In Test of Boeing Jet, Pilots Had 40 Seconds to Fix Error

NY Times ^ | March 25, 2019 | Jack Nicas, James Glanz and David Gelles

[C19fan]

During flight simulations recreating the problems with the doomed Lion Air plane, pilots discovered that they had less than 40 seconds to override an automated system on Boeing’s new jets and avert disaster.

The pilots tested a crisis situation similar to what investigators suspect went wrong in the Lion Air crash in Indonesia last fall. In the tests, a single sensor failed, triggering software designed to help prevent a stall.

[wbill]

Many decades of excellence destroyed by a few recent shitty decisions.

Doesn't matter the job or the industry. One "Oh Shit" negates one hundred "Attaboys".

[ThunderSleeps]

I'll start by saying overall I like Boeing. Full disclosure, they are at times a competitor to my company and at other times a teammate. So I have personal economic interests that at times and in various areas swing both for and against them.

That said, as an engineer I am extremely disappointed in them, to the point of being mildly shocked that they would put out something like MCAS in it's original form.

As I understand it, part of the fix or software "patch" etc. includes a couple of new limiting factors on MCAS. For example, MCAS must now take inputs from two sensors - the article I read this in did not say which two but I'm assuming two angle of attack sensors and hopefully/probably two airspeed sensors. (sidebar, I guess that means all MAXes will be retrofitted with the optional second AoA sensor?)

Another part of the fix includes a limit on the amount of nose down trim MCAS is allowed to command - no more than what can be counter-acted by the pilot pulling on the yoke - ie. using the elevator control surface.

Ok, great ideas, perhaps even obvious ideas - so why the {expletive} were these not included in the original design? As an engineer I've got to believe Boeing engineers considered these things during the initial design of MCAS. These steps (and others) seem fairly obvious and I'm not even in that segment of the business. I'm sure their engineers who are had proposed these characteristics for the MCAS system, so why weren't they incorporated in the original design?

So far all I can come up with is an economic decision by management. They probably wanted to make the second set of sensors (AoA, airspeed, etc.) optional as a cost savings. Therefore MCAS had to be configured to accept input from only one set. Boeing sales/management was probably also worried that if MCAS did not "help" enough with preventing stalls that the stall characteristics of the MAX would be enough different from previous 737 that the FAA and other certifying authorities would require significant pilot retraining - increasing costs to potential operators and thus reducing the allure of the new MAX. But they know sensors go bad - that's not news to anyone. It's not a question of if, merely when, it is a certainty. They had to know a faulty AoA or airspeed sensor would cause repeated activation of MCAS. That's not "rocket science" as they say, that is entirely foreseeable in any potential fault analysis.

That is my real disappointment with Boeing. It appears they let marketing and economic decisions override engineering. Sure, that happens every day. Engineering is all about "good enough" vs perfection but... Maybe it is just 20-20 hindsight but this seems like a very bad decision to implement MCAS in this form when there was a much safer option. Well, Boeing will have another entry in the history books - a world-class bad decision here.

[Pearls Before Swine]

I understand your comment. The enhanced Boeing system supposedly had some sensor validation, or at least a disagreement warning light. In any event, the rumor (and of course I don’t know if it is true) is that the enhanced system was helpful but optional.

[Yo-Yo]

Pulling back on the stick gives much more elevator authority to raise the nose than the MCAS system had to lower the nose.

The problem wasn't that they had 40 seconds to pull the breaker on the MCAS jackscrew motor, it's that the pilots continually tried to leave the aircraft on autopilot to automatically climb to their preset altitude instead of hand flying the aircraft.

[TheRightGuy]

if you had forty seconds to avoid a car crash there would most likely be hardly any.

[Robert A Cook PE]

One thing I haven’t heard discussed is how marginal the plane’s stability is. Was the MCAS added as a marginal improvement, or is the plane really likely to stall. I’d like to hear more about that.

The “root cause” of the extended 737’s “failure to fly stably” was the extended fuselage itself. It became inherently unstable (like the B2 and F117 and Space Shuttle a few other high-end military jets with the modification - unlike the earlier (shorter) 737's. The MCAS was designed to “automate out” that instability and allow the pilots to retain what amounted to “normal control” of the plane - just like they were used to in previous versions.

And that is Boeing's threat in these lawsuits. IF the input to the “automatic get out of jail free” program fails, then the “backup regular pilot” MUST do the right actions immediately (turn OFF the automatic program that they have never had to turn “off” before during emergencies) and then continue to recover the lane, then fly the plane on the edge of its new envelope.

Tricky job.

Boeing will get penalized because they didn't do more to prevent a "single mode failure."

[Wuli]

The more complex and sophisticated, the more possible points of failure.

One of the reasons that the U.S. approved U.S. funds in Afghanistan for the purchase of Russian helicopters for the Afghan military was the lower training and maintenance costs for the Russian equipment - which had fewer bells and whistles than the U.S. machines.

[River_Wrangler]

In my younger days I Jumped out of airplanes a few thousand times. From standard deployment altitude in a full malfunction we had 8 seconds to diagnose, cut away and deploy the reserve to avoid impact. I and many other skydivers performed this action with time to spare.

As a pilot I was trained to never use autopilot within 10 miles of the airport or 1000 feet of the ground. What happened to the old instructors with this kind of wisdom? I guess this knowledge fits with advise another old pilot gave me concerning three most useless things in aviation: 1 Altitude above you 2 Ideas you haven’t thought of yet and 3 Fuel left in the fuel trucks.

[conservatism_IS_compassion]

Boeing will get penalized because they didn't do more to prevent a "single mode failure.”

Correct, IMHO. They had a fix, in the form of an extra cost option to consider both of the existing AOA sensors simultaneously rather than only one of them. How many airline crashes does it really take to force them to make that “option" standard???

Pretty predictably, the airline which stints on optional safety features will be the airline that stints on aircrew training as well.

[conservatism_IS_compassion]

As I spun around, my brain went into slow motion and I remember thinking, "How cool, just like a carousal.”

I had a similar experience, hydroplaning on a patch of water on the Interstate. I corrected steering into the skid - realized that if the skid stopped I would swap ends, relieved the steering a bit, the wheels regained traction, I tried to stop the overcorrection that I had anticipated - and almost succeeded. The second oscillation got me; the driver behind stopped, and said he had thought I was gonna make it.

Anyway, as we were spinning around and headed towards the ditch, it felt like slow motion. Just as you said. Had to have a tow to get out of the hole we ended up in . . .

But at that point there was nothing I could do.

[Robert A Cook PE]

As I spun around, my brain went into slow motion and I remember thinking, “How cool, just like a carousal.”

I woke up in the passenger's seat on hearing my wife's reaction to the same car-on-a-carousal spin: “Oh Sh*t! Oh Sh*t! Oh Sh*t Oh Sh*t! “

She got out exactly one “Oh Sh*t!” for every revolution on the wet highway. Ended up sliding gracefully backwards down the (wet & slippery) embankment into a row of bushes. No scratches. No scars. No dents or dings even. No problems... Except three very assumed kids in the back seat - and every one of them remembers it fondly today.

[editor-surveyor]

.
Had a very similar experience, driving my first time on snow with radial tires in my brand new 1974 Mustang II Mach 1.

Landed in a row of snow plough castings with no harm done, excepting my pride.

[editor-surveyor]

.
>> “Many decades of excellence destroyed by a few recent shitty decisions.” <<

For sure!

And likely for an un-necessary “safety” fix. The 737 is Was the most nimble and capable commercial plane in the air.

[TalonDJ]

The short version is this. Stalls are bad (you know that) and when the aircraft is low you have little time to react (I know you know that too. Just setting this up). This Max has bigger engines. The engines are below the center of gravity. When a stall happens the pilot needs to apply more power. Doing that tries to pitch the noes up which is bad. So a pilot trained on the old engines needed to either not apply so much power.... or, if you did not want to retrain pilots, you just put in an automatic system that gets the plane’s nose pushed down preemptively when a stall is detected. Great way to counter at the more powerful engines, pilot reaction time, and lack of retraining.
Those factors made adding this MCAS seem like a good idea... until some dipwad decided to sell the redundant sensors as an addon, thereby making the system ‘single string’ and turning the plane into a death trap.

[conservatism_IS_compassion]

three most useless things in aviation:

1. Altitude above you
2. Ideas you haven’t thought of yet and
3. Fuel left in the fuel trucks.

I heard it as, Altitude above you, runway behind you, and fuel used.

[minnesota_bound]

FTA: ...three engagements over just 40 seconds, including pauses, would send the plane into an unrecoverable dive, the two people involved in the testing said.

Me: And we are not gonna tell you about the “feature” unless you pay for an option.

FTA: In the current design, the system engages for 10 seconds at a time, with five-second pauses in between. Under conditions similar to the Lion Air flight, three engagements over just 40 seconds, including pauses, would send the plane into an unrecoverable dive, the two people involved in the testing said.

Me: You would think that diving to the ground with not enough altitude would be a bad thing.

[WhoisAlanGreenspan?]

My understanding is that all 737 MAX had two AOA sensors already and the software to use both was already written, so installing it was a zero cost for Boeing. And the company said they didn't include it in manuals and training because normally flight crews would never even notice it working silently in the background.

I'll bet the autopilot uses lots of redundancy and checks and balances. Otherwise air travel wouldn't be nearly as safe as it is today. Doesn't the attitude indicator or artificial horizon use a gyro to display aircraft orientation? It's not an angle of attack vane but the two should be in general agreement, and that's just one example of a cross checking data.

[RinaseaofDs]

“This is a BIG deal for the airlines, because the 737 MAX 8 and 9 offer 14% better fuel efficiency than earlier models. That is a huge number!”

All the economic incentive you need. If those numbers have real data behind them, then they’ll fix this and the orders will return.

I suspect some of these orders are going away for either political or economic reasons, not the safety reasons.

[vette6387]

“I suspect some of these orders are going away for either political or economic reasons, not the safety reasons.”

My neighbor thinks that the foreign governments who are cancelling their orders are doing so to cover up their state airline’s poor level of pilot training. He said that there was absolutely no reason for these two crashes except inept pilots who did not know what to do when faced with a malfunction. As a pilot, he would never fly on most of these foreign flag carriers.

[vette6387]

You left out “the runway behind you!”