There are tests to prove out ideas during the course of development, but then there are tests which would perhaps be more accurately called "demonstrations"; where you're not trying to find flaws and refine your designs, but rather prove that you're [insert thing-name you're proving here] actually works the way you are representing it to work.
I understood this test to be more in the demonstration category, where Boeing would/should have had very high confidence, but they needed to prove to NASA that their spacecraft worked as advertised. If that's true, it was almost more a test on how much NASA should trust the confidence of the Boeing team than it was a test engineering and manufacture.
If that wasn't the character of the test, then I apologize for the distraction.
I think it’s just the (well deserved) media narrative Boeing is in now. When you kill hundreds of people and then pretend it wasn’t your fault, you get what’s coming to you.
These are known engineering problems with known engineering solutions. The explanation from Boeing was that a timer was set incorrectly. This sounds like a trivial error to me (though I'm not a "rocket scientist" just a "kerbal scientist", I guess, but we've been using timers for a long time afaik to properly manage burns to orbit).
I don't know how much the systemic issues that clearly compromised the design of the plane extend to the design of the capsule, but trivals errors seem to be very possible.
This design is bad, but it makes sense as a update of the 737. The flight computer setup is each pilot gets a computer under their chair, each computer gets its own set of sensors and the computers take turns each flight. The flight computer is generally safe (i don't think it's been implicated in any crashes?), but that's because in case of issues in flight, the system usually will disengage and alert the pilot, or if the system takes poor actions, it will disengage when the pilot opposes it, or the pilot will disengage it.
Adding MCAS to the flight computer makes sense, the flight computer needs to be aware of it. It's understandable, but negligent, to add a new feature to the computer without considering the original design. The problem comes in when MCAS was not disclosed to pilots, doesn't disengage on errors, doesn't disengage when pilot input opposes it (partially by design), and can't be disabled except by disabling electric trim, which is more or less needed to recover from the error condition MCAS puts the plane into.
I think this is fixable, but the public information on the current fix doesn't include being able to turn MCAS off, so it doesn't seem like they've really done enough.
I think it’s important to acknowledge the process failures like lack of communication between domains rather than acquiesce to simple conclusions that are more clear only in hindsight.
Most complex engineering projects are hard not because of one thing, but because of the mind-bogglingly large number of things that must all be done correctly.
(1 - x) ^ y, where x is the chance of each small mistake and y is the total number of opportunities, doesn't need a very large x, if y is large enough, for things to start looking dicey.
There are a lot of things I'd love to know the accepted name for, as I came into understanding through the backdoor. I regret that my college CS track didn't include more borrow-courses from physical engineering on reliability (and control theory). So many valuable, applicable lessons.
I would guess that at least in part the difference in attitudes is because SpaceX is considered more startup-y and Boeing is more associated with the "failure is not an option" ethos.
Anyway, I do not care too much about pointing fingers elsewhere. The parachute thing was quite embarrassing and IMO this problem should have been prevented as well.
Regardless, testing all of the flight software is certainly not exclusive to SpaceX. I would bet any amount of money that Boeing also tested their software and performed simulated launches, moreover that testing is probably mandated by their contract with NASA. My uninformed guess is that one of two things happened:
1. Their tests were incomplete. e.g. they didn't find some edge case that would cause problems when the T-0 changed.
2. Someone goofed the procedures on the day of launch and didn't update their configuration properly.
Then when something like this happens, you can have your PR call up journalists they know and suggest a name or two that is likely to say what you'd hope for.
To reiterate, the procedure is:
1. restore trim to normal with the electric thumb switches
2. throw the stab trim cutoff switches
Boeing Emergency Airworthiness Directive
"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."
https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
This AD was sent to all MAX flight crews. It works because the first incident of MCAS failure (Lion Air) was safely dealt with by doing just this.
No, it's not.
So here's some context. Boeing installed known not-to-spec structural components on the NG. Boeing installed known to fail prematurely slat tracks on the NG and 737 MAX. Boeing installed (probably known) not-to-spec pickle forks in the NG and 737 MAX. Boeing falsified repair documentation for an Air Canada 787. Oh, and of course, Boeing hid any mention of MCAS. Point being Boeing doesn't have a lot of credibility left.
With that in mind:
Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.
As the Ethiopian crew found out: it can't. The larger instruments of the NG required the hand cranks to shrink while the stabilizer itself grew. With the resulting lower mechanical advantage and increase in force required to move the stab itself the wheels became unusable. Sure, the Ethiopian crew went over the "maximum" speed but they were still under the max diving speed (Vd). That means the cranks were supposed to work.
It works because the first incident of MCAS failure (Lion Air) was safely dealt with by doing just this.
It worked because the first crew got lucky and had a third set of eyes that was free to dig through everything in search of a best guess.
Whatever you read about that is simply wrong. (I've seen a LOT of misinformation in popular print about this.) You're correct that the hand cranks were unusable. But the electric thumb switches WERE usable and were pointed out in the AD.
Note that the crews of BOTH the LA and EA crashes had already used the thumb switches to restore normal trim, the LA crew did so 25 times.
> best guess
No guessing required. Follow the training, which is supposed to be a "memory item", meaning they weren't supposed to need to consult a checklist nor dig through anything nor guess.
I am not a pilot, but I would not consider myself fit to fly unless I knew by memory what every single switch in the cockpit does, ESPECIALLY the ones prominently located within easy reach. You can bet it's not the infotainment system.
For damn sure I would read every Emergency Airworthiness Directive for the airplane I'm the pilot of, most especially one issued in response to a crash.
And if you enable the electric trim switches on a 737 MAX you get MCAS activation. MCAS, of course, trims faster than the switches. Using the electric switches is fighting a losing battle (look at the graphs of trim input vs output). How are you supposed to fly the plane when you can't trim the stabilizer?
Look at the graphs from the Indonesian report. The pilots were countering with trim up button presses and MCAS still managed to take the trim to a severe AND position.
Look at the graphs from the Ethiopian report. You'll see a long gap where the electric trim was disabled (leaving the pilots with no way to trim the stabilizer). Outside that gap you'll see an automatic (MCAS) AND command with no change in trim and a couple ANU clicks from the pilots with no resulting change in trim.
No guessing required. Follow the training, which is supposed to be a "memory item", meaning they weren't supposed to need to consult a checklist nor dig through anything nor guess.
And what memory items were they supposed to have in mind? Keeping in mind MCAS presented counter to how Boeing defines runaway trim.
The electric trim switches override MCAS. That is why the steps are:
1. use the electric trim switches to set the trim to normal
2. cut off the electric trim
That's all there is to it.
> MCAS presented counter to how Boeing defines runaway trim.
That's simply false. (And runaway trim does not need definition, Boeing does not define it.)
They pause MCAS but do not disable or override it it. The trim switches move the stabilizer slower than MCAS activation thus as seen by the Ethiopian and Lion Air crews using the electric trim switches is tantamount to fighting a losing batle.
1. use the electric trim switches to set the trim to normal
What happens when the electric trim switches don't work? They didn't in the Ethiopian crash.
runaway trim does not need definition, Boeing does not define it.
Sure they do, it's in the QRH plain as day.
Condition: Uncommanded stabilizer trim movement occurs continuously.
MCAS activation isn't continuous, especially not if you're pausing it with the trim switches.
The way to make things safe is to address ALL points in the zipper that led to the accident. That includes the pilot error aspects.
So how do you propose training against an unfinished product? Boeing still hasn't given the FAA a completed software package to evaluate. At the time of the 737 MAX crashes there were, what? two? 737 MAX simulators, and none of them emulated MCAS or even the forces required to crank the stabilizer manually.
One Lion Air flight got lucky because they had a third set of eyes that could spend time going through reams of documentation.
To even begin discussing pilot "error" is disingenuous when the pilots weren't informed or trained on new 737 MAX behavior. MCAS activation is not, and was not, a runaway stabilizer situation.
It presented as a runaway stab trim. Repeatedly coming on and driving the nose down is runaway trim. No two ways about it. And the usual, standard, runaway trim procedure would stop it.
> they had a third set of eyes that could spend time going through reams of documentation
From my reading of that incident, nothing of the sort happened. The 3rd pilot simply reached forward and flipped off the cutoff switches. The crew landed safely and went on with their day. Nobody bothered to inform the next crew flying that same airplane.
No, it didn't. From the latest QRH:
Condition: Uncommanded stabilizer trim movement occurs continuously.
Well that's not met as MCAS doesn't run continuously. By design it stops periodically. Put it another way. You're arguing semantics while the 737 MAX remains a smoldering pile of aluminum and hubris.
2.) Control airplane pitch attitude manually with control column and main electric trim as required.
4.) If the runaway stops after the autopilot is disengaged ....
MCAS also stops after the trim switches are hit. So, again MCAS activation is not a runaway trim condition.
From my reading of that incident, nothing of the sort happened. The 3rd pilot simply reached forward and flipped off the cutoff switches.
Reread the report. The third pilot went back into the cabin to fetch reading material.
Trying to argue that the trim system erratically coming on and driving the nose down is not "runaway trim" is arguing semantics. Runaway trim is when the trim is doing something dangerous without command from the pilot.
If the cockpit voice recorder reveals them discussing the definition of "runaway trim" and deciding that the instructions Boeing provided didn't apply, I'd be surprised and interested.
> MCAS also stops after the trim switches are hit.
Exactly, the trim switches override the MCAS. That's why you use the trim switches to set it back to normal, then hit the cutoff switches. That's what the Emergency Airworthiness Directive says to do.
> Reread the report.
I haven't read that anywhere. I don't know what report that is. Reference, please.
On the 737 Max there is no way to disable the MCAS without also disabling the electric trim.
1. trim to normal with the electric trim switches
2. cut off the stabilizer trim
Do it in that order. Doing step 2 before step 1 won't work.
I can understand if the AD was intended as a short term fix but I would question the rationale if it were considered a long term solution
It was not, Boeing at the time was working on a solution.
Regardless, however, the pilots MUST know how to deal with runaway trim. This was true before MCAS, and is true after. It was true on the 757 (I spend 3 years working on the design of the 757 stab trim system). The cutoff switches are prominently within easy reach on the center console for very good reason, 40 years before MCAS.
It is not acceptable that pilots were unaware of the cutoff switches. It is unacceptable that MAX pilots did not read, understand, and remember the Airworthiness Directive sent to all MAX crews.
Similarly, airplane engineers work hard to keep the airplane from catching fire. But pilots also MUST learn to properly use the airplane's fire suppression systems. Most of pilot training consists of learning emergency procedures.
It's why airplanes still have pilots, instead of using automation instead.
Boeing still deserves blame for the flawed MCAS implementation. But there were other contributing factors in the crashes that must be dealt with.
The Ethiopian crew tried the cutout switches and found they couldn't trim the airplane with the hand cranks because Boeing lied. How is that a pilot training issue?
But there were other contributing factors in the crashes that must be dealt with.
A Boeing employee concern trolling over pilot training is pretty rich considering that Boeing knowingly hid crucial details from pilots.
The Emergency Airworthiness Directive to all MAX crews says:
"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."
https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
> A Boeing employee
I left Boeing about 40 years ago.
If the graphs are to be believed neither the electric commands nor hand crank were able to move the stabilizer. Again, how is that a pilot training issue?
1. trim to normal with the electric trim switches
2. cut off the stabilizer trim
What the EA pilots did was:
1. cut off the stabilizer trim
2. try to use the hand cranks to trim to normal
Graphs of the FDR data from the (preliminary) accident reports. The Ethiopian authorities even annotated theirs with things like "automatic trim command with no change in pitch trim". You can see quite plainly the stabilizer was not moving as intended.
2. try to use the hand cranks to trim to normal
Per Boeing's documentation this should've worked. Unfortunately Boeing's documentation is mostly wishful thinking. Boeing's also suggested that a pilot try unloading the stabilizer with a roller coaster type maneuver. Unfortunately Boeing removed detailed instructions on this maneuver decades ago and the FAA's already demonstrated that with the altitude that the Ethiopian crew had, unloading the stabilizer would've just flown the plane into the ground.
There's a reason Boeing's largely backed off of the whole pilot error nonsense: the 737 MAX crashed due to shitty design not pilot error.
But there were other contributing factors in the crashes that must be dealt with
I don’t necessarily disagree with this either, but it does come across as if we’re being distracted by proximate causes rather than focusing on the root cause. To someone on the outside, it sure seems like there are deeper engineering and cultural problems that deserve a greater priority at this point. Not to belabor the point, but simply issuing a procedural AD doesn’t appear to address the root causes and should just be a stop gap measure
https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
Put another way, would you want to board an airplane where the pilot did not take EMERGENCY instructions seriously? I wouldn't.
> distracted
Pretty much 100% of the popular media (and its repeated appearances on HN) has been on the MCAS design shortcomings. Which distract from dealing with the other causes of the accidents.
As I mentioned previously, the AD was issued as a stopgap measure while Boeing worked on an MCAS fix.
Procedural is meant as an administrative action as opposed to a designed engineering action.
Think of a hazardous system that has software involved with controlling a pressure hazard. A procedural mitigation may be to have an operator monitor system pressure and push a non-software shut-off emergency button if the system overpressurizes. Even though it's an emergency, it's still a procedural mitigation. An engineering mitigation, on the other hand, may have mechanical pressure relief devices in place to mitigate the hazard. Whether or not it's an "emergency" just relates to the severity and time criticality of the hazard, not the mechanism of mitigation.
In safety design the hierarchy of hazard control preference is generally engineering controls, followed by procedural controls, followed by PPE as the least desirable control scheme.
Which distract from dealing with the other causes of the accidents.
One of the common flaws in mishap investigation is jumping to “solving” proximate causes at the expense of finding the root cause. This is applicable to MCAS as well if that isn’t the root cause (although my hunch is MCAS will be closer to the root issue than pilot actions). As long as people aren’t pointing to the AD as the “fix” I think there’s not a problem with it being an interim measure
"It was unclear whether NASA would require Boeing to fly another test mission without crews onboard before allowing its astronauts to fly in the Starliner. Bridenstine said he wouldn’t rule out a mission with crews onboard, pointing out that the space shuttle had been piloted by astronauts, not computers."[0]
While Boeing makes noises about how there's no systemic problem with their ability to write software in general, earlier in the same article NASA comes to their defense by pointing out that if the craft was manned then the test would have been... saved? That seems strong to me but that is word used in the quote.
"NASA Administrator Jim Bridenstine said at a news conference Friday that the failure would not have been life-threatening had astronauts been onboard. He said that had the spacecraft been crewed, the mission might have been saved. “They are trained to deal with a situation where the automation is not working according to plan,” he said."
[0]: https://www.washingtonpost.com/technology/2019/12/20/boeing-...