If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.
Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
No, it's not, and most of the regulatory agencies around the world agree. Pilots that Boeing handpicked to test out MCAS fixes (and thus knew what it was, what to do, and expected a problem) agree. And that whole runaway stab trim checklist is a red herring especially after Boeing has come out and said MCAS is a part of STS — itself a system that trims the stabilizer in a counterintuitive manner on the NG. The stabilizer operates in a counterintuitive manner on the NG and MCAS runaway doesn't meet Boeing's definition of runaway trim. Full. Stop.
https://www.nytimes.com/2019/03/25/business/boeing-simulatio...
Here's a relevant quote:
Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.
> Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Not quite:
While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously).
So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back).
The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots.
We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured.
Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.
The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)?
Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component.
> Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum.
At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft
An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo...
> The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.
> Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high.
It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.
After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.
Detecting a classic constant runaway trim is an old drill for pilots.
Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern.
It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.
A few hundred people who died as a result of MCAS would disagree. MCAS is not safe as currently implemented, or the 737 Max would still be flying.
MCAS on the other hand is basically a bad hack that was necessary for business reasons. It's a serious step backwards in safety from previous iterations, which has not happened with modern nukes.
Airplane certification is expensive for both manufacturer and airlines that might want to fly it. So there is a quicker process if you just make minor revisions, a reasonable compromise on the surface. Certification is so expensive and not having to retrain pilots is such a huge selling feature it creates a pressure to make planes that meet the same type requirements rather than design new airframes.
Boeing is all set to design a new airframe to replace the 737 that will be more fuel efficient and be built for today's point to point flights. Along comes airbus with the a320neo (new engine option) that kills the 737-800 on fuel efficiency and Boeing panics. They scrap 2020 plans for a 737 replacement and design the MAX. Now the problems mount. Fuel efficiency needs turbines that spin slower but have more surface area and are therefore larger. 737 is a low slung plane, dating back to hub and spoke flight concepts where the 737 might land places that don't have jetways. Since the plane is so close to the ground, Boeing has to move the engines forward so they can raise them. This generates more lift than previous 737s, but to meet same type requirements the plan has to be the same. Not meeting same type means they can't sell to airlines like southwest who only fly a single type and any airlines who do commit will have to spend training dollars, raising the total cost of operation without adding anything to the bill of materials.
Enter MCAS, a system designed to meet the same type regulation with disastrous unintended side effects. Side effects made much worse by the fact pilots don't know the system even exists since this plane is the same as every other 737 as far as they know.
I don't think the same type regulation should be scrapped since it would stop things like fuel efficiency gains during an airframe's lifespan, but there needs to be a same type minimum training and documentation that has to be done even if the only thing you change is thickness of the paint. If anything the definition of what meets same type should be slightly expanded allowing more flexibility in what can be changed. Combined with mandatory training for all subtypes (but still much shorter than different type training) the perverse incentive to make the plane behave exactly the same is removed. That leaves room for the better technical fix to win the day rather than the one that will meet the regulation. Training costs will go up some, but less than full different type certification.
There's a nasty rumor that Boeing agreed to pay Southwest $1 million per plane if additional training was required. That's a lot of money just on the Southwest contract. If any other airlines (e.g. Ryanair) demanded similar that's a huge chunk of money.
I see this entirely differently -- the FAA was being way too lenient/cozy with Boeing, and took their word that the airplane operated exactly the same (even if it didn't). This to me indicates that harsher regulations are needed, not less harsh ones! In what other industry do manufacturers self-certify such safety-critical machines?!
Relax regulations and we'll just start seeing more of those crashes that have killed so many airline passengers previously. It's a proven fact across all industries since time immemorial; companies don't make things safe out of the good of their hearts, and are OK with shockingly high body counts. Governments have routinely needed to rein in companies that were playing fast and loose with safety.
Place a random passenger into the cockpit of a modern commercial airliner without training and ask them to fly the thing safely and you'd probably have a 100% loss rate.
It retains no memory of being overridden by pilot input but will keep pitching down until cut-out of the loop or the aircraft exits what it thinks is the dangerous corner of the envelope. Unfortunately it often lacks the information to make that determination correctly, due to the poorly-designed sensor integration.
That sounds like something right out of the 'Catastrophic Failures' books we studied in uni.
This ultimately is not a training issue. Why was a system that can potentially plow the aircraft's nose into the ground utilizing only a single sensor without any redundancy in place? Boeing screwed up. Now both sensors will be used. Great, but sometimes 2 sensors fail. If pilots that operate these aircrafts are trusted with the lives of 150+ passengers, they should have an "easy button" to take complete manual control of the aircraft. My human sensors should trump any mechanical sensor(s) when my life is on the line.
Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.
Are there other feedback mechanisms present that can interrupt that determination?
That appears to be the case in these scenarios. The MCAS doesn't perform the incorrect action continuously, it looks like initial corrective measures fix the problem until they suddenly don't.
And then what? How much longer will it take to manually move the stabilizer to a suitable position? How much time do the pilots have at under 7,000 ft AGL? Will the elevator have to be moved nose down to unload the stab before the stab can be retrimmed?
That's great...if they'd understood that the system was malfunctioning...but they had no such indication because their airline didn't pay for the optional "feature."
The two problems present themselves differently enough that it's confusing pilots (runaway trim is continuous trim movement. MCAS is 5 seconds on, 10 second off).
This is a systematic training issue. Pilots have been trained to recognize runaway trim but not faulty MCAS.
The only real solution is extensive simulator training until pilots reliably diagnose MCAS activations and start the correct checklist, something which Boeing and airlines don't want to pay for.
If that was the only issue, the plane would have not been grounded.
But it seems here on HN there's this persistent idea that it's just fine for the plane to start misbehaving and it's "only" a matter of the pilots fixing it.
Sure, why not, let's all run a cronjob that gets a random number, then beeps and wipes your computer every 1/100 times. But hey, it will beep and you'll have 1 second to fix it, sounds good, right?
This attitude killed 300 people
There is always a trade-off with these types of decisions, and like it or not, every airframe certified airworthy has the potential to kill everyone on board without proper piloting.
I'm not saying that I'm letting Boeing off the hook personally, but as someone who has an avid interest in engineering things, I do understand the optimization points they were going for with the MAX, they found a physical design that could accommodate those optimizations, but they skimped or didn't put enough emphasis on communicating changes to pilots.
The pilots are the single most versatile safety system on the plane. Hiding or keeping from them the information they would need to form a checklist to handle this type of failure is the major failing here (given we assume there were no other physical configurations that could have been grandfathered in that wouldn't have involved an MCAS like system for certification). The root cause of that omission though may be traced to the minimal retraining requirement, which was absurd in the first place.
Safety in an aircraft means getting passengers to their destination without injury or loss of life. Boeing failed here - blame lack of training, single sensor dependence or software if you like but there was certainly a failure.
Now no one really cares if MCAS is problematic - any solution needs to resolve the underlying fault.
This practice, fortunately or unfortunately depending on who you ask, effectively normalized deviance, and short-circuited the protection offered by that airworthyness regulation. It went from being clearly spelled out to "or equivalent level of safety" which opens the door to all sorts of workarounds.
The alpha vanes need to be a high-priority maintenance item. They may also need to be redesigned/augmented such that they can be hardened against typical failure states, or subjected to in-flight remediation/diagnostics and graceful failover.
That isn't easy from my understanding. Doing something like hardening vs. freezing would require some form of heating element, which would potentially effect the calibration of the sensor while active, and increase maintenance complexity. Adding some sort of self contained calibration unit to the sensor could work too, however, the more complexity built into that, the more costly it becomes.
There is a point of diminishing returns, and I do think the plane can be rendered safe with MCAS and pilot retraining.
Unfortunately, that will still come bundled with an aircraft losing its airworthyness rating on Stab Trim cutout.
FAA emergency airworthiness directive 2018-23-51 [1]
We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously
And what it describes previously is MCAS when receiving erroneous AOA sensor input.
Also, your post basically says MCAS is safe when disabled, because in the very same sentence you claim it's safe you also claim the pilots are supposed to know how to (indirectly) disable it. That's almost comedy.
>why the pilots did not take this simple corrective action
It's a valid question why they didn't take corrective action; it's insulting and asinine editorializing to call it simple.
[1] http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/...
Boeing did not want to sell the training as an add on package, they didn’t want more training at all. This reduces the cost to purchase the 737 Max, because existing 737 pilots can fly the max without recertification.
What was sold as an add on was the system to detect the two AoA indicators disagreeing. This would help, but it probably would have been less effective than MCAS training would have been.
Better still would have MCAS read both sensors and disengage when they disagree, with an alarm.
So far, aircraft with malfunctioning MCAS has resulted in 100% loss of aircraft.
Which, notably, they did not run right away. The need to run the runaway trim checklist was pure guesswork on the pilot in the jumpseat's part. It took them several minutes of fighting with the controls before they finally killed the trim. They even re-enabled the auto trim after killing it, not initially recognizing that that was what had fixed the issue.
Not even the flight that survived correctly identified the issue initially. This really isn't a case of "see, these other pilots got it right". They got lucky.
At first, everyone asserted it was 'faulty sensor reading,' but later it came out that there's also faulty programming and the MCAS system has way more authority than originally specified to the FAA.
There’s about 40 seconds before the aircraft becomes unrecoverable in these 2 crash scenarios. It’s not pilot error.
It’s design, software, certification subterfuge, lax FAA regulatory posture, and limited pilot awareness and superficial training. Roughly in that order.
Add to that desperation, in that Boeing was keen to catch up with the Airbus 320neo, and didn’t want to build (and certify) an entirely new aircraft.
Plus an extra sensor and related systems most US 737MAX’s have was an option, and at least the Lion Air aircraft didn’t have it.
Demonizing pilots or belittling the training of the LionAir and Ethiopian Air pilots is offensive and not supported by the facts.
This is going to get worse for Boeing. Their only saving grace is that the airlines and military need them too much.
<pilot; not ATP>
When hundreds of lives are at stake, defense in depth is critically important. Planes that crash unless the pilot does the exact right thing in some rarely occurring situation are not safe. It's bad design. That's like saying that airbags aren't necessary in cars because if everyone just drove perfectly there'd be no accidents. Well guess what, no one's perfect, and building systems that require human perfection are bad engineering.
But here's the thing. It's impossible to train or have a checklist for every eventuality or combination of failures. In the end, it's up to the pilots to use good airmanship and fly the plane. If systems are interfering with that, disable them and fly the plane. Trim system doing something you don't want? Disable it and fly the plane. Instruments disagree? Set known good pitch and power and fly the plane. It was daylight in good weather. Look out the window. Fly the plane. Diagnostics can wait until the plane is flying again.
Those two aircraft were flyable. All they needed to do was flip a switch. And fly the plane.
I'm not in any way suggesting that the problems with MCAS or AoA data on the 737 MAX should not be fixed.
I personally find the AoA sensors failure to be unlikely in the case of the Lion Air crash as they were replaced in between the two problematic flights.
I most interested in seeing the final results of the Ethiopian crash. My suspicion is the MCAS has terrible software and is a bug-ridden mess.
If maintenance procedures for testing did not correctly specify that a retest must start, then restart the system to actually test that the repair was successful, then that replacement may have been tested while the computer was being fed data by the correctly operating sensor. They would have had to attempted a single boot between flights for the next flight to have flown with the untested replacement sensor. If they didn't test at all, then it's possible both sensors had a problem.
This is of course assuming that there is any retest procedure at all in the documentation given that the AoA sensor wasn't classified as safety-critical.
It really seems like the makings of a bad movie doesn't it?
That's why it's incumbent upon Boeing to let the pilots know about all of the systems.
Trim system doing something you don't want?
STS generally does this by design.
Disable it and fly the plane
Boeing claims that MCAS is a part of STS. Well, you can disable STS quite easily by pushing/pulling on the yoke. You cannot disable MCAS this way.
It's not until some poor, senior engineer, who is probably one of their best staff, has a stellar reputation, and genuinely cares about their job, their team, the product, and the company ... they have to fall on the sword and TELL management what's going happen: we're not shipping this yet, IT IS NOT SAFE. Then that goes all the way up the chain, management at every level wrings their hands, "how oh how did this happen?" (although they specifically are talking about the missed deadline, not the safety concerns). It gets high enough that feeling is overcome by senior leadership wrath, which flows back down, and ultimately that engineer and their entire team is punished.
What a dumpster fire.