back to article Airlines in Asia, Africa ground Boeing 737 Max 8s after second death crash in four-ish months

China has grounded all Boeing 737 Max 8s on its civil aircraft register after one of the US-made airliners crashed yesterday near Addis Ababa, Ethiopia. Operators in other countries, including South Africa and Thailand, have followed suit. A four-month-old 737 Max 8 operated by Ethiopian Air came down on Sunday shortly after …

  1. Anonymous Coward
    Anonymous Coward

    Is anyone knowledgeable in the aviation industry?

    Is it just a coincidence that both planes belong to carriers in developing nations? And that the carriers reported to be reacting to the crash also seem to be mostly african or asian ones, not say BA, KLM or Lufthanse?

    It makes you wonder how Southwest seems quite reassured and cocky about the issue. Political posturing?

    1. Mark 85

      I suspect there's a possibility of coincidence more than anything else. There may be maintenance issues with the aircraft and corners cut on training of ground crews due to costs, etc.

      On the other hand, there may very well be an issue with flight control systems or sensors. It could be bad parts, bad design of the sensors or even ground maintenance. Years ago, they found certain wasps and other bugs liked to build nests or just hide out in pitot tubes. Covering is the answer when the aircraft is on the ground but these sensors maybe flush with the skin so no external tube to cover.

      The problem (one of them) is that there's not a lot of them out there and the fleet (and Boeing) are working through the teething problems. I'd say that grounding those aircraft is probably a good idea but politics and pressure from corporate sales types provide a lot of resistance to that.

      1. SkippyBing

        Worth noting Ethiopian can't be that bad as they're allowed to fly into European airports. There's a disturbingly long list of airlines from the developing world that aren't due to maintenance and training concerns.

        Incidentally you can cover static ports (the ones that are flush with the skin) you basically get a little plug that sticks in the hole. Clever designers make sure the tube part has a hollow core so if it gets broken on removal the static port still works.

    2. Crazy Operations Guy

      Southwest is probably confident in the planes not because they know something we don't but rather because if they doubted their aircraft, they are right fucked. SWA has nothing -but- Boeing 737s in their fleet.

      As for what is happening, it may likely be an issue of Pilot training and Overconfidence in the technology. Similar crashes happened when other technologies, like Auto-throttles and A/Ps with TO/GA switches were introduced. What is likely happening here is the pilots are entering incorrect data into the FMS and the aircraft is miscalculating is climb-stall speed, one of the wings is stalling,causing the plane to roll to that side and collide with the terrain. It could also be the FMS not taking certain factors into consideration

      As for why its happening to African and Asian Airlines, probably just going to be the law of big numbers. Two events are not a trend. Could also be that Western Pilots tend to be far more cynical about new technologies being total shit for their first few iterations.

      1. SkippyBing

        It also looks like SWA ticked the AoA display option on their 737 Max aircraft which means they also get a warning if the two sensors disagree. So if it is the same problem Lion Air had SWA pilots have a bit more information to work with.

        Only 35 of SWA 737s are this variant at the moment, although they've got over 200 on order...

      2. Dabbb

        Southwest has only 35 737 MAX 8 which seems to be problematic, out of 755 total, so grounding them would not be an issue. You need to remember that 737 over years had so many incremental changes that the only common thing between 737 Classic and 737 MAX is that 737 name, everything else is different and pilots training is different as well.

        1. Crazy Operations Guy

          Yeah, I know it only affects a small percentage of their aircraft, but the vast majority of the passengers do not. Their website also doesn't list what specific model of 737 is going to be on that route, so you might have more than a few passengers see that its going to be a 737 and decide it isn't worth the perceived risk. The media isn't also going to spend the time to explain the differences between the models, they're just going to say "737", and leave it at that.

          1. Anonymous Coward
            Anonymous Coward

            Well that doesn't make sense based on your other comment. If they keep the Max 8 running then for the passengers it IS a lottery (assuming a Max 8 issue). However if they say they are grounding the Max 8 then all passengers would know that they are on a plane without this 'issue'.

            Grounding them also shows that you take safety seriously and are not prepared to take a risk while there is still a lack of information, whereas carrying on running them shows that you will carry on until you can be certain a risk exists. As a passenger I would prefer my airline to be overly risk averse.

        2. GrumpyKiwi

          **and pilots training is different as well.**

          I'm told by an airline pilot that this isn't the case and is supposedly one of the selling points of the MAX 8 (no pilot retraining required).

          1. Dabbb

            It's similar to 737-800 but not to 737 Classic.

          2. Richard 12 Silver badge

            Except that clearly isn't true

            As the Lion Air pilots were experienced on other 737 variants, yet did not do the right thing during their final flight

            One wonders why the Boeing top brass still make that claim.

            1. Mine's a Large One

              Re: Except that clearly isn't true

              I don't think Lion Air ended as it did because the pilots "did not do the right thing" - MCAS was happily trimming the nose nose down to the point it couldn't go further whilst the pilots were unable to apply enough force to pull the yokes back and stop the dive.

              1. micheal

                Re: Except that clearly isn't true

                according to a "trainer" on BBC news, pulling the yoke does nothing, you need use the trim wheel on the yoke to override the MCAS

                1. Anonymous Coward
                  Anonymous Coward

                  Re: Except that clearly isn't true

                  Trim wheels are on the center pedestal (flanking the throttles, and presumably lacking crank handles in this model), but each yoke does have a set of switches for controlling the trim electrically. My understanding is that on the Lion Air flight, they did use the switches multiple times, but the system would automatically kick back in soon after they stopped. Previous model 737s would have disabled the stabilizer trim if you pulled on the yoke.

          3. sanmigueelbeer Silver badge
            Alert

            no pilot retraining required

            That was what Boeing Sales Team said BEFORE the Lion Air crash.

            MCAS is a new system. That needs training. That needs simulator time. Senior pilots of SWA may have access to simulator to be able to know when to determine if MCAS is going-to fight the controls.

            Right now, it is too early to tell if this is MCAS-related fault or not.

          4. Geoffrey W

            All the experts I have heard so far seem to be focusing on the MCAS system as the culprit and most say there should have been more AoA sensors than two - three minimum, so that in event of failure of one then the other two can vote it down. With two sensors then when one fails, which is the failing one?

            It also seems that the manuals had no mention of the MCAS system or its functioning in them. A pilot of these planes said that until the first crash he didn't even know there was an MCAS system, and woudln't have known what to do if it malfunctioned. He does now. And that the only training they had had was a one hour training class on an iPad, and no simulators for this aircraft. Simulators are now on order.

            1. Anonymous Coward
              Anonymous Coward

              Or check with another sensor type such as a 9 axis sensor and a GPS, even if you don't use it as your primary sensor it could quickly alert if there was a potential issue with the primary sensors and flash up a big red override option automatically.

            2. Cavehomme_

              It's now seeming to be about profit winning over safety. The FAA looks to be a contributer for getting into bed with Boeing.

            3. fobobob

              I just looked through an FCOM, and MCAS shows up in a glossary of terms, but literally nowhere else.

          5. Anonymous Coward
            Anonymous Coward

            Yes it's a selling point but not necessarily true. Pilots do a 90 minute re-train on a tablet, however to ensure that they can have minimal training (as a selling point) some important features were missed - such as the new anti-stall feature and how to disable it.

        3. A.P. Veening Silver badge

          Differences

          "everything else is different and pilots training is should be different as well."

          Small correction as the pilot training isn't different while it should be. Unfortunately, the decision was made to keep the same type rating (saves money in retraining) and hide the differences with a hidden and undocumented modification (MCAS).

      3. GrapeBunch

        Holy Akron.

      4. jmch Silver badge

        "Two events are not a trend."

        True, but 2 very similar crashes of the same plane model within a short time period SHOULD be raising red flags and not treated as coincidence.

        Also, it's a 4-month old plane, and (not sure), relatively new model?

      5. Poncey McPonceface

        The other say I was walking past this high-rise and a grand piano crashed into the ground *inches* from where I was. “What a coincidence,” I thought to myself, “No more than four months in practically the exact same spot a similar grand piano almost clobbered me. Well, nothing to worry about, it must be the law of large numbers.”

        Personally I'd cross the street in front of that building until I found out why grand pianos were randomly dropping from the sky in front of it.

        1. Spherical Cow Silver badge

          Just remember to look both ways before you cross ;-)

          1. RegGuy1 Silver badge

            ... or you might get run over by a grand piano.

        2. JeffyPoooh
          Pint

          "...a grand piano crashed into the ground..."

          The ground?

          That's odd. Usually their fall is cushioned by a Morris Marina.

    3. Anonymous Coward
      Anonymous Coward

      Southwest's position (last November)

      https://theaircurrent.com/aviation-safety/southwest-airlines-is-adding-new-angle-of-attack-indicators-to-its-737-max-fleet/ (article from Nov 2018)

      Southwest Airlines will activate new Angle of Attack (AOA) indicators on the large display screens for its upcoming 737 Max deliveries from Boeing to guard against any erroneous sensor data that may activate the jet’s controversial stall protection system, according to the airline.

      The cockpit display modification marks the first technical change to the airline’s 737 operations since the October 29 crash of Lion Air 610 off the coast of Jakarta, Indonesia that killed all 189 aboard the brand new 737 Max 8.

      Southwest’s pilots, the largest group of trained 737 aviators on the planet, were notified this week of the upcoming change that will start rolling out with new deliveries from Boeing starting in late December, according to two people familiar with the deployment.

      [important information follows in the rest of the article... please read it]

      Opinion: If the latest loss of life doesn't kick airline manufacturers and operators and regulatory authorities out of their excess complacency in recent years, then something is seriously out of kilter.

      1. This post has been deleted by its author

        1. Alister

          Re: Southwest's position (last November)

          I think you are misunderstanding, Southwest's aircraft have always had AoA sensors, but what they are installing are in-cockpit displays for the readings from the sensors, so that pilots can see if there is a discrepancy between them.

          1. devTrail

            Re: Southwest's position (last November)

            I think you are misunderstanding, Southwest's aircraft have always had AoA sensors, ...

            I read his comment and nowhere he wrote anything about new sensors, he correctly refers to new indicators. Where is the misunderstanding?

            1. Alister

              Re: Southwest's position (last November)

              There is a deleted comment which read:

              "They are just now installing AoA sensors on their craft? What a bunch of lazy/cheap gits...."

              And that was what I was responding to.

        2. Anonymous Coward
          Anonymous Coward

          Re: Southwest's position (last November)

          "They are just now installing AoA sensors on their craft? What a bunch of lazy/cheap gits...."

          TRY READING THE FACTS AGAIN. CAREFULLY.

          Anyway, unlike on the 737 MAX, your PiperCub's AoA sensor doesn't feed a newly introduced computerised system (MCAS) which the suppliers and regulators have sneaked in "under the radar", and which if it misbehaves risks the lives of significant numbers of inniocent people.

          Better luck next time.

          Meanwhile, sympathy, condolences, etc to all affected.

          1. chapter32

            Re: Southwest's position (last November)

            The MCAS was introduced on the Max because the installation of the new engines changed the center of gravity leaving the aircraft less stable than desired in certain configurations. The system makes the aircraft behave in a similar way to the previous generation of 737 and Boeing seem to have convinced the FAA that it did not need to be covered as a mandatory part of the conversion training. When the system gets an erroneous input from a speed sensor it can misbehave as can any similar system, but you have to know that it exists to be able to do much about it, such as turning it off.

            1. Richard 12 Silver badge

              Re: Southwest's position (last November)

              And once you've turned it off, the pilot needs to know how to fly and land the aircraft without it.

              The number one set of skills and training needed by a modern commercial pilot is what to do when the computers are confused, how to spot that and how to fly and land the aircraft with them in the alternate laws.

              The vast majority of commercial passenger jet incidents in recent years happened because the pilots did not understand what the computers were doing, or what to do when the computers don't understand what's happening.

              - Air France 447 is a particularly tragic example, as the right thing to do was nothing, but the pilot flying didn't know that.

              Because the purpose of MCAS is to make the aircraft fly like a 737NG, it obviously will not fly like a 737NG once the MCAS is no longer active.

              So clearly, you need type-specific training and simulator time to learn how to fly a 737 MAX8 with MCAS (and other systems) misbehaving and disabled. I don't see any possible argument otherwise.

      2. John Brown (no body) Silver badge

        Re: Southwest's position (last November)

        "Southwest Airlines will activate new Angle of Attack (AOA) indicators on the large display screens for its upcoming 737 Max deliveries from Boeing to guard against any erroneous sensor data that may activate the jet’s controversial stall protection system, according to the airline."

        Thanks, that's interesting. Why would an airline spend money on a optional extra unless they thought it was safety critical option? Profit is everything unless the hunt for more profit is likely to destroy the the business. The subtext of the above reads to me like this optional extra really is not optional, ie the word "controversial" seems to be carefully chosen to mean "potentially bloody dangerous"

        1. Paul Hovnanian Silver badge

          Re: Southwest's position (last November)

          "Why would an airline spend money on a optional extra unless they thought it was safety critical option?"

          Well, that's on Boeing. One of the selling points of derivative models is that they will be similar enough to the older versions that training and procedures manuals won't have to be changed (much). It sounds like Boeing thought they could add this stability augmentation system and have it just putter along in the background without having to bother the flight crews with the details.

          SWA, for whatever reason, seems to have sprung for the additional indication (really just a software generated dial on an existing display) and some class time on what it means. Their motivation may have had nothing to do with MCAS faults, but having that additional information might have proven to be invaluable. Something about hindsight being 20-20.

        2. eldakka

          Re: Southwest's position (last November)

          Why would an airline spend money on a optional extra

          SWA didn't add this option until after the Lion Air crash.

          I would imagine that, since SWA have only received around 30 737 MAX's out of a total order of 280, I think they'd have the buying power to get those sensor displays added at no cost. They are, after all, just a software option, not requiring physical instrument installation. A safety critical issue I believe would be enough for SWA to cancel the remaining 250 order without penalties on SWA.

          If SWA did, in fact, opt to pay more to get this option, then their contracts people need to be fired.

    4. Jason Hindle

      Ethiopian are a pretty solid airline

      “Is it just a coincidence that both planes belong to carriers in developing nations? And that the carriers reported to be reacting to the crash also seem to be mostly african or asian ones, not say BA, KLM or Lufthanse?”

      Good job you didn’t include Air Chance in that list.... Ethiopian are considered the best major airline in Africa, and Addis Ababa an increasingly important hub for the region (and, like Turkish, they can cover more their routes via cheaper to fly 737a than most, so potential issues with the Max are a worry).

    5. katrinab Silver badge

      Ethiopian Air is a very good airline with excellent maintenance / safety record and so on and not at all like what you might expect from African airlines.

    6. Colabroad

      Regarding Cayman Airways, who were the first to ground their planes, they only have one in operation and the second was delivered just last week so they can keep almost all their services going without the 2 MAXs.

      They're also subsidised by the local government so there's less pressure to make profit for shareholders at the expense of passenger safety.

    7. Ken 16 Silver badge

      Probably coincidence and in fact, since those are the newest, shiniest, most expensive planes in their fleet, chances are they got 1st place for service and the most qualified aircrew assigned.

  2. Dabbb

    Why do you think tickets on Lion or Ethiopian are cheaper than on Southwest ?

    That's your answer.

    1. Black Betty

      Ethiopian Airlines actually have a better than average safety rating.

  3. whoseyourdaddy

    I fear this is similar to putting too much faith in vehicular self-driving with exponentially larger tragedies.

    1. Spherical Cow Silver badge

      And yet self-driving vehicles make far fewer mistakes than human-driven vehicles. Don't refuse major improvements just because they're not 100% perfect.

      1. Paul Crawford Silver badge

        "self-driving vehicles make far fewer mistakes than human-driven vehicles"

        Really, got any reputable statistics to back that up? And under all driving conditions?

        1. John Robson Silver badge

          Paul - just look at the road...

          There has been one, well published, fatality as a result of a <disable libel legislation>knowingly negligent</libel legislation activated> company disabling safety systems.

          Their particular software was also way behind the capabilities of other vendors, and they had decided that they didn't need both a test operator and a safety driver.

          How many people have been killed on the roads in the couple of minutes it's taken me to write this comment - it's more than have been killed by even uncertified autonomous systems.

          What we don't know is how many people already *haven't* been killed as a result of self driving and/or driver assistance features...

          (Yes I know there have been cases of driver assistance programs being blindly trusted to death, but that's different from an actually self driving vehicle.)

          1. Anonymous Coward
            Anonymous Coward

            Autonomous vehicle safety/crash data analysis

            Have a read. See if it changes anything.

            http://www.safetyresearch.net/blog/articles/new-analysis-challenges-bold-tesla-claims

          2. Paul Crawford Silver badge

            There has been one, well published, fatality as a result of a <disable libel legislation>knowingly negligent</libel legislation activated> company disabling safety systems.

            Their particular software was also way behind the capabilities of other vendors, and they had decided that they didn't need both a test operator and a safety driver.

            You could also say the same about some of the piss-poor drivers on the road as well.

            How many people have been killed on the roads in the couple of minutes it's taken me to write this comment - it's more than have been killed by even uncertified autonomous systems.

            That is a very dubious comparison to make, given that there are many millions more meat-bag drivers on the road than there are automated cars being tested.

            What we don't know is how many people already *haven't* been killed as a result of self driving and/or driver assistance features...

            Sure, many things have improved road safety - seat belts, anti-lock breaks, air bags, etc, but they are all things that act in very well-defined cases, where as the self-driving thing has yet to prove it can cope with a lot of typical driving conditions in a safe manner (snow, accident with police re-directing traffic, single-track country lanes with passing places, fog/snow, etc). Relying on the "driver" to respond to an unhandled condition is utterly impractical as they won't be paying attention (why have a self driving car if you have to?) and unlike a aircraft you have drivers without training on such cases and only seconds to impact, not the minute or two that we see in these fatal air accidents.

          3. Pan_Handle

            Your xml is invalid.

  4. Anonymice

    According to the BBC...

    https://www.bbc.com/news/business-47514289

    ----

    The Indonesian National Transportation Safety Committee indicated that Lion Air flight 610 experienced "erroneous input" from one of its sensors designed to alert pilots if the aeroplane is at risk of stalling.

    The sensor and connected software work in a different way to previous models of the 737, but pilots had not been told that.

    Within days of the Lion Air crash, the aircraft maker Boeing issued an operations bulletin to airlines.

    The US aviation regulator then issued an "emergency" airworthiness directive to US carriers about this sensor - a so-called Angle of Attack (AOA) sensor.

    The Federal Aviation Administration said the sensor "condition, if not addressed, could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain".

    ----

    1. veti Silver badge

      Re: According to the BBC...

      "excessive nose-down attitude, significant altitude loss, and possible impact with terrain"

      That's rather a long-winded way to say "diving into the ground", don't you think?

      1. Yet Another Anonymous coward Silver badge

        Re: According to the BBC...

        "possible impact with terrain"

        possible? I think impact with terrain is pretty much all you can be sure of when faced with a crater

        1. caffeine addict

          Re: According to the BBC...

          I assume "impact" in that sense refer to "the terminal event". So "possible impact" would mean "possibly hit the ground as an entire, viable, aircraft, rather than disintegrating in the air"

        2. Spherical Cow Silver badge
          Unhappy

          Re: According to the BBC...

          "possible impact with terrain"

          Presumably the other possibility involves bathymetry?

      2. cshore

        Re: According to the BBC...

        What is officially known as "Controlled Flight into Terrain" is one of the leading causes of plane loss. And, yes, that is what they call it!

        1. Yet Another Anonymous coward Silver badge

          Re: According to the BBC...

          A sub-optimal flight-path ground-plane intersection solution ?

        2. SkippyBing

          Re: According to the BBC...

          This would probably be classed as LOC-I, Loss of Control Inflight, which is also an option under the ICAO Air Accident Taxonomy.

        3. Wellyboot Silver badge

          Re: According to the BBC...

          C.F.I.T has a habit of leaving a long trail of debris across the landscape, If the impact results in a crater I think 'controlled' can be ruled out.

          These two events are similar enough 'aircraft only a few months old, experienced pilots, mins after take-off' to seriously consider a world grounding and some detailed examinations of the Max-8. If a third one comes down in a city Boeing would be toast.

          The Max-8 could become Boeings 'Comet'

      3. uccsoundman

        Re: According to the BBC...

        "excessive nose-down attitude, significant altitude loss, and possible impact with terrain"

        With the result of embedded carbon based entities ceasing to function due to rapid impact disassembly.

  5. steelpillow Silver badge
    Boffin

    Background

    Further to some of the above:

    Ethiopian are a relatively respected airline, Lion are less well established. The location issue may relate more to airport layout and local practices, as these can differ from Western standards.

    But the main focus of attention is on the stall-warning system. At least one experienced pilot alleges (on the UK national BBC 4 radio news) that the Max 8 is so different from previous variants that it flies like a completely different aircraft and has had to have a special stall-warning system installed, but that pilots are not trained in its use because Boeing passed it off as the "same" as before and did not want to overload them with information. Ouch! The suggestion is that this may have been a contributory factor.

    Certainly, the reported sudden wing drop and subsequent nosedive are characteristic of a stall. It is conceivable that, where the Lion accident happened because the pilot overreacted to a false stall warning, the Ethiopian crashed because the pilot learned from that and under-reacted to a genuine one. But that is pure (though informed) speculation on my part. It seems rather more certain that both Boeing and the Federal Aviation Authority (FAA) are currently being strapped into the hot seat.

    But all must await the outcome of the crash investigations, and these things usually take time.

    1. SkippyBing

      Re: Background

      Strictly it's not a new stall warning system, it's an anti-stall feature that trims the aircraft nose down to prevent it stalling. If it gets erroneous data it can continue to trim nose down when there's no need to. The trim moves the whole tailplane, whereas the pilot's controls only affect the elevator, consequently it's almost physically impossible to pull out of a fully trimmed dive.

      It doesn't work in the opposite sense, so it shouldn't trim the aircraft into a stall, although the normal trim could do that, although I'm not sure it has full trim authority*.

      *i.e. the automatic system may not be able to trim to the limits.

      1. steelpillow Silver badge

        Re: Background

        As I understand it, it does warn about what it is doing. It can also be overriden - if you have been trained how to. And it is certainly a new feature. But yes, maybe stall management would be a better description.

        One other thing, most aircraft systems rely on multiple parallel data paths. A single failed sensor should not have caused anything more than a red indicator somewhere. If that was really the immediate cause of the Lion Air crash, then something else must have gone badly awry.

        1. Alister

          Re: Background

          One other thing, most aircraft systems rely on multiple parallel data paths. A single failed sensor should not have caused anything more than a red indicator somewhere. If that was really the immediate cause of the Lion Air crash, then something else must have gone badly awry.

          One of the problems with Boeing's Maneuvering Characteristics Augmentation System (MCAS) is that it only uses two AoA sensors, and loss of only one of them will trigger the system to keep adding nose-down trim to try and bring up the airspeed.

          1. Richard 12 Silver badge

            Re: Background

            If that's true then it should never have been awarded an airworthiness certificate, and whomever authorized it should be being held personally liable for all the deaths related to it.

            Because that would be, and I put it mildly, a Fucking Stupid Design.

            1. Alister

              Re: Background

              Because that would be, and I put it mildly, a Fucking Stupid Design.

              Agreed. Unfortunately, as the 737 MAX is not counted as a new aircraft, but merely a modification of an existing airframe, it relies on "grandfather" rights and did not have to go through a CoA renewal.

              EDIT: Link to Airworthiness Directive released after LionAir incident https://ad.easa.europa.eu/blob/2018-23-51_FR_Correction.pdf/AD_US-2018-23-51_1 (PDF)

              1. Mike 125

                Re: Background

                From what I heard on the BBC, the changes made to the 737 MAX count as major modifications- new engines, new position, etc. Boeing have tried to use software intervention to make the plane behave like the original. But they didn't tell anyone. So when something unexpected happens, the pilots are fighting an 'unknown' software adversary.

                When my boiler was condemned because corrosion made a tiny hole in the pressure path, I wanted to to weld a plate to cover the hole. The guy said "Yea, that would certainly work. But unfortunately, the gas-safe rules state: 'No Modifications' ". That's a very annoying but simple rule, which everybody understands.

                It sounds like definitely the plane (and probably my boiler) qualify as 'new', and should have been certified as such.

            2. CrazyOldCatMan Silver badge

              Re: Background

              whomever authorized it should be being held personally liable

              Cue Boeing settling out of court 'without admitting liability' and one or more FAA inspectors suddenly being given suspiciously high-paying jobs in the aero industry..

              Not that I'm cynical about such things.

            3. Pete4000uk

              Re: Background

              As long as no American airline and passengers get killed I'm sure Boeing will get away *relatively* lightly

              1. WolfFan Silver badge

                Many lawyers inbound

                You do know that at least four of the passengers were Americans, don’t you?

          2. Electronics'R'Us
            Holmes

            Re: Background

            The MCAS system can autonomously control the flying surfaces and should have been analysed for a single point of failure because MCAS should be treated as being safety critical.

            The available data suggest that a single erroneous sensor can cause it to push the nose down and that single issue should have caused a lot of concern (and some significant mitigating design work).

            Having designed flight control computers, I can definitely say that having a single point of failure potentially cause a crash is completely unacceptable. This is also a major departure from the Boeing philosophy that in case of conflict between the automation and the pilot, the pilot gets control.

            Where is the FMECA (failure mode effects and criticality analysis) for this system and for the aircraft? Inquiring minds want to know.

            1. Anonymous Coward
              Anonymous Coward

              Re: where's the FMECA

              "Where is the FMECA (failure mode effects and criticality analysis) for this system and for the aircraft? Inquiring minds want to know."

              Good question.

              Is there any such thing these days, given the fascination for "light touch regulation" and "self certfication" and so on?

              Even if the FMECA processes and documents do still exist, are they made readily available to the regulatory authorities?

              Or has someone really convinced the regulators that "it's the same aircraft with the same subsystems as it was before the new improved but still the same" version?

              Last time I saw an FMECA for a safety critical aircraft system was a few years ago. It had been value-engineered offshore to a subcontracting company who had difficulties distinguishing between an input to, and an identically named output from, various subsystems. All done in Excel too.

              It wouldn't have mattered quite as much if the "comprehensivess and correctness of the FMECA" hadn't been used to justify eliminating much of the actual *testing of the real system*. Ooops.

          3. Major N

            Re: Background

            The B737-MAX has 2 AOA sensors. one goes into Flight Computer 1, one goes into Flight Computer 2. MCAS uses one FC, alternating each flight (to the best of my knowledge). There is also no display of the AOA data from EITHER sensor, or an AOA-Sensor-Disagree light, UNLESS YOU PAY EXTRA FOR THEM.

            Lion Air did not pay extra. Therefore the pilots could not know that the AOA was wrong, even if they had known about the MCAS system and what it did/would do in those circumstances. Which they did not, as they had not been trained, and MCAS is not mentioned in the MAX manuals apparently (well, it wasn't before the incident, probably is now)

            I do not know at this stage whether Ethiopian did.

        2. Version 1.0 Silver badge

          Re: Background

          The problem is that you have to realize that there's a failed sensor - but the software believes that the sensor angle is right and so - given two sensors - if one says that you are about to stall then the software will believe it first and go into anti-stall mode. You can say that the pilots should just take over but it's not that simple - a sensor's lying - which one? What do we trust? Flight control systems are so automated these days that commercial pilots don't spend a lot of time flying by the seat of their pants anymore and when the system goes into kamikaze mode you're fighting the software and the bad sensor - you don't have a lot of time to turn the software off, figure out which sensor is good and which one should be ignored when the plane is taking off and only a couple of thousand feet up.

          1. eldakka

            Re: Background

            You can say that the pilots should just take over but it's not that simple - a sensor's lying - which one? What do we trust?

            You're right, it's not that simple.

            You see, the pilots were in manual control of the aircraft, yet the anti-stall system allegedly still took over and crashed the plane. The pilots were not aware of this new MCAS system, so did not know that it could produce the effects being experienced, therefore did not know that it could be disabled in this situation by disabling the auto-trim system.

            They might have been able to work it out, if given enough time, but in the Lion Air case it was something like 8 minutes into the flight, so those pilots at least were taking longer than 8 minutes to figure it out. And, as the AoA sensors that the MCAS system was using to decide to engage its anti-stall protocols had no cockpit display, the pilots couldn't see instruments/data in their cockpit that was telling them AoA sensor 1 thinks this and AoA sensor 2 thinks that, they didn't know they had conflicting AoA sensor data.

        3. Anonymous Coward
          Anonymous Coward

          Re: Background

          As I understand it, it does warn about what it is doing. It can also be overriden - if you have been trained how to.

          No, by default, without optional extras, MCAS does not have any indication that it is working.

          Yes, it can be overridden, but you would need to identify what the problem is fairly quickly.

          One other thing, most aircraft systems rely on multiple parallel data paths. A single failed sensor should not have caused anything more than a red indicator somewhere.

          This is not the case with MCAS.

          On the 737 MAX there are two flight control computers (FCC) each of which has an MCAS module. Each FCC has a single Angle of Attack sensor tied to it.

          During a flight, only one FCC is active and in use, and therefore only one AoA sensor is in use. If there is a fault in that sensor, there is no comparison made with the other sensor on the other FCC, and the MCAS will activate based on the signals of a single sensor.

          An optional extra provided by Boeing is to have in-cockpit displays of the readings from both AoA sensors, but this is not fitted as standard, so the pilots do not know what the AoA is reading unless their airline has paid for the extra option.

        4. SkippyBing

          Re: Background

          'As I understand it, it does warn about what it is doing.'

          My understanding is that the pilots were unaware it even existed prior to the Lion Air incident, and therefore there's no indication that it's doing anything.

      2. Anonymous Coward
        Anonymous Coward

        Re: Background

        "Strictly it's not a new stall warning system, it's an anti-stall feature that trims the aircraft nose down to prevent it stalling."

        You can describe MCAS like that, but the reality is the 737MAX is unsaleable without a trustworthy MCAS - it would either need aircraft recertification or crew retraining or both, in which case... no sale.

        More info than I can be bothered summarising:

        https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/

        "When Boeing set out to develop the 737 Max, engineers had to find a way to fit a much larger and more-fuel efficient engine under the wing of the single-aisle jet’s notoriously low-riding landing gear. By moving the engine slightly forward and higher up and extending the nose landing gear by eight inches, Boeing eked another 14% improvement in fuel consumption out of the continually tweaked airliner.

        That changed, ever so slightly, how the jet handled in certain situations. The relocated engines and their refined nacelle shape caused an upward pitching moment — in essence, the Max’s nose was getting nudged skyward. Boeing quietly added a new system “to compensate for some unique aircraft handling characteristics during it’s (sic) Part 25 certification” and help pilots bring the nose down in the event the jet’s angle of attack drifted too high when flying manually, putting the aircraft at risk of stalling, according to a series of questions and answers provided to pilots at Southwest Airlines, the largest 737 Max operator reviewed by The Air Current.

        The Maneuvering Characteristics Augmentation System (MCAS) was designed to address this, according to Boeing engineers and pilots briefed on the system, now at the center of the inquiry into the crash of Lion Air 610, a brand new Boeing 737 Max 8. MCAS is “activated without pilot input” and “commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall.”

        [continues - please refer to original article]"

        1. SkippyBing

          Re: Background

          'You can describe MCAS like that'

          Which is why I did, mainly because I found it too depressing copying and pasting the full explanation of the certification issue I made four months ago.

          https://forums.theregister.co.uk/forum/all/2018/11/27/boeing_737_max_mcas_lion_air/#c_3665169

          1. Anonymous Coward
            Anonymous Coward

            Re: /2018/11/27/boeing_737_max_mcas_lion_air/

            Point taken, and thanks for the reminder.

            "when the regulatory authorities start accepting modifications to equipment and procedures without proper understanding of the implications, we all stand to lose."

            That's one of the things I said at that time (but had forgotten about):

            https://forums.theregister.co.uk/forum/all/2018/11/27/boeing_737_max_mcas_lion_air/#c_3666401

            "in the case of the loss of AF447 and all on board, there were pitot tube icing issues already identified and various remedial programs were in progress, but its importance hadn't been fully recognised, and combined with various other unrelated failures, it led to the loss of AF447 and all on board:"

            https://en.wikipedia.org/wiki/Air_France_Flight_447

            1. steelpillow Silver badge

              Re: /2018/11/27/boeing_737_max_mcas_lion_air/

              Remember that this crash is not the previous crash and things happened rather differently. The apparent resemblances in the surrounding circumstances may be pure coincidence and the magic software may yet be shown to have played a very different role, if any, in either crash. Be that as it may, I certainly don't want to fly in one of the motherf*****s until this is all sorted out.

        2. TReko

          Re: Background

          That's a great link, thank you

        3. Anonymous Coward
          Anonymous Coward

          "under the wing of the single-aisle jet’s notoriously low-riding landing gear"

          Boeing is refusing to understand that the 737 design is EOL - and they would have needed to invest on a new one, as engines got a far larger diameter since the early turbojet-derived turbofans used in the first models.

          "help pilots bring the nose down in the event the jet’s angle of attack drifted too high when flying manually" [emphasis mine] - great design, an auto system that kicks in when you're trying to fly the plane yourself and contrast your inputs until you understand it does and you turn it off, probably very easy when you're trying to avoid the plane entering a deadly dive....

          Also, why the MCAS doesn't look at vertical speed, its change and other inputs as well, before deciding to command a nose down pitch - especially if the two (!!!!) sensors don't agree??

          1. A.P. Veening Silver badge

            Re: "under the wing of the single-aisle jet’s notoriously low-riding landing gear"

            " especially if the two (!!!!) sensors don't agree??"

            Because it doesn't even compare those two sensors, it uses only one (alternating them each flight).

          2. imanidiot Silver badge

            Re: "under the wing of the single-aisle jet’s notoriously low-riding landing gear"

            The 737 design is not EOL, it's still a perfectly viable airframe that offers several advantages to customers over the competition (that low landing gear means it fits into smaller hangars and requires less ground equipment for service for instance) The problem is that in order for the redesign for the MAX series to make sense they needed to be able to sell it without requiring retraining and re certification as this would raise the price enough that customers would rather just buy the older NG series. And this required MCAS. As it turns out now they might have taken a shortcut or 2 too many. The basic premise of MCAS is not wrong, but the idea that it doesn't require retraining from pilots trained on the NG series platform is just plain stupid.

  6. Anonymous Coward
    Anonymous Coward

    From CNN:

    China's airline regulator said Sunday it had "zero tolerance for safety hazards."

    A pity they don't take the same stance for elevators, road safety, escalators, chemical works, construction sites, any workplace involving machinery and so on.

    Chinese haphazard attitude to safety makes for compelling viewing on Liveleak.

    1. Anonymice

      Oh, China's response is totally in retaliation for the games the US is playing with Huawei.

      1. Fred Dibnah

        Re: @ Anonymice

        An even better response would be to buy Airbus next time.

      2. Poncey McPonceface

        If that is truly the case (and we don't know if it is) then Boeing has been indirectly harmed by the heavy-handed actions of its own government and the political blowback therefrom.

    2. Anonymous Coward
      Anonymous Coward

      >Chinese haphazard attitude to safety makes for compelling viewing on Liveleak

      Any downvoters, I'll just finally wrap up my argument by saying this

    3. Poncey McPonceface

      Maybe because China's *Airline* regulator doesn't regulate the safety codes of elevators, roads, escalators, chemical works, construction sites, and any workplace involving machinery.

    4. mathew42

      Australia's Civil Aviation Safety Authority bans Boeing 737 MAX 8

      > Australia's Civil Aviation Safety Authority (CASA) says it is suspending operations of the Boeing 737 MAX 8 plane in Australia after a deadly crash killed 157 people in Ethiopia at the weekend.

      https://www.abc.net.au/news/2019-03-12/boeing-737-max-8-suspended-operations-australia/10894426

      Only two carriers are currently using737 MAX 8 on flights to Australia. Silk Air have access to alternative planes, but not sure about Fiji Airways.

    5. Poncey McPonceface

      o rly?

      Along with: Singapore, Indonesia, Australia, South Africa, Ethiopia, Mongolia, Brazil, Mexico, Argentina, …

      https://timesofindia.indiatimes.com/business/international-business/boeing-737-max-countries-which-have-grounded-it-so-far/articleshow/68370169.cms

      1. Geoffrey W

        Re: o rly?

        ...Add to that list UK, Germany, Austria, France, Netherlands and Ireland. The US is looking a little isolated in still operating the MAX.

  7. Version 1.0 Silver badge

    A programming error?

    Don't forget that AF447 went down because of a sensor error too - when the sensors give bad readings the software seem to always assume that the sensors are correct and the pilots are not - and so the software puts the plane into the ground - it's no big deal for the software. Human pilots, on the other hand, generally struggle to not put the plane into the ground. Sure, we occasionally have pilot errors too but pilot errors that cause a crash are extremely rare.

    1. Craig 2

      Re: A programming error?

      "pilot errors that cause a crash are extremely rare."

      In fact, pilot error is the leading cause of commercial airline accidents, with close to 80% percent of accidents caused by pilot error, according to Boeing. The other 20% are mainly due to faulty equipment and unsafe, weather-related flying conditions.

      The numbers may vary, but the experts agree: Human error is the biggest cause of plane accidents. The focus is often on the pilots. PlaneCrashInfo.com analyzed 1,015 fatal accidents involving commercial aircraft, worldwide, from 1950 thru 2010, and found pilot error was a factor in 53 percent of all fatal accidents in that period.

      As aircraft have become more reliable, the proportion of crashes caused by pilot error has increased and now stands at around 50%.

      1. Anonymous Coward
        Anonymous Coward

        Re: A programming error?

        "80% percent of accidents caused by pilot error, according to Boeing" - Mandy Rice Davis Applies.

        Survival rate for all fatal Boeing 737-8 MAX accidents: 0 % of all occupants survived fatal accidents

        Survival rate for all fatal Boeing 737 accidents: 34.6 % of all occupants survived fatal accidents

        1. Yet Another Anonymous coward Silver badge

          Re: A programming error?

          >"80% percent of accidents caused by pilot error, according to Boeing"

          That's because 99% of all aircraft accidents are General Aviation light aircraft with very little automatic technology.

          It's like Nasa saying the shuttle is safe because exploding rockets are only involved in 1 in a million vehicle accidents in the USA.

          1. Anonymous South African Coward Bronze badge

            Re: A programming error?

            "1 in a million chances occur 9 times out of 10" - Pterry.

            1. BebopWeBop
              Joke

              Re: A programming error?

              Now where is my bow?

        2. FrogsAndChips Silver badge

          Re: A programming error?

          Survival rate for all fatal Boeing 737 accidents: 34.6 %

          These figures include hijacking situations, where you might have a very low number of fatalities compared to the number of passengers (source http://aviation-safety.net/database/types/Boeing-737-series/statistics).

          The reality is, if your plane is going down, as was the case for both 737-800 accidents, your survival rate is pretty much 0%.

    2. Anonymous Coward
      Anonymous Coward

      Re: A programming error?

      "Don't forget that AF447 went down because of a sensor error too - when the sensors give bad readings the software seem to always assume that the sensors are correct and the pilots are not"

      There were lots of factors (including human ones) in the AF447 disaster, and they're well documented if you know where to look. Software didn't really figure in this story; competence and complacency play a much larger part.

      The sensor-related stuff (hugely simplified) reads like this: commercial aircraft have three airspeed sensors of two different designs, so the chances of two failing in the same way at the same time andthen leading to loss of life are (say the regulators) negligible; there should always be a reasonably accurate airspeed signal.

      AF447 proved that regulators operators and crew got it wrong, with very sad results. That was ten years or so ago: see e.g.

      https://www.reuters.com/article/us-airbus-sensors/airbus-urges-sensor-switch-after-crash-idUSTRE56T5UN20090730

      It turns out that two of the three airspeed sensors failed the same way at the same time, therefore the computers rejected the remaining good one, and ultimately leading to the loss of AF447. The sensor failure mode was known and understood and Airworthiness Directives had been issued, but not fully rolled out across all potentially vulnerable aircraft.

    3. eldakka

      Re: A programming error?

      Don't forget that AF447 went down because of a sensor error too - when the sensors give bad readings the software seem to always assume that the sensors are correct and the pilots are not - and so the software puts the plane into the ground

      The software on AF447 did not put the plane into the ground.

      Because of the sensor error, the software switched to alternate law 2 (reduces the influence of various automatic systems, including in this case disabling the anti-stall systems) and the pilots then flew the plane into the ocean, there were issues as to why the pilots did that, which I went into in a post about this on a previous article.

    4. tip pc Silver badge

      Re: A programming error?

      “Don't forget that AF447 went down because of a sensor error too - when the sensors give bad readings the software seem to always assume that the sensors are correct and the pilots are not - and so the software puts the plane into the ground”

      That’s not true.

      The pitot tubes gave erroneous speed readings causing the autopilot to disengage and due to the low air speed readings from the master (captains side) pitot the stall warning was sounded even though the aircraft was flying fine. The 2 pilots (the captain was on a rest break) got confused and the co pilot pulled his controller up and held it there continuously while the other copilot thought he was in command and couldn’t understand why the aircraft wasn’t responding to his inputs correctly even with high thrust. Neither pilot realised the auto pilot had completely disengaged and assumed it was still providing basic safety, when the captain returned and was discussing the issue the right hand copilot admitted he’d been pulling up for a while, the captain then realised it had been causing an actual stall and told him to stop but it was too late and the aircraft crashed into the sea at high speed.

      The crash was caused by the right hand copilot putting in erranous flight commands even though he was not in command and the pilot in command had no clue he was doing it.

      1. Anonymous Coward
        Anonymous Coward

        Re: A programming error?

        Yup, poor CRM :-(

    5. SkippyBing

      Re: A programming error?

      'the software seem to always assume that the sensors are correct and the pilots are not'

      Actually the software realised it wasn't sure what was going on and handed over to the pilots. It turns out suddenly handing a difficult situation to a pilot who is mentally relaxed doesn't work well...

  8. PhilipN Silver badge

    Human vs. Machine vs. Software Error

    The original Spiderman from many years ago, when climbing up the sides of buildings on the end of a rope, wanted blokes on the other end of the rope, not machines.

    The main way I can think of to rationalise this is there is only one potential point of failure. And one which has a brain.

    1. devTrail

      Re: Human vs. Machine vs. Software Error

      Human vs. Machine vs. Software Error

      Such an arguments is too much simplified for the issue. To put it blundly is pointlessly dumb. All these planes are piloted by extremely complex fly by wire systems, the pilots are completely disconnected from the real outputs of the commands and whether the system should or should not overrule the pilot depends on too many variables.

  9. Black Betty

    Why no sanity check systems?

    Blocked or partially obstructed pitot tubes can be tested for by applying a partial vacuum and/or slight overpressure to the pitot lines.

    GPS can provide ground speed, altitude and climb/descent rates for comparison with other instruments.

    Extended range RADAR altimeters should be able to override a faulty barometric altimeter.

    Even something as simple as a few bits of ribbon visible through the cockpit windows could provide a visual cue that something is seriously off kilter.

  10. GrapeBunch

    157+189 = 346

    The post is required, and must contain letters.

    1. GrapeBunch

      My summary of the death toll of those two flights received four downvotes so far, and zero upvotes. Yet, as implied, the incidents are resulting in regulatory close looks at this type of aircraft. Or were the downvoters imputing some different comment genesis?

  11. scrubber

    Software error

    Maybe someone was entering too much text in the IFE.

  12. Anonymous Coward
    Trollface

    The Professional Pilots Rumour Network (PPRuNe)

    Why are bellends who run PPRuNe a bunch of c0ckwombles? You make one post that these flight-sim heroes don't like and they ban you. Knobs.

  13. sanmigueelbeer Silver badge

    Continued Airworthiness Notification to the International Community

    FAA has issued a CANIC (Continued Airworthiness Notification to the International Community) regarding the 737 MAX (737-8 MAX & 737-9 MAX).

    The objective of this document is to inform every operators that the FAA & NTSB are aware of the accident and working with ET (Ethiopian Air) to determine the cause of the crash. (Translation: FAA & NTSB are not sleeping.)

    Take away notes: Airworthiness Directive (AD) 2018-23-51 and simulator sessions to ensure pilots are able to correctly identify when AoA is working or not.

    In the meantime Boeing is about to release a software patch to "enhance" MCAS (Translation: Make it easier for pilots to know if AI is going bonkers) .

  14. Tim99 Silver badge

    A friend who trains pilots...

    ...for several international airlines advised “If things are going wrong with the aeroplane, and the aircrew don’t know why, you want them to panic in English as their first language”.

  15. Chris G

    If you modify an existing model of aircraft such that the modification alters the flight characteristics significantly, then the new model should undergo new C of A testing and flight training. Clearly Boeing used their muscle and political clout to avoid that. Also interesting that a manufacturer insists that 80% of accidents are human/pilot error; ' it's not our planes, oh no!'.

    1. SkippyBing

      'If you modify an existing model of aircraft such that the modification alters the flight characteristics significantly, then the new model should undergo new C of A testing'

      Not so, under the current regulations there are grandfather rights and you only have to certify the changes. This makes sense when all you're doing is stretching, or shortening, a basic airframe, e.g. A320 to the A321, A319 and A318, or Boeing 777-200 to the 777-300. The question is when do the cumulative differences make it a completely different aircraft? I'd suggest when you've gone from carrying 84 pax 1500 miles to 200 pax 3000 miles over 50 years...

  16. nichomach

    I'm probably being silly...

    ...but as I understand it, the indicator for AoA Disagree is an "option", rather than being standard. I would have thought that this was a fairly ****ing important thing to know?

    1. tip pc Silver badge

      Re: I'm probably being silly...

      Important for MCAS, during the day pilots likely look out the window or use some other artificial horizon?

      If AoA is separate to the artificial horizon then it’s likely that pilots will not likely check it.

      The truth is that on most flights there are many many faults with systems that are not deemed critical enough to ground the plane, we just don’t hear about them.

      1. I ain't Spartacus Gold badge

        Re: I'm probably being silly...

        But MCAS is a critical system. Because the plane is, if not dangerous, then at least less than pefectly safe without it working. And yet MCAS is allowed to operate with only 2 sensors, even though it's safety critical - given it can malfuntion and fly the plane into the ground.

        So you need to have a way to diagnose if the MCAS is trying to save you from your own mistake, or if MCAS is screwing up because of bad sensor data and trying to kill you. And comparing its AOA readings to your artificial horizon (and other data) is therefore important in diangosing the problem - and should not just have been an optional extra / afterthought.

  17. Anonymous Coward
    Anonymous Coward

    after second death crash (OT)

    maybe I'm having a bad day (brexit, storm, struggling towards mid-week, etc.), but I've got an impression there's a growing number of sensationalist headlines in the register these days. I find them cheesy, offputting, and tedious to parse, because I have to take a guess whether such headline reflects the actual text, and frankly, I usually can't be bothered.

    1. I ain't Spartacus Gold badge

      Re: after second death crash (OT)

      El Reg even call themselves a tabloid. And have the red top to prove it.

      The strapline "biting the hand that feeds IT" might be a clue too...

    2. David Nash Silver badge

      Re: after second death crash (OT)

      This one seems pretty accurate to me.

  18. Anonymous Coward
    Anonymous Coward

    A distinct sort of accident...

    It's a distinct sort of accident when the aircraft is in essentially perfect condition in the final second before impact.

    Well, 'perfect condition' except for minor things like a bad sensor, bad software, user interface induced pilot error, clogged pitot tube, etc. Minor things that should NOT down an airliner.

    Back in the early days of Airbus, most of their accidents were of this distinct type. Perfect aircraft, right up to impact. You'll recall the one that landed in the forest at Paris. Too many similar examples.

    As opposed to the traditional Boeing or MD accidents that often started with a loud bang because something very important broke; where the aircraft is doomed with the initial failure.

    Designer hubris may be a contributing factor to the frequency of these newer style of accident. Making incorrect assumptions about the real world outcomes arising from overly-complicated and too-subtle systems.

    Designers and regulators should step back and recognize this widest possible view. The evidence supporting this view is perfectly obvious; one would have to be willfully blind to not see it.

    1. I ain't Spartacus Gold badge

      Re: A distinct sort of accident...

      You do need to remember that increasing safety standards mean that crashes are becoming less and less frequent. And safety features built into aircraft are therefore working, to some extent that we can probably never measure accurately.

      So we now have problems where the saftey systems are so complex that the pilots sometimes aren't able to diagnose and resolve the problems when they themselves go wrong - but then we have many fewer crashes to suggest that those safety systems are also doing their job most of the time.

      So while I agree that we now need to look at user interface to try and avoid confusing the pilots with too many contradictory warnings when the complex systems crap out on them - we shouldn't forget that crashes are getting more complex partly because we're not having many of the stupidly simple ones anymore. For an example see that Qantas airbus 1,000ft bounces flight, where the copilot had over 1,000 different warnings in under 5 minutes to try and scroll through on his screen making it basically impossible to get any information out of such a mess.

  19. Anonymous South African Coward Bronze badge

    Take the case of the Gimli Glider - it was due to pilot skill that the plane landed without loss of life.

    Now take any modern aeroplane, and put it into that situation...

    I can understand that costs need to be cut, but there is a point where it is true insanity to cut out pilots and have a T-800* fly the aeroplane, only to crash it into a densely-populated area just to make it more horrific.

    *zx-spectrum, robocop, amiga, TRS-80, TWIKI, Dalek etc... take your pick.

    1. Yet Another Anonymous coward Silver badge

      Although it was due to pilot error in not checking the error made by the ground crew in loading the fuel.

    2. I ain't Spartacus Gold badge

      Chesley Sullenberger was flying a modern fly-by-wire aircraft with all mod cons. And he didn't complain about the automatic systems that Airbus had fitted stopping him from gliding. He deliberately took action to make sure he had them.

      In fact, as I understand it, procedures have now been changed to match what he did. He started the APU (auxilliary power unit) in order to have the full suite of fly-by-wire computers helping him - whereas his checklist had that step at the very end and would have relied on the RAT (which is an emergency turbine giving minimal power for instruments deployed when the engines all fail, which uses the airspeed of the plane to generate it).

      1. Anonymous Coward
        Anonymous Coward

        IF dual engine failure situation, THEN start APU early

        Thank you. I'd forgotten that. Here's the source:

        https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf

        (Section 2.3.1, following text is on "page 88" (PDF page 105)):

        "... Starting the APU early in the accident sequence proved to be critical because it improved the outcome of the ditching by ensuring that electrical power was available to the airplane. Further, if the captain had not started the APU, the airplane would not have remained in normal law mode. This critical step would not have been completed if the flight crew had simply followed the order of the items in the [Engine Dual Failure] checklist.

        The NTSB concludes that, despite being unable to complete the Engine Dual Failure checklist, the captain started the APU, which improved the outcome of the ditching by ensuring that a primary source of electrical power was available to the airplane and that the airplane remained in normal law and maintained the flight envelope protections, one of which protects against a stall.

        [continues]"

  20. Anonymous Coward
    Anonymous Coward

    Dubious

    It seems that Boeing and the FAA are saying "The aircraft is perfectly safe" while at the same time admitting that two separate aircraft of the same type have suffered very similar failures, of a type which apparently gives the pilots very little chance to recover.

    Sounds rather like Russian Roulette. It's perfectly safe - most of the time.

    1. sanmigueelbeer Silver badge
      Thumb Down

      Re: Dubious

      have suffered very similar failures

      The jury is still out as to the cause of the Ethiopian Air crash. They've just recovered the black box and haven't even began to analyze the contents.

      Until then, I'll wait for the final report and form my conclusion.

      1. Anonymous Coward
        Anonymous Coward

        Re: Dubious

        'Beer Na Beer' offered, "...I'll wait for the final report."

        It amuses me that those that would only ever accept any findings that are contained in the 'final report' even bother to visit the forums where it's inherently speculation. So, why are you here?

        There are even those that frequent this and other comment forums and attempt to restrain the speculation, "...because it may lead the investigators astray..." Which is an extremely silly concept.

        There should be a special forum for the Speculation Police. It would be designed especially for them. It would be empty and locked. The only post would be "Final Report goes here ---v". Then nothing.

        1. sanmigueelbeer Silver badge
          FAIL

          Re: Dubious

          It amuses me that those that would only ever accept any findings that are contained in the 'final report' even bother to visit the forums where it's inherently speculation. So, why are you here?

          I am not speculating anything. Exactly what is wrong with "waiting for the final report"? Do tell?

          FAA and NTSB don't even know what the cause of this accident is. The black box was just found <24 hours ago. And it takes, at least, 48 hours to begin retrieving the information from them.

          If you know what the real cause of this accident, tell the FAA and NTSB.

          1. Anonymous Coward
            Anonymous Coward

            Re: Dubious

            The mockery was directed specifically at your posting "I'll wait for the final report" in an internet comment forum where the topic is speculation (informed or otherwise). You post is just as silly as would be random Internet-style speculation at a formal NTSB hearing.

            PS: The FAA has now grounded the fleet. Based on some well-informed speculation I expect.

  21. Mystic Megabyte
    Unhappy

    Sell Boeing?

    Personally I will avoid flying on this type of aircraft for a few years.

  22. Anonymous Coward
    Anonymous Coward

    MCAS automatic trimming system

    In order to accommodate the larger engine Boeing moved it forward of the wing and mounted it with extended nacelles. This had the unintended consequence of causing the plane to pitch nose-up. The solution being to install the MCAS system which forces the plane to pitch-down when it falsely detects a stall situation, such as incorrect readings from the air-speed indicators. Such a configuration is especially dangerous in the take-off phase. MCAS was installed without informing the pilots or giving them the ability to disable it. I think it a flawed model, where the computer can override the pilot.

    1. Yet Another Anonymous coward Silver badge

      Re: MCAS automatic trimming system

      >I think it a flawed model, where the computer can override the pilot.

      Especially ironic given the Boeing attitude to computerised Airbus aircraft

  23. not_my_real_name

    Reading between the lines

    A Boeing technical team will be travelling to the crash site to provide technical assistance (and destruction of evidence) under the direction of the Ethiopia Accident Investigation Bureau and US National Transportation Safety Board.

  24. Alister

    UK CAA now suspended flights of the 737-MAX

    As well as Australia, Asia and Africa.

    Wonder what the American FAA will do now?

    1. Anonymous Coward
      Anonymous Coward

      Re: UK CAA now suspended flights of the 737-MAX

      Wonder what the American FAA will do now?

      FAA is saying that it's safe. I can't help but wonder if the aircraft had been an Airbus rather than a Boeing if they would have been less forgiving?

      1. Richard 12 Silver badge

        Re: UK CAA now suspended flights of the 737-MAX

        If the Ethiopian crash turns out to be in any way related to MCAS (including 'it was turned off', whether intentionally or not), then the EU really needs to tell the FAA they no longer consider them competent to issue airworthiness certificates, and they'll make their own decisions from now on.

        It'll be interesting to see what the FAA say when the results of the investigation are known.

        1. Yet Another Anonymous coward Silver badge

          Re: UK CAA now suspended flights of the 737-MAX

          The independent NTSB was established precisely because the FAA was in charge of both promoting air travel and accident investigation. The early FAA did have a tendency to blame any crash where both wings didn't obviously fall off on 'pilot error'.

          There were some complaints a few years ago that the FAA were taking a 'Boeing aircraft are supporting our boys in Iraq/Afghanistan' and that any criticism of Boeing was tantamount to treason.

      2. Anonymous Coward
        Anonymous Coward

        Re: UK CAA now suspended flights of the 737-MAX

        FAA has now grounded them.

  25. IJD

    The first "mistake" Boeing made was building a safety-critical system into the 737MAX without enough sensor redundancy, because this would have cost more.

    The second "mistake" was not telling airlines/pilots about MCAS because this would have needed pilot retraining which costs the airlines money and puts them off buying the plane, and such a change would have meant re-certification is needed which costs Boeing money.

    "Mistake" in inverted commas because it appears that saving/making Boeing more money was the driving factor in both decisions. Hope they're still happy with that given the resulting body count...

    1. devTrail

      The first "mistake" Boeing made was building a safety-critical system into the 737MAX without enough sensor redundancy,

      I see you pointed out the missing redundancy as well, I didn't see your comment before posting mine.

      "Mistake" in inverted commas because it appears that saving/making Boeing more money was the driving factor in both decisions.

      One or a sequence of mistakes can still be considered mistakes, with or without commas. But I would really like to know what actions did they take after Lion Air crash, because once you are aware of the mistakes the following actions determine how close you get to negligence.

      1. Yet Another Anonymous coward Silver badge

        An interesting series of 'mistakes'

        The MCAS is necessary because the engines had to be moved well forward of the wing - moving center of mass and center of lift apart.

        The engines need to be moved forward to fit larger, quieter and more fuel efficient fans because the 737's wing is too close to the ground to accommodate modern engines. Which is why the engines on other modern 737s have the famous hamster cheek profile.

        The wing is too close to the ground to allow onboard retractable stairs on early models of the 737 so it could service small airports who weren't setup to handle jets.

        Boeing don't want to change any of this because it would mean it was no longer a 737 and so had to recertify to modern standards. By incrementally changing one part at a time they now have an aircraft which shares no parts with the original 737 but flys on its 50year old type approval.

        It's as if VW made the new beetle air-cooled so that it only needed to meet the emissions and safety specs of the original 1930s car.

  26. Anonymous Coward
    Anonymous Coward

    As a traveller in his 5th country in 6 days, and four more in the next 6 days I'm just glad that I don't have a 737 Max 8 in my planned flight schedule......or, to put it another way as a distortion of the old slogan, "If it's Boeing (737-Max 8), I'm not going".

  27. Anonymous Coward
    Anonymous Coward

    And now UK grounds them as well

  28. devTrail

    Missing redundancy

    I always heard that airplanes were safe because of the high level of redundancy in their systems. However everything I read about the Lion Air crash stated that the MCAS was mislead by a single faulty sensor. Am I right? If I'm right how come nobody considered this lack of redundancy a problem serious enough to stop the planes immediately?

    1. Anonymous Coward
      Anonymous Coward

      Re: Missing redundancy

      "how come nobody considered this lack of redundancy a problem serious enough to stop the planes immediately?"

      Remember the golden rule. The US has the best lawmakers and lawyers that money can buy. Redundancy is for engineers (as in, pink slip redundancy for "not being a team player").

    2. ilmari

      Re: Missing redundancy

      The redundancy was in the recovery procedure, same thing as if electric trim gets stuck: pull the circuit breaker and turn the trim wheel manually.

  29. Anonymous Coward
    Anonymous Coward

    I hear the voice cockpit recorder has been read and an early leak of the transcript reads:

    Captain: Set target altitude to 30,000ft

    Flight computer: I'm sorry, Dave. I'm afraid I can't do that.

    After that, it's blank.

  30. TrumpSlurp the Troll

    SWA

    From reading the informed comments it looks as though there is one airline, SWA, which is effectively the Varsity for 737 pilots. They have a large body of experienced pilots who no doubt talk to each other about the job. Who also could cause major problems if they decline to fly a variant they consider unsafe. Not least politically.

    If the airline decides all craft should have the additional instrumentation then this should be a very strong hint to all other operators that this is a required feature.

    It seems realistic also to assume that the word has gone round all the pilots warning them of the issue and to make sure they understand how to cope with it.

    From that it seems reasonable for SWA to continue flying the Max8 because they have effective mitigation for the issue.

    However it seems that most airlines don't have the same level of expertise and experience flying the Max8 and should suspend flights until further training and instrumentation brings them up to the level of SWA.

    The main thing to take away is that Boeing seem to have introduced an undocumented feature which does not warn the pilot when it is deployed. Not a good idea in any software system.

    Naive question: do all modern planes still take off and climb on manual? Seems that once the plane is lined up and ready to roll an autopilot could handle the take off and climb.

    1. A.P. Veening Silver badge

      Re: SWA

      "Seems that once the plane is lined up and ready to roll an autopilot could handle the take off and climb."

      Given modern navigation (like in cars), it shouldn't be too difficult to have the autopilot also handle taxiing and lining up. That would certainly avoid problems with using incorrect connections from the taxiway to the runway, taxiing to the wrong (blocked) runway and taking of from taxiways.

  31. Anonymous Coward
    Anonymous Coward

    And now Canada and the USA too...

    Canada grounded them mid-day ("new info"), and USA followed a couple hours later.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like