But would that pilot have to be in the plane to fly it? We have been using remote controlled killer drones for years now.
This illustrates two things: First the design of the software used in commercial airplanes is bat shit insane and second, the fallbacks require that a trained person is physically present on the plane.
> We have been using remote controlled killer drones for years now.
While Boeing has shown some talent at killing people the goal of commercial airplanes is usually to get their passengers to their destination alive.
At least in that case. But it isn't normal that you blindly trust a sensor, not even Level D (failure is unimportant and easy to deal with) Software would/should do that. It actually takes a significant effort to put Software into a plane, which only increases with safety requirements.
The chain of failure which needed to happen in this case is enormous. Dozens of people need to have looked at the documentation and nobody cared/figured out this blatant security issue. How can a company like Boeing even operate like that?
Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware
A lot of hardware/software is totally automatic and it would be insane if it were constantly checked by humans. Of course none of these systems running totally automatic have the ability to push thevplane into the ground based on faulty sensor data.
My point was that the failure of the MCAS was institutional, you should not be able to bring software like that onto a plane.
On the topic of the number of pilots my thoughts are that the redundancy is for the most part only neccessarry in exceptional situations. But exactly those situations are the ones in which the best thing a plane can usually do is graceful failure and handing control to the crew, which can far more easily overwhelm a single pilot.
The yaw damper does.
There was another crash where the autothrottle was reading data from only one of the radio altimeters, which was giving false data. At 400ft altitude the autothrottle thought the airplane was landing, and pulled the throttles back to idle. The airplane pancaked into the ground.
All avionics software that has control authority can crash the airplane.
What was wrong with MCAS was its reliance on only one sensor, and no way to tell if the sensor was faulty. That's not an issue with the concept of MCAS.
The override was there, it was always there. The thumb switches on the control column overrode it. Turning it off with the STAB TRIM CUTOFF switch turned it off.
This procedure was detailed in an Emergency Airworthiness Directive issued to all 737MAX pilots after the first crash. The pilots in the second crash did not follow that procedure.
The pilots of all three incidents used the thumb switches to override MCAS and restore normal trim. The first crew then turned off the trim and landed safely. The second crew never did turn off the trim and crashed. The third turned off the trim when the airplane was in a dive and could not recover.
> The pilots in the second crash did not follow that procedure.
"At 05:40:35, the First-Officer called out 'stab trim cut-out' two times. Captain agreed and First-Officer confirmed stab trim cut-out."[1]
However they were unable to correct the trim of the aircraft without help of the electrical systems (still being on full takeoff power didn't help).
So around 3 minutes later stab trim cutout was switched back to normal. Pretty much the moment they did that the aircraft pitched down hard, the situation becoming unrecoverable within seconds, followed by the aircraft impacting the ground.
There were possibly ways to save the aircraft (reduce aerodynamic forces that prevented trim by hand by, for instance, reducing thrust), but those weren't detailed in any ADs.
[1]https://leehamnews.com/wp-content/uploads/2019/04/Preliminar...
1. restore trim to normal with the electric thumb switches on the column
2. then turn off the stab trim
The electric trim overrides MCAS.
Boeing Emergency Airworthiness Directive:
"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."
https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control.
And they did try to correct the trim before moving to 2.
5:40:00 AND (here automatic nose down) activates for 9 seconds, computer trimming from 4.60 to 2.1 units, crew trying to counteract by pitching up.
5:40:14 Pilot begins adjusting trim up. Gets to 2.4 units.
5:40:22 AND activates yet again (7s), also pushing trim all the way down to 0.4 units. DON'T SINK warning and PULL UP.
5:40:29 Captain asks the First-Officer to trim up with him. They reach 2.3 units (9s). This interrupts AND.
5:40:38 stab trim cut-out
5:40:43 AND activates again, but at least now it leaves the stabilizer alone.
All in they did fine, considering all this happened in 40 seconds. They regained control of the aircraft and now have time to asses what even happened.
However they still have to apply up to 100lbs of force to keep the nose somewhat pointed up. Only at times when both of them are actually pulling on the stick does the plane gain altitude. On top of that they're getting a MASTER CAUTION "anti-ice left alpha vane", adding to their workload. In the next three minutes they're discussing the warnings they're getting, informing ATC of their problem, and are trying to manually trim the plane (which doesn't work). I'd imagine their arms are getting tired.
So the understandable next step is to switch stab trim cut out back to normal, then trying to correct the trim further.
5:43:11 stab trim back to normal, followed by some short manual electric trim inputs
5:43:21 AND triggers yet again (5s), stab to 1.0 units. Within the first 3.5s the aircraft pitches -8° down, descent rate increases to -5,000 ft/min.
If they had caught and interrupted the AND/flipped stab trim back immediately, maybe this could've been saved. But since the computer got to do its thing for a few seconds, it's pretty much too late to do anything. The pilots are applying up to 180lbs of force, which accomplishes nothing. The plane keeps pitching further down.
5:43:44 Plane impacts the ground at an angle of 40° nose down.
That whole timeline was 3 minutes, 44 seconds.
The only way you can reasonably expect a human to deal with a situation like that, which requires a quick response, is if you train them for it. You don't just give a vague warning, a bunch of steps with three IFs attached, and hope for the best.
More complete, interim, report: https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-...
> That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control.
Having the trim start running again every few seconds is EXACTLY WHY there's a trim cutout switch. A few seconds is enough time to hit the thumb trim switches right on the column under your thumb, and the then hit the cutoff switch which is right there on the center console.
I don't dispute the timeline. But the fact remains, using the electric trim switches to return trim to normal, then turning it off, would have worked.
The stab trim does not move that fast, they had time to turn it off after trimming to normal.
Thanks for the link. At one point, it was clear the EA pilots did use the electric trim switches to override MCAS. They did turn off the trim at one point. What they did not do was follow the instructions in the EAD.
> maybe this could've been saved
The first incident shows the procedure works. Trim to normal, turn it off. That's all there is to it.
The thing about the Emergency Airworthiness Directive is it came out after the first MAX crash, and was about how to not die if it happens to you. If you were a MAX pilot, wouldn't you take extra care to read that EAD, understand it, and remember it? I cannot fathom ignoring it.
I can see why it they wouldn't have recalled it in the first 40s of that situation. However they got the situation stabilized to a point where they could've kept going for a while and maybe came up with a better plan of action before attempting to correct the trim again (which is what ultimately doomed the flight).
> Having the trim start running again every few seconds is EXACTLY WHY there's a trim cutout switch. A few seconds is enough time to hit the thumb trim switches right on the column under your thumb, and the then hit the cutoff switch which is right there on the center console.
Which is kind of leaving the territory of the AD. The way I'm reading it, it advises to leave the switch set to cutout for the remainder of the flight. They'd have had to come up with that approach (or an approach that would have enabled manual trim) on their own once they had the aircraft flying somewhat straight without immediate danger. Their main mistake may have been to not take more time to assess their situation when they had the chance and not fully grasping the danger of leaving that switch on normal for even the 5s it took the plane to become unrecoverable at the end.
But all those factors pale in the face of inadequate training and the fact that there could hardly be a more dangerous problem with an aircraft than it - out of nowhere - entering an uncontrollable nosedive if the pilots don't properly respond within seconds. I'd maybe rate complete loss of control/"wings fell off" higher.
I still have trouble blaming the pilots because - with the benefit of hindsight - I would have expected such crashes to happen as much as they did, maybe more. The aviation industry generally avoids expected mistakes that result in loss of life and someone was bound to make this one.
No, it isn't.
> The way I'm reading it
What it says is to restore trim to normal and then turn it off.
> not fully grasping the danger of leaving that switch on normal
Uncommanded stabilizer trim movement is a severe problem which is why what to do about it is a "memory item", meaning you don't have time to read the checklist. All pilots should know that runaway trim is a critical danger.
> out of nowhere - entering an uncontrollable nosedive if the pilots don't properly respond within seconds
There's enough time to respond. All three crews correctly restored normal trim immediately.
> I still have trouble blaming the pilots because
I give the pilots some of the responsibility, because they had all the information needed to counter the problem. The rest goes to Boeing for a bad MCAS design. It's a pilot's job to read, understand, and remember Emergency Airworthiness Directives. If that's unreasonable for them, they need to turn in their wings and drive an Uber.
I find no fault for the pilots of the Alaska crash where the stabilizer trim jammed. There were no instructions on how to deal with that, and they were in contact with the maintenance chief who had no clue, either. The pilots kept trying to break the jam loose, doing things like engaging both trim motors to apply more torque. The result was the jackscrew nut stripped the threads, and then it slid to hard over, then broke the end of the jackscrew off, and it was game over.
Now me, as an engineer who knows how that system works, I would have advised them to leave it alone, reduce airspeed to reduce the loads on it, and land ASAP. The jackscrew motors are way too powerful to let them grind away at it. Also, when it did move, it let off a very loud screech indicating that something awful was happening.
But they weren't engineers or mechanics. They made a mistake, but it was reasonable considering what they knew. They did the best they could.
However we design systems and procedures such that suboptimal usually doesn't mean fatal, and in those specific instances where it would, we train humans so they perform adequately.
If humans were so great, we wouldn't need a lot of the technology in modern aircraft. It's mostly there because humans suck. Taking work away from the meatbags, putting in safeguards, and designing with the human element in mind, produces more desirable outcomes.
And it's not like this crew had the wrong ideas. They attempted all the right things, but execution was lacking and sadly the situation had no room for error:
1. Did use cut out, but left it on normal for a few crucial seconds without any manual input, allowing the computer to mess everything up again.
2. Did try to fix trim before cut out, but only got it halfway there to the point where they could at least achieve level flight and a slight climb. Tried to trim the rest of the way manually, but that didn't work.
> There's enough time to respond.
Disregarding that the situation could have been avoided, the second time this crew didn't have time to react anymore. It took only 3.5s from the automatic nose down engaging to descending at -5,000 ft/min, pitching -8° down and quickly increasing to -40°, despite the pilots pulling on their sticks full force. They had maybe a second or two to nip it in the bud, then had twenty seconds left to somehow arrest the rapid descent of an aircraft that is trimmed precisely the wrong way with the horizon in a place you don't ever want to see it in a commercial airliner. I don't think it was physically possible?
It's not hard imagining situations where an aircraft doing something like that within 3.5s out of nowhere would be disastrous. There certainly wouldn't be time to respond. This crew was warned by earlier misbehavior, so the situation was theoretically avoidable, but there was little room for error and so we should be glad for all the times something didn't happen.
> All three crews correctly restored normal trim immediately.
Are you counting this crew? I don't think they had normal trim at any point once the incident started. They were trying to get there.
We expect pilots to pay attention to those things. They make mistakes, sure, but they are still responsible for those mistakes. The EA pilots did not follow the procedure laid out as "how to not die like the Lion Air pilots". Seems to me that should be worth reading, understanding, and remembered. Especially as there was nothing complicated about it - trim to normal, turn it off.
Wouldn't you prefer to fly with pilots who did? I do.
A remote operator cannot pick up a fire extinguisher, go into the cabin and look out the window, smell the smoke, feel the weird vibration, relieve the pilot who is pulling on the controls with all his might, fend off intruders with the fire axe, etc.
Remote control is always going to have a lag in it. I doubt one could land an airplane remotely even with just a 1 second lag.
Having your butt in the seat of the airplane is a strong motivator to keep it flying. The pilot always arrives first at the scene of the crash.
On that note, we'd like to ask everyone to please stop using anything wireless, as it runs a small risk of interfering with the delicate connection to satellites overhead, which is currently all that is keeping our remote pilot connected."
[1] https://www.pyrosoft.co.uk/blog/2007/11/04/army-fly-uav-spy-...
Quote from 2014: https://www.washingtonpost.com/sf/investigative/2014/06/20/w...
I think with planes carrying humans we don't want that track record, especially if you calculate crashes per mile flown.
Also, this is an attempt to reduce labor costs. They aren't going to put a pilot on the ground as primary or backup - they just want to remove the second pilot from the loop entirely.
We have a list of airliner crashes[1], that once we figure out absolute numbers of total flights likely shows that airliners are much, much safer than remote controlled drones (after excluding shoot downs for latter), but what we don't have is data on how many aircraft landed safely but only because the second pilot was there. I'd want to know:
1. How many times did a pilot immediately intervene for a developing safety issue while the other pilot was asleep, in the toilet, or suffering from a medical incapacitation? A huge amount of work has been done to ensure redundancy of human control in such situations, because many crashes have occurred where this process failed.
2. How many times did a pilot make a mistake that was corrected by a second pilot, and if that correction hadn't been made a safety issue would have developed? There are numerous crashes attributed to pilot error and the second pilot failing to correct that error - a huge amount of work has been done to make sure that can't happen again, because everyone knows pilots regularly make mistakes, often a critical time of the flight from a safety perspective: landing.
3. How many times has an automated system shown better error correction performance that saved an aircraft vs a human being?
Until we have this data, the data we have suggests remote controlled aircraft or removing a pilot has the potential to be one of the most dangerous decisions to happen to civil aviation in the history of the industry.
[0] - https://dronewars.net/drone-crash-database/
[1] - https://en.wikipedia.org/wiki/List_of_accidents_and_incident...
The first 737MAX MCAS incident you never hear about because there were 3 pilots in the cockpit, and one of them reached over and turned off the stab trim system.
I don't think the comparison to a drone that doesn't need a pilot on board applies to an airline. If there are humans on board, one or ideally more of them should be capable of controlling the aircraft.
The difference here is that if the drone fails then nothing really happens, the targets might even be spared lol, but if a commercial airplane fails then hundreds of lives could possibly be lost.
I don't think the airline industry is ready for that massive risk. It's already risky enough for them now.
I don't think that argument flies.
If your answer is “the pilot on the ground takes control”, what happens when that system gets hacked?