Ethiopia sits on 737 Max report but says pilots followed Boeing drills Ethiopia's transport minister has said the national carrier's pilots were following published Boeing procedures immediately before the fatal crash of a 737 Max 8 in March, citing an unpublished government report. During a press conference this morning, transport boss Dagmawit Moges said: "The crew performed all the procedures …
https://www.nytimes.com/2019/04/03/business/boeing-lawsuit-ralph-nader.html
"The family of a woman killed in an Ethiopian Airlines accident last month plans to file a wrongful-death lawsuit against the airline, the aircraft manufacturer and the parts supplier linked to the crash that left 157 people dead.
The woman, Samya Rose Stumo, 24, was a niece of Ralph Nader, the consumer rights advocate and past presidential candidate. Lawyers representing the family said in a statement that they planned to file the suit on Thursday morning in Federal District Court in Chicago.
A number of other families are pursuing litigation against Boeing, Ethiopian Airlines and Rosemount Aerospace, the manufacturer said to be responsible for an aircraft part that may have played a role in the crash.
......"
Rosemount, previously a subsidiary of UTC and/or Goodrich, manufactured the AoA sensor.
I watched the Stumo family conference video earlier today and, assuming the two crashes did occur due to the MCAS failing, it seems a bit harsh for the family to now be suing the airline as they are just as much a victim as those who died as they were duped by Boeing and the FAA into believing the aircraft was safe, even after the first Lion Air crash, and that pilots did not require additional training.
As for Rosemount, unless they guaranteed their sensor was safe to use with no redundancy in a safety critical system then again that's harsh, but maybe just part of the legal process, as it's a bit like Ford selling a car with only 3 wheels instead of 4 (but available as an optional safety extra) and suing Pirelli when the car crashes because it's not driveable on 3 wheels when one has a puncture.
It may be that by suing all parties, whether initially justified or not, will ensure that all the evidence - testing data, internal memos, cover-ups, FAA collusion etc. - required to determine justice for the victims and that further accidents are avoided will be revealed.
Yeah - sounds like one of those USA legal oddities where the defendant can scream "unfair!" if you've not rounded everyone up against the wall. It may also be a bit early to be legally pointing the finger at one party, and the superfluous suits may be dropped if it's proven they acted without fault.
I agree that Ethiopian Airlines don't (at least initially) appear to be to blame here. It sounds like they were [misled / duped / misinformed] by the Boeing.
As for Rosemount, no hardware is perfect. That's why servers, in particular, are built so that breaking hardware components don't normally take down the whole computer. This is no mystery, so I don't see that Rosemount can be expected to shoulder the blame alone. Perhaps the sensor failed woefully early, and there may be an angle there, but anyone experienced in aviation (or critical systems of any kind) should be able to tear down that line of reasoning.
It's still looking like Boeing's can to carry, if you ask me.
As an aside, somebody on the radio this morning was demanding to know why it took two fatal crashes and the deaths of 300 people to reveal what was at fault. Not sure what her point was, as a single crash can be attributed to anything - especially when the crash report for Lion Air isn't ready yet. One crash is an accident. Two in the same way is a problem. The de Havilland Comet took 3 fatal crashes before they grounded the things, and the only reason they didn't kill 300 people in that time is that they could only carry 40-odd passengers.
Really?
Sometimes planes crash.
Sometimes bad maintenance causes it, sometimes mistakes by ground crew, sometimes pilot error, usually pilot error, sometimes a pilot's deliberate actions. One plane crashing is an anomaly, sure, but there were 15 fatal airliner crashes in 2018, two of them on climb-out.
By your criterion, we should have grounded:
* Antonov An-148-100B
* ATR 72-212
* De Havilland Dash-8
* Boeing 737-7
* Cessna Grand Caravan (twice)
* Boeing 737-200
* Let L-410 (twice)
* Convair CV-340
* Junkers Ju-52(!)
* Boeing 737-8
* Boeing 737 MAX 8
* Boeing 757
* Antonov An-26
Well done. You've just stranded most of the world's Boeing 737s, between the -200, -7, -8 and MAX 8. You've stopped a huger percentage of air travel, and put thousands (not even at Boeing) out of work.
Sometimes planes crash, and until you have reasonable certainty, in an impartial and rigorous investigation (not hearsay and rants), you can't just go grounding entire fleets.
Now, if all of the MAX 8 pilots who went off ranting in bars and pilot forums had submitted formal complaints about the aircraft to their appropriate regulatory bodies, then we might have grounds to suspend the model on the first crash. Maybe.
And, to be facetious for a moment, we do do it better now - it "only" took two crashes this time.
, it seems a bit harsh for the family to now be suing the airline as they are just as much a victim as those who died as they were duped by Boeing and the FAA into believing the aircraft was safe, even after the first Lion Air crash, and that pilots did not require additional training.
It is the airline who provided the flight service to the customers who perished. It is the airlines responsibility to provide a safe service to its customers. It is the airlines responsibility to provide a safe aircraft to the customers. The passengers on the aircraft were not customers of Boeing, they didn't buy their tickets from Boeing and Boeing wasn't the provider of the service.
Therefore it is the airline who is responsible. The Airline failed in its duty of care to provide a safe service, a safe aircraft to its customers. Irrespective of the quality of the aircraft provided to the Airline, it is the Airlines responsibility to ensure the aircraft is safe.
However, the airline can then sue Boeing for compensation, the cost of the litigation and any payouts incurred from the customers cases, if the airline can show that it was a faulty aircraft (which is what appears to be the situation) and not due to mistakes made by the airline. As Boeing has a duty of care to provide a safe aircraft to its customer, the Airline..
The "first point of contact" thing seems unfair, but appears to be expected practice, in the UK at least. If my electrical appliance breaks down then I complain to the seller, not the manufacturer, even if it clearly has a manufacturing defect. If I'm in a 3 car pile up then I sue the person behind who crashed into me, not the person who caused the accident by smashing into them. The unfortunate victims of this plane crash effectively had a contract with the airline, not Boeing. It sucks to do it like that, but hopefully, in the end, justice will come to those responsible.
Sadly, as one of (if not the) largest of our MICC, they run the country. They will never be sued out of business. Too big to fail - or to jail more than a few insignifiant scapegoats.
Who would make all those lovely toys for the military?
Break them up? As with Microsoft - "We'll just see who has the power here" - not gonna happen.
Even the partially successful breakup of AT&T (before the government was utterly owned by business) simply gave us Verizon instead - but we lost Bell Labs in the process...
The track record is like that of our regime-change wars....not exactly batting 1000.
I wonder if they put a (pair of) faulty/miscalibrated AOA sensor(s) in the craft when the head cheese was riding along? Or at least simulated the faulty sensor(s)?
It's all well and good to fly with perfect inputs to test the patch, but if the crash scenario had faulty inputs, then you need to feed in faulty inputs to test for proper behavior of the patch.
Otherwise it's a publicity stunt, and nothing more.
>Otherwise it's a publicity stunt, and nothing more.
An unauthorised photographer managed to snap this photo of Boeing chief exec Dennis Muilenberg just before he boarded the 737MAX "cross your fingers and pray" flight.
Wouldn't work. Too low for the chute to open and that's if he could make it the door and actually get the door to open. But, I guess there's a sense of comfort there. Maybe carry a bog roll and a change of underwear would be more mentally comforting?
Disclaimer... yes I know your post needed a "humor" icon.
All they need to have on board are pilots who are fully aware of the system and how to shut it off if it goes faulty. Unfortunately many pilots were unaware of the system. Who's fault is that? Does Boeing provide training or do the individual airlines? There was obviously some detailed documentation on MCAS available as some previous pilots have disabled it.
All they need to have on board are pilots who are fully aware of the system and how to shut it off if it goes faulty.
From what I read of the Ethiopian report, their pilots were made aware of the process via the Boeing memos issued after the Indonesian crash but were, despite this, unable to disengage MCAS. Hence their nosedive.
That raises a lot of questions.
I've read the preliminary report. An executive summary of events from the FDR:
1: Shortly after takeoff, the left AOA sensor changed to an improbable reading, roughly 60° offset from the right AOA sensor, and the stall warnings on the Captain's side activated.
2: When the conditions for MCAS activation were all satisfied a couple of minutes later (flaps retracted, autopilot tripped due to speed sensor disagreements related to the underlying AOA disagreement), MCAS pushed the trim down. This caused a downward flight path deviation sufficient to activate the GPWS.
3: Several trim corrections were issued by the pilots, via the electric trim switches, to partially reverse the MCAS activation. The remainder of the necessary flight path correction was performed by pulling the yokes back. The stab trim remained in a considerably more nose-down position than when the first MCAS activation began.
4: The trim runaway checklist was performed, and consequently the electric trim was cut-out according to Boeing's instructions. A subsequent MCAS activation is recorded in the FDR which had no effect on the trim position, showing that the cut-out switch was effective.
5: The checklist then states that trim must be applied manually, meaning via the trim wheels located either side of the throttle quadrant, and with foresight since turning these wheels by hand is much slower than the electric system. The data shows that the trim position moved gradually more nose-down, not nose-up, even though the yoke position and flight path showed a need for more nose-up trim. It seems to me (not in the report) that the pilots may have inadvertently turned the wheels the wrong way.
6: The aircraft continued with little sustained climb but with the engines still at takeoff thrust; this caused the speed of the aircraft to reach and eventually exceed Vmo, the maximum safe operating speed. During this time both pilots were exerting considerable effort on the yokes, both in turn and together, to keep the nose up.
7: Towards the end of the recording, electric trim inputs and MCAS activations are again seen, this time associated with corresponding movements of the stab trim; this indicates that the cut-out switch was returned to normal. Subsequently, MCAS drove the plane into the ground.
There is much material here for the investigation to get to grips with, and it seems clear to me that the pilots had a path to recovery which was not adequately followed. The root cause, however, is a single faulty AOA sensor causing runaway nose-down trim via MCAS.
"Does Boeing provide training or do the individual airlines?"
The FAA agreed with Boeing that the changes between a 737 MAX 8 and the original 737-800 (first flown in 1997), were so small that no extra pilot training was required. Boeing performed many of the tests for the type certification themselves and the FAA accepted the results. (That link is worth a read for a more in depth look at how the certification process worked in this case)
So, Boeing would provide the training if requested, but they told the airlines that their pilots would not need training on the 737-MAX if they were already qualified on the 737-800, and this was backed up by the FAA.
So to answer your question, it's Boeing's fault for saying that pilots wouldn't need additional training covering MCAS, and the FAA's for believing them.
Well indeed. They didn't think it would happen, so when it did it all went pear shaped. But hey, it's okay now, because with the patch:
"There are no known or envisioned failure conditions where MCAS will provide multiple inputs."
*envisioned* - not *possible*, but *envisioned*. I can see a difference.
You do realize, Airbus has had it's share of negligence suits. For instance the Fairfax incident in Canada, AirAsia Flight 8501, and lets not forget the Paris Air Show... and of course there are others. This doesn't include those which are due to weather or pilot error.
Yes, an airline and/or manufacturer can be sued; however, there is typically a 'ceiling' for the amount of payout per person who was killed. This differs on whether negligence, deliberate act, pilot error, technical fault, willful misconduct, etc. is found as the reason behind the disaster.
This latest crash can be a result of technical fault, act of god (bird strike), and even willful misconduct--in allowing someone with less than 300 total flight hours as a pilot operate a sophisticated aircraft such as the 737, or someone not repairing/reinstalling a flight system and/or aircraft part properly.
And before you damn Boeing too much. Better think about how air travel was changed under this company, and how many innovations were created by Boeing--that even Airbus uses every day and in the Airbus systems. Finally, lets not forget, Boeing is an independent company. It doesn't receive funding from any governments. Boeing must maintain a profit to stay alive. Unlike Airbus, which is supported quite a bit by European tax payers.
In the first crash the sensor appears to have been faulty before take-off so it may just have been faulty, certainly the work was done on it post the previous flight indicates there were issues. In the second crash the sensor became faulty after take-off, which makes it most likely it hit a bird. If you google pictures of bird strikes they don't have to be direct to cause damage that would cause a false reading.
Boeing is kept afloat by the US Department of Defence, so yes they are funded by the taxpayer.
Regardless of past innovations, Boeing installed a more-or-less secret safety critical system that had no redundancy unless airlines paid extra for the redundancy which is essentially selling "safety as an optional extra", an utterly disgraceful approach but is exactly what Boeing did on this occasion, not to mention the concealment of the MCAS system which was done to increase sales of aircraft as pilots - according to Boeing - wouldn't then require expensive additional training/re-training on a new airframe.
Boeing have criminally trashed their hard-won safety reputation for the sake of a few dollars and a few sales. The victims of both air crashes have paid the price. MCAS should be ripped out of all 737 MAX8 aircraft as I'm not sure I would ever want to fly on a 737 MAX8 with a patched MCAS - that's too little, far too late.
With MCAS & working sensors it flys ok.
With Patched MCAS & working sensors it flys ok.
Without MCAS the plane will attempt backflips with very little warning.
With Broken sensors MCAS will pile the plane into the ground nose first.
With Patched MCAS software & broken sensors - we don't know yet - who'd volunteer to fly it?
If just one sensor is broken, MCAS won't activate because they'll differ by more than 5.5 degrees. If both are broken who knows, but that seems unlikely assuming someone noticed the "disagree" light on the previous flight and told maintenance so they can fix the one that's broken.
I wouldn't have a problem flying in a Max 8 after the fix. Given all the publicity every single pilot flying one will be fully aware of MCAS, what it does, and how to disable it if there are problems. If Boeing and/or regulators had required pilots were fully trained about MCAS, the two crashes wouldn't have happened.
If Boeing and/or regulators had required pilots were fully trained about MCAS, the two crashes wouldn't have happened.
As I said elsewhere, current reports indicated the pilots of the SECOND crashed plane (Ethiopian) WERE aware. For a start, it's sheer self preservation (IMHO always the best possible motivator), and secondly, Boeing sent bulletins to 737 MAX operators.
The problem: apparently they were unable to disengage MCAS regardless.
That said, I do agree with you that post incident there is a period of peak alertness which makes things safer, at least for a while.
Once the insurance people have gone and the lawsuits have finished, the accountants will move back in to massage new bonuses. After all, from now on, the stock price can only go up..
Without MCAS the plane will attempt backflips with very little warning.
I'm in full agreement that Boeing screwed the pooch quite badly on this one, but the quote above is a bit unfair. While the MAX has some handling issues at high AOA that prevent it from passing certification, it's hardly a bucking bronco. Even without MCAS, recovery from approach-to-stall and actual stall are still quite feasible. And the high-AOA circumstances that necessitate MCAS aren't something that should occur during normal flight operations, anyway. Basically if you get to the point that you need MCAS, you're probably already doing something wrong.
This is the irony - it's very likely that without MCAS the MAX would've been a lot safer. But the cert requirement says that the stick force vs. AOA curve can never go negative, even if that is something pilots could probably handle, and so in trying to patch that minor safety issue, Boeing created a giant safety issue. Unforeseen consequences.
"Boeing installed a more-or-less secret safety critical system that had no redundancy unless airlines paid extra"
There was and still is no redundancy offered. There are just 2 AoA sensors and the MCAS alternated which one it used per flight. An AoA disagree warning light was a $80k extra. From the published reports the pilots followed the same procedure to disable MCAS they would have if they had the disagree warning light. Looks like there was no way to stop MCAS deliberately killing all onboard .
"MCAS should be ripped out of all 737 MAX8 aircraft as I'm not sure I would ever want to fly on a 737 MAX8 with a patched MCAS - that's too little, far too late."
MCAS is integral to the 737 MAX as it counteracts the tendency for the nose to rise due to extra lift from the new position of the engines. No MCAS no 737 MAX, MCAS name may be erased but the feature will still remain as the plane is not airworthy otherwise. There are lots of automated systems on aircraft we (passengers & pilots alike) take for granted examples are auto brakes, abs, auto thrust ratios (take off is rarely full chat unless the thrust leavers are fully at/past the stops).
MCAS cant be ripped out. Boeing reused the certified 737 airframe with upgraded engines. The upgraded engines have changed the aerodynamics thus needing MCAS to fly.
Realistically boeing needs a new plane with the new engines but certification is expensive. Cheaper to retrofit and it seems the innocent passengers have paid with their lives for the cheap retrofit.
AirAsia Flight 8501 was caused by the pilot trying to do something only an engineer should do while the aircraft is on the ground.
I can't figure out what the 'Fairfax incident in Canada' is as there's no obvious link to an Airbus crash.
I think the air show incident you're referring to was actually at Mulhouse–Habsheim and was due to the flight control system preventing the pilot stalling the aircraft, mainly because it thought that if you configure the aircraft to land that's what you want to do. Especially if you make your flypast at 30' not the 100' that had been briefed.
None of these are directly attributable to negligence on the part of Airbus, not that I'm denying that there may have been, or could be accidents due to negligence on their part. It's just your examples don't demonstrate that.
It's perfectly acceptable to have someone with less than 300 hours as the co-pilot on the 737. Ultimately if they've got 1000 hours experience on a Cessna and 150 on a 737 they're unlikely to be any better at handling the situation.
What could be construed as negligence is designing a flight critical piece of software that only uses one sensor and doesn't do a sanity check on the input. It appears in this instance the AoA sensor was reporting ~70 degrees nose up, if you've managed that at 250+ knots in an airliner stalling is the least of your problems.
it thought that if you configure the aircraft to land that's what you want to do
Except that a "go around" is something that happens every day. Pilots need to abort a landing, so they hit full throttles, pitch up, and rightly expect the plane to go up.
I read about the air show case. The pilot's complaint was that the plane simply did not respond as quickly as it should have; that something was wrong. And the investigation had some abnormalities, and as with Boeing and the FAA today, there were commercial and government interests back then that were very reluctant to see Airbus blamed. I don't know for sure where the truth lies, but it wasn't such a clean story.
@Aodhhan
Did you manage to keep a straight face while entering your last paragraph?
You must have missed the March 28, 2019 statement from the World Trade Organization saying that the US government has failed to halt a state tax subsidy for Boeing.
Between 2000 and 2014 Boeing received $13B in state and local subsidies. Boeing has received federal grants, which are generally non-repayable, federal loans and loan guarantees to the approximate tune of $64B.
NASA and DOD subsidies for Boeing R&D are estimated at least at $22B. Boeing uses DOD centres and test facilities to work on civil planes. IOW R&D for Boeing civil planes is paid for by military budgets, not by Boeing. The Department of Commerce and the Department of Labor also pitch in.
And before you damn Boeing too much. Better think about how air travel was changed under this company, and how many innovations were created by Boeing
I've had to deal with a lot of stupid shit this week, but this ranks well up there. Sorry, Aodhhan, but this ranks up there with "before you go bad-mouthing Pol Pot, think of all the good he did for the environment by promoting organic farming".
The bottom line here is that 300 people paid (indirectly) Boeing to be carried safely to their destination. Boeing have a duty of care to ensure that their aircraft are safe. It's looking increasingly likely that Boeing failed in this. It's looking increasingly likely that Boeing failed in a way that's spectacularly reckless, even to observers outside the aircraft industry.
(Yes, the 747 changed the world. No, Boeing had no real love for it until the 2707 was canned. Yes, it flew stably without having to be constantly trimmed by computer.)
AC offered, "That's why Airbus use the input from 3 AOA sensors on their systems..."
Google Flight QF72 (an Airbus) which went "psycho" even with triple-redundant AoA sensors.
Wiki conveniently links to the Final Report, and then see footnote 28.
Bad design can trump even triple redundancy.
"There's some speculation that a bird strike may have damaged the AoA sensor, which could have led to the crash."
Is it just me or does this 'stunning' piece of journalism seem to be very 'convenient' for Boeing !!!
A nice 'act of god' to divert away from the 'crap work-around aka MCAS' to allow the 737 Max to be pushed out the door as quick as possible with the 'no need for any further training' sales pitch to encourage all the existing customers to buy Boeing rather than go for Airbus !!!
Boeing really do deserve to be hit hard in the courts for all the lives lost due to their greed.
I particularly like the very professional way the Ethiopian authorities are reporting the information from the investigation, giving Boeing and/or the FAA no excuses to use against them.
I hope the results are not used to have legal proceedings run for the next 5-10 years, all the families of the dead from both flights need all the help they can get ASAP.
Boeing should own up to a mistake and take the punishment due.
(I know .... American company so not very likely ... but they might get some kudos for *not* playing the 'I've got a building full of lawyers on standby & I am going to use them *all*' gameplan.)
"Is it just me or does this 'stunning' piece of journalism seem to be very 'convenient' for Boeing !!!"
I'd think that it'd be very damning for Boeing. I mean, if something as tiny as a bird, which shares, at least, some of the airspace with an aircraft, can cause the loss of the craft, with all of the crew and passengers, in my opinion, that would be a very faulty design. (Ok, so I might give them a pass if the sensor were damaged by a fish, because reasonably competent aeronautical engineers shouldn't have to consider the possibility of encountering a fish during normal flight. But, well, birds are a completely different item.).
And, as to the fact that airplanes share the same airspace with birds, I can't really consider it an "Act of God".
So, in my humble opinion, the entire design was crap, and the families deserve to be promptly and adequately compensated for the loss of their loved ones.
[From original AC]
Apparently, Boeing have admitted liability ???
If true then some small kudos for not thowing lawyers at it first.
It is a sorry mess for Boeing but maybe the families can count first, for once, get some closure and real assistance now. (Compensation helps *but* does not replace people.)
Also read in NYT that Ralph Nader is starting proceedings to sue on behalf of his Family, as grandniece was on Ethiopian flight. So the legal consequences start now!!!
There's some speculation that a bird strike may have damaged the AoA sensor
Unlike the case of Lion Air, Ethiopia did not release (to the public) the FDR readings. So no one really knows what happened.
Lion Air didn't need to release the "official" report because everyone could see the AoA went opposite direction the minute the plane left the tarmac.
Next, if the AoA sensor for Ethiopia Air was faulty, surely, Ethiopia Air would've mentioned this in the press. Maybe someone could've "leaked" the maintenance record, perhaps.
Not sure if the official Ethiopia Air incident is being held back because there could be something that may cause further embarrassment to either the FAA &/or Boeing or a lawsuit-waiting-to-happen.
Personally, I'd prefer the FAA to re-certify Boeing MAX family as a brand new model and not just a "modification" of an existing model.
NOTE: And I also have no idea, recently, why my posts have been deemed as "Submitted and awaiting moderation".
As I understand it, Boeing's original procedure for MCAS failure was to treat it like trim runaway. So you cut power to the stabiliser trim motor from the control panel - and then you have to fall back to trimming the aircraft with the manual trim wheels. Which is a bugger if MCAS has managed to get the thing all the way to the stops, as it takes quite a lot of turns of the wheel to get you back to a sensible trim level.
The Telegraph report on this press conference implied the pilots re-enabled power - either because they thought they were rebooting the system, or to get electric power back to their trim switches on the control yokes (which are way quicker than spinning the manual trim wheels). The Guardian and Reg pieces just said they "followed procedures".
I guess this confusion is what comes of speculation before we've got the data.
The procedure is to set appropriate trim using the yoke switches before cutting power to the stab trim motors. In the Ethiopian flight they sort of poked the switch a bit and left the plane with significant nose down trim when they pulled the plug. This left them to struggle with pulling the elevators up. Eventually they got tire and then they reconnected the motors. They again gave the trim switch a jab, but not enough to eliminate yoke forces and then waited for the MCAS to give another nose-down increment. All the while the plane was accelerating due to maintaining take-off power. http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-800MAX+%2C%28ET-AVJ%29.pdf/4c65422d-5e4f-4689-9c58-d7af1ee17f3e It seemed like they had never flown with manual trim and did not know what it was supposed to do.
Your interpretation is flawed, and, I feel, aimed at discrediting the pilots.
Despite all the conflicting wanings they were getting, and the stick-shaker operating, they managed to correctly identify the problem as runaway stab trim, and followed the correct procedure to correct it, a procedure which includes the instruction to re-enable the electric trim to try and recover the aircraft in the event that the manual trim is unsuccessful. It appears that they didn't fully appreciate that the MCAS would dump a load more AND on them when they did that.
If they are struggling to get the aircraft into a climb, pulling back on the throttles would not be any pilots' first thought.
Geezuz H.
The design and procedures should allow cutting off the MCAS while maintaining power to the manual trim switches. As well as providing also providing another kill switch to cut power to the trim motor. i.e both, individually.
One would have to be a half-wit to design a system where the first step also disabled the trim switches and motor.
One would have to be a half-wit to design a system where the first step also disabled the trim switches and motor.
... and there you have, in a nutshell, Boeing's root problem. I've had comments from people that fly for a living that the Boeing design team cannot possibly have consulted a pilot in the process because he/she would have flagged that immediately as a Very Bad Idea.
1 FACTUAL INFORMATION
1.1 HISTORY OF FLIGHT
On March 10, 2019, at about 05:44 UTC (All times listed is Universal Coordinated Time (UTC), as recorded on the FDR.), Ethiopian Airlines flight 302, a Boeing 737-8 (MAX), Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport (HAAB), Ethiopia. The flight was a regularly scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International Airport (HKJK), Nairobi, Kenya. There were 157 passengers and crew on board. All were fatally injured, and the Aircraft was destroyed.
The following is based on the preliminary analysis of the DFDR, CVR and ATC communications. As the investigation continues, revisions and changes may occur before the final report is published.
At 05:37:34, ATC issued take off clearance to ET-302 and to contact radar on 119.7 MHz.
Takeoff roll began from runway 07R at a field elevation of 2333.5 m at approximately 05:38, with a flap setting of 5 degrees and a stabilizer setting of 5.6 units. The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1, which matched the N1 Reference recorded on the DFDR. From this point for most of the flight, the N1 Reference remained about 94% and the throttles did not move. The N1 target indicated non data pattern 220 seconds before the end of recording. According to the CVR data and the control column forces recorded in DFDR, captain was the pilot flying.
At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°. At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.
At 05:38:43 and about 50 ft radio altitude, the flight director roll mode changed to LNAV.
At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.
At 05:38:58 and about 400 ft radio altitude, the flight director pitch mode changed to VNAV SPEED and Captain called out “Command” (standard call out for autopilot engagement) and an autopilot warning is recorded.
At 05:39:00, Captain called out “Command”.
At 05:39:01 and about 630 ft radio altitude, a second autopilot warning is recorded.
At 05:39:06, the Captain advised the First-Officer to contact radar and First Officer reported SHALA 2A departure crossing 8400 ft and climbing FL 320.
Between liftoff and 1000 ft above ground level (AGL), the pitch trim position moved between 4.9 and 5.9 units in response to manual electric trim inputs. At 1000 ft AGL, the pitch trim position was at 5.6 units.
At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted and the pitch trim position decreased to 4.6 units.
Six seconds after the autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes. These oscillations continued also after the autopilot was disengaged.
At 05:39:29, radar controller identified ET-302 and instructed to climb FL 340 and when able right turns direct to RUDOL and the First-Officer acknowledged.
At 05:39:42, Level Change mode was engaged. The selected altitude was 32000 ft. Shortly after the mode change, the selected airspeed was set to 238 kt.
At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.
At 05:39:50, the selected heading started to change from 072 to 197 degrees and at the same time the Captain asked the First-Officer to request to maintain runway heading.
At 05:39:55, Autopilot disengaged,
At 05:39:57, the Captain advised again the First-Officer to request to maintain runway heading and that they are having flight control problems.
At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested and the aircraft descended slightly.
At 05:40:03 Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.
At 05:40:05, the First-Officer reported to ATC that they were unable to maintain SHALA 1A and requested runway heading which was approved by ATC.
At 05:40:06, left and right flap position reached a recorded value of 0.019 degrees which remained until the end of the recording.
The column moved aft and a positive climb was re-established during the automatic AND motion.
At 05:40:12, approximately three seconds after AND stabilizer motion ends, electric trim (from pilot activated switches on the yoke) in the Aircraft nose up (ANU) direction is recorded on the DFDR and the stabilizer moved in the ANU direction to 2.4 units. The Aircraft pitch attitude remained about the same as the back pressure on the column increased.
At 05:40:20, approximately five seconds after the end of the ANU stabilizer motion, a second instance of automatic AND stabilizer trim occurred and the stabilizer moved down and reached 0.4 units.
From 05:40:23 to 05:40:31, three Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.
At 05:40:27, the Captain advised the First-Officer to trim up with him.
At 05:40:28 Manual electric trim in the ANU direction was recorded and the stabilizer reversed moving in the ANU direction and then the trim reached 2.3 units.
At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out.
At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position
At 05:40:44, the Captain called out three times “Pull-up” and the First-Officer acknowledged.
At 05:40:50, the Captain instructed the First Officer to advise ATC that they would like to maintain 14,000 ft and they have flight control problem.
At 05:40:56, the First-Officer requested ATC to maintain 14,000 ft and reported that they are having flight control problem. ATC approved.
From 05:40:42 to 05:43:11 (about two and a half minutes), the stabilizer position gradually moved in the AND direction from 2.3 units to 2.1 units. During this time, aft force was applied to the control columns which remained aft of neutral position. The left indicated airspeed increased from approximately 305 kt to approximately 340 kt (VMO). The right indicated airspeed was approximately 20-25 kt higher than the left.
The data indicates that aft force was applied to both columns simultaneously several times throughout the remainder of the recording.
At 05:41:20, the right overspeed clacker was recorded on CVR. It remained active until the end of the recording.
At 05:41:21, the selected altitude was changed from 32000 ft to 14000 ft.
At 05:41:30, the Captain requested the First-Officer to pitch up with him and the First-Officer acknowledged.
At 05:41:32, the left overspeed warning activated and was active intermittently until the end of the recording.
At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.
At 05:42:10, the Captain asked and the First-Officer requested radar control a vector to return and ATC approved.
At 05:42:30, ATC instructed ET-302 to turn right heading 260 degrees and the First-Officer acknowledged.
At 05:42:43, the selected heading was changed to 262 degrees.
At 05:42:51, the First-Officer mentioned Master Caution Anti-Ice. The Master Caution is recorded on DFDR.
At 05:42:54, both pilots called out “left alpha vane”.
At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.
At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.
At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.
The left Indicated Airspeed increased, eventually reaching approximately 458 kts and the right Indicated Airspeed reached 500 kts at the end of the recording. The last recorded pressure altitude was 5,419 ft on the left and 8,399 ft on the right.
Airspeed is corrected by a function of the angle of attack in the 737. This is due to the position of the pitot tube causing variations in speed readings as the airflow changes. So a misreading AoA sensor will affect that side's speed indication. Not sure about altitude as that's off the static pressure sensor so shouldn't need correction if it's sensibly positioned.
Consequently when an AoA sensor is faulty you get lots of conflicting information to deal with, and MCAS trying to kill you.
So the last act was to return power to trim so they had motorised control, and they had 9 seconds of stability, enough to think they had regained control. But, because MCAS still had a control ability as well, after those 9 seconds trim went from 2.3 to 1.0 in the span of 5 seconds - basically it flipped trim into disaster within the time it took someone to realise it was doing this and kill power, and it kept it that way.
Jezus Christ in a bucket. They didn't stand a chance :(
I read elsewhere (Flight Global or the BBC?) that Boeing do not accept that MCAS was the cause of the crashes. They appear to think that the planes will be flying again as soon as the FAA rubber-stamps this patch. I have a feeling that until both crash investigations are completed, both reports are in, and all their recommendations have been implemented and directly FAA certified, those planes are going nowhere. Safety may or may not have been "our" priority for some of us yesterday, but it sure is today. I'm looking at the FAA here.
I read too that Boeing's response to all this will be critical to its credibility as a future supplier to the industry. If I may say so, they still seem a little slow off the mark, I feel that they should not be hedging "we admit nothing" until the light goes on, but would be better advised to announce: a massive apology for mismanaging the whole thing, the creation of a compensation fund (if only "just in case"), the pain they are budgeting in their bottom line, and the internal investigation they intend to feed to the US criminal justice system.
It's a bit difficult. We've only had the preliminary report on the Lion Air crash, and a really, really early report on the Ethiopia one - where the press conference has not been clear.
I suspect the Lion Air report was enough to tell them there was a design flaw in MCAS - in that it appeared able to do stuff that their certification documents say it shouldn't. But whether that report gives all the information is another question. And we're still at an incredibly early stage for the Ethiopia report - although as Boeing will be helping the enquiries, they should be getting data faster than the press do.
So while I personally think they've fucked this up - they may still not know exactly how. My personal suspicion is that it was the test flying requiring MCAS to be given more control authority, but nobody sat down and fundamentally looked at how the system should now work - as it had been beefed up and was therefore a higher risk to the aircraft and needed a full re-design. But there are other possibilities.
Oddly, had MCAS been given less authority it's action would be even less noticeable, allowing the error to accumulate over a longer period of time instead of basically giving a yank on the controls. Because the condition MCAS was responding to was unaffected by MCAS the input error continuously called for a trim change and so it would just extend the time before the pilots were overtaken. As it was, in the Lion Air, the PIC essentially countered every MCAS input, sometimes during it. It looked like he would have done that all day. When he turned it to the SIC, they just gave quick, ineffective blips on the switch even as the controls rapidly got heavier, and it was all over in 30 seconds. With the original rating that might have extended a full 2 minutes with a boiled-frog component.
It is not a bit difficult, not at all. Boeing already knew enough about the LionAir investigation and the stream of pilot complaints from elsewhere to develop a safety patch which fixed three different software bugs, to make standard a fault indicator previously treated as optional, and to explain more to the pilots. They got that far, but did they ground the planes as a precaution until the fixes were installed, like you normally would? Did they fuck!
I predict this won't end well.
Especially if the pilots aren't trained on the system in the simulator (they weren't for MCAS).
Especially if the planes are carrying passengers again before 3 months of rigorous testing in multiple aircraft has been performed..
And especially if a pilot with experience of the old malfunction gets insufficient training on a flight sim and/or preflight briefing before meeting the patched system in the air.
Like, moments after takeoff, "Help! MCAS has just kicked in. What do I do next? Which MCAS is it, my brain's panicking I can't remember, the plane is nosediving, WHAT DO I DO?!!??"
Anyway, it's far different being flown by test pilots on an empty 737 thoroughly checked by Boeing itself before the flight, than being flown by normal pilots on a loaded plane sustaining the common duty circles and scheduled maintenance....
Yeah. I don't think anyone is saying the aircraft are not safe to fly. Or that pilots cannot manage a failure in AOA sensors, or MCAS or whatever.
More that Boeing did a naughty and hid a lot of the "problems" behind technobabble, and marketing. Suggesting the aircraft handled the same, and trying their hardest for no one to figure out it had MCAS (as that IS an indication the handling is different), as this would require costly or lengthy certification or training!
No doubt with the training or change to the software (so MCAS is not hiding, but prominent), the craft fly fine... though arguably are still a bodge of a design.
I'm not yet sure if the plane is safe to fly? MCAS is there because if you pull back on the stick and hold it at a certain angle the plane won't always maintain the expected continuous climb, but might go into an increasingly steep climb - then stall. That's caused by the engine cowlings generating increasing lift as the angle-of-attack increases.
As I understand it, that's enough for the plane to fail to get certified as airworthy. However I've not read how serious it is - or how easy to recover from once the process starts.
Hence MCAS.
On the other hand, MCAS was only certified to have authority for a 0.6° total trim adjustment to the stabiliser. Making it only a moderate safety risk, and allowing it to get away with only having one sensor. Which is minor, and suggests MCAS isn't that important, it's just there to make the plane tick the boxes.
On the gripping hand, according to the Seattle Times, Boeing allowed MCAS to exceed that authority after flight testing. Now it has authority for 2.5° of trim change - 4 times what it says in the certification documents! That would move it up the safety critcal list, and mean it might have needed more work, or more sensors. So does that just mean MCAS didn't work as expected during testing, or that they found it needed to be much beefier, because the plane wasn't safe without it, or something else?
Separately there appears to be a bug in the MCAS design. As it doesn't limit itself even to 2.5° - it just keeps on adjusting trim every ten seconds, if the sensor is faulty.
Basically it's flaws all the way down. Which leads me to suspect that with trust in Boeing at a low ebb, this is going to take at least 6 months to sort. And European regulators have far less incentive to rush to re-certify, as Boeing compete with Airbus, and most of the European airlines who ordered the new 737s haven't taken delivery yet.
Well it certainly seems that this time, pilot error is NOT going to be an excuse.
And I will never change my mind about one thing : one single sensor. In a world where we know that information is what lives depend on, Boeing only used ONE effing sensor.
There is no patch for stupidity.
A combination of training and take-off procedures. For the MCAS to kick in, that angle of attack needs to be higher than "normal" assuming the MCAS is functioning properly. Given the flight hours and training the pilots had on both flights, could be a clue and/or just a coincidence. There's unanswered questions question regarding the AoA on climb out.
Disclaimer: I have no affiliation with Boeing.
-- but what I remember from my days working in industrial automation, you always must assume a sensor can malfunction. You always program alternate control algorithms to deal with that. You always, always allow operator override (manual control) in a simple, understandable way. And for critical systems: three sensors (so two good ones can outvote a bad one). Preferably belt-and-suspenders in the sense that at least one sensor should be designed along different principles that others.
Where there is the possibility of control windup (ie, trim adjust going to full-stop) then you provide some form of "reset to neutral" function. Again, the implementation must be simple and understandable to the operator. Pilot in this case. (Mechanical windup is what one poster described; integrator windup in PID control is a very similar and common problem in industrial control.)
I don't think Boeing engineers are stupid, unaware of control design principles, or fail to take their responsibility seriously. (Although I have seen some pretty stupid control engineering strategies come from design firms in my time...)
I would love to read an account from someone deeply involved in designing the algorithms for the 737 Max. What decision-making shaped the process? Who made critical decisions -- like the single-sensor, no belt-and-suspenders design? Hmmm?
I don't think Boeing engineers are stupid, unaware of control design principles, or fail to take their responsibility seriously
Sadly you may be thinking of an earlier, pre-offshoring Boeing. I have it on very good authority that this kind of thing is contracted out to other firms, and those other firms employ certain "engineer mill" (for lack of a better term) offshore companies to provide the bare minimum human intelligence / training / on-paper credentials required to pass the regulator audits and automated test suites.
The reject rate is high (i.e. high incidence of what is effectively an engineering student in real qualifications messing up a system badly enough to fail the defined tests), but the mill provides replacement employees whenever one doesn't work out. Really scary stuff; profit seeking has basically made the regulator-approved test definitions and test execution the only reason we don't have more planes falling out of the sky.
> The chairman of Boeing acknowledged Thursday for the first time that its new maneuvering system was responsible for two recent plane crashes that killed almost 350 people and apologized to the families and friends of the victims.
That's a good start. Now for the FAA to admit to it's role in this disaster, and then the healing can begin for the industry and families, with jail time for those guilty of corporate manslaughter.
There is some very worrying information in this article from the New Yorker magazine:
https://www.newyorker.com/news/our-columnists/how-did-the-faa-allow-the-boeing-737-max-to-fly
which suggests that the FAA contracted the whole certification process for MCAS to Boeing itself. There are surely some tough questions to be answered, and both Boeing and the FAA have some explaining to do - probably in court.
It is actually standard practice to allow self-certification of computerized flight systems to the manufacturer, on the grounds that the manufacturer has shown themself over time to be a trusted supplier and has too much to lose by being unprofessional. The certification process itself is still subject to the same rules and procedures, and there is evidence that the number of mistakes in the process differs insignificantly between public authority and private manufacturer.
But I agree, I think the FAA gave Boeing too much rope. They should have woken up and smelled the coffee a lot sooner - like, as soon as those pilot complaints started coming in, never mind after the smell round the LionAir crash was first identified.
“repetitive uncommanded aircraft nose down conditions“
That phrase being pseudo technical waffle for the computer is overriding the pilot. The solution being to put the pilot back in control of the aircraft and use audio-visual-tactile signals from the computer to the pilot when the plane moves out of its safe operating envelope. I suspect that the current model was chosen so as to put minimally trained pilots on the flight-deck. The downside being such as the Ethiopian crash when the computer gets confused.
“If the jet is under manual control .. and the angle-of-attack is increasing, MCAS automatically adds nose-down trim in 10-second bursts.“
Then by any logical criteria: the jet is still under computer control!
uncommanded aircraft nose down
You see this kind of writing a lot in investigations. It's the same language used if an elevator falls off or a hydraulic line fails and the airplane becomes partly (or wholly) uncontrollable, yet since it's "just" a computer we seem to be treating it as a lesser fault.
If this was the tailplane falling off these planes wouldn't even be in the air a year from now. MCAS had better be proven that it cannot ever provide an "uncommanded nose down" or the aircraft should not be recertified. Heck I don't think it should be certified anyway, considering the engine design results in "uncommanded aircraft nose up" within the normal operating envelope!
the whole point of MCAS was that it autonomously amended the nose down angle in order to mask the nose up tendency of the aircraft due to the new positions and angles of the engines.
its whole reason for being was to do auto trim which was not commanded.
@JeffyPoooh: That's a possible start from an engineering point of view.
But as the safety of those on board a commercial airliner would then become dependent on this previously unknown message, the new system not only needs to be properly tested, it also then needs to be documented in the standard operations documents for flight crew on the 737 Max, maintenance staff, etc. Which means it then needs to be part of MAX-specific retraining for flight crew, maintenance staff, etc.
That all costs time and money, for Boeing and Boeing's customers, and the net result of those additional costs (arguably the costs of being 'honest') is that the 737 Max becomes unsaleable. Which it probably was anyway in reality, because of the mechanical changes, not just the need for MCAS and the subsequent MCAS failures.
From a post almost four weeks ago:
"the reality is the 737MAX is unsaleable without a trustworthy MCAS - it would either need aircraft recertification or crew retraining or both, in which case... no sale.
More info than I can be bothered summarising:
https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/"
The reporting on this has been confusing.
Initially it was reported that the pilot could not counteract malfunctioning MCAS.
When I posted about how absurd/negligent that appeared, I was downvoted to hell because apparently MCAS can be disabled by flipping a switch.
Boeing now says new MCAS it will ensure the pilot can always overrule MCAS using stick alone. So clearly there was room for improvement. But all the same...
Now this report says that the crew "tried to undo [MCAS trim] changes [33 times]." And that they were fully trained on the type. So what went wrong? I agree that in the scenario of flying a complex aircraft like the 737 MAX 8, there is the potential for information overload, and with the lack of positive warning of sensor/MCAS malfunction, it might take some effort to gain full situational awareness concerning aircraft flight systems.
But if the crew positively observed uncommanded trim changes on 33 separate occasions--how many possible causes could there be? How long was the checklist that would have identified possible AoA/MCAS failure, leading to disengaging MCAS? In the event of multiple uncommanded inputs for an unknown reason, would it not be recommended practice in general to disable non flight-critical automated control systems and regain manual control of the aircraft? Would not multiple uncommanded trim changes clue in the crew pretty much immediately? How many other systems are able to input trim changes in that way?
Certainly 7 minutes is not much time to figure all that out. But nonetheless, the whole scenario remains puzzling to me.
The crew were presented with all sorts of conflicting warnings, including airspeed warnings, the stick-shaker-stall warning, an Anti-Ice warning and so on.
They did identify, amongst all that, that they were in a runaway stab trim situation, and did disable the electronic trim (and MCAS).
However, disabling the trim does not return it to normal, it just stops any further automatic trim inputs from moving the stabiliser, and the only way to get the aircraft back into trim is to use the manual trim wheels, which are much lower geared than the electronic version.
Additionally, the aerodynamic forces on the stabiliser at the speed the aircraft was travelling appear to have made the manual trim almost impossible to move. Given that the crew were already having to pull back on the yokes with considerable force to counteract the nose-down attitude, they were unable to correct the trim manually.
It appears that they may have then re-enabled the electronic trim to try and use the yoke-mounted trim buttons, but then MCAS kicked in and added further nose-down trim, sealing their fate.
An addendum to the above.
On Pprune, figures have been posted regarding the manual trim wheels:
it takes 250 full revolutions of the trim wheel to go from full nose-down to full nose-up deflection of the stabiliser, so to correct the MCAS trim input, a maximum of 125 full revolutions would be required. The wheel is not free spinning, so to make one full revolution requires two or possibly three hand movements by the pilots.
So, if we say that to make a single full revolution of the trim wheel requires 2 seconds, then to adjust to neutral trim from full nose-down deflection would take 3 minutes of constant winding, whilst at the same time trying to keep full back pressure on the yoke.
In all the reporting to date, I don't remember seeing any mention of who designs+builds+tests+supplies the flight computer system in the aircraft in question.
Being as Boeing in recent years are primarily a brand management and final assembly outfit, I can't imagine that they build their own flight control systems in house.
[NB: whoever provides them, ultimately Boeing are responsible for their fitness for purpose and for their regulatory compliance]
So who does provide the relevant flight control computer systems in the MCAS picture? Subsidiaries of GE or UTC or Goodrich or similar would be an obvious starting point, but apparently BAe Systems also have some flight surface control systems electronics on the 737 Max, according to the 737 entry at
http://www.airframer.com/aircraft_detail.html?model=B737
Combining it with the BAe Systems Platform Solutions entry at
http://www.airframer.com/direct_detail.html?company=119283
suggests that BAe subsidiary provides:
"Cabin Management Systems: Touch screen attendant control panel; Full Authority Digital Controls: FADEC for the LEAP-1B engine (737 MAX); Onboard Computers: Mission computer systems (P-8A); Automatic Flight Control Systems: Spoiler control electronics (737 MAX) "
Improvements and/or definitive sources welcome (especially bearing in mind that Spoilers aren't Stabilizers).
You are correct that Boeing does not design the flight control computers (and there are a lot of different ones in modern aircraft).
What Boeing does define are the control laws that any flight control computer must implement which is derived from the aerodynamics of the aircraft and something that Boeing alone is responsible for.
BAE Systems (the E has not been lower case for over a dozen years) does design and manufacture flight control computers, but whether they designed and manufactured MCAS part of the flight control system is unclear.
Any design activity for the 737 MAX would have been in the USA; BAE Systems does design such systems in the UK, but not for this programme. Disclaimer: I worked at that UK site until fairly recently.
It appears they do make the spoiler control electronics. These programmes are often joint ventures between the electronics / control system designers and the actuator manufacturer so just what name is on the box will not necessarily make everything clear.
"Any design activity for the 737 MAX would have been in the USA"
Or passed through the Boeing commercial division from another contractor. You would have little way of knowing.
In the midst of the 787 battery fiasco, some of Boeing's engineering representatives were questioned about details of the charging system. "We'll get back to you on that." was a response designed to buy time while they got an engineering firm, possibly half way around the world, out of bed and on the phone for an answer.
When I left the company, the support a software system I was responsible for was contracted with a firm in India. That firm located my name in some source code comments and subcontracted with me for consulting services. When answers were needed in Seattle, a significant communications effort ensued, checking time zones and contacting someone to get answers. Similar antics ensued trying to reach me. I imagine a few eyes would have been raised in the Boeing boardroom had they known that the answer they were waiting for came from 10 miles down the road.
https://slate.com/technology/2019/03/ethiopian-air-crash-where-did-boeing-go-wrong-with-the-737-max.html
According to the article included, the reason they added the "force the nose down" hack was because when they retrofitted the 737 with new engines to make it more efficient (creating the 737 Max), they introduced a dangerous tendency to pitch up and stall. No plane should be so unstable as to require such a countermeasure.
This whole saga proves that automation of flight should only be done in support of 2 highly trained, well rested and financially rewarded human pilots. The relentless imperative to save money and automate absolutely everything must end, it’s utter madness. Same with airlines cutting corners on their human pilots.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
