RangerNS

How the Boeing 737 Max Disaster Looks to a Software Developer

Quite the description.

bimmerdriver

I agree with your first point and I was disgusted when they used the words "making an already safe aircraft safer". While Boeing did not use the words "deeply flawed", they since have admitted MCAS is flawed and if you look at the changes they made to MCAS, it was clearly deeply flawed. I was trying to economize on words, but there was a loss of precision in the way I referenced Boeing in that statement.

I'm not claiming that the number of crashes of the MAX isn't unacceptable either. I have never claimed that and I would be surprised if anyone thinks the failure rate of the MAX is acceptable.

WRT the number of failures, you are missing my point, which is that in the cases where there were no issues, MCAS either did or did not "augment maneuvering characteristics" exactly as it was intended to. Its intended purpose is make the maneuvering characteristics of the MAX the same as the NG. MCAS decides if it should or should not "augment maneuvering characteristics" based on AoA. In those cases, which cover all of the flights except two crashes (plus however many other flights in which there were AoA sensor issues), the MAX flies exactly as it's supposed to fly. Obviously, MCAS is not supposed to fail so ungracefully and in those cases where it did, it points out that its design is critically flawed, not that its intended purpose is flawed. This is why I've been saying that people criticizing the overall design of the MAX or the intended purpose of MCAS are barking up the wrong tree. There is nothing wrong with the intended purpose of MCAS, what's wrong is the design that is intolerant of the loss of an accurate measurement of AoA. Tired of flogging the dead horse...

canopus27

I think we all agree that a design that is intolerant of the loss of an accurate measurement of AoA, is a bad thing.

Obviously where there's a divergence, is about the fundamental design of the MAX, and the requirement for MCAS in the first place.

My opinion is that they will eventually certify the MAX (with improved software), and that software will be generally good enough.

In most cases.

Of course, even the computer centric Airbus design has fallback modes in which the computer bows out and lets the pilots fly the plane (the Alpha floor).

In the case of the MAX, when the plane has to revert to the non MCAS mode (if another bird flies into an AOA vane), I really hope that those pilots won't get into a difficult situation because of the non-standard lift and (potentially) stall inducing characteristics of the MAX airframe.

When the MCAS does next bow out because of a sensor failure - then assuming the pilots are able to recover ok, it will be despite (not because of) the basic flight characteristics of the airframe.

And that's not a great state of affairs.

bimmerdriver

Here is Juan Brown's latest video:
He talks about the purpose of MCAS and, in particular, at around 4:00, he says that with MCAS turned off, seasoned 737 pilots barely notice the difference between the MAX and previous versions of the 737, which is the point I've been making.

Stranger

bimmerdriver

You keep saying that, but the reality is that pitot tubes and AoA sensors are widely used because there are no practical alternatives. They serve their intended purpose.

Not sure what your point about MCAS is. When it gets updated, it will serve its intended purpose.

Stranger

bimmerdriver

Do you know what a pitot tube even does? It's used to measure airspeed. Airspeed indication is required for all aspects of a flight. It's not an afterthought and can't be used "conservatively". Pitot tubes have been used literally for decades, because they work. If there is another more effective way to measure airspeed, I've never heard of it.

As for the AoA sensor, below is a photo of a 737-300, which you can see has an AoA sensor, even though this generation of 737 does not have MCAS. If you look at other types of airliners, you will also see AoA sensors. Again, they are present because they are required.

Your comments reflect the original design of MCAS, which everyone agrees was flawed. The new MCAS software still relies on AoA, because AoA is the fundamental input to MCAS. Since earlier versions of the 737 also have AoA sensors, AoA indication presumably is used as an input to other aspects of the flight control system, otherwise, there would not be AoA sensors.


Notice the AoA sensor on this 737-300.

PLeblond

Apologies if this has been covered, buy a cursory search revealled nothing. From AVHearald:

On Apr 11th 2019 The Aviation Herald received a full copy of the Flight Operations Manual (FOM), Revision 18B released on Nov 30th 2018, which is currently being used by Ethiopian Airlines (verified in April 2019 to be current). Although Boeing had issued an operator's bulletin on Nov 6th 2018, which was put into Emergency Airworthiness Directive 2018-23-51 dated Nov 7th 2018 requiring the stab trim runaway procedure to be incorporated into the FOM ahead of the sign off of this version of the FOM (the entire document is on file but not available for publishing), there is no trace of such an addition in the entire 699 pages of the FOM.

Quite the opposite, in section 2.6 of the FOM "Operational Irregularities" the last revision is provided as Revision 18 dated "Nov 1st 2017".

According to information The Aviation Herald had received in March 2019, the Airline Management needed to be reminded to distribute the Boeing Operator's Bulletin as well as the EAD to their pilots, eventually the documents were distributed to the flight crew. However, it was never verified, whether those documents had arrived, were read or had been understood. No deeper explanation of the MCAS, mentioned but not explained in both documents, was offered.

It turned out, that only very cursory knowledge about the stab trim runaway procedure exists amongst the flight crew of Ethiopian Airlines even 5 months after the EAD was distributed. In particular, none of the conditions suggesting an MCAS related stab trim runaway was known with any degree of certainty. In that context the recommendation by the accident flight's first officer to use the TRIM CUTOUT switches suggests, that he was partially aware of the contents of the EAD and reproduced some but not all of the provisions and not all of the procedure, which may or may not explain some of the obvious omissions in following the procedure in full.

One might consider this as a "major contributing factor".

canopus27

The problem I have with this line of thinking is that it carries with it an implication that the crew behavior was significantly out of the range of reasonable behaviors, and so causal to the accident.

It is, of course, unknowable what percentage of MAX crews worldwide who were operating a MAX that day, would have been able to recover the flight if they were suddenly faced with the same circumstances.

I'm absolutely not claiming that 100% of them would have crashed - but I think that to blame the Ethiopian crew in any significant way, would require that the vast majority of other crews (ie, more than 99%) would have been safe. To say the percentage should be lower than that implies that you're comfortable with a plane design in which it's ok for 10 flights out of every thousand crash.

Very few humans are perfect, and I doubt the Ethiopian crew were either. Despite that, I continue to struggle to see what substantive failings the crew exhibited during the incident flight.

The situation as I understand it is that the crew did attempt to correct the trim, the runaway continued anyway, and the crew then cut out the system. Several minutes went by, the captain reported that he was having increasing trouble to control the plane, and they attempted to re-engage the system as a last ditch effort to save the plane.

Hindsight is 20/20, especially with the benefit of an FDR readout and the Boeing engineers to interpret it... but I am really struggling to place significant blame on the crew, as their actions strike me as profoundly reasonable and well with the window of behaviors that we'd expect a normal crew to exhibit.

Stranger

canadiancow

Exactly. "The pilots should have been aware of a fatal flaw in the design of the aircraft" does not mean the pilots deserve much blame. And it certainly only contributes to one of the two crashes.

PLeblond

If one considers MCAS as a fatal flaw, then I suggest they also consider most autopilot systems, auto-throttles, TOGA and a multitude of other automated processes as the same. There are several dozen automated systems in a modern airplane that can cause a major crash, if the operating crew does not understand how they work, or know what to do in the case of a system failure.

After Lionair, every airline had a responsibility to better understand the system and train accordingly. Given the updated information was not in ET's flight manuals as late as April 2019 means they share a large part of the responsibility.

As for truelfatal design flaws, I suggest you avoid the MD80/717 family at is, by definition, has a fatal design flaw. But no one is grounding that, are they...

ridefar

Or, AoA is presumably NOT used as an input to other aspects of the flight control system, otherwise, there would have been multiple crashes of earlier 737 generations.

There. Now we both have made statements based on baseless speculation. Why do you insist on make a positive statement based on an absence of positive knowledge as your only evidence?

So... how many AoA sensors are there on a previous generation 737? And what are they used for? If there aren't 3 or 4, and you don't know, and they can't be used by MCAS, and they all aren't all used by MCAS in this "fix" then what reason do we have to believe that MCAS is any better this time around (after the fix)?

bimmerdriver

I'm having a hard time following your logic and I disagree with your conclusion that the pilots behaved reasonably. Juan Brown has been very careful in his choice of words describing the pilots and he has not pulled any punches with regards to the role of Boeing. He has also acknowledged that the situation was difficult for the pilots. However, he has also discussed the role and training of pilots, not only in nominal situations, but in emergency situations. Pilots are trained to deal with both situations and everything in between. As a former 737 NG pilot, he has said numerous times that a 737 pilot is trained to follow the runaway trim procedure. MCAS failure is a specific case of runaway trim. It's been pointed out in multiple places (not only by Juan Brown, but elsewhere) that not only did the ET310 pilots not control their airspeed, but they also took a long time to turn off MCAS and unbelievably, they turned it back on. So they made two significant errors directly contrary to procedures. AFAIK, the AoA sensor failed not long after take-off, before the flaps were retracted. They should have turned around right then, but they didn't. We will never know why.

Everyone knows that pilots are human beings, and as a result, they are capable of making mistakes. I find it strange that people are so reluctant to admit that the pilots made errors and those errors may have contributed to the outcome. Is this reluctance because the pilots are African? I don't know. Personally I don't care what the nationality or ethnicity of a pilot is, as long as the pilot is qualified. This is not a matter of Boeing designing an aircraft that requires superhuman capabilities to fly. Depending on what the emergency situation is, any aircraft in an emergency situation can be difficult for pilots. This is why they are supposed to be highly trained and highly skilled. I'm sure the accident investigators already have a good idea if the pilots could have prevented the crash. Hopefully the final report will be honest in this regard.