HN had above-average quality of discussion on technical topics.
Okay, how's: you can use thrust to pitch up a 737 beyond the authority of the elevator.
Airbus aircraft are “safe” despite the fact that dual conflicting pilot input is averaged without stick feedback (see the Airfrance flight from Brazil).
There is an aural warning (DUAL INPUT) on Airbuses with conflicting input.
The precise wording would be that it is dynamically unstable, and the ball is with Boeing now to prove it's not the case. Also after all we discovered on the last weeks, Boeing better make a good case, or they won't convince anyone.
The US aviation industry is about to change. I don't know into what, but it's not in a stable situation.
Airliners are very safe. They're not in dynamic stability like jet fighters and don't need active measures at all times to stay airborne. Having sensors and systems that coordinate to keep the aircraft flying optimally to remove pilot load and increase safety margins is a good thing and has been in use for decades.
The problem here was a badly implemented system without redundancies and without enough training so that pilots were actually aware of the flight profile and MCAS. Also aircraft do not have millions of flight hours, they wouldn't reach a million even if they flew 24 hours a day for 100 years.
- it is difficult for pilots to understand how MCAS works, and how to diagnose failures. They are not programmers or engineers. And MCAS doesn't provide any debugging information about its work anyway. And pilots don't have time to analyze it.
- it adds new points of failure
- sometimes there are situations when automatic systems shut down and pilots have to control everything manually. With MCAS, they would have more things to look after. Pilots who got used to flying with autopilot are usually not comfortable with manual flight, and systems like MCAS only make things more complicated for them. An example is a recent crash of SSJ100 in Moscow where experienced pilots failed to land a plane manually after autopilot has turned off.
So I think that plane designers should be very careful with adding more automatic controls. Especially if their purpose is only to save money at cost of making place less safer.
At high angle of attack, the MAX-8 is more unstable than pilots were trained to expect. And the MCAS has done an absolutely miserable job of fixing this. Worst case scenario bad: it caused the loss of two airplanes that, if the MCAS had never been added to the MAX-8, would have reached their destinations just fine.
Until the it flies predictably in every flight profile (including high AOA), it's demonstrably wrong to say "the aircraft flies fine." Maybe it will eventually "fly fine" but Boeing's got quite a bit of work to do first.
Most commercial planrs fly 3000 hours a year. There are about 400 787-Max planes built - that's a million flight hours per year already (if they weren't grounded...)
The engine position exacerbates a problem already plaguing the 737 since the Classic. I think you're understating the problem quite a bit here.
Unless there is something about the magnitude of MCAS necessity that Boeing did not tell us yet.
Boeing's original stance of "stupid pilots should have followed runaway trim procedures" does not seem very consistent with actively removing a two-stage disable feature that already existed (and which, in hindsight, might have saved those lives). How desperate exactly were they to never ever let the pilots catch a glimpse off the real flight characteristics?
Anecdotal: I know of at least one family that booked a trip on a non-Boeing airline, at additional cost, to avoid risking being on a Max.
Imagine that after the Max is back in service, that there is a serious incident in the first few months - it doesn't have to be fatal, just a close call of some kind - how many more customers will avoid the Max at all costs?
By the time you've arrived at the airport and see the MAX at your gate, it's too late and you've already paid your fare.
1. to make certain I don't board one of these machines by mistake. I will not risk my life over this egregious comedy.
2. to vote with my dollars and punish Boeing and businesses that do business with Boeing, especially if they refuse to remove these planes from their fleet.
What Boeing committed here is leagues beyond the recent emissions scandals. It's criminal and the perpetrators should be afraid of the coming justice. This should honestly be as close to a company-ending event as one could imagine. We shouldn't treat this lightly, slap on the wrist, business as usual. This must never happen again.
i booked a boeing 787 dreamliner but ended up in a crummy 777 from a decade ago.
In a world that had actually severe consequences for corporate negligence, regulators would force Boeing to let airlines cancel/change all orders, and compensate them for the 737 Max models they already shipped to them, as they cannot be flown safely. Boeing's behavior does not indicate that they are interested in properly fixing this problem as opposed to getting it certified via corporatism / the FAA allowing them to perform a big part of their own checks.
No choice? It's a choice between risking passengers' lives and money. Be real about what the choice is.
Even that would've been acceptable and similar systems are already in use in other planes but it was the inadequate info, redundancy, warnings and controls to disable the system that created the problem.
It's easily fixable but still a tragedy of greed and oversight that led to the situation in the first place.
From what I have read, the new aircraft design had a habit of raising it's nose when engine power was applied, which put the plane into a situation where it might stall.
The MCAS was added to automatically detect this behaviour and stop the nose lifting.
So basically, without the MCAS, under certain scenarios the plane had a tendency to want to stall.
That does suggest the aerodynamic design of the plane is less than ideal and this could even be considered a design fault.
There are serious flaws with a safety system (MCAS) which was added to prevent the need for more training and a new type rating for pilots who are already rated to fly the 737. This needs to be fixed.
The problem is the fact the MCAS is required to fix the pitching problem.
Boeing tried to fix the design issue with a workaround solution only to then find they had created another, even bigger problem.
You can claim this because now all the FAA approvals for this planes, all tests need to be redone by somebody that we can trust. Sure they but larger engines, did they improved the supports, the bolts ,FAA "checked" this updates but can you trust them? the idea that MCAS is the only subsystem that must be fixed and checked is flawed, everything needs to be tested.
Sure the FAA definitely needs to be questioned as to how they let this through without enough redundancy and pilot awareness but the engines are not the problem and certainly not the supports and bolts. Those are things that are well-tested before it even gets to the FAA and having extreme paranoia about the industry doesn't help.
I imagine that putting a larger engine is not as easy, isn't a larger engine heavier? the forces larger? Don't you need to test the engine supports, the wings, all the related mechanical support structure.
Your theory that only MCAS is an issue is already false since it was found that without autopilot 2 humans don't have the physical force to control the plane , so probably a new requirement in the FAA should be added that with autopilot off 1 single pilot should be able to control the plane. You may say this is related to MCAS but6 it is obvious that this item was not in any checklist for things to test so even with a working MCAS but other emergency where autopilot would be turned off you would get in the same situation.
So there's not just the design workaround but there seems to also be process gaps that contributed to the situation.
My simple solution? Disable MCAS, keep the stick trim switches as on previous 737s, and require MAXs to only fly with a forward CG. 2000 kg of forward ballast might work. Even better, reduce aft weight by increasing economy seat pitch (20 rows rather than 30 or so), thereby reducing aft CG :-)
That said, I think seating pitch and spacing is definitely a conversation that needs to be had. I'm an average-sized guy, and I have a hard time with today's airline seats. I would hate to see what it's like for someone taller. There definitely needs to be more stringent regulation of airline seating to mitigate ever-vanishing personal space.
There's a difference between software stability controls and specifically emulating behavior.
MCAS is a longitudinal stability enhancement. It is not for stall prevention (although indirectly it helps) or to make the MAX handle like the NG (although it does); it was introduced to counteract the non-linear lift generated by the LEAP-1B engine nacelles at high AoA and give a steady increase in stick force as the stall is approached as required by regulation. ... This new location [of the engines] and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA. As the nacelle is ahead of the [centre of gravity], this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up.
Airbuses operate in C* law (they are not positively stable) [2] and the stick is just that, a spring-loaded.... stick; it meets regulations by default.
However MCAS also makes the MAX behave like the older design which specifically led to the gap in training and controls over the system. If they just had stability control but without the emulation of behavior then there would be new training and certification, which is something they wanted to avoid but would've prevented these accidents.
Emulation is incidental. Redesigning the 737 with FBW is not something that Boeing would've considered, even for a moment.
At least that was my understanding.
I don't think there is anything fundamentally wrong with that. But when you have active systems for that rather than passive ones you're in a different design domain. Boeing was trying to pretend they weren't.
As far as I can tell there are definitely some flaws, which seemed to have crept in as a result of the attempt to make them behave like older designs, but it seems optimistic to assume you can simply remove the flaws by sacrificing on that point.
Training and technical improvements can resolve these problems and it's ready to fly. If that's still deemed too risky then Boeing can remove the behavior modifications with training and certification as a completely new design. It was this cost that they were trying to avoid through emulation but clearly not done in a safe enough manner.
This doesn't mean the aircraft is fundamentally unsound, it's just a flying characteristic and can be managed just fine if the pilots knew about it and what the MCAS system was doing to counter it.
And here's a good overview: https://leehamnews.com/2018/11/14/boeings-automatic-trim-for...
The 787s or A320neos could start dropping out of the sky at any minute. Maybe their carbon fiber panels start disintegrating midair after some number of pressurization cycles. The 787s almost did drop out of the sky due to battery problems. Because of the complexity involved, the only hard proof of an aircraft's safety is many years of successful flying.
Other planes have had fatal flaws that took a lot more work to discover. The silver lining of the 737 MAX's MCAS problem seems to be that it is at least quite straightforward to fix, as far as aircraft bugs go.
IMHO Boeing should payout millions for each death they caused, fix the mistakes that caused them, reorient their culture towards safety first, and return the 737 MAX to service. If they work very hard and learn from this mistake there's no reason to think they can't regain the public's trust within a few years.
A brand new design actually supporting the engines used would not have aerodynamic issues that place the airframe outside the limits set forth by regulations.
The 737 is riddled through with legacy design features and needs to be put to pasture once and for all. And designing a replacement wouldn't be from scratch; there are plenty of other modern airliners to base a new one off of.
Complete bullshit. I’ve boarded/deplaned without a jetway in Beijing, SLC, JAC, and AMS in the last couple of years alone.
An embedded staircase is an option on the 737
Yes, it's true that it would be have been free from this specific MCAS issue. But what other issues would a new design have had? It's impossible to know.
It's also true that if Boeing had done a better job of implementing the MCAS design it would have been viewed as a triumph of software solving hardware problems.
Air France 447 crashed in large part because the pilot flying was incapable of handling the aircraft at cruise speeds without software assisting him. He thought the plane would stop him from doing something stupid but it didn't because the software failed in a somewhat similar way to the MCAS failures (sensor failure).
Airbus hasn't done anything to make their planes easier to fly at cruises speeds without software because software assisting pilots with complex flight characteristics is a fundamentally sound idea. The important thing is that the software actually works. Clearly the first version MCAS did not work reliably but there is no reason to believe that it couldn't work reliably.
And yet hundreds of people died in Air France 447 because the pilot stalled the aircraft when sensor failure disabled the Airbus software without the pilot realizing it.
In the case of MCAS, people died because the Boeing software didn't disable itself due to sensor failure.
Definitely not the same issue but both examples of software-sensor-related fatal crashes.
Automation creates complacency, which can be lethal when things go wrong.
The fresh design could tackle problems such as noise in a new way in order to get new customers.
The problem will be addressed, and life will continue. It is tragic, and there will be major repercussions within the manufacturer and regulator but the design will be fine.
The primary reason for the downgrade being:
Barclays’ survey of airline passengers says many people will avoid the 737 Max “for an extended period” once the aircraft is flying again.
I very likely would not. Would you? Would others?
It’s one thing to answer a question of a pollster, it’s another to take concrete action.
Why? Because I'd be so unbelievably pissed at myself if the plane nosed itself into the ground, at least for the time it took to impact.
I also vote with my money.
Simple answer? I won't be flying airlines that use the 737 Max. Stick to the NG or pick up some 320's. Between work and personal travel for our family, that's over $50k of gross revenue per year (we both travel a lot for work). Maybe nobody else cares? I'm betting there are more people like me and my wife.
Granted I might not be a typical discount shopper, I pick flights based on comfort, not price and have checked the aircraft/airframe I will be in for years.
However, I have a tough time seeing anyone I know taking a risk with flying the 737 max for a 10% discount in fares.
Typically, fuel costs to the airline can be estimated at 10-20% of the ticket price on domestic flights (5 gallons per seat per hour). 737 Max is advertised as providing up to 20% in fuel cost saving, which would bring the cost to 4 gallons per seat per hour. Which should not affect a ticket price by more than $4-6 per hour of flight.
Are you suggesting that people aware of the issue will be wiling to risk their lives for a chance to save $8-20 to their destination?
And to add to that very few 737 Max are in service right now, only 300 or so of 5000 orders have been fulfilled. These supposed savings are not yet factored into the price of most tickets, they are future reductions at best. And likely these will not even be reductions, just a way for carriers to earn more per seat.
In the case that I for some reason couldnt determine it ahead of time I would complain emphatically enough.
Such a move would be ill-advised.
Your point still stands, of course.
Airlines need their airplanes, and if boeing would recompense them for the lost planes they’d be instantly out of business.
Conversely, the carriers cannot just write off a significant part of their fleet and buy new ones, which wouldn’t show up for years anyway.
More than that - they're continuing to manufacture them. There's quite a few of them stacked up at KPAE, just sitting there waiting for their software updates, all painted in customer livery. (They're not even manufactured at PAE; they're ferried there for storage.)
They did not think - it'd ever happen. The shortcuts were taken for bringing 737 max quick to market.
I don't think so. Traditionally manufacturers and airlines never argue about a security incident of the competition. I only know of one issue were this unwritten rule was not respected.[1]
(Not to mention that these planes have never crashed in most countries, even with an admittedly serious bug.)
In... Most countries? That's such a weird standard to hold an aircraft to. Even very serious aircraft issues before typically only resulted in crashes in a handful of countries!
Did I read that wrong or do you want 100+ of the 200ish countries in the world to have experienced a 737 MAX crash before scrapping the MAX?
Actually, I think if the planes can be fixed (and I'd be shocked if they couldn't), the two crashes before the fix will no longer be relevant for assessing safety.
You are calling me out over nothing. This is uncharitable, to say the least. Why make trouble?
your parenthetical still shows some finger pointing towards “poor” countries’ pilots and ignores the number of crashes and reports for as young as this plane is and the numbers in use.
You have a strange idea about how to assess risk. It's like faults are somehow contagious.
They are. If 737 MAX was rushed to market and this is the first issue we become aware of, how many more are hidden?
If Boeing makes a habit of rushing planes to market without certification, how many more ticking time-bombs are flying around?
There’s no question that Boeing’s implementation had major issues, but there is IMO a higher burden of argument(?) to declare that a fundamental inevitability.
This could simply be a case of Boeing incompetent/reckless/...
Aviation adapts to problems and it always has. Southwest installed additional gear on their planes to help prevent this when the first plane crashed. It’s not far fetched that companies in countries with lesser regulations might skip out on training or plane enhancements that would lessen the chances of this problem.
Clearly, that didn't happen, or a second MAX wouldn't have crashed under very similar circumstances.
> Southwest installed additional gear on their planes to help prevent this when the first plane crashed.
Southwest ordered the MAX with an AoA indicator; it wasn't retrofitted.
> ... to help prevent this ...
It's questionable whether the AoA indicator would've made a difference. However, an AoA disagree alert that is standard in the previous 737 gen was "accidentally" made part of the AoA indicator extra feature set on the MAX, and the AoA disagree just _might_ have made a difference. [1]
> It’s not far fetched that companies in countries with lesser regulations might skip out on training or plane enhancements that would lessen the chances of this problem.
An AoA indicator is not mandatory anywhere in the world.
[1] https://www.aviationtoday.com/2019/05/06/boeing-angle-of-att...
If you make controls more complicated, pilots will make more mistakes in critical situation.
Welcome to the internet where other people's money doesn't matter.
In term of public perception, it is a PR disaster but not unprecedented. The DC-10 went through a similar rocky start where passengers just wouldn't want to board it. But after the flaws were fixed it turned out to be quite reliable.
As evidenced by the ever-crashing 787s and A350s.
(Engines on newer models can be - and usually are - iterations of older designs. The A380's RR engines are built on the same platform as the Tristar's, introduced in 1972!)
Bad design decisions forced from chasing the bottom dollar, optional, critical safety features with the warning indicator and now these switches.
> Boeing declined to detail the specific functionality of the two switches
That's also interesting- I assume they are in CYA mode and wouldn't discuss anything that could be sensitive to the current investigations in any point. I wonder how hard the Seattle Times had to work to get manuals for the MAX.
I hope the loss of life is vindicated in the end.
I hope there are lessons learned from this but I fear our culture of quarterly profits and lack of real punishment for companies and their directors will result in nothing drastic happening.
https://www.nrc.gov/reactors/new-reactors/col/new-reactor-ma...
Hopefully, their planes don't need MCAS ;)
Bit separately, I know people in DC who work in this field and they say the same thing.
I dunno, I see it as the opposite: regulation (apparently) made it impossible to just train pilots on this one new feature, instead requiring a full recertification of both the airframe and the pilots, which is incredibly expensive and unnecessary relative to what was actually required to save lives.
So one way of looking at is is: regulation caused perverse incentives that ultimately got people killed.
You’re basically saying that because shitty people don’t want to follow safety regulations we shouldn’t have them.
Having safety in mind doesn't make something unambiguously good, fit for purpose, or free of net-negative consequences. The specific content of rule determines that.
Even if your assessment is valid, you’d likely be throwing away the baby with the bath water if you’d cut regulation to avoid it.
Is that less regulation? More regulation? I don't know, and I doubt it matters if it's "less" or "more" since the goal is fewer dead people, not passing an ideological Turing test.
You are suggesting stronger regulation of some aircraft ('upgrades', as you rightly say), without weakening regulation for any other aircraft. So it's certainly 'more regulation'.
> I doubt it matters if it's "less" or "more" since the goal is fewer dead people, not passing an ideological Turing test.
It's a political question, so there's at least some question of ideology. Full-bore libertarians would doubtless find some way to oppose your suggestion.
You said regulation caused perverse incentives that ultimately got people killed. It would be more fair to say that a loophole in the regulations, caused the perverse incentive.
Remind me, when's the last time we had a major fatality incident in the US domestic passenger airline business?
And how does that compare with the prevailing state of affairs before "deregulation?"
Difficulty: answer with numbers, please, rather than insults, downvotes, or political attacks.
Weather forecasting has gotten much better in the years since deregulation. We’ve also been operating a mostly-jet fleet, which has larger inherent performance margins than the turboprops (and, worse, pistons) before them. And we have decades of experience about how pilots kill airplanes to inform operations and regulations.
It’s not clear that airfare deregulation either hurt nor helped airline safety in the US. US-flag air carrier ops are extraordinarily safe and I believe the FAA makes a positive contribution to that outcome.
Doesn't really matter much. Incidents in aviation that can happen on continent X could usually have happened on any continent.
The regulations we have in place here in the US -- to say nothing of our airlines' own policies -- would have kept that aircraft grounded until the problem was diagnosed and addressed.
It seems like that's really the crux of the problem. They made changes that they didn't feel it was necessary to tell their customers about. Just another step along the "I know you bought this product from us, but it's still our product at the end of the day" timeline that we're stuck on.
Further, I'll bet that it transpires that no one entity inside Boeing is really to blame for this mess. The engineers in charge of the AOA indicator subsystem didn't know that someone else in the company was going to drive a safety-critical component from it. And that engineering group may not have realized that the AOA data they were getting came from only one of the two sensors. My guess is that Boeing not only hid this information from their customers, they hid it from themselves.
The problem will have to be addressed at the top, but I don't agree with those who say that blaming, firing, or jailing the CEO is going to be helpful. The culture that allowed this to happen will have grown organically over time.
There is a reason why the aviation industry focuses on fixing the problem rather than the blame. A witch hunt makes everybody feel better in the short term but provides no guarantee of actual forward progress.
1. The A320neo caught Boeing completely off-guard;
2. The threat of the likes of American Airlines (already a mixed Airbus/Boeing customer and the largest airline in the world) placing a large A320neo order for regional aircraft operations scared the bejesus out of Boeing management;
3. For airlines like Southwest that are pure 737, the prospect of adding a plane that didn't share a common type rating with their existing fleet would complicate their lives and make them vulnerable to a sales pitch from Airbus; and
4. The development cycle for a completely new body was too long for many customers as it would arrive several years after the A320neo.
I don't think any of this is in dispute so the constraints for Boeing were to design a more fuel-efficient plane that shared a common type rating with the 737. To get there:
- They added newer, more fuel efficient engines. These changed the flight characteristics so they had to be moved;
- These engines moving made the plane more vulnerable to a stall situation. To counter this, they added MCAS, which would point the nose down when the AoA sensor told it the nose was too high;
- Standard configuration had 2 AoA sensors but MCAS only ever read from one;
- There was a safer configuration as an optional extra purchase;
- Telling airlines and pilots about this and providing overrides risked the common type rating.
I don't believe any of this is in dispute. It is widely believed, but not yet proven, that the primary cause of both fatal crashes was a runaway MCAS that drove the planes into the ground. It's also believed that with proper training a pilot may have been able to counter this (as happened the day before the Lion Air crash with a pilot in the jump seat).
Now what I find interesting is the response people have to all this. Some claim this is a fundamental design flaw that puts a shadow over the plane. Others believe it will be corrected and everything will be fine.
I'm firmly in the first camp: the plane CLEARLY flies differently to a 737. An automatic system, with no triple redundancy, was required to correct the flight characteristics of the plane.
I'm no expert but it seems to me the plane is fundamentally flawed at this point.
> the plane CLEARLY flies differently to a 737[...]
That's going from a length:span ratio of 0.86:1 to 1.17:1, you think those sort of airframe changes don't make for a plane that flies differently?
Maybe the whole notion of a "common type rating" is foolish, and pilots should need to re-train from scratch for the smallest of changes. Change the paint job? New type!
There's a lot of "the engines moved!" discussion around the 737 MAX which seems to be ignorant of decades of significant airframe changes not impacting type, to little apparent ill effect until now.
1. https://en.wikipedia.org/wiki/Boeing_737_Next_Generation#Spe...
2. https://en.wikipedia.org/wiki/Boeing_737_MAX#Specifications
Consider cars: You can get most full-size sedans with either four or six cyliner engines, manual or automatic transmission, and regular or sporty suspensions. That's potentially eight different sets of handling characteristics. But they're all going to be in a fairly narrow cluster of "this still drives pretty much like a Camry." When you decide "instead of the six-cyliner engine, let's drop in a 700 horsepower turbocharged V8", it's no longer anywhere near that cluster.
The 737-100 had 62 kN of thrust, the 737 600-900 up to 120 kN[1], that whole line (and beyond) shares the same type rating.
I don't think this is correct. A lot is being made about the engine move with regard to aerodynamic behavior, but it doesn't seem at all outside of the bounds of what is considered standard. Pilots report that a similar 'light stick feel' at high AoA is already present in aircraft like the 757.
It's not that the aerodynamic change was worse or better, it's simply that it was a change at all. MCAS was there to satisfy the type rating. MCAS is not anti-stall.
The crucial mistake appears to be the extreme failure mode of the system; it is permitted to input high stabilizer trim angles without limit. Without any kind of restriction, the failure goes from annoying (pull up on flight stick + fiddle with stab control until you solve it) to the deadly crashes we've seen where pilots are in extremely tricky situations.
The fix could be as simple as making MCAS cutout in the case of an AoA disagree (no real hardware changes here) as well as limiting the input of extreme trim angles.
It seems you are correct [1]:
> MCAS is a longitudinal stability enhancement. It is not for stall prevention (although indirectly it helps) or to make the MAX handle like the NG (although it does); it was introduced to counteract the non-linear lift generated by the LEAP-1B engine nacelles at high AoA and give a steady increase in stick force as the stall is approached as required by regulation.
MCAS's only observable intervention is to push the nose down to prevent stall, which means it is by definition anti-stall.
Boeing says MCAS is an acronym for "Maneuvering Characteristics Augmentation System", but a better name for MCAS is "Machine Controlled Anti Stall".
https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...
According to this article[1], the intended purpose was to restore the back-force needed to put the airplane in a stall, as the effect of the new engines was to make the control feel lighter at high AofA. The article also discusses the certification requirements with regard to acceptable handling characteristics.
FWIW, Boeing CEO Dennis Muilenburg is quoted in [2] as saying that "When you take a look at the original design of the MCAS system. I think in some cases, in the media, it has been reported or described as an anti-stall system, which it is not. It's a system that's designed to provide handling qualities for the pilot that meet pilot preferences.
"We want the airplane to behave in the air similar to the previous generation of 737s. That's the preferred pilot feel for the airplane, and MCAS is designed to provide those kinds of handling qualities at a high angle of attack."
Of course, the elephant in the room not being mentioned here is whether Boeing's primary motive for replicating the handling characteristics of earlier versions of 737s was an overriding concern with avoiding pilot training.
[1] https://leehamnews.com/2019/02/15/bjorns-corner-pitch-stabil...
[2] https://www.businessinsider.com/boeings-ceo-on-why-737-max-p...
Boeing 737 MAX without MCAS violates that requirement (caused by the lift generated by large engine nacelles in front of the wings). MCAS is indeed designed to restore that required back-force. Back-force that is required to prevent stalls.
I suppose one could debate whether the stall prevention effect of MCAS is direct or indirect. But I don't think it's debatable that it is designed to comply with a certification requirement that's intended to help prevent stalls.
Boeing may be denying that MCAS has a stall prevention purpose only because to say so might put it in the critical systems category, requiring additional training. If so, this would apply as much to the fix as it does to the original version. To acknowledge that it has a stall prevention function might require an additional AofA sensor as well as additional training.
Having the control get 'lighter' (more sensitive to increased back-force) as one approaches the stall is definitely an undesirable characteristic, as it increases the risk of a distracted pilot stalling. While a change in the opposite direction might have been problematic (insofar as additional training is a problem), the way it actually goes is more likely to prompt the FAA to require something be done about it.
Forgive me if I'm missing something but these extra options are AoA cockpit indication and AoA discrepancy alert when two sensors disagree.
They don't alter software, MCAS would continue relying on just one sensor regardless of this indication. It's just an extra bit of information for pilot's decision making.
Sounds to me like another hack over the hack hardly adding much extra safety.
Note that the 737 already has two such sensors, but only consults one at a time for MCAS, so there'd be a software change required in addition to adding a new sensor.
But yes it's certainly not impossible sounding. It's like a minor recall where the planes get fixed on site.
If the needed telemetry is already exposed to MCAS, it could all be fixed in software.
Maybe it would be better just to use old time-tested design instead of saving small money at the cost of safety.
Now we can assume that the Max won't re-enter service until this issue is completely solved (I'm sure regulators will be extra-scrupulous here and customers will want cast iron re-assurance).
However, is anyone going over all the other safety decisions and changes made to other Boeing models over the period of the Max development?
It seems unlikely that this was an isolated incident of rushing things for commercial benefit...
Hopefully it will result in Bowing being required to make this a new plane and a lot of pilot re-certification. If it does return to the market, I wonder if they'll be forced to rebrand it. It's obviously not a 737.
So, in all probability, we don’t even know the list of fatal flaws even yet!
The flaw is using software to fix a hardware issue.
When the 737 was built back in the 60s it was intended to be a small regional jet, not the continent and ocean crossing aircraft it evolved into over the years since. It originally came with a retractable staircase for passengers to embark/alight the aircraft, and having a low fuselage also made it possible to hand load the luggage in a time before widespread belt loaders.
It's not so much that the pilot pool is lacking, it's that a lot of airlines have a pool of existing 737 pilots already on their payroll. If you need to lay off half your employees, and replace them with an entire new pool of people, half of them are going to be terrible employees, and it will take you years to weed out the bad ones. For better or worse, pilot unions tend to be very strong. Firing them is difficult.
The 737 MAX wasn't beset by technical problems, they were social and political ones.
The airlines would've just had to retrain their existing pilots to fly the new type. It's not nothing, but it's a lot less worse than massive lay-offs and rehiring.
If getting a new type rating was cheap, this whole 737 max debacle never would have happened. Boeing would have just told everyone the 737 line was done, and to retrain into 767s or 787s, and for anyone who wanted to stick with the 737 to pound sand.
If it was cheap and/or easy for Boeing to tell airlines and/or pilots to get a new type rating, they gladly would have sold them 767s which do everything the 737 MAX does. (it does) They've probably already told them that and they've said no. And Boeing made the 737 MAX with the same type rating as the regular 737. Which is why we're here.
The 797/NMA program Boeing is proposing is a replacement for the aging 757 and 767 fleets.
Also, global pilot pool doesn’t matter as much as what individual aurlines’ pilots are certified on. The specific airlines that operate 737s would prefer not to have to retrain their pilots on a new aircraft; if they had to retrain them for the 757max that would open the door to consider the airbus as an equally good option.
and it wasn’t seemingly insignificant. it was for fuel efficiency. it was significant and they knew what they were doing.
And it was unstable because larger CFM engines could not fit under the wing anymore so they had to put it further forward and a bit up. This increased the pitch up moment when a full power is applied.
Also, can't really see how the height of the fuselage above the ground affects fuel efficiency.
It doesn't. They wanted to use a larger, more fuel-efficient engine but the 737's ground clearance couldn't accomodate it. So they moved the engine forward.
Forgive me if I'm missing something, but isn't MCAS disabled while the flaps are extended, which is the case during takeoff and landing?
In the doomed ET302 flight they retracted flaps 62 seconds after liftoff at only about 1200ft above the ground. MCAS kicked in 5 seconds later. Had autopilot been engaged it'd also had saved them from MCAS trim down commands.
The ultimate economic reasoning for the 737 MAX was entirely to reduce operational cost: “give us a plane with better fuel efficiency that we don’t have to pay to train pilots for!”. This is actually a deeply broken incentive that, I think this case shows, should not exist. The plane delivered is objectively far worse than it _could be_ were it not for the need to reduce operational cost.
Ultimately — some large portion of that operational cost is induced as a result of the need to comply with safety regulations. That creates downward pressure on unecessary experimentation but also has created this very perverse incentive to design planes that are _deliberately_ not as safe as they could be given application of some approximation to “our best engineering knowledge”.
Pretty early on in the design process for the 737 MAX — there shouldve been a meeting with regulators. The regulators should’ve been presented with this option and the design and economic reasoning for it — and they should’ve also been presented with another option wherein there was a relaxing of the need to defuse operational costs. The regulators should be empowered to then say “don’t build this broken plane, build the safer plane and we will introduce tax credits sufficient to help offset the airlines retraining costs.”
A cynical man could be inclined to think that with this change, they casually removed a possibility of pilots/airlines realizing the existence of MCAS: "we have thrown off the right switch to unlink the autopilot from the trim motor and there is still something making automated stabilizer inputs, what could it be?"
I’m as negative as the next person when it comes to the 737 Max, but this is just a bit to far. Read the rest of the article and you’ll understand a logical reason why this was done and how it was communicated.
My personal guess is that it was internally totally disparate teams inside Boeing and neither communicated about the change. Is that bad? Certainly. But how often does that happen in big companies? All the time. Sadly it might have had a part in causing fatalities in this case, but doesn’t make it any less common.
Either way, it’s not like the change definitively had any bearing. Turning off all electronic control was still the training given to pilots and then reverting to manually turning a wheel that controlled the horizontal stabilizer via cable. It’s not an easy thing to do (turn the wheel manually), especially during a nose dive, but it’s been done before in an emergency and pilots are trained on it.
Ultimately, the FAA had a prestigious record due in part to having excellent checks and balances. Whoever decided to move away from DERs to ARs ultimately should get the brunt of this blame, but sadly, that’ll never happen.
Before 2004, those Boeing technical employees who worked safety on behalf of the FAA were called “Designated Engineering Representatives,” or DERs. Though paid by Boeing, they were appointed by the FAA and reported directly to their technical counterparts at the FAA.
What changed since 2004 is that safety engineers, now called Authorized Representatives, are appointed by and report to Boeing managers.
The opaque bureaucratic name for this new structure — Organization Designation Authorization (ODA) — masks the significant change: Instead of having individual Boeing employees authorized as FAA reps, Boeing now has an entire organization within the company so authorized. The individual FAA Authorized Reps — Boeing engineers — report up the chain to their Boeing managers, not the FAA.
source: https://www.seattletimes.com/business/boeing-aerospace/engin... Interesting read.
And the root cause reason for that is Boeing was hiding changes in order to make the same type certification. Many decisions were made not in the interest of maximizing safety but in minimizing visible changes. This is one of those.
It would have been safer overall to have a new type, and then they could've had a cut-out switch just for the MCAS and trained pilots on how to use it.
It's worse actually. They've taken a procedure, and are raising it on a pedestal as if to say "See, this is how a 737 flies! It's all right there! You can stop looking now!"
It's as if they don't want anyone to realize that this plane simply does not fly like a 737. Which is what has been getting shouted from the rooftops since the first disaster.
What I find wickedly ironic was it was exactly Boeing's insistence to "not inundate" flight pilot's with technical information, and give an accurate accounting of the vast differences in the minute details of the aircraft that created the problem.
Someone looked at the checklist item of "both stab trim switches to cutout", didn't look into what that actually meant, and changed the plane to fit the procedure. This change cost extra effort. Instead of using the same switches and wiring they were using before, they actually degraded the granularity of control of the plane to hide the differences.
I can't imagine the thought process at the time. Be nice to see what the documentation turns up.
[1] https://www.vox.com/2019/4/5/18296646/boeing-737-max-mcas-so...
I don’t blame AA for taking a good offer. They did not force Boeing to do this.
Instead, Boeing saw dollar signs, and threw caution and people's lives, and years of good will to the winds.
And I know people will try yo claim that it was the engineers fault and they should have just refused and gotten fired. But engineers have mortgages and have to work for a living. They can't afford to career suicide just because their boss is being unreasonable.
The people who made the decisions should be held accountable. That means the CEO should actually go to prison.
Airbus sold 98 A320Neo to American Airlines, totalling 413 Airbus (the biggest fleet in the world).
It loads much better in Lynx with a tiny fraction of the resources.
So, MCAS trims the plan to a dangerous attitude, then when pilots follow Boeing's SOP to disable, they lose the ability to re-trim the way they have done it a million times before? I can see valuable second being eaten up when pilots flick the thumb switch towards them and sit there wondering why the back pressure isn't easing up.
And the report also says that the manual trim adjustment wheel would be harder to move due to the load on the tail when the aircraft is in a nose (death) dive? This is already on top of the fact that the pilots have to hold around 60Kg back pressure on the control wheel while leaning forward to crank the manual trim wheel?
Recipe for absolute disaster.
https://news.ycombinator.com/item?id=19627660#19627755 That video was removed :(
...and without that commonality, the FAA might have required additional training?
Regulations needs to ensure every little detail about these planes are articulated to the end-user.
We continue to put the microscope on Boeing but this is why there is a person in the cockpit: to oversee the planes automated systems. There were multiple failures, and while we pick apart Boeing, we have not done the same to the pilots.
At the time of the crash, it appears that the established procedures were insufficient. In particular, the MCAS failure creates a qualitatively different 'runaway stabilizer' than the previously-imagined failure mode of a stuck-on motor.
In turn, that seems to have created a situation where the pilots did accurately follow the runaway stabilizer checklist, but the trim was so far off neutral that they could not manually control it.
That's why the article here notes that the older-spec second switch, which deactivated just autopilot inputs into the electric trim system, could have helped. However, that is still far from a final answer, since the troubleshooting checklist would still need modification to try deactivating just auto-trim rather than both switches.
Pilots encountering the issue during takeoff have neither of those things, with results that we've already observed.
There was an article recently where they put very experienced pilots in a simulator under the same conditions and they all failed.
Apparently you haven’t read it either, otherwise you wouldn’t have said what you did. I’m not defending Boeing in the slightest, they should be tarred and feathered over this, but it’s getting really old seeing folks on HN acting like experts and not even knowing the basic facts, especially when the article they are commenting on refutes their own statements.
Its more important to focus on the processes rather than the individual people, especially because even great people can have off days.
Edit: This seems to be unpopular. I am curious how you guys would do it differently? Just document the controls and provide no procedural recommendations? Interesting.
The failures in the Boeing 737 introduced a significant probability of unrecoverable failure. The fact that a few pilots managed to recover does not mean that the ones who didn’t recover did something wrong.
On the other hand, the fact that 2 crews with over decades of safely flying planes were unable to recover from the same plane indicates it had a lot to do with the issues in the plane.