
Ethiopian Airlines 737 MAX Investigation Preliminary Report - kunkurus
http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-800MAX+%2C%28ET-AVJ%29.pdf/4c65422d-5e4f-4689-9c58-d7af1ee17f3e
======
mhandley
Indeed looks like they did disable MCAS using the stabilizer trim cutout
switches, but the aircraft was trimmed nose down when they did so. Aerodynamic
loading prevented manual trimming using the trim wheels. They eventually
turned electric trim back on, as they didn't really have any other options,
but didn't trim back enough, and left it turned on. At this point the right
airspeed indicator (which should be more reliable) reads 365 knots. VMO is
340, so they're already in big trouble. 5 seconds later, MCAS kicked back in,
and then it was all over. Very sad.

~~~
wereHamster
> Aerodynamic loading prevented manual trimming using the trim wheels.

Are the trim wheels mechanically connected to the trim mechanism in the back?
Is there no way to trim the horizontal stabilizer electrically without also
enabling MCAS? What would happen if the pilots continually pressed the trim up
switch on the yoke? That should've prevented MCAS from activating, right?

I thought Boeing airplanes were built such that "the pilot is always in
control". That doesn't seem to be the case anymore, if by cutting the power to
certain subsystems you can't control the airplane anymore.

~~~
fgonzag
I thought all jets had to be capable of performing non powered glides (as in
no electrical power, not just engine power).

I guess that's no longer a requirement.

~~~
usrusr
Being capable of performing a glide without electricity does not necessarily
imply that a no-power glide can safely be entered from extreme conditions like
diving too fast with trim set to insane.

~~~
Domenic_S
Why is it possible to set the trim to insane? Is there a legitimate scenario
where that would be used?

~~~
ls612
If the AoA was truly way too high then insane trim would be required to
correct that. MCAS and similar systems came about in response to AF 447 where
the pilots entered a high AoA situation and stalled the plane into the
Atlantic.

~~~
cjbprime
Is it necessarily true that you have to use the stabilizer for MCAS? Would
implementing a stick pusher instead fail to avoid some stalls?

~~~
Zak
It's true in the case of the 737 MAX where the pitch-up moment caused by the
engines exceeds the elevator authority in a low-speed, high-thrust situation
if the pitch trim is also set too high.

MCAS will evidently work with less maximum nose-down trim than the current
version has, as the proposed update places a limit on it.

------
Rooster61
> The crew performed runaway stabilizer checklist and put the stab trim cutout
> switch to cutout position and confirmed that the manual trim operation was
> not working.

This is very damning to Boeing. It's precisely the procedure they prescribed
and intended to mitigate possible MCAS caused trim runaway. In light of the
fact that they put this in place as a justification for moving the engines
forward without reclassifying the plane, I don't see how they can get around
fault here.

What a tragedy.

I can't imagine the emotion those pilots must have felt after attempting to do
exactly what they were told to do to keep the aircraft in the air, only to
have the nose lurch back downwards. Godspeed, gentlemen. It wasn't your fault.

~~~
davepage
It does not appear to be "precisely" the procedure, in that sufficient nose up
trim was not selected by the yoke manual trim switch prior to pulling the trim
cutouts. And then they did not work the mechanical trim wheel hard enough to
reset the residual nose down trim.

And, the crew left the power setting at climb throughout almost the entire
sequence, so they oversped the airframe.

And, when they (against procedure) (apparently) turned the electric trim
system back on, they did not use the yoke manual trim switch to fix the nose
down trim problem -- which is a big mystery.

The MCAS design inhibits its FCC trim down output when manual trim is
utilized. So, if they had just continuously pushed the nose up manual trim
switch on the yoke until they got the trim to neutral, then pulled the cutout
(either the first time or second time), the accident could have been avoided.

History shows this is not a good human factors design on the part of Boeing,
but the crew does not look good, either, IMO.

~~~
cjbprime
> sufficient nose up trim was not selected by the yoke manual trim switch
> prior to pulling the trim cutouts

The EAD/service bulletin doesn't talk about sufficient nose up trim or caution
against performing the cutout with even a slight mistrim.

> And then they did not work the mechanical trim wheel hard enough to reset
> the residual nose down trim.

It's possible that aerodynamic load (of the stabilizer opposing the elevator)
made it physically impossible to manually trim given any mistrim at the time
the cutout happened, given the airspeed they had. And, the captain is pulling
back on the yoke as hard as he can, so he's unavailable to let go of it and
grab a trim wheel instead without immediately losing altitude.

> And, when they (against procedure) (apparently) turned the electric trim
> system back on

It seems sensible to assume -- and the report states -- that they did this
because they found that manual trim was impossible in these circumstances.

~~~
kayfox
> It's possible that aerodynamic load (of the stabilizer opposing the
> elevator) made it physically impossible to manually trim given any mistrim
> at the time the cutout happened, given the airspeed they had.

Its been noted in previous discussions that while it would be difficult, the
load can be overcome if both pilots were to operate the manual trim wheel at
the same time.

Not that its a good situation to be in.

~~~
cjbprime
> Its been noted in previous discussions that while it would be difficult, the
> load can be overcome if both pilots were to operate the manual trim wheel at
> the same time.

I haven't seen that noted anywhere, and have seen it theorized as impossible
without motor assist, given their airspeed and with the elevator opposing. Got
a link?

~~~
swhitt
_Manual Stabilizer Trim_

Excessive airloads on the stabilizer may require effort by both pilots to
correct the mis-trim. In extreme cases it may be necessary to aerodynamically
relieve the airloads to allow manual trimming. Accelerate or decelerate
towards the in-trim speed while attempting to trim manually.

[https://www.pilot18.com/wp-
content/uploads/2017/01/B737NG_FC...](https://www.pilot18.com/wp-
content/uploads/2017/01/B737NG_FCTM_31-10-05.pdf) page 312 (8.16)

~~~
cjbprime
To be clear, that's a link that agrees with me that it can be impossible, not
a link that says they just needed to work harder.

It's also from a 20 year-old manual, and isn't present on newer manuals, and
pilots haven't trained on it in decades. Not appropriate to expect pilots to
know, and possibly not helpful here: the pilots were low altitude, so allowing
the nose to drop even further (to relieve aerodynamic load) may have been
deadly too.

~~~
swhitt
[https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-
ra...](https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-range.html)
does a pretty good job of summarizing it I think. It sounds incredibly
difficult to do.

------
Zak
The design of this system, from what I've heard so far sounds _insane_.

For some background, systems intended to automatically override pilot input
upon detecting an impending stall have been used on large, complex aircraft
for a long time. The most common mechanism is a stick pusher, which
mechanically pushes forward on the stick to mimic what a pilot _should_ do
about an impending stall. The force of a typical stick pusher is low enough
that a pilot can overcome it with arm strength.

A stick pusher, or a pilot pushing forward on the stick is not enough for the
aerodynamics of the 737 MAX in certain circumstances. The position of the
engines means the thrust tends to push the nose up, and at low speed, the
elevator controlled by the stick alone is not enough to push the nose down
when nearing a stall. Instead, the trim must be used, which moves the whole
horizontal stabilizer rather than just the elevator. That's not part of the
procedure on most aircraft, including other 737s, so regulators would not
allow pilots rated for 737s to easily transfer their rating to the new
aircraft, if they were willing to certify such an aircraft at all.

MCAS is the solution to this problem. It automatically uses the trim to force
the nose down with greater authority than the elevator alone could provide.
While the concept is sound, the implementation strikes me as reckless.

First, the system uses only one of the two angle of attack sensors to
determine that the aircraft is nearing a stall. Such sensors have a fairly
high rate of failure relative to the safe operation of a commercial aircraft.
As far as I can tell, causing the system to use both sensors is a _software_
change and all models of the aircraft had the required hardware. I can't
imagine a good reason the system was designed this way, especially since
Boeing has included MCAS on a previous aircraft, the tanker version of the
767, and it did use two sensors in that application.

Second, activating the system automatically, and allowing it to contradict the
pilot's attempt to pitch up using the elevator seems like a mistake. While
stalls are almost always the result of pilot error, I'm inclined to think
automated systems should let humans have the last word. A better design might
have been to automatically trim nose-down in response to full forward pressure
on the stick at low speed. That could be in combination with a stick pusher
providing full forward pressure on the stick when an impending stall is
detected _in the absence of pilot input to the contrary_.

~~~
linuxftw
A compounding problem is, if the MCAS system is disable, now the flight
characteristics are completely changed. Without additional training, there's
no way for the pilots to know they have to trim down.

~~~
Zak
There's no way for pilots to know they have to trim down under what
conditions?

~~~
linuxftw
During otherwise normal flight conditions, the nose might unexpectedly pitch
up. MCAS is designed to prevent that when AoA > somevalue to prevent stalling.

~~~
Zak
During normal flight conditions, the nose does not pitch up beyond the pilot's
ability to control with the elevator, and the pilot doesn't fly especially
close to the critical angle of attack.

MCAS is for an unusual combination of conditions where both elevator and trim
might be needed to reduce the angle of attack. An example would be if the
pilot set a fairly high nose-up trim to maintain the slow speed of final
approach, then decided to go around (abort the landing), applied full thrust,
and fully raised the flaps too early.

A pilot would definitely know that using trim is an option if the elevator was
not producing enough nose-down pitch, but a pilot who has put the aircraft
into the situation where a stall is imminent during a passenger flight has
already made a series of errors.

~~~
linuxftw
> An example would be if the pilot set a fairly high nose-up trim to maintain
> the slow speed of final approach, then decided to go around (abort the
> landing), applied full thrust, and fully raised the flaps too early.

This scenario seems it would apply to previous generation 737s as well. But
for some reason, MCAS was required for the MAX 800.

Everything I have read so far indicates the MAX 800 has some 'pitch up on it's
own' type problem that can lead to a stall. So while I'm sure it's possible to
crash the plane in a variety of ways, none of that has to do with MCAS.

~~~
Zak
All 737s have a nose-up pitch moment from the thrust of the engines because
they're hanging under the wings. The engines of the MAX are more powerful, and
positioned differently resulting in a stronger nose-up moment.

The elevator is not enough to overcome the nose-up pitching moment of the MAX
under certain conditions, but the trim is.

------
ralph84
This puts the nail in the coffin of a quick software fix getting the max back
in the air anytime soon. To have any credibility the FAA is going to have to
recertify the entire flight control system with all failure modes considered.
And no scout's honor with Boeing this time.

------
salex89
This isn't only MCAS issue anymore... If there are issues with manually
rectifying trim after it went haywire because of any reason, that might be a
problem. Interesting to find out was that an issue with older 737 models, just
without severe runaway trim events.

~~~
msbarnett
> If there are issues with manually rectifying trim after it went haywire
> because of any reason, that might be a problem.

It's not so much a "problem" as it is "physics". If the stabilizers are
forcing the nose down, and the pilot pulls back on the stick (engaging the
elevators) to pull the nose up, the forces exerted on the stabilizer are such
that, in extreme cases, human force is insufficient to move the manual wheel.

This is extremely (EDIT: No longer) well documented by Boeing going back
decades, and it presents solutions of either: 1) reengaging the electronic
stabilizer trim and trimming electronically back to a point where the forces
are manageable, then cutting electronic trim again, or 2) relaxing the stick,
letting the nose go the way the stabilizers want it to, which slackens the
force, and makes cranking the wheel manually doable. Great if you're
stabilizers are trimmed severely nose down at a height of 40,000 feet; less
great at a height of 1,000 feet. (EDITED TO ADD: Apparently this information &
procedure was removed from Boeing's manuals after the 1980s, and pilots no
longer train on it, as the issues that led to its necessity were thought
solved. The MCAS apparently has reintroduced the need for them.).

This is _compounded_ by a new change in the 737-MAX: in prior 737 series
aircraft, there are two stab trim cutout switches: one to cut the autopilot's
ability to command the stabilizer trim, the other to cut electronic power to
the stabilizer trim adjustment entirely, so you could stop the autopilot from
changing the trim but still retain electronic control and not need to worry
about the manual crank forces. The two switches are MAIN ELEC and AUTO PILOT.

In the MAX, this changed, and it's now an all or nothing setup: you have to
kill electronic power to kill autopilot commands to the stabilizer. The two
switches are now PRI and B/U. Both must be cut out to stop any stabilizer
runaway, including MCAS runaway.

This all seems to add up to Boeing's narrative of "The MCAS is safe, pilots
just need to know to hit the stab trim cutout" being grossly insufficient.
They must cut it at a moment where the stabilizer isn't grossly mistrimmed
with respect to level flight, OR they may well need to re-engage it _and race
the MCAS_ to get into a close-to-proper trim setup prior to cutting out the
stabtrim and assuming manual trim control.

~~~
Rooster61
> They must cut it at a moment where the stabilizer isn't grossly mistrimmed
> with respect to level flight, OR they may well need to re-engage it and race
> the MCAS to get into a close-to-proper trim setup prior to cutting out the
> stabtrim and assuming manual trim control.

All while keeping the plane in the air, reading the manual, and attempting not
to lose composure knowing that the same thing has happened to another flight
that lost all hands.

I'm trying very hard to look at this objectively, but this is an extremely bad
look for Boeing.

~~~
daddylonglegs
> > They must cut it at a moment where the stabilizer isn't grossly mistrimmed
> with respect to level flight, OR they may well need to re-engage it and race
> the MCAS to get into a close-to-proper trim setup prior to cutting out the
> stabtrim and assuming manual trim control.

> All while keeping the plane in the air, reading the manual, and attempting
> not to lose composure knowing that the same thing has happened to another
> flight that lost all hands.

Additionally an angle of attack (AOA) sensor failure also triggers an
unreliable airspeed warning so the pilots no longer trust their airspeed
sensors or their AOA sensors while trying to judge pitch and speed. If they go
too fast the control forces overpower them, if they go too slow they are more
likely to stall.

I don't think Boeing gamed out or tested in a simulator the human factors
involved in an AOA failure at takeoff, particularly for pilots who - like the
Lion Air pilots - are entirely ignorant of MCASes existence.

~~~
Rooster61
I don't remember where I read it, but my understanding is that the MAX
simulator does NOT simulate MCAS behavior.

EDIT: Found it: [https://www.reuters.com/article/us-ethiopia-airplane-
simulat...](https://www.reuters.com/article/us-ethiopia-airplane-simulator-
exclusive/ethiopia-crash-captain-did-not-train-on-airlines-max-simulator-
source-idUSKCN1R20WD)

~~~
daddylonglegs
Thank you for that. Putting hundreds of aircraft into service before the
simulators were available to airline pilots looks rather bad in hindsight.

I would hope that Boeing internally had simulators for the MAX while they were
testing it - along with a borrowed supply of pilots who were competent but had
no inside information. Even if they didn't, a pencil and paper exercise might
have been useful:

1\. AOA sensor fails at takeoff (A), the pilots receive an unreliable airspeed
warning and the stick shaker activates. The pilots now mistrust their sensors
and want to keep their speed up and the nose down.

2\. At about 1000 feet above ground the pilots level the aircraft, raise the
flaps and start the unreliable airspeed checklist. MCAS starts trimming
intermittently.

3\. The pilot flying is having to pull further back on the stick and trim
correctively while the crew work through their checklist. At this point the
crew need to avoid any over-focus, task saturation or over-stimulus from the
many warnings and indicators and ask themselves why the aircraft is trimming
the way it is. They have a fairly narrow window of time in which to do this
and then disable the trimming with the plane in a well trimmed state.

(A) That this happened twice in relatively quick succession might be due to a
common problem. Even if such a problem is found and fixed the AOA vanes and
pitot tubes are delicate sensors sticking out of the nose of the aircraft; the
system should be robust to failures in these sensors.

------
ummonk
It appears that Boeing's directive was simply wrong, and doomed them. The
right response to faulty MCAS is not to do a stab trim cutout and then
manually retrim, but to first use the manual electric trim switches to fix the
trim and then immediately do a stab trim cutout. This is mentioned at the end
of the directive, but reads more like an afterthought when it should be the
standard procedure.

~~~
VBprogrammer
In my opinion the pilots here have attempted to follow that checklist as well
as could be expected (bearing in mind that their lives depended on it). Having
to trim to neutral before disengaging the trim would have contradicted the
normal trim runaway checklist.

We're now talking about pilots having to have abnormal levels of skill and
possibly even strength to fly this aircraft.

That's an untenable state of affairs. Boeing have really screwed this one up.

------
danaliv
_> Both engines were found buried in the ground at a depth of approximately 10
meters._

My God.

~~~
segmondy
fly into the ground at 40 degrees doing 600mph will do that.

------
dao-
I'm starting to think that disabling MCAS isn't even a sane option because
then the pilots are exposed to unexpected aerodynamic characteristics due to
the plane's weird design. Does this make sense?

~~~
linuxftw
Many people have this opinion. You can't both require MCAS and be okay with
disabling it at the most critical portion of a flight where the system is
needed most.

~~~
pdonis
_> You can't both require MCAS and be okay with disabling it at the most
critical portion of a flight where the system is needed most._

If MCAS activates when it isn't supposed to, which is what happened here,
disabling it is what you want to do--to stop it from doing an incorrect thing.
The plane was not in a situation where MCAS was needed; it was perfectly
flyable without MCAS in the flight regime it was in.

The problem is that, _if_ you disable MCAS (which requires disabling the
entire electric stability trim system) without first using the electric trim
system to get back to something close to neutral trim, you will be stuck with
a lot of nose down trim that you can't remove fast enough with the manual trim
wheel. It looks like that's the situation this flight got into.

But if you first use the electrim trim system to get back to something close
to neutral trim, and then, before MCAS has a change to mess it up again,
disable the entire electric stability trim system, you're ok. How do we know?
Because that's what the first Lion Air flight (the one the day before the one
the crashed) did, because an off duty pilot that was riding in the jump seat
figured out what was happening and how to deal with it and told the pilots
what to do.

~~~
linuxftw
> The plane was not in a situation where MCAS was needed;

As far as I can tell, there is no takeoff (pitch up) situation where MCAS is
_not_ needed on the MAX 800. It's required for safe operation of the plane,
otherwise the nose might pitch up unexpectedly into a stall.

As I said, the system can't both "be required for safe operation of the plane"
and "it's safe to disable MCAS while it's malfunctioning during takeoff." You
have to pick one.

~~~
pdonis
_> As far as I can tell, there is no takeoff (pitch up) situation where MCAS
is not needed on the MAX 800._

Reference, please? I have not seen anything that says MCAS is required for
safe operation at a normal angle of attack for takeoff and climb to altitude.
Note that the key parameter is angle of attack, not pitch angle; if the plane
is climbing the angle of attack is lower than the pitch angle, because the
plane is climbing so the relative wind is coming from somewhat above the
horizontal direction.

------
teh_klev
I usually enjoy HN discussions, but this is a pitiful and sad thread. I
couldn't be bothered trawling past the responses to the top comment with back
seat drivers, and "ooh but I read the 737's flight manual, they fucked up".

Likely 99% of the commentariate here are neither 737 Max pilots, let alone
even licensed to fly commercial passenger jets, or even have a pilots license.
And no, as much as I love the guy, watching Mentour Pilot does not make you an
expert. They have fuck all knowledge about, or even experience, about the
sudden cockpit workload that was imposed on these pilots until the point of
hull loss. Have some respect. Oh, and you know what, this was Ethiopia's
national carrier, I expect these flyers were at the top of their profession
and as good a pilot as any other national carrier,

~~~
bronco21016
Can’t upvote enough. As someone who actually does fly airplanes for a living
it’s disturbing to me the amount of ‘expert’ arm chair quarterbacks that have
come out on HN in the wake of these two incidents. Immediately after the
Ethiopian crash there were 200+ comment threads every few hours full of
experts speculating about all the things that went wrong. People who were flat
out wrong could not be told otherwise. I had to stop even engaging.

~~~
teh_klev
Thanks for the supportive comment. I thought I was going to get a polite but
firm message from dang asking me not to drink-and-hackernews :)

------
danaliv
Am I mistaken or is there a missing item in the chronology where the pilots
reactivated the electric stabilizer trim?

The timeline mentions stab trim being switched to cutout, and if you look at
the FDR graphs there's a (relatively) long period of more-or-less stable trim
after that. But then there's an automatic trim down, which is only possible if
the electric stab trim is switched back on, and there's no mention of that.

I also can't help but wonder if exceeding Vmo was a factor.

(I don't mean to sound as though I'm trying to assign any blame here.
Obviously this was a confluence of problems, the most significant of which is
the control system reacting to an erroneous 75° (!) AOA indication.)

~~~
Torquer
I find it amazing that there is no mention in the report of this fact. The
investigators obviously know that they turned the cutout switches back to
normal mode. Assuming there really was no mention of it on the CVR strongly
suggests that it was the very inexperienced first officer who did this (the
switches are on his side) without getting concurrence from the captain.

If you carefully study the graphs in the report, the plane was really not in
bad shape up until this point. They were 7000 feet above ground and climbing.
They were going too fast, but again, this is the fault of the crew. If they
would have not flipped the cutout switch and taken stock in the situation and
backed the throttles down, it is quite possible this flight would have ended
very differently.

~~~
guyhg
There are a lot of well-taken comments in this thread. However, in reading the
Lion crash report and this one, it strikes me that there is a fundamental
difference in the crashes. In this case, it appears that the pilots had very
little knowledge about the reasons why the anti-stall system was implemented.
And their combined flight time on the MAX is absolutely pitiful. In short,
normally one thinks of a stall as a low speed event. In this case, by
switching to manual with an improperly trimmed plane, it began a process which
could be magnified by an accelerated turn (one of the reasons the MACS exists
in the first place.) They began executing a rapid 180 degree turn at >300
knots, which is shown on the attitude graph, headed back to the airport. With
a heavily loaded plane, is there any reason to doubt this wouldn't induce a
high speed stall? The plane became so unstable, as it was outside of its
operating envelope, they could not manually trim it. When they used electric
trim it turned the anti-stall system back on, and it nose-dived the plane. The
Boeing manual and/or directive says once you turn it off, it stays off. If
they were unable to manually trim, is it really much of a surprise given their
airspeed and rapid turn? So you ultimately see an electric trim which did
little to help them, and assured anti-stall would kick in again. The report
shows that neither of the pilots had signifcant experience in the MAX. The CVR
is replete with ignored overspeed warnings, and stall warnings. An experienced
pilot would know the danger is not a low speed stall, but a high speed stall
accelerated by a mismanaged turn. By the time they tried to electrically trim
it, it was over. Many planes are not aerodynamically stable without computer
assistance. This crash is far different from the Lion crash. And I have not
seen a single news outlet state the conclusions (or lack thereof) in the
report accurately.

------
jordache
>The left Indicated Airspeed increased, eventually reaching approximately 458
kts and the right Indicated Airspeed reached 500 kts at the end of the
recording. The last recorded pressure altitude was 5,419 ft on the left and
8,399 ft on the right.

How can the sensors record such different readings?

~~~
daddylonglegs
The reading from the pitot tubes (pressure sensors) for a particular airspeed
varies with the sensors angle to the airstream so the airspeed value is
adjusted based on the angle of attack (AoA). If the AoA sensor is on the fritz
on one side the airspeed reading for that side changes.

For redundancy, each pilot receives separate instrument readings from
independent sensors. When the airspeed readings disagree a warning is
activated and the pilots are expected to follow a prescribed and memorized
procedure. The warning that the AoA sensors disagree was a paid option before
this crash and the Lion Air crash.

~~~
mannykannot
While the changes in the right pressure altitude indicator track those of the
radar altimeter reading, the left falls below it -- except, in the last 15
seconds, there are blips where the left pressure altitude jumps to match the
right one. These correspond to the the times when the errant left AofA
indication briefly matches that from the (apparently working) right AofA vane.

The airspeed discrepancy has the same pattern: the left is reading low and
also showing blips, where it equals the right reading, that also correspond to
when the AofA indicators match.

All this would be consistent with the left AofA reading being used to correct
the left static pressure reading by raising it at high angles of attack, and
vice-versa for the right AofA vane and static port (this assumes there is a
right static port used by the right pressure-driven instruments, an a left
port for the left ones.)

------
Osiris
Do we know of any documented situations in which MCAS actually did it's job
correctly, that is, preventing a stall from too large AoA?

~~~
bbojan
Preventing a stall is _not_ what the job of MCAS is.

(edit: clearer language)

~~~
cjbprime
This language is not clear, at least to me. MCAS is absolutely an anti-stall
system. There's some correlation with yoke handling, but it's still with the
goal of affecting yoke handling in order to prevent stalls.

------
linuxftw
> Also, the airspeed, altitude and flight director pitch bar values from the
> left side noted deviating from the corresponding right side values. The left
> side values were lower than the right side values until near the end of the
> recording

Hmm. Seems not just faulty AoA sensors? Perhaps some major malfunction in the
flight computer? I've felt this entire time there's been a rush to claim
'faulty AoA sensors' because 'sensors' are known to fail, and it's an easy
scapegoat.

My question is, does the flight recorder have raw inputs from the sensor, or
just what the flight computer is reporting from the sensor? Seems like the
latter.

~~~
rootusrootus
Blaming the sensors seems pretty plausible, because the expected failure rate
of that sensor is roughly 1:100000 and there have been about a quarter million
737-MAX flights since the plane was introduced.

~~~
linuxftw
But I just quoted 3 other sensors were reading off so...?

~~~
jellicle
The problem is all those other things are CALCULATED values off the AoA
sensor.

Literally everything depends on a single tube which is known to get clogged
with ice, bugs etc.

So for the 737 Max, a single clogged AoA sensor causes all these things
immediately and simultaneously:

\-- all your airspeed and altitude readouts go haywire, at least on one side
of the cockpit

\-- a bunch of alarms start going off and a bunch of lights start flashing,
each indicating a different problem

\-- your control stick starts shaking

\-- a little-documented system immediately commands the nose straight down
into the ground, and keeps commanding it until turned off (but turning it off
effectively prevents you from counteracting the nose down command)

Good luck.

------
aeternus
> From 05:40:42 to 05:43:11 (about two and a half minutes), the stabilizer
> position gradually moved in the AND direction from 2.3 units to 2.1 units.
> During this time, aft force was applied to the control columns which
> remained aft of neutral position. The left indicated airspeed increased from
> approximately 305 kt to approximately 340 kt (VMO). The right indicated
> airspeed was approximately 20-25 kt higher than the left.

This part is very interesting. This aircraft nose down (AND) trim occurred
while the electric trim system was disabled. This means that either the pilots
were moving the manual trim wheel in the wrong direction, or that aerodynamic
forces were causing significant AND trim.

------
godson_drafty
To avoid FAA scrutiny, Boeing developed and deployed MCAS covertly. This was
done because they feared scrutiny would have led to huge losses in the face of
competition from Airbus. Had Boeing management just laid all their cards on
the table, potentially the FAA could have still approved the design, with
small but crucial improvements. These changes might have included: using both
AOA sensors, using a 3rd AOA sensor, not switching between left and right
sensors each flight. Instead, the covert nature of the development and
deployment of this feature allowed flaws in its design to go unchecked.

------
djmips
Imagine MCAS was never created. Instead pilots had to deal with the nose up
stalls themselves. Would that have ended up being the outcome? Instinctively I
feel like pilots could deal with the situation where MCAS was supposed to
help, especially a lot better than when MCAS is dooming these two planes. What
do you think?

------
spockz
Imagine being the one who was forced to develop this. Regardless of whether
one did see something like this coming and raised objections or missed it, I
would be unable to continue to function. Do we know how teams cope with this?

------
jessmay
1\. Using the input from a single AoA sensor as the single source of truth.

2\. Not ticking the box on the AoA DISAGREE alert option on the order sheet.

3\. Not using electronic override to neutral before STAB TRIM CUTOUT.

~~~
elsonrodriguez
Boeing should be raked over the coals for even allowing item 1 to be a valid
order configuration, and item 2 for being an order option.

------
YjSe2GMQ
Aircraft crashes attract a lot of attention, and probably for a good reason.
But just to keep folks' internal perception of risk - aircraft safety has
improved _a lot_ :

[https://www.edge.org/images/airtravelsafety.png](https://www.edge.org/images/airtravelsafety.png)

------
treis
This shouldn't be marked as a dupe since it's the actual report.

It sounds like they did everything right. There are two fateful moments:

>At 05:41:46, the Captain asked the First-Officer if the trim is functional.
The First-Officer has replied that the trim was not working and asked if he
could try it manually. The Captain told him to try. At 05:41:54, the First-
Officer replied that it is not working

At this point they were in stable flight and the trim wasn't that extreme. An
inability to manually adjust trim is a huge design flaw unless it was pilot
error.

>At 05:43:11, about 32 seconds before the end of the recording, at
approximately 13,4002 ft, two momentary manual electric trim inputs are
recorded in the ANU direction. The stabilizer moved in the ANU direction from
2.1 units to 2.3 units. >At 05:43:20, approximately five seconds after the
last manual electric trim input, an AND automatic trim command occurred and
the stabilizer moved in the AND direction from 2.3 to 1.0 unit in
approximately 5 seconds. The aircraft began pitching nose down. Additional
simultaneous aft column force was applied, but the nose down pitch continues,
eventually reaching 40° nose down. The stabilizer position varied between 1.1
and 0.8 units for the remainder of the recording.

They re-activated electric trim control but only slightly adjusted it. MCAS
kicks in to send them nose down. There's no further pilot correction recorded.
Again, unclear here if there is an airplane issue preventing them from
adjusting trim or a pilot error.

~~~
sctb
The report was the basis for this article and discussion yesterday:
[https://news.ycombinator.com/item?id=19570378](https://news.ycombinator.com/item?id=19570378).
From Hacker News' perspective, since the report itself was prominently linked
in the article and its contents were discussed directly in the thread many
times, it qualifies as a duplicate.

~~~
dmix
How is that the same? The BBC article doesn't contain even 20% of the
information as the full report (including multiple charts).

~~~
sctb
You're absolutely right, it's not the same (in this sense “duplicate” is a
misnomer—or at least should be applied to the thread or topic and not the
submitted link).

~~~
Rooster61
If that's the case, it would be appreciated if this was moved back, or at
least re-posted. It appears worthy of being visible based on the amount of
discussion it generated in a short time. Moving it to this thread effectively
threw a bucket on the fire.

This document is a big deal.

~~~
sctb
OK! We've put it back.

~~~
Rooster61
Err...Not quite, its still under the poster of the bbc article, but the effort
is appreciated nonetheless. You guys rock. :)

------
rdiddly
Reading through the chronology in section 1.1, it feels like a movie where the
aircraft is a malevolent entity that's trying to kill them. So if I were in
the cockpit I'm sure it would've been some mix of fear and anger. My life's
not in danger though, so I'm only left with the anger, on their behalf,
knowing some greedy bunch of assholes were effectively that malevolent entity,
whose will was expressed via the aircraft.

EDIT: You guys can fucking blow me. Moderators ban my account please.

~~~
ummonk
Why is that getting downvoted? What the heck.

~~~
aaron695
> knowing some greedy bunch of assholes were effectively that malevolent
> entity, whose will was expressed via the aircraft.

If this it true then link? When was this confirmed? Who are the assholes?

Else this is just Reddit spam that contributes less than nothing.

~~~
toss1
They would be the set of assholes who:

1) decided to move the engines forward making the aircraft dynamically
unstable, but improve performance and potential sales

2) decided to counter the instability with a software system (MCAS) based on a
single sensor, with zero redundancy or fail-safe mode, AND make a second
sensor an optional extra cost for the airlines, AND bury the whole thing in a
poor UI, in short: cheaping out on a band-aid fix to a critical problem of
their own creation, to maximize profits

3) decided to evade normal requirements to make the airframe a new
classification, so that airlines wouldn't need to spend money on retaining and
separately qualifying pilots for the different airframe, again to reduce
apparent costs of the new airplane and increase sales

4) minimized the training on the MCAS system and require no new training when
they made changes to the system. AND make the MCAS system automatically re-
engage, based on the single sensor to reduce customer costs

5) ensured that this cascade of bad decisions got implemented through the FAA
and rolled out globally.

The effect of all of this was to overlook and minimize critical flaws in a
complex human flight system, and do so in order to maximize sales and profits
over safety.

They killed 346 people already, and nevermind the economic knock-on effects.

No, I'm not going to hunt back and provide a link to every bit of analysis I
read gathering the above facts. It is all recent, non-obscure, and very
google-able.

Yes, bad engineering and management decision that kill people will tend to get
folks a bit riled up. This is a good thing. While this forum should indeed
emphasize facts and intellectual argument, this is not a peer-reviewed
journal, it is a forum for humans to discuss issues, and we should also keep
here the human perspective on engineering.

~~~
cjbprime
> AND make a second sensor an optional extra cost for the airlines

This would be extremely egregious, but it's not what happened. Every MAX has
two AoA vanes. Every MAX only hooks up the MCAS to one vane. The optional
feature was just an "AOA disagree" light and display, which wasn't even hooked
up to an error alarm. It's a red herring for these crashes, in my opinion. The
pilots aren't going to hunt around the cockpit during an emergency and notice
a disagree light and be able to conclude anything meaningful about what's
happening to the plane and how to stop it.

~~~
alvah
They could have had "check for AoA disagree" as part of the pre-flight
checklist though - I read somewhere that in at least 1 of the MAX crashes, the
AoA vanes disagreed on the ground before departure.

~~~
tlb
Are they expected to agree when there's no airflow? What direction should they
be pointing in?

~~~
cjbprime
You're right, they're literally vanes on the side of the aircraft, they don't
do anything without airflow. Takeoff roll is when you could possibly first
notice it.

------
dboreham
Is there a demand for freight aircraft of this size? Conversation to
freighters might be the best option for these planes.

------
intrasight
I really feel as we're entering an era where full automation is the only
solution. This current paradigm of the plane telling the pilots "I don't know
what to do here - handing it back to you" doesn't make much sense. Do we just
need better multi-modal and redundant sensors so the plane isn't flying blind?

~~~
crooked-v
This problem was one of too much automation, which decided that the best
course of action was to fly the plane into the ground. In a less automated
system, the pilots would have been able to enable electrical trim systems
without also having their trim control overridden by MCAS and would have been
able to recover flight control that way.

