Safety as a DLC; Two 737 MAX Airliners That Crashed Did Not Have Optional Safety Equipment

[ThePointblank]

Most of you are probably aware of the two crashes of the Boeing 737 MAX airliners with both Indonesian-based Lion Air, and Ethiopian Airlines, and the subsequent worldwide grounding of the jet:

 

There is now reporting from the New York Times that the jets involved with both crashes did not come with two optional safety features:

 

https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html

 

The reason why the two jets were not equipped? Because Boeing made the two safety features a paid optional extra, and charges a lot of money for those features.

 

The two safety features involved is the angle of attack (AOA) indicator which displays the readings of the two angle of attack sensors. The second is a called a disagree light, which is activated if those sensors are at odds with one another. Both features could have alerted pilots to the fact that there were problems with the angle of attack sensors—the input suspected of causing the Maneuvering Characteristics Augmentation System (MCAS) software to put both aircraft into a fatal dive.

 

A bit of background on the MCAS software, paraphrased from this source:

 

https://leehamnews.com/2018/11/14/boeings-automatic-trim-for-the-737-max-was-not-disclosed-to-the-pilots/

 

When Boeing set out to upgrade the Boeing 737 airliner into the 737 MAX, Boeing's engineers had to figure out a way to install the bigger, more fuel efficient engines on an airframe that sits much closer to the ground compared to their competitor's Airbus A320 series airliner.

 

Boeing 737:

Spoiler

Airbus A320:

Spoiler

 

This was previously a problem for Boeing in the 1980's when they originally created the 737 Classic, as the newer, more efficient CFM-56 engines were significantly larger than the previous Pratt & Whitney JT8D engines. Boeing managed to resolve this problem by reducing the fan diameter size, and the engine accessory gearbox was moved from the bottom of the engine to the side of the engine, giving the engine nacelle its distinctive flat-bottomed shape:

 

Spoiler

 

Boeing again faced the same problem with the CFM International LEAP engines that was meant for the 737 MAX airliner; as the engines were even bigger, Boeing had to re-engineer significant parts of the aircraft in order to make the engine fit. Boeing's engineers decided that in order to fit the new engines on the 737 airframe, they would install a taller nose landing gear, and mount the engine slightly forward and further up to ensure enough ground clearance for the engines:

 

Spoiler

 

 

These changes, in particular, the changes in how the engine is mounted to the aircraft, had the side effect of changing how the aircraft handled in certain situations. The relocated engines and their refined nacelle shape caused an upward pitching moment by generating lift — in essence, the MAX’s nose was getting nudged skyward under certain conditions. In response, Boeing quietly added a new system called the Maneuvering Characteristics Augmentation System (MCAS to compensate.

 

This system would help pilots compensate for the nose up pitch by bring the nose down in the event the jet’s angle of attack drifted too high, putting the aircraft at risk of stalling and falling out of the sky. The system was designed to activate without a pilot's input and commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall. Depending on AOA value and rate, altitude (air density) and Mach (changed flow conditions) the MCAS, which is a software loop in the Flight Control computer, initiates a nose down trim above a threshold AOA.

 

Pilots can disable the system by manually counter-trimming on the Yoke or by the pilot hitting the CUTOUT switches on the center pedestal. It’s not stopped by the pilot pulling the Yoke, which for normal trim from the autopilot or runaway manual trim triggers trim hold sensors. This would negate why MCAS was implemented; the pilot pulling so hard on the Yoke that the aircraft is flying close to stall.

 

The problem is that this behaviour runs counter-intuitive compared to how pilots are taught in situations where there unwanted autopilot trim or manual trim runaway, and since Boeing's manuals made no reference to the system, pilots had no way of knowing that this system even existed in the first place, and what to do to correct the situation when it occurs. This probably was the reason why the pilots of the Lion Air 737 were so confused, causing the aircraft to crash, and this is suspected of causing the same situation for the Ethiopian Airlines 737 to crash as well.

 

Back to the original matter: safety as an paid option:

 

While it is typical for airliners to have a number of features as optional extras, and charging significant amounts of money to add those features in is a common practice by all aircraft manufacturers, this practice has come under criticism when these optional extras are fundamental to how the aircraft operates, such as the communication, safety, or navigation systems. Many budget airlines op to not buy these features in order to save money at the time of purchase, unless the local regulators require that these features be mandatory. Such features include things like backup fire extinguishers, which in Japan are mandatory for the cargo hold, but in other jurisdictions, are optional and not required.

 

Of the major North American airlines that have purchased and operate the Boeing 737 MAX airliners, all of the airlines have equipped their aircraft differently:

• American Airlines and Air Canada bought both the angle of attack indicator and the disagree light;
• Southwest Airlines had already purchased the disagree alert option, and it also installed an angle of attack indicator in a display mounted above the pilots’ heads, and has since indicated that in the wake of the earlier Lion Air crash, they would place the angle of attack indicator on the pilots’ main computer screens;
• United Airlines did not purchase either the angle of attack indicator and the disagree light;
• WestJet purchased their 737 MAX's with the disagree alert option, but are not configured with the angle of attack indicator;
• Sunwing Airlines had not responded to any media requests regarding how their aircraft are configured

 

In the wake of the Ethiopian Airlines crash, Boeing has since indicated that future 737 MAX deliveries will have the disagree light standard, but not the angle of attack indicator, along with changes to the MCAS software; previously, the MCAS took readings from only one angle of attack sensor on any given flight, leaving the system vulnerable to a single point of failure.

 

This is suspected of causing the Lion Air crash, and is the leading suspect for the Ethiopian Airlines crash as well. Boeing has since been developing a software patch where the MCAS software will now take readings from both angle of attack sensors, and if there is disagreement between the two sensors, the MCAS software will be disabled.

 

However, safety experts and engineers are saying making the disagree light and the angle of attack indicators standard would be a welcomed move, as it would enhance safety by making it easier for pilots to diagnose the problem and compensate, and for maintenance staff who service the aircraft when a problem does arise and requires repair work.

[dizmo]

Seems more like hardware than software so I don't see how that's related to DLC. 

 

I still don't see how this is tech news. 

I should start posting about cosmetics breakthroughs. I mean, they're made using tech too. 

[NumLock21]

42 minutes ago, dizmo said:

Seems more like hardware than software so I don't see how that's related to DLC. 

 

I still don't see how this is tech news. 

I should start posting about cosmetics breakthroughs. I mean, they're made using tech too. 

It's tech news because involves technology. Technology isn't only about computer parts. 

 

As for the topic, boeing should have made that a standard feature. 

[ravenshrike]

4 minutes ago, NumLock21 said:

It's tech news because involves technology. Technology isn't only about computer parts. 

 

As for the topic, boeing should have made that a standard feature. 

Except the MAX only comes with one AoA sensor as standard, not two.

[NumLock21]

Just now, ravenshrike said:

Except the MAX only comes with one AoA sensor as standard, not two.

I'm saying boeing should added both safety feature into the cost of the plane, not as a optional feature where it cost extra. 

[porina]

1 minute ago, NumLock21 said:

I'm saying boeing should added both safety feature into the cost of the plane, not as a optional feature where it cost extra. 

Agreed. If it becomes proven this was a significant factor in these crashes, it may well become mandatory anyway so wont be a problem looking forward. I just hope it doesn't end up that Boeing end up profiting as a result of these tragedies.

[straight_stewie]

1 hour ago, ThePointblank said:

communication, safety, or navigation systems

That was a very well written post, and very on point. However, there is a big problem with that statement:

Communication, navigation, and safety equipment is always optional, to a point.

 

Take a Cessna 172, for example.

• Navigation/Instrumentation
  • You can get Steam gauges
    • The aircraft can be IFR certified or not
      • IFR certified aircraft can optionally have DME, or not.
  • You can get a glass cockpit
    • Always IFR certified
    • Optional weather RADAR, considered a safety/navigation feature.
• Communication
  • There are various radio options, for both internal and external radios, with both instrumentation stacks.
    • The most basic option with the traditional cockpit provides a basic two channel external, one channel internal with PTT external, always on internal.
    • The most advanced option, included with the glass cockpit, provides an unlimited length radio stack, with dual tune stereo (one channel in left ear, one channel in right ear), provides one-push tune when a flight plan is entered (automatically tune to appropriate frequency based on flight plan), and provides two internal channels (pilot-copilot, and pilot-copilot-passengers).
• The aircraft can be optionally equipped with emergency, always on, or unavailable, supplemental oxygen, depending on the package.

 

The real point is that the minimum provided equipment must be whatever is necessary to fly the aircraft safely and respond to emergencies that might arise as a result of onboard systems. Everything else is optional.

 

In this case, leaving out the differential AOA indicator was probably a mistake, as it is necessary to diagnose problems with the always included MCAS system. Alternatively, Boeing could have provided a Disagree Light, which just indicates that the differential AOA has passed some threshold and is no longer reliable.

 

As another point about optional equipment, there are thousands of Vans RV aircraft that fly safely without even an external radio or their emergency parachute system, there are thousands that fly safety with radios but without the emergency parachute system, and there are thousands that fly safely with both.

[porina]

10 minutes ago, straight_stewie said:

The real point is that the minimum provided equipment must be whatever is necessary to fly the aircraft safely and respond to emergencies that might arise as a result of onboard systems. Everything else is optional.

Would it be fair to say that safety isn't a fixed line to cross. Different choices will have different impacts in different areas. As new knowledge comes in, this can be refined and requirements tightened where necessary.

[straight_stewie]

14 minutes ago, porina said:

Would it be fair to say that safety isn't a fixed line to cross. Different choices will have different impacts in different areas. As new knowledge comes in, this can be refined and requirements tightened where necessary. 

That's exactly what I'm trying to say.

I can't find fault in Boeing for not having initially included the indicators as part of the base system. The aircraft are overwhelmingly complicated and I'm sure that their testing indicated that the MCAS system was reliable. I do find fault in Boeings continuing refusal to actually fix the damn issue now that it's been twice tragically notified of it.

[bcredeur97]

2 hours ago, ThePointblank said:

Both features could have alerted pilots to the fact that there were problems with the angle of attack sensors

so they could of alerted the pilots there was a problem -- could the pilots still have done anything about it though? that is the real question here.

 

Sure I was alerted I was about to crash and burn but doesn't mean the alert would of helped me not crash and burn.

[ZestyJalapeno]

I've been reading on avforums that the MAX 8 is inherently a flight risk. The 737 was a great design, back in 1966. But now you've taken that 53 year old airframe, stretched it and put two huge engines on it. They've done a Dolly Parton on it. It's had the effect of moving the CoG so much that Boeing felt the need to create and certify a MCAS system, which worked perfectly - but it was being fed wrong information.  

[wanderingfool2]

48 minutes ago, straight_stewie said:

That's exactly what I'm trying to say.

I can't find fault in Boeing for not having initially included the indicators as part of the base system. The aircraft are overwhelmingly complicated and I'm sure that their testing indicated that the MCAS system was reliable. I do find fault in Boeings continuing refusal to actually fix the damn issue now that it's been twice tragically notified of it.

I don't blame Boeing for the AOA not being in aircrafts initially, actually even now (could be wrong) I feel that a missing AoA display wouldn't generate any dangerous situations.  The sensor disagreement should have been included from the start.  Any system that takes full control of a plane, especially one that requires a different action by a pilot than what is typical, should be included. (And more so given the software will only rely on one sensor)

 

If it is true that the software only used one of the two sensors, I really believe that this major fault is being overlooked.  At no point should a system that takes over an aircraft should rely on one sensor and not have warnings

[S w a t s o n]

>designs plane that tends to stall due to it pitching upwards by itself (how is this even a risk if the planes can fly on a single engine?)

>instead of fixing design creates system to push nose down and alert pilots (doesnt tell pilots systems exists)

>charges money for alert system to tell pilots when the bandaid fix is actually causing problems

>planes fall out of sky because of the free "safety feature" that doesnt come with the warning system needed

 

how is this legal?

[straight_stewie]

1 hour ago, wanderingfool2 said:

If it is true that the software only used one of the two sensors, I really believe that this major fault is being overlooked.  At no point should a system that takes over an aircraft should rely on one sensor and not have warnings

If it only used one of the sensors, we wouldn't be having this conversation. The fault is that it doesn't fail gracefully when the two sensors are not in agreement with each other... Actually, the whole problem could probably have been avoided if it used only one sensor or three or more sensors. This was a failure in the design of a fault tolerant system, in that they didn't actually succeed in building a fault tolerant system.

 

I'm in full agreement there. I would actually go one step further and make the claim that, at no point should a system take over any vehicle if the operator didn't explicitly tell it to do so. In this case, that means that turning MCAS on should have been a pre-takeoff checklist item, just like every other flight automation system in the plane is.

 

@S w a t s o n

It's easy to make that claim now. Hindsight is always 20/20. It's much harder to make that claim when you are in the middle of designing what is one of the most complicated things on the planet, and all of your testing indicates that it is functioning as intended.

As I already stated, we can't fault Boeing for not having originally included the indicator in the base configuration, unless we know that they knew there was a problem from the start. In which case, the fault is not that they didn't include the indicator, the fault is that they moved forward with a system that they knew was dangerous.

[The Benjamins]

3 hours ago, dizmo said:

Seems more like hardware than software so I don't see how that's related to DLC. 

 

I still don't see how this is tech news. 

I should start posting about cosmetics breakthroughs. I mean, they're made using tech too. 

I think he is using DLC more as a joke, saying it's a paid extra. Like crash mitigation tech in cars are optional extras.

[Trixanity]

1 hour ago, straight_stewie said:

If it only used one of the sensors, we wouldn't be having this conversation. The fault is that it doesn't fail gracefully when the two sensors are not in agreement with each other... Actually, the whole problem could probably have been avoided if it used only one sensor or three or more sensors. This was a failure in the design of a fault tolerant system, in that they didn't actually succeed in building a fault tolerant system.

 

I'm in full agreement there. I would actually go one step further and make the claim that, at no point should a system take over any vehicle if the operator didn't explicitly tell it to do so. In this case, that means that turning MCAS on should have been a pre-takeoff checklist item, just like every other flight automation system in the plane is.

 

@S w a t s o n

It's easy to make that claim now. Hindsight is always 20/20. It's much harder to make that claim when you are in the middle of designing what is one of the most complicated things on the planet, and all of your testing indicates that it is functioning as intended.

As I already stated, we can't fault Boeing for not having originally included the indicator in the base configuration, unless we know that they knew there was a problem from the start. In which case, the fault is not that they didn't include the indicator, the fault is that they moved forward with a system that they knew was dangerous.

I disagree. You're not exempt just because you didn't know. This isn't a Dave Chappelle sketch where you can just say "sorry I didn't know you couldn't do that".

 

You're supposed to test these things and you're not supposed to withhold extra security measures and lock them behind a pay wall. If you design extra security measures, one has to assume there is a reason behind it. There is no excuse for this and I'm sure Boeing is aware. Of course that doesn't mean they'll actually take responsibility.

[straight_stewie]

35 minutes ago, Trixanity said:

You're supposed to test these things and you're not supposed to withhold extra security measures and lock them behind a pay wall. If you design extra security measures, one has to assume there is a reason behind it. There is no excuse for this and I'm sure Boeing is aware. Of course that doesn't mean they'll actually take responsibility. 

Angle of Attack indicators are hardly a security measure. In fact, outside of aircraft designed to perform aerobatic maneuvers, they are quite rare. I would go so far as to say that if your aircraft requires an AOA indicator to be safe during normal modes of flight, then the aircraft design itself is the danger.

 

And yes, sometimes things slip through the cracks. It's not like Boeing is one all knowing individual. The reason they need to be held accountable is because they refuse to fix their mistake, not because they made one, Unless it is shown that Boeing knew they made the mistake beforehand.

 

It is unrealistic to think that every mode of failure in any complicated system, from websites to flight control systems, can be caught before show time.

[D13H4RD]

Come to think of it, the Airbus A320 actually had an issue with its avionics display panel in its early years of operation.

 

Where pilots would confuse the flight path angle with its vertical speed. So if you set a descent angle of -2.5 degrees but forget to change the mode, you might have actually entered in a -2500FPM descent rate. It was a major contributing factor to the crash of Air Inter Flight 148.

 

Just another example of a bit of a bizarre oversight

[Trixanity]

41 minutes ago, straight_stewie said:

Angle of Attack indicators are hardly a security measure. In fact, outside of aircraft designed to perform aerobatic maneuvers, they are quite rare. I would go so far as to say that if your aircraft requires an AOA indicator to be safe during normal modes of flight, then the aircraft design itself is the danger.

 

And yes, sometimes things slip through the cracks. It's not like Boeing is one all knowing individual. The reason they need to be held accountable is because they refuse to fix their mistake, not because they made one, Unless it is shown that Boeing knew they made the mistake beforehand.

 

It is unrealistic to think that every mode of failure in any complicated system, from websites to flight control systems, can be caught before show time.

It isn't about being omnipotent. If I do something that results in the death of someone I won't be acquitted because I was unaware of that potential outcome; at best I'll get a shorter sentence.

 

From reading this thread it sounds like Boeing retrofitted a plane with new engines (among other things) causing them to have to implement a host of changes to make it work and to be safe. Some of these changes could result in these accidents especially if the pilots aren't aware of the specific peculiarities and the accompanying systems. I wouldn't claim to know if it requires extra training to fly a new plane but it seems like a major design flaw if a pilot would need to be well versed in a particular model in order for it to not be a potential hazard.

 

If that was the case it would seem test flights were mostly or only done by pilots with intimate knowledge of the plane beforehand meaning your average pilot with no preamble could get into a situation they don't know how to get out of - hence we're in a situation where two planes of the same model crash within four months allegedly for the same reason.

[D13H4RD]

2 minutes ago, Trixanity said:

If that was the case it would seem test flights were mostly or only done by pilots with intimate knowledge of the plane beforehand meaning your average pilot with no preamble could get into a situation they don't know how to get out of - hence we're in a situation where two planes of the same model crash within four months allegedly for the same reason.

There’s one question though.

 

There are hundreds of 737 MAX airframes out there. They’re obviously now grounded but they were flying. How did the ones who encountered a malfunctioning automated system managed to recover whilst the ill-fated flights didn’t? 

 

I have a feeling this is more than just an onboard flight envelope system going haywire.

[straight_stewie]

11 minutes ago, Trixanity said:

I wouldn't claim to know if it requires extra training to fly a new plane but it seems like a major design flaw if a pilot would need to be well versed in a particular model in order for it to not be a potential hazard. 

For all Airline Transport Pilot aircraft, all pilots are required to get what are known as "Type Certifications", which is training specific to that model of aircraft. The type of aircraft are thus also known as "Type certified aircraft", and the pilots who complete the training are referred to as "certified on that type".

 

Usually it involves simulator time, online and classroom training, and ends with a final check ride either in a certified simulator or actual aircraft of the type, given by an experienced type certified pilot who has FAA approval to conduct the check ride. To maintain the Type Certification for that aircraft, a pilot must conduct a certain number of takeoffs and landings under various conditions each month, as well as potentially other activities like practicing missed approaches, rejected takeoffs, and other scenarios.

 

One of the failures here, and one of the things I think Boeing should be held accountable for was it's lack of MCAS training throughout these courses, even after the first accident.

11 minutes ago, Trixanity said:

If that was the case it would seem test flights were mostly or only done by pilots with intimate knowledge of the plane beforehand

That's how all test flights are conducted for all aircraft. Being a Test Pilot or Test Flight Engineer is very similar to being an astronaut pilot, or an engineer working flight control during an Apollo mission (in fact, it is exactly like that: The Apollo team viewed each flight as a test flight of new hardware.)

[D13H4RD]

4 hours ago, Dogeystyle said:

I've been reading on avforums that the MAX 8 is inherently a flight risk. The 737 was a great design, back in 1966. But now you've taken that 53 year old airframe, stretched it and put two huge engines on it. They've done a Dolly Parton on it. It's had the effect of moving the CoG so much that Boeing felt the need to create and certify a MCAS system, which worked perfectly - but it was being fed wrong information.  

They apparently never planned a 737 MAX in the first place. They were scheduled to launch the Boeing Y1 by 2020, which would be a fully-redesigned and overhauled replacement for the 737 and 757 alongside the smaller 767-200.

 

The reason for the MAX’s existence? The Airbus A320neo family and AA’s massive orders for them. It was at the point where Boeing had to respond with a competitor soon and all they had was the 737, as the 757 had been discontinued.

[DrMacintosh]

Kappatalism at its finest. I wonder how much Boeing could have saved by implementing those features and calculating them into the cost of the plane, rather than making them “optional saftey features” and having to deal with the consequences now. 

 

Hope Boeing gets what it deserves. 

[S w a t s o n]

3 hours ago, straight_stewie said:

@S w a t s o n

It's easy to make that claim now. Hindsight is always 20/20. It's much harder to make that claim when you are in the middle of designing what is one of the most complicated things on the planet, and all of your testing indicates that it is functioning as intended.

As I already stated, we can't fault Boeing for not having originally included the indicator in the base configuration, unless we know that they knew there was a problem from the start. In which case, the fault is not that they didn't include the indicator, the fault is that they moved forward with a system that they knew was dangerous.

Boeing designs much more complex things than a refit of an airframe that is decades old. I dont buy that the engineers COULDNT have designed the plane better. I do buy the management didnt want to spend the money on designing the plane to be better.

[D13H4RD]

2 minutes ago, S w a t s o n said:

Boeing designs much more comlex things than a refit of an airframe that is decades old. I dont buy that the engineers COULDNT have designed the plane better. I do buy the management didnt want to spend the money on designing the plane to be better.

Read up on the Boeing Y1.

 

That’s the jetliner that’s going to replace the 737 range entirely. The MAX was never planned until American Airlines ordered a heap of the A320neos. Boeing was adamant that they were going to do a whole new airframe until the aforementioned order.