Boeing

[Thumper]

First of all, at least 90% of people, whether I read or hear them as an informed news source, a layman on the street, or g*d forbid, a "reader comment," have absolutely no idea what they're talking about when it comes to the recent events with the 737 Max. The most ignorant and uninformed quips are basically conspiracy theories where Boeing and the evil American government planned to kill thousands of people or make billions of dollars on their deaths. Great theory: we're going to kill all of our customers to make money. That's all for now. If anyone is interested it talking about the subject, I'm in.

[geonuc]

I hadn't heard any of that conspiracy nonsense but I'm not surprised. I do worry about the FAA being in bed with Boeing. It's important for the confidence of air travelers that the agency remain biased in favor of the consumer. Their reluctance to ground the Max 8 after virtually every other country had done so was disturbing.

It's a little like the NRC for me. That is an agency that I'd had unwavering confidence in in terms of unbiased and uncorrupt regulation. But now, not so much.

[SciFiFisher]

It does appear that Boeing had undue influence on the regulators. I suspect it was a case of "trust our expertise". And the regulators apparently did instead of questioning things they should have questioned.

[SciFiFisher]

As for the conspiracy theorists. I would refer you and them to an episode of "Adam Ruins Everything" in which he discusses why we prefer conspiracy and why it is bad that we do. How Random Events Create Conspiracy Theories

[Thumper]

I still don't think they necessarily should have been grounded. But that's my personal, non-expert opinion. I think the grounding in many countries was uninformed and knee jerk. And then when everyone else followed along, the FAA first looked like idiots and then had no choice. I cannot fathom how a second crash happened after the first one. Unfortunately, the final conclusions along with the recommendations and actual "fixes" always take time. The NTSB does a rigorous, thorough, exhausting investigation to determine the causes and all contributing factors of a crash with the intent that a crash like that never happens again. But it often takes a year or more. So I do get the alarm when there were two similar crashes so close together. There does need to be fixes in hardware, software, pilot training, company practices, engineering, and maintenance. But I'd have flown on a MAX the day after the second crash. Because I would be certain that every MAX pilot in the US would be thoroughly familiar with the crash parameters and how to avoid them before their next hop.

The ironic thing to me, is that the grounding of the planes may cause more deaths. As many flights in the US were cancelled, many people may have chosen to drive to their destination. We lost over 1100 people on Ohio highways last year. That's 5 or 6 Max crashes a year, every year. And that's just Ohio. I get it, every accidental death is tragic, everytime. We lose orders of magnitude more people in auto crashes than air crashes. I don't hear alot of ignorant uniformed outrage about that on a daily basis. Air crashes are spectacular, they are media worthy.

[Thumper]

As for the conspiracy theorists. I would refer you and them to an episode of "Adam Ruins Everything" in which he discusses why we prefer conspiracy and why it is bad that we do. How Random Events Create Conspiracy Theories

I think I saw that episode.

[Thumper]

It does appear that Boeing had undue influence on the regulators. I suspect it was a case of "trust our expertise". And the regulators apparently did instead of questioning things they should have questioned.

As I read it, the FAA would not certify the aircraft unless Boeing implemented the MCAS. I can go into what I know about it, why it was deemed needed, and the apparent lack of training on it if anyone is interested. Unfortunately, it can get lengthy because it involves many, many factors.

[SciFiFisher]

It does appear that Boeing had undue influence on the regulators. I suspect it was a case of "trust our expertise". And the regulators apparently did instead of questioning things they should have questioned.

As I read it, the FAA would not certify the aircraft unless Boeing implemented the MCAS. I can go into what I know about it, why it was deemed needed, and the apparent lack of training on it if anyone is interested. Unfortunately, it can get lengthy because it involves many, many factors.

So... you need to do a TLDR version?

[geonuc]

Here's my take. Correct me where I have it wrong.

The Max 8 has an MCAS system that automatically corrects an improper angle of attack by adjusting the stabilizers, preventing a stall. The MCAS relies on data from one sensor to determine the plane's angle of attack. On the Lion Air flight, the sensor was faulty and reported an angle of about 20 degrees when in fact the plane was at it's normal angle. So it adjusted the stabilizers to bring the sensor reading back into proper range but that actually had the effect of causing a nose dive. The pilots had no idea what was going on and attempted to counteract the system by adjusting the stabilizers manually but the MCAS simply re-engaged and counteracted those efforts. A tug of war with the stabilizers happened between the pilots and the MCAS, which the pilots (and everyone else on the plane) eventually lost. The latest reports are the other plane that crashed had similar problems.

Boeing's solution (so far) is to have MCAS take input from two redundant sensors and to activate a warning if those sensors disagree. It also will have MCAS not re-engage if the pilots manually take control of the stabilizers. So, no tug of war.

I hear you about relative risks and dangers vis-a-vis driving, etc. And I'm also way more confident that US pilots - and those from other first-world countries - probably wouldn't allow MCAS to do what it did. But if what is being reported is true, I'm good with grounding the fleet until Boeing makes those changes.

I mentioned the NRC before and I'll draw the parallel again. As you know, I have a long career with nuclear systems, primarily safety systems. The reason I have been so unabashedly pro-nuclear in terms of plant safety is the defense in depth culture that pervades the industry and which the NRC not only agreed with but imposed. Airliners are not nuclear plants but similarities exist in how engineering is done, or should be done. If in fact the MCAS did what the reports say it did and had only one sensor, I'd say Boeing's engineers (or more probably those attempting to keep costs down) had a massive failure. There is no way in hell any one sensor could imperil a nuclear plant. Or even two sensors. Or three, four.

[SciFiFisher]

It makes me wonder if they didn't realize that the automated system would fight with the pilot when they took over manually? Sometimes second and third order effects that seem so obvious get missed because people think it's impossible or won't happen.

[geonuc]

As I read it, the FAA would not certify the aircraft unless Boeing implemented the MCAS. I can go into what I know about it, why it was deemed needed, and the apparent lack of training on it if anyone is interested. Unfortunately, it can get lengthy because it involves many, many factors.

I'm interested.

[Thumper]

Sorry, been out in the field most of the week and again today. I'll post something (hopefully sensible) soon.

[geonuc]

Sorry, been out in the field most of the week and again today. I'll post something (hopefully sensible) soon.

It is unacceptable to let work get in the way of other priorities!

[SciFiFisher]

Sorry, been out in the field most of the week and again today. I'll post something (hopefully sensible) soon.

It is unacceptable to let work get in the way of other priorities!

Exactly!

[Thumper]

So I agree with pretty much all of Geo's analysis. Like him, the biggest thing I do not understand is why the MCAS system would rely on just one sensor. Let's go back to the beginning to get a little more perspective, I'll be brief (HA!)
The Boeing 737 is a tried and true trusted aircraft that has been around forever. It's been modified many times over the years with new models released to make them bigger, faster, more efficient, quieter, safer. But each time it was still a 737. Pilots that were qualified on a previous version of the aircraft would only need minimal training to qualify and fly the newest version. There are various levels of qualification requirements depending on a pilot's current certifications, licenses, and hours flown on specific aircraft. For companies purchasing aircraft, it is much more economical for them to choose planes for which their pilots are already certified or mostly qualified to fly. If an airline purchases a new plane that they have not flown before, obviously there will be considerable expense and time to qualify the pilots on it. Not to mention maintenance, engineering, and servicing.

The newest Max versions of the 737 were created to compete directly with certain Airbus models on certain routes with certain passenger loads. Boeing chose modifying (once again) its workhorse 737 rather than going to the drawing board and going through the larger expense of creating a brand new plane. Hopefully cheaper for Boeing, and cheaper and thus more attractive to the companies. The Max is longer and the engines physically larger than the NG models. Due to its low clearance, the larger engines had to be moved forward and elevated higher in the wings (I also think they were moved inboard somewhat). These changed the flight characteristics of the aircraft especially in certain circumstances. During certification flight testing, the FAA determined that there was a not insignificant risk of an aerodynamic stall in high speed, high thrust situations after the flaps and slats had been retracted (shortly after takeoff, on the climb out). So they mandated Boeing to install some sort of automated system to aid in preventing a stall in those situations while the pilots were flying the plane manually, before they would certify the aircraft for flight. MCAS was born. When the system detects the AoA is too high, the nose is pitched too far up and the plane is entering a potential stall condition, it uses the trim system of of the rear stabilizers to push the nose back down to an acceptable AoA. Now on a couple of planes, the AoA sensor malfunctioned and chaos and tragedy ensued.

The take off and climb portion of the flight are very busy for the crew, there's alot going on. Due to several factors: cost, additional training, and pilot sensory overload, it was deemed unnecessary to put visual or aural warnings in the cockpit alerting the crew that the MCAS situation was engaging. In a perfect world, if a plane was entering an unsafe AoA, the system would quietly kick in and help the pilot ease the nose back down preventing a stall. As both SciFi and Geo have pointed out, there seemed to be a single point failure and consequences of the consequences were either not considered or deemed negligible. There are procedures if pilots have issues with the rear stabilizers, the condition is listed as "Runaway Stabilizer" in the Non Normal Flight portion of the flight manual. Boeing and the FAA thought that was sufficient.

Pilots and autopilots are constantly "trimming" the aircraft. During a climb, whether than having to pull back on the yokee

[Thumper]

So an IT guy (the good kind, he actually helps me) came by to do some work on my machine and I had to log off quickly. Rather than try to save my post as a draft, I just sent it as is. Anyway:

So that a pilot doesn't have to pull back or push forward on the yoke for long periods of time to maintain the desired pitch, they simply trim the aircraft. On the climb out, they put the plane in the proper pitch, then with a button, move the rear stabilizers until that position is "neutral." The plane will maintain that attitude with no input on the yoke. The autopilot also uses trim to maintain or change altitudes. If you're at 10,000 feet and want to climb to 20,000 feet, you can pull back on the yoke a bit and hold it until you reach your desired altitude, or you can adjust the trim of the stabilizers one time, then readjust it back when you get there.

If there is a fault in the trim system, such as the motor controlling the jack screw that moves the entire stabilizer sticks and runs the stabilizer full up or full down, it's called a Runaway Stabilizer. The fix is to flip two cutout switches that provide power to that motor. On a 737 there are trim wheels on either side of the throttle console that can then be used to manually adjust the trim. Apparently, in the Lion Air crash, the pilots did not perceive that they had a stabilizer issue, they were confused. They adjusted the pitch back up electrically with the switch on the yoke but MCAS repeatedly kicks back in and pitches the plane back down. As long as the AoA sensor was feeding faulty info to MCAS, it would continue to trim the nose down. The pilots pulled back on the yoke to counter that action and eventually lost that battle. The reason being, a trim adjustment moves the entire stabilizer. Pulling back on the yoke only moves the elevator control on the back edge of the stabilizer. This has much less surface area and much less effect. It's like a linebacker arm wrestling a coxswain. It's impossible to overcome (thus the procedure to override or cutout the runaway stabilizer). It appears that the pilots of possibly both doomed flights were confused, overwhelmed by the alarms and indicators in the cockit, and completely unaware as to why they could not control the pitch of the aircraft. And were unable to find the solution.

[Thumper]

The reason that just pulling back on the yoke doesn't is because that would render the entire MCAS system useless. A pilot is pulling back and putting the plane into a potential stall but doesn't know it. MCAS kicks in and corrects the pitch. The pilot says whoops, what happened, I want to pitch up He pulls back on the yoke, which disconnects MCAS, the plane over pitches up, the plane stalls.

Interestingly, I was watching an episode of Air Crash Investigations last night about an Airbus A-300 crash. It was one of the first aircraft with major flight automation changes. During the landing sequence, the pilots inadvertently put the plane into "Go Around" mode. This is done when you are not in a stable landing sequence for whatever reason and elect to abort the landing, go around and try again. It's called a missed approach. On this plane when you engage Go Around mode, the thrust increases, and the stabilizers automatically adjust into a pitch up configuration. The pilots tried and tried to push the nose down with the yoke to continue the landing. Then they disengaged the auto throttles, and slowed the plane down to try to descend. However, this particular aircraft remains in "Go Around" mode until you put the flight control system into another mode. So although they were finally descending toward the runway, they were still pitch up and losing airspeed drastically, approaching stall. The captain realized this and attempted a full manual go around. But with the stabilizers already set in a pitch up config and the the increasing thrust pitching the plane up more, it nosed up into an aerodynamic stall, and plummeted. Originally the investigators blamed the pilots only. But they studied the weird, suble operations of the FCS in the Go Around mode, and also found that the captain had trained on a simulator in a different country because his company did not have a simulator for the A-300. In that simulator, the Go Around mode could be disengaged simply by pushing forward on the yoke. So in the confusion of the landing, he could not understand why he could not control the pitch. There would have been several solutions. The flight control manual was ambiguous and confusing about those systems as well. As a result of the crash report, they changed the indicators and the ability to disengage go around, and also had Airbus rewrite the manual.

I wasn't aware at the time of that crash (there were actually several incidents where pilot confusion with the automation characteristics nearly caused crashes) of any major backlash against Airbus or the certifying authorities like we're seeing today.

[Thumper]

How's that for keeping it short? Geez I suck.

[Sigma_Orionis]

Very interesting explanation Thumper. As an IT guy (of the BAD kind ) I am used to see spectacular failures due to sloppy coding or sloppy operation. From your and geonuc's explanation it seems to be a design failure caused by the requirement to keep costs down. The impression I had from the news was that it was a software issue. Like this one

[Thumper]

Hilarious!

I mean scary!

[SciFiFisher]

It's true. I think the AI singularity has already occurred and the AI just hangs around screwing with us.

[geonuc]

Thanks for that detailed explanation. You obviously are well-versed in the subject.

Do you place any fault with the FAA for requiring Boeing to devise and install MCAS? Or perhaps for failing to follow up to see that the eventual design wasn't flawed? How much does the FAA get into that sort of determination?

[Thumper]

That part is unclear to me. It will be interesting to see if the FAA itself gets any "blame" for the issues. If I had to guess, in a nutshell I'd say it was somewhat unofficial conversations. "Okay, Boeing, you want to sell this as an existing, "improved" aircraft. We'll go with that, but you have to do something about the increased stall characteristics of this beast. Then we'll sign off."

I'm guessing maybe they didn't rigorously test those systems as well as they could. Maybe saw some simple demos. I will be interested in the findings in the final NTSB report. (I'm not sure who's cover the report will go out under since both crashes involved foreign companies crashing in foreign lands.) But the NTSB will be involved. Those reports are highly detailed and very thorough. They can take an awful long time to come out. Two years wouldn't be surprising. So obviously, many steps will be taken to improve safety long before then.

[geonuc]

I think it's interesting that one of the two involved airlines (I forget which one) decided to send their two recovered flight recorders to European experts for analysis rather than to the NTSB.

[Thumper]

As I understood it, Paris was the closest location that had a lab capable of working on the recorders and recovering data. But I wouldn't rule out a possible slight to the US. I just don't have any info in that regard.