Jan 4, 2021, 1:37 am
Last edit by: WineCountryUA
This is an archive thread, the archive thread is https://www.flyertalk.com/forum/united-airlines-mileageplus/1960195-b737max-cleared-faa-resume-passenger-flights-when-will-ua-max-flights-resume.html
Thread Topic
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
United does not fly the 737 MAX 8 that has been involved in two recent crashes, but it does operate the 737 MAX 9.
How to tell if your flight is scheduled to be operated by the MAX 9:
View your reservation or flight status page, either on the web or on the app. United lists the entire aircraft type. Every flight that is scheduled to be on the 737 MAX will say "Boeing 737 MAX 9." If you see anything else -- for example, "Boeing 737-900," it is not scheduled to be a MAX at this time.
The same is true in search results and anywhere else on the United site.
For advanced users: UA uses the three letter IATA identifier 7M9 for the 737 MAX 9.
All 737 MAX aircraft worldwide (MAX 8, MAX 9, and MAX 10) are currently grounded.
Thread Topic
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
READ BEFORE POSTING
Once again many posters in this thread have forgotten the FT rules and resorted to "Personal attacks, insults, baiting and flaming " and other non-collegial, non-civil discourse. This is not allowed.
Posters appear to be talking at others, talking about others, not discussing the core issues. Repeating the same statements, saying the same thing LOUDER is not civil discourse. These problems are not with one poster, they are not just one point of view, ...
As useful as some discussion here has been, continuing rules violations will lead to suspensions and thread closure. Please think about that before posting.
The purpose of FT is to be an informative forum that, in this case, enables the UA flyer to enhance their travel experience. There are other forums for different types of discussions. This thread was had wide latitude but that latitude is being abused.
Bottom line, if you can not stay within the FT rules and the forum's topic areas, please do not post.
And before posting, ask if you are bringing new contributing information to the discussion -- not just repeating previous points, then please do not post.
WineCountryUA
UA coModerator
Once again many posters in this thread have forgotten the FT rules and resorted to "Personal attacks, insults, baiting and flaming " and other non-collegial, non-civil discourse. This is not allowed.
Posters appear to be talking at others, talking about others, not discussing the core issues. Repeating the same statements, saying the same thing LOUDER is not civil discourse. These problems are not with one poster, they are not just one point of view, ...
As useful as some discussion here has been, continuing rules violations will lead to suspensions and thread closure. Please think about that before posting.
The purpose of FT is to be an informative forum that, in this case, enables the UA flyer to enhance their travel experience. There are other forums for different types of discussions. This thread was had wide latitude but that latitude is being abused.
Bottom line, if you can not stay within the FT rules and the forum's topic areas, please do not post.
And before posting, ask if you are bringing new contributing information to the discussion -- not just repeating previous points, then please do not post.
WineCountryUA
UA coModerator
This thread has engendered some strongly felt opinions and a great tendency to wander into many peripherally related topics. By all normal FT moderation standards, this thread would have been permanently closed long ago ( and numerous members receiving disciplinary actions).
However, given the importance of the subject, the UA Moderators have tried to host this discussion but odd here as UA is not the top 1 or 2 or 3 for MAX among North America carriers. However, some have allowed their passion and non-UA related opinions to repeatedly disrupt this discussion.
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
Discussion of Boeing's culture or the impact on Boeing's future is not in scope. Nor is comments on restructuring the regulatory process. Neither is the impacts on COVID on the general air industry -- those are not UA specific and are better discussed elsewhere. And for discussion of UA's future, there is a separate thread.
Additionally repeated postings of essentially the same content should not happen nor unnecessarily inflammatory posts. And of course, the rest of FT posting rules apply including discuss the issue and not the posters.
The Moderator team feels there is a reason / need for this thread but it has been exhausting to have to repeated re-focus the discussion -- don't be the reason this thread is permanently closed ( and get yourself in disciplinary problems).
Stick to the relevant topic which is (repeating myself)
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
WineCountryUA
UA coModerator
However, given the importance of the subject, the UA Moderators have tried to host this discussion but odd here as UA is not the top 1 or 2 or 3 for MAX among North America carriers. However, some have allowed their passion and non-UA related opinions to repeatedly disrupt this discussion.
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
Discussion of Boeing's culture or the impact on Boeing's future is not in scope. Nor is comments on restructuring the regulatory process. Neither is the impacts on COVID on the general air industry -- those are not UA specific and are better discussed elsewhere. And for discussion of UA's future, there is a separate thread.
Additionally repeated postings of essentially the same content should not happen nor unnecessarily inflammatory posts. And of course, the rest of FT posting rules apply including discuss the issue and not the posters.
The Moderator team feels there is a reason / need for this thread but it has been exhausting to have to repeated re-focus the discussion -- don't be the reason this thread is permanently closed ( and get yourself in disciplinary problems).
Stick to the relevant topic which is (repeating myself)
The reason for continuing this thread is to inform the UA traveler on the status of the MAX recertification and if / when UA might deploy the MAX aircraft. And UA flyer's thoughts about UA deploying the MAX if that was to happen.
WineCountryUA
UA coModerator
United does not fly the 737 MAX 8 that has been involved in two recent crashes, but it does operate the 737 MAX 9.
How to tell if your flight is scheduled to be operated by the MAX 9:
View your reservation or flight status page, either on the web or on the app. United lists the entire aircraft type. Every flight that is scheduled to be on the 737 MAX will say "Boeing 737 MAX 9." If you see anything else -- for example, "Boeing 737-900," it is not scheduled to be a MAX at this time.
The same is true in search results and anywhere else on the United site.
For advanced users: UA uses the three letter IATA identifier 7M9 for the 737 MAX 9.
All 737 MAX aircraft worldwide (MAX 8, MAX 9, and MAX 10) are currently grounded.
B737MAX Recertification - Archive
Mar 14, 2019, 3:20 pm
#466
FlyerTalk Evangelist
Join Date: Oct 2001
Location: Austin, TX
Posts: 21,386
I'm not a pilot but know one who flies 737s for UA very well. He continues to claim that MCAS was "new" on the MAX series and Boeing did not provide adequate flight crew documentation/training on MCAS when it came out. They did provide it after and, supposedly, in response to the Lion Air crash.
Mar 14, 2019, 3:27 pm
#467
Join Date: Jan 2005
Location: New York, NY
Programs: UA, AA, DL, Hertz, Avis, National, Hyatt, Hilton, SPG, Marriott
Posts: 9,447
Wouldn't the training requirement to be:
1) Train pilots on the MCAS system -- how to detect that it is malfunctioning and what steps to take to disable it, and quickly enough to prevent not just crashing but violating altitude restrictions, causing passenger injuries/discomfort, etc
2) Train pilots how to *safely* fly the plane with MCAS disabled. Do all of the airlines involved have access to the right simulators to do this, how much time is needed to become aware/proficient in the differences between the raw aerodynamics of the MAX and previous 737s to avoid stalls in all weather conditions, altitudes, airspaces etc?
I'm not saying that's not the right answer, but I think it's more than just turning off MCAS and flying what is now might be a different plane than you're certified to fly.
1) Train pilots on the MCAS system -- how to detect that it is malfunctioning and what steps to take to disable it, and quickly enough to prevent not just crashing but violating altitude restrictions, causing passenger injuries/discomfort, etc
2) Train pilots how to *safely* fly the plane with MCAS disabled. Do all of the airlines involved have access to the right simulators to do this, how much time is needed to become aware/proficient in the differences between the raw aerodynamics of the MAX and previous 737s to avoid stalls in all weather conditions, altitudes, airspaces etc?
I'm not saying that's not the right answer, but I think it's more than just turning off MCAS and flying what is now might be a different plane than you're certified to fly.
I'm not a pilot but know one who flies 737s for UA very well. He continues to claim that MCAS was "new" on the MAX series and Boeing did not provide adequate flight crew documentation/training on MCAS when it came out. They did provide it after and, supposedly, in response to the Lion Air crash.
MCAS was developed to correct a nose-up tendency in specific attitude with a high stall speed configuration, brought about by the placement of the engine pods (slightly greater lift). The MCAS, as we've discussed, trims the nose down slightly if the pilot does not counteract it so that a stall can be avoided. It also helps bring the flying characteristics of the MAX closer to that of other, earlier 737 series. That's why it was an essential component to retaining the same type rating.
Boeing's argument was that because the system is fully automated, functioning in the background, and designed only to engage to preserve the safety of the flight in a narrow scenario, additional pilot training on the system was not necessary. Moreover, it argued that additional training would be superfluous because the airplane was going to behave just like any other 737 in that phase of flight. With respect to failure modes, they would present in the same way (to the pilot) as a runaway stabilizer, which is remedied by a specific checklist on which all 737-rated pilots receive training anyway. Whether that logic in and of itself was negligent, or there was some other nefarious reason for that course of action remains to be seen, but that's essentially how it happened.
Following the Lion Air crash, Boeing published materials that fully describe the purpose and function of the MCAS system, and set forth a procedure to disengage it, which follows the steps a pilot would be expected to take in the event of a runaway stabilizer. Boeing (and no doubt UA, AA, WN, AC) contends that properly-trained pilots were already well-equipped to safely handle the scenario presented by an inappropriate MCAS activation. The bulletins that came out after Lion Air increased situational awareness but did not introduce any novel procedures or protocols.
I think the question that needs to be asked, and will be asked, but can never be answered, is whether the pilots of the Lion Air or Ethiopian flights, if presented with a runaway stabilizer situation unrelated to MCAS, would have been able to diagnose it and react appropriately in a way that would have led to the safe conclusion of their respective flights. It's possible, and even likely that the answer is no, and that essentially negates the MCAS "demon."
Mar 14, 2019, 3:59 pm
#468
Join Date: Jul 2012
Location: Chicago
Posts: 1,161
The point is that 737-rated pilots already were trained in the procedure to safely correct a MCAS runaway. This is indisputable fact, and pilots absolutely can fly safely with the MCAS disabled... it can be modeled in a simulator simply by cutting out automatic stabilizer trim. Some airplanes (like the 737) have a manual trim wheel which allows pilots to simply trim the stabilizer by hand, rather than relying on automation or electric trim control. Again, it's something 737 pilots were trained on long before the MAX was even conceived.
He's 100% right. The MCAS was a new system for the MAX, but it was embedded into the flight control system the same way as other automated flight augmentation systems, like yaw damper, Mach trim, speed trim, etc. These are all automated systems installed on aircraft to counteract known, hazardous aerodynamic tendencies and phenomena (Dutch roll, Mach tuck, etc.).
MCAS was developed to correct a nose-up tendency in specific attitude with a high stall speed configuration, brought about by the placement of the engine pods (slightly greater lift). The MCAS, as we've discussed, trims the nose down slightly if the pilot does not counteract it so that a stall can be avoided. It also helps bring the flying characteristics of the MAX closer to that of other, earlier 737 series. That's why it was an essential component to retaining the same type rating.
Boeing's argument was that because the system is fully automated, functioning in the background, and designed only to engage to preserve the safety of the flight in a narrow scenario, additional pilot training on the system was not necessary. Moreover, it argued that additional training would be superfluous because the airplane was going to behave just like any other 737 in that phase of flight. With respect to failure modes, they would present in the same way (to the pilot) as a runaway stabilizer, which is remedied by a specific checklist on which all 737-rated pilots receive training anyway. Whether that logic in and of itself was negligent, or there was some other nefarious reason for that course of action remains to be seen, but that's essentially how it happened.
Following the Lion Air crash, Boeing published materials that fully describe the purpose and function of the MCAS system, and set forth a procedure to disengage it, which follows the steps a pilot would be expected to take in the event of a runaway stabilizer. Boeing (and no doubt UA, AA, WN, AC) contends that properly-trained pilots were already well-equipped to safely handle the scenario presented by an inappropriate MCAS activation. The bulletins that came out after Lion Air increased situational awareness but did not introduce any novel procedures or protocols.
I think the question that needs to be asked, and will be asked, but can never be answered, is whether the pilots of the Lion Air or Ethiopian flights, if presented with a runaway stabilizer situation unrelated to MCAS, would have been able to diagnose it and react appropriately in a way that would have led to the safe conclusion of their respective flights. It's possible, and even likely that the answer is no, and that essentially negates the MCAS "demon."
He's 100% right. The MCAS was a new system for the MAX, but it was embedded into the flight control system the same way as other automated flight augmentation systems, like yaw damper, Mach trim, speed trim, etc. These are all automated systems installed on aircraft to counteract known, hazardous aerodynamic tendencies and phenomena (Dutch roll, Mach tuck, etc.).
MCAS was developed to correct a nose-up tendency in specific attitude with a high stall speed configuration, brought about by the placement of the engine pods (slightly greater lift). The MCAS, as we've discussed, trims the nose down slightly if the pilot does not counteract it so that a stall can be avoided. It also helps bring the flying characteristics of the MAX closer to that of other, earlier 737 series. That's why it was an essential component to retaining the same type rating.
Boeing's argument was that because the system is fully automated, functioning in the background, and designed only to engage to preserve the safety of the flight in a narrow scenario, additional pilot training on the system was not necessary. Moreover, it argued that additional training would be superfluous because the airplane was going to behave just like any other 737 in that phase of flight. With respect to failure modes, they would present in the same way (to the pilot) as a runaway stabilizer, which is remedied by a specific checklist on which all 737-rated pilots receive training anyway. Whether that logic in and of itself was negligent, or there was some other nefarious reason for that course of action remains to be seen, but that's essentially how it happened.
Following the Lion Air crash, Boeing published materials that fully describe the purpose and function of the MCAS system, and set forth a procedure to disengage it, which follows the steps a pilot would be expected to take in the event of a runaway stabilizer. Boeing (and no doubt UA, AA, WN, AC) contends that properly-trained pilots were already well-equipped to safely handle the scenario presented by an inappropriate MCAS activation. The bulletins that came out after Lion Air increased situational awareness but did not introduce any novel procedures or protocols.
I think the question that needs to be asked, and will be asked, but can never be answered, is whether the pilots of the Lion Air or Ethiopian flights, if presented with a runaway stabilizer situation unrelated to MCAS, would have been able to diagnose it and react appropriately in a way that would have led to the safe conclusion of their respective flights. It's possible, and even likely that the answer is no, and that essentially negates the MCAS "demon."
Mar 14, 2019, 5:20 pm
#469
Join Date: Apr 2009
Location: Houston,TX
Programs: UA Plat, Mil Miler, Marriott Bonvoy Lifetime Titanium Elite, National Exec. Elite, Hertz Prez Circle
Posts: 191
Still begs an explanation...
The point is that 737-rated pilots already were trained in the procedure to safely correct a MCAS runaway. This is indisputable fact, and pilots absolutely can fly safely with the MCAS disabled... it can be modeled in a simulator simply by cutting out automatic stabilizer trim. Some airplanes (like the 737) have a manual trim wheel which allows pilots to simply trim the stabilizer by hand, rather than relying on automation or electric trim control. Again, it's something 737 pilots were trained on long before the MAX was even conceived.
He's 100% right. The MCAS was a new system for the MAX, but it was embedded into the flight control system the same way as other automated flight augmentation systems, like yaw damper, Mach trim, speed trim, etc. These are all automated systems installed on aircraft to counteract known, hazardous aerodynamic tendencies and phenomena (Dutch roll, Mach tuck, etc.).
MCAS was developed to correct a nose-up tendency in specific attitude with a high stall speed configuration, brought about by the placement of the engine pods (slightly greater lift). The MCAS, as we've discussed, trims the nose down slightly if the pilot does not counteract it so that a stall can be avoided. It also helps bring the flying characteristics of the MAX closer to that of other, earlier 737 series. That's why it was an essential component to retaining the same type rating.
Boeing's argument was that because the system is fully automated, functioning in the background, and designed only to engage to preserve the safety of the flight in a narrow scenario, additional pilot training on the system was not necessary. Moreover, it argued that additional training would be superfluous because the airplane was going to behave just like any other 737 in that phase of flight. With respect to failure modes, they would present in the same way (to the pilot) as a runaway stabilizer, which is remedied by a specific checklist on which all 737-rated pilots receive training anyway. Whether that logic in and of itself was negligent, or there was some other nefarious reason for that course of action remains to be seen, but that's essentially how it happened.
Following the Lion Air crash, Boeing published materials that fully describe the purpose and function of the MCAS system, and set forth a procedure to disengage it, which follows the steps a pilot would be expected to take in the event of a runaway stabilizer. Boeing (and no doubt UA, AA, WN, AC) contends that properly-trained pilots were already well-equipped to safely handle the scenario presented by an inappropriate MCAS activation. The bulletins that came out after Lion Air increased situational awareness but did not introduce any novel procedures or protocols.
I think the question that needs to be asked, and will be asked, but can never be answered, is whether the pilots of the Lion Air or Ethiopian flights, if presented with a runaway stabilizer situation unrelated to MCAS, would have been able to diagnose it and react appropriately in a way that would have led to the safe conclusion of their respective flights. It's possible, and even likely that the answer is no, and that essentially negates the MCAS "demon."
He's 100% right. The MCAS was a new system for the MAX, but it was embedded into the flight control system the same way as other automated flight augmentation systems, like yaw damper, Mach trim, speed trim, etc. These are all automated systems installed on aircraft to counteract known, hazardous aerodynamic tendencies and phenomena (Dutch roll, Mach tuck, etc.).
MCAS was developed to correct a nose-up tendency in specific attitude with a high stall speed configuration, brought about by the placement of the engine pods (slightly greater lift). The MCAS, as we've discussed, trims the nose down slightly if the pilot does not counteract it so that a stall can be avoided. It also helps bring the flying characteristics of the MAX closer to that of other, earlier 737 series. That's why it was an essential component to retaining the same type rating.
Boeing's argument was that because the system is fully automated, functioning in the background, and designed only to engage to preserve the safety of the flight in a narrow scenario, additional pilot training on the system was not necessary. Moreover, it argued that additional training would be superfluous because the airplane was going to behave just like any other 737 in that phase of flight. With respect to failure modes, they would present in the same way (to the pilot) as a runaway stabilizer, which is remedied by a specific checklist on which all 737-rated pilots receive training anyway. Whether that logic in and of itself was negligent, or there was some other nefarious reason for that course of action remains to be seen, but that's essentially how it happened.
Following the Lion Air crash, Boeing published materials that fully describe the purpose and function of the MCAS system, and set forth a procedure to disengage it, which follows the steps a pilot would be expected to take in the event of a runaway stabilizer. Boeing (and no doubt UA, AA, WN, AC) contends that properly-trained pilots were already well-equipped to safely handle the scenario presented by an inappropriate MCAS activation. The bulletins that came out after Lion Air increased situational awareness but did not introduce any novel procedures or protocols.
I think the question that needs to be asked, and will be asked, but can never be answered, is whether the pilots of the Lion Air or Ethiopian flights, if presented with a runaway stabilizer situation unrelated to MCAS, would have been able to diagnose it and react appropriately in a way that would have led to the safe conclusion of their respective flights. It's possible, and even likely that the answer is no, and that essentially negates the MCAS "demon."
1) Why does an MCAS depend on only a single AoA sensor? Isn't this completely contrary to all the design principles of avoiding a "single point of failure"?
2) If MCAS was supposed to make flying more safer, and idiot proof (from getting into a stall situation), isn't it logical for it to shut itself off automatically, when it diagnoses a runaway situation? Why does this MCAS necessitate or relies solely on a pilot to diagnose a critical situation and cutoff the automation - which flies in the face of basic design principles. Does it not?
4) Does it not feel like the MCAS is band-aid to fix a engine positioning design flaw (yes, flaw)? Or to keep the same 737 certification and avoid a costly re-certification process with the FAA. Rather than fix the core issue, they designed a work-around and expecting a human to figure out and kill the "work-around" in a very dangerous situation with alarms blazing and a few seconds to react.
5) So, let's say in the event of manually cutting off the MCAS by pilots, (MCAS allegedly was designed to prevent a stall) would not not risk a stall situation? Because I read the MCAS becomes active ONLY in manual fly mode as opposed to the Autopilot. This last question is truly terrifying. If you design a product designed to work with a workaround that would prevent a fatal stall, if you kill the workaround, wouldn't you add more risk?
6) Boeing can blame the pilot and maintenance - why does a 6 month old aircraft need so much maintenance anyway?
If a manufacturer does not operate with transparency when faced (esp. when faced with design issues), aren't the flying public or even airlines (Ethiopian does not want the US to handle the blackboxes) going to lose faith and confidence in the product, transparency and leadership? Also the FAA it looks like it is hand in gloves with Boeing, because I read that FAA certifies planes based on self-certification. FAA only inspect the procedures and processes and does not really verify the end result (meaning doing a code review - I used to write software that I cannot release to my customer unless it goes through a buddy full code review). Who is watching Boeing? Truly concerning!
I would appreciate clarifications, please.
Last edited by surram; Mar 14, 2019 at 5:38 pm Reason: Adding email notification to myself; removed redundancies
Mar 14, 2019, 5:25 pm
#470
FlyerTalk Evangelist
Join Date: Oct 2001
Location: Austin, TX
Posts: 21,386
Mar 14, 2019, 5:38 pm
#471
Join Date: Apr 2009
Location: Houston,TX
Programs: UA Plat, Mil Miler, Marriott Bonvoy Lifetime Titanium Elite, National Exec. Elite, Hertz Prez Circle
Posts: 191
Apologies...done.
Mar 14, 2019, 6:26 pm
#472
A FlyerTalk Posting Legend
Join Date: Sep 2002
Location: LAX/TPE
Programs: United 1K, JAL Sapphire, SPG Lifetime Platinum, National Executive Elite, Hertz PC, Avis PC
Posts: 42,192
@bocastephen
My company works in software testing in Avionics. So, I have a nuanced view here.
I know that from a programming perspective, the folks at Honeywell, Rockwell and others (because, yeah, a lot of these systems are not actually created by Boeing, just like a lot of the software going in a car is not actually made by the OEMs) need to meet the toughest quality standard known to man. It is stringent yet well thought. And the reason why so much software goes inside vehicles now, whether they are plane or cars, is because it is advantageous - saves on gas, provides more safety, etc...
Until it doesn't. Because this is the flip side of software: it is relatively complex. A SMS can be 500K lines of code. Sure, it is often Ada (very well-defined, constrained language), it is arch-verified, but the system remains very complex. That's why any level A system has triple redundancy. The thought is, for the most critical systems, if one computer has a flaw, at least the two others will have it right, and the third one can be rebooted.
But in a case like this, could it be either that a faulty hardware provided the wrong information to the computer, which assumed command based on that faulty data? Or perhaps there is a use case when hitting just the right numbers the software came to the wrong conclusion and again took command? In both cases, and I am not an expert here, why wasn't the pilot, who is supposed to be the ultimate fail safe for all these computers, not be able to override the computer's decisions if it is obviously wrong? Shouldn't it be easy for a pilot to take command?
We don't know what happened, and there is plenty of bright experts working on this right now. So it is best to keep judgment for later. But if it turns out to be such a problem, then somewhere in the design there has been perhaps a wrong philosophy at work. Instead of seeing the pilot as a faulty decision maker that must be prevented from making mistakes (which may happen...), perhaps this should have been designed with the opposite philosophy: ultimately the pilot knows best. From a standard perspective I can see lively debates happening to ensure such problems are engineered out of the systems in the future.
My company works in software testing in Avionics. So, I have a nuanced view here.
I know that from a programming perspective, the folks at Honeywell, Rockwell and others (because, yeah, a lot of these systems are not actually created by Boeing, just like a lot of the software going in a car is not actually made by the OEMs) need to meet the toughest quality standard known to man. It is stringent yet well thought. And the reason why so much software goes inside vehicles now, whether they are plane or cars, is because it is advantageous - saves on gas, provides more safety, etc...
Until it doesn't. Because this is the flip side of software: it is relatively complex. A SMS can be 500K lines of code. Sure, it is often Ada (very well-defined, constrained language), it is arch-verified, but the system remains very complex. That's why any level A system has triple redundancy. The thought is, for the most critical systems, if one computer has a flaw, at least the two others will have it right, and the third one can be rebooted.
But in a case like this, could it be either that a faulty hardware provided the wrong information to the computer, which assumed command based on that faulty data? Or perhaps there is a use case when hitting just the right numbers the software came to the wrong conclusion and again took command? In both cases, and I am not an expert here, why wasn't the pilot, who is supposed to be the ultimate fail safe for all these computers, not be able to override the computer's decisions if it is obviously wrong? Shouldn't it be easy for a pilot to take command?
We don't know what happened, and there is plenty of bright experts working on this right now. So it is best to keep judgment for later. But if it turns out to be such a problem, then somewhere in the design there has been perhaps a wrong philosophy at work. Instead of seeing the pilot as a faulty decision maker that must be prevented from making mistakes (which may happen...), perhaps this should have been designed with the opposite philosophy: ultimately the pilot knows best. From a standard perspective I can see lively debates happening to ensure such problems are engineered out of the systems in the future.
The bottom line is a computer should never be allowed to override a conscious pilot without offering the pilot some form of kill switch to disable the computer's overriding control inputs.
I haven't seen anything indicating a software defect. The Lion Air accident appears (so far) to have resulted from an improper pilot response to the MCAS activation due to faulty hardware (AoA sensor/sender). I presume that the software "fix" is to attempt to better identify bad data from a faulty sensor to reduce the probability of an MCAS activation due to faulty data. The bigger question regarding Lion Air, IMO, is why did they keep sending the airplane out for additional flights when the previous four flights had reported similar problems?....
For example, if a pilot on a non-technie plane is watching his airspeed slow while he is in descent in a clean configuration in VFR can reference the horizon to verify his attitude indicator is OK, then deduce the problem is with the airspeed indicator. Multiple sources of information can be used to figure out which source is wrong.
IIRC, the A320 had a rather prominent Go Around button on the power levers so in the event of a go-around, the pilot was basically 1. telling the computer he was going around, hence the "illogical" control inputs at a low altitude and speed, and 2. to get the engines up and the airplane in a climb quickly with fewer pilot inputs. Again, IIRC because it was a long time ago and my memory specific are rusty, the fatal A320 crash at the air show many years ago was due to a pilot doing a go-around without pressing the button and getting into an "argument" with the computer who decided his control inputs were illogical and fought with him until the aircraft went into the trees.
Last edited by J.Edward; Mar 14, 2019 at 7:13 pm Reason: Merge multiple consecutive posts.
Mar 14, 2019, 7:36 pm
#473
Join Date: Nov 2006
Location: DSM, BKK or anywhere with an airport
Programs: UA 2P, HH Gold
Posts: 1,018
And the hits just keep on comin'
Not UA related at all, and not even Max related, but man what a month for Boeing:
https://www.cnn.com/2019/03/14/polit...ane/index.html
Not UA related at all, and not even Max related, but man what a month for Boeing:
https://www.cnn.com/2019/03/14/polit...ane/index.html
Mar 14, 2019, 7:36 pm
#474
FlyerTalk Evangelist
Join Date: Mar 2014
Location: 4éme
Posts: 12,026
I learned very early in my flight training and flying experience that you learn and ace all of the training procedures in a simulated environment but what you can't train for is how you will react in a real emergency. For me that developed over time with experience.
Mar 14, 2019, 9:03 pm
#475
A FlyerTalk Posting Legend
Join Date: Sep 2002
Location: LAX/TPE
Programs: United 1K, JAL Sapphire, SPG Lifetime Platinum, National Executive Elite, Hertz PC, Avis PC
Posts: 42,192
In a rather stinging rebuke of Boeing and the USA, the black box from Ethiopia was sent to France for impartial third party analysis - this reflects very badly on Boeing and on the impartiality of the US to investigate one of its own key defense contractors.
Mar 14, 2019, 9:34 pm
#476
FlyerTalk Evangelist
Join Date: Oct 2001
Location: Austin, TX
Posts: 21,386
You can't seriously believe that the French have less of a conflict of interest than the FAA, can you? The same French government who is the largest shareholder of Airbus?
Mar 14, 2019, 9:36 pm
#477
Join Date: Mar 2016
Location: Houston/DC
Programs: UA 1K, 1MM
Posts: 564
Regardless of who is examining the devices, I am sure there will be Boeing Reps on hand for technical assisstance, probably even seasoned FAA investigators. In the end all the data will be shared so the multiple crash investigations can move forward.
Mar 14, 2019, 9:54 pm
#478
A FlyerTalk Posting Legend
Join Date: Sep 2009
Location: Minneapolis: DL DM charter 2.3MM
Programs: A3*Gold, SPG Plat, HyattDiamond, MarriottPP, LHW exAccess, ICI, Raffles Amb, NW PE MM, TWA Gold MM
Posts: 100,393
Reading a bit into this aren't you? Since it was Ethiopian Air Space & their airline, it was up to them where to have it examined since they do not have the capability themselves. It is not like the FAA has jurisdiction over the entire world. Europe is bit closer and if you want to extract the data as soon as possible, it might make sense?
Regardless of who is examining the devices, I am sure there will be Boeing Reps on hand for technical assisstance, probably even seasoned FAA investigators. In the end all the data will be shared so the multiple crash investigations can move forward.
Regardless of who is examining the devices, I am sure there will be Boeing Reps on hand for technical assisstance, probably even seasoned FAA investigators. In the end all the data will be shared so the multiple crash investigations can move forward.
Yeah, but the crash occured on Sunday and it's only today, Thursday, that the black boxes are being delivered to French authorities. IMO the delay is almost criminal.
If the local authorities don't have the requisite expertise, by all means send those black boxes elsewhere. By convention the country in which the crash occurred leads the investigation and therefore can choose--hopefully a place with good capability that's also unbiased--but the data needs to be read and analyzed ASAP.
Personally I wish the black boxes had been sent to the UK after Germany declined since France as we all know is the home of Boeing's competitor Airbus. Perhaps Switzerland, Scandanavia, Holland etc. would have been a better choice, but I'm not confident that they have the expertise to get data from damaged black boxes where you seem to have only one opportunity to do it. Similarly, I'm not sure about Japan/South Korea/Singapore, but Australia seems able to do this stuff, and if so, that would have been a better choice than France in terms of the optics.
If the local authorities don't have the requisite expertise, by all means send those black boxes elsewhere. By convention the country in which the crash occurred leads the investigation and therefore can choose--hopefully a place with good capability that's also unbiased--but the data needs to be read and analyzed ASAP.
Personally I wish the black boxes had been sent to the UK after Germany declined since France as we all know is the home of Boeing's competitor Airbus. Perhaps Switzerland, Scandanavia, Holland etc. would have been a better choice, but I'm not confident that they have the expertise to get data from damaged black boxes where you seem to have only one opportunity to do it. Similarly, I'm not sure about Japan/South Korea/Singapore, but Australia seems able to do this stuff, and if so, that would have been a better choice than France in terms of the optics.
Last edited by MSPeconomist; Mar 14, 2019 at 10:02 pm
Mar 14, 2019, 10:37 pm
#479
FlyerTalk Evangelist
Join Date: May 2001
Posts: 10,965
...
Until it doesn't. Because this is the flip side of software: it is relatively complex. A SMS can be 500K lines of code. Sure, it is often Ada (very well-defined, constrained language), it is arch-verified, but the system remains very complex. That's why any level A system has triple redundancy. The thought is, for the most critical systems, if one computer has a flaw, at least the two others will have it right, and the third one can be rebooted.
Until it doesn't. Because this is the flip side of software: it is relatively complex. A SMS can be 500K lines of code. Sure, it is often Ada (very well-defined, constrained language), it is arch-verified, but the system remains very complex. That's why any level A system has triple redundancy. The thought is, for the most critical systems, if one computer has a flaw, at least the two others will have it right, and the third one can be rebooted.
Mar 15, 2019, 12:08 am
#480
Join Date: Nov 2002
Location: UK
Posts: 816
This says more about the political feelings of the Ethiopian government than it does about the impartiality of the FAA. It was a cheap opportunity to score points with those around the world who have negative feelings toward the US government.
You can't seriously believe that the French have less of a conflict of interest than the FAA, can you? The same French government who is the largest shareholder of Airbus?
You can't seriously believe that the French have less of a conflict of interest than the FAA, can you? The same French government who is the largest shareholder of Airbus?
However because of the narrative following this case I think it potentially helps Boeing and possibly the FAA (from a perception point of view) if this is done outside the USA. And as mentioned it’s very likely there will be Boeing representatives present.