Hacker News new | ask | show | jobs
by daveoflynn 2776 days ago
That analogy doesn’t hold up. All Airbus and most Boeing aircraft have systems to push the nose down in event of a stall.

The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone.

Imagine someone added Adaptive Cruise Control to your existing car without telling you - the first time the car braked on its own, you’d freak out. The car is suddenly behaving in a way it should be able to.

If you know the system exists, you can recognise what’s happening and deal with it. If you don’t know it exists, the behaviour is going to be absolutely baffling, and no in-flight diagnostic procedure has a step for “did the manufacturer add an important safety device and not tell me?”

3 comments

Something similar happened in the past: Scandinavian Air 751 (MD-81 with twin engine aft-mounted) had both engine surged due to ice ingestion shortly after takeoff. Pilots were not aware of auto throttle control, which revert pilots’ action of reducing throttle (to fix the engine surging). Both engines ultimately failed and aircraft crash landed. Luckily all survived.

https://en.m.wikipedia.org/wiki/Scandinavian_Airlines_Flight...

For those interested in a video breaking down SA 751: https://www.youtube.com/watch?v=a6oJUt4WWdQ
Well, the throttle control was one issue, but it is far from certain that it would have saved the engines. The main issue was still the ice that went in to the engines to begin with. The full report is available here:

https://www.havkom.se/assets/reports/English/C1993_57e_Gottr...

I agree. Improper de-icing + aft-mounted engine is the main cause of this disaster (although ice on wing itself is already a problem as it reduces lift and could cause stalls). My (rather subtle) point is that Boeing can’t really go “oh this has never happened before”.

In fact, as a general rule of thumb, I believe any safety feature that would automatically change the state of the aircraft should be well educated to the pilots.

I understand how the term 'ingestion' got to be used but given how turbines react to foreign objects, 'indigestion' seems more accurate.
You have to ingest something to get indigestion, resulting in sentences like "ice ingestion gave the turbines indigestion". At that point it's long-winded and would be shortened to "ice ingestion", making the point somewhat moot.
> The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone

Totally out of my depth here, but how is it possible that they "didn't tell anyone" about a feature so crucial, how could pilots not know how the plane's computer will behave in such a fundamental, non edge-case scenario?

Boeing specifically marketed this as not requiring new training. So they did everything they could to hide it in order to satisfy marketing’s desire.

The FAA signed off. I guess the lawyers will argue if it was legal or not.

But it's right there in the Terms of Service box! The pilot probably just clicked right through it without reading.
Wow. Your statement is so true on so many levels and applicable to so many industries that it seems unfair that I can only upvote you once.
That's what I'm wondering about. How did Boeing get away without disclosing it. Or if they disclose it how did FAA agree that this is not something that pilots need to know and train for. If they signed off on Boeing not letting pilots know FAA should be on the hook for this too.
A stick Pusher is not a new feature, if you're right, and the FAA signed off that operators of the NG did not need any supplementary training and that caused the accident that will be very ugly for Boeing
MCAS is not a stick pusher -- and that's the crux of the problem. A stick pusher would essentially adjust the elevator to pitch the plane down. MCAS trims the stabilizer. At full stabilizer travel you may not have sufficient elevator authority to overcome the downward pitch. Put another way, you can counteract the stick pusher by pulling back (although this may take a strong pilot). If you don't catch MCAS doing something stupid and the plane ends up fully trimmed down you cannot counteract this by pulling back.

Here's some other examples of what happens when the stabilizer is trimmed without the pilot knowing. Sadly Capt. VanderBurgh died a couple years ago. Had he not it would have been fascinating to see his take on the Lion Air wreck.

https://www.youtube.com/watch?v=WfNBmZy1Yuc

And here's a quick overview of how the stabilizer functions in a 737:

https://www.youtube.com/watch?v=l62NvkRWa5E

The first video is fantastic (and terrifying). Thanks for sharing.
> At full stabilizer travel you may not have sufficient elevator authority to overcome the downward pitch.

Do the stabilizer trim tabs really have more authority than the elevator? That seems odd.

They aren’t “trim tabs” — it moves the entire stabilizer.
Yes (but it's not tabs)
> Totally out of my depth here, but how is it possible that they "didn't tell anyone" about a feature so crucial, how could pilots not know how the plane's computer will behave in such a fundamental, non edge-case scenario?

I couldn't even hazard a guess. Boeing told the Brazilian authorities about it. See the table on Page 18 under MCAS.

http://www.anac.gov.br/assuntos/setor-regulado/profissionais...

For comparison here's the FAA equivalent:

http://fsims.faa.gov/wdocs/fsb/b-737_rev%2014.pdf

Note that MCAS is distinctly absent from the difference tables (also) on page 18.

The FAA signed off on the NG to MAX training as "B" level differences. This means no sim time necessary[1] (although apparently American Airlines doesn't have a MAX sim in the first place). The Brazilians were made aware of MCAS and thought that also qualified as a "B" level difference. The question then is: did the FAA think MCAS constituted a C or D level difference?

1: See the table on page 14 for a list of the FAA definition of different categories of differences

Boeing can self certify[0]. I'm not sure where this enhancement/feature would fall but they seem to have at least some latitude.

[0] https://www.seattletimes.com/business/boeing-aerospace/faa-e...

> Imagine someone added Adaptive Cruise Control to your existing car without telling you - the first time the car braked on its own, you’d freak out. The car is suddenly behaving in a way it should be able to.

I recently got a hell of a shock in my fathers BMW: I was driving with cruise control engaged, depressed the clutch, and when I released it, found the car re-accelerating to match it's previous speed. Every other car I've driven has disengaged cruise when the clutch is engaged, so this took be quite by surprise and could have put me in danger.

Another oddity in using adaptive cruise control that happened with me and scared me a bit: imagine you are in a congestionated area and eventually enter a lower speed uncongestionated area, the car is going to speed up. If you don't notice the speed up and intervene immediately, you might easily end up at speed that is unsafe, unallowed, or both.
Does that mean that if you shift down, the car will still accelerate / maintain speed and that "breaking on the engine" (slowing the car down by increasing the revs and not accelerating) doesn't work?

What gave me a scare was lowering the cruise speed on the steering wheel by clicking the button a few times, which in fact caused the car to actively break quite hard instead of naturally lowering its speed.

EDIT Now that I think about it, my BMW does not disengage the cruise when you shift up and ... I'm not sure if it does when you shift down.

> EDIT Now that I think about it, my BMW does not disengage the cruise when you shift up and ... I'm not sure if it does when you shift down.

My BMWs (E46, E39) all have two clutch switch outputs: one for the starter and one for cruise control.

The cars I've driven only disengage cruise control if you tap the break.
My '97 Mazda, '02 BMW, and '15 Ford all disengage cruise when you clutch. What do you have that doesn't, and are you sure its clutch safety switch is actually working?
>are you sure its clutch safety switch is actually working?

If the clutch switch was inoperative and the cruise control was engaged, the cruise would not know the engine is disengaged from the transmission and would rev the engine up to redline.