Boeing 737 MAX model involved in Ethiopian Airlines crash banned from European airspace.

[LaCroix]

Government agencies pressured by the public, who are ignorant when it comes to aviation.

That's not how it works. Aviation agencies are not responding to public pressure, but to facts. One plane crashed, Boeing said they fixed it.

Now another plane of the same model crashes (a plane type that is pretty much brand new, instead of a worn out clanker) under pretty much the same circumstances as the last one.

So, apparently, the bug was not fixed. Or there are other issues at work, which are not connected to the bug they claimed to have fixed. And on top, it is a brand-new plane for which technically, no pilot is certified, since the whole problem is about a feature that was meant to remove the need to recertify.

Why do you think it is unjustified to ground these planes until they know what happened?

[Broomstick]

Yes, aviation agencies ARE subject to public and political pressure. They are usually somewhat resistant to it, but the pressure exists.

And the problem is the ASSUMPTION that what happened is actually known. Yes, there are parallels between the two crashes but they haven't finished investigating the first one, much less the second. You are ASSUMING it is a "bug", and the same bug that was supposedly fixed when it could be a different bug, or an engine problem (software problems don't usually cause smoke to trail behind an airplane, as multiple witnesses to the Ethiopian crash reported)

Yes, there are questions about software. There are also questions about the engines, which are larger, heavier, required a re-design of the 737 nose struct to maintain a safe ground clearance. This results in a more forward CG in the airframe and a stronger tendency to nose-down with or without software involved. If the root of the problem is a fundamental flaw in the airframe design that needs to be addressed (probably by scrapping the model, or redesigning it to such a degree that it's essentially a different airplane) in the material world rather than tinkering with software.

My problem is the kneejerk reaction of "oh, these two accidents are the same and we know what the problem is without even finishing the investigation on the first, or even starting the second". If it later turns out that the Ethiopian airplane sucked up debris from the runway (like the Concorde) and there's not a damn thing wrong with the current iteration of the 737 then you've grounded airplanes for no good reason, inconvenienced thousands of people, and damaged the operations of a dozen or more companies around the world. The grounding is NOT from "an abundance of caution", it's from people assuming they already know what the problem(s) were. The media has decided it wants a story about bad software and the evils of automation and that's what they're reporting. I dislike the rush to judgement. I dislike that the TV news has described the 787 Max and as a "de Haviland Comet" and a deathtrap without proof.

I also find it VERY weird the delay on analyzing the contents of the black boxes. Ethiopia had them and was sitting on them. While I, personally, don't think the NTSB would have been biased in analyzing them I understand why Ethiopia or another country might have that concern, but the Germans refused to look at them. What? The French are a fine neutral party for that task, but really, those boxes should have been looked at a couple days ago.

[LaCroix]

Nobody is saying the accidents are the same apart from "Both planes fell outof the sky in a similar manner".

There is a strong assumption that it is due to a new system, because these planes evidently did not fall out of the sky until that system was changed.
2 out of 376 airplanes had a similar accident, with causes yet unknown.

Boeing acknowledged an existing problem and patched the reason THEY believed to cause the issues (multiple reports of nosdowning, autothrottle and trim issues) after the LION crash. Boeing agreed that there was a bug in the system. Nobody is just assuming there was one - Boing said they found and fixed it.

Still, this second plane crashed in pretty much the same way as the first, showing a persistent problem. So, either they didn't find the bug, or it is a flawed design that can't be fixed. In both cases, a reasonable person would retire the system until the analysis is completed. I have personally killed a software rollout for less than that, and in most cases, there would only have been money, and not lives on the line.

[Jub]

From a layman's point of view Lion Air Flight 610 never should have happened, whatever was wrong with that plane started on a previous flight and whoever said it was fine to go back out again should be liable. I know they did some maintenance and based on the then current material from Boeing were legally fine to fly, but it sounds like that plane had issues on multiple fronts and it would have been safer for all involved to ground it until a proper investigation of the issues from its previous flights could be analyzed.

I don't know what SOP is for a plane that called in a pan-pan for technical issues usually is, but would it have been unusual for Lion Air to pull that plan for extended maintenance after such an event?

[Sky Captain]

From what I read on this I get that modifications made to accomodate bigger engines caused 737 MAX to be unstable when at low speed and high angle of attack flight regime. To counteract that Boeing added a system that automaticaly trims the stabilizers in a nose down position to avoid stall. It is suspect that this system caused aircraft to nosedive into the ground when it erroneusly thought a stall is about to happen because of faulty sensors and/or software bug.

It is also said that pilots were not sufficiently informed about this new system and what to do if it fails. I think it is prudent to ground the MAX fleet until everything is sorted out. Two similar crashes of brand new plane are suspicious and may point to a common cause affecting all 737 MAX planes.

[Broomstick]

I stayed away from this thread for a few days until more facts came out.

Now, based on evidence it does seem that the Lion Air and Ethiopian crashes had many similarities, but also based on facts brought to light I don't think this is a software issue, it's a hardware issue.

With the usual disclaimer that the following is subject to change with more information.

The first Boeing 737 launched in the late 1960's - that's fifty years ago, about halfway point in the entire history of powered flight. The fact it has lasted this long and become the Cessna 172 of commercial aviation (ubiquitous - I think it's still regarded as the best-selling most-total-units type of aircraft in the commercial passenger category) indicates that it started as a good, safe design. Over the years it has been repeatedly tweaked, hence the -100, -200, -NG, etc. suffixes to various versions.

However, the Max line - the newest version - wasn't just "tweaked" from what is coming out. You see, Boeing concluded it needed new, more efficient engines to stay competitive and chose the LEAP engine from CFM international. There was a problem in that mounting these engines where prior 737 engines were mounted on the wing would result in inadequate ground clearance. In order to fix that, they mounted the nacelles further forward on the wing, also lengthened the nose strut, and modified a few more bits and bobs as needed to make it all work. Even so, those engines have a mere 43 cm ground clearance on the Boeing 727 Max line.

But in flight the nose strut doesn't really matter. What matters is that the engine sits further forward relative to the CG of the airframe and is in a slightly different relationship to the rest of the wing and airframe. This results in both a stronger-than-normal nose-up tendency AND a stronger than normal nose-down tendency in the airplane depending on the situation. So strong, in fact, that it caused issues with the airworthiness of the aircraft. The MCAS reaction to these conditions is likewise stronger than normal in order to made the airplane flyable. The airframe of the Boeing Max is less stable than any other 737.

This was "solved" not by actually fixing the weight-and-balance problem in the hardware but by attempting to write software to fix the problems by having a computer modify the pilot's control inputs. This is something we have been doing routinely with fighter aircraft which are arguably inherently unstable in current designs and require a functioning computer to be flown. However, the "solution" to lose of control in a fighter jet is to have the pilot eject from the aircraft. This is not a feasible "solution" in an airliner facing a loss-of-control situation. Airliners should be designed to be inherently stable (to the extent that is physically possible), not unstable, because airliners don't have to perform dogfight maneuvers or other edge-of-the-envelope stuff. Indeed, passenger airliners should as much as possible stay firmly in the middle of the envelope.

So... instead of a hardware solution to a hardware problem in this instance Boeing decided to use a software fix for a hardware problem. This apparently resulted in a problem when the software was not up to the problem (if your new iPhone has a software bug worst case you get a different phone. If your aircraft has a software problem worst case is you die a horrible fiery death). Boeing rolled out a "patch" for the software "solution" to the hardware problem. Which didn't seem to work. Because, based on what I've been able to find (with the caveat I'm not an engineer or privy to all the facts), the problem wasn't software, it was hardware. I have serious doubts that patching and re-patching software is going to solve this. I understand the appeal of the attempt - new software is a fuckton cheaper than new hardware in this sort of situation, or having to scrap a design entirely.

In addition, instead of the standard "triple-redundancy" of the aviation industry the MCAS system that is supposed to compensate for the hardware problem relies on not three but only two sensors. Unlike a triple redundant system where if one sensor fails there are two still giving accurate information and a "vote" between sensors yields reliable information, in a double-redundant system if one unit fails you have no way to know which is giving accurate information and which isn't, meaning it's a coin-flip whether the decision system (computer or human) is going to guess right or wrong on what to do. Yes, triple-redundancy costs more, but it's also a fuckton safer. Even on the bottom rungs of aviation where I used to hang out there's an emphasis on multiple inputs and confirmation of information, even more so should there be at the commercial transport level. Who the hell thought giving up triple-redundancy was a good idea? I'm guessing it's someone who spends more time pushing money around than actually traveling in an airplane.

The result of all this is that you have an airplane with a nose-up-down tendency to an unusual degree (which in aviation usually means unsafe, or at least less stable), and a software system that masks this... until it disengages or is turned off or simply can no longer adequately compensate, at which point you have a human pilot called in (because humans are there to handle situations the machines aren't programmed to handle) to deal with an airplane of flight characteristics of such unusual nature as to be dangerous. Remember - Boeing didn't think they could get an airworthiness certificate for the 737 Max without the MCAS software, so if the system disengages or is turned off the human pilot is then dealing with an aircraft of marginal airworthiness at best, and arguably NOT airworthy. Again, with a fighter jet the pilot can eject at that point, and in a modern fighter if there's a computer problem that's what the pilot does: abandon ship. A commercial airliner pilot can't do that, neither can the passengers, and is left to wrestle with something with, arguably, a major design flaw.

This isn't a matter of pilot error or pilot training. You can't train a pilot to deal with an airplane with a design problem that makes the aircraft unairworthy in a particular situation because physics doesn't let you cheat.

There are some software problems here. Inputs that result in the anti-stall system engaging doesn't just result in a nose-down input (which is what you do to prevent a stall) but a very strong nose-down input that is hard for the pilot(s) to fight. In it's first iteration this system would keep re-engaging multiple times which could (and apparently did) result in the up-down-up-down climb/dive seen in both crashes. If the system is turned off - meaning turned off so it won't be automatically re-engaged - then you have the pilot flying a plane of different than typical flight characteristics which can be hazardous. I don't know if this something that can be addressed by specifically training pilots for 737 Max emergency procedures, but Boeing advertised and sold this aircraft as something that didn't require specific training for already certified 737 pilots. Which would only compound any other problems involved with this mess.

It's not "pilot error" if the pilot was told he didn't need any additional training and wasn't informed of unusual flight characteristics.

To further add to the mess - due to the "make government small enough to drown it in a bathtub" meme in the US for the past few decades, FAA funding has been cut back with the result that aircraft manufactures have been given more and more responsibility for making sure their designs are safe. This is no way to run aviation. You need third-party observation to keep honest people honest and to put the dishonest out of business. I suspect an incremental slide to the current design flaws of the 737 Max due to lack of impartial oversight and fact-checking, economic pressures, and bad decisions on the part of the people at that were never questioned and never had to be justified to that third-party impartial outside observer that wasn't there due to budget cuts.

So, at this point, I think the 737 Max shouldn't be grounded, it should be scrapped. Because it looks like this is a hardware design flaw and you don't fix those with software or pilot training, you fix those by either fixing the hardware or getting different hardware.

[Beowulf]

The airframe of the Boeing Max is less stable than any other 737.

It's less stable, but not unstable. The column stick forces reduce once you hit a certain angle of attack, but they don't reverse. If you keep pulling back, it will go into a stall, but if you let go of the yoke before then, it will go back into normal flight.

This was "solved" not by actually fixing the weight-and-balance problem in the hardware but by attempting to write software to fix the problems by having a computer modify the pilot's control inputs. This is something we have been doing routinely with fighter aircraft which are arguably inherently unstable in current designs and require a functioning computer to be flown.

Almost every other modern airliner is Fly By Wire. Every Airbus. Every B777. Every B787. If those lose their flight computer, they are done. Every FBW airliner modifies the pilot's control inputs. If the B737 was FBW, it would not have to have MCAS. It would be able to just increase the stick forces as appropriate, as the plane computer creates them in the first place.

So... instead of a hardware solution to a hardware problem in this instance Boeing decided to use a software fix for a hardware problem.

Every FBW airliner does this.

In addition, instead of the standard "triple-redundancy" of the aviation industry the MCAS system that is supposed to compensate for the hardware problem relies on not three but only two sensors.

Nit: MCAS is activated by whichever flight computer is primary, and only reads from the sensors on that side. It's no redundancy, as the theory was that the pilot should be able to determine the trim is being driven wrong by something, and do the runaway trim memory checklist.

The result of all this is that you have an airplane with a nose-up-down tendency to an unusual degree (which in aviation usually means unsafe, or at least less stable), and a software system that masks this... until it disengages or is turned off or simply can no longer adequately compensate, at which point you have a human pilot called in (because humans are there to handle situations the machines aren't programmed to handle) to deal with an airplane of flight characteristics of such unusual nature as to be dangerous.

All FBW airplanes mask oddities in the stability of the aircraft. And the B737 Max when not flown near the edges of the envelope has essentially the same flight characteristics as the B737 NGs. We have had crashes of FBW airliners where the pilots were dumped into control when they didn't understand the flight characteristics had changed. Specifically, AF447.

Remember - Boeing didn't think they could get an airworthiness certificate for the 737 Max without the MCAS software, so if the system disengages or is turned off the human pilot is then dealing with an aircraft of marginal airworthiness at best, and arguably NOT airworthy.

Boeing could not get the certificate, as the reg specifies the forces on the stick should not decrease with increasing angle of attack.

There are some software problems here. Inputs that result in the anti-stall system engaging doesn't just result in a nose-down input (which is what you do to prevent a stall) but a very strong nose-down input that is hard for the pilot(s) to fight. In it's first iteration this system would keep re-engaging multiple times which could (and apparently did) result in the up-down-up-down climb/dive seen in both crashes. If the system is turned off - meaning turned off so it won't be automatically re-engaged - then you have the pilot flying a plane of different than typical flight characteristics which can be hazardous. I don't know if this something that can be addressed by specifically training pilots for 737 Max emergency procedures, but Boeing advertised and sold this aircraft as something that didn't require specific training for already certified 737 pilots. Which would only compound any other problems involved with this mess.

MCAS isn't anti-stall. It will let you get into a stall. It's job was to make sure the manuevering characteristics near stall remained with in spec. If it's turned off, then flight characteristics will remain near identical to the NG version, except when you near stall conditions. After the Lion Air crash, Boeing put out a notice on emergency procedures relating to MCAS, and how to disable it.

It's not "pilot error" if the pilot was told he didn't need any additional training and wasn't informed of unusual flight characteristics.

Is it a pilot or training error if the pilot isn't able to identify the trim appears to be running away downward, and doesn't implement the memory checklist to resolve it?

So, at this point, I think the 737 Max shouldn't be grounded, it should be scrapped. Because it looks like this is a hardware design flaw and you don't fix those with software or pilot training, you fix those by either fixing the hardware or getting different hardware.

The aviation industy fixes hardware design flaws with software all the time. Infamously, the F/A-18 doesn't have enough elevator authority to take off at the spec speed on land. The fix was to have the FBW computer also use the rudders to provide upward pitch during takeoff and landings. This is going to be patched by software, and I doubt there will be another MCAS induced crash during the life of the MAX.

[Broomstick]

The airframe of the Boeing Max is less stable than any other 737.

It's less stable, but not unstable. The column stick forces reduce once you hit a certain angle of attack, but they don't reverse. If you keep pulling back, it will go into a stall, but if you let go of the yoke before then, it will go back into normal flight.

Yes, I said it was less stable. At a certain point decreasing stability becomes a bad thing, particular in an aircraft that is supposed to be delivering boring, uneventful transportation.

Based on what I've managed to glean, if MCAS is engaged then it may not go back into normal flight, or at least not immediately, The MCAS system is designed to push the nose down, which yes, is the way to avoid/recover from a stall, but when you're low to the ground that can become a problem. In both crashes, based on preliminary information, it looks like the MCAS repeatedly pushed the nose down resulting in rapidly fluctuating vertical and eventually a crash.

This was "solved" not by actually fixing the weight-and-balance problem in the hardware but by attempting to write software to fix the problems by having a computer modify the pilot's control inputs. This is something we have been doing routinely with fighter aircraft which are arguably inherently unstable in current designs and require a functioning computer to be flown.

Almost every other modern airliner is Fly By Wire. Every Airbus. Every B777. Every B787. If those lose their flight computer, they are done. Every FBW airliner modifies the pilot's control inputs. If the B737 was FBW, it would not have to have MCAS. It would be able to just increase the stick forces as appropriate, as the plane computer creates them in the first place.

You still need a well designed airplane for a FBW system to work well. Also, while the original 737's were not FBW (that not existing in the late 1960's) the latest designs are incorporating FBW into the design, although not quite as thoroughly as the A320 forward with Airbus.

The MCAS is also different a FBW because it can, in fact, be turned off in case there is a problem with it. Unfortunately, this does not seem to have been effectively communicated to pilots.

So... instead of a hardware solution to a hardware problem in this instance Boeing decided to use a software fix for a hardware problem.

Every FBW airliner does this.

And changing the W&B requires testing and reprogramming, but unlike the B737 Max, when they put the new LEAP engine on the A320 they did not have to modify the nose strut to ensure ground clearance, and they could mount the new engine where the old one was. With the B737 Max they had to do both of those things and that will alter the flight characteristics of the airframe. Yes, you can disguise some bad traits with software, but that doesn't mean you should. Sometimes, changing the hardware is a better solution - except of course for time, expense, bean-counters...

In addition, instead of the standard "triple-redundancy" of the aviation industry the MCAS system that is supposed to compensate for the hardware problem relies on not three but only two sensors.

Nit: MCAS is activated by whichever flight computer is primary, and only reads from the sensors on that side. It's no redundancy, as the theory was that the pilot should be able to determine the trim is being driven wrong by something, and do the runaway trim memory checklist.

So if your primary flight computer is toast you're fucked? If that's what you're saying that's not acceptable. That's why triple redundancy in critical systems became an industry standard.

And who came up with that theory, anyhow? It doesn't seem to be working - we've had two separate flight crews crash, and there is now a report of a third that avoided a crash only because a pilot sitting in a jump seat happened to have a little more knowledge than, apparently, the average pilot of these aircraft. So... how is that theory working out in the real world?

If pilots are missing the fact the trim is running away then it may be a human factors issue. That requires better communication. It probably also means that 1-2 hours is NOT sufficient training to transition to these aircraft despite Boeing's claims that it is.

The result of all this is that you have an airplane with a nose-up-down tendency to an unusual degree (which in aviation usually means unsafe, or at least less stable), and a software system that masks this... until it disengages or is turned off or simply can no longer adequately compensate, at which point you have a human pilot called in (because humans are there to handle situations the machines aren't programmed to handle) to deal with an airplane of flight characteristics of such unusual nature as to be dangerous.

All FBW airplanes mask oddities in the stability of the aircraft. And the B737 Max when not flown near the edges of the envelope has essentially the same flight characteristics as the B737 NGs. We have had crashes of FBW airliners where the pilots were dumped into control when they didn't understand the flight characteristics had changed. Specifically, AF447.

"Normal climb-out" should NOT be an "edge-of-the-envelope" maneuver.

Also, AF447 involve failure of the triple-redundancy system due to ice-over pitot-tubes, and the fact that on a dark and stormy night over the Atlantic if the instruments aren't giving the pilots real information they are fucked because in those conditions you can NOT fly using Eyeball Mark I. If you think AF447 was solely due to a lack of understanding on the part of the pilots you don't know what you're talking about. There is evidence that the pilots were getting multiple airspeed readings and had no way to know which one was accurate. At 2 hours, 12 minutes, and two seconds into the flight the CVR captured the pilots saying "I don't have any more indications" and "we have no valid indications". That means they don't know what the fuck was going on, in IFR conditions where you can NOT rely on bare human senses to keep you alive. That is an airplane problem, not a pilot problem, except of course it definitely became a problem for everyone aboard.

In this thread I go into detail about Air France 447 based on the document produced on the accident by the BEA (French equivalent to the US NTSB)

There are some software problems here. Inputs that result in the anti-stall system engaging doesn't just result in a nose-down input (which is what you do to prevent a stall) but a very strong nose-down input that is hard for the pilot(s) to fight. In it's first iteration this system would keep re-engaging multiple times which could (and apparently did) result in the up-down-up-down climb/dive seen in both crashes. If the system is turned off - meaning turned off so it won't be automatically re-engaged - then you have the pilot flying a plane of different than typical flight characteristics which can be hazardous. I don't know if this something that can be addressed by specifically training pilots for 737 Max emergency procedures, but Boeing advertised and sold this aircraft as something that didn't require specific training for already certified 737 pilots. Which would only compound any other problems involved with this mess.

After the Lion Air crash, Boeing put out a notice on emergency procedures relating to MCAS, and how to disable it.

Apparently that communication was not effective. Now, I don't know if that was a Boeing problem or an Ethiopian Air problem or a these-two-particular-pilots problem, but definitely there was a problem there.

It's not "pilot error" if the pilot was told he didn't need any additional training and wasn't informed of unusual flight characteristics.

Is it a pilot or training error if the pilot isn't able to identify the trim appears to be running away downward, and doesn't implement the memory checklist to resolve it?

If more than one cockpit crew screws this up in a fairly short period of time I begin to suspect it is NOT pilot error, although it certainly could be a human factors problem. We have had not one, not two, but THREE flight crews get tripped up by this since October of last year, and two of those crews have crashed. So yeah, maybe it's a "training error" - meaning there's something wrong with the training. Not enough, perhaps, or something else. Maybe there's some issue with this information being imparted to the flight crew. It's not sufficient to shrug and say "human error" when the same error keeps happening.

This is going to be patched by software, and I doubt there will be another MCAS induced crash during the life of the MAX.

I'm not convinced a patch is going to cut it for this airplane.

[K. A. Pital]

Most FBW planes have a variety of backup control modes if sensors malfunction. Ie I know with A320 one can go into alternate law 2, to remove most of the computer protections. Complete power failure (as opposed to computer failure - I really wonder what Beowulf is talking about here) has such a low probability that you may as well count hydraulics failure as more probable... So in case of various failures, FBW craft can be switched to a variety of control modes depending on the failure areas. This is layered protection for civilian aircraft.

The example of a military aircraft ITT should not be given. There is no reason whatsoever to conflate military and civilian aircraft design, end goals are completely different.

[Broomstick]

Most FBW planes have a variety of backup control modes if sensors malfunction.

Yes, it's that principal of redundancy again. It's part of what makes aviation a safe mode of travel. I don't know why Beowulf is having trouble with the fact that the MCAS doesn't have the redundancy characteristic of most airliner systems.

Complete power failure (as opposed to computer failure - I really wonder what Beowulf is talking about here) has such a low probability that you may as well count hydraulics failure as more probable... So in case of various failures, FBW craft can be switched to a variety of control modes depending on the failure areas. This is layered protection for civilian aircraft.

There actually is a record of an Airbus 320 losing all power over the Atlantic, Air Transat Flight 236. Thanks to systems in place for just that sort of event they were able to glide to the Azores and land, all aboard surviving and most with no or minor injuries (the airplane did need repairs, they trashed the landing gear bringing it to a stop without all the handy anti-problem feature operable because of the power failure). Also, his talk about "the flight computer". Last I heard, anything run by computer on those airplanes has back ups in case of bad circuit boards or the like. There was also the earlier Gimli Glider incident with a Boeing 767 - another fly-by-wire airplane - likewise landing safely (with even less damage) after a complete power failure again, thanks to "redundant" systems. This sort of thing is standard regardless of whether you're talking about Airbus or Boeing. I'd say this isn't rocket science except that, technically, jet engines are a part of rocket science.... but it's a part of rocket science that's actually easy to understand. You have back ups for everything. You have what is, essentially, a windmill you can deploy to power a highly technical machine in case it loses all other power (really - it's a officially a "ram air turbine" but it's the kissing cousin of the windmill technology that dates back centuries). You still have an old fashioned compass mounted in the same cockpit as a 21st century heads-up display in case the heads-ups stops working, and you still teach pilots how to use them just in case. And that's AFTER the triple-redundant sensors of the Flight Management System. You CAN fly a modern airliner without the fancy avionics and with just very bare minimum of power, we know this because it's been done not once but twice.

So, with this in mind - why the fuck is the Boeing Max having such a problem?

Don't handwave this with "modern airliners are FBW". Well, so were the Air Transat flight that successfully glided across half the Atlantic Ocean and the Gimli Glider, yet they didn't crash - even more impressive because at the time of the Gimli incident they pilots did not have access to the best glide speed for the jet and the co-pilot (who, lucky for everyone, was a world-class competitive glider pilot in his spare time) had to estimate that based on how the airplane was flying (also lucky for them it was daytime and optimal weather). A hell of a lot can go wrong or stop working on either an Airbus or Boeing and you still have a flyable airplane. Or worst case a flyable glider. This isn't rocke--- this is something aviation figured out 40 years ago.

So, if ONE bad sensor results in the unsafe conditions that can kill an airplane that's not normal for modern aviation (that hasn't been normal since at least as far back as the 1950's). If it's happened twice in six months that's getting goddamned serious.

In addition to investigating these two accidents we also have to look into the NASA maintained database on aircraft problems (The Aviation Safety Reporting System or ASRS) to capture incidents where this is happening when it doesn't result in an accident. And that has, in fact, been done. There have been at least five other occasions where flight crews had this same problem, the difference being those flight crews successfully dealt with the problem. Since October. That's six months. That's just what's been reported - reporting is voluntary and not everything get into the database. And it's just the US. Now, other nations also have comparable systems, those should also be looked at as well. Quite likely, they are being looked at.

If experienced flight crews are regularly having these problems then either 1) NO ONE is getting proper training or 2) there is something wrong with the airplane itself. If we aren't having constant crashes it's because we do, in fact, have good pilots out there who are handling the problems. The thing is, you don't want the same problem occurring over and over because, eventually, for whatever reason, a flight crew won't handle it well. As we have seen.

At the beginning of this thread I was thinking that these two crashes were like most air crashes over the past couple decades: due to a chain of events that, even if ending the same, were actually different in detail. That is not the case, based on what we know so far. There is a definite and serious flaw here. It must be fixed.

[Beowulf]

The Gimli Glider is a bad example for working after power failure: the B767 is not a fly by wire airplane. The primary flight controls are mechanically connected to the yoke/pedals.

I referenced AF447, because the pilots were given full control over the airplane, including the ability to actually stall the aircraft. They then proceeded to stall it, and never successfully make the control inputs required to pull it out of the stall, because they apparently never realized that the aircraft was stalled until it was too late. Possibly because the stall warnings cut out when the airspeeds went too low, so when they pitched down, the stall warnings started back up. It was flown past the edge of it's performance envelope and the pilots didn't know how to aviate their way out.

I expect certified pilots to be able to tell when something's wrong with the aircraft, and be able to execute the correct actions. The AF447 pilots didn't diagnose that they were stalled, and flew the aircraft at 10000 fpm descent into the ocean. The Lion Air and Ethiopian Air pilots didn't diagnose that they had runaway trim problems, and failed to execute the runaway trim memory checklist.

I've seen only three reports referencing MCAS in ASRS: 2 of them reported pitch down in autopilot, and the 3rd was a complaint about the lack of documentation. Neither of the pitch down incidents were caused by MCAS: both started with autopilot engagement, and were resolved with auto-pilot disengagement.

MCAS is not designed to push the nose down. It's designed to cause the stick forces to continue to increase at high angles of attack. It's not like a stick pusher. It won't cause violent changes in pitch. Is stick pusher activation a safety critical event? CRJs only have two angle of attack sensors, and they are equipped with stick pushers (or at some point, were equipped). I'm not sure how it uses both sensors, but it definitely can't toss the one that's out of whack, because it doesn't know which one is out of whack.

Yes, MCAS probably should have been designed to use both AoA sensors/not allow repeated activations while the AoA hasn't yet returned to normal values. And I suspect the patch as delivered will do both of those. I reference the F-18 problem because it's a direct analogy: there was an aerodynamic problem, and they used software to solve it. But I can see why they didn't think that it was a system that required both AoA sensors' input: it shouldn't have ever have generated enough trim to cause an issue before the flight crew cutout the electric trim system.

[Sky Captain]

Found this video explaining the automatic trim system and how to disable it if it fails.


Looks like it should have been possible to regain control on both 737 MAX aircraft before crash if pilots acted quickly and disabled electric trim killing the faulty MCAS.
Biggest fault of Boeing probably is not providing enough information and training about MCAS to pilots and relying only on single sensor to provide angle of attack data to flight computer. It is said that before first 737 MAX crash pilots didn't even know such system exists. Both crashes happened just after takeoff, there were little time to regain control, maybe pilots without knowing about MCAS got confused what is driving the trim wrong and failed to execute runaway trim checklist in time. Probably not the first time a faulty equipment and pilot error together cause crash.

[Broomstick]

I referenced AF447, because the pilots were given full control over the airplane, including the ability to actually stall the aircraft. They then proceeded to stall it, and never successfully make the control inputs required to pull it out of the stall, because they apparently never realized that the aircraft was stalled until it was too late. Possibly because the stall warnings cut out when the airspeeds went too low, so when they pitched down, the stall warnings started back up. It was flown past the edge of it's performance envelope and the pilots didn't know how to aviate their way out.

That is because in the middle of the night during a storm over the ocean is pretty much the most adverse conditions for flying using human senses imaginable. The pilots had full control over the aircraft but they did NOT have accurate instrument readings. Without accurate instrument readings it is IMPOSSIBLE for pilots to maintain flight in such conditions. It can not be done.

Yes, the stall warning cut out when the airspeed fell into a deep stall, then resumed when the airspeed rose but the aircraft was still stalled - that is the very definition of bad information because the corrective actions were triggering an alarm. Under the environmental conditions the pilots were utterly reliant on instrument readings. If the instruments were not giving them good information - and they weren't - it would have been completely impossible for the pilots to fly the airplane for more than a few minutes.

No human pilot that has ever been trained, or ever will be trained, could fly an aircraft in such environmental conditions without proper and accurate instrument readings. Because the pilots for AF447 did not have accurate instrument readings they were doomed. Your assertion that the pilots of AF447 were somehow incompetent ignores that 1) there were multiple problems with instrument readings and 2) they were in weather conditions that required accurate instrument readings to retain control of the aircraft. It's like demanding someone drive down a road blindfolded then blaming them for the inevitable resulting accident.

[LaCroix]

Just as a note on how important Broomstick's notion is:

A person holding a standard private or commercial pilot's licence is not allowed to fly at night, in non-optimal (bad sight) weather, or even at certain altitudes.

You need an at least 100 hour long training (while already being a qualified pilot)under these conditions to learn how to fly with no input but your instruments to get IFR rated, which means you are allowed up under almost any conditions you are willing to risk. And you are needed to re-validate this every 12 months to keep that rating. It is that critical of a skill.

If you are up in such conditions (some fog or simple darkness are enough) without this training, or have no instuments or malfunctioning instruments - well, barring a miracle, you are dead.

[Broomstick]

The Canadians actually did a study on this - pilots that had no IFR training were put in a simulator under IFR conditions.

Average lifespan was 178 seconds. Just under three minutes.

Since learning to fly IFR and actually flying IFR are entirely dependent on accurate instrument information (because you can NOT rely on human senses) putting ANY pilot, no matter how well trained, into IFR conditions without proper/working/accurate instrumentation is basically the "178 seconds" scenario.

[Broomstick]

Looks like it should have been possible to regain control on both 737 MAX aircraft before crash if pilots acted quickly and disabled electric trim killing the faulty MCAS.

Well, yes, it's possible because, apparently, other flight crews have done just that. However, if pilots do not have the proper information they aren't going to make good decisions. On take-off if something goes wrong you have very little time to take proper action as you are so very close to the ground. You don't have time to look things up.

Biggest fault of Boeing probably is not providing enough information and training about MCAS to pilots and relying only on single sensor to provide angle of attack data to flight computer.

^ THIS.

It is said that before first 737 MAX crash pilots didn't even know such system exists. Both crashes happened just after takeoff, there were little time to regain control, maybe pilots without knowing about MCAS got confused what is driving the trim wrong and failed to execute runaway trim checklist in time. Probably not the first time a faulty equipment and pilot error together cause crash.

Again - if pilots don't have good information they won't make good decisions. That's the whole purpose of training required before flying a new airplane - to familiarize pilots with the airplane systems and any particular quirks or unique aspects of a particular airplane. The MCAS is new with the 737 Max, it's there to correct an aerodynamic "quirk" of the airplane, and if pilots are not adequately trained on it is that really the fault of the pilots?

Facts:

MCAS is a new feature of the Boeing 737 Max line to deal with issues that arose from fitting the airframe with new engines.

Boeing advertised and sold the B-737 Max as requiring minimal additional training to fly.

There is mounting evidence that pilots are not getting adequate training in this aircraft, not just reports in databases like the ASRS but also including two smoking holes in the ground and several hundred corpses.

Boeing made several warning features regarding the MCAS and it's reason for existing in the first place optional (and at least one of the crashed aircraft did not include those systems, possibly both).

The use of just one sensor to feed information to the MCAS is ... unusual to say the least in an industry where multiple redundancy is a standard practice.

[LadyTevar]

Beoing Max 737 Makes Emergency Landing in Orlando

A Boeing 737 Max 8 plane — the same model that the Federal Aviation Administration grounded after two recent crashes — made an emergency landing at Orlando International Airport on Tuesday afternoon.

No passengers were on the jet, only two pilots for the plane's owner, Southwest Airlines. The pilots were flying the jet to California for storage when an engine overheated just before 3 p.m., a spokesman for the airline told NBC News. The plane was in the air about 11 minutes, the spokesman said.

The flight was scheduled to fly to Southern California Logistics Airport in Victorville, California, for short-term storage, according to the spokesman.

"The pilots reported a performance issue with one of the engines shortly after takeoff," the spokesman said.

The pilots landed safely at the airport. The plane will be moved to the airline's Orlando maintenance facility for review and will be taken to Victorville once it's safe to do so.

The FAA on March 13 grounded the Boeing 737 Max jets after it found that a Ethiopian Airlines aircraft that crashed March 10 had a flight pattern very similar to a Lion Air flight that went down in Indonesia in October.

Under the FAA order, airlines are allowed to fly the jets without any passengers to a base for a purpose of storage or maintenance.

The cause of the Ethiopian Airlines and Lion Air crashes of the 737 Max jets has not been determined, but investigators probing the Lion Air accident have focused on an automated system designed to use information from two sensors to help prevent a dangerous aerodynamic stall, The Associated Press reported.

11 minutes into the flight, the engine overheats and they have to make an emergency landing.

[Broomstick]

Probably unrelated to what caused the two crashes.

[LaCroix]

Most likely.

Still not good - the max 8 is less than 2 years old. Even on a typical max airborne time shedule, their engines should still purr like kittens.
Either southwest had a maintenance bo-boo, which is bad enough, or we might be finding out that these new engines are also a weak point of the design.

[Broomstick]

Given the engines are also on A-320's and also another plane used by the Chinese you'd think we'd have heard about that by now with more than just the B737max.

[EnterpriseSovereign]

Boeing introduces 737 Max software overhaul. EDIT: Seems copy pasting the content breaks the spacing.

[LaCroix]

Given the engines are also on A-320's and also another plane used by the Chinese you'd think we'd have heard about that by now with more than just the B737max.

Actually, they use one of the engines used in the A320 (which uses the LEAP and the P&W ). They use the CFM LEAP but they altered it to have a bigger fan (almost 70 instead of the standard 66 or 68 inch)...

So we have a modified engine, in a rather new nacelle design, in an unusual spot (in reference to prior design of the hull and engine placcement).

There are a lot of factors that could be bad here due the the nacelle positon - airflow, heat transfer, etc.

What I am most worried about is take-off, and the possibility of debris getting sucked in due to the 'low-slung' engine (even if it is only a few inches compared to other types due to the engine move further ahead). Or thrown around and hitting the tail section of the aircraft. There have been reports of damage to the tarmac by 737 max airplanes, and there is a lot important stuff at the tail section to be hit.

[Broomstick]

Latest report from the flight data recorder information is that the two Ethiopian pilots DID, in fact, follow proper shut-down procedures for the MCAS. Then it turned on again. Not yet determined if they pilots did that (although it seems unlikely) or the software decided to reboot itself.

Wow.

The final report on this is going to be interesting.....

[Broomstick]

....and now the news is staying there's evidence that something (bird, debris, something) hit the plane on take-off, damaging the sensor the MCAS relies on. Which, if true, means this is a mechanical failure combined with possibly software and human error to cause a fatal crash.

[Jub]

....and now the news is staying there's evidence that something (bird, debris, something) hit the plane on take-off, damaging the sensor the MCAS relies on. Which, if true, means this is a mechanical failure combined with possibly software and human error to cause a fatal crash.

That sounds a lot less damning for the MAX than the other theories. Combined with the fact that, at least in my opinion, the Lion Air plane never should have flown so soon after the pilots called in a Pan-Pan (later rescinded) does a lot to make me think that MAX may have fewer issues that it first appeared to have.