The Case Against Boeing

https://www.newyorker.com/magazine/2019/11/18/the-case-against-boeing

by axiomdata316 • 7 years ago

107 151 7 years ago

It's true that if the MCAS software requirements weren't inadequate, the accidents would not have happened. It's also true that if the pilots had followed the runaway trim procedure, like the first Lion Air pilots did, like was reiterated to all MAX crews by Airworthiness Directive, the accidents would not have happened.

But I don't see why the shortcomings in the MCAS software design requirements were the result of cost savings.

jacobush7• 7 years ago

Because the training deviates enough from old 737 that you couldn’t grandfather the new into the same rating? Am I missing something obvious here?

WalterBright34• 7 years ago

Pilots are already supposed to be trained in runaway trim procedure. That's a reasonable evaluation to make, and the FAA agreed with it.

One of the crews followed it, the other two didn't. Crews aren't always trained properly, that isn't on Boeing.

Note that each of the three crews used the column trim switches to restore normal trim, why two did not think to then use the cutoff switches is something for the NTSB to determine.

If you watch "Air Disasters" on the Smithsonian Channel, many many crashes have an inadequate pilot training component, and/or pilots who did not do what they were trained to do.

elygre• 7 years ago

Whether the runaway trim procedure would be sufficient is disputed.

For example https://www.reuters.com/article/us-ethiopia-airplane-regulat...

WalterBright34• 7 years ago

"In the deadly Lion Air crash in October, the pilots lost control after initially countering the Maneuvering Characteristics Augmentation System (MCAS)"

They successfully countered it 25 times before the crash, meaning they had 25 opportunities to remember to use the cutoff switches.

"Boeing advised the airline about it after the crash."

An Airworthiness Directive was issued to all MAX flight crews after the Lion Air crash specifically laying out the procedure of countering with the trim switches and then throwing the cutoff switches.

sho5• 7 years ago

This is pure Boeing apologism. Why was it even necessary to follow the "runaway trim procedure" in the first minutes of a flight, in a brand new plane? Yes, it's possible expert pilots could have gotten out of the jam - as they did in the first Lion Air incident. But Boeing's shoddy workmanship, and the FAA's total lack of oversight, created the jam in the first place.

Boeing's victim-blaming can be understood, if not excused, from a liability perspective. It baffles me why anyone would take on that point of view otherwise.

et2o4• 7 years ago

Exactly. The suggestion that it is acceptable that a well engineered system would require heroic intervention with 4-10 seconds as the plane rapidly points nose down is baffling.

WalterBright34• 7 years ago

Why was it even necessary to follow the "runaway trim procedure" in the first minutes of a flight,

Because the stabilizer trim was running away.

Emergencies can happen in any stage of the flight, and the flight crews are supposed to follow their training.

For example, sometimes an engine catches fire. This is never supposed to happen. But the pilots are trained to deal with it. Probably 90% of pilot training is learning to deal with problems that shouldn't happen.

fsh• 7 years ago

This claim is being disputed by Chesley Sullenberger who is undoubtedly a great pilot and who has actually witnessed the MCAS behaviour in a simulator: http://www.sullysullenberger.com/my-letter-to-the-editor-of-...

WalterBright34• 7 years ago

"These emergencies did not present as a classic runaway stabilizer problem"

Since the LA and EA crews both successfully countered the runaway trim with the electric trim switches, this statement by Captain Sullenberger is inadequate. Furthermore, I have no idea what "classic runnaway stabilizer" is. When the trim starts erroneously pointing the airplane down, it's runaway trim. There is no other kind.

BTW, I worked for three years on the 757 stabilizer trim system. I know what runaway trim is.

hn_throwaway_992• 7 years ago

Your arguments are simply baffling due to a very simple reason: two planes crashed! Even if everything you say is true and the pilots were at "fault", it means that Boeing is designing planes where some significant percentage of pilots flying today will crash it. Do you want to fly on that plane?

This is basic Human Factors 101. Designing something where some percentage (even a small percentage, and especially when tragic consequences are involved) of properly trained people will be confused by the design means the design is at fault, not the people.

CydeWeys3• 7 years ago

And equally importantly, other planes don't crash nearly as much. Boeing managed to make a new plane that's much more deadly than existing planes on the market. It doesn't even matter so much why it's more deadly, just that it is. Placing blame on pilots misses the point, when those same pilots would not have crashed in those same conditions in a different plane.

mopsi4• 7 years ago

It's also true that if the pilots had followed the runaway trim procedure

The aircraft did not act how the manuals define runaway trim condition. MCAS was intermittent, runaway trim is constant. Checklist: https://i.imgur.com/K7El4K4.jpg

Nevertheless, the preliminary report says that crew identified the issue and followed the runaway trim procedure, but it still left them struggling to maintain control. Report: https://flightsafety.org/wp-content/uploads/2019/04/Prelimin...

mopsi4• 7 years ago

Video demo of where the checklist left them after completion: https://youtu.be/aoNOVlxJmow?t=606 (preceded by explanation)

WalterBright34• 7 years ago

The aircraft did not act how the manuals define runaway trim condition.

I'm curious. How do the manuals define runaway trim?

I'll tell you what actual flight controls engineers consider is runaway trim who actually worked on the 757 system - the trim running when it is not supposed to. All imagined faults that could result in trim running when it wasn't supposed to were accounted for and blocked. But STILL the backstop is the trim cutoff switches, which were deliberately and prominently put on the console within easy reach just in case.

All three crews knew it was the trim repeatedly running because they successfully countered it with the electric trim switches.

All 737s bracket the center console with a pair of large wheels with a white stripe on it that are directly connected to the stabilizer jackscrew and spin when the trim is running, making a loud clacking sound. This is deliberate to make it clear to pilots when the trim is running.

The trim running can also be stopped by simply grasping that wheel hard.

snarf21• 7 years ago

The thing that you are missing is that they said it flew EXACTLY like all other 737s. The same thousands of 737s that have been flown around the world for years. The fact that you are saying they didn't follow the "proper runway trim procedures" doesn't hold water. Not following the trim procedures caused ZERO crashes in the last (what?) million 737 flights!!! Whether that was the proper procedure is completely irrelevant. The pilots were given 30 minutes on an iPad and sent on their way being told they needed to do nothing different. Two crashes in (what?) a few hundred flights is the result of pure greed. Lots of people should be in jail.

WalterBright34• 7 years ago

The procedure for dealing with MCAS runaway trim failure is the same as dealing with runaway trim for previous 737 models.

briandear5• 7 years ago

The Lion Air maintenance department should be in jail then. They let a plane in the air when they knew they had a bad AOA sensor. That sensor is required by the Type Certificate and they allowed the plane to fly knowing it was faulty.

hef198988• 7 years ago

Maybe one general remark, from one engineer who spent half his professional life in aerospace to another. Aerospace is, rightly so, proud of the whole industries relentless pursuit to eliminate errors, improve systems and learn from accidents. Your argumentation, in the whole discussion, conveys a different image and does no favour to the sector in general. Some people are already afraid to fly, so the very least we all can do is to be open and honest about errors in the system and the actions taken to prevent the same accident from happening twice.

And generally on engineering. If a system, regardless of the application, fails I consider it bad engineer behavior to single out the user. Systems, especially in aerospace, include everything from design over manufacturing, software, the parts to maintenance, logistics and ultimately training. Failure in any single one of these means failure of the system. Which directly implies all entities involved in development and certification. Failure in more than one is catastrophic. Defending it is bad engineering. Just my 5 cents.

EDIT: MCAS relied on a single AoA sensor. Non-redundant safety critical systems in an aircraft? Seriously?

kortilla5• 7 years ago

MCAS isn’t a safety critical system. If it was turning it off wouldn’t really be an option.

WalterBright34• 7 years ago

Defending it is bad engineering.

I did not defend the MCAS software design. Not once. Quite the opposite.

the very least we all can do is to be open and honest about errors in the system and the actions taken to prevent the same accident from happening twice.

I totally agree with that. That also means being open and honest about all contributing factors to these crashes.

petilon• 7 years ago

Cost savings came from not retraining pilots and not requiring airports to be redesigned, and so on.

Boeing needed to use a larger engine for the new plane because larger, hotter engines burn less fuel. When the engine is made larger the wings and fuselage have to raised to accommodate the larger engine, which means jet bridges at airports have to be modified to accommodate the new plane. Boeing wanted to avoid this, so they designed the airframe such that the overall geometry of the plane is still compatible with existing infrastructure at airports, but this meant that the airframe was unstable---it has a tendency to tilt up when accelerating. Boeing compensated for this hardware flaw with a software fix.

The two serious mistakes Boeing made are (1) designing a multilayer system where bottom layers rely on upper layers for safe operation (i.e., airframe relies on software for stability) and (2) lack of redundant sensors.

jacobush7• 7 years ago

The upward tilt behaviour is not a flaw, as much as it is a quirk. Had they kept it unmitigated, they would have had to retrain pilots before they could fly the plane. (Their software fix was also a cost saving measure, and it didn't work.)

salawat2• 7 years ago

Good people in a bad system is still a bad system.

That line right there is essentially the same response I had for the Langewiesche's piece. It is not an excuse to pawn off the accountability for a catastrophic loss to the pilot when even the basic design is as fraught with failures to deliver even basic sanity checks as the MCAS system was. Make no mistake either, the issues that were found were basic. FMEA was not performed once, but never updated because it wasn't legally required, nor was a full fault-tree enumerated or kept consistent through the system's lifetime. Either of which would have forced a consideration of what would happen in the event of a sensor failure. Furthermore, the overall architecture of the flight computer failed to comply with design requirements that require no single point-of-failure which would have been revealed by doing what amounts to a textbook case of "what is the worst conceivable bit flip that could possibly happen right now?"

This is one of the few points I tend to respectfully differ from WalterBright on. I don't give a damn if every pilot were a Chuck Yaeger or Sully clone. That plane was dangerous by design.

A dangerous plane flown by a Good pilot is still a dangerous plane. There is no place in something manufactured to be deployed in a careless or cavalier manner, and the MAX rollout checks every box for organizational negligence in my book.

I'll let blame rest with the pilot in so much measure as it is do, but a machine that will actively frustrate its operator, while endangering the lives of everyone using it is a machine whose place is in a scrapyard; not in the sky.

WalterBright34• 7 years ago

We are in agreement that the MCAS design was dangerous. I don't think we disagree at all on the points you mentioned.

supportlocal4h2• 7 years ago

This is off-topic, but WalterBright's participation here has reminded me of my own weaknesses. Everything I have read about the 737Max has put a pitchfork in my hands to go after Boeing. Walter's are the first comments I have read that make me think perhaps Boeing wasn't completely, utterly, criminally unjustified.

It is interesting that Walter has chosen to jump in like this, and to hold his position so firmly so publicly. He must realize that this action threatens to paint him very unfavorably to a lot of people. There seems to be no reason for him to speak out and take such a risk.

To do this seems to me to require either a certain level of stupidity or a certain level of conviction and courage. My impression is that Walter has considerable courage and some motivation to try to counteract public ignorance.

FWIW, Walter's courage has given at least one person pause. I'm going to put the pitchfork down for a little bit. Boeing still isn't on my good list, but now I admit that I don't know as much about this as I thought I did.

lisper5• 7 years ago

Can you be a little more specific about what WalterBright said that changed your mind? Because the only thing I see that could possibly be considered a mitigating factor is this:

Both the LA and EA did make the adjustments within 10 seconds. They then did NOT throw the cutoff switches

(Emphasis added, because I missed this the first time I read it.)

If I squint hard enough I guess I can see a tiny hint of merit in the argument that the fault for the two crashes lies at least in part with the pilots because they failed to throw the cutoff switches. But that seems like a mighty thin reed to me. Have I missed something?

throwanem• 7 years ago

I don't think you have. Bright's arguments have focused entirely on the design of the MCAS software, and have as far as I can tell completely ignored the fact that that software, driven by input from a single AoA sensor, creates a very short critical failure path which requires immediate and precise human intervention to avert a fatal accident. That such human intervention was imperfectly performed in two cases does not indict the humans in question, so much as it indicts a design which errs so far on the side of unsafety that perfection in human behavior is required to prevent it killing everyone on board a commercial aircraft.

Any competent engineer knows that a design which requires human perfection for safety is a design not only doomed to failure, but a failed design in itself. At least one Boeing engineer raised this very concern during the 737 MAX design process, only to be quashed by management. It would be invidious to suggest that at least one ex-Boeing engineer should argue in the defense of that design out of any motivation other than a genuine conviction of the merit in his argument. But conviction alone doesn't suffice to render that argument meritorious, and I'm surprised and disappointed to see anyone here or elsewhere claim otherwise.

hadrien01• 7 years ago

Except, as dlgeek already answered to WalterBright: the EA crew followed the procedure and used the cutoff switches

jquery2• 7 years ago

The outrage mob over this has made it difficult for the whole truth to surface. For months, many people have said exactly what Walter is saying in this thread, Walter just happens to be more eloquent and qualified than other people who have made generally the same points.

Most of these people receive insults and downvotes so they stop talking about it. This leads to the classic “spiral of outrage” and the truth becomes lost.

I’m tooting my own horn here, but I’ve said what Walter has said in previous threads, and my comments were often downvoted into invisibility and I eventually gave up trying to point out that the pilots, the airlines, and the maintenance staff of the 737-MAX deserve some portion of the blame in addition to Boeing. Planes have become so safe that some airlines skip out on pilot emergency safety training, and Airworthiness Directives were ignored by the two airlines which had a 737-MAX crash.

This doesn’t mean that Boeing has no culpability, but it does mean that Boeing is not the sole party at fault. For everyone saying “Boeing cut costs and cost lives”, this is equally true for the airlines which skimped on pilot training and skimped on maintenance. The 737-MAX crashes were the result of a series of bad decisions and mistakes, not merely the result of bad MCAS system design.

Note: my late father worked at Boeing for 25 years so I have some personal reasons for wanting to defend Boeing. My mother’s widow pension is also dependent on Boeing stock not cratering into the ground.

jacobush7• 7 years ago

I may be bigoted, but I expect very little from certain countries, but quite a lot from Boeing.

pdonis5• 7 years ago

Walter's are the first comments I have read that make me think perhaps Boeing wasn't completely, utterly, criminally unjustified.

They shouldn't make you think that; the fact that, considered in the abstract, there were actions the pilots could have taken that would have avoided the fatal crashes does not change the fact that Boeing designed a system where the failure of a single sensor could cause a fatal accident. There can be responsibility in both places.

ReptileMan• 7 years ago

Boeing instructed pilots to deal with excessive downward pitching

That is my favorite newspeak so far.

EddieCPU3• 7 years ago

@ReptileMan >> Boeing instructed pilots to deal with excessive downward pitching

That is my favorite newspeak so far

Going by the faded out aspect of your post, someone here doesn't like you quoting facts.

throw7• 7 years ago

When the FAA Chief of Aviation Safety says there was "nothing he could have done", that is sign of deep systemic problems where someone else is to blame.

6gvONxR4sf7o2• 7 years ago

This reminds me of the debate around not-quite-self-driving cars. Saying the product is safe to use, but that the user must be ready to do X immediately, despite evidence that the users you're selling to won't be ready to do X immediately. Then when people die you get to say it was totally safe, if they'd just done what they were supposed to do.

Or we could just design products that will be safe in the real world, rather than ones that could have been safe in a utopia of perfect people.

ChuckNorris89• 7 years ago

At least most car manufacturers, apart from one(guess who that is) are honest in the marketing about what the features is, a more advanced lane assist and don't sell it as self driving.

ScalaFan• 7 years ago

Certain items just have a danger level that requires an elevated sense of responsibility and awareness and I don't just mean firearms. Workshop tools like power saws or table saws need to be handled with respect and care and those that cannot provide it should just not use them. Those that have worked in some kinds of environments know what I mean. Some factories or manufacturing places have lots of extra safety regulations. Those that have been in the military also know of dynamic and changing circumstances of their operating environment with all the specific equipment they use.

Even on a sailboat you need to be aware of the boom.

puzzledobserver• 7 years ago

As do cars. Which is why people need licenses to drive them. The question being asked is whether it is ethical for a company to market auto-pilot low-awareness chainsaws, designed to give the user only a half-second heads-up, and then disclaim responsibility when accidents happen.

Maybe the solution is for licensing authorities to call these auto-manual chimeras unlicenseable.

kortilla5• 7 years ago

That comparison falls flat because planes are filled with technologies where the pilot has to be ready to do X and it works fine (see autopilot).

gamblor956• 7 years ago

On planes pilots generally have time to take over if the autopilot fails. Falling from ten thousand feet takes a few minutes.

On cars, if autopilot fails, the driver might have a fraction of a second to recognize the failure, take over from the AI, and initiate corrective action. Generally, there isn't sufficient time for any of these steps, let alone the first one.

bathtub365• 7 years ago

Pilots have significantly more training than drivers. Safety is drilled into them from the beginning and how to respond in emergency situations is continuously reinforced with recurrent simulator training and testing. There are also far fewer interactions between an airplane and physical elements of the world than with cars. Weather visibility is much less of a problem except on takeoff and landing. Finally, on commercial flights there are at least two pilots operating the aircraft at one time to balance the workload.

droidist2• 7 years ago

Exactly, and you have Elon Musk retweeting the guy who slept the whole ride home in his Tesla and giving him an attaboy.

P_I_Staker• 7 years ago

Oh God, quicktime events are leaking into the real world. Press X to not die.

EddieCPU3• 7 years ago

“Boeing decided to place the engines farther forward, just in front of the wing. The new position, and the greater thrust of the engines, produced an aerodynamic challenge during a maneuver called a windup turn — a steep, banked spiral that brings a plane to the point of stall, which is required for safety tests, though it’s rarely used in typical flying.”

This is a curiously disingenuous statement. Not only at ‘windup turn’ and not only for “safety tests”, but most importantly when the engines were at maximum thrust such as at take off. Causing the air-frame to experience a pronounced nose-up attitude. The nacelles adding even more upward thrust.

‘Boeing settled on a software feature called the Maneuvering Characteristics Augmentation System. As the nose of the jet approached a high angle, suggesting an oncoming stall, MCAS would adjust the stabilizer on the plane’s tail, pushing the nose down, to alleviate the slackness in the control column. “They were trying to make it feel the same, so the pilots wouldn’t require training,”’

No, they didn't tell the pilots as this would require retraining and this would require re-certification.

“Boeing considered the MCAS feature to be so minor that it removed mention of it from the 737 MAX’s pilot manual.”

Boeing lied by omission, that's why when MCAS kicked in on those two crashes the pilots were unaware of MCAS and had no way of knowing how to recover from an MCAS induced nose dive. It was Boeing executive decisions killed those people. If this had happened in the US there would have been uproar by now.

V_Terranova_Jr• 7 years ago

I'm an Aerospace Engineer, currently working for the U.S. Gov, but have spent time on the Industry side. I don't have a thesis per se after reading this, but several thoughts:

- I don't think it's unfair to vilify Boeing's accumulated divergence from "doing the right thing". On the other hand, it's quite sad that it takes significant events like this to force anyone to act against the long-term pressure of corporate behavior that leads to such events.

- As per a thread I had with WalterBright, https://news.ycombinator.com/item?id=21037522 , I agree Airbus has a number of significant flaws in their vehicle management systems for which there has been insufficient criticism and action.

- It's not easy being on the side of the gov/regulators. There is continuous pressure from industry, and from up the management/political chain, to be a cooperative partner. Especially in light of how quickly industry can execute tasks, it's very hard to say "we need to take a pause" or "we need to go back, do some more homework, and be deliberative about this". If the gov/regulator is excessively slow, there are concrete costs that industry incurs. These realities, with the continued pressure, have trended in the U.S. to lead to ultimately less effective oversight.

- The U.S. Government insufficiently values in-house technical expertise. In the aerospace realm, NASA is the principal exception. But within the DoD and FAA, while there is is technical expertise, much heavy-duty technical lifting is done by FFRDCs (e.g., Aerospace Corp., MITRE's CAASD, the national labs) or UARCs (e.g., Johns Hopkins Univ's Applied Physics Lab). In my view, the DoD and FAA should build in-house engineering capability sufficient to properly oversee and advise major programs without having to outsource as much as they do. You cannot do an effective job overseeing complex engineering developments if you are insufficiently technically-competent. The DoD is starting to realize this and places like AFRL are starting to swing back toward that direction, but there's a very very long way to go. If you are going to effectively push back against industry pressure, you have to be equipped to make strong technical arguments, not just appeals to precedent or vague statements about risk.

- If you can find people with the right mindset and competence levels, it's better, in my view to have ex-Industry engineers working for the government. Those that go straight from school to government don't often have direct experience as practitioners, and as per my previous point, that often makes them less effective than they could be.

- "Follow the plan," from the article, sounds exactly like what I've heard from Boeing. The article captured well the context and implications of that kind of talk.

- "... engineers had to accept that they were no longer the center of the universe" really resonated with my own experience at another (non-Boeing) large American aerospace company. I was told by the man in charge of a major subsystem discipline that "engineering is out of favor [with the company management]". He was an engineer and on the side of engineers, he was just telling it the way it was. I couldn't believe what I heard then, and decades later, still can't believe it. How can engineering be "out of favor" in a company that specifically engineers systems at the edge of what humans can accomplish in hardware? I think you will find most large American aerospace companies helmed by people who really see no irony in making statements like that.

- The aerospace industry is not one I would encourage my children to work in. I'm driven heavily by my passion for aerospace - it's an integral part of my identity. But it's really hard in industry to find job security, avoid rampant pigeonholing, avoid corporate mistreatment, work on multiple well-executed flight programs in your career (the equivalent of "shipping" software), and generally work somewhere where there is a strong corporate motivation to "do the right thing". It's a lot harder than in software for the corporate culture to not permeate everything around you because of how capital-intensive the field is. Also, the U.S. Government sucks as a customer, which makes it harder for small companies to thrive in the field. The job security issue can go away if you work in government, but then your ability to be an implementer (why a lot of people become engineers) also diminishes.

The Case Against Boeing

Related Stories