The New York Times Magazine just published a 14,000 words piece about the Boeing 737 MAX accidents. It is headlined:
What Really Brought Down the Boeing 737 Max?
But the piece does not really say what brought the Boeing 737 MAX down. It does not explain the basic engineering errors Boeing made. It does explain its lack of safety analysis. It does not mention the irresponsible delegation of certification authority from the Federal Aviation Administration to Boeing. There is no mention of the corporate greed that is the root cause of those failures.
Instead the piece is full of slandering accusations against the foreign pilots of the two 737 MAX planes that crashed. It bashes their airlines and the safety authorities of Indonesia and Ethiopia. It only mildly criticizes Boeing for designing the MCAS system that brought the planes down.
The author of the piece, William Langewiesche, was a professional pilot before he turned to journalism. But there is so much slander in the text that it might as well have been written by Boeing's public relations department.
The piece is also riddled with technical mistakes. We will pick on the most obvious ones below. The following is thus a bit technical and maybe too boring for our regular readers.
Langewiesche describes the 737 MAX trim system and its failure mode:
That's a runaway trim. Such failures are easily countered by the pilot - first by using the control column to give opposing elevator, then by flipping a couple of switches to shut off the electrics before reverting to a perfectly capable parallel system of manual trim. But it seemed that for some reason, the Lion Air crew might not have resorted to the simple solution.
Wrong: The manual trim system does not work at all when the stabilizer is widely out of trim (i.e. after MCAS intervened) and/or if the plane is flying faster than usual. That is why the European regulator EASA sees it as a major concern and wants it fixed.
Langewiesche knows this. He later writes of one of the accidents:
The speed, meanwhile, was producing such large aerodynamic forces on the tail that the manual trim wheel lacked the mechanical power to overcome them, and the trim was essentially locked into the position where the MCAS had left it
Is that a 'perfectly capable system'?
Of the crashed Lion Air flight 610 Langewiesche writes:
At 6:31 a.m., 11 minutes into the flight, Suneja got on the radio for the first time. He did not know their altitude, he told the controller, because all their altitude indicators were showing different values. This is unlikely and has never been explained.
Wrong. The value given by an Angle of Attack sensor is also used in calculating the speed and attitude of a plane. If one of the two AoA sensors fails the instruments on the side that with the failed AoA sensor will show different values than those on the other side of the cockpit.
Langewiesche knows this. Further down in his piece he writes:
That story actually starts three days before the accident, when the same airplane - under different flight numbers and Lion Air crews - experienced errors in airspeed and altitude indications on the captain's (left side) flight display that weren't properly addressed. Those indications are driven by a combination of sensors on the surface of the airplane.
Is that 'unlikely' and unexplained?
This is an unfounded claim:
Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane's flight manuals.
Wrong. Boeing sold the new plane with the dubious claim that it handled no different than its predecessor. It left MCAS out of the manual because it did not want to add to training requirements for the pilots which would have contradicted its marketing claim. Furthermore Boeing did not do any additional safety evaluation when it increased the authority of the system.
Another wrong part:
A set of independent duplicate sensors drive the co-pilot's (right side) display. A third standby system provides additional independent backup and allows for intuitive troubleshooting when any one of the three systems fails: If two indications agree and the third one does not, the odd one out is obviously the one to ignore. This sort of arrangement helps to explain why flying a Boeing is not normally an intellectual challenge. Furthermore, the airplane provides an alert when airspeed or altitude indications disagree.
There is no general third standby system on a Boeing 737. There is a set of standby instruments for altitude and airspeed. But these give uncorrected values that differ from the ones shown on the two flight control displays. Those values are calculated by two flight computers and each takes the value of only one pitot (speed) tube and one AoA sensor into account. If an AoA sensor fails the instruments on one side show wrong values. The instruments on the other side will show different but hopefully correct values. The standby instruments will show different, uncorrected values than both of the calculated ones.
Langewiesche describes an earlier Lion Air flight that also experienced an MCAS failure but was by chance saved:
Immediately after liftoff, the captain's airspeed indication failed, airspeed-disagreement and altitude-disagreement warnings appeared on his flight display and his stick shaker began to rattle the controls in warning of an imminent stall.
The Bali captain was enough of an airman to realize that he was dealing with an information failure only - not an actual stall. No direct mention has been made of this, but he must have immediately identified the replacement angle-of-attack vane on his side as the likely culprit.
Wrong. How would the pilot know that? The pilot noticed intermitted automatic down trim. That failure mode was not in the flight manuals and pilot had no way to attribute it to an AoA sensor. The claim is also contradicted by the pilot's maintenance log entry:
After pulling up to the gate in Jakarta, the Bali captain informed a company mechanic about "the aircraft problem" and in the maintenance log noted only three anomalies - the captain's airspeed and altitude indication errors and the illumination of a warning light related to a system known as Feel Differential Pressure. That was it. Apparently the captain noted nothing about the failure of the newly installed angle-of-attack sensor, or the activation of the stick shaker, or the runaway trim, or the current position of the trim cutout switches. If true, it was hard to conclude anything other than that this was severe and grotesque negligence.
The captain noted nothing about the AoA sensor because he did not know that it failed.
The captian did mention a trim problem but he had not experienced a runaway trim. A classic runaway trim is continuously. An MCAS intervention like the captain experienced discontinues after 9 seconds. But the pilots on that flight did not even know that MCAS existed. The captain reported all the basic symptoms he experienced during that flight. A runaway was not one of them.
Langewiesche fails to mention, probably intentionally, the captain's additional entry in the maintenance log. The captain wrote:
"Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the wrong direction ...".
STS, the Speed Trim System, moves the stabilizer trim. It does that all the time but discontinuously during every normal flight. The pilot correctly described the symptoms of the incident as he perceived them. Those were not the symptoms of a continuously runaway stabilizer. But the pilot knew, and documented, that he experienced an intermitted trim problem. It was the mechanics responsibility to analyze the underlying error and to correct the system which is exactly what he did.
The author's "blame the pilots" attitude is well expressed in this paragraph:
Critics have since loudly blamed it for the difficulty in countering the MCAS when the system receives false indications of a stall. But the truth is that the MCAS is easy to counter - just flip the famous switches to kill it. Furthermore, when you have a maintenance log that shows the replacement of an angle-of-attack sensor two days before and then you have an associated stick shaker rattling away while the other stick shaker remains quiet, you do not need an idiot light to tell you what is going on. At any rate, the recognition of an angle-of-attack disagreement - however pilots do or do not come to it - has no bearing on this accident, so we will move on.
An AoA sensor failure and a following MCAS incident will cause all of the following: an unexpected autopilot shutdown, an airspeed warning, an attitude disagree warning, a stall warning and, after MCAS intervenes, also an over-speed warning. The control column rattles, a loud clacker goes off, several lights blink or go red, several flight instruments suddenly show crazy values. All this in a critical flight phase immediately after the start when the workload is already high.
It is this multitude of warnings, which each can have multiple causes, that startle a pilot and make it impossible to diagnose and correct within the 10 seconds that MCAS runs. To claim that "MCAS is easy to counter" is a gross misjudgment of a pilot's workload in such a critical situation.
After blaming the pilots Langewiesche bashes the foreign air safety regulators which are now investigating the MAX accidents:
According to sources familiar with both investigations, Boeing and the N.T.S.B. have been largely excluded and denied access to such basic evidence as the complete flight-data recordings and the audio from the cockpit.
It is a forlorn hope, but you might wish that investigators like those in Indonesia and Ethiopia would someday have the self-confidence to pursue full and transparent investigations and release all the raw data associated with the accidents.
I am not aware of an accident in the U.S. where the FAA investigators released "complete flight-data recordings and the audio from the cockpit" to foreign entities that were suspected to have caused the incident. Nor will the FAA "release all the raw data" associated with an accident. Certainly not before an investigation is finished.
Boeing screwed up by designing and installing a faulty systems that was unsafe. It did not even tell the pilots that MCAS existed. It still insists that the system's failure should not be trained in simulator type training. Boeing's failure and the FAA's negligence, not the pilots, caused two major accidents.
Nearly a year after the first incident Boeing has still not presented a solution that the FAA would accept. Meanwhile more safety critical issues on the 737 MAX were found for which Boeing has still not provided any acceptable solution.
But to Langewiesche this anyway all irrelevant. He closes his piece out with more "blame the pilots" whitewash of "poor Boeing":
The 737 Max remains grounded under impossibly close scrutiny, and any suggestion that this might be an overreaction, or that ulterior motives might be at play, or that the Indonesian and Ethiopian investigations might be inadequate, is dismissed summarily. To top it off, while the technical fixes to the MCAS have been accomplished, other barely related imperfections have been discovered and added to the airplane's woes. All signs are that the reintroduction of the 737 Max will be exceedingly difficult because of political and bureaucratic obstacles that are formidable and widespread. Who in a position of authority will say to the public that the airplane is safe?
I would if I were in such a position. What we had in the two downed airplanes was a textbook failure of airmanship. In broad daylight, these pilots couldn't decipher a variant of a simple runaway trim, and they ended up flying too fast at low altitude, neglecting to throttle back and leading their passengers over an aerodynamic edge into oblivion. They were the deciding factor here - not the MCAS, not the Max.
One wonders how much Boeing paid the author to assemble his screed.
Previous Moon of Alabama posts on Boeing 737 MAX issues:
Posted by b on September 18, 2019