
The world pulls the Andon cord on the 737 Max - MilnerRoute
https://theaircurrent.com/aviation-safety/the-world-pulls-the-andon-cord-on-the-737-max/
======
saagarjha
It's hidden at the end, so I thought I'd put it up here: an Andon cord is a
way to notify management of issues in the assembly line, typically by pulling
it:
[https://en.wikipedia.org/wiki/Andon_(manufacturing)](https://en.wikipedia.org/wiki/Andon_\(manufacturing\))

~~~
vonseel
Seems like such an odd name for a cord that “stops” production... I imagined
by the naming that the world must have resumed flight of the 737 Max or
something like that. “And.... on!” or a race “and... go!”. Good to know, I
wasn’t aware of these in factories.

~~~
dmoy
It's derived from a language other than English. Japanese? Something...

~~~
robin_reala
Japanese: 行灯. It’s the classic Japanese lamp, I guess pressed into use as a
warning signal in factories?
[https://en.wikipedia.org/wiki/Traditional_lighting_equipment...](https://en.wikipedia.org/wiki/Traditional_lighting_equipment_of_Japan%23Andon#Andon)

------
kccqzy
> A warning light that would’ve alerted the crew to the disagreement wasn’t
> part of the added-cost optional package of equipment on Lion Air’s 737 Max
> aircraft.

I'm not an aviation expert, but why should something that seems as important
as an indicator of system malfunction be an optional package instead of
builtin?

~~~
dangwu
I agree with you, but cars have optional packages for warning lights for lane
changes and automatic braking. It’s not _that_ hard to imagine.

~~~
TheSpiceIsLife
The first thing I noticed about planes is they are not cars.

Seems an analogy that’d rapidly break down.

~~~
Joe-Z
Well, you want to be witty, but that‘s exactly the point of an analogy: Make
things that are different comparable, so you can come to conclusions about
thing A even though you only have knowledge of thing B.

You might want to try to strengthen your argument by explaining why an analogy
between cars and planes can‘t hold (one moves only in „2D“ vs. the other one
moves in „3D“ for example)

~~~
zaphirplane
that 737 costs 100,000,000

a plane crash kills a lot of people

The training to drive a car vs a 737 is Hugh

------
donkeydoug
So... they put in software (MCAS) to try and auto-assist in certain situations
so that flying the 737 Max would respond like flying the current 737. But
seems like an indicator light to show when the sensors that activate that
system trigger isn't standard equipment & the sensors may very well have a bad
baseline read before takeoff and the system kicks into gear and auto-crashes
the plane if you don't know how to disable it. Yeah, I'm never flying in one
of those things :-)

~~~
WalterBright
Pilots are trained in how to disable it - the stab trim cutoff switches are
right there on the console. The mystery is why the pilots didn't follow their
training.

~~~
lysp
[https://www.aviation24.be/manufacturers/boeing/boeing-737-ma...](https://www.aviation24.be/manufacturers/boeing/boeing-737-max-
automatic-stall-prevention-system-mcas-not-in-flight-crew-operations-manual-
fcom/)

> Boeing issued a multi-operator message (MOM) explaining the MAX’s
> manoeuvring characteristics augmentation system (MCAS) “commands nose-down
> stabilizer” in certain flight profiles using “input data and other airplane
> systems.” MCAS is operated by the flight control computer and “activated
> without pilot input and only operates in manual, flaps-up flight,” and MCAS
> is not part of previous 737 designs.

> The Allied Pilots Association (APA) told American Airlines (AA) pilots in a
> message on its website. “It is not in the AA 737 Flight Manual Part 2, nor
> is there a description in the Boeing FCOM. It will be soon.”

> A multi-page document issued by the airline’s flight operations department
> that highlights the differences between the MAX and 737 NG does not mention
> MCAS or any other changes to the auto-trim system.

> A multi-operator message (MOM) from Boeing on Nov. 6 cautioned that “an
> erroneous AOA” can trigger automatic nose-down pitch-trim.

There are lots on indications that at least in the Lion Air case it was not in
manuals or communications to pilots.

Further here:

[https://www.wsj.com/articles/boeing-withheld-information-
on-...](https://www.wsj.com/articles/boeing-withheld-information-on-737-model-
according-to-safety-experts-and-others-1542082575)

[https://outline.com/https://www.wsj.com/articles/boeing-
with...](https://outline.com/https://www.wsj.com/articles/boeing-withheld-
information-on-737-model-according-to-safety-experts-and-others-1542082575)

~~~
WalterBright
For a pilot ignorant of MCAS, what he'd see is uncommanded stabilizer trim
movement. The training says to stop that by throwing the stab trim cutoff
switches. They're prominently located on the center console.

The pilot of the same airplane on the prior flight to the Lion Air crash did
just that.

~~~
taneq
Wait, are you saying that the aircraft actually exhibited the same failure in
the prior flight but the pilot overrode it, and then they let it take off
again without warning the new pilots?

~~~
RidingPegasus
The previous flight before the disaster actually made an emergency distress
call to return back but after disabling the automatic system decided to
continue onwards and did so with no further problems in the flight.

Pilots are given all this information and are meant to read it before takeoff
but there is no way to enforce that.

Maintenance logs show the AoA vane was replaced, but Lion Air has a sketchy
history with maintenance and what's written in the logs doesn't always reflect
the reality, they are one of the cheapest airlines in the world and need to
keep planes flying. I'd say that's likely the root of the issue combined with
pilots not following the procedure books when faced with anomalous behavior.

[https://www.airlineratings.com/news/lion-air-plane-fault-
fou...](https://www.airlineratings.com/news/lion-air-plane-fault-four-
previous-flights/)

------
speeq
I wonder what their management team was thinking.. "We're going to make so
much money by not having to retrain pilots for this new plane!"

Reality: Hundreds of people die within months. Boeing is now worth $25 billion
less in market cap and the planes are grounded worldwide.

~~~
dingaling
> Boeing is now worth $25 billion less in market cap

The 737 Max order backlog ( just over 5,000 aircraft ) has a list-price value
of about $600 billion. Even if we assume 50% discounts that's still a lot of
revenue.

~~~
duado
Revenue doesn’t really matter, it’s profit that matters. They can’t discount
50% because they couldn’t even make the planes for that.

------
Panino
> Every airplane development is a series of compromises, but to deliver the
> 737 Max with its promised fuel efficiency, Boeing had to fit 12 gallons into
> a 10 gallon jug.

I know this is just impactful writing, but the more I read about the 737 Max,
the more I feel that the business decisions behind it are somewhere in between
Intel speculative execution and "fly fast and break things."

------
Waterluvian
Unrelated: the attempt to prevent me from selecting segments of text is a
massive turn off to returning to this website.

------
pauljurczak
There is a long list of errors and omissions, which contributed to these
accidents, but the bottom line seems to be software development malpractice.
MCAS system was designed by Boeing and certified by FAA to keep operating with
wildly diverging data from two AOA (angle of attack) sensors. Reports indicate
that AOA was the only sensor type MCAS was using. There have to be at least 3
AOA sensors to have some level of reliability in case of a single sensor
failure. MCAS should turn itself off in case of large difference between two
AOA sensors readings. Whoever wrote and certified that code bears at least
some level of responsibility.

~~~
planteen
The system does not necessarily need triple voting. Many aerospace systems are
only primary and redundant. There are two highly trained human pilots aboard
who can detect and isolate faulty equipment. And my guess is that these high
level software requirements originated with an aerospace systems engineer, not
a software engineer. Clearly that high level requirement was flawed
(especially in a human factors sense), but we need to remember that passenger
planes are not designed to be fully autonomous.

It seems only one AOA sensor is currently used by software. The update will
change that.

"The company said it will change the MCAS software to give the system input
from more than one AOA sensor. It will limit how much MCAS can move the
horizontal tail in response to an erroneous AOA signal. And when activated,
the system will kick in only for one cycle, rather than multiple times."

[https://www.seattletimes.com/business/boeing-
aerospace/inves...](https://www.seattletimes.com/business/boeing-
aerospace/investigators-find-new-clues-to-potential-cause-of-737-max-crashes-
as-faa-details-boeings-fix/)

~~~
pauljurczak
< change the MCAS software to give the system input from more than one AOA
sensor

That's even worse than I thought. The data from both sensors was being logged.
Some reports indicated cases of huge discrepancies (20 degrees) between
sensors. It is incomprehensible to me that MCAS ignored the other sensor. The
lawyers will have a field day with that and in this case I say: go for it!

~~~
planteen
What if the system was arranged such that there were 2 MCAS systems and 2 AOA
sensors, each redundantly wired in a cross-strapped fashion? Then, in the
cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then
tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a
method to bypass and ignore any failing sensor/actuator.

Disclaimer: I've never worked on aircraft software. I've worked on unmanned
spacecraft and the scheme I described is very common for fault tolerance.

------
WalterBright
"the complexity of aviation technology was being pushed too hard and at too
great a risk to safety, all in the name of economics."

Using automated systems to adjust the flight characteristics has been going on
at least since the 707 with its yaw damper, and likely much earlier.

There's nothing fundamentally wrong with the 737MAX. An entirely new airplane
would entail more risk. Altering the 737, with known and proven
characteristics, is low risk.

~~~
mtw
« There's nothing fundamentally wrong with the 737MAX »

This would be like Harley Davidson putting a much more powerful engine in an
old bike frame, perhaps because they feel threatened by new technology.
However the new engine is so powerful it creates wheelies, and potentially
fatal accidents as customers were not made aware they'd need to change their
bike driving habits.

There is something fundamentally wrong with the 737MAX and how they installed
the engines. I'm not an aeronoticaul engineer so I don't know the best
solution to minimize the instability. But they certainly should have tried out
more configurations, different wing shapes, done more tests etc. Somehow they
skipped all that to get more $$

~~~
kayfox
The new engines are not that much more powerful (NG: 120kN, MAX: 130kN max
thrus), its that they are physically larger.

The issue (nose up tendencies at high power settings) was an issue with the
737 Next Generation as well, its just more prevalent with the Max.

Also, nose up tendencies at high power settings is a known issue with all jet
aircraft that use underslung engines.

------
burfog
I wonder what design choices were considered and rejected. Was there a missed
option that would have been better? Numerous possibilities pop in to mind...

The rear landing gear could have been made to extend more, by telescoping or
folding.

The rear landing gear could have been attached more outboard, letting it be
longer without the wheels colliding in the middle. Perhaps something else
would need to move a bit to make room.

The rear landing gear could have been stowed as the B52 bomber stows landing
gear, asymmetrically with one going in front of the other. This would let it
be taller since it would be able to cross over the midline of the aircraft.

An engine could be flatter if it had two turbines side by side. The cost of
engine removal is still low since the aircraft still only has two engines to
remove, and the pilot training is the same because there are still only two
engines to control. Really, that isn't a quad-jet.

Letting the fan portion of the engine peek up over the wing is an interesting
thought.

~~~
pauljurczak
The primary concern was fuel efficiency, which is proportional to the diameter
of turbofan engine. Two smaller engines would be less efficient. The same with
turbofan airflow hitting the wing.

~~~
burfog
Two smaller turbines can have the same frontal area, which is what creates the
efficiency. It's total area, not diameter. Well it is the amount of power per
unit of frontal area.

Turbofan airflow already hits the support structures for the engine.
Everything is a compromise of course. Tossing a bit over the top of the wing
could be beneficial, with the impact of the wing being less harmful than the
alternatives.

------
pauljurczak
Another great article on this subject:
[https://www.seattletimes.com/business/boeing-
aerospace/faile...](https://www.seattletimes.com/business/boeing-
aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-
implicated-in-the-lion-air-crash/)

Notable points:

\- FAA delegated System Safety Analysis for MCAS and many other certification
steps to Boeing engineers (what can go wrong with corporations policing
themselves?)

\- Political pressures on FAA resulted in signing off on some certification
steps before they were completed

\- Actual limit of MCAS’s command was not known to FAA, 737 MAX operators and
pilots

\- MCAS failure was miss-classified as a “hazardous failure” instead of
“catastrophic failure”, which would require redesign

\- MCAS was not even mentioned in flight manuals

------
fouc
Why was a new single-aisle plane important?

~~~
kalleboo
The continued pursuit of increased fuel efficiency. Airbus managed to make
their A320neo more fuel efficient than Boeing's 737 and so Boeing were at risk
of losing customers to Airbus.

The new, more efficient engines are bigger and hence didn't fit under the
wings of the 737. Hence the "hacks" Boeing did to fit them on 737 that
required software augmentation to get it to work safely. A newly designed
plane taking into account the size of the engines would have been more
inherently stable without software augmentation.

Boeing's solution will probably be to improve the software augmentation by
fixing the behavior of error detection and correction in the case of sensor
troubles (such as adding clear warnings which some airlines have already added
as a optional features)

~~~
salex89
Maybe it's an overstatement, but further improvements on the 737 is beating a
dead horse. Maybe even the MAX was a stretch, but if it weren't for this
particular issue, it would live a long and happy life. Not that it won't after
this fixes. It will probably be the most audited plane in the skies.

It's a great plane that connected the world, surely, but there is no denying
that the A320 family is just more modern and still has more potential to be
squeezed from it. Starting from the trivial facts that it has a higher ground
clearance and the cockpit has more room to improve on instrumentation.

------
adam
Interesting the production methodology follows Toyota. I blogged about the
need for exactly this as I'm convinced in these kinds of situations there are
employees working on these projects who know there are issues, but because of
culture or pressure to launch, are never heard:
[https://www.cultivatelabs.com/posts/the-rise-of-anonymous-
to...](https://www.cultivatelabs.com/posts/the-rise-of-anonymous-tough-love-
and-not-a-moment-too-soon)

------
billfruit
This year hasn't been a good one for Boeing at all, besides 737 Max issues,
there have been major crashes of the 707 and the 767 this year.

~~~
siwatanejo
links?

~~~
billfruit
707 crash in Jan 2019
[https://en.m.wikipedia.org/wiki/2019_Saha_Airlines_Boeing_70...](https://en.m.wikipedia.org/wiki/2019_Saha_Airlines_Boeing_707_crash)

767 crash in Feb 2019:
[https://en.m.wikipedia.org/wiki/Atlas_Air_Flight_3591](https://en.m.wikipedia.org/wiki/Atlas_Air_Flight_3591)

------
PaulHoule
It is nice to see articles out highlighting that Boeing's choice to string the
737 along will come at great cost.

~~~
marcc
Why is this? I’m not an expert or really follow the airline industry too
closely. I’m curious to understand what about Boeing’s decision to continue
the 737 line prompts your comment.

~~~
llukas
They slapped new engines on old airframe to save costs of qualifying new
airframe and airlines save costs on retraining crews.

------
Jabbles
How much of this is hindsight? The article seems to suggest that the 737 Max
is poorly designed and incorrectly certified. Is the system really that
broken? Who knew? Could anyone have known? Are other aircraft similarly
flawed?

------
mtw
Imagine how it goes for military aircraft. If a Boeing military jet crashes,
there's no NYTimes coverage, no foreign governments pressure, no dramatic
images of emergency response team around crash site. Maybe just a single
family voice, or one over zealous Pentagon officer asking questions. But if
Boeing doesn't even acknowledge risks after a phone call with Trump, I can
imagine Boeing always claiming their military jets are the safest aircraft
ever.

~~~
duado
Safety isn’t as high a priority for military aircraft, except in that losing
an aircraft is expensive. Military pilots know that they are expected to die
for the mission if necessary.

~~~
tialaramex
Suicide is not part of conventional military doctrine. Pilots are tremendously
expensive and take time to train, so they are not expendable. One of the
things going badly wrong for Hitler by the time of the Normandy invasion was
he was running out of trained pilots. Factories can build ten more planes when
you lose ten per night, but your pilot training can't replace ten men
overnight regardless of whether those men are dead or in POW camps.

The RAF was losing planes too of course, but mostly in friendly territory, so
it kept getting the pilots back. Put them in a new plane and you've kept all
that valuable real world experience.

------
charlesism

        Boeing CEO Dennis Muilenburg reportedly spoke 
        with President Trump earlier Tuesday, 
        urging him not to ground the jet.
    

Great priorities there, Dennis! /s

