Lion Air crash: Jakarta Boeing 737 'had prior instrument error'

[SiliconWizard]

I'm not an aviation engineer but it does leave me scratching my head as to why they'd decide to have two separate sensors but then not make some method of indicating a disagreement between the two as a standard feature. What's the point of redundancy if you're not going to detect a fault and alert the crew so they can act accordingly? It also strikes me as a very serious oversight that someone thought it was ok to make this MCAS system have so much authority that it could just keep pushing the nose down over and over beyond the ability of the flight controls to override. Surely there is some threshold where it should have been trivial for the software to determine "Ok we've pushed the nose down well beyond what we ever expect to need, something is probably wrong!"

I do agree with this. This was also my point right from the start, but I remember a few people replying to this that (IIRC):
- this was not as bad per se or as unusual as I thought;
- properly knowing what to do in case of sensors disagreement could be almost untractable;
- showing alerts was likely not a good idea, because overloading pilots with alerts was usually counter-productive.

(I probably forgot a couple other points.)

I do not agree with any of the above, but hey. YMMV. And for the 3rd point, there's a line between too little and too much.

As to adding a safety threshold as you suggested last - I also do agree, but it seems obvious (also from other discussions on related topics) that all this was just lacking in the written specifications for some reason, thus the developers just didn't implement any of this. Back to a discussion we had a while ago.

I'm still wondering why anyone at Boeing thought this system was so simple and so mundane that it didn't require any of these safety features. And not even any special training for the pilots. And not even any clear mention of its existence.

[KL27x]

- properly knowing what to do in case of sensors disagreement could be almost untractable

I bet when the plane is actively trying to crash itself into the earth from less than 1000 feet, you would be willing to try the other one. I mean, the pilots were surely aware that the current setup was not working, correctly, even if they didn't have enough time to fully pinpoint the problem. Even without time to check out the "backup system," you would probably want to go with the odds of both "redundant" systems going screwy being relatively tiny. Esp when the odds of surviving the impending crash are going to be pretty close to nil.

This is like having a backup parachute that you don't pull, just in case it doesn't work. Well it's even worse. It's alternating parachutes on each jump, but when the one doesn't work, you give up on parachutes, altogether. Even though you carry two, and the other one worked fine on the previous jump.*

The arrangement they have made seems to be the opposite of redundancy. And is simply a doubling of the potential failure points.

*Boeing and/or FAA might not have considered the flight computer and AOA sensor (and w/e other stuff they are cleverly alternating/testing) to be as critical as a parachute. The plane may be very safe to fly without any of that, under most circumstances. But... whey carry and alternate between two "redundant" systems if you don't make them redundant?

edit: I suppose after regaining manual control of the plane, perhaps the pilots would attempt to boot up the backup computer/sensor? And having 2 AOA sensors, one would be able to know there's a disagree, even if an adverse event hadn't occurred, yet? I can see why using 2 AOA sensors will be helpful. But what's the point of alternating which one is the primary and which is the "ignored one?" i'd think after a sensor replacement/maintenance, you would set that newly changed sensor as the 2nd stringer, until it proved itself. And until the tried and true one started getting closer to pasture, regarding wear/age. Or.... just leave the left one primary, all the time! If someone does not notice the disagree (because they didn't spring for that upgrade, maybe?) you are ensuring they will be using the malfunctioning sensor on the very next flight, just in case they got lucky and it was on the secondary on this one. If you make the left one the primary, the right could fail and you could never even notice it (until you sprung for the upgrade warning light?). Even if the left/primary failed, you wouldn't switch to the other one, anyway, apparently, so you wouldn't even notice that your backup chute had a giant hole in it, for the past 3 years.

In summary, if you're not going to use the other sensor, you're not going to observe or act on the data from that sensor, then it's better, statistically, to have just 1 sensor than alternating between 2. You're just guaranteeing that if 1 of the 2 fails, you will be using that one for sure. And even if you're doing all of the above, diligently, I still see no tangible benefit from alternating which one is the primary. If there is any way to determine which of the two sensors is more likely to fail**, then alternating would have tangible cons, though.

** e.g., maybe one has worked perfectly fine for the last 1000 flights and is still in the prime of its service life, and the other one just got replaced, yesterday. I might have a slight preference, if I were to bet on one. But maybe this sensor has been through enough testing that there's an MTF graph to check, first, before I place any big money.

[SilverSolder]

ISTR that one of the things Boeing is doing as part of fixing the Max, is to re-purpose the "dual computers" to become a true redundant system where both are active at the same time.

Anyone with software experience will tell you they probably underestimate by a factor 1000x how hard that is going to be, and the reason why the system was made the way it was, will become apparent!

[jmelson]

I'm not an aviation engineer but it does leave me scratching my head as to why they'd decide to have two separate sensors but then not make some method of indicating a disagreement between the two as a standard feature. What's the point of redundancy if you're not going to detect a fault and alert the crew so they can act accordingly?

The point is that Southwest Airlines (biggest customer for the 737, it is all they fly) told Boeing that they would fine Boeing one million US Dollars per aircraft sold if their pilots needed even one minute in simulator training when moving to the Max.  So, there must be NO new indictors or switches at all.
Boeing concealed the MCAS system from airlines in general, and partly from the FAA.  Every procedure in the Max cockpit had to follow previous versions,
and there was a one hour tablet computer course for the differences.

It also strikes me as a very serious oversight that someone thought it was ok to make this MCAS system have so much authority that it could just keep pushing the nose down over and over beyond the ability of the flight controls to override. Surely there is some threshold where it should have been trivial for the software to determine "Ok we've pushed the nose down well beyond what we ever expect to need, something is probably wrong!"

Yes, that is pretty much the crux of the whole thing.  First, Boeing told the FAA that it would only give nose-down trim for a few seconds at a time, then after some test flying the nose-high condigiton, Boeing decided they needed a lot longer nose-down trim when MCAS triggered.  They decided NOT to TELL the FAA about that change!  The flight computers know where the trim is, they could have easily bounded the system so it would NEVER push the stabilizer into abnormal ranges of trim.  On the trim wheel, there is a green central band, with a larger range of motion to compensate when something is really wrong with the aircraft.  One should never trim outside the green band unless you KNOW why you have to do this, such as improper center of gravity.
So, MCAS should have never gone out of this range, either.

The revised MCAS will apparently only command one nose-down trim movement of 9 seconds, and then NEVER do it again unless the nose too high AOA reading goes away and then occurs again.

Jon

[jmelson]

*Boeing and/or FAA might not have considered the flight computer and AOA sensor (and w/e other stuff they are cleverly alternating/testing) to be as critical as a parachute. The plane may be very safe to fly without any of that, under most circumstances. But... whey carry and alternate between two "redundant" systems if you don't make them redundant?

Well, on previous 737 models, the AOA sensor was NOT a flight critical instrument.  It did very little, and did NOT adjust any flight control surfaces.
BUT, on the Max, due to the much larger engines and their changed position, they needed a system to modify the flight handling characteristics at high angles of attack.  So, the AOA sensors were moved up to a flight critical instrument, without anybody going back and reviewing what that really meant.
Really, if the FAA had been made aware of this very important change, I think they would have refused to certify the aircraft as it was.  Most newer aircraft
with significant computer flight controls need triple-redundant computers and all instruments that feed them flight-critical data, and a complex system of voting out the bad instrument or computer.  Not totally failsafe, there are cases where two instruments failed in similar manner, causing to one remaining good instrument to be voted out.  But, that is getting pretty rare.

Jon
[/quote]

[KL27x]

Anyone with software experience will tell you they probably underestimate by a factor 1000x how hard that is going to be, and the reason why the system was made the way it was, will become apparent!

I was thinking why this is, and I am guessing it has a lot to do with communication protocols/acknowledgements?

Make an alternate loop where the program is in standby. The standby computer will disable itself from all communications with sensors. The standby computer only receives sensor data from the active flight computer. The active flight computer will relay these updates, if and when it is not otherwise occupied with more important things. Outputs will of course be rerouted to software-only bookkeeping. When requested, by pilot input, the main computer will hand over the keys, at the earliest opportune time, perhaps with a forced time-limit for when to send the most recent update and prepare to standby, and the computers will switch roles. The new first-stringer will be working from the most recent update, while new information streams in. I'm sure it's more complicated than that. And there will have to be safeguards so that it is practically impossible for both computers to go into either standby or primary mode, together.

[Nusa]

It's like you guys are starting from scratch, without having read the thread at all...

[Daixiwen]

Forums are often a big write-only memory 

[SilverSolder]

Something good is always worth doing again! 

[KL27x]

No. Been read. Just overflowed the memory. And you gotta go thru all ^^^ this crap from the peanut gallery to read it, again. 

Plus this one might go even better than how the expert knowitalls did it the first time.

[Gyro]

Plus this one might go even better than how the expert knowitalls did it the first time.

Hang on, a lot of the posts were yours! 
 

[KL27x]

^ yeah, I remember some of it. And I'm not excluding myself from that comment. 
If I remember correctly, this is usually where some dude comes in with "actually, you don't know what you're talking about. I fly a Cessna and I watch this guy Mentour Pilot, and...." then goes off on 99% tangent that barely touches on the current subject and simply derails it while (sometimes) correcting some minor semantics.

edit: I actually don't remember where this topic went. Regarding the alternating of the primary AOA sensor. From a hardware programmer perspective, this is of interest to me. There could be legit and observable reasons why Boeing's own engineers said things such as "MAX is designed by monkey supervised by clowns."  But some folks just want to defend the industry without speculating on the specifics of the engineering fail. Perhaps if in their own culture at the FAA and Boeing, engineering could be discussed without being derailed by business politics and throwing-around-of-resumes, then the FAA could actually be useful.

There's a point where endlessly thwarted meetings and emails eventually end with people with legit still-unanswered engineering concerns to end up saying, well, fuck it. It's your funeral. And thus, the FAA becomes the dog-watching-TV.

[Gyro]

I've no axe to grind. Just an observation.   

[Nusa]

How quickly the MAX gets certified to fly again has become largely academic for the duration of the CV19 crisis, with airlines grounding large numbers of planes for lack of demand. The MAX story is now background noise in the news, if you can find it at all. More people dying of CV19 every single day than have died in MAX crashes, ever.

As for the facts, most of what's actually true in this thread is old news and not hard to find if you look. Even hitting the wiki will answer most of the questions being asked above:

https://en.wikipedia.org/wiki/Boeing_737_MAX

https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Augmentation_System

[SilverSolder]

You could argue that CV19 bought Boeing some much needed time...

[Gyro]

It's a shame they continued building and filling up their car parks though - they'll have a tough time selling them now!

[KL27x]

They don't have to sell them, though. The American taxpayers will be forced to buy them. Then we'll start a war.

[Gyro]

Target selected... Engage MCAS!

Oh sorry, you mean a trade war. 

(Couldn't help myself)

[KL27x]

No, I meant when our economy stalls, the US is gonna find a reason to drop some bombs on some people pretty soon. I.e., things will go back to the regular status quo. It's a hard job leading and driving a flawed global economy. To make this omelete, you have to sometimes break some eggs.

[Gyro]

Ah yes, that's a tried and tested formula, works every time! Even for Thatcher (at least to distract the electorate).

[madires]

Boeing and FAA didn't learn anything, still trying to fool around:
- Boeing 'inappropriately coached' pilots in 737 MAX testing: U.S. Senate report: https://www.reuters.com/article/us-boeing-737-max/boeing-inappropriately-coached-pilots-in-737-max-testing-u-s-senate-report-idUSKBN28S314
- FAA punished whistleblowers, protected industry and covered up flaws, Senate report says: https://www.politico.com/news/2020/12/18/faa-punished-whistelblowers-boeing-senate-report-448550

[SilverSolder]

Regulatory bodies in other jurisdictions need to take testing more seriously too, instead of swallowing the FAA medicine raw (with or without coaching).

[BravoV]

Boeing and FAA didn't learn anything, still trying to fool around:
- Boeing 'inappropriately coached' pilots in 737 MAX testing: U.S. Senate report: https://www.reuters.com/article/us-boeing-737-max/boeing-inappropriately-coached-pilots-in-737-max-testing-u-s-senate-report-idUSKBN28S314
- FAA punished whistleblowers, protected industry and covered up flaws, Senate report says: https://www.politico.com/news/2020/12/18/faa-punished-whistelblowers-boeing-senate-report-448550

This is enough to downgrade the FAA, which is a gov. agency that is corrupt like in those banana republic 's gov. agencies, no better like in those less developed country. 

Yet, Euro certification body passed and said its ok for 737 Max to fly again "in advance" of FAA, so which one is worst ? 

[richnormand]

Fits very well with the the philosophy of "acceptable risk"  when fixing the tail issue was more expensive than paying the insurance compensation back then to slowly evolving to "killing people for profit" looks like.

[Mr. Scram]

It's a shame they continued building and filling up their car parks though - they'll have a tough time selling them now!

It's a great way of pressuring the FIA to smooth things over, or at least not make life impossible. No one wants to sink Boeing, right?