And generally on engineering. If a system, regardless of the application, fails I consider it bad engineer behavior to single out the user. Systems, especially in aerospace, include everything from design over manufacturing, software, the parts to maintenance, logistics and ultimately training. Failure in any single one of these means failure of the system. Which directly implies all entities involved in development and certification. Failure in more than one is catastrophic. Defending it is bad engineering. Just my 5 cents.

EDIT: MCAS relied on a single AoA sensor. Non-redundant safety critical systems in an aircraft? Seriously?

I did not defend the MCAS software design. Not once. Quite the opposite.

> the very least we all can do is to be open and honest about errors in the system and the actions taken to prevent the same accident from happening twice.

I totally agree with that. That also means being open and honest about all contributing factors to these crashes.

1. In a safety critical system design, any change that results in fallible humans being more likely to crash their plane into the sea means the fault lies with the system, not the individuals.

2. I think people are (rightfully IMO) so angry with Boeing because so many of their actions look like they were cost-saving measures. If the system worked exactly as it did, but Boeing had been very clear about the difference in handling MCAS caused, which would likely have required recertification and additional retraining of pilots, I think people would have at least been somewhat more sympathetic. But it looks like so many of the MAX design constraints were driven by the bean-counter directive of "don't do anything that would require recertification", and that's why people are pissed.

I believe these two statements are contradictory. The pilots were a contributing factor to the crashes. This needs to be investigated to determine why they did not respond appropriately, and corrective action taken. In addition to Boeing correcting the MCAS system, and the maintenance issues.

All contributing factors must be accounted for.

> I think people are (rightfully IMO) so angry with Boeing because so many of their actions look like they were cost-saving measures.

Some of this anger seems to stem from inaccurate, incomplete, and sensationalist reporting, such as the cost saving one. The problems with MCAS were in the software requirements for it. Not bugs in the software, not outsourcing the programming, not in the design of the airframe, etc. The fix is in the software, too. Using the correct software rules in the first place would have cost the same amount of money. Having the MCAS software compare the two independent AOA sensor readings would not have cost more money.

I haven't heard it characterized as an instability by any reputable source. Just that the behavior in certain unusual circumstances did not match the earlier 737 behavior.

This is basic Human Factors 101. Designing something where some percentage (even a small percentage, and especially when tragic consequences are involved) of properly trained people will be confused by the design means the design is at fault, not the people.

The aircraft did not act how the manuals define runaway trim condition. MCAS was intermittent, runaway trim is constant. Checklist: https://i.imgur.com/K7El4K4.jpg

Nevertheless, the preliminary report says that crew identified the issue and followed the runaway trim procedure, but it still left them struggling to maintain control. Report: https://flightsafety.org/wp-content/uploads/2019/04/Prelimin...

I'm curious. How do the manuals define runaway trim?

I'll tell you what actual flight controls engineers consider is runaway trim who actually worked on the 757 system - the trim running when it is not supposed to. All imagined faults that could result in trim running when it wasn't supposed to were accounted for and blocked. But STILL the backstop is the trim cutoff switches, which were deliberately and prominently put on the console within easy reach just in case.

All three crews knew it was the trim repeatedly running because they successfully countered it with the electric trim switches.

All 737s bracket the center console with a pair of large wheels with a white stripe on it that are directly connected to the stabilizer jackscrew and spin when the trim is running, making a loud clacking sound. This is deliberate to make it clear to pilots when the trim is running.

The trim running can also be stopped by simply grasping that wheel hard.

It advises turning off the autopilot after first uncommanded movement and pulling the yoke firmly (triggers trim hold), and hitting trim cutoff switches after the second. That's what they did, but by then MCAS had moved the stabilizer so much that they were struggling to maintain control. Aerodynamic forces from their speed rendered manual trim ineffective. Checklist offered nothing beyond this point.

When they restored electric trim three minutes later in an attempt to trim the nose up, everything was normal for 30 seconds, but then MCAS kicked in for the third time and put the aircraft into a 40-degree nosedive.

All they needed was a bit of electric trim.

It's possible they confused 737MAX with older 737NGs, considering the virtually non-existent retraining. Older ones have two cutoff switches, one for pilot-controlled electric trim and the other for automated systems. MAX retains two switches for commonality, but they have the same function: both turn off all power to stabilizer trim, it's impossible to isolate automated systems without losing all electric assist.

Thank you for the reference.

Having it repeatedly come on and run is runaway trim. Trying to interpret the meaning of "continuous" makes for great courtroom drama, but is unhelpful when you're faced with a crisis. Besides, if the runaway trim was caused by an intermittent electrical short, would you dismiss that as well, too? Or would you turn the sucker off and save your life and let the mechanics sort it out on the ground?

> it's impossible to isolate automated systems without losing all electric assist.

The column electric trim switches override all other trim inputs. That's why the procedure is as follows:

Boeing Emergency Airworthiness Directive

"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."

https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...

And they recognized it as such and completed the runaway trim checklist, but they couldn't use manual trim (as advised) to recover from the situation, because aerodynamic forces acting on the stabilizer overpowered them.

Two Swedish pilots demonstrated this scenario in a 737NG simulator: https://youtu.be/aoNOVlxJmow?t=606 Ethiopian pilots were in even more stressful situation, because they also had broken AOA sensor with unreliable airspeed indication, active left stick shaker, occasional terrain proximity warnings and overspeed clicker.

No procedures or training existed for the situation they were in. Pilots of early 737s were taught the so-called rollercoaster maneuver to temporarily relieve the load to allow manual trimming, but that was scrapped decades ago.

Boeing's victim-blaming can be understood, if not excused, from a liability perspective. It baffles me why anyone would take on that point of view otherwise.

The runaway trim procedure is also a "memory" procedure, meaning the pilots have it memorized in order to save time.

What's your argument? "Real pilots need to work against the aircraft's malfunctioning systems 26 times" ? Oh these poorly trained Lion Air idiots, only prepared to counteract the badly programmed airframe 25 times

The Lion Air flight crew caused that crash because they lacked fundamental piloting skills. Like many low-cost carriers in middle-income countries, Lion Air have systematic problems with poor pilot training and supervision. The poor design of the MCAS system contributed to the crash, but any number of other system failures could have caused a similar accident if handled equally poorly.

https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...

I think a lot of us here are software developers. As such, we all know that if a user does the wrong thing once, that's their problem. If they do the wrong thing 25 times in a row - that's our problem. I don't care how good the pilots are, or what country they're from. If a software system silently activates, with no immediately obvious way to turn it off, and ends up killing hundreds of people - I blame the developer. Fail-deadly systems have no place in commercial aviation.

I don't want Boeing to go bankrupt, but I want them to hurt very badly from this. $25B of stock buybacks but they cut corners on this jet, to the cost of ~300 lives. This needs to cut right to their core and I'd be happy to see the entire C-suite and board fired.

I was replying to the argument that they had only 4-10 seconds. They had much more than that.

Hey walterbright, who do you work for?

By the way, my opinions on this issue are my own. I don't speak for anyone else.

The 737 MAX rightfully has a reputation as a death trap too unsafe to remain in the skies.

I'm not sure how the one is relevant to the other.

Correcting 25 times in that window is <10s on average.

That doesn't sound like anything was corrected to me. It just kept pushing down, over and over.

I'm sure you know the human factor plays a role in tons of cases.

What I don't quite understand is where you want to go from what you repeat again and again, pointing at supposed faults of the pilots, and then when more directly asked on the line if you are trying to diminish Boeing responsibility, you conveniently answers on the line of "of course not, I did not say there was no engineering problems".

So yeah, maybe pilots did not do a critical step in a critical phase of the plane doing utterly stupid things trying to kill everybody, because of various economics factor that have been debated to hell.

So... what?

You know Air France is a reputable company. You know that the pilots of AF 447 did some really weird things in the cockpit. That does not make the pitot tubes used at the time less defectives. And MAX trim (and the whole story around it) is way worse than that. I mean common, were you not once subject to a high stress situation that made you fuck one thing? And even if you were, can't you also not understand some people react differently and the human factor must be taken into account?

(It's not like the pilot has to turn around and search for it.)

I've been reading these comment threads with increasing amazement. I understand where you're coming from but if you really want to make the case that this system is faulty and that the pilots did something wrong at the same time you're doing a poor job of it by not taking into account the human angle: (1) there's 600 people dead; (2) HN'ers likely fly a lot and have little to no control over the systems on the planes that they fly with, but know all - or think they know all - about bad software and systems design; (3) The planes are still grounded pending investigation and fixes. Taken all those together I think you should take a dose of your own medication and not take such a strong position given that the facts aren't in yet.

Best case you manage to convince one or two people that there is more than one factor at play here, worst case people will associate you with Boeing in a way that helps neither. Finally, it is none of my business but ex-employees often hold stock in their former employer, if it should ever come out that you hold Boeing stock that would be held against you, so I really hope that is not the case.

Because the stabilizer trim was running away.

Emergencies can happen in any stage of the flight, and the flight crews are supposed to follow their training.

For example, sometimes an engine catches fire. This is never supposed to happen. But the pilots are trained to deal with it. Probably 90% of pilot training is learning to deal with problems that shouldn't happen.

They did follow their training. Unfortunately they had been trained to fly something that was actually a completely different plane.

Nope.

All the facts revealed so far from the investigation show that the plane was rushed and things that could have improved safety like training and warring lights were omitted because of money.

Source: my former business ran heavy check maintenance software for most of the world's largest airines.

What it did do is remove granularity (again, not sure why, as the 737NG setup is perfectly fine) in the options available to the pilot. Regardless, the SOP on using the cutout switches did not change.

Since the LA and EA crews both successfully countered the runaway trim with the electric trim switches, this statement by Captain Sullenberger is inadequate. Furthermore, I have no idea what "classic runnaway stabilizer" is. When the trim starts erroneously pointing the airplane down, it's runaway trim. There is no other kind.

BTW, I worked for three years on the 757 stabilizer trim system. I know what runaway trim is.

Where are those pilots now?

No, "runaway trim" as it was defined for every 737 variant prior to the MAX was more specific than that: it meant the trim system would continuously adjust the trim in an erroneous direction. The continuously is key.

In the 737 MAX during erroneous MCAS operation, the trim is not adjusted continuously: it is adjusted intermittently. An adjustment of a given fixed increment is made; then nothing happens. Then, a short time later, another adjustment of a given fixed increment is made; then nothing happens. Then...

This presentation is not at all the same as normal runaway trim that 737 pilots are trained to deal with. So what is inadequate is not Capt. Sullenberger's statement, but yours.

It continuously activated and ran forcing the nose down. Your pedantism is suitable for courtroom drama, but is inappropriate when you're in command of an airplane. In fact, I suspect a judge would ridicule such an argument. I was involved in a court case once where the opposition based their case on navigating around the overly literal definitions of words. The judge ruled against them on every point. They appealed, and it went before a 3 judge panel, that unanimously ruled against them on every point.

Do you seriously believe a pilot, faced with trim that kept turning on trying to dive the airplane, would not think "I need to shut off the stabilizer trim. Oh wait, I'll leave it on because it's intermittent!" ?

There's a reason airplanes have not dispensed with pilots and gone fully automated.

Normal runaway trim does, yes. MCAS failure does not, and did not in the incidents. MCAS only intermittently adjusted the trim. (Yes, the computer was continuously running the MCAS algorithm, but that's not visible to the pilot, and if you're going to hang your hat on that definition of "continuously" you are the one being pedantic, not me.)

> Do you seriously believe a pilot, faced with trim that kept turning on trying to dive the airplane, would not think "I need to shut off the stabilizer trim. Oh wait, I'll leave it on because it's intermittent!" ?

First, I have not said the pilots could not have done anything to prevent the crashes. Of course they could. But the thing they could have done was not "the runaway trim procedure".

Second, the pilots were being bombarded with multiple warnings and conflicting information. Sure, it's easy to sit in your armchair and say they should have figured out that shutting off the stabilizer trim was the right thing to do (and even then they would have had to first figure out that they needed to use the manual electric trim to put the trim where it was supposed to be, since shutting off the automatic stabilizer trim would also shut off the manual electric trim). But pilots are not omniscient and they're not magicians. There are limits to what humans can figure out under the conditions those pilots were subjected to.

> There's a reason airplanes have not dispensed with pilots and gone fully automated.

And there's a reason that pilots are supposed to have full information about any system in the plane that they might be expected to have to override. Pilots weren't even told about the existence of MCAS until after the Lion Air crash; and even then they weren't told exactly what it did or how it worked or how an issue could arise or how the system could put the plane into an unrecoverable state.

There's also a reason that the plane is not supposed to subvert the pilots' attempts to control it when it starts doing wrong things.

For example https://www.reuters.com/article/us-ethiopia-airplane-regulat...

They successfully countered it 25 times before the crash, meaning they had 25 opportunities to remember to use the cutoff switches.

"Boeing advised the airline about it after the crash."

An Airworthiness Directive was issued to all MAX flight crews after the Lion Air crash specifically laying out the procedure of countering with the trim switches and then throwing the cutoff switches.

> An Airworthiness Directive was issued [...] and then throwing the cutoff switches

So the response was "there's a known-lethal fault in our product X, when it happens, do Y"

but not

"there's a known-lethal fault in our product X, withdraw X from use immediately"

Edit: given C programmers have many, many of opportunity to learn "not to do that" in an unsafe language, instead you wrote D. That's silly, why not continue to tell C programmers "don't do <dangerous thing>"? I mean, you could have completely saved yourself year of your time writing a new language which makes it hard to do <dangerous thing>, right? Just tell them not to make mistakes is better, right?

I also regularly tell people that if you don't have a plan for when your software fails, you're going to be sorry. In this case, the plan is for the pilots to follow the runaway trim procedure.

As for software people, do you have a backup plan for when the software goes berserk? No? Well, someday it will go berserk and delete all your files. Have a backup plan. Suing the software maker won't get your files back.

About 90% of pilot training is dealing with emergencies that are never supposed to happen. One of them is runaway trim. Nobody has a plan to dispense with pilots and rely totally on automation.

The directive issued is literally just reminding pilots of a procedure they should already know - reset the trim to stabilize the plane and throw the cutout switch. The issue with MCAS changing how the plane performed was remediated by skills pilots should have irrespective of feature descriptions in a manual.

(Hint: it shouldn't.)

Especially as my field of commercial aerospace was vendor agnostic.

One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing.

Note that each of the three crews used the column trim switches to restore normal trim, why two did not think to then use the cutoff switches is something for the NTSB to determine.

If you watch "Air Disasters" on the Smithsonian Channel, many many crashes have an inadequate pilot training component, and/or pilots who did not do what they were trained to do.

Timeline: "At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out."

Initial Findings: "The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working."

What happened was by the time they did, they were trimmed nose down really far and it took all their effort on the controls to keep the nose up. The aerodynamic forces prevented them from being able to manually trim. They eventually turned the trim back on because they had to use the electric manual control to try to get the nose up because it was physically impossible for them to do so manually. They adjusted the trim in the ANU direction electrically, but then "an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds" which caused them to lose control completely.

With the MAX it isn't possible to have electric trim without MCAS, so if MCAS is malfunctioning pilots have to trim manually. The problem with the EA flight is that it occurred shortly after takeoff, so they lacked altitude (unlike the LA flight). A complicating factor was that they were flying east out of Addis Ababa (i.e uphill).

(from wikipedia): Two minutes into the flight, the plane's MCAS system activated, pitching the plane into a dive toward the ground. The pilots struggled to control it and managed to prevent the nose from diving further, but the plane continued to lose altitude. The MCAS then activated again, dropping the nose even further down. The pilots then flipped a pair of switches to disable the electrical trim tab system, which also disabled the MCAS software. However, in shutting off the electrical trim system, they also shut off their ability to trim the stabilizer into a neutral position with the electrical switch located on their yokes. The only other possible way to move the stabilizer would be by cranking the wheel by hand, but because the stabilizer was located opposite to the elevator, strong aerodynamic forces were pushing on it. As the pilots had inadvertently left the engines on full takeoff power, which caused the plane to accelerate at high speed, there was further pressure on the stabilizer. The pilots' attempts to manually crank the stabilizer back into position failed. Three minutes into the flight, with the aircraft continuing to lose altitude and accelerating beyond its safety limits, the captain instructed the first officer to request permission from air traffic control to return to the airport. Permission was granted, and the air traffic controllers diverted other approaching flights. Following instructions from air traffic control, they turned the aircraft to the east, and it rolled to the right. The right wing came to point down as the turn steepened. At 8:43, having struggled to keep the plane's nose from diving further by manually pulling the yoke, the captain asked the first officer to help him, and turned the electrical trim tab system back on in the hope that it would allow him to put the stabilizer back into neutral trim. However, in turning the trim system back on, he also reactivated the MCAS system, which pushed the nose further down. The captain and first officer attempted to raise the nose by manually pulling their yokes, but the aircraft continued to plunge toward the ground.[8][9]

https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...

which deals specifically with that:

"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."

That’s beside the point. In the story they discuss how airplanes are not intended to require this level of superhuman ability to stay airborne.

You are avoiding that this was a combination of an engineering flaw (reading from a single AOA sensor guiding MCAS, when in reality it should have been redundant) and a regulatory flaw (the role of MCAS was increased despite it being initially regulated as a much milder intervention).

It wasn't necessary to know MCAS existed - the procedure for runaway trim is in the manual and is the correct response to MCAS failure as MCAS failure exhibits itself as runaway trim.

> superhuman ability to stay airborne.

Turning off the stab trim with the cutoff switches is part of the memory procedure to deal with runaway trim, and no superhuman abilities are required. Just remembering to do it.

> You are avoiding

Not at all. I just take issue with the claim that pilots had no role in the accidents, and take issue with the bad design of the MCAS software being a cost saving measure.

Note that the fix is redesigning the MCAS software.

I did read the article, and that isn't what he said. Furthermore, Captain Sullenberger is an Airbus pilot and hasn't flown 737s in a long time and is not rated on the 737NG.

I don't know what runaway trim procedures are on Airbus airplanes.

If an aircraft starts pitching down, and it wasn't commanded by the pilot, and resetting the trim (temporarily) fixes the problem, the issue is almost certainly with the trim. If it is MCAS and a malfunctioning sensor or a failing motor that occasionally kicks on and drives the trim to its limits, the pilot response should be the same. This is what I hear Walter saying, and it makes sense. MCAS just makes it more probable to manifest.

Hence, they might not have thought it was a trim runaway.

Of course many accidents have a "pilot error" component, the central issue is what made the pilots do the wrong thing. This needs to be analyzed on a systemic level, i.e. was the training good enough, did the pilots receive adequate information, did the aircraft system provide the pilots understandable feedback, etc.

For the pilots to do the right thing, they first need to identify the problem. That can be very difficult when a lot of visual and auditory alarms -- sometimes contradicting each other -- goes off at the same time. The aircraft manufacturer has to account for the human factors.

Boeing failed miserably in this regard: 1) MCAS didn't work as intended, 2) they deliberately left out essential info about the system from flight manuals. In addition the FAA failed in their oversight of Boeing.

The deaths are on them, not the pilots.

Very few aviation crashes are the result of a single failure. Usually, they are a combination of failures, all of which were required to produce the crash.

These crashes are no different:

1. the design shortcomings of MCAS

2. the refurbished AOA sensor on the LA airplane was not calibrated properly

3. LA put the plane back in service despite the failed AOA sensor

4. The crew of the LA flight were not informed of the failed AOA sensor

5. The flight crews did not follow the memory runaway trim procedure

All of these had to happen. A typical NTSB crash report dispassionately identifies all the contributing factors to an accident and issues corrective action recommendations for each of them.

I can't exactly say but a quick read comes up with some relevant points:

"According to the reports presented to the Indonesian parliament, a Florida-based aerospace company performed the repair of the faulty AOA sensor."

https://airlinerwatch.com/broken-aoa-sensor-in-lion-air-737-... [from april 2019]

So possibly it's not LA's fault, however

"On Nov. 5, CNN published an update on the crash investigation from Capt. Nurcahyo Utomo of Indonesia's National Transportation Safety Committee (KNKT) noting that the FDR review also concluded that the aircraft's airspeed indicator had been malfunctioning on four consecutive flights prior to the crash. Utomo also indicated the pilots should have recognized the malfunction when it occurred on flight JT610."

https://www.aviationtoday.com/2018/11/07/faa-issues-boeing-7... [from nov 2018]

“1. the design shortcomings of MCAS”

“5. The flight crews did not follow the memory runaway trim procedure”

How would the pilots have switched off MCAS if they didn't know it was there?

> These emergencies did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS.

http://www.sullysullenberger.com/my-letter-to-the-editor-of-...

He bases that opinion on having flown the scenario in a professional full motion simulator (explained in the rest of his letter).

What's your response to that?

Note that the penultimate flight of Lion Air had an extra airman deadheading in the cockpit. That is a CRM luxury most normal crews would not have.

Since each crew did restore normal trim more than once, they did have more time than just seconds.

Boeing needed to use a larger engine for the new plane because larger, hotter engines burn less fuel. When the engine is made larger the wings and fuselage have to raised to accommodate the larger engine, which means jet bridges at airports have to be modified to accommodate the new plane. Boeing wanted to avoid this, so they designed the airframe such that the overall geometry of the plane is still compatible with existing infrastructure at airports, but this meant that the airframe was unstable---it has a tendency to tilt up when accelerating. Boeing compensated for this hardware flaw with a software fix.

The two serious mistakes Boeing made are (1) designing a multilayer system where bottom layers rely on upper layers for safe operation (i.e., airframe relies on software for stability) and (2) lack of redundant sensors.