Re "[MCAS] operating in the background to help avoid a stall."
Sort of. MCAS operates in the background to make the Max handle like something it is not: A 737 NG. Cut out MCAS, and it will fly like a Max, and experience positive pitch-up feedback.
Seems to me in the long term, we need a more reliable AoA indicator. Or at least one that can accurately diagnose it's own health.
4
Speculating on the basis of the information in the press, I think Boeing designed the anti-stall system to activate the horizontal stabilizer, rather than the elevator. Pilots can readily override the elevator manually, but repositioning the stabilizer manually is time-consuming and counter-intuitive in an emergency.
If this is true, it is a fundamental design error, not readily correctable with a software fix.
10
Oh my god. The more I read the worse it gets. Boeing builds aerodynamically defective plane. They try to correct aerodynamic flaw with flawed software program that sends plane into nosedive based on readings from 1 sensor. Boeing fails to inform pilots that this new system even exists, let alone provide training or information about how to disengage it. Once the system engages pilots have 40 seconds to disengage it before the plane plummets vertically towards earth at 450 mph. The plane is carrying people’s mothers, fathers, children, loved ones. These people are gone forever.
Oh yeah, and the FAA signed off on the whole thing. Actually, it allowed Boeing to do this.
I hope Boeing is sued into bankruptcy and there are long prison sentences for those involved at Boeing and the FAA. Even though I know this won’t erase the grief or bring people’s loved ones back.
23
@MF
Unfortunately, the story is even worse (but it has net yet been reported).
One of the world's leading business school professors, Dr Theodore Piepenbrock of MIT/Oxford/London School of Economics spent the best part of a decade working as a consultant to Boeing's most senior leaders (CEO, VPs, GMs, etc.), teaching them his award-winning theory on "The Evolution of Business Ecosystems", which Boeing gave the code name "Red vs Blue". His PhD on "RvB" was one of the largest and most downloaded dissertations in the history of MIT.
"RvB" predicted years ago that the 787 Dreamliner would be the biggest financial disaster in Boeing's history, with interim losses exceeding $50 billion, which many reputable newspapers (e.g. WSJ, The Economist, Seattle Times, etc.) have since verified.
"RvB" also predicted years ago that the 737NG replacement could not be both economically and physically viable. In fact, Dr Piepenbrock has stated over the years that Boeing airplanes could systematically begin to fall from the sky before 2020. He ultimately terminated his contract with Boeing due to his ethics concerns. Although a number of journalists at major newspapers are aware of this story, interestingly it remains unreported.
As an aside, Dr Piepenbrock is also known for being stalked by an obsessed female LSE employee whom he fired after she exposed herself to him, which resulted in the largest lawsuits in the history of Higher Education against the LSE, which will be heard in 2020.
14
So who will be held accountable for the lost lives?
9
What concerns me the most about this is the unknowns. We know the Max has a design flaw that Boeing tried to fix with software and that the FAA did not do a very good job in making sure that pilots of existing 737s were safe to fly it. How many more of these shortcut solutions are out there, with little to no regulatory oversight? If I avoid flying on a Max, will I be switching to an aircraft that has an equally (or more) dangerous design defect?
11
This is a rather frightening article. I recall an earlier article (or maybe a comment to it) where it referred to pilots in the US claiming that they would be able to handle the situation and it was just an issue of not having sufficiently trained pilots in 'developing world' airlines. And look at the result! But mostly what got me was the end of the article - they would carry out update training - on an Ipad!! Seriously? This should require mandatory simulator training given both the differences between the systems of the earlier 737 and the Max 8 but also just because of what has happened and it is a new, 'upgraded' system. Nice try Boeing. Never stepping foot in a Max8.
16
"In simulations of a suspected problem in the crash of a Max 8 in Indonesia last fall, pilots had just moments to disengage a faulty system." Forty seconds is two-thirds of one moment, not "moments"--a significant difference.
Re other facts, it is a shocking disappointment that Boeing has thrown off its engineering integrity for sleazy, short-term profits--a criminal choice, really, when such consequences to people who trust you might result.
Pertinently, I saw Judgment at Nuremberg, the film, recently and notice a similarity here to the decision processes the film and trial judged--no matter the magnitude of consequences, it is dumb to put convenience before integrity, to value your job more than your professional knowledge and conscience.
10
OK, I have read every story I could find on this tragedy and several hundred comments. Nobody has mentioned a fact that seems obvious to me. The aircraft is not airworthy without MCAS, because it can stall under some otherwise normal conditions. That’s why they created MCAS in the first place. So, the remedy for the failure of the single sensor is to make the aircraft unairworthy by disabling MCAS. The pilot is supposed to put the aircraft into a potentially fatal mode to make up for the failure of a single sensor. Does this sound like a reasonable course of action to anyone? Anyone?
20
@miller mcpherson
I'm not sure the aircraft is not airworthy without MCAS. It seems that Boeing had to add MCAS to avoid a requirement for transition training in simulators. My impression is that if they had been willing to go along with a requirement for simulator transition training, the plane would have been certified without MCAS.
Other comments to this article have suggested that the Max cannot be flown straight and level without MCAS, or that MCAS is required to prevent it from stalling on take-off or in a steep turn, or that MCAS is required to recover from an incipient or actual stall. I don't believe that any of these suggestions are correct.
As I understand it, the size and position of the engines created different handling characteristics, compared to previous 737 variants. A certain amount of back pressure on the yoke would result in more nose-up pitch on a Max than on earlier versions. A pilot transitioning to the Max would have to pay greater attention to the attitude resulting from given control inputs, until the pilot became acclimated to the plane. MCAS was introduced to handle situations where a transitioning pilot lost situational awareness. But I don't think your suggestion of a "fatal mode" is accurate where a pilot has transitioned.
9
There are quite a few technical discussions in the comments site. I have no technical knowledge. But letting the FAA allow Boeing to certify its own planes is ludicrous. There is an erroneous belief that business can do a better job than the government, and can police themselves. I believe there should always be strong regulations free from business interference. Business is accountable to shareholders for maximum profits rather than to serve. Unfortunately the current economic and political systems often fail to recognize the important role government can play in society to support its citizens. All these lives and talent lost are tragic and unnecessary. Not only their families and friends suffer, but their communities are also negatively impacted.
12
And maybe trying to overcome MCAS, might give an operator the feeling of driving off in an automobile with the steering lock engaged (As this idiot once did, some how managing to take the key out of the ignition lock)
3
Didn't they test-fly this thing?
3
FINALLY! A salient fact in this story.... there is a 40 second window within which MCAS can be disabled by the pilot in command.
I have consistently criticized NYT reportage for its ignorance of flight physics... and asked why the pilot didn't/couldn't disable MCAS and hand fly the aircraft. Now we know... he had a tight time window, and wasn't appropriately trained.
THIS stories detail about "turning a wheel" to fly the aircraft isn't correct. The wheel in question is an elevator trim. While it's nice to have, the pilot can simply use the yoke to fly the plane. The elevator trim will simply restore the yoke to center position, avoiding the need to correct a nose-down pitch by pulling back on the yoke.
Parenthetically, all of the hoo-hah about 'safety options' like a yellow light on the panel, or sensor-compare software has no meaning. UNLESS the pilot has virtually zero time to disable MCAS...and even then, a yellow light on the panel isn't going to save many of those 40 seconds, unless the pilot happens to be looking at it. The pilot's backside knows which way the nose is pointing, but maybe not if MCAS is fighting him...in those critical 40 seconds.
Repeating my criticism: we need to know if the aircraft is stable enough to be hand-flown with MCAS disabled. We now know the second part...can MCAS be disabled by the pilot in command? And that answer is: only if he's fast. And knew he had to be!
7
@jljarvis You didn't read the story carefully enough (granted, it was grossly misleading).
The plane will crash if the pilots do absolutely nothing for 40 seconds (presumably starting at the altitude Lion Air achieved) and just watch the nose go down and don't do anything to counter it. After 40 seconds of doing nothing, it would be too late.
If the pilot hits the yoke-mounted pitch trim switch with his thumb, then MCAS is interrupted. I'm not sure how long MCAS would wait before it triggers again. But a new 40-second clock probably wouldn't start until it does. The Lion Air pilot interrupted MCAS with the thumb switch something like 23 times and kept the plane flying for around like 12 minutes after take-off. Not 40 seconds.
He could have deactivated the pitch trim (and MCAS) if at any time during those 12 minutes he had followed the standard procedure for a runaway pitch trim (which is to place the center console switch in the cut-off position and retrim the plane manually). He knew he had a runaway pitch trim. He didn't need to know why (there could be many reasons) in order to perform the standard procedure. And he didn't need to be fast.
6
@Piper Driver
You're right. I bailed out before the graf that described disabling the MCAS, after resetting with the pitch-trim switch one or more times.
If simply de-powering MCAS eliminates the automated control problem, that implies that the Max8 is stable enough to be hand flown.
If true, both Max8 crashes would likely be attributed to lack of pilot training.
3
@jljarvis
I believe the Lion Air crash was attributable to airline negligence (failure to fix a broken AOA sensor that triggered MCAS on the previous flight and failure to notify the accident pilots of what happened the day before), and also to pilot training or proficiency.
I believe the Ethiopian Airlines crash is not related to MCAS at all. I believe the most likley explanation is that the plane was overweight for the density altitude at take-off.
1
Just the name Maneuvering Characteristics Augmentation System (MCAS) says a lot about how much was hidden. I wonder if this was a name chosen by management and not a senior systems engineer. What does it really describe? Not maneuvering, as what pilot purposely maneuvers into a stall?
3
Push two switches and crank a wheel? Stand in a door with your hands in the air? This is an airplane? Who makes up this kind of phony software and why are people’s lives in jeopardy from it!
6
Boeing has released a software update... i feel safe now... especially when cnbc just sent an alert that a 737 Max just made an emergency landing in Orlando...
5
It took 40 seconds and the test pilots were expecting some kind of anomaly? Next time, do something like cut off the fuel, then have the training pilot figure out how to get out of that stall situation!
3
Tonight, right engine failure after takeoff causing emergency landing in Orlando. Only 2 pilots aboard, who were flying to California to warehouse the plane.
4
So, by making an automated system dependent on one singe faulty sensor and not telling the pilots about its existence, the aircraft was basically designed to crash.
Good luck with the class action lawsuit. Here is the sound of the company stock: Boeing, Boing, Bong, crash
13
The problem simply goes back to letting companies certify their OWN planes!.
There should be an independent agency which thoroughly certified planes before they get out into market. Just like FDA approves drugs before they can be sold.
6
My father worked and retired from Boeing as a blue collar worker. We always want Boeing to do well, but this "software bug" which killed people, broke the trust on Boeing safety and credibility. It would be like cloud providers or online bank, to say we have been hacked. "If it ain't Boeing, I ain't going" is changing to "If it is Boeing, I ain't going"
We will say "it's part of the business", "we will learn from this" but imagine being on the doomed flight. A slight jolt on a normal flight makes me nervous. These passengers probably experienced both weightlessness and excessive g force. Make all Boeing executives get on a test 737 Max and experience what these passengers had to face for the last minute of their life, and bring their family too. Never forget this.
Boeing killed people, some executives should go to jail, but this is America, land of the free.
23
To me, by far the most unconscionable aspect about this whole terrible story is Boeing's insufficient response after the first Lion Air crash last year. The pilots on that doomed plane were tragically under-informed about MCAS and how to respond to false alerts generated by the system. But surely Boeing knew, or at least must have had a very good idea, of what had contributed to the crash based on early data from the investigation of that tragedy. To still not speak up and say there might—at the very least—be a cause for concern over MCAS suggests a level of corporate callousness that is outright criminal.
It was the company's fundamental duty to inform regulators and airlines about the potential hazards of flying the 737 Max 8 without proper training after that first crash. By not doing so, they are directly responsible for the deaths of 157 innocent human beings in the Ethiopian Airlines crash.
12
@Jai Vijayan Where to begin?
1) After Lion Air, the FAA issued an Emergency Airworthiness Directive and Boeing provided doc updates that explained to pilots that the MCAS system could cause runaway pitch trim, and what to do about it.
2) It's very interesting that you've figured out that the Ethiopian Airlines crash was caused by MCAS. How'd you do that? Because that's what everyone else is saying? Did you consider other possible causes (like an overloaded airplane)?
1
@Piper Driver Actually, the fact that Boeing is issuing an update to address how MCAS works—after the second crash—would suggest a link between the two incidents that you don't need to be a genius to figure out.
7
@Jai Vijayan
They are issuing an update because they are being forced to. I'm not sure it makes the plane safer.
If you look at the radar data, the Ethiopian Airlines flight had a very shallow climb gradient on take-off, much shallower than Lion Air's. That can have nothing to do with MCAS.
The rumble you hear is the stampede of lawyers waving their class action suits at Boeing and every entity with deep pockets that dealt with Boeing
Saving the airlines the cost of safety features and pilot training is going to cost Boeing and their customers (and flyers who ultimately have to buy/pay for a ticket that covers the cost of the litigation & fix) an enormous amount.
Mistakes happen and lawyers get rich on them.
5
Adding readings from a second sensor does not solve the problem. Instead it doubles the probability of failure (i.e. the probability that one of the sensors fail). If the sensor readings don't agree, they will not be used by the MCAS system, which means that airplane will be vulnerable to high angle of attack and a subsequent stall. Such a stall is more likely to happen when the airplane is already pitched up during takeoff. But that is exactly the time when a stall is difficult to recover from due to the low altitude. Taking all this together, if the new software fix had been applied to the lion air, the failure of the angle of attack sensor (even if the other one was working normally) simply makes the plane vulnerable to an unrecoverable stall. So with the fix, the MAX is less likely to experience aberrant stabilizer behavior similar to the one that led to the lion air crasah, but will be twice as likely to get itself into a stall vulnerability scenario.
6
I wonder why the AoA (angle of attack) sensor can’t be made more sensitive, placed inside the aircraft, and be based on gravity rather than the airstream. Wouldn’t an instrument like that be less prone to fail? (no possibility of icing.) Or a gyroscope?
Pitot tubes are also prone to icing; there was a short in the pitot tubes of the 737 Max 8 when it was first released that caused the heater not to work—I assume that problem was solved. Is GPS not sensitive enough to determine airspeed? It’s all very well to focus on MCAS, but GIGO (Garbage In, Garbage Out) may play a role, too. Just asking.
4
@BlueMountainMan The definition of AOA is the angle between the relative wind and the chord of the wing. You cannot determine AOA by looking just at g-force. You need to know relative wind, and you cannot know that without measuring the wind.
GPS does not measure airspeed, it measures ground speed. So it isn't a sensitivity issue, it is just measuring something different.
4
@Piper Driver
Thanks. It just seems that multiple factors are in play—it seems a mistake to focus on only MCAS.
1
@Piper Driver
Thanks. It just seems that multiple factors are in play—it seems a mistake to focus on only MCAS.
The angle of attack is not the same as the absolute angle of the aircraft? How does it differ?
1
Boeing's software has a major problem, which should have been discovered in the required testing. Any aircraft software should have enough logic to prevent the software from driving the plane into the ground (or water).
9
I’m so sorry for those pilots and passengers. The pilots not knowing what to do with a new air plane in which their government failed to buy emergency fail systems and shame on Boeing for offering those an options. It’s sickening that humans lives are put at risk with only 40 seconds in which possibly a pilot may or may not in panic to keep the plane from crashing. Profits over people. Heartfelt sorrow.
13
OK, I believe I understand -- failure of a single sensor kicks in an automated system which pilots were never trained on which erroneously kicks the nose of the plane up and forces it to stall, and the pilots have 40 seconds to figure out something they've never seen before or the plane crashes.
I will never fly on a Boeing aircraft again until I receive substantive information about this plane's actual safety. The mere idea that failure of a single sensor could bring the plane down and that this was not deduced after the first crash is mind boggling.
Further, as anyone can see by the evolving news cycle, Boeing is in political damage control -- as such we have no idea how severe the problems with this aircraft really are. Are there other problems?
This looks like an obvious money versus safety issues. Why only one sensor? Why doesn't the sensor work? Atlas moon rockets have lots of sensors on *them* that didn't fail.
Let me guess -- it's really expensive to build good sensors. You need titanium and stainless steel and silicon bronze and cast O-Ring rubber assemblies, you know, the costs add up. Are the sensors tested? How? Can we see the procedure? I've written what's called "life-critical" software which, if it doesn't work, it means people can die. Let's see some details here, FAA. What company makes the sensors?
I see that over the last 10 years, Boeing's stock has a 10 times return on investment (1,000 %). Congratulations to the winners.
10
Boeing screwed up as did the FAA when it allowed Boeing to certify its own planes as safe.
11
I think it's time we see some hard, criminal sentences for the Boeing execs who negligently killed ~350 people within 6 months.
14
Let's think this through. The original 737 airframe as certified was flyable by a competent pilot. Then larger engines were substituted. The new airframe was deemed by Boeing and FAA to be a minor modification. The large replacement engines in the MAX model rendered the plane unflyable without MCAS. When MCAS malfunctions for any reason, the proposed procedure is to disable MCAS, Wake up. The plane can't fly without MCAS.
The MAX airframe should be decertified, and the model should be configured to fly safely by pilots, or scrapped. Whatever replaces it should be submitted for testing and certification as a new model. We cannot allow unflyable planes into the fleet. How many deaths will it take 'til we learn that too many people have died?
14
When you are fearing for your life (and feeling responsible for many others) it is hard to make effective use of 40 seconds.
12
The only "positive" about this article is that hopefully there is no longer any blame or doubt that the pilots were to blame in either fatal crash.
What continues to haunt me is thinking about the fear and terror all aboard both flights endured during those horrific 6 minutes and 12 minutes. Cannot imagine that degree of panic and fear.
11
Two things:
1. If you have a basic understanding of the controls of a Max 8 you would instinctively know to turn off the "Stabilizer Trim" switch to restore control to the pilot from the autopilot.
2. To totally eliminate the possibility of a similar crash, simply turn off the "Stabilizer Trim" switch as part of the pre-flight checklist. That would permit the pilot to hand fly the aircraft to the assigned cruising altitude, where it would level off and be safe to fly on autopilot to the destination.
Either one of these solutions would cost absolutely nothing and require only a very short training session.
2
@ronbj99
Guess the Ethiopian pilots aren’t as savvy as you are despite 1000 hrs between them. By the way, did you figure out the solution sitting in your easy chair having a coffee?
Or were you actually in the cockpit of a wildly undulating commercial jet with a few hundred lives on the line?
If it took you longer than forty seconds I guess the former scenario was the case.
2
Maybe Boeing should include training when they sell an aircraft. Both of the recent 737max8 crashes might well have been avoided. Thanks Boeing, for making America great.
5
I'm an engineer, PhD. Been disguising, developing software since 1964, now retired.
This aircraft is inherently unstable.
I will never get on a 737 Max. Never.
11
@Austin Liberal
Well, now: My system's spelling autocorrect feature did a fine job. A mistyped "designing" became "disguising."
Any questions?
7
The original MCAS design commanded a moderate 0.6 degree deflection of the horizontal stabilizer under certain flight conditions to avoid the greater tendency of the 737 Max to stall. Test flights showed that this was insufficient and the final design commanded an aggressive 2.5 degree deflection (additive each time the system cycled).
Now Boeing is reportedly testing a milder version "solution" less aggressive in deflection, won't deflect the horizontal stabilizer for as long and will only fully deflect once. Additionally the new MCAS won't even activate if the two AOA sensors materially disagree.
So in the rare incidence of stalling conditions (although inherently greater in the Max vs. earlier 737's due to design) that the revised MCAS will provide less authority and will not even activate if the two sensors disagree. That means that there is a greater chance, albeit small, that the MCAS "safety system" will FAIL or will not provide sufficient authority to avoid a stall. Logically there is a greater chance that the pilot will need to hand fly the aircraft and attempt to avoid/recover from a stall.
I suspect that any fix will require pilot simulator training for this very event. This defeats Boeing's very argument for both certification and marketing that the 737 Max needs no additional pilot training for existing 737 pilots.
I can't see how it gets quick recertification. Things will likely only get worse for Boeing stock and GE (engines).
12
The headline and thrust of this article, like most other NYT articles about the crash, are grossly misleading.
The author says, "If pilots don’t act hastily enough, attempts to disable the system can be too late." Maybe true if the crew did absolutely nothing. After 40 seconds, MCAS would have triggered 3 times for a total pitch down of around 8 degrees. Presumably, that was too much to recover from at the altitude Lion Air was flying. But that doesn't mean, and the article doesn't say, that a 737 Max cannot recover from an 8 degree nose down attitude at other altitudes.
More significantly, it is inconceivable that a pilot would not use the yoke trim switch to reverse the forward trim, potentially as many times as necessary. The Lion Air pilots apparently did this 23 times, even though they knew nothing of MCAS. And they continued to fly the airplane for minutes, not 40 seconds, as suggested by the article
Lastly, the article does not explain that there is apparently no limit on the amount of time to execute the runaway pitch trim procedure, which the article recognizes would shut off MCAS.
The article says "Another person found the system controllable because it was expected" But I've yet to hear an explanation of why a pilot, faced with a spurious MCAS situation, would NOT execute the standard runaway pitch trim, procedure, especially after battling the pitch trim nearly two-dozen times (unless they had forgotten about it).
I agree, this article doesn't seem to provide enough context or explanation and the headline seems like it might be misleading.
I'm not a pilot and I recognize airplanes are far more complex than cars. But the way I read this, grossly simplified, it sounds like they are saying something more or less like: if you are driving near a wall, and notice the electronic steering assist is pointing you towards the wall, you'll have only a few seconds before you crash if you do nothing (more time if you're further from a wall); if you manually turn the wheel the other way, you can extend this for a few minutes; if you figure out how to turn off the faulty steering assist (which the carmaker never told anyone about), you can remove the issue and drive manually.
Is that at all analogous? If not, what is missing to complete the picture and allow the average non-pilot to better understand? Article makes it hard to say for sure. If this is a relatively easy fix or easy to educate pilots to fix, it would seem to be a manageable issue going forward (leaving aside the question of blame for not publicizing earlier). If there's more to it, the public would be justified in remaining concerned.
5
@UWSer You are basically correct except for two things:
1) If you manually turn the wheel the other way, you can extend this indefinitely (as I understand it); and
2) They auto mfgr might not have told you about a mode where the steering assist would malfunction and insist on pointing toward a wall, but it provided a switch to turn off steering assist, put the switch on the center console, and told you to use it if the steering assist misbehaved for any reason.
1
Thanks for clarifying. On #1, what seems hard to understand for me is whether the system would "fight back" by gradually increasing the degree of correction to overcome the pilot's resistance, to a point where manual steering eventually wouldn't work? We have all seen the graphs showing the plane going down, then back up, then down again. You mention this was done 23 times -- what happened after that/why didn't that continue to work? Unclear to me if the pilot could have just kept doing this the entire flight if he hadn't turned his attention to the manuals or trying to find a permanent fix.
1
Boing and Lion agreed that the pilots did not need to be alerted to the existence of MCAS. WOW.
3
I'm No Pilot and I'm Not safisticated with knowledge of flying a Commercial Airline. I but a ticket we take off the pilot there is a problem in the air the pilot has 40 seconds to adjust according to the Manuel. Something is not right here. Mid air these poor guys are reading a manuel with a load of passangers. Why isn't everyone's hair on fire over this?
5
Foreign countries that use Boeing products should give them 40 minutes to fix this problem or cancel their orders.
7
One situation where the MCAS strongly activates is during tight turns, such as turning back to the airport after trouble. This may explain why both flights plummeted so severely at their ends, even though their transponder tracks ended at reasonable heights and rates of climb.
3
I have been a private pilot for 52 years (amateur - I know) and a software engineer for 58 years - an intersection of experience perhaps slightly germane to this topic. I offer this as a suggestion, not as a criticism, and to invite a discussion, and to invite you to tell me where I'm off-track. I've seen fight control software described as "artificially intelligent". But consider what the human pilots are aware of compared to MCAS: MCAS could know it has been just a few minutes after takeoff, therefore there's not much altitude to play with. It could know GPS altitude, height above terrain, rate of climb or descent, attitude, airspeed, yoke control forces, power settings, and maybe even audible panic in the cockpit. Instead it considered input from just one (now two) angle of attack sensors. Sounds artificially stupid, instead of artifically intelligent. In the small planes I fly there are stall warning systems, that have no moving parts, that detect airflow over the wings. It seems also that MCAS could more simply compensate for MAX 8,9 pitch-up characteristics by gently adding nose down pitch solely by reference to the cause: increased engine power settings. If they are going to rely on software it could have more "situational awareness" by considering as many sensory inputs as available, relevant, and reliable. I am inviting a discussion on this by professionals more knowledgeable than I am - as a prerequisite to feeling more comfortable flying the MAX.
6
@paul
Yes, if the infernal mechanism was actually integrated with the other instruments, what you say would be true, and likely pretty safe. All indications, though, is that the MCAS was a patch/hack that was stand-alone except for being turned off when autopilot was engaged. So the pilots had lots of information that they were indeed not headed for a stall, but they could not know that the MCAS was driving the stabilizer until more or less too late. Without an indicator or a comparison from the other sensor or noticing the trim wheels spinning more than usual, Paul, the dive could have been from other causes. Then, they could only move it back from (in the one crash) 20 degrees by very rapidly manually cranking those trim wheels after throwing the breakers off. (How many turns for that huge and heavy tail?). And all near the ground, and all at high throttle for climb. And all depending on a little mechanical weathervane sticking out there in the weather. One weathervane.
6
"Pilots will be required to complete a training on the updated system on their iPads." !!!???
Yeah, sim time costs thousands of dollars an hour. Maybe Boeing should pay for it?
6
The FAA dropped the ball on this one? What do you expect in the age of Trump where all government agencies are being systematically gutted and corporations are given plenty of leeway to make all or most of their decisions based on shareholders’ interests and the almighty dollar? The foxes are guarding the henhouse, people, and they are getting fat and sassy at the expense (in this case) of our lives.
10
@Gary Pahl - First flight was January of 2016 and it entered service in May of 2017. So rather than a "Trump thing," I think it is a long term systemic issue.
4
Hello - is there anybody out there who wants to fly the 737 Max 8 with "40 seconds to go to eternity"? Ask yourself Boeing - there's no way you can ever recover from killing 346 people in a time span of 5 month. You knew of the problem of the larger engines mounted more forward on the wing that created the upward movement of the planes nose. But rather than starting a new design from scratch you created the MCAS to save you from the design flaws. And by hiding the problem from the pilots you Boeing are guilty of murder.
17
It's been pretty well reported what the MCAS system is designed to do. And it (probably) has crashed two planes. What I have not seen reported is how many Boeing passenger jets have crashed because of nosing up high enough to stall? Is this system even necessary?
1
@LI'er, a stall on a plane such as this can be extremely deadly and you can easily get to the point where a stall is unrecoverable.
This is why planes have had stick shakers, stick pushers, and other electronic nannies for decades.
Turkish 1951 was a 737-800 that staled and crashed in 2009, though this likely would not have been helped by MCAS.
Not a Boeing, but the Airbus in AF447 killed 228 people in 2009 due to an unrecognized stall in a plane with a huge amount of automation. This was due specifically to nose up.
Also not a Boeing but the Q400 in Colgan 3407 was caused by a stall caused by pilot fatigue. The pilot in this case pulled the nose into a stall.
Stalls are deadly serious and without the systems currently in place there'd be even more deaths.
4
A criminal investigation of Boeing is called for
5
This is a tragic, deadly, and thoroughly preventable, failure of capitalism. To meet self imposed competitive pressures, Boeing cut corners, and misled about the need for training, and now hundreds of people are dead, hundreds of families devastated, and whatever money was made will soon be gone as well. Greed kills.
8
and they think driverless cars are the future?
9
If the engines are larger, sit higher and further forward, wouldn't that shift the center of gravity toward the nose and thus bring the nose down? My understanding of aerodynamics must be flawed...
The most important part of the article was that the new MCAS software update won't be so aggressive as to make flight control inputs pilots can't overcome manually. I can't imagine the pilots on Lion Air and Air Ethiopia, pulling as hard as they could on the yoke, while being overridden by...software.
2
@Jim R.
I wondered about that too. Wasn't well explained.
Think it must refer to greater engine thrust.
2
@Jim R.
The larger nacelle on the new engines provides more lifting surface at nose high attitudes.
1
I have an advanced degree in engineering and an MBA. This appears to be a classic case of putting profits over basic safety and common decency. That Boeing is still planning on selling planes that are physically unstable only shows that something is very rotten in Denmark. As far as I'm concerned, its top executives need some jail time.
11
Those engines just don't look right on that plane. That is all.
Sorry. An ipad training session "fix" won't solve the underlying engine placement design flaw.
3
It seems that before all this crazy flawed software pilots did fine flying planes. Why was this software initiated anyway, did another company sell Boeing a bill of goods? Pilots have plenty of instruments to let them know if the nose of the plane is too high or too low and they can easily correct it. Trying to developing 'self flying' planes as it seems Boeing has done has proved fatal.
1
If the MCAS system was designed to keep the nose from pitching up, can't that only happen if the pilots don't know how to read the angle of attack. Don't they have artificial horizons on planes anymore? A stall indicator shakes the stick right? Are the pilots being trained to know airspeed and climb angle? It seems that pilots don't have basic flight knowledge that a student pilot has regarding nose angle and speed. Turn off the MCAS system and read the air speed and flight angle indicators. Boeing could take a step backwards from their technology and turn something off and let pilots fly.
3
@markd. An analog, and a pretty good one, would be if you were very experienced riding large motorcycles, and somebody sold you one that was supposedly of exactly the same dynamics, only the new one could pop wheelies when you just expected to accelerate on the ground. And letting off the throttle didn’t bring it back down...
6
“ this crew didn’t even know that this system existed,”
"the captain of the Lion Air flight flipped through a technical manual trying to figure out what was happening."
This is pilot error through and through.
At no point should they have accepted PIC of that aircraft until they were familiar with all of its systems.
--> There is a reason why the 737 has a trim-disconnect panel reachable from both seats. That panel didn't mysteriously appear in the airplane over night, ya know.
The Auto-trim disconnect has been installed since 1967.
There is no excuse, Just poor training, for why those pilots didn't disconnect - As they were supposed to - And fly the airplane by hand.
@Dave Burke. Seriously. There are two large, noticeable wheels spinning when the system is working (or malfunctioning). It isn't a mysterious force: you're pulling up while the rim wheel spins against you? You have stabilizer runway and you start the memory items.
It does not matter whether it is caused by MCAS or one of the other systems that could cause this problem.
The problem is similar to AF447 in that too many pilots aren't hand flying enough in good weather.
1
The key question is now with the less aggressive MCAS, will the risk of unrecoverable stall increase? The MCAS was there to compensate for the aircraft's tendency to tilt up. Now that it's going to be a far milder version, what are the consequences?
What rocket scientist wrote software that could fly the plane into the earth? And, more importantly, what person in management signed off on the project?
4
Presented the possible deficiencies of the new system (MACS),
is there any documentation of situations that prevented the stall for what de system was designed?
1
So Boeing's cutting corners to stay ahead of the "competitive curb" has finally come back to bite them. French plane maker AirBus announced today that it signed a deal to sell 300 planes to Chinese airlines.
Cutting corners on crucial and what should be mandatory SAFETY features on the design of any plane is a non-starter and the price to pay for it is evidently very high.
4
The plane should have been re-designed to accommodate the larger engine. A software re-design does not correct a hardware problem. If they actually put these planes back in the air with nothing but a software correction and extra pilot training, then shame on Boeing and shame on the FAA.
5
@Lou Hoover
It appears Boeing was updating the 737 to stay competitive in the pipeline and to do so, by burying all the software and sensor changes so that it could have minimal impact on future revenue stream to capture carrier orders. And the crazy thing is that the FAA allowed for all this to happen. I don't know about anyone else, but I do not feel comfortable flying on these new MAX planes if it's just a software fix. 40 seconds is not enough time.
2
The poorly trained pilots were trying to fly the software instead of just flying the airplane. There is a trim-disconnect panel for a reason. It didn't just magically pop into existence. It has been there for a reason since 1967.
3
So 300 people die because Boeing executives forced the pace of development so that Boeing stock price could go up and they could get fatter bonuses. 300 people lost their precious lives, countless family members will suffer just because greedy executives wanted to fill their pockets with more money... BLOOD MONEY. Boeing needs to suffer for this and I really hope (but doubt it will happen) that someone goes to jail for this negligent unethical behavior. This brings back memories of the Challenger disaster where the technical community tried to warn executives and they refused to listen. SO TRAGIC that certain people value money over the safety and lives of human being. Oh wait a minute, we’re the same country that allows our politicians to be influenced by the NRA and the tobacco industry. I am angry. I am disgusted. I feel for the people who have lost loved ones in the name of greed.
8
"Boeing’s software update would require the system to rely on two sensors, rather than just one, and would not be triggered if the sensors disagreed by a certain amount,...."
That is what we used to call a "hack" in the software business. That is, a fix that is simply done to correct a design flaw, to compensate for a problem that lies elsewhere.
In this case there are two design flaws: (1) The sensors are untrustworthy so the hack is needed to compensate for that problem, rather than fixing the sensor itself; and (2) The user interface, that is, how the pilots interact with the system, is confusing to the point that it has fatal consequences. So rather than make the feature intuitive to the pilots, they increase the timeout to give more time for the pilot to recover from the confusion the system causes.
Boeing has good engineers so I am surprised they tolerate this sort of hacking to fix a serious problem.
5
"In conversations with pilots and airline officials over the weekend, Boeing executives didn’t directly address why MCAS was designed with such flaws, one person with direct knowledge of the meetings said." That's a question that should be answered.
Why does this somehow bring to mind the faulty O-ring involved in the 1986 explosion of the Space Shuttle Challenger, killing the crew of seven, including a civilian school teacher?
People flying commercial airlines are passengers, not astronauts, but neither should be exposed to unnecessary risk.
4
I really don't understand the need for this particular automation. Why can't the sensor just trigger an audible warning in the cockpit and let the pilot make the determination? If his artificial horizon confirms that they are at a steeper than normal angle of attack then he can deal with it manually. It's looking like automation gone wild to me...
4
Boeing had to pretend that the Max flew just like the old 737, or else face training or certification costs. It was a conscious decision to use a hack that didn’t trigger any delay or costs. Definition of culpable.
5
Great to learn that pilots and software, given enough time and training will be able to control and safely bring back an aircraft that is inherently unstable and poorly designed. I for one will not fly on a Max 8 737 -- I would rather take a risk on an aircraft that is functionally designed well (i.e., a Dash 8, or original 737) than on an aircraft that is less stable, but has more "fail-safe" systems to counter poor design. Bottom line is that I suspect that there is more risk in a failure of the counteracting systems than there is on a failure of a well designed aircraft -- and some would argue that the systems provide less risk, but IF it fails, the results are catastrophic v. when a well designed aircraft's system fails, it can possibly land (i.e., Hawaiian Air 737, Gimli Glider 767, etc.)
6
In the early years of high-altitude passenger jet travel, British aviation developed the Comet which seemed to give it a technological edge in competitive air travel. It had a design flaw: square windows. At high altitude internal air pressure tended to cause failure of the window seals and explosive decompression that caused the airplanes to crash, killing their occupants. The Comets were grounded until a different window design could be perfected and tested. The damage had been done and Comets soon were taken out of service.
The best aeronautical engineering and software designers sometimes get things wrong as when McDonald-Douglas engineers designed cargo doors on the DC-10 that were susceptible to failure at altitude if not absolutely closed and properly secured. In March 1974 Turkish Airlines flight 981 experienced explosive decompression when a rear cargo door that had been improperly closed, burst open. The result caused flight control cables to be severed. The design flaw was that the cargo doors were designed to open outward to save space in the cargo hold. Thus, there was a potential for door failure built into the design. The door’s locking mechanism was another Rube Goldberg design that, if not properly activated, would cause the door to burst open at altitude. The plane crashed, killing all of its occupants.
@bkbyers
On the cargo door design, initial tests showed a potential for failure. Convair, which designed and build the fuselage for McDonald-Douglas, informed MD that there could be catastrophic failure with the cargo door design and that this needed to be changed. A "Band-Aid" change was made to strengthen the locking mechanism of the door, but this had not been installed on the aircraft flown by Turkish Airlines.
1
Accident investigators have long come to grips with the fact that these events are never the result of a single failure. There is always a lengthy chain of events leading up to the inevitable carnage. I submit that this chain began when the Fed chose to delegate their duty to protect the public with the independent safety oversight so essential to the aviation industry. We should start by fixing that first link.
8
It seems to me that Boeing has developed a Rube Goldberg device that conflicts with itself and confounds pilots. If earlier models of the 737 performed so well without the MCAS why did Boeing develop and install if on its newer models? The guys on the ground set up the air crews for potential disaster and this occurred twice, killing 346 people in two crashes. Refinements of instruments and systems might reach a point where the returns for the rewards of the new systems are questionable if not perilous. It seems obvious that in developing MCAS Boeing did not consult experienced pilots about its necessity and use. The result was loss of human life and, equally as bad, the terrible price surviving families must pay for Boeing’s bad judgment.
@bkbyers
They installed the MCAS on the MAX version of the 737 because, for better mileage (to compete with Airbus), they used bigger engines that would not have cleared the ground sufficiently as originally positioned. The engines were moved forward and up to make up for this. That made the plane tend to "nose up" too easily, which could lead to a stall. Basically, the jet, designed in the mid-sixties--yes, you read that right--became somewhat inherently unstable, and this terribly flawed system was designed to make up for that. They need to scrap this design and build a modern plane from the ground up. But that's very expensive.
6
In the age of autopilot and unmanned planes, Boeing needs to do better than allowing such a short time for a pilot to react. The software should be able to adjust even with flawed data. If the software is reading that it is too close to the ground at excessively high speeds, why isn't it overriding the previous maneuver?
4
Here's my question: assuming it turns out that the two crashes were caused by a flaw in the MCAT system which was developed to compensate for the aircraft's tendency to turn up BY ITSELF which could result in a stall, why would anyone want to fly on a plane the DESIGN of which leaves it likely to stalk in midair unless the MCAT works or the pilots override it?
2
@John Burke
The 737 MAX 8 is a fly-by-wire aircraft, meaning that ultimately the plane is controlled by a computer, over a networked electrical bus. There are a number of reasons for using fly-by-wire, including the control of an inherently unstable air frame. Previously, aircraft were designed to be inherently stable, which meant that they were easier to control by a human pilot. In order to increase the performance of their aircraft, fly-by-wire now allows Boeing and Airbus to design less stable aircraft, but to compensate for this using computer algorithms. Boeing's MCAS is one of those systems. In the case of the 737 MAX 8, they used larger, quieter and more fuel-efficient engines, which have a tendency to force the nose of the plane up. This is a less stable design, so they used the MCAS control system to make it easier for the pilot to fly.
2
It must be obvious to Boeing that the Max version is dead. Their 4,300 back orders are about to go to zero and, if the deposits are not refunded, the lawsuits will start -- and they will prevail.
The Max 737's are inherently fatally flawed and the prospective buyers were not made aware of that defect. No jury will vote with Boeing unless their lawyers can challenge seating anybody who ever travels by plane.
6
Boeing's rush to announce "we fixed it" is all too reminiscent of the scene in the movie "Jaws" where the mayor poses with a hastily caught shark to proclaim to vacationers that the danger has passed, so please come back and spend your money. It's all too convenient. Time for Boeing to go back the drawing board. It needs a bigger boat.
6
@DL
No, they actually have probably fixed it. Too little too late, yes, but the plane will likely be pretty safe. I--and many others I would guess--still don't like the idea of a plane that has odd flight tendencies (due to the engine change) that have to be countered by computer commands.
3
This is a challenge for the world we live in. Something analogous once occurred to me: I had a car's cruise control not disengage when I braked. It took me a couple of seconds to figure out what was going on, I tried braking again a couple of times but when that didn't work I realized I had to switch off the cruise control. This happened on a quiet freeway in eastern Washington so there was no threat to life. If it had been rush hour in LA and there had been rowing kids in the back it could have been different. Those pilots have my sympathy.
5
FAA has a dual mandate (serve the public and industry).
You can't serve two kings. I guess the line was crossed on this one.
Hmm, I wonder about the FDA...
4
I won't be a guinea pig when the 737 MAX is returned to service. I will be sure to find-out which aircraft service my routes.
6
The inescapable conclusion is that the FAA let passengers down. Boeing may also be at fault, but we need to be able to trust our regulator to keep Boeing in check. The problem is how to craft effective regulations without making them unnecessarily cumbersome. The solution is good government focused on the needs of the electorate, rather than short-term political gain and partisanship.
4
I am a pilot for a major US airline. I have to undergo a flight physical exam by an FAA approved doctor every 6 months. My doctor noticed that my blood pressure, while not hypertensive, was a bit high. He said, "Are you under stress at work?" "Ah, no doc, I don't have any stress associated with my job."
Yeah Right! Remember this when you pay for your ticket.
105
Kent, how about us? We’re sitting in the back of the aircraft and we don’t have any control over anything.
12
What Boeing doesn’t tell us is how were the conditions reproduced (i.e. altitude, attitude ,speed, configuration, lateral navigation, etc.),and how a minimal element of surprise was introduced in the trial. It is one thing to be in a sim knowing more or less what’s going to happen and quite another to have to recover from the initial shock of a critical situation close to the ground in a typically stressful climb out phase, trying to figure out first what’s really going on. Furthermore, airframe manufacturers, for obvious safety, systemic and cost reasons do not provide test flight data outside of the flight envelope of the airplane for the simulator. Hence the reaction of the simulator might be erroneous (like in the case of simulated unusual attitudes). Last but not least, one can question how Boeing gathered all the necessary material for this trial in such a short amount of time...
6
They used the data from the Lion Air crash, not the recent one. And the new software was basically ready to deployed.
2
I own a 15 year old Toyota. Two years ago, I started receiving check engine warning lights on my dash. I wasn’t able to diagnose the problem, so I took it to my mechanic who said the CEL was triggered by a disagreement between the crank shaft position sensor and the camshaft position sensor. He said the timing belt had probably jumped a couple of teeth over a sprocket and so the two shafts were not timing the rotation of the shafts properly. If the problems continued, the engine could have been destroyed. If Toyota can give a driver a CEL about a disagreement of two engine timing sensors, I can’t understand why Boeing would create the redundancy of two angle of attack sensors, but not even give the pilots a warning light when they were not consistently reporting the position of the aircraft relative to the airflow over the plane, without charging the airline for the warning light. Putting profits before safety is just unconscionable.
191
@John Smith Toyota is a Japanese Company and Boeing in an American Company. Toyota is safety conscious and Boeing is Profit at every opportunity minded.
Boeing will pay dearly for nickeling and diming when it comes to the safety of flying passengers and crew.
21
@Joe Not The Plumber
"Boeing will pay dearly for nickeling and diming when it comes to the safety of flying passengers and crew."
I bet it won't. :-(
11
@John Smith
As you were driving down the road - what did the check engine light tell you and what would have been your IA (immediate action)?
Your car told you no more and no less than a Boeing could.
And Boeing did offer a 'warning light' as an option just like some Toyotas have an oil pressure gauge versus and idiot light.
5
My concern is that there is too much money involved to keep the planes grounded and implement the proper correction of the design flaw.
Which may not be possible.
At the very minimum, continuous simulator (not iPad) training of all possible contingencies resulting from that flaw should be mandatory. That may kill that plane, but the alternative is worse.
87
@Kara Ben Nemsi The aerodynamic design should have killed the plane, but profit before safety.
4
@Kara Ben Nemsi What alternative are you talking about? Boing going bankrupt? Personally I think that's all this company deserves. They are criminals and should go to trial.
2
@Kara Ben Nemsi Pretty sure they would just permanently disable MCAS before that happened.
1
Knowing that two MAX 8 planes crashed and killed everyone on board, I will do my best not to fly this airplane until Boeing redesigns the whole thing.
A software patch won’t cut it for me.
An extra sensor won’t cut it for me.
More training for pilots whether on an iPad or in simulators won’t cut it for me.
A software patch plus an extra sensor plus extra training for pilots given for free to pilots and airlines won’t cut it for me.
The problem is plane design and the only solution is plane redesign.
Anything short is a marketing spin that has been green lit by bean counters who has made the decision based on profit versus litigation and insurance claims and arrived at a decision that the numbers are still in their favor no matter the chances of a crash.
Do the right thing Boeing—let engineers redesign the plane, not your accountants.
13
@Opinioned
Indeed. And don't forget to mention this plane was first produced in 1967. I know Boeing wats to squeeze as much profit as possible out of it, but either accept the less efficient basic 737 (which os fine), or redesign from the ground up.
2
As an engineer, the fact that a critical, life-saving system only relied on one sensor is borderline criminal. When the design team went through the FMEA (Failure Modes and Effects Analysis) did they really assess the reliability of that single sensor to be acceptably low at all times? It boggles the mind.
7
@BaldySanta - Certainly a good approach, however an FMEA is a hardware centric analysis. The results may have pointed to the software, and possibly the runaway stab trim procedure. I think their software V&V process should have identified the problem before release. But in either case, I agree with you that their analysis and error identification process failed.
1
An AoA indicator is hardware.
2
@Kara Ben Nemsi - That is true, however the software is what must handle the failure of the hardware. Software does not fail per se. It will behave as it is programmed. Therefore a failure analysis is not as appropriate a tool.
Software must be vetted differently, to find any behaviors under "boundary conditions." This is where V&V comes in.
1
MCAS was not installed as a safety feature. Not buying that argument. It was installed to offset a design flaw, specifically that the bigger engines had to be moved forward on the wing and then would tend to push the nose up. Airplane software is great when it's operating like cruise control -- not when it's being asked to correct a design problem. And the design problem was a marketing decision.
370
@Jfitz wrote "It [MCAS] was installed to offset a design flaw."
I agree absolutely. Let's be on guard now for semantic tricks by oily PR folks who may try to finesse the MCAS gadget as a "great safety device". I can hardly wait to watch the Boeing executives testify under oath in front of Congress members this week.
48
@Jfitz
Bingo! You got it.
26
@Jfitz
You may be partly correct. MCAS is Boeing's stall protection system designed to meet FAA aircraft certification in "large commercial transport aircraft"...this is mandatory for the category & a particular safety feature in IMC conditions.
The safety feature is incorporated in all airliners although it may be called by different names.
But there may be more to MCAS that is unknown to operators (& the flying public). It may involve other control features to improve the safety of an 'inherently' bad design airplane! Under certain flight configuration the aircraft may exhibit serious nose up tendencies that could result in a 'stall' & loss of total lift! This condition could be particularly troubling at low speeds, high AoA's, rearward C of G, flaps extended etc...!
Boeing has not been very transparent/honest in disclosing more info.
17
Mcas is not worth all of the lives that have been lost. Scrap mcas, as people will not trust any 737 max for some time. Keep the former tried and true planes running.
1
Some executives need to go to prison. They obviously sought profits over safety.
3
Crank a wheel? The procedure is called trimming and it requires a feather touch and is taught to every student pilot on day one.
All the coverage of this event is pushing a narrative. Just report the facts dry please.
1
How could someone design a plane that needed a system like MCAS to fly properly?
6
Shame that Boeing has not discovered this years ago.
So 346 people are dead because of the incompetence of Boeing.
2
We are not witnessing the dawn of the age of flying. Max 8 is aerodynamically flawed. The MCAS lipstick on this pig doesn’t work. Boeing knew the flaws and they don’t want to talk about it:
“In conversations with pilots and airline officials over the weekend, Boeing executives didn’t directly address why MCAS was designed with such flaws, one person with direct knowledge of the meetings said.”
And we have a clueless FAA watching after Boeing has killed over 350 people.
6
Something very important to learn from these 2 fatalities.
A 'Heads up' or 'Awakening'...call it whatever!
Closer scrutiny between the relationship of big business corporation & government regulatory agencies.
"Artificial Intelligence" is replacing human control/input...considered the weak link & root cause of accidents. In their enthusiasm the design "Gurus" must exercise extreme caution to design a product with public safety being priority #1! Wanted: Extreme imagination!
Next area of intense scrutiny...Self Driving Autos!!!
1
If there is only a forty (40) second window during which MCAS can be disabled, then maybe that system should be upgraded to the standards of the Primary Flight Control (PFC) system. Currently it is assumed that MCAS would be disabled by the pilot if it failed, and the plane would still fly safely. This meant that Boeing does not have to rely on the more stringent standards used in the PFC.
Every part of the Primary Flight Control (PFC) system would require a total of four (4) Angle-of-Attack (AoA) sensors, instead of the two (2) currently used by the 737 MAX 8 MCAS control system. One would be a redundant sensor dedicated to deferred maintenance (i.e. if it fails, the airline can wait up to ten (10) days to replace it). A second would be assumed to fail in-flight, and would ground the plane if it fails. This leaves two (2) good sensors for the MCAS system.
According to Yeh (1998): "The triple-triple redundant PFC architecture, triple channels with triple dissimilar lanes in each channel, has been described [14]. The PFC can be dispatched with one failed lane: maintenance alert is generated for maintenance attention. The PFC can also be dispatched with one failed channel: flight deck status message is generated requiring replacement of a PFC channel within three flights." (p. 3)
Cite:
Yeh, Y.C. Design Considerations in Boeing 777 Fly-By-Wire Computers. Boeing white paper (1998, undated). From: yeh98_777-fbw.pdf
1
For those keen on blaming so called "third world pilots", read this NYT piece on how pilots in Asia air crash, due to lack of info from Boeing, had no idea what was happening:
https://www.nytimes.com/interactive/2018/12/26/world/asia/lion-air-crash-12-minutes.html
1
Absolutely ridiculous and reprehensible on Boeing’s part. I used to have a tremendous amount of respect for one the most successful, dominating corporations in history. Leadership responsible for the hastily developed 737 max should be thrown to the curb.
2
Still "trying to determine what went wrong"?!?! What deadheads at Boeing and the FAA
40 seconds to identify, diagnose, and solve a problem, that will kill you and everyone around you, without having any training? Count to 40...1 one thousand, 2 one thousand...Try to do anything compex in that time.
2
The more you learn, the more irresponsible Boeing appears
After designing an aeronautically inherently unstable passenger plane, the company covered it up with a badly designed software patch without fully informing the pilots
A criminal investigation is called for
5
I am so furious!!
This is what our lives mean for Boeing, the FAA, and the airlines: nothing.
356 people died just because Boeing wanted to make more money, airlines wanted to save on expenses, and the FAA, well, I guess the FAA couldn't be bothered about this particular issue. Perhaps there are so many issues with modern planes that they don't know where to turn their heads. Or worse, maybe they are just corrupt, or stupid, or... the words are failing me.
At the moment, I have decided, no more flying on Boeing planes. It's a vow which I intend to keep for the rest of my life. And I will tell people all around me about this story so they too will avoid these killing planes.
1
While 40 seconds doe not seem too long - try counting it like 1001, 1002 etc.
That's pretty long.
On CNBC today, Mr. Crandall who ran American Airline many years ago - he is 80 plus now - was asked his opinion on under what circumstances he would allow Max to fly.
He said if pilots and unions think it is safe, that's the first step. Then if FAA and other governments buy into it - it's good to go.
He also said that it is clear that training and experiences of pilots mattered. If folks could land a simulated Lion - under same conditions, surely it's not only the system.
Ethiopian co pilot had a total of 200 manhours, period.
In America, it takes almost 6 to 8 plus times more hours before they will allow you in a cockpit.
I think training and experience appear to be leading causes of these crashes.
And this is not surprising.
Over 90% of crashes are attributable to pilots errors - deliberate, unintended or simply uninformed.
Let's wait till we know more before start calling folks names.
All are doing level best to address these issues.
2
@Neil
Yes, had the pilots known about MCAS, they may have been able control the plane. If there is a possibility that the Ethiopian pilot was still unaware of the system following the lion air crash, it is a failure on so many levels, beginning with Boeing.
1
IMHO, this will become a business school study in how Boeing has totally failed to deal with the PR aspect of this crisis.
Boeing is restricted from talking about the accident investigations because they are part of those investigations.
Boeing should have come out and talked about why they have an MCAS system and the problem it was designed to overcome. They should have admitted that they made a big mistake when they designed the MCAS to respond to only a single AoA signal and they should be explaining right now about the changes they are making and how they will enhance safety.
Boeing has allowed all kinds of incorrect statements to be made in the media that has allowed hysteria about the Max to grow without correcting the media sources.
Boeing should have taken the initiative to educate the reporters and assist them in being factual. Why has Boeing or one of the airlines not had media representatives in a simulator to video what pilots should have done so that passengers could see for themselves what was involved.
41
@Bob in Pennsyltucky
They did not talk about it because the real reason is a design flaw in the plane. The engines are to big and forward for the almost 50 year old airframe. Basically, the software update is to counteract a possible stall because of a questionable design (due to not wanting to change so they could declare is a similar plane and not require training)
12
@Bob in Pennsyltucky
Unfortunately, it has been a business school case study for over a decade.
One of the world's leading business school professors, Dr Theodore Piepenbrock of MIT/Oxford/London School of Economics spent the best part of a decade working as a consultant to Boeing's most senior leaders (CEO, VPs, GMs, etc.), teaching them his award-winning theory on "The Evolution of Business Ecosystems", which Boeing gave the code name "Red vs Blue". His PhD on "RvB" was one of the largest and most downloaded dissertations in the history of MIT.
"RvB" predicted years ago that the 787 Dreamliner would be the biggest financial disaster in Boeing's history, with interim losses exceeding $50 billion, which many reputable newspapers (e.g. WSJ, The Economist, Seattle Times, etc.) have since verified.
"RvB" also predicted years ago that the 737NG replacement could not be both economically and physically viable. In fact, Dr Piepenbrock has stated over the years that Boeing airplanes could systematically begin to fall from the sky before 2020. He ultimately terminated his contract with Boeing due to his ethics concerns. Although a number of journalists at major newspapers are aware of this story, interestingly it remains unreported.
As an aside, Dr Piepenbrock who is known for his ethics, was forced to sue the LSE, for its cover-up of a female stalker who exposed herself to him, and when he complained, she made a false and malicious grievance against him, which the LSE believed.
6
@Bob in Pennsyltucky And the CEO asked trump not to ground the planes in the US. He should be forced to step down.
3
If, as the article states, “In the tests, a single sensor failed, triggering software designed to help prevent a stall,” why is so little attention focused on that “single sensor”? If the sensor hadn’t failed, the computer wouldn’t have gone haywire, and the planes wouldn’t have crashed.
By all means, fix the flight control software. But give at least as much attention to the accuracy and reliability of the sensors whose outputs feed into that software.
3
The problem wasn't that the automated systems in the planes that crashed could not be controlled by their pilots--it was that these particular pilots lacked the training to control the systems. That doesn't mean that the systems shouldn't have been better designed for safety from the outset. It is unconscionable both that the systems were so inflexible and that the pilots were allowed to fly the planes without proper training in those systems. But, regardless of whether you want to rely on automation or do away with it, you need pilots who have the proper training. Doing away with automation doesn't solve that problem.
2
Boeing should not have concealed the existence of MCAS. Nevertheless, even though its existence was concealed, there was one pilot who knew how to manage MCAS on the Lion Air flight before the one that crashed. That strongly suggests that pilot error is at least a part of the problem. The other part is going to be corrected once the software is updated.
I see a lot of people saying that this plane has a faulty design, but it's flown tens of thousands of times without any problem.
Once the software is corrected, I will be much more interested in what pilots will think about the safety of the plane, than in what thousands of non-engineers and non-pilots, will say.
@Sue Pearlative
The Times' coverage of this problem has not been balanced. Alongside the valid criticisms of Boeing's business actions, and sensationalist headlines like the one with this article, we've heard very little from probably thousands of engineers who would say that the plane's design, from and aerodynamics point of view, is safe.
Two issues in aviation today: 1) pilot reliance on technology rather then pilots flying the airplane and 2) limited training on new technology because because it's deemed "safe" and the company wants to get the plane to market.
Both of these issues kill people.
4
The money Boeing should be fined must be more than sufficient for the FAA to hire and retain a cadre of empowered systems, software and aeronautical engineers. There is no reasonable alternative.
5
@John
What did they do that was illegal?
This story reminds me of what happened to Britain's pioneering Comet passenger jet in the 1950's. There were two crashes due to catastrophic structure failure. It turned out that the square shape of the windows was a big part of the problem caused by the pressurizing and depressurizing of the cabin. The planes were refitted with oval windows and went on to have a good service life in the RAF. But the damage to the prestige of De Havilland (the manufacturer) was devastating.
2
This is the essence of libertarian free market capitalism. If enough planes crash, the buying public will not purchase the seats, forcing airlines to stop buying lanes, making Boeing change their product. No need for government interference and over-regulation!
I assume that advocate of such a system will be first in line to fly on the 373 MAX with Boeing's fix, certified by Boeing's reassurances.
7
@Interluke
And all it cost was a few dozen lives, paltry in the face of huge profits. It is American Exceptionalism!
1
As described, the software seems somewhat basic, relying on information from only one of two angle of attack sensors. Shouldn't a mechanism that drives the front of the plane down receive information from a altimeter or some sort of altitude information to prevent ground collisions? What happens when altimeter data conflicts with angle of attack data? From the information given, the software doesn't seem to be very well written.
4
@Jun H
American Capitalism calls for lots of profits at any expense. Only when it is obvious that profits will be lost that improvements are deemed necessary. Everything else is secondary. Everything else is godless socialism.
Some people surely need to go to jail for this. Their crime is homicide and endangering human lives. The chief engineers who designed the MCAS override system should be charged with reckless disregard for human safety. The executives who approved the MCAS should be charged with criminal negligence. The FAA officials and their delegates too should see jailtime for oversight failure. The public should not have to suffer from these kinds of fatal manufacturing defects. Putting these people away for a long time will show others to exercise more care for other people's lives.
5
“Before the Lion Air crash, Boeing and regulators agreed that pilots did not need to be alerted to the new system, and training was minimal.” Their complacency cost more than 300 lives. This is negligence, pure and simple, and arguably criminal.
As far as I am concerned, the Boeing 737 Max 8 is cursed forever. I never want to fly in one again, software update or no software update.
5
I'm disappointed in the NYTimes over the headline and tone of this article. There are many failure scenarios on any airplane where the time to diagnose and respond to the problem are similar to the one being discussed here.
One of the reasons that aircraft are extensively automated is to compensate for the limitations of human beings. We're ill equipped to monitor complex systems for long periods of time looking for low-probability events such as this.
I'm not defending Boeing, clearly this was questionable engineering compounded by poor management and ineffective regulators. However, I think this is a good example of how the media can subtly spin the facts in the quest for sensationalism.
5
@Tony How is the NYT spinning this one? To the contrary, NYT journs have done excellent investigative journalism on Boeing's shoddy work history with regards to this particular aircraft.
2
@Tony
It would be interesting to hear examples of failure scenarios in which just 40 seconds is available to diagnose and respond to a flight-critical problem. For Flight 1549 (Sully), the NTSB simulation allowed 35 seconds for pilots to recognize the problem (both engines failed due to bird strikes).
I could have sworn it was just the other day the FAA and Boeing were telling us how great and safe this place was. (after the two crashes). Sad that integrity that takes decades to build is spent in a day.
1
The main problem with MCAS is that it cannot be disabled manually. Pilots must cut the power to the stabilizers so MCAS cannot fiddle anymore. Once you learn about MCAS the procedure looks ridiculously simple. But if you are not aware about MCAS - and the autopilot and autothrottle are off - is almost impossible to guess that there is a `second autopilot` that controls the plane and you have to cut power to some system in order to regain full manual control. The question is... who said that minimal training is needed?
5
@Catalin, that procedure, for runway stabilizer (which is what MCAS causes), has been a memory item to be certified to fly a 737 for years. This means you have to be able to recite them, rote and are expected to keep up and practice them. I don't know when the switches were first installed, but one poster says 1967, and I have no reason to disbelieve him.
Malfunctioning MCAS causes runway stabilizer, but so can the failure of other systems as well.
1
Let me understand this. The pilots had 40 seconds to fix this emergency. Is this going to be the normal fix with proper training on how to handle this? Or will the problems not occur in the first place?
@Phil M: There should be fewer occurrences of the problem, since two sensors will now be used rather than one and excessively divergent sensor readings will be ignored. And there will be more training for pilots, which should reduce the time needed to correct the problem. Also, the system as currently modified responds "less aggressively", which I think refers to limiting the automated correction to an extent that that can be manually corrected by a pilot. And the system as currently modified responds "less persistently", which I suppose means that there will be some limit (unspecified here) on how many times the automated system will attempt to counteract corrections by a pilot. The system still has to be reviewed and approved, so the final version may differ from the version as currently modified. Also, presumably the system will be left operational to an extent that will allow it to correct the problem that it was originally intended to solve.
6
These tragedies were not the result of pilot error. This was the result of an engineering error and poor management decisions. It reminds me of the Challenger disaster. When engineers fail to account for all possibilities and management makes bad decisions for financial or scheduling concerns, innocent and unsuspecting people die.
7
@Keith Wagner ....and this conclusion is based on your full examination of the evidence coupled with you commercial pilot's certification and your engineering degrees.
I have no aviation training or experience, however I'm astonished that there isn't a single switch to shut down all the automated control systems and allow the plane to be flown by the pilot.
3
There isn't in your car either. And often when you think you shut off the systems they are still working.
Seems the rest of the World is realizing that our once trusted government has all but been gutted by the Capitalists and Corperatists with help from the Right and middle America.
It is owned and controlled fully now.. and just so shareholders can keep winning while the rest of us go hurling towards our graves. In this case... Literally.
Why does nobody seem to recognize all the amazing feats that got us?... Safe water, roads, defense, the Internet, highways... On and on. If we did we would have protected the FAA and not let Boeing take them over.
Failure of society here is all to see.
5
@David and that was all paid for with taxes. Meanwhile 50 years of GOP tax cuts have given us 22 trillion in debt, destroyed our infrastructure and gutted our education. No wonder we reap what we sow.
3
The cockpit instruments in any aircraft should be just that. Tools that give pilots information and warnings if something isn't right or the aircraft is about to enter into an unsafe condition so that pilots can take corrective action. No automation should ever take the decisions away from pilots.
Machines don't die. Pilots and passengers do.
3
It's terrifying to read that pilots had 40 seconds to avert disaster, with no training to help. Flipping through a handbook in those final seconds of life? It's horrible to think about what went through the minds of the pilots. Machine over man- no thank you!
7
First, fly the plane. If you suspect a malfunction, disconnect the system, and fly the plane. Time to disconnect -- ten seconds at most-- that's why there is a pilot there!!
Automation is great-- except when it does not work.
4
@Chris Anderson I think you failed to grasp the essential point. There was a second layer of autopilot that was tricky to shutoff. Fly the plane all you want, but if the auto pilot is getting faulty data from a faulty sensor... and you don't know how to shut if off... it's hard to stay in the sky.
3
The more articles I read about Boeing, the more terrified I become. The pilots did their best, but didn't stand a chance. I drive by Boeing every day on the way to work. For the rest of my life, I will do my best to avoid flying on any of their planes. Profits were prioritized over people's lives.
5
@Second try failed we don't know what happened on the ethiopian plane. The airline has said that after the Lion Air crash, their 737 Max pilots were specifically trained on how to deal with the same problem, and if that is so they should have been able to recover. That may be the biggest mystery here.
If they were trained, and did what they were told, and the plane still crashed, then the problem is way worse than Boeing is admitting. On the other hand, we have seen, in the Air France airbus crash, than an inexperienced copilot can bring a plane down (and he did it by doing exactly what MCAS is designed to prevent, a self-induced stall). it is still too early to draw final conclusions, and that plane should not be certified to fly again until we know why the second one crashed.
2
It is criminal that this happened once let alone 2x killing over 350 people. The Boeing response to the first crash should have been to ground the plane and work out the issues, which given the information they had pointed to the MCAS system early on. Instead, they tried to downplay the issue and suggest it was a lax airline and crew that was at fault. The current top management is a complete disgrace and should be replaced, while the basic safety culture should be reviewed top to bottom. The idea that a malfunction of a single system can bring down an airliner is totally unacceptable and goes against 60 years of their bedrock engineering principles. Obviously, the compromises needed to make the MAX from the existing NG airframe and the compressed time frame they were working under ( owing to the head start of the A320 NEO) made for poor choices. No doubt, the fixes will make the MAX a success but the tragedy is that so many people had to die to make it happen.
5
And the costs of the crash and litigation will surely cancel out any supposed savings. Boeing didn't have the time to do it right, but now has the time to do it over.
I just flew a drone for the first time. Or rather I nudged these little levers and the drone flew itself. Surely that sophisticated software somehow has a place in aviation. Maybe it's time to rethink all of the aviation industry.
This is a typical bureaucratic problem which will be solved by the typical bureaucratic answer...fire the innocent and promote the guilty.
2
The Stab Trim switches on the 737s have been there for more than 50 years but the MCAS is the new “improvement”. Any experienced 737 pilot at my airline remembers the simulator exercise. When the Runaway Stab Trim began, you disabled it with the power and control switches, extended the manual handle on the beefy wheel on the center console, and cranked it to a suitable setting. Muscle memory is real.
Maybe if the captain in the first accident or the maintenance department had rejected the aircraft, then the discovery could have been circulated industry-wide. The preceding flight crew had reported the same experience.
If there is any good to come from these fatal crashes, it’s a good time for airlines
(1) to reexamine their Minimum Equipment Lists for current waiverable repairs,
(2) to develop in their flight crews an awareness of the importance of distinguishing between inconvenience and the danger of flawed aircraft systems, and
(3) to realize the byproducts of pilots’ limited exposure to system failures due to more reliable aircraft, limited years of experience, and the balance between “Can Do” and “No”.
Hundreds of these 737 MAX aircraft have been flying around successfully for years with dozens of foreign and domestic airlines.
All cockpits are a virtual museum of aircraft systems, whose development started with a crash.
9
@bobbogram. Since you have some familiarity, how many seconds before the runaway drives to the end stop, and how many turns of that little wheel to bring it back to level or even beyond? The time elements are: understanding that it’s an MCAS problem not something else (and as built, no MCAS operation indicator!), avoiding using the yoke switch to shut the trim drive; then realizing that the bugger has rebooted itself, going to the console switches, and then turning that wheel how many turns, and then using the remaining engine and elevator controls to actually not auger in. The sim was run at higher altitude than Lion Air had, but the MCAS could go rogue at any altitude whatsoever. Killer.
2
@Marat1784
According to the Press reports, the MCAS is inactive with the flaps retracted. I presume the air show began after flap retraction on takeoff.
An old axiom in aviation - after moving a control or switch and something unexpected occurs, return that control or switch back to its original position. If true, that would have solved their problem.
The simulator can have an artificial atmosphere or the instructor can advise the crew about what is about to happen. The REAL emergency is more of a surprise.
The first rule in any emergency procedure which normally produces a loud bell or alarm or voice instruction -> SILENCE THE NOISE. It produces a better analysis and crew coordination. The ambient noise in the cockpit along with the Stab Rim Wheel noise would be pretty annoyingly loud and not controllable.
Another Press article said the AUTOPILOT would override the MCAS.
So aside from the MCAS unexpected actuation, crew rest, crew recent experience in model, maintenance records will be examined, the airline training syllabus will be looked at, and other pertinent aspects will be examined thoroughly.
But it seems like there were solutions other crew(s) had employed to regain control of their aircraft. Whether their response was instinctive or taught, we’ll all soon know.
1
I'm surprised the words "criminal negligence" do not appear in this article. There appear to be people who could use some serious jail time to cool their jets.
6
The pilots had less than 40 seconds AFTER they already knew what the problem was. Imagine having to try to figure out the problem first and then react in less than 40 seconds!
11
Sounds like Boeing and the FAA institutionally had a breakdowns. Boeing's arrogant assumption of technical prowess led to rushing into service highly flawed technology compounded by a lack of disclosure and training. The FAA which traditionally set the global Gold standard for safety and testing has had catastrophic failure in carrying out its basic responsibilities. Of course, as bad as the situation is, starting with the horrific deaths, one hopes the disasterous actions of these two formerly respected organisations didn't come down to trying to force through sales and profits prematurely.
5
@Niall If you have watched the news for the last decade you might have noticed that with the greatest generation gone. America has suffered an institutional breakdown. You can barely point to anything that works properly. Good thing we saved the rich all that tax money and didn't spend it on schools, or roads, or bridges, or....
2
The most penetrating question is: Why did the Boeing pilots who presumably tested the new MCAS system on a simulator and the Boeing/FAA safety inspectors who finally approved its implementation -- including no need to notify or retrain pilots -- not "fully understand how powerful the system was" and that pilots would have "less than 40 seconds" to shut it off to prevent a fatal dive? Surely these characteristics would have been discovered during routine testing and approval?
Boeing and the FAA stand condemned both if they knew about the deadly condition and implemented it anyway or if they failed to discover it through basic safety testing.
Their reputations for safety are in tatters. Passengers are left to wonder what other critical systems on Boeing's newer aircraft have received such eyes-closed rubber stamping based on prioritizing corporate profit over human life?
13
@Nick Wright they probably didn’t test the system in the sensor failure condition. They probably didn’t realize the airplane crashes itself when certain sensors are broken in a particular way. But after the Lion Air crash, they knew, which is why this article asks the even MORE penatrating question - was Boeing’s revised procedure at all safe or worthy of certification? Answer is no. That’s their big problem here. Huge. After Lion Air, these people were at a known risk. A relatively high risk. Unsafe procedure. From my armchair as a non-pilot.
1
@rjs7777: Why would they not routinely test the software in a sensor failure condition, since the activation of the software is entirely dependent on the reliability of the sensor data? Modern aircraft systems are designed with multiple layers of redundancy; allowing an automatic system, whose existence and effect are unknown to pilots, to depend on readings from a single external source goes against every tenet of aircraft safety.
2
I can only imagine what the pilots of the two doomed 737 Max 8's were going through as they tried to wrest control of the aircraft to avoid a crash.
Added to their own alarm must have been the sound of the programmed alarms. I've often thought that those loud alarms must make an extremely tense situation worse, and that much quieter versions, voice or otherwise, would help the pilots sort things out. They already know they're dealing with an emergency situation. Why make it worse?
9
If Boeing's software system has caused two crashes and prevented zero crashes, why are they still trying to finesse it into working instead of removing the killer?
I wouldn't wanna be Boeing, this is gonna cost them billions of dollars in wrongful death payouts, lost sales, and ruined corporate reputation. Yet they do not address this problem logically — if it's new and it disimproves the situation, don't try spackling over the issue: eliminate it!
4
@T. Chandler .
The conclusion you have to come to is that without this system, the airframe is too inherently unstable to be safe ...
I'd like to know under what circumstances the MAX "noses up". Not just "if" , but "when" - addition of throttle/thrust for instance.
2
@Fred Mueller
This link will give you some answers.
http://www.b737.org.uk/mcas.htm
1
Sounds as though the MCAS is an idea whose time ought never have come. It also seems that the entire way this was handled by Boeing, and the avoidance of pilot training was a disaster waiting to happen. And the FAA rubber stamping the process is disturbing, to say the least.
3
Why wasn't the FAA all over this immediately? Oh, that's right. The government was shut down. Oops. I guess the failed attempt to hijack money for the useless wall on the Mexican border was more important than saving people's lives. #PolicyPriorities!
6
Actually, this whole boondoggle predates Trump and his pointless wall. However, it does pertain directly to the Republican-led "war on (big) government", and its resulting handover of corporate oversight from regulatory US agencies to the corporations, whose only responsibility is to make money for their shareholders. Under the guise of returning power to the people, the watchdogs in the government have become lapdogs for corporate America. The FAA has a long way to go to catch up to the 20,000 American lives lost to OxyContin by the FDA (Thanks, Sacklers!), but if they keep taking people out at about 200 per episode, they could just catch up.
The designers and engineers at Boeing aren't idiots and almost certainly realized how powerful the MCAS system was, and that reliance on a single AOA sensor was inappropriate. They probably advised management of their safety concerns in writing but those were dismissed or considered less important than saving money on the plane and pilot training. If so, I hope it all comes to light with the several investigations underway, and the managers responsible up the chain fired.
16
@Mman1
Just fired? How about locked up for manslaughter?
The video explanation is good: like two boys on a seesaw, each has to be in the right spot of the fat one lands with a big thud.
1
"... that the 737 Max has had both sensors already, why the system was designed to rely on a single sensor, creating, in effect, one point of failure."
This is the height of post modern, post truth era of endless corporate greed.
Maybe soon the cars would also start charging you money for activating your hand brake ( already installed) and activating power steering (when turning left and right separately, or activating your brakes to one or all of your wheels. Make no mistake if they can they would.
This is the new face of innovation- How to slice and dice a product's features to milk money from customers.
What about safety ? - the new mantra is one can tout the past (record )to make some real money now and obfuscate the issues well known even to amateurs. ( why else would they be working on this MCAS fix for months)
Boeing and FAA should come out and apologize unequivocally and pay the damages to families who lost their loved ones because of their greed and stupidity.
And then they can try to work on some real solutions.
4
@Harjot Kahlon These problems are coming to the road. My friend with a new Subaru was telling me how if a person is breaking to turn right, and he goes left over the line to pass them, and comes near them the car will break hard, which is not at all what the driver wants or expects. That is only one tiny example of smart cars not doing what we expect. This technology will cause accidents. I've almost had a couple of accidents because of related quirks of technology in an Acura and a MB.
And we're still not discussing the root cause of all of this: Boeing built an aircraft that required MCAS to compensate for a design that causes the plane to pitch up.
It doesn't make sense to me to build an apparently non-airworthy vehicle and then have to write software to compensate for the design flaw(?). Remove MCAS from the Max and what do you have? A plane that don't work.
35
@A. Jubatus
consider the possibility that the sensor information causing the dive were hacked remotely. recall how the iranians took over a US drone and landed it....
This is, clearly, a horribly misconceived scenario within the software. I believe we are getting close to the root cause of the accident(s). I also believe it may be feasible to do a software fix that cures the problem. This problem was not because of aerodynamic instability; it was a sensor malfunction that led to an apparently evil autopilot error. There is a long history of computer controlled flight and it is not by definition unsafe or bad. Boeing has a problem here and I believe it will be fixed through software. The armchair experts saying the 737 is fundamentally unsafe seem to misunderstand the professionalism and standards already engaged for those questions. This isn’t amateur stuff and feelings don’t matter.
5
Fundamentally unstable, not unsafe. The fix mitigates the risk of a critical safety item, it does not remove the cause of a single point of failure. There are multiple systems engineering lapses at work in this case.
2
@rjs7777 Problem is, after Boeing KNEW about the problem, and was working on an upgrade they denied the problem in public. Even after the second crash was similar to the first. Mistakes always occur in engineering. Reputations are lost on denying them.
I have several friends in Seattle who work for Boeing as technicians (welders, electricians...) who have been making tons of money for YEARS with overtime. They work 10 hours a day, 7 days a week continuously, non stop, motivated solely by the easy extra money. No wonder quality goes down the hill.
4
@MP True story. I met a Boeing shop floor employee who hard worked for three months (voluntarily) without a day off.
Isn't this really a case of a company trying to correct a design flaw without correcting the design? The 737 Max design is simply flawed and should be completely redesigned. The size and position of its engines make it an un-airworthy plane. Personally, software fix or not, I would prefer not fly on one of these planes, ever.
21
There is nothing here that gives me confidence. Boeing, a highly respected company, has lost all credibility. Meanwhile the FAA has lost its shine letting this plane fly in the first place. Now we are to trust them that a second new and improved software fix to a gerry rigged plane will now work. Boeing is now desperate to get the Max 8 and 9 back into the air, as they have no alternative with the amount of orders placed for this aircraft over next several years. Meanwhile, who in their right mind would place their lives in the scenario presented in this article? Pilots manually turning a wheel to make adjustments? Really?? We will be force feed this kluge jet since Boeing’s stock will tank if the FAA does not approve it soon. Does anyone think that will happen. It will fall under acceptable risk. The count is 0-2, what’s the plan for when the 3rd strike happens?
8
@JCGMD Much has been said about how terrified the pilots must have been those last few minutes. What about the passengers with the plane bouncing up and down until it crashed? Terrified doesn't even properly express their feelings. May they all rest in peace.
I'm glad I currently live in Europe where this model of aircraft will never be allowed to fly. The test pilots can continue enjoying their time at the Boeing but the global market for this aircraft is now gone.
12
I read in Sunday’s New York Times that, prior to Boeing creating the 737 MAX 8, Airbus had modified its workhorse A320 into an A320neo, a plane with larger, more fuel efficient engines, the same thing Boeing eventually did with the 737. James F. Albaugh, Boeing’s chief executive of the commercial airplanes division, had criticized Airbus’ modifying the A320, saying that it “could alter the aerodynamics and require big changes to the plane.” “It’s going to be a design change that will ripple through the airplane,” he said. That certainly proved to be the case the Boeing 737 MAX 8.
What I didn’t read in that NYT story—and haven’t seen elsewhere—is whether the A320neo actually did have aerodynamic problems, as the 737 MAX 8 did. If it did, how were those problems solved? Did Airbus use software, as Boeing did for the MAX 8? Did Airbus inform the airlines and the pilots of the changes in the behavior and handling of the A320neo? Did airline pilots test those changes on a simulator first, before they had to deal with life-threatening issues in the air? Did the FAA (Federal Aviation Administration) fully certify the A320neo? Or did the FAA leave some of that responsibility to Airbus (as it did with Boeing)?
15
So Boeing charges airlines extra for certain safety features? A second sensor. A light to tell pilots when the two sensors don't agree. Because providing you with a choice of safety options is a number one priority.
Coming soon. The super sucker saver ticket. As an enhanced safety option, seat belts are offered for just $25 ($35 with buckles) at time of ticket purchase, or directly to passengers for an on-board convenience fee of just $100.
13
The software changes still require approval by the"Federal Aviation Administration"
- is that a euphemism for Boeing
9
This is even worse than previous reports had led me to believe. What's described seems to me to go beyond mere negligence on Boeing's part into outright criminality. It's not merely that the pilots were not trained on the new system (bad enough), it's that THEY DIDN'T EVEN KNOW ABOUT IT ("the 40-second window ... may still not be enough time to diagnose and solve the problem ... if the pilots, like the Lion Air crew, were not informed of the system."). Not informed of the system. Think about that. Combine that with making the computerized system so powerful that, in less than a minute after malfunctioning, it could not be over ridden by human stick and rudder flying -- sending the aircraft into an irreversible dive. You can't solve a problem if you can't even conceptualize -- visualize -- it. And without even knowing that the MACS system was on board, no amount of "flipping through the manual" would have led to a solution -- let alone 40 seconds worth. Surely there must be some criminal liability here.
40
If you ever built model airplanes you'd understand that you almost always have to alter the center of gravity to improve its flying characteristics. This is typically done by attaching whatever is readily available to the desired location; this is typically a paperclip or a small piece of gum. Of course you now have a slightly heavier model, which of course has its own set of consequences, but it's a flying model just the same.
Isn't technology just wonderful?
1
Assuming mcas engaged on the Lion Air flight because of the faulty sensond (given that that plane wasn't grounded after the previous flight as it should have been), why did mcas engage on the Ethiopian Airlines flight? Reports were that the plane was flying too fast. Could that have triggered mcas?
Boeing and FAA has a lot of explaining to do!
7
It is incomprehensible to me that the Boeing CEO and other senior managers have not resigned or been fired. Such titans receive multiple millions of dollars in salary and bonus which I thought were supposed to be performance related. If you preside over the loss of 2 preventable crashes then where is the accountability for such catastrophically poor performance?
20
@Pa I agree. Your post made me write Boeing about that.
It’s time for an independent, outside design review of relevant aspects of the Max series. MCAS was clearly a hack (single sensor, hard to over-ride, dynamics not understood, aircrews uninformed). What else in the design got similar treatment? If the FAA and Boeing fail to bring in acknowledged, independent experts, perhaps the European air safety regular will do so.
17
This same kind of scenario will ultimately find its way into the self driving vehicle industry. Some sensor will be flawed and some software will make the wrong decision.
10
What I would like to know, and still haven’t seen, is data on the number of times pilots of the Boeing 737 MAX have experienced these potentially catastrophic problems and recovered from them. Surely the two disasters we are now examining aren’t the only instances of the terrifying failures built into these planes.
8
@RipYes, I read that the day before the latest crash that another plane was saved by a pilot who war riding on the plane as a passenger who showed the pilots how to save it. There must be a few more cases of the "sensor" malfuncting. How many?
2
The basic problem that required the MCAS system to be deployed remains unaddressed -- the design of 737 MAX series of planes is flawed. Boeing in its hubris was caught flat footed by Airbus, and had to retrofit the 50-year 737 old air frame to create the 737 MAX, creating an aircraft that is a global risk. What is shocking is that they have an order backlog of over 5000 planes and are producing over 50 a month.
The only way to stop endangering all of us is for us to refuse to fly on the MAX jets. Only then will Boeing and their airline customers listen to us.
15
@HKI've already made that decision not to fly on one.
Any pilot knows how to disengage the autopilot, but was that enough to override MCAS? How Boeing got away with designing a system that has a single point of failure, and makes it strong enough to override the pilot's input, then doesn't tell anyone about it, is literally incredible. I think Boeing is in grave legal jeopardy for their focus on income and industry prominence over basic aircraft safety.
38
Everything I have read so far has indicated that MCAS is only active when the Autopilot is OFF.
4
@Airpilot There is no switch for MCAS, though it turns on only if the autopilot is off, the flaps are up, and the stab trim switches are on. Change any of those and MCAS is disabled. But you can't do that if you weren't train that it exists, let alone how it works.
3
I have read all the comments here about regulatory failure. But, is that not the case throughout our entire government. From Congress to Education to Interior, all departments have the foxes guarding the hen houses. The predictable results may not be as obvious or as dramatic as two plane crashes, but more people may die unnecessarily in the long run.
19
Why are these tests being done _after_ the plane is sold?
7
It's my understanding that in order to avoid pilot retraining for the MAX, Boeing developed MCAS to make the MAX fly more like the older 737 models.
If so, why not just remove MCAS entirely and retrain pilots?
I personally will not fly MAX unless MCAS is removed. If many consumers feel this way, it might make more economic sense for Airlines/Boeing to remove MCAS and pay to retrain pilots.
4
@Chris They had to install the MCAS system because they modified an existing airframe in such a way as to make it inherently unbalanced ie larger engines and higher mounting of the engines, which was not compatible with the existing 737 airframe. This was done for cost and time saving reasons, so they could get the 737 Max to market before Airbus could offer an alternative.
This is a perfect example of why we need more, not fewer federal regulations and oversight.
10
@Chris. No. The MCAS is there because the plane itself has a stability issue and can’t safely be flown manually without a high level of pilot effort. The new engine placement means it can nose up and stall under power, something that no prior airliner would do. Something like making a car with steering geometry that doesn’t try to return to straight ahead by itself, but vastly more dangerous.
6
@Marat1784 Hi Marat and Loyd. So even if MCAS is removed and pilots are trained to fly with the odd center of gravity, then the MAX is still unsafe?
Well I guess I will just avoid the MAX altogether. It’s sad because I used to really respect Boeing and their commercial jets.
Never fly 1.0 software without a quick disable. I guess Boeing is learning it s in the software business and finding it out the hard way.
5
I'm glad to see that at least the commentators are starting to see the fundamental problem: it is not just the software that was flawed, but the plane itself. Who wants to fly in a machine is that is just inherently unstable? If it takes constant adjustments by software to keep a plane flying (or constantly super alert pilots over the duration of long flights), I personally don't want to be on them.
17
@Glenn Well no, I don't think that's really the problem. The instability only comes into play in certain circumstances that are unlikely to occur inside the normal flying envelope. It's really an edge case, and certainly something that pilots could be taught how to adjust for. Problem is that would require pilots to get a separate certification for the MAX, something Boeing and its airline customers wanted to avoid because it costs money. Hence MCAS which automatically adjusts for this scenario and thus makes flying the MAX "feel just like" flying the prior generation. The real issue is MCAS reacting to erroneous inputs (e.g., only relying on one sensor) and the lack of disclosure about it to pilots.
1
Which is it? "Just moments" or 40 seconds? The two are not the same! If an engine fails, I have two seconds to diagnose and take the appropriate action. THAT'S "just moments". Or if I suffer a rapid decompression, I have 5 seconds to put on an oxygen mask, and another 10 seconds to execute a checklist from memory to begin an emergency descent. Even that is a bit longer than "just moments"!
@Steve The MCAS system engages for 10 sec. If disabled through the thumb switch, it reengages after another 5 seconds. After 3 such events, the aircraft enters an unrecoverable phase. So, now tell us, how much time does the pilot have? 10 sec of pulling up the plane, and 5 sec of stability? The full 40s is not available to figure out stuff.
6
@Steve
If you were on an airplane traveling at 500 mph, fighting for control...would you be parsing the difference between moments and 40 seconds? Niether is enough time to overcome a problem you don't have enough information to correct, and can end in certain death for everyone on board!
1
@Steve. They also, according to the Times, made oxygen masks for the cockpit optional add-ons!
1
There is a fundamental design problem with this plane that software adjustments are not going to make go away. Boeing needs to acknowledge this problem and either pull these planes, or make a convincing case that this inherent instability will not lead to further loss of life.
10
Modern military aircraft are inherently unstable and cannot fly without software. The fix is improving the software, not starting over, although the latter would result in a better aircraft.
Modern military aircraft also come with ejection seats and parachutes. Should we add those to the 737?
@John Good grief, are you comparing a fighter jet which, by virtue of the requirement of high maneuverability, is inherently unstable (by design!), to a passenger jet carrying hundreds of people whose primary requirement is to convey those people safely to another destination?! I sincerely hope and pray that Boeing and regulators are not using this kind of logic.
For those who are familiar with Boeing and aircraft design the MCAS fiasco is difficult to fathom.
For a safety engineer to overlook a single point of failure, as the MCAS system was designed relying on only one of two available angle of attack sensors, is as unthinkable as a surgeon not scrubbing before an operation.
Also, Boeing was famous for a "belt and suspenders" approach to engineering design (see "Built to Last" by Collins and Porras). The MCAS system was apparently designed on a "tight fit" idea with no belt and no suspenders. Boeing isn't what it used to be.
21
With some notable exceptions, the great American industrialists of the past have been replaced by Ivy Business School graduates whose primary personal characteristic is greed, not a passion for innovation or producing a great product. The MAX seems in essence to be a new plane, and my guess is that it is different from the 737 in enough ways that it never would have even gotten TO the drawing board, let alone OFF it, if the engineers, not the MBAs, had been in charge.
21
@Cowboy Marine Amen. In the electronics business, we used to say "if you're in a rush to ship the product, you'll have to shoot the engineer."
In addition to a flawed design - larger engines move forward and up because they did not fit - to bad software to patch/conceal the bad design, they also used a cheap sensor that has failed twice.
Great algorithm - fly into the ground to resolve a potential stall, disregarding the terrain warning systems. Shouldn't terrain warning supersede a stall warning? A possible stall is more survivable than flying straight into the ground. Indeed, survivable in these two cases where the stall was not real.
Seems like Boeing did not disclose the feature to pilots as that would have signaled a flawed design of the plane.
Imagine adaptive cruise control in a car overriding a vehicle's forward collision avoidance assist system or the lane assist prevents you from changing lanes so you don't collide with the dead dear in the road? Imagine if automakers never informed you of the lane assist feature! Indeed, imagine if the NTSB didn't require drivers to know if ABS brakes are installed and how they work? They're useless if you pump the brakes to avoid skidding on ice or panic by the ABS feedback.
Wouldn't the MAX get even better fuel efficiencies with a properly designed plane with good trim flying characteristics with the new larger engines moved forward and higher and using software to coverup the bad trim with the elevators increasing drag to pushing the nose down. Perhaps adding a row of seats lengthening the forward fuselage would be enough to compensate for the tendency to pitch up.
12
Boeing needs to rethink who is in charge of their company at the same time they are fixing glitches in their software.
7
And yet a Lion Air pilot had success in doing just this. The next pilot is said to have been trained to address it. Not to say Boeing did not make mistakes but pilots have in real cases fixed the issue in real time. The Lion Air plane should have been grounded as well. It will be fixed and we will go forward.
3
It is incomprehensible that the AOA / MCAS Disagree annunciator was an extra-cost option, which customers could decline to purchase, saving about $7,000. That device could certainly have helped the Pilot and FO diagnose the fault in the very limited time they had to solve the problem. Boeing, what were you thinking?
13
Written like a true lawyer.
Changes cost. Who knew the indicators would go bad so quickly? Why are they going bad? Give these planes all two years in the air & pilot experience over that time, and suddenly we aren’t having this conversation. This is a three fold failure- instrument failure, pilot training, non nuanced software. So many of these comments are Monday morning quarterbacking, and we’re not even looking at the right failure. What is going wrong with the sensor ?
7
@John Not a lawyer - I'm an engineer with a mechanical/electrical/DDC control systems design background (and a Commercial pilot).
Transport Category aircraft are provided with Slats / Flaps Disagree annunciators to alert the Pilot and FO to a condition that could result in an uncommanded roll, and departure from controlled flight due to wing flap or slat asymmetry. To my knowledge this annunciator is not an extra cost option. My question is, why wasn't the AOA/MCAS Disagree annunciator provided as a standard feature of this aircraft? Any time there is incipient loss of controlled flight, every bit of information that can be provided to the flight crew in real time is crucial to solving the problem before you run out of altitude.
I agree that the cause of these accidents involves multiple failures, and a comprehensive solution to these failures is needed.
4
One thing intrigues me. Until 737 Max was put in operation all other previous models had no such issues. Why did Boing change the particular nose up nose down scenario for this plane? What advantage did Boing see in this when it is apparent the manual take over had only 40 Seconds to correct the situation. Why was even manual take over necessary? Why were they risking this? This operation could not have been for fuel saving. So what was it for?
5
@Eraven The plane is designed in a way that makes the issue more likely due to a change in the center of gravity in it.
6
@Eraven
From what I have read, the MAX line of 737's has new, large engines, placed slightly further out on the wing than the original 737's. This weight distribution change made the MAX slightly less stable in the air and it seems the MCAS system was meant to compensate for an increased tendency toward stall. Even so, MCAS is remarkably poorly designed, given that it uses only one of two sensors available and is so persistent as to constantly override pilot input.
4
@Eraven My understanding is that a major selling point of the MAX is that pilots of the older 737 models would not need to be retrained because the flight dynamics would be so similar. This is how Boeing marketed the MAX to airlines. However, the larger engines did in fact significantly change the flight dynamics, making it easier to stall. To avoid retraining Boeing developed MCAS to correct for the stall tendency. I think this was explained in the Seattle Times article.
I say remove MCAS entirely and retrain pilots.
2
If there were switches in the cockpit to cut electricity to the elevator (which there were), I’m a little surprised pilots did not know what a couple of random switches were for. If I was flying a complex system such as a modern airliner, you can bet I’d know what each and every switch did.
2
I seriously do not how to relate to this. I understand the basic problem, and that the MCAS has been designed to cope with it.
But how can I ever feel safe flying again, in general, and with a Boeing 737 MAX, in particular? The end to this will be that the 737s will be back in the air, with an improved system. Maybe even three sensors, as proposed by a pilot. But I will know that I am seated in a plane with a fundamental design fault which requires computer systems to correct it. I will know that it will be prone to overreacting which the pilots then will have limited time to correct.
This in combination with the fact that previous reports have described how some of this equipment - like a light/alarm going off in the cockpit should the sensors be in disagreement - is something the airlines must pay extra for.
I will want to see this plane in operation for many years before I will fly it again. I know the public tends to move to new issues and forget, and I suspect Boeing counts on it. But I will not forget. They can say whatever they want, but the fact remains that the 737 MAX is inheritantly unstable.
Everybody knows this. The interesting question is how Boeing will present the facts when they put the plane back on its wings.
299
@Kalle H
I'd wager good money that Boeing will change the branding and re-name it. There will be no more Max-8's it will be called something else, something that will not ring alarm bells.
It's a badly tarnished product, so marketing will re-brand it - just wait and see!
11
@Kalle H
You said, "But I will know that I am seated in a plane with a fundamental design fault which requires computer systems to correct it. " and, "the fact remains that the 737 MAX is inheritantly unstable." Would you be surprised to know that every current airplane being manufctured to carry passengers in the world have design "elements - or flaws, as you determine them" that absoultely require computer systems to deal with them safely? Flying airplanes with cables running from the cockpit to the control surfaces went away years ago. This ariplane is no more inherently unstable than any other airplane flying today, it is that the computer system design did not produce the results that the designers thought it would. Bottom line, every airplane flying today in commercial service is unstable to some degree that must be dealt with by the installed flight control software. To a high degree, every auto also has similar systems. So, to feel safe, maybe you need to got back to horses. Oh, right, they also throw their riders.
8
@Kalle H
@Kalle, I won'f forget either. Apparently, the size and placement of the engines on the Max 8 present a fundamental, systemic problem - that is, a tendency to stall while gaining altitude. To offset this, Boeing has installed one or more sensors that ultimately activate the stabilizer. Now, you risk a sensor misread, a failure of its communication with the stabilizer, and the possibility that pilots won't be able to disengage the system if necessary. Are the larger, more fuel efficient Max 8 engines really worth the incremental risks that passengers incur? I don't think I can bring myself to feel confident on this aircraft.
15
I flew more than 100,000 miles on American Airlines in the last year, assuming that Boeing, the airline, and the FAA put passenger safety first. I feel betrayed. Next time I fly, it wont be on an airline that owns fatally flawed aircraft that require software patches and has pilots frantically flipping through an instruction book to prevent the plane from crashing.
303
@Dan Then you sir cannot fly again. Almost all manufactures of commercial aircraft have had a fatal accident in their history. Airbus the only other manufacture making planes this size had the same AOA failure in 2008 and patched the software to fix it on the A330. The reason flying is so safe is because of accidents that we learned from and changed design of the aircraft. I find it very sad that these accidents have happened. But I understand that we have always learned from them in the past and made aviation safer.
23
@Dan
The problem with that is that airlines have a shared monopoly devoted to making Max profit, no matter what. So what choice do you really have?
7
@Dan Profit first, passenger safety dead last.
21
After reading previous articles descripting the rush to "catch up" to the Airbus 320N, it seems Boeing re-designed the 737 with aerodynamic alterations to provide a competitive product; ie, the Max 8. All aircraft stall at some point when the indicated airspeed is reduced to the point lift is no longer provided. It seems the Boeing fixes reduced that airspeed value to an unacceptable number and their answer was a hastily designed, powerful system pilots would have difficulty using in adverse conditions. A simulator is not the real world. I agree completely with Neil.
6
Boeing and FAA executives who thought it was safe to design a system allowing pilots just 40 seconds to avert disaster should be fired...today!
20
"Why MCAS was designed with such flaws?"
Easy, to put the MAX8 faster on the market. Time to market and quality are opposing attributes of development process. All this story, it's a huge failure of the regulator.
It makes me feel sad for the victims, knowing that all of this could have been avoided.
268
@Karim. Using the two sensors one at a time on alternate flights is so blatantly wrong that it could not have passed even a single review. It implicitly acknowledges that the designer is aware there are two sensors and then actually increases the chance of an accident by putting the plane at risk if there is a failure in either one.
This could put the MCAS system in pole position for the award of worst ever software design.
31
@Karim
My son used to ask me questions about unfairness and inequity - he was truly upset when he saw the movie "Titanic", where the passengers in steerage were not allowed to even try to escape - and my sad answer was always: money.
15
Think about this. There is a flawed Boeing aircraft that has already murdered 356 innocent people. And the public across the world is supposed to get happily excited about several pilots over the weekend being brought together to learn how to automatically correct the flaw?
These planes are defective. Admit it Boeing. Admit it F.A.A. It’s 2019 and you can’t do better than this?
Our lives are this meaningless compared to all the money you’re pulling in?
And by the way, not “charging extra” for a safety feature, suddenly created this past weekend for the airlines, is a cheap shot. The public is watching and we’re not satisfied with what’s going on. We’re not stupid.
453
@MIMA ---->
Pairing of ng variant airframe w/ larger engines rendering unstable weight distribution in the new 737 (Max) should have never been approved FAA.
People need to go to jail over this.
111
Exactly - it’s 2019 and we can’t do better than this.
19
@MIMA
MIMA, I totally agree with your overall diagnosis of this particular example of a “profits over people” economic system run amuck — which Shoshana Zuboff in her very recent book, “The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power”, and which I term a “Disguised Global Capitalist Empire” — which can cause deadly societal results in advanced systems like planes, and other high-tech systems, in less than a minute and before pilots or peple can react.
Another NYT commenter here used several analogies to other systems that are being considered, like automated cars, but as I’ve noted here before when the ‘take-off’ and control of the 737 Max 8 was first reported, a far greater potential problem, which is not being seriously considered is the potential for a ‘fast take-off’ of a first fully AI system, that could occur in nano-seconds and without self-reporting any problems.
But, heck, look at the positive side — the first AI system, based on its absorption of massive readings of human history and philosophy might well be more humanitarian than our current faux-global Emperor Trumpius and the “what’s in it for me” gang of hidden actors behind him.
21
There is only one way to fix this problem and that is for the public to refuse to fly on this aircraft. I certainly will make sure that no portion of any travel arrangements I make is likely to be serviced by this plane. That is really how to get Boeing's attention as it would likely lead to further order cancellations. I'm sorry that this might have an adverse impact on employees across many companies but it seems that Boeing's Executives and Directors are still focused on profitability above all else including the absolute safety of the flying public (which is ironic given that without public confidence they have nothing). The rush to find a software solution by a company which should be focused on engineering principles is what I find most disturbing. Of course the push to deregulate or at best self regulate is the root of the problem forced on agencies by ideologically blinkered politicians and funding cuts via reduced taxes. There's a choice to be made here. Government can provide necessary competent oversight or you can have extremely low taxes for the rich but you can't have both.
12
From all that has been written, it seems that the key misstep that led this situation and these two crashes was Boeing's requirement to make 'no new training' one of the mandates in its effort to get these planes to market fast enough to be able to compete against Airbus. But a rush to complete in order to compete should never exist in industries where safety is as important as it is in aviation. If a new iPhone is brought to market with glitches they can be corrected without people dying. All technology companies constantly face business challenges in keeping up, but makers of airplanes simply must be held and hold themselves to a higher standard. Yes, losing a big contract to a competitor would have hurt, but nothing like what Boeing must be feeling now.
6
This is horrifying. As pointed out in the article, why would Boeing design software with such glaring flaws??
I would never ever want to board one of these. The passengers died in a horrifying manner with the plane throttling down jerking back up on repeat until they slammed into the ocean.
9
This is not a plane that I want to fly on.
12
I’m a private rather than a commercial pilot, so I’m probably missing something. However, it seems to me that in diagnosing the problem the issue wasn’t the cause, the infamous MCAS system, but rather the effect, a runaway down trim of the stabilizer. The down trim was confirmed by about the only piece of hard evidence found and reported so far, the stabilizer jackscrew in the fully “down” position. Any pilot that flys with an autopilot is taught that it’s possible, for whatever reason, one of the motors that adjusts the control surfaces, in this case the stabilizer, can “runaway” forcing the control surface into an extreme position. Whatever the cause, the solution is the same, shut off the power system and use the manual back up to readjust the control surface. It seems this is what Boeing was counting on in thinking that “no special training” was needed. However, in very complex aircraft especially in IFR (bad weather) it may be a big leap for pilots to abandon the computers that normally fly these planes and go “seat of the pants”.
7
A software patch to fix a software patch to fix a design flaw, concluding with mandatory (non simulator) Ipad certification, what could possibly go wrong? With an extra few minutes more than 40 seconds, to remedy a fatal dive into the ocean by pushing buttons, turning motors off, cranking wheels, reciting the alphabet backwards, rest assured (unless one of the pilots is caught with his/her pants down in the newly designed bathroom cabinet) that everything is OK.
14
Nothing short of a pledge by Boeing top brass to take many 737 Max flights each month will suffice.
8
I feel very sad about the number of souls lost. That they would make the additional software piece optional rather than standard speaks of corporate greed. Boeing is not to be trusted. I hope the DOJ gets them and gets them good.
16
"Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator,"
They didn't do a simulator test before building the aircraft?
12
Boeing: existing procedures covered the situation.
After the Lion crash: sent a bulletin.
This just seems criminal, doesn't it?
A crash happened.
Manufacturer: "Gosh, it's in the owner's manual."
"We'll send out a memo."
In engineering, if a failure occurs in the early days, it is absolutely inevitable that it will recur. There are no random failures during development or shakedown.
Boeing has been in this business a long time.
This, speaking from my development engineering point of view, was a management decision, just like the Columbia shuttle--"Launch now, the risk is minimal."
18
@JohnH
I agree with your point of view. Very straightforward.
3
@JohnH I believe you mean the Challenger disaster where management disregarded warnings from engineers.
2
@Lenny-t
I stand corrected. Thank you.
Management--"don't worry about that o-ring."
Engineers: "But..."
2
How about have whoever approves these new updates and allows the planes to start flying again to also sign an agreement that if 1 crashes they will accept facing murder charges. Then let's see how quickly they will be willing to sign off on these planes flying again with innocent passengers.
7
This plane was designed to fly with older technology that relied primarily on a flying crew of three pilots. The position of the flight engineer was eliminated and substituted it with sensors and computers to help navigate the plane, many modifications were done to ensure the plane was safe, the problem lies with Boeing's current management's approach to cut costs down, and trade safety for profits.
It may work, but 350 people have already died to bring the point across about safety.
I hope management receives a hefty bonus to celebrate their cost cutting accomplishments.
3
@hugo
There are for practical purposes no three-pilot aircraft in service today. All current production airliners, by Boeing or Airbus or anybody else, are flown by two pilots only and this has been so for decades. The 737 was designed from the get-go as a 2 pilot aircraft, since by the time it entered service in the '60's it had been found, among other things, that eliminating the third person in the cockpit actually enhanced safety by reducing distraction, as was illustrated by the crash of EA 401 in 1972.
3
So many people posted here blaming the pilots who perished on these flights. Seems they are silent now. 40 seconds to recover is ridiculous. There should be a way to go into a manual mode where the pilots are in control. Anyone who’s worked with computers knows that software can be glitchy. This affects my ability to do my job, but lives are not at stake. Southwest had the most 737 Max 8’s, and that’s the carrier I fly most. I have to rethink my loyalty since they were stubborn and didn’t ground the planes until Trump said to do so. I feel a complete redesign is warranted, not some software update.
20
Boeing's tortoise paced response to the second crash should be alarming to regular fliers everywhere. The subsequent revelations should confirm those alarm bells. What other airplanes might have hidden problems that will only be revealed by disaster? Boeing's deficiencies and those of the FAA need to be addressed with transparency and with the safety of the public and airline personnel at the forefront. Business interests last. Until that happens, this regular flyer will be searching out Airbus planes and routes. It seems to me foolish to respond any other way.
13
What still isn't answered is why this "Hal" moment has happened only a few times (the two crashes and some reports from pilots). That's worrisome. Is there a flaw that requires an uncommon, unfortunate but non-zero set of circumstances in order to occur? Is that particular flaw truly unrecoverable? Workarounds of bad systems are not as good as redesigning the system.
1
@Mike S.
It has (99% probability) been answered. It happened when the angle of attack sensor malfunctioned. Something similar happened when the pitot tube malfunctioned on an AF Airbus 330, starting a cascade of mostly pilot error events which plunged it into the Atlantic Ocean killing all aboard. Such things do happen and such problems are not unique to Boeing, a fact of that many commenting here seem to ignore. In this case it seems likely that the use of just one AoA sensor rather than two was an important link in the chain of errors.
1
Many years ago another commercial passenger aircraft was grounded due to a bad design on a cargo door.
The manufacturer made the necessary corrections and the regulatory officials were satisfied the corrections were sound and we continued to board the aircraft until the operators retired the aircraft from passenger flights.
This too will happen with the 737 Max.
1
It now seems clear that this is a massive engineering failure that should not be handled by a software fix. The Max 8 needs to redesigned to eliminate the stability issue and not be allowed to be recertified because pilots can be trained to handle this in less than a minute. That's not a plane I would ever want to fly on.
32
@Paul Wortman
Disagree. There is not enough information here to make your determination. The plane handles differently, but I have yet to hear anything about how well or poorly this plane maneuvers once you turn this MCAS system off compared with other similar aircraft including previous 737's. There is no way to know from this article whether or not this aircraft is inherently unstable. I'd like to hear more about that from qualified pilots who have flown 737's for a long time.
Angle of attack sensors are always installed because stalling is always an issue. What's different here is that Boeing a) didn't emphasize what steps the MCAS would take to "help" the pilots avoid a stall, b) there was little room for error in the steps necessary to make it stop "helping," c) wrote software that relied on readings from only one sensor, and d) kept resetting itself each time the pilots lifted the nose up manually. I mean, at some point you do have to let the pilot fly the plane.
3
I'm trying to think, what would get me to board a 737 Max, at this point, and I'm coming up blank. Trusting a company that chose to leave out safety systems, in favor of profits, doesn't do it. Fast tracking a new plane design, then gaming the system, so it's not really a new design, doesn't help. Leaving the lives of its passengers depending on a single sensor and undertrained pilots? I don't think so. At this point there is no way I'm setting foot on one of these thrill rides.
36
@Michael
Ironically once the fixes are done and the new lights installed and training done it'll be the safest plane to fly. Every one on the plane now knows about the mcas system.
1
@E I disagree as it will still have the design flaw of the engines being too large freezing this entire system was put into place to begin with. It sounds like stability questions remain only it's easier for Pilots to avert a crash. I certainly am not taking a chance have fun if you want to.
5
@E
This is true. The most reliable elements of a design are the things that failed last.
It seems that the more we find out about this situation the clearer it is that proper testing was NOT done prior to certification. In an airplane EVERY POSSIBLE CONTINGENCY should be tested no matter how unlikely it is. In the 2 flights that crashed the situation (sensor failure)was a possibility and should have been tested for.
1
If this software adjustment is truly the fix Boeing says it is, let’s see the Boeing chairman and other top officials take some flights. Better yet let’s see their families, including children and grandchildren, getting on 737 Max flights, and not just the special ones that have been tested numerous times with the best-trained pilots. We fly a lot for both business and pleasure, and I am angry that they thought this was ok! Shame on them. Sorry for the dead and the many Americans that may lose their jobs because corners were cut.
48
"Given that the 737 Max has had both sensors already, many pilots and safety officials have questioned why the system was designed to rely on a single sensor, creating, in effect, one point of failure."
This statement fails to recognize that the system itself was designed as a safety system. The stall (or impending stall) would have been considered the "failure" and MCAS would step in to try to correct it. If the plane is about to stall, you wouldn't want to wait for both sensors to get into full agreement before making the corrections. The real problems here lie not in the number of sensors and resolution of sensor disagreement as much as with the fact that pilots didn't had limited awareness of the system, no knowledge when/if it was triggered, and no intuitive way to override it.
6
@SJG
It seems to me that responding manually to a stall condition is a pretty basic pilot skill; it must be taught very early on.
Maybe an indicator, meaning possible stall condition, rather than a "get out of the way human" auto intervention, might have solved this problem.
I'd appreciate a pilot or two commenting on how they are trained to respond to a stall in the absence of this automatic responder.
@SJG
I believe that I have read previously that the3 2nd sensor was aa "purchase option". Please tell me that I am wrong
The MCAS was the cause of the problem. The problem was "runaway trim.". Regardless of the cause, the solution to the problem was the "runaway trim" procedure. The procedure is to trim opposite the runaway and then use the "trim cutout" switches to remove power from the trim motors and then trim manually.
I suspect the reason the FAA in the US delayed grounding the MAX was they understood and agreed with what I wrote. MCAS is flawed, but jets need not be crashing because of it.
Remember that when you buy a low fare ticket in a foreign land. The quality of the pilot matters.
7
@airwolf1980
The quality of the plane matters, and the MAX series are dreadfully flawed.
Software is a bad way to fix hardware faults.
17
@airwolf1980
There is some subtle racism here. Pilots are well trained across the globe. Pilots want to live and not crash. If this happened with a US carrier at a US airport the crash chances would be just as high as not in the US.
4
@E, my comment has nothing to do with the race, Creed or color of the pilot. The Ethiopian airline's first officer had 200 hours of flying time. In the US it takes 1500 hours to get an interview at a regional airlines.
Imagine if your car's anti-collision software didn't avoid a crash, but accelerated you into one. Now imagine that same software locked you out of being able to just use the steering wheel & brakes to avoid the crash. Instead, as you headlong at 50mph you only have 4 seconds to hit a bunch of buttons or switches on the dashboard (500mph plane gets 40 seconds, so I'm assuming a 50mph car gets 4 seconds) BEFORE you regain control of your car.
Now imagine 200 lives depend on your actions.
If this was a car instead of a plane, every single one would be recalled & off the road instantly & that entire system would be removed. But in a plane, we have to believe Boeing, a company that by its own & the FAA's admission, is allowed to oversee itself.
Every update I read about this ongoing fiasco makes me feel worse about these planes. Not better.
103
@BP
Much of this is worth considering. Also worth considering, the 737 Max probably has a better safety record than your car.
1
@SJG
I don't think so. They're maintained better than by car owners and parts replaced more often (before failure, because car parts' failures don't normally result in an immediate catastrophe).
But Pilots over car drivers, then yes.
3
@SJG
It most certainly does not. The MAX has a record of about one death per airplane per year of flying. That’s unbelievably poor.
There are about 40,000 commercial planes in the air.
There are roughly 1 billion cars in the world.
If the engineers and programmers cannot have a zero percent failure rate in 40,000 planes, how can they expect to make even 1 million self-driving cars?
This whole episode just manifests how overly-optimistic silicon valley is: autonomous vehicles, 5G, children who NEED to learn how to code or they won't be relevant.
If we haven't already hit some technological ceilings, we are most likely a century away.
I wish all of the engineers would focus on renewable energy instead of cutting the humans out of the picture. We will be better off for it.
33
@Walker
We would all love a "zero percent failure rate" but this is the real world. Planes are safer than ever. Cars are safer than ever. And this is not because pilots and drivers have gotten better. The way travel got safer was through progress. Autonomous vehicles have their obstacles and they will have their failures. But they don't need to achieve a "zero percent failure rate" in order to be safer than with you or me behind the wheel.
4
@SJG Yeah, but all the people who are put out of work because of this are not going to become nurses, coders or plumbers.
@SJG With all due respect I disagree. I will drive my children through rush hour Garden State Parkway traffic and feel safe in my abilities; I won't put them in an autonomous car with a 1.6% failure rate.
3
"The pilots tested a crisis situation similar to what investigators suspect went wrong in the Lion Air crash in Indonesia last fall. In the tests, a single sensor failed, triggering software designed to help prevent a stall."
What happened to the aviation rule of thumb of redundant safety systems? MCAS was designed to rely "on a single sensor, creating. . . one point of failure."
And over 300 innocent people are dead, their families shattered, and for what? A quicker turnout to produce more profits? Where was the FAA? (Gutted by Republican policies of "less government," more profits).
Let's hear it for some socialist policies that put people over profit, eh wot?
71
Reassuring to read that completing a a training on an iPad is all that 737 Max pilots need.
20
"Before the Lion Air crash, Boeing and regulators agreed that pilots didn’t need to be alerted to the new system, and training was minimal." WHO ARE THOSE CORRUPT REGULATORS? THAT should be our main focus at this point. If the FAA cant remain neutral no more, Disband it! If the FAA has a conflict of interest that is causing hundreds of people to die in plane accidents, DISBAND IT! There is no need for them any more if they are allowing airlines makers and operators to do as they would like. But please find those Regulators who agreed with Boeing that there was no need for pilot training on this software.
17
@Nat those regulators you are looking for are Boeing employees. The FAA allowed Boeing to regulate itself, farming out its sole job to the company it's meant to oversee.
7
After the first crash, how is it possible that any pilot flying Max planes didn't familiarize themselves with the system and the proper procedure to override it? If someone told me my car's electronics could cause an accident, I would immediately learn how to turn off that system.
2
Because there was still no training or information made available by Boeing. The real scandal is lack of training and information (which would necessitate training).
7
@Mike The Ethiopian pilots were new to the 737 MAX, and the first officer was a complete novice. They were also very low when MCAS appears to have engaged. The Lion Air situation, which was simulated in the tests reported, began at a higher altitude.
3
@Mike It is astonishing that 1) there was "Given that the 737 Max has had both sensors already, many pilots and safety officials have questioned why the system was designed to rely on a single sensor, creating, in effect, one point of failure." and 2) there were 'optional' features that may have helped.
"Doomed Boeing Jets Lacked 2 Safety Features That Company Sold Only as Extras
Airlines had to pay more for two optional upgrades that could warn pilots about sensor malfunctions. Boeing now plans to make one of the features standard."
1
Most "folks" simply trust Doctors and Pilots because the learning curve is tremendous. Unfortunately we spend more time buying a TV. "Pushing Product" is just as important to Boeing as it is to Samsung -- and we get to pay for mistakes.
Boeing Max was a quick fix to an old aircraft by young engineers without the "seasoned experience" that is quite often a repellant to young hiring agents -- and the cost of acquiring that experience also plays a part in "cost concerns".
Quick rapid designs accompanied by lack of real training -- always spells disaster at airspeed.
7
When are Boeings CEO, COO and CFO going to be fired, resign or be arrested?
18
@Blackmamba The extraordinary improvement of air safety over the past fifty years has in large part been associated with extensive scientific investigation of accidents and incident reporting without criminal responsibility being a priori sought. Of course, some culpable behaviour has been tried in courts of law, but the goal is to prevent further accidents by uncovering all the contributing factors and by implementing measures to minimise their recurrence. An explicitly punitive approach will just result in cover-ups and not reporting adverse incidents.
4
We now know that on the day before the Lion air crash in 2018, an extra pilot in the cockpit helped pilots overcome the problem that made that same plane crash--the next day. Has Boeing surveyed every pilot who has ever flown the Max 8--easily done with a computer--and if not why not, and if so, why are the results of that survey not made public? Boeing's evasiveness permeates this article, and I am even more determined not to fly on a Max 8 this morning than I was yesterday.
And don't put it beneath Boeing to rename this plane at some point.
15
Sorry, but as a passenger, the fact that pilots specifically trained to overcome a software and equipment design flaw were able to do so in a simulator is not sufficient reassurance for me to board a 737 Max. Boeing should cut its losses and either remove the system from Max planes or abandon the 737 Max altogether. I'm a frequent Southwest Airlines passenger, but if they go back to flying the Max, I'll be looking for another airline to get me where I want to go. We obviously can no longer rely on the FAA to keep us safe, so we have to vote with our feet.
40
@Karen due to the design of the plane and its engines I think this system is actually needed which is even more scary and another reason I will never fly on one of these planes
5
As an American Airlines 'executive platinum' frequent flyer, I can state publicly I will not book on the MAX 8 even if Boeing engineers develop a software "fix". I am not a nervous flyer but when the aircraft dips suddenly from turbulence, all bets are off and I become a "nervous Nelly" until calmer air is found. I can't even imagine flying on an aircraft that suddenly descends and ascends so erratically from takeoff and with the variables of engine placement, pilot training and the reliability of sensor data, this becomes too much of a risk for me. Those poor passengers must have suffered unimaginably until they hit the ground. For those who oppose government regulation, this is your wake-up call.
155
@Mark1021
Yes but the government regulation has to be independent and not bought.
27
Here is a really simple question for those with knowledge of planes: why would a software program on any plane anywhere ever allow the nose to be pointed down at a dangerous angle below a certain altitude floor? I would assume that since the software knows where airports are, unless the pilot overrides the system, a software program should not allow a plane to fly below a certain altitude anywhere. Sully, could have overridden the system, but he would have had to take an action, knowingly, to do it.
Airbus does it too. One reason we are a long time from getting away from pilotless cockpits.
@billy Bobby. I know a little, having flown a little myself. One major problem is that, from all reports, the MCAS acts entirely by itself, and is not connected with the other instruments. So the pilot’s attitude indicator says the plane is at the proper angle, and no stall warning horn goes off, but the little pendulum in the MCAS decides to go hard over to extreme nose down ALL BY ITSELF. All pilots know that nose down could be several things, and adding throttle is one of the things you do immediately. As soon as the pilot’s brain tries to figure out what’s driving the nose down, he or she will do several other things, like trying to pull up with the yoke or extending the flaps. All this takes away the precious few seconds needed to hand crank (yes, hand crank) the tail into trim. And only near the ground, when the autopilot is off. This was a totally added-on patch, not an integrated subsystem. A no-thought killer item.
2
Not being a pilot, I may have no understanding of this. But isn't the real issue why this aircraft needs this system at all? And secondarily, how these two planes (and probably others) are getting into situations that trigger it?
2
@BillScott
Anti stall systems are needed in large commercial transport aircraft especially in weather conditions (IMC) where the pilots have 'no visual reference to the ground' when the aircraft can suddenly assume an attitude that is unsafe. Example:- a high nose up/down or steep angle of bank & pilot situation awareness is slow.
In perfect weather conditions the pilots should be aware & sufficiently trained & confident to recognize a stall condition as in the case of Lion & Ethiopian Air but unfortunately the 'stall avoidance system' (MCAS) went awry close to the ground & recovery simply puzzled the pilots.
3
I have a commercial pilot's certificate and a background that includes designing some automation. What surprises me is the FAA's approval of a software solution to an aerodynamic problem. The existence of the software is evidence that there was suspicion at Boeing that the average airline pilot could have trouble flying the plane. This shouldn't have been the case, flying straight and level is the first lesson when learning to fly. To me, this indicates an aerodynamic problem and should have had an aerodynamic solution. So, how flyable is the plane if the pilot has to turn the software off? A change in weight and balance or an aerodynamic design change is what the FAA should have ask for and it may still be needed.
64
@Dan Earley Boeing didn't want to design a whole new plane, that's why they redesigned--again--the 50+ year old 737. The time it would have taken to design something else (new, not dangerous) would have put them behind Airbus for a generation, maybe longer. I suspect they think this was/is a cost of doing business.
5
This is so sad. All those beautiful lives cut short because of an apparent lack of focus on quality. Do you think the Boeing executives will be losing their positions? My guess is some may but IF so they will be skipping down the yellow brick road with multi million dollar severance packages that the Board of Directors signed off on. Almost as equally sad.
19
What kind of simulation tests in failure mode were done with the MCAS system?? If they had done just the minimum, it would made the problem clear. The experts and the public need to see that data, to determine if Boeing is liable. But, more importantly how to prevent future accidents in complex systems like these.
7
This coverage has given me increased respect for the work of pilots. In this day of automation, I naively thought that the job was largely to ensure that takeoffs and landings were safe. When I read in recent days about all that is expected of pilots. I am in awe of the life-or-death responsibilities they face. It is terrifying to realize how deadly the consequences can be when the manufacturer of the aircraft provides inadequate training. In another article, it was reported that pilots whose job was to fly the 737 Max were provided 56 minutes of training, accessed through a smartphone app.
13
Based on the number of Max planes flown by US carriers, why hasn’t it been an issue in the US? Better or more training? More experience in the cockpit?
4
@Exactly and it is for that training and experience for which we pay those pilots with the expectation, in a time of emergency, they will pull us out of harm's way.
3
Perhaps the vast experience of all pilots flying the MAX in the US helped. All three airlines that fly that type plane in the USA have a vast amount of experience. For example myself. I have 20,000 hours flying. I am a little more than half way up our seniority list. The average new hire has over 4000 hours when they are hired.
Experience isn't everything but it sure helps rational thinking and measured reactions when things go very wrong. Flying is not as easy as some may think.
12
Part of the reason for the shortage of pilots is the low pay. I'm guessing pay at those two airlines is not great. Up until recently pay in the USA was horrible. All airlines (except Southwest Airlines) took advantage of the post 911 downturn to go bankrupt and gut pilot contracts. I made more money in year 2000 than every year following until 2014. Same job and same airline. Since 2014 my pay has tripled.
8
I hate to say it, but as a systems design engineer it seems that the focus here is not where it should be ... at the primary source of the problem. The MCAS was installed to prevent stalls caused by a tendency of the plane to climb at a dangerously high angle of attack. The source of that problem has been reported to be that the new engines were mounted at a different location on the old 737 airframe which could render the MAX8 succeptible to this stall condition. Instead of trusting new (and possibly glitchy) software to fix the already glitchy MCAS sensors, why isn’t Boeing doing the responsible thing and redesigning the engine/airframe configuration to eliminate or reduce the potential for stalls. Is it because of money? Stopping production and recalling all delivered MAX8’s would be hugely expensive. Boeing has not addressed this significant design issue and neither media nor safety regulators are challenging them on it. However unless Boeing can prove conclusively the existing configuration is not the primary cause for the stall potential requiring all of these Rube Goldberg fixes (will there be Release 3.0, 4.0, etc. after another tragedy?) ... I for one will never fly a MAX8 as it is currently designed.
159
Of course it's money! It's all about shareholders and maximizing executive compensation tied to stock prices. When Boeing gets fined and punished, the fines should only come out of the executive's compensation, not through layoffs of innocent workers. Enough of those kinds of penalties might wake up the executive class that stakeholder value matters too.
16
@Duckdodger
The fix to place the new engines in a stable position requires longer lamging gear. The wing would have to be entirely re-designed to accommodate that. Apparently Boeing decided that was just too expensive.
On the 777 refresh, they redesigned the wings from scratch, so it's possible for Boeing to make that decision.
Same here, I'm never flying on a 737MAX with the current wing design. Boeing should consider this: if people are vocal in the airport about refusing to fly on one due to whatever scheduling updates and last minute aircraft changes, other passengers might get wind of it and also refuse to fly. Could get ugly.
23
@Chris Oxford I completely agree with you. These greedy cold blooded animals still depend on us Flyers and if we refuse to fly on the plane they will be forced to do the right thing.
8
As a matter of course, during the system development life cycle, new software will ultimately function properly precisely because of extensive and continuous testing, and the appropriate training of “end users,” before its final delivery. Whenever this tried and true method goes awry, it is all too often because insufficient time is provided in the final stages for complete and thorough “system acceptance testing,” most often due to scheduling pressures. Predictably, this haste all too often results in future system malfunctions resulting in the need to go back and do again what should have been done correctly the first time. Thankfully, this maddening rigmarole, familiar to anyone who has worked even briefly in the software industry, usually does not involve the deaths of hundreds of people. That form of haste is both unconscionable and unforgivable.
6
@Richard I've been in the IT business for 40 years. I started as a software developer, but after the dot-com bust I started doing general IT support for the SMB community. I've noticed a rapid decline in software quality and reliability in recent years. I put this down to an emphasis on time-to-market and the emergence of various rapid development methodologies such as devops that tries to short circuit the traditional development techniques we practiced before the bust, all in the name of cost reduction and profit. I've also noticed that many younger developers seem to have limited understanding of the basics of the trade. It seems all everyone wants to do is code first and think later.
1
Amen to your comment. Coders rely on black boxes. Programmers roll their own code.
1
I don’t care if they do get it back in the air. I ain’t getting on it. I’ve lost trust in Boeing and Southwest, although I have to fly them day after tomorrow. The whole thing makes me wonder what else is wrong with any of the fleet of planes of any type they are not telling us about. And then they are shoddy enough to be leaving tools and other assorted scraps on the military stuff they are building! Also, the 737 Max story seems to have completely eclipsed the story about how the airline was already strained and operating in EMC mode. Nobody is talking about that anymore? If they were already having issues with the mechanics being overworked and having them look the other way on safety concerns, imagine the additional burden now that they have to scramble to take up the slack from the grounded model. This whole thing is just a microcosm of a much bigger issue and we are in deep doo doo in this country.
9
Software should be intended to improve planes, and not to patch bad designs, nor make it fly. Supposing the MCAS could be deactivated, then the pilots would be dealing with a possible emergency, plus the airplane nose pitching up. It is incredible that this plane got any aviation certification since its design can cause a stall. Now Boeing will fix its plane with MCAS 2.0, let's hope an MCAS 3.0 won't be needed
19
What I've read is that Boeing found a loophole to claim it wasn't a "new" airframe requiring lengthy and expensive certification.
5
@Anne Hajduk Along with expensive simulator training for the pilots.
Please initiate an investigation and have public hearings.
5
[Pilots will be required to complete a training on the updated system on their iPads.]
So, experienced pilots already aware of the flight situation and what the MCAS was causing tested the existing version and found that in as little as 40 seconds the 737 could be in an unrecoverable dive but that the proposed software improvements improved response time and exhibited the need for less corrective force under revised conditions.
Fine. These pilots now have physically experienced how the 737 reacts to the two versions of the MCAS and how to recover. They have in the process programmed themselves so in the event of another incident they will more quickly recognize it and take corrective action.
I would trust those pilots to fly a 737MAX 8 since they've explored how the plane reacts in a full fledged flight simulator, but what of the remaining pilots who will be "trained" on an Ipad? Will they gain the same experience as those on the flight simulator, I think not.
And here's lies a problem, from other reports, there appears to be only one flight simulator available with the existing MCAS characteristics installed. That is why Boeing has to resort to an Ipad for training, they have no other choice now as they had before the two crashes.
15
That and the fact that they knew what challenge they would be facing. Which is not what happens when trouble strikes in mid air. You first need to detect the issue. While flying a plane and batteling unexpected circumstances.
1
Just an infuriating article. It keeps getting worse for Boeing. Shame on them. I've read elsewhere that they hired grief counselors after Lion Air. They are going to need to hire a lot more.
* Due to hubris and laurel-resting, under competitive pressure they scramble to design a half-baked plane that Boeing engineers know will have a tendency to stall.
* To compensate for the aircraft's fundamental aerodynamic flaws they write software (MCAS) that's "powerful" and relies on a single AOA sensor (while the plane is equipped with two).
* They don't train the pilots on the new software (that could send them and their passengers back to earth at 90 degrees @ 600 MPH).
* To fully disable MCAS/HAL pilots need to "flip two more switches," "crank a wheel," and rub a rabbit's foot 5 times.
Completely absurd. This plane is still being manufactured. Somehow my primary carrier (Delta) had the wisdom to completely avoid this disaster and has 0 MAX and 0 on order.
135
@dack
From NYT's reports last week, I would further develop your first point and add at the very beginning of the list:
* They dismiss their competition's new design with larger, more fuel-efficient engines as a potential commercial threat.
As you superbly put it: laurel-resting. There and at MBAs making decisions that should had been left to engineers lays the root of the problem.
5
I don't want to get on a plane with 40 seconds to avoid disaster.
87
@Mike Livingston If an engine fails you have much less than that before the asymmetric thrust spins you into the ground. And that's one of the slower emergencies compared to a depressurization or really anything much on takeoff or landing.
3
If the the plane had been designed correctly, there would have been no need for a MCAS. I wonder if it has stable glide characteristics with both engines flamed out. I personally will never fly on a 320 MAX even when the FAA approves the fix. The FAA is nothing but a rubber stamp!
24
@JAB
You mean 373 MAX, there is no 320 Max, the 320 is an Airbus plane and so far safe.
Let's all remember who heads up our own Defense Dept. A former Boeing guy. And of course -- he's lining his pockets -- and helping Trump along the way. The guy has ZERO experience in the military life. Yet - he's running DoD. Oh, I know.. because Trump wants contracts with Boeing. The crook never stops. He must be voted out. And the Boeing guy needs to be replaced at DoD.. and Boeing should pay heavily for it's shortcuts -- and offering safety features as OPTIONS. Sickening level of corruption at Boeing.
30
This plane is not airworthy.
Boeing put engines on an existing that they knew could cause the plane to tilt up on take off and sought to mitigate that with a software fix. The plane should have been designed such that this tendency did not exist but they put money first.
I am also disappointed in all the pilots in these comments who think in narrow flying terms and can't see the wider issue of engineering design involved in this issue.
Boeing 's behavior in this has been appalling.
And to blame foreign airlines...... Have other modern aircraft fallen out of the sky recently like this anywhere in the world?
Ground the fleet until they actually physically reconfigure the plane to fly with these engines.
Engineers at Boeing should hang their heads in shame.
19
Why were the planes not grounded after the first crash?
6
Corporate greed and government corruption.
This has to be one of the blackest of black eyes for Boeing. As bad as the stress cracks on the De Havilland Aircraft Company's Comet jet liner with square windows. Then there was the DC 10 with its poorly designed cargo door. All the result of a room full of smart people still managing to do something really dumb.
The fact that this MCAS system wasn't put through rigorous testing is going to haunt Boeing for a long time to come. The closest analogy I can come up with is if Ford took its F-150 pickup and disconnected the brakes and instead relied on a sensor and computers to decide when the brakes were applied. And of course there'd be no mention of this in the owner's manual.
5
@Lee Elliott The Comet's big square windows sound dumb now, but they didn't know this when it was designed being that it was the first passenger jet aircraft. It's failure really gave Boeing a bump up in the passenger jet business, in addition to becoming, sadly, a template for air crash investigations worldwide.
1
And what happens when AI is your pilot instead of, or even alongside a flesh-and-blood pilot? Can we ever trust, absolutely, a robot? Especially when AI develops and builds improvements over time --evolves, in other words-- and these "improvements" are beyond the ken of what man can grasp?
3
The FAA should ban this model, with its software patches upgraded, and urge Boeing to create a new mainframe for the new engines. All the countries with pending orders for 737Max should cancel them. As a passenger, I am unwilling to take any risks and fly on a faulty plane which relies on software patches.
17
Amazing that Boeing is going to such extremes to enlighten the public on their flawed 737 Max 8 that killed over 300 people. Additionally, Boeing hasn't admitted an ounce of responsibility for putting out a plane that lacked proper training of pilots to understand the changes made to the 737. This is an example of a company trying to cover up their mistakes, a company that emphasizes profits over the safety of passengers. It also brings into question just how partial the FAA was in easily approving the Max 8 for certification.
17
I have to ask: How often do 737 engines stall? It seems like Boeing created an overly technical solution to something that isn't much of a problem. You can't simply give pilots a warning light when the nose is too high? Why do pilots need the automated system at all? You shouldn't have to worry about stalling an engine so regularly that you need an elaborate safety system to prevent crashes. Perhaps the engine is the problem. Otherwise the software wouldn't exist.
I think Boeing has more questions to answer before this episode is over. A software update isn't going to cut it.
13
@Andy
It's not the engine that stalls. Climbing at too steep an angle causes the airplane to slow and eventually stop climbing altogether. The result is a plane that may or may not be able to recover normal flight.Pushing the nose down usually solves the problem, although a nose down plane flying at too low an altitude will not recover sufficient air speed to avoid plowing into the ground.
12
@Andy you're confused - the plane stalls, not the engine
1
It's not the engines that stall. It's the wing that stalls. The MCAS system pushes the nose over to keep the wing from stalling. Aerodynamics not engines.
I don't care what Boeing does to this Max airplane, I will not fly on it. A patched-up airplane like this will never be safe.
8
I'm always flummoxed by the number of Monday morning quarterbacks and instant experts who show up whenever there is something about airlines and/or aircraft in the news.
A couple of things stand out. Yes the MAX is a derivative of an airliner that was designed years ago. That doesn't make it inferior to newer designs. Entirely new designs have their own set of risks, probably far more than evolutions of older designs -- the Airbus 320 has had incidents too, and no doubt will in the future. That's just how it is -- there is no perfect safety. And you can bet that going forward Airbus will be revamping it rather than doing an entirely new aircraft for the same job, just as Boeing has done. The cost and risks of new "clean-sheet" airliner designs compels that.
The other thing is the uncritical belief that more competitors in the aircraft building industry would solve all these "greedy monopolist" problems. Sorry, but we've been down that path before. Remember McDonnell-Douglas and Lockheed? Hawker Siddeley and de Havilland? They all produced airliners, but without sufficient capital to develop and test them properly they had problems that cost lives. Airliners are enormously expensive to design and bring to market. The up-front costs have to be covered by sales, and splitting up the market too much makes it impossible to do the job right. Boeing and Airbus are strongly competitive. Maybe that's the best there can be.
10
Maybe, but Boeing sold this redesigned 737 with knowledge of its unstable takeoff characteristics because they wouldn’t have needed or installed the MCAS system if they were unawares. That’s what makes this situation so different ... it appears to have been an accident waiting to happen... in a possible rush to market they produced a flawed aircraft with a flawed autopilot system to correct the original flaw and now they want the world to believe that MCAS 2.0 is the ultimate solution. Pardon me for being skeptical but my life may depend on Boeing actually taking public safety first not just saying they do.
6
@John Binkley Do not agree John. The redesign places the engines a bit more forward, physically giving the aircraft the tendency to climb too high and possibly stall. Rather than changing the physical characteristics of the aircraft, Boeing chose a "software fix". Sadly it was not initiated well, not documented well in the training manuals. A physical redesign is what is needed~expensive, yes.
3
@John Binkley When sometime like this happens a lot of people resent anyone but engineers daring to have an opinion. Over 300 people wouldn't be dead and Boeing wouldn't be in a big, ol, mess if they'd had somebody with a little common sense (not learned in engineering or business schools, apparently) around when they were planning this.
2
I’m not a pilot or an aircraft manufacturer so I don’t know if 40 seconds is long enough to fix a problem like this. But boy, it sure doesn’t sound like a lot.
Your average person puts a lot of faith in aircraft and pilots to go up in the air? What happens when that faith starts to falter? I have to travel for business and family over the next 6 weeks, but I will not do it as lightly as usual, that’s for sure - and if I could drive instead of fly, I would. It’s not rational - but maybe going up in a big machine in the sky and not thinking twice about how it stays up isn’t rational either.
5
@A It takes less than one second for either the Captain or the First Officer to reach down to the center console and flip off the two switches that power (and de-power) electric trim inputs to the horizontal stabilizer, thus completely taking the MCAS out of the equation and reverting to safe, manual flight. The problem, as I see it, was Boeing not telling pilots and the folks who write each carrier’s Aircraft Flight Manual much about the new nose-over system or its flight characteristics when activated. This may have made it difficult for the pilots involved in the two crashes to recognize what they had. Add in the broken sensor resulting in erroneous input to the MCAS, and the pilots might have experienced something they had never seen before, with little to go on to figure it out. Boeing’s approach to all this (with FAA concurrence) seems to have been to lump all stabilizer trim problems into one same Emergency Procedure: turn off the two trim switches.
5
"pilots are highly likely to use the thumb switch to extend the 40-second window to several minutes."
That likelihood is exactly the same as the likelihood that you would steer your car to the right if it pulls to the left. This fact renders the title of the article misleading and fit for the NY Post.
Still unaddressed are vital questions such as why the Lion pilots were almost entirely in the dark about the seriousness of events on that aircraft's previous flight and that the problems on that flight had been remedied by actuating the pedestal cutout switches. In all probability, everyone on that airplane would be alive today had the doomed pilots had that knowledge.
Also unknown, if the Ethiopian pilots did in fact have the same problem as Lion Air, is why four months later they, too, were apparently unaware of the simple action that would have saved them.
Boeing and FAA will easily remedy the shortcomings of the airplane. But the sorts of issues these other questions raise, and the various human failures that caused the crashes at least as much as aircraft systems issues, may well be swept under several rugs and never addressed.
11
I enjoy flying occasionally as a passenger and I know nothing of airplanes and will not emit criticism. This analysis is fascinating and shows how relatively simple (to understand, at least) things can go wrong even in big complex plane. Wow.
5
A current trend when it comes to modern technology, is for manufacturers to offer more and more options until it becomes necessary to "read the manual", which in itself can be hard, to do even simple things. The electonic display in my car is like that and to me this is just poor design. A question arises for me with this "software malfuntion". To what extent is the software being used similar to the kind of software associated with autonomous vehicles, i.e., the software is "trained" rather than being a simple if this then thatrelatively style? In any case there is a common belief that such systems can be designed that will be superior to humans at many tasks. For games that is apparently the case but for situations where unanticipated conditions can easily arise, I'm skeptical.
13
@ME Seems to me I want more pilots like Sully, and less computers piloting my plane.
1
Speaking as a pilot and as a flight instructor, forty seconds is not "moments," it is plenty of time to ponder, question, cogitate on, discuss and fix a problem. The emotionalism and sensationalism surrounding this issue in the press in general and the other readers' comments are comical to those technically knowledgeable, libelous to Boeing, and tragic to those who think that a free press must shoulder responsibility for accuracy and eschew sensationalism if it is to segregate bias and ignorance from news.
9
@Ed
As a former Navy pilot and a now retired major airline pilot (30 years with the airline), I disagree that 40 seconds is "plenty of time..." In some situations, but not in this one.
97
@Ed the flying public does not share your narrow technical view of this. And this is not born out of emotionalism. Rationally, Boeing modified an existing plane and built increased risk into that modification. It should have been engineered such that this tendency did not exist. The public sees the wider design concept here.
24
40 seconds is enough if you need to look up and read up on the procedure in the user manual??? Apparently, this procedure wasn't even mentioned on pilots' training iPad. That unstable air plane is another example of shoddy American engineering and execution.
21
There is no such thing as 100% predictable software - for the simple reason that it has to interface with humans. Without extensive testing - much more than boeing is doing or has done - there is no way to predict whether their MCAS update will work in all or most critical situations. When it was stick and rudder, you had 3 variables, stick, rudder and people. Now you have many thousands of variables x people = more accidents waiting to happen.
2
So, Boeing rushed out an airplane knowing it had an inherent flaw in the design that made it prone to stalling. To fix that, they installed software that "under conditions similar to the Lion Air flight...would send the plane into an unrecoverable dive." Then, to preserve market share and profits, they told everyone that the plane flew exactly the same as its predecessor -- the pilots could be trained on an iPad! According to this article, an afternoon in a simulator would have disclosed the threat. Even after 189 people were killed on the Lion Air plane, they delayed rolling out promised software updates. After 90 more people died, they still claimed the plane was wonderful, as did their lackeys in the FAA. And, now they tell us they're going to install better software? After this history, I'm supposed to feel safe and believe them? This should have been called the "Mechanized Crash the Airliner System."
44
Great summary. Thank you. Unfortunately, Airbusses are a rarity in this country.
6
@In VA Great comment !
3
The aeronautics industry, given automated system flaws like apparently occurred with the 737-Max, is still one of the most technically advanced in transportation. If system failures can plague this industry how can we trust the push from automotive companies to market self-driving cars and trucks to far less professional and educated operators than airline pilots.
7
@Jay Amberg by not allowing these big companies/industries to purchase congress and self-regulate.
15
@Jay Amberg Good question, but 30,000 deaths and over a million injuries a year from 100% human only, automation free driving is the answer. Making cars less dangerous than they are right now through automation is desperately needed and likely not that difficult considering the utter disaster of human driving.
2
I am not a pilot nor do I work in the airline industry, but I have worked in the software dev industry, and I can tell you that hubris and a poor GUI (Graphic Human Interface) is a very dangerous combination when one has to manage a life or death situation in seconds. I am very surprised that Boeing didn't discover this flaw in running millions of simulations and seeing how the problems were resolved, or not, prior to a crash. Sadly, hubris in design. And Boeing knows a mea culpa would lead to massive legal payouts to the victim's families.
21
I thought the Air France 447 problem was unique to fly by wire systems on the Airbus, which then stalls the plane. I didn’t think Boeing jets suffered from a similar concern, so were they solving for a purely theoretical problem by creating a real one?
1
The way Boeing fixed this problem by not recalling all the planes and not fixing the design is beyond my understanding. The risk is life here, and the people is up in the airspace, not on the ground. Pilots are also humans with a variety of speed of reflects especially in critical moments and from various background/training settings in different countries. They should have a plane without design problems at the first place. It is like asking the pilots out rightly to fly a plane which has the risk of death and if that happens it means the burden is on the pilots, too, because they cannot react according to the procedure to solve the problem while Boeing can still earn the money from selling the plane without consequences. It's so unfair. I do not want to board on 737 Max even with the upgraded software. There's a difference between flying with a possible risk of death from unknown problem/cause and flying with a possible risk of death from a very known preventable problem/cause.
9
It is interesting that they were surprised they only had 40 seconds. What other surprises are lurking in the background?
11
This scandal appears to expose the consequences of a certain arrogance that is plaguing not only Boeing here in this country: first dismissing a new development - in this case more fuel efficient smaller aircrafts - only to be forced to “catch up” later by taking shortcuts because the global competition is simply moving at a different pace. The same behavior was at the core of the crisis in the automotive industry and the resulting lost market shares turned out to be not recoverable. Taking cheap shortcuts and risking the lives of passengers is the last thing you would expect and tolerate when it comes to aircrafts but Boeing obviously did exactly that. That hundreds of passengers paid with their lives for the “catch up” at Boeing is unacceptable.
34
Despite everything, Boeing and the airlines will continue to hold costs down by providing pilots only with training on their iPads, not in simulators. Ah, the almighty dollar!
20
Worse!
The FAA is going along with it to cover up its own failure. What good is a huge bureaucracy if it can’t recognize such a glaring failure during the approval process and then - MUCH WORSE - lets it happen a second time after the data from the first crash had been reviewed and the problem recognized?
8
Looks like Boeing 737 MAX aircraft needs 3 AoA sensors. The flight computer can then compare the 3 readings and if one is giving erroneous reading, then the computer can discard the reading. This cannot be done with 2 AoA inputs. Of course, this would mean hardware modification.
18
Is anyone else concerned that fixing the current problem with a software fix that makes MCAS operate less aggressively and easier to turn off, will in turn expose the MAX to the risk MCAS was originally designed to avert -- i.e., sudden destabilization of the plane's aerodynamics due to the size and placement of its engines? Is this approach trading one critical risk for another? I haven't seen this question addressed in the NYT's coverage.
268
@mlec Apparently not, as nobody seems to consider the instability of the airframe designed for smaller engines and low ground clearance. Everyone thinks this software hack can be fixed with just another one on top of it.
49
@mlec let's acknowledge that this is highly technical and demonstrates why we need expert regulators who perhaps would never have approved the 737 Max.
45
@mlec This is still my main concern. To rush out a new narrowbody and maintain parity with Airbus, Boeing purposely created a plane that was aerodynamically unstable because the company did not want the aircraft to require certification as a new plane, a - with good reason - lengthy process. To me, it is only repeating itself in its rush to put out a patch. And I am not impressed with its attempts to sound magnanimous because critical safely features will not longer be just options. I still won't fly in a MAX.
53
As I commented to a previous article, the expected system design is to incorporate three sensors, not two. This avoids problems from single sensor failure. Using two guards against either a false positive or a false negative, but not both.
This is not hindsight, this was taught as standard practice,
Any investigation into Boeing should include questioning this design decision, especially when considering changes for future safety.
9
@Gerard
If this is only a software upgrade, then there are only two sensors. Is Boeing adding a third angle of attack sensor?
1
@Gerard I've worked in industrial safety, and a hard and fast rule is that if lives are at stake, use triple redundant sensors, with the safety action being triggered if 2 out of the 3 sensors are indicating danger. A less fail-safe method is to use 2 sensors, triggering automated action when either one indicates danger. Never use only a single sensor if it's safety-critical, because one thing certain in addition to death and taxes is that every sensor will fail at some point. Count on it to fail, not to indicate properly.
I have been astounded to read that actions are taken based on a single sensor reading when hundreds of lives are at risk.
A single sensor is dangerous both ways, by the way: Indicating danger when there is none, and failing to indicate danger when it is present. NEVER trust a single sensor.
16
If any reader knows someone working on the crash investigation, please mention this comment to them.
1
It's been known all along that a big factor was lack of training by a foreign airline known for it's economy. Forty seconds is plenty of time to deal with the problem in light of the fact that it was already well known that the plane's sensor was faulty and should not be relied on to help the plane fly. Also forty seconds is plenty of time to accomplish the shut down of that software when you realize the problem, which at least one of the airline's pilots had done just the day before.
4
@Richard Mclaughlin This is not true in the case of Ethiopian Airlines. The pilots were well trained on their iPads. Just like the proposed pilot training for the 'fix' that now leaves this unstable plane at risk of flying without the MCAS system. No plans for flight simulator training requirements currently exist. Soon these death traps will fly again. I am afraid I will not be on board.
20
@Richard Mclaughlin 40 seconds is nothing. Even 4 minutes is short.
It's pretty clear now that whilst Boeing made shortcuts which resulted in two crashes with so many people killed, management and shareholders benefited mightily from these shortcuts. Because a not yet fit for use plane came onto the marketpre-maturely and fetched several thousand orders, the stock price went through the roof.
How will the Executives who pushed for this accelerated time table be held accountable?
37
@W Probably by having their annual bonus payments doubled. Let's not forget that BA shares traded around $75.00 at the time of the battery fires in the 787 dreamliners. Look at them now!
8
Boeing's proposed "fix" leaves the 737 MAX exposed to the risk of stalling should the MCAS disconnect after receiving inconsistent data from the ACA sensors.
It is not good enought for pilots to be trained on how to switch off the MCAS. They will need to be trained on updated simulators - not just on iPads - to fly this inherently unstable plane without MCAS, otherwise we may have another 737 MAX crash due to loss of control by pilots surprised by the unusual behaviour of this plane without MCAS.
Even so, question whether this plane is too vicious to be allowed to fly without MCAS...
28
The steps that Boeing and others are taking as a result of the two tragedies are appropriate, however they do not address the underlying corporate responsibility issue. As long as short term financial goals can influence safety and quality issues the public will be at risk. Compensation to victims and their families along with substantial penalties, (treble damages, return of executive bonus payments and fines), designed to tip the scales in favor of safety and quality will direct future. corporate action.
7
@Carey ---> criminal liability in the c-suite is a must !!!
@wd funderburk Very difficult to prove criminal liability. Civil penalties to remove motivation and punish prior action can be proven and have an immediate effect on all corporations.
1
PS if it can be found that the airlines did not do their "due diligence", they too can be held liable.
Both operators, Lion Air and Ethiopian Airlines opted out of the AOA indicators and AOA disagree crew alert. If that decision was made without any knowledge of why these options existed, it was not best practice. The decision should be communicated to the aircrews and procedures in place to compensate for the lack of indications. If the aircrews on these were competent then management was not. These operators are required to have a safety committee in place with representatives from all departments of the organization. If the final configuration of the airframes they order is not discussed and approved by this committee there is a large gap in the safety of these organizations.
3
@Dan There shouldn't be an option to "opt out" of critical safety features. Should you be able to opt out of seat belts and air bags on your car to save a few bucks?
18
@David Goldberg The operator may not want the indications. There is point where the PFD is cluttered, decreasing the information the displays are conveying to the pilot. Look at the example on the Boeing website. Personally I would incorporate the AOA disagree text alert. If the decision was taken as a cost saving it is incompetence. Everyone should give Boeing and FAA some consideration. There are many studies wrt the visual presentation of information to the pilots. This is used as advisory material when Boeing is applying for approval. Notice I said pilots, the aircraft is approved with the assumption both pilots have the skill to fly an Air Transport Aircraft.
Just shows the plane is too complex then to be handled by humans.
The greater the complexity, the greater the risk of failure. Cutting out a vital warning light on the XX assumption that it hopefully may never be triggered else the plane crashes makes no sense.
1
I hope they are testing what happens with their solution if one sensor fails and the nose needs to be forced down to prevent a stall. It sounds like they are are eliminating redundancy in the system to avoid stalls.
2
Computer driven flight while best computer is inside the skulls of the pilots. Boeing forgot that.
5
@Lenny-t yes if memory serves Capt Sully landed that plane on the Hudson because it would let him.
3
(telephone conversation) "Hello? What type of aircraft am I being booked on ? Boeing 737? Nope, no thanks".
4
Five hundred twenty-five thousand six hundred minutes
Five hundred twenty-five thousand moments so dear
Five hundred twenty-five thousand six hundred minutes
But for Boeing, it’s only forty seconds of fear...
1
what incopetence, why am i not surprised, big firms they became all of the same, only $ counts these days and so called leaders only think of their own positions. for that so many people needed to die. for some switches nobody knows existed in a timeframe of no time. Boeing should feel devastating shame and compensate all those deaths to their families. same for the regulator.
6
Boeing is a disgrace and people are insane to ever get on one of these planes. MCAS is just the tip of the engineering mess that this plane is.
What an amazing representation of America this is. Corruption. Greed. Deregulation. It’s a disgrace on every level.
I’ll actively avoid any Boeing plane when I travel and so should you.
10
This entire problem stems from a management failure, full stop. Design of safety-critical systems requires a complete analysis of possible failure modes, their effects, the ability to detect failures, and systems to mitigate the effects. In engineering circles, this practice of SFMEA is widely practiced. In this case, one of three things happened. Either the effects analysis was “pencil-whipped” to look less severe, the team working on this was green and lacked technical oversight, or time pressures led to a rushed analysis. My money is on all three happening.
What’s shocking is that when tested in the simulator, pilots reported that the system was much more powerful than anticipated. Maybe Boeing should have taken a couple of weeks to vet MCAS in the sim before rushing the SFMEA?
21
@Ed M To extend your point further, how in the world did Boeing put that plane and system into production without testing? Or worse yet, they tested and did anyway.
7
How absurd. Hopefully some airspace authorities outside the US will either de-certify these death traps or permanently ban them from their airspace before Boeing and the FAA decide to clear them for flying once again.
6
40 seconds make for good headlines, but actually it is an eternity in the cockpit. Having been an airline pilot for 29 years, pilots make not 40 second decisions but split second decisions to ensure safe flight. Trim lockout switches have been in existence for 40 years. So for all the Monday morning quarterbacks out there, you probably got it wrong!
Also consider the rapid growth of airlines, especially in Asian markets, and the lack of experience in the cockpit. Piloting is more about predicting problems than solving problems, proverbial seeing around corners! Management is always pushing to save money with light fuel loads, deferred maintenance items, minimal training, etc.,"Experience" pushes back, experience keeps everyone alive.
19
@Robert ....but you are exactly describing what seems to have happened here: profit margins were allowed to be the driving force - just like minimal fuel loads etc. “Experience” is valuable but also expensive - because it takes intensive training and years of practice to gather it. The promise of bascially all advanced control systems and specifically with the rise of “artificial intelligence” is that “experience” can be substituted by progressing automation and “clever” algorithms - which are usually developed by engineers who have no “experience” in the sense you are mentioning: software engineers do usually not pilot the planes they are developing for.
6
The Ethiopian Airlines co-pilot with 200 hours total flight experience is a good example of that lack of experience. The pilot was more experienced, but either should be able to handle routine sensor failures. I'd be more interested in how a nooby pilot like that reacted in the simulator, with no special test preparation, than how seasoned pilots from the most selective airlines reacted.
2
@Robert - They knew putting the engines in those places would change the dynamics. They added a program to compensate for that. Pilots were not told. Boeing offered safety features as OPTIONS. And if 40 seconds is such a long time -- why were the pilots on the ill-fated jet flipping through the manual? And they never made it. Facts First. Boeing is liable for this disaster. I truly hope they die off. American know-how -- LOL. Pitiful. This is why I fly AIRBUS on overseas trips. ALWAYS.
2
A terrible story from start to finish.
These shortcuts will end up deservedly costing Boeing billions and be a huge boon for Airbus.
You can blame the deregulation* here as well..
" We can have Boeing regulate their own aircraft... How could that go wrong?"
* This is why we need government.
159
@steve boston area When American financial regulators and aviation regulators fail, things crash--and lives are destroyed. This regulatory failure has already caused so much sorrow, and it has exposed a level of greed and communication failure in the airlines industry that will make a lot of us feel a new fear for a long time to come.
2
So much focus has been on pilot training and helping pilots recognize the problem and react quickly enough. I'm sorry, but I don't want to fly on a plane where pilots are being trained to quickly respond to a problem which can kill everyone on board. I do NOT want the plane to have the problem in the first place.
The whole thing seems like buying a new car where the sales person tells me that when I drive this car I need to know what to do when the breaks go out because that sometimes happens. I'd move on not just to a different car, but also to a different manufacturer... and one might actually survive failed brakes.
209
@Anne-Marie Hislop
In the case of the brakes going out in your car, the correct emergency procedure is to activate the emergency brake - that's why you car has one.
Aircraft are very complex mechanical/electronic/hydraulic devises which is why pilots undergo extensive training on how to handle so many potential failures.
When the 737 Max changes are certified, the aircraft will be even safer.
3
@Anne-Marie Hislop You'll have a hard time flying, then. In case of an engine failure, the asymmetric thrust will crash the plane in much less than 40 seconds. A depressurization gives even less time. Pilots are trained to instinctively respond to these and run the checklist after stabilized, which they also did in this case with the trim switches. The difference is for whatever reason they didn't try to run the right checklist, or were unable to complete it for some reason.
By the way given the data I estimate that MCAS failures and engine failures are approximately equally frequent.
But please don't stop getting on airlines! If you drive instead you're far more likely to die. In fact it's probably true that more people die from driving subsequent to a highly publicized crash than from the crash itself.
One thing I've learned from this is that the general public has no clue how to evaluate the risks of airline flight. The regulators do a very good job keeping you safe even including the rare lapse. It's not that changes shouldn't be made, it's that most of us have no clue what those should be.
1
@Robert Just because a person doesn't work in the airline industry doesn't mean a person cannot assimilate the information and details around aircraft. If that was the case, then no company executive would be able to run any business.
12
Boeing did an upgrade, the 50 year old design of the 737 (first flight 9 April 1967) had no longer in it. This produced problems which they tried to fix with a software crutch. This approach is fundamentally flawed!
The Airbus A320 is almost exactely 20 years younger (first flight 22 February 1987), and thus, could still be upgraded to the A320Neo. Airbus developped that jet at a time when many Boeing 727, BAC Trident, and Sud Aviation Caravelle were approaching the end of their service life, and an window of opportunity for a passenger jet of this size opened up. Boeing decided not to design a new plane but to stay in this market segment by upgrading it's 737 series with - among other things - more modern engines. The basic problem became apparent already back then however: The ground clearance is low. That's why the air inlets of the 737 "Next Generation" models are not circular! Maybe Boeing should have developped a new aircraft in the following 20 to 25 years, instead of just laying back, cashing in, and believing the 737 would be good forever?
32
Slapping larger engines on an air-frame not designed for them, then adding operating s0ystem overlays to deal with the resulting problems, seems Rube Goldbergesque to me. Doesn't it to you? A machine created by marketing.
All of this, the resultant deaths and such, is a result of a rushed attempt at preventing a competitor (Airbus) from taking market share, and for no other reason than that. I don't know if you can consider this decision by Boeing to be prosecutorially criminal, but it certainly is shameful.
John~
American Net'Zen
15
@John
The airframe was not the problem. It is the same basic airframe that has been in service since the 707, and has proven itself with many configurations of the 737 not to mention the original 707, 727, and the 757.-- all Boeing narrowbody aircraft have the same basic airframe. Previous iterations of the 737 have been altered in various ways over the years to accommodate different sized engines without creating problems. Nor was rushing to market a problem -- the software and training issues that are almost certainly at the root of this could have been addressed without any delay in getting the MAX to market.
4
@John Binkley Apparently not, unless you are suggesting that Boeing engineers and management were asleep at the will or acting with malice.
1
@John do you think graduate engineers of all stripes at Boeing making pretty decent incomes (use your imagination) are going to sit by and watch their work being manipulated for profit resulting in the flouting of basic rules of safety? Not to change the subject, but in the same vein, why do you think US nuclear subs cost so much?
Looks like Boeing should be charged with civil and criminal crimes. It maybe time to break up Boeing. They have a monopoly and this is non competitive and has led to overlooking basic safety procedures.
16
Your comment makes little sense, since it was their competitor's superior machine that drive them to seek a quick update solution to the 737. As for "criminal and civil charges", I'd prefer to wait for the final investigation reports, rather than just baying for blood.
4
@PeteH
They have no competition in the United Ststes . Airbus is in Europe.
Look for major class action.
3
@Ralph Petrillo
Airbus is in Europe so therefore Airbus is not a competitor of Boeing? That's ludicrous.
Designing and marketing airliners is a hugely expensive business, and cannot support more than a very few companies. McDonald Douglas and Lockheed, not to mention Hawker-Sidley and a few others found that out the hard way. Their aircraft ultimately failed, with loss of lives, in part because they didn't have sufficient economic resources to develop them. Having multiple competitors building airliners is a non-starter. Be glad we have at least two.
2
The fix for this needs to be three sensors. All providing data at the same time. If one is eroneous the other two will vote it out. If too much conflicting data is be supplied on all three then the system automatically isolated from the MCAS system and an EICAS message displayed. Then the airplane can be repaired at the next station. Anything less is still cutting corners. Captain B777.
118
@Mike
The software for effective use of triple redundancy has existed for a long time. I used it about 28 years ago on air conditioning in the National Gallery London.
13
@Mike. Quite right. This is the only adequate solution. It's going to take a lot of work though, especially for the planes already delivered, as the sensors will have to be fitted, wired up and tested, the software updated, installed and tested, the warning system wired in and each plane flight tested after the completion of the work.
And it still looks as though Boeing have failed even to acknowledge that this work is going to have to be done.
A clear statement from one of the regulators that this is what will be required would help move things along.
12
@Mike If you use multiple sensors, then how will the software know which one is giving correct readings if they are all not providing correct readings such as after a bird strike?
3
The fact remains that the MCAS system would not even be necessary if the basic re-design of the airplane was not inherently flawed.
306
@Neil You are absolutely correct. MCAS is a band aid that simply adds more complexity to an already complex aircraft. The last thing an aircraft needs is for software to automatically put it in nose dive unexpectedly. All of this has come about because Boeing wanted the cheaper route of pushing an "upgrade" or "modification" as opposed to properly redesigning an aircraft originally built in 1967.
28
@Neil
Spot on. End of story.
13
@Neil
It would be interesting to know how many time MCAS system did actually worked as intended and prevented stalling & accident. Just how unstable is this plane?
Boeing has all necessary data ...
14
Studies of various types of accidents almost always result in the same findings, that accidents rarely have a single cause. There is a chain of events that lead up to the ultimate failure of the system. A failure of single link in that chain would result in disaster. In the case of Apollo 13 and the Challenger accident, there were multiple failures.
If the investigations show the Max 8 accidents were caused by an MCAS failure, It would seem that the missing links would have been to have a few software safe guards that would have automatically disabled the system if there was conflicting information received from multiple senors or if the the system detected repeated activation of nose up trim inputs, which would indicate that the pilot was trying to counter a nose down condition.
That such safeguards were not built into the MCAS system from the beginning is inexcusable and indicates either an urgency to get the planes out the door or an arrogance that the system was "unsinkable" #Titanic.
83
Probably the result of having MBA management types in charge who were admitted to Harvard by having their parents pay off some coaches.
36
This system appears to have been designed in a theoretical vacuum. Surely even basic around-the-table conversations would have raised the issue of a single point of failure? It has all the hallmarks of a late in the day fix for another problem (new engines on an old airframe) which never got the attention it deserved from manufacturer or regulator.
‘Hi, Bob? We sorted that issue out. Yeah. Just a software fix. Very neat’.
76
Time for Boeing to hire a team of lawyers and new engineers. Also time to dismiss all FAA employees and jail those responsible for ignoring their duties. Seems that U.S. Government bureaucrats don't think they have to do anything other than show up (if they even do that). Where is their boss ?
29
@Tomario
The engineers are not the problem. They probably were well aware of the design flaw but the management forced them to come up with a "software solution" to cover up the problems.
75
The problem isn't engineers and government inspectors, it's Congress and marketers.
3
@Two in Memphis
I would add that it isn’t the fault of the rank and file FAA employees either. They aren’t the ones who decided the FAA would be so small that the safety evaluation of an airplane would have to be left to its manufacturer. Also, they aren’t the ones who decided it was OK to have only one American manufacturer, and only two manufacturers in the whole world.
11