Gregory Travis, a software developer and pilot for 30 years wrote a scathing report on the limitations of the 737, and the arrogance of software developers unfit to write airplane code.
Travis provides easy to understand explanations including a test you can do by sticking your hand out the window of a car to demonstrate stall speed.
Design shortcuts meant to make a new plane seem like an old, familiar one are to blame.
This was all about saving money. Boeing and the FAA pretend the 737-Max is the same aircraft as the original 737 that flew in 1967, over 50 years ago.
Travis was 3 years old at the time. Back then, the 737 was a smallish aircraft with smallish engines and relatively simple systems. The new 737 is large and complicated.
Boeing cut corners to save money. Cutting corners works until it fails spectacularly.
Aerodynamic and Software Malpractice
Please consider How the Boeing 737 Max Disaster Looks to a Software Developer. Emphasis is mine.
The original 737 had (by today’s standards) tiny little engines, which easily cleared the ground beneath the wings. As the 737 grew and was fitted with bigger engines, the clearance between the engines and the ground started to get a little…um, tight.
With the 737 Max, the situation became critical. The engines on the original 737 had a fan diameter (that of the intake blades on the engine) of just 100 centimeters (40 inches); those planned for the 737 Max have 176 cm. That’s a centerline difference of well over 30 cm (a foot), and you couldn’t “ovalize” the intake enough to hang the new engines beneath the wing without scraping the ground.
The solution was to extend the engine up and well in front of the wing. However, doing so also meant that the centerline of the engine’s thrust changed. Now, when the pilots applied power to the engine, the aircraft would have a significant propensity to “pitch up,” or raise its nose. This propensity to pitch up with power application thereby increased the risk that the airplane could stall when the pilots “punched it”
Worse still, because the engine nacelles were so far in front of the wing and so large, a power increase will cause them to actually produce lift, particularly at high angles of attack. So the nacelles make a bad problem worse.
I’ll say it again: In the 737 Max, the engine nacelles themselves can, at high angles of attack, work as a wing and produce lift. And the lift they produce is well ahead of the wing’s center of lift, meaning the nacelles will cause the 737 Max at a high angle of attack to go to a higher angle of attack. This is aerodynamic malpractice of the worst kind.
It violated that most ancient of aviation canons and probably violated the certification criteria of the U.S. Federal Aviation Administration. But instead of going back to the drawing board and getting the airframe hardware right, Boeing relied on something called the “Maneuvering Characteristics Augmentation System,” or MCAS.
It all comes down to money, and in this case, MCAS was the way for both Boeing and its customers to keep the money flowing in the right direction. The necessity to insist that the 737 Max was no different in flying characteristics, no different in systems, from any other 737 was the key to the 737 Max’s fleet fungibility. That’s probably also the reason why the documentation about the MCAS system was kept on the down-low.
Put in a change with too much visibility, particularly a change to the aircraft’s operating handbook or to pilot training, and someone—probably a pilot—would have piped up and said, “Hey. This doesn’t look like a 737 anymore.” And then the money would flow the wrong way.
When the flight computer trims the airplane to descend, because the MCAS system thinks it’s about to stall, a set of motors and jacks push the pilot’s control columns forward. It turns out that the Elevator Feel Computer can put a lot of force into that column—indeed, so much force that a human pilot can quickly become exhausted trying to pull the column back, trying to tell the computer that this really, really should not be happening.
MCAS is implemented in the flight management computer, even at times when the autopilot is turned off, when the pilots think they are flying the plane. In a fight between the flight management computer and human pilots over who is in charge, the computer will bite humans until they give up and (literally) die. Finally, there’s the need to keep the very existence of the MCAS system on the hush-hush lest someone say, “Hey, this isn’t your father’s 737,” and bank accounts start to suffer.
Those lines of code were no doubt created by people at the direction of managers.
In a pinch, a human pilot could just look out the windshield to confirm visually and directly that, no, the aircraft is not pitched up dangerously. That’s the ultimate check and should go directly to the pilot’s ultimate sovereignty. Unfortunately, the current implementation of MCAS denies that sovereignty. It denies the pilots the ability to respond to what’s before their own eyes.
In the MCAS system, the flight management computer is blind to any other evidence that it is wrong, including what the pilot sees with his own eyes and what he does when he desperately tries to pull back on the robotic control columns that are biting him, and his passengers, to death.
The people who wrote the code for the original MCAS system were obviously terribly far out of their league and did not know it. How can they can implement a software fix, much less give us any comfort that the rest of the flight management software is reliable?
So Boeing produced a dynamically unstable airframe, the 737 Max. That is big strike No. 1. Boeing then tried to mask the 737’s dynamic instability with a software system. Big strike No. 2. Finally, the software relied on systems known for their propensity to fail (angle-of-attack indicators) and did not appear to include even rudimentary provisions to cross-check the outputs of the angle-of-attack sensor against other sensors, or even the other angle-of-attack sensor. Big strike No. 3.
None of the above should have passed muster. It is likely that MCAS, originally added in the spirit of increasing safety, has now killed more people than it could have ever saved. It doesn’t need to be “fixed” with more complexity, more software. It needs to be removed altogether.
Numerous Bad Decisions at Every Stage
Ultimately 346 people are dead because of really bad decisions, software engineer arrogance, and Boeing’s pretense that the 737 Max is the same aircraft as 50 years ago.
It is incredible that the plane has two sensors but the system only uses one. A look out the window was enough to confirm the sensor was wrong.
Boeing also offered “cheap” versions of the aircraft without some controls. The two crashed flights were with the cheaper aircraft.
An experienced pilot with adequate training could have disengaged MACS but in one of the crashed flights, the pilot was desperately reading a manual trying to figure out how to do that.
Flight Stall Test
If you stick you hand out the window of a car and your hand is level to the ground. You have a low angle of attack. There is no lift. Tilt your hand a bit and you have lift. Your arm will rise.
When the angle of attack on the wing of an aircraft is too great the aircraft enters aerodynamic stall. The same thing happens with your hand out a car window.
At a steep enough angle your arm wants to flop down on the car door.
The MACS software overrides what a pilot can see by looking out the window.
Useless Manuals
If you need a manual to stop a plane from crashing mid-flight, the manual is useless. It’s already too late. The pilot had seconds in which to react. Yet, instead of requiring additional training, and alerting pilots of the dangers, Boeing put this stuff in a manual.
This was necessary as part of the pretense that a 737 is a 737 is a 737.
Mike “Mish” Shedlock
I agree with the article 100%. The sheer incompetence of boeing developers has to be called out. I have been writing software of all kinds for over 35 years and the mistakes I can see in the MCAS from the outside are staggering. There is no reason, other than total incompetence and clear inexperience, not immediately disengage the system as soon as the pilot applies a contrary force to the column. It’s basic precaution that a developer with any experience would have put in. There is no reason not to flash a giant warning to he pilot that the MCAS is trimming down and allowing a simple single cancel action. These are all basic feature of any software that can risk writing a wrong penny to the wrong account. And these geniuses couldn’t put a single safety measure in? And now the same incompetents want to fix the software that was put in to fix faulty hardware… anyone, again, with any experience could have told them to stop, stop and plan again.
Some typos in my post I’d like to fix, but I’m sure everyone gets the gist. – Remaining Anonymous.
I did try to edit out my typos, and correct some of the sentence structure to read correctly, but the edit did not go through. Apologies that I didn’t proof it before publishing, I was definitely angry regarding the matter as I wrote my post.
Email how you want it to read. I can correct it.
To everyone here who has defended the 737 max, who has disputed the author, or has said something along the lines of ” You dont know what you’re talking about, leave the engineering to engineers who know better”: I have news for you, I am an engineer, who spent most of my career in aerospace, and I worked for one of Boeing’s Contractors. I am intimately familiar with aerodynamics, aircraft design, and the corporate culture in question.
EVERYTHING outlined in the article is CORRECT. This aircraft should not be certified! No passenger aircraft should EVER be aerodynamically unstable. The center of lift should always be in close proximity to the center of gravity which almost universally should be somewhere around 1/4 of the chord back of the mean lifting surface. In a cessna with a straight leading edge this would literally mean ¼ of the wing chord back from the leading edge. There is SOME room to move this to adjust for certain preferred handling characteristics, or to account for Cargo and passenger distribution, BUT NEVER should a condition be conceivable where the plane can aerodynamically shift the center of lift be INFRONT or BEHIND the entire wing depending on AoA. SOME fighter jets do this for combat-specific maneuvers, but even with the fly-by-wire systems required to stabilize the shudder and maintain stability, the PILOT ALWAYS HAS DIRECT CONTROL OF THE AIRCRAFT’S MANEUVERS.
This is no fighter jet. Fighter jets are made for DANGER. Passenger jets are made for SAFETY. Again, even in fighter jets THE PILOT HAS CONTROL. NEVER under ANY CIRCUMSTANCE should a computer be able to override the pilot, or make a change the pilot is not aware of and indirectly in control of. To the moron suggesting this is the way of the future, again I’m an engineer and take it from me; there is NO SUCH THING as ARTIFICIAL INTELLIGENCE. AI is just a term for programs with extensive databases, resources, the ability to prioritize certain inputs based on preset conditions. Machine Learning is also just the ability for the program to recognize patterns and store them in a memory device accessed by the program. Truly there is nothing INTELLIGENT about it and self-driving cars and self-flying planes, whilst possible WILL NEVER be safe. IT is absolutely irresponsible to hand control over from true intelligence to a computer that may or may not have the ability to do something depending on whether the person who programmed it imagined every possible thing that could happen ever Reactions to unique circumstances must always be unique and only intelligence can handle that. Listen to Pilots, they are much closer to Engineers in their experience and knowledge than “Software Engineers”. Most of the software engineers out there, even the ones hired by Boeing ARE NOT engineers. Often they are people who learned how to code online, and haven’t the faintest engineering knowledge, but because of the crossover between their work, and that of computer/electrical/electronics engineers, they adopted the name. Programmers ARE NOT ENGINEERS. Again, Pilots are much closer. Further, most of the macho young grads working on these new planes are so high strung in their egos, that they act like Mark Zuckerberg with your lives instead of your privacy. There are certain truths about Aerodymanics and Physics that MUST be RESPECTED. You cannot counter physics with Software. Software doesn not change the density of air, the flow of turbulence, or the force of gravity. If you fuck with physics, physics will fuck you.
Again, I have worked for contractors of Boeing, not on this project, but on the 787. I can tell you first hand that the decision makers DO NOT LISTEN TO ENGINEERS, and they CONSTANTLY delegate Engineering responsibilitie to OTHER departments when Engineers raise flags. They work on attrition and suppress the voice of engineers who don’t fall in line.
I promise you, this plane IS NOT safe. IF you had the entire design of this thoroughly vetted by any single PE with an aerospace/aeronautics background they would refuse to stamp it.
And seriously, having any system on a plane the pilot cannot control, except for when a passenger pleases to flush the toilet is absolutely unacceptable. Pilots are Pilots for a reason, and we NEED them to continue to be pilots. We must respect them, and keep them up to speed. They should constantly be engaged by the aircraft they fly, so they continue to know how to fly.
To those who so readily embrace the replacement of humans with technology, I warn you: Devolution IS A THING. We are Technology. We are Impecible Technology, developed over millions of years. The ego trip of some IPhone loving fanboy who thinks that the toys of our last 200 years of tinkering can challenge billions of years of scientific laws refined by the universe to whom we are nothing, is bloody foolish.
first the pilots should fly the airplane, not the autopilot: turn the autopilot off and take over manually when there are problems !
Trust in yourself, never a computer.
It was not the first time that there were problems with this system…
Dear Mish,
Please note… Boeing must have been aware of this patchwork!
When they decided to compromise on the self-stabilizing design I described roughly in my post before to take advantage of the high economical high performance laminar airfoil profiles… combined with the larger engines on an unmodified airframe… and then to tame the resulting aggressive wing with the computer controlled elevator… who were feed by an unreliable sensor …. they also decided to place an AOA (angle of attack) sensor “disagree” indicator on the aircraft’s cockpit display.
But only as an expensive option for approx +-8000$ as far as I got to know!
To make you understand… that’s only a warning lamp on the pilot’s dashboard and a few wires. It’ macabre to charge you that for a lamp against your death!
Now, after the crashes they quickly decided to provide this indicator (so important for the pilots) free of charge.
Any thoughts?
Boeing already had a beautiful, advanced narrow-body airliner – the 757. (same fuselage dia. as the 737?) WHY didn’t they replace the 737 with a short-body version instead of strapping Ferrari engines on Granma’s Studebaker?
Production of the 757 ended in October 2004. Of course… all design plans are there but there is no active production line and tools has been re-allocated.
Using the 757 deign would have not provided much advantage time wise in the race with Airbus.
Dear Mish…
After very long time….15 years ago, we had a few chats about a matter here in the Middle East (where I am still in). At that time, some people had difficulties accepting the facts in one of my post. I really appreciated your understanding.
Since then I was rather occasional reader. But the 737 issue brought me back to chip in some of my experience. Anyhow, I am happy seeing that you having toughly carried on with your blog through the times.
Back to the 737, since I have spend a handful of years in the same business (in the presidential fleet of the country at that time) I fully understand what happened and I can only confirm what Gregory Travis is describing. However, I might have to add my 2 cents and a few important details to it.
Gregory is right… the main culprit is… that the Boeing management didn’t wanted to accept the fact that the time of the design of that air-frame had come. Everybody should remember the concept year of the 737 was when Gregory and me were born… 1964!!!
But now to the critical details. As Gregory is pointing out… the engines play a critical role.
By design the center of thrust of the engines is not perfectly in line with the cord line of the airfoil (pls see wiki -> airfoil) but between 2…5 degree negative. This can be noticed by all other aircrafts if you look at the nacelles/engines… they usually pointing a little down with their head.
Further at that time… the old 373 30 years ago was, as Gregory described it correctly, designed for the 2-spool, low-bypass jet engines. Hence the low entry fan diameter.
But… there is another culprit that Gregory did not mention – it’s the landing gear!!!
To be attractive for the airlines the maintenance costs have to be low. Of course, that’s common sense. The first generation passenger jet aircrafts had the engines mounted in the root of the wing (Comet, TU 104) or on the tail (Vickers VC10, MD80/90, DC9, Tupolev 134/154, Ilushin 62) both designs have proven awful to maintain.
I worked on a machine with tail engines and I can tell you it was a pain to maintain the engines standing on the ladder changing the filters and others overhead. Like changing a light bulb half an hour long…. try that!!
Airline personal loved the Boeing 737 because the engines were fixed on the wings with the thrust line approx 1.4m above ground which means the center line of the engine was at chest height and you could work on the auxiliaries normal standing with the hands straight forward.
To realize this, the landing gear has been kept short. Go to wiki look at the pictures for the 737 and then compare with the photos on wiki A320. You can clearly see how short landing gear of the 737 is.
Now… fitting a high bypass engine with larger fan would be easy possible… just enlarge the landing gear by 50-80 cm. However, catch 22… the landing gear retracts inwards and if you make the landing gear too large the wheels hit each other. Furthermore, the wheels will require space more inwards and that must be cut out from the airframe… but fuck… there is the central spant of the airframe which cannot be touched at all… otherwise the cabin will fold during flight.
(Again, see wiki 737 scroll down to the 4th picture “737-200 platform” which shows the aircraft at the flight from down. You will understand what I mean.)
And that created headache for the designers when they wanted to fit the new high bypass engines from 1986 onward.
(pls scroll down in wiki 737 to the section Engines… look at the picture comparing the three generations! You can see the slightly pointing down CFM56 flattened at the bottom but the CFM LEAP-1B much higher without pitch. Well… with the PW1000 the 737 would have become a vacuum cleaner.)
So, now comes the engineer and says… no problem we move the hinge points of the landing gear more outward then we can enlarge the landing gear and make space for the engines.
And here the money is popping up!!!
The hinge points of the landing gear are the most impact stressed elements on the whole aircraft!!! A change in the hinge points means you change the whole integrity of the wing! Getting approval from the FAA for that would require extensive simulations… prototype building… and crash test to failure!!! before approval. A lengthy process.
All that cost time and money… and airbus was ahead of time! Here and because of this the Boeing management said No… find another solution.
And so the engine has been raised as Gregory mentioned it and the negative angle in the thrust line flattened. By doing so the force vector on the wings have changed… and here the aerodynamic is joining the party.
An airfoil is not only creating lift… no, unfortunately also a pitching moment. So, for compensating and controlling that we need the elevator on the rear of the plane.
Further, as higher the angle of attack as higher is the pitching moment… but as higher the angle of attack is… the greater the drag that has to be overcome by the thrust of the engines.
Normally… if good designed the thrust vector of the engine (which is slightly negative to the cord line of the airfoil) will compensate a part of the pitching moment. Thus, as bigger the angle of attack as stronger the pitching moment will be but as bigger will be also the drag and so as higher trust from the engines is required that creates in return through the negative vector a higher counter momentum to the pitching moment and hence stabilizes the wing a bit.
The result will be a peaceful behavior of the wing (and the aircraft) at critically high angle of attacks – something that is ultimately desirable when you wanted to ship safely hundreds of passengers around.
Now… by changing the position of the engines and flattening of the negative angle between the thrust line and the cord line this counter momentum has been effectively reduced. Additionally on top of that as described by Gregory, the larger nacelles cause additional lift reducing the counter momentum further.
The result was an aggressive behavior of the wing in the critical angle of attack zone.
And now we have to understand the spirit of our present time. Wrapped in the prior unimaginable progress of the last 2 decades we tend to believe everything can be solved… with computers. Nobody wanted to accept the physical boundaries of the hardware anymore… no… nothing can stop us with the help of computers.
And so the idea to tame the aggressive wing with the computer controlled elevator was born.
The rest… Gregory is nailing it perfectly. I hope I have not bored you with this details…
Every major design changed aircraft should first be used only for cargo planes. After couple of years only it can carry human traffic.
We dont even test new medicines directly on humans.
I grant that publications by IEEE are reputable. I see no resume for this Gregory Travis with a quick internet search. He is a pilot. Pilot of what aircraft? Software developer: Software developer of what? The technical aspects of this article are beyond my capacity to judge. Did anyone else assist in the writing of this article. The final question: Is or has he been employed, reimbursed, compensated by plaintiff attorneys.
You must have been living under a rock these past few months. The very same analysis of the 737 crashes was offered up by multiple other sources. What Mr Travis has said is nothing new. Qualified or not, his analysis is broadly correct.
If it is nothing new, then why publish it? Skeptical of all initial “I’ve got the explanation” articles. These are complex systems. They may not have the explanation but only theories.
A pilot said….! Nonsense. I’m no pilot, raised in a mountaineer family, none the less, have height phobia (mild).
Look, this was all settled some 30yrs ago as I’ve stated in another session. 30yrs ago the airline industry was frightened sh…. They decided something had to be done about accidents. Commissioned a study for 1mill+, told the excavators: one year guys, this is good money, don’t waste it.
During the year there was a lot of teeth grinding, no results, no meaningful correlations, causality. THEN, a statistician noted something VERY interesting: here’s a stack of countries with best records on top down to the sh…iest records on the bottom. Nobody else saw it. What did he see?
RELIGION
At first the world airline industry was pee-ohed! When the industry was convinced the study had discovered the Holy Grail, they changed every manual out there.
Rest is history.
LACK of religion is the point I guess you’re missing.
The advanced countries have cultures based on rationality and have relegated their iron-age sky-fairy legends to weddings, funerals and presidential campaigns.(US)
More nonsense. My item is REAL. (although I immed felt the upvote was sarcasm)! I prefer folks search this stuff on their own but if you wish, reply, and I will take the pains to explain in detail
One more 737 MAX crash and Boeing is toast, brought down by MBA-type suits with polished speeches, zero understanding of engineering and focused on “maximizing shareholder value” nonsense.
The quality lapses at Boeing (also on other models, such as 787) are shocking. I lost confidence in this company.
My understanding and view are both very simple. Boeing built a plane that has aerodynamic problems due to the position of its engines. Instead of redesigning a completely new plane that has the correct height to accommodate the new bigger engines, they opted to design a software to fix the stalling problem that is created by the engine position problem. Problem which should not have been approved by the FAA.
Boeing should cut it losses short by going back to the drawing board.
As an industry expert, I have flown the 737 max as a line captain and it was my 12 th type rating. This being said, i can tell you that the MCAS is the tip of the iceberg, this airplane is majorly flawed not only aerodynamically but also technically.
Never before have I encountered such strange behaviour from an airliner.
Two thing jump to me.
AOA don’t fail, we have a series of failure of this part, it is the beginning of the problem.
Pilots are now younger and more inexperienced, a bad stall indication system will only exacerbate the situation. Adding a light or more information to digest will only delay the response.
The automation is very very weak compare to other Boeing products and especially to its arch rival Airbus.
I have flown the Boeing 767 which was desing in theory 30 years passed and it is more advanced that the 737 max. Why? Simply because the 737 max is actually an older design and has shown the limits of what this fuselage could bring. It’s like having an IPhone 10 that you have to plug in a phone jack to get internet.
Besides, I have seen autopilot kicking off for no reason and weird roll behaviour in some instances.
I asked to be removed from flying the 737 max ever again. I don’t trust this airplane and I have 17000 hours as a line Captain and have been an instructor for close to half this time. Why should the public trust the airplane? I don’t.
I appreciate your first hand impression…
Anyhow… 40 years ago… as a teen before starting my flight lesions I found an old book in our town library… the life of the Horton Brothers – based on interviews with them. With a lot of photos of their planes. And I was impressed by the foreword…
“For everything nature created… it found the simplest solution.”
If i recall correctly, Airbus had a similar problem with its 300-600 when the addition of more powerful engines (without an increase in size of tail plane) caused unexpected pitch-up angles when having to execute a ‘go-around’ – in auto-pilot mode. This panicked pilots and caused them to push the nose down which was then countered by the auto-pilot. The result was a stall and, at least, 2 cashes
My name is Sean Frayling from England.
Following the news on the Eithiopian airlines Boeing 737 MAX 8 plane crash, I like to put a message across to not just Boeing, but any other aircraft Manufacture such as Airbus.
Although it is not confirmed, I am led to believe in a problem with a new feature on the 737 max series. (ANTI STALL SYSTEM).
I will start from when the first commercial jet airliners took to the skies. The Comet was grounded for a period of time due to several crash’s unexplained. Later, the Comets were back in service with unanswered questions. It took another accident for investigator’s to discover a fuselage problem and consider the comet to be unsafe to fly.
At the time of Comet dominating the skies, and falling from the skies, Boeing was already in production. It was too late for Comet to redeem themselves financially, among other reasons.
Since Boeing started dominating the skies, there have still been a lot of accidents over the years, which have been investigated, and problems have been solved. Not just Boeing, but also Commercial Douglas planes. I could go on forever about aviation history in terms of accidents.
My point is, when there is a problem causing planes to fall, it seems that it takes a few accidents to consider that a plane maybe unsafe to fly.
The new Boeing 737 MAX series is no acception.
If we look at flight safety history, there is a pattern of accidents on particular aircraft’s. Each accident leads to flight safety improvement. Over the years, planes have been getting safer and safer to fly with modern technology and human knowledge. But there has to be a point when planes do not need new technology or improvements in terms of flight safety for passengers and crew. Only keep planes well maintained. I believe that time has come.
The year 2017 is recorded as the safest year to fly with no major accident. Year 2018 should’nt be any different. The new Boeing 737 MAX series Lion airlines changed that theory in August, and again now just recently with Eithiopian airlines.
This would suggest that planes are now as they should be, and that they only need regular maintenance. Introducing new technology or new features pose a life threatening risk in the sky, as we have little knowledge on new technology as we are still learning about new technology.
Boeing are confident to say that the 737 MAX series is still safe to fly, yet 2 new planes fall from the sky allegedly caused by the same problem. A new anti stall system. This new feature is proving to fail as it forces the plane’s nose down during take off.
This begs the question, how many planes need to crash before the planes are considered unsafe to fly? How many people have to die before the planes are considered unsafe to fly?
One crash is one too many. It’s like Boeing are trying to fix something that is not broken. If there have not been any accidents in the past 2 years, why introduce a new plane with new technology that could potentially go wrong? As in this case has gone wrong.
I believe it’s now time to stop trying to improve flight’s, and just keep the current fleet maintained without the MAX series.
Although Boeing promise to do a software upgrade on the max series, even after testing, its not guaranteed it will work for long during flights.
A good example in the early ninetys prooved this with a rudder problem bringing 2 planes down and almost a third plane. Although the rudder was tested after the 2 accidents, it still failed on a third plane and the rudder was able to work in reverse by itself. Since the rudder has been re -designed, there has been no problems. This is just 1 example.
I follow these stories very closely, and very happy to see flight safety at its best. Disappointed to see the MAX series ruin this reputation.
Its understood that the MAX series is grounded worldwide, for understandable reasons.
The question now is, can Boeing afford to risk hundreds of live’s with a new feature? My answer is no. Boeing have a very good fleet now with very good reputation. We do not need the MAX series.
Planes do not need an anti stall system, as pilots have a stall preceder to follow safely if a stall accurs.
Its possible that the anti stall system could be conflicting with the planes performance during take off with the anti stall system thinking the plane is in a stall because the plane is low as it takes off.
Personally, on my future flight’s, I would refuse to board if I see a MAX series on the tarmac, and that I would request a flight change at the airport, on the grounds of the MAX series reputation.
I think it’s to do with fuel efficiency hence new planes. It’d work if we have no concerns over environment, noise nor fuel costs, we’d happily fly old planes designs that’s working and not broken. So, unfortunately yes we do have to innovate and improve, Boeing, airbus, anyone. Or we be still cruising around in ocean liners
In terms of fuel efficiency, there is always room for improvement. I am talking about new software and cockpit instruments. Old or new planes do not need new instruments or software. New technology needs to be understood for many years before putting everyones life at risk in the sky. Note that 2017 was the safest year for flying. This was before the new max series started flying commercially. The anti stall system should be removed, and the max fleet grounded permanently. Many travellers have lost trust in Boeing. This could be a bigger problem if airlines are still buying Boeing, and travelers refuse to board. Airlines will lose millions, and Boeing risk going bust.
Mish, you do your readers a disservice. What Gregory Travis wrote was an opinion or essay and NOT a report. I read his entire article over a week before you picked it up, and I think “scathing” is a bit strong as well. I would encourage anyone who gets this far to read the original work rather thin this review. Mr. Travis gives a reasonable explanation of SOME of the things that probably went wrong inside Boeing specific to software ment to improve questionable but understandable poor decisions, things that may have lead to the two crashes in question. It is an enlightening and well written read. Please go read the original and not this hack review.
No expert on this but would this aircraft glide if it ran out of fuel or lost engines due to a bird strike or volcanic ash as a lot have proved they can
Yes but it would take longer to pitch up hands off and everything in neutral as it has a foreshortened static margin … Loads of other aircraft employ this as device for enhanced manouverability
And to reduce trim drag
I’m sure someone thought to make the struts @ a foot longer. Naa too complicated, software is easier. BTW I’m Comm Pilot, A&P, FE Turbo Jet, 5630 hrs tt. Not a newb.
I believe they did consider making the struts a foot longer however that would have necessitated an entire redesign of the aircraft/fuselage rendering it NOT a 737. Big problem. Better to just fit it all in as best you can and save yourself time and money 😉
I completely agree with the article. Only Boeing management will disagree. No software fixes required. Total hardware change required from blueprint stage.
I see a few people in the comments are blaming the pilots. I dont see it that way. All that matters is did the aircraft crash or not? If you are trying to sell an aircraft like this, high volume, to be sold all over the world, it needs to be stable and simple to use. Evidence suggests that it is neither.
I dont see an easy way out for Boeing here. A software fix is hugely risky. If another plane were to go down after such a fix, it could be the end of Boeing, who could trust them?
The other alternative is to redesign the plane. It looks to me as if a redesign to accommodate bigger engines will make the plane’s characteristics very different to the current 737. Sometimes though, you have to bite the bullet and do the right thing. John Harrison changed his design philosophy and went from H3 to H4, a decision that changed the world. I think Boeing need to take a deep breath and consider a big change of their own.
Ideally you want a plane that is so safe and easy to fly than anyone can fly it. As a second choice you want an outstanding, well-trained pilot that can fly anything. Even better would be both, but the worst option is neither.
While I agree that Boeing should accept much of the blame in your argument, let’s not forget that the FAA (THE regulator for this industry) allowed all of this to occur on their watch. The same regulator who will not allow private pilots to earn income from transporting people and forces all of us to fly on one of a few conglomerates also didn’t care one iota about our safety. Sure, none of the US piloted Max’s have crashed, yet, but regardless of that this aircraft is inherently unsafe to fly. A regulator is supposed to care about safety and soundness for their industry not the profits of a single US manufacturer. All of this is indicative of the ongoing corruption in the Federal government which only serves it’s corporate lobbyist masters.
Isn’t it ironic that Boeing actually promoted on YouTube their inovative way ti extend the main gear height to give the airframe a higher stance for takeoff/landing by mechanically extending the oleo struts during these phases of flight and then compressing the height issue in order to fit the gear up into the wheel well since they can’t relocate the pivot point on the wing without raising flags with the FAA and creating a “new” aircraft, type. I think the 737 airframe has reached its limitations for expansion and Boeing needs to revisit the drawing board. This is my observation from fixing 737’s for18+ years….
The KC-135R (re-engined KC-135 with CFM56 engines and equipped with an APU on the aft main deck to start the engines as cartridge starters are not possible on the CFM56 for alert ops) has a permanent restriction that 3000 pounds of fuel must be carried and not offloaded in the forward fuel tanks, ie: the fuel is unusable. Due to the fact that the heavier CFM56’s and their pylons mount them considerably more forward than the engines the plane was originally configured with.
You hit it right on Leoxes
I agree to your conclusion, the strikes of failures (2&3) but not the argument. Many crash occurred when no visibility of the outside is possible, thus the instrument flying skills needed by pilots. And there are more planes nowadays that’s inherently unstable and requires help to stabilise it to fly, most famously in military planes F117 and the B2. I doubt the list will decrease over time with push for economy in fuel and the plane and training etc. Increasing year on year. So, an aerodynamically unstable plane doesn’t means it’s unflyable, just need to be better designed to make it safer. And agree Boeing made an epic fail on this. The hard to override is terrible, insane decision, the one sensor reliance is simply ignoring all those crashes with blocked peto tubes, icing sensors history. Utterly disappointing on their part.
Why is it nobody is saying anything about Boeing taking the counter weight out of the tail section which made the center of gravity change 10 feet forward of the engine intakes at take off. With the engines already set well forward of the wings, at a stall even at altitude it would be almost impossible to recover. This is why in the old 737 center of gravity was center of wing at take off and could recover from a stall.
Who said that Boeing didn’t take the counterweight out of the tail? This is basic stuff that even the most junior engineer would consider
Good article and points to the baseline truth, Boeing didn’t want to break the chain of keeping it a 737. If they did then they couldn’t continue sales of a “new” model to their steady customers as the same type. Creating a new model causes new type ratings, sperate fleets, instructors, examiners, pay scales, etc. All things the steady customer doesn’t want. Keep it looking the same to get it past certification and then you can sell lots of them and make your shareholders and wall street happy!
Boeing should just swallow their pride and correct the flaws in the aerodynamic flaws in the airframe. This simply means that even those claiming safe operation, the airframe experiences unnecessarily high stresses under normal operational conditions. Once this is not corrected, we shall begin to see issues of early fatigue a few years down the road leading to similar disasters. Accept it’s a new plane, give it a new name and correct the dynamic stability issues but not with just software.
An airline pilot and plane mechanic adds some explanations about the MCAS system in his videos. He said that the Ethiopian airline plane was doing 500 knots and that it would have been very difficult to trim the plane manually at that speed. please see
Wrong video ! Nothing about mcas or 500 knots.
The link is actually goes to a series of videos that analyse the issue.
It was only doing 500 knots once in a nosedive.
Due to the huge surface area of the trim surface – 737s can be untrimmable at c.300 knots when fighting the elevators.
Nobody seems to have noticed that the airlines flying the most Max8 aircraft have had no crashes, for a person claiming to be a pilot the author doesn’t mention the situations that the crashes had in common. I do believe Boeing should have been prohibited from passing the Max aircraft off as common type rated aircraft, that would have skewed economics but may have saved lives. That’s not a certainty because the two crashes were in airlines with low proficiency crews, anyone afraid to fly a Max 8 or 9 aircraft should look at how many people die on American highway’s annually.
No US crew has yet faced MCAS failure. So no conclusion to be drawn.
There have been 3 such failures: 2 killed everyone aboard, 1 was saved with intervention from a 3rd pilot.
What a brilliant article. Quite well balanced and it explained things I didn’t understand about what happened and how the plane was made and operates in flight. I’m a software developer so it was nice to understand how things work.
There were design issues I think from many different engineering, financial, and managerial backgrounds you can’t just blame one discipline.
I’m very unhappy about the use of software and automation in planes, especially as a modification to an old plane. But looks like it could be cars next!!!
Nothing intrinsically wrong with old, good designs: take the C-130 Hercules – 1953! (if my memory serves).
Still in production, constantly updated, still a world-beater.
at time like this.. i missed my flight simulator teacher, Rod Machado and how he told me how to recover a 737 stalling plane. thanks Rod.
The SYSTEMS engineers are at fault. They are the ones who model the flight dynamics and flow requirements down to mechanical, software, and electrical engineers.
Unless management overrides their advice and threatens everyone who says anything “negative”.
Absolutely!
I will still fly MAX 8 once this aircraft gets back into the air
Able company behaving with
negligent morality.
Well ..who wants to take a plane 10,000 ft high that is proved to have so many issues.. and actually killed 350 people ..only idiot..
Let’s take this an example, how many people fly on the dreamliner? Millions
Boeing 787 dreamliner was grounded for a couple years, while they figure out the problem and fixed it.
I wouldn’t be surprised that the MAX 8 would be grounded for couple years
I’m sorry, but Mr. Travis is a fool with an axe to grind. Or he’s getting a nice check from Airbus. I too am a pilot. I have friends that fly for the majors, and they specifically fly the MAX. Any uncommanded pitch trim is dealt with the same way, you simply switch off the electric trim. Two switches right below the throttles. Doesn’t matter if the uncommanded change in pitch trim is MCAS, or a runaway pitch trim motor, the result is exactly the same. Turn the system off. The aircraft can be flown safely, and easily by hand, using the manual trim wheel. This is basic pilot skill 101. Everyone is taught pitch&power the first day they are in an airplane. MCAS was designed to deal with unexpected pitch up due to the new forward position of the engines. If Boeing is guilty of anything it’s producing faulty sensors. Why anyone would listen to some tool with an axe to grind is beyond me. Go find a MAX pilot and ask them. I know two, and the info I have is straight from them. Not filtered through the talking heads of the media.
Dont attack the person, just respond to his claims. Is this a good or bad designed aircraft ? You just found Boeing making faulty sensors, how about not training pilots about the limits of MCAS system ? How about Boeing selling some of the planes with extras like a MCAS sensor warning lamp, when it should have been a standard safety feature in all planes. Who knows may be he is not a fool, may be you are getting a nice check from Boeing.
Why do the two MAX pilots I know, know about the system?. Its in the manual, I have seen the manual, and they have trained for the failure. Boeing doesn’t train pilots, the airlines do. Yeah, sure buddy, I get a fat check from Boeing for posting. But the tool of an author is lilly white…. Sure.
As I recall, one of the pilots that crashed had only 100 hours of experience. I’m not sure on the other one, but it would seem that pilot training is certainly part of the issue.
i m not pilot, but if it just because two switch below throttles, why its claimed 300+ lifes? seems like an easy talk, like turning off an auto wipers but its not rain. does it engineer to blame or pilot to blame? or both??
“Those lines of code were no doubt created by people at the direction of managers.”
This is the truth. I have been a software developer and implementer for 30 plus years and no individual contributor does anything outside the direction of management.. I’m also instrument-rated but only in Cessnas.
This is in no way a software developer fault but a management fault if indeed the stories are true.
Airbus also has a history of computer faults such as the Air France Crash from South America to Paris or the Airbus crash at the Paris Air Show.
I have wondered why the pilots just couldn’t look out the window or look at the attitude indicator or look at the pitch and Power instruments and determine whether or not they were in his stall. However if the computers were in control it’s all for naught
Modern aircraft can operate safely although dynamically unstable. As a stick and rudder pilot, I like to believe that any airplane should be able to be landed dead stick, yet economics and performance matter. If a fighter, for example, gets shot down by a SAM, then it doesn’t matter if it’s dynamically stable. So, the latest fighters depend on computers to maintain attitude. The trade off makes sense. In transport class aircraft, there are legitimately similar trade offs. We gradually have grown to accept the greater risk posed by twin engines relative to three or four engines for overseas operations, in the interest of fuel efficiency. And we can grow to accept the risk of poor dynamic stability. It is not inherently “malpractice “ because the capabilities of technology have advanced. The Max will fly and safely.
The article seems balanced to me. Whatever he says makes sense.
Read the blackbox transcripts. They tried the manual trim wheel, but couldn’t get a response — to much counter force (because of the speed) and too many rotations required. Boeing and others have already commented to the effect that the one thing they could/should have done differently is turn down the full throttle.
MCAS failure is NOT ‘the same’ as trim runaway though, is it?
Because MCAS failure comes with a surprise package of stall warning, deafening stick shaker and air-speed disagree warnings.
And every time you pull the stick back to keep the nose up while figuring out why all hell has let loose – MCAS sneaks on a bit more nose-down. Then a bit more …
I believe the MCAS is overridden with the trim in the column for a period if time. So the pilot would correct with that first. Then the MCAS would trigger again, after 10 seconds or so. It is still an uncommanded change in trim pitch. This is basic airmanship. Airspeed? Good. Ground speed? Good. Attitude? Good. Power setting? Good. Fly the airplane. Ignore the rest.
So why hasn’t it been a problem for the US carriers? The people I know that work for them, knew exactly what the MCAS is, and trained for it. It’s in the manual. If you’d like me to get the page it’s on, I will. Expecting a small airline from a third world country to have equivalent training is ridiculous. They cant, and they don’t. That is reality. Their maintenance and training is substandard. Everyone in the aviation industry knows this.
Incompetence Boeing & Complacency FAA led to lost of innocent lives at the expense of profitability and arrogance
When plane manufacturer do their own self-certification with FAA consent, disasters occur inevitably
Much of this article applies to the future, and to self-driving cars. Suppose you are in the car, and a look out the window tells you that the auto-pilot is making an error. Can you quickly take control back without having to read a manual? Oh, wait, there may not even be manual controls, or a pilot.
Or, we can take the reverse view. Why aren’t planes self-flying? Should they even have pilots? Perhaps a self-flying plane would be easier than a self driving car as there is no traffic to deal with, no erratic drivers prone to make unpredictable decisions on the spur of the moment.
touche!
The chances that interpreting and responding to an angle of attack sensor, is more difficult than interpreting and responding to being engaged in a running gunbattle through downtown Manhattan while ferrying Barron Trump to school, is pretty much zero.
ZorroBandito A self-flying plane would not have traffic or erratic other drivers. It would also have no passengers if you ask me. I want a living pilot on board, who hits the ground first.
Read the whole story. Seems like click bait to me. MCAS is pretty easy to disable, 2 toggle switches. This is what the ride along pilot did on the lion air flight prior to the fatal flight. Why wasn’t that info shared with the flight crew of the next flight? Oh, those switches are there before MCAS was ever in the plane. Yes understanding the plane is important. I agree that they should have considered more than a single AOA sensor. But don’t use hindsight to throw Boeing under the bus.
Actually the software worked properly and as designed…
The problem was the faulty input data from the Angle of Attack Indicator,,, a simplistic mechanical device…..
Correct. There are loads of aircraft with intentionally shortened static stability margins in pitch to increase maneuverability, these days. The F15 like the 737 max has too much mass too far out from the aerodynamic center and in fact every aircraft design is a series of compromises. The original writer is wrong in that the more forward raised thrust line does not pitch the aircraft nose up at high power settings but he is correct to acknowledge this resultant effect from a forward nacelle placement altering the overall lift distribution, which in turn reduced the static margin (distance from the aerodynamic center to the cg).
What to do with the remaining 737 Max? Boeing should give a huge price discount since it isn’t a proper designed product. Stop taking new order for this plane. By price cutting enable the unfortunate airlines setting low ticket price so the passengers have at least some return for taking the risk of taking this plane.
so if the plane is mechanically unstable by design and software is required to ensure system stability, it seems like there will be a lot of compensation going on which will cause undo wear and stress on components. i cant see myself getting on a plane that is mechanically unstable in its base design.
Read the whole of Gregory Travis’ article instead of Mish’s (bordering on copyright infringement) quotation of the original. Some planes are specifically designed to have some inherent instability (e.g. fighter planes, stunt planes). So depends in what kind of airplane you are getting into. If you went to one of those “Top Gun” experience flight centers to do some mock dogfighting, you may want that airplane that handles like a sports car instead of like a station wagon.
Efficiency is another benefactor of freeing designers from requirements of stability. It’s very fundamantal. Substituting the heavy, deadweight keel of a traditional sailboat for movable ballast, swing keels and trapezes, yields much more speed for the same power. Even just standing or walking, is made much more efficient by removing the requirement for the kind of huge, heavy feet big enough to prevent you from falling over without dynamic correction….
All commercial planes have mechanical instabilities. The major one is the Dutch Roll Moment. With the plane at level flight, constant pilot input, and no feedback system closing the loop; the plane will start to roll to one side and the nose pitch down.
yes but those are during steady state flying conditions where the forces are minimal…drift correction. Takeoff is a transient condition where the forces are huge and a system that has to correct for forces to fight “over lift” may accelerate the wear on components depending on how many cycles they were engineered to.
Sounds like a possible disgruntled writer. The 737Max has flown well over 40,000 flights over the past 2+ years with these two incidents and after the first one we learned that a pilot riding in the jump seat apparently overrode the flight crew and told them how to correct the issue which they did successfully. HMMM. Why didn’t they know that and be did?
I’m going to agree with you on the disgruntled writer part. As much as I agree on more and more corporations becoming all about the all mighty dollar, I have to disagree with the entirety of this article.
I guess if you’re not in the aviation industry, things are a little different looking on the outside.
The author suggests that since the nacelles were moved forward, this was a major design flaw. A design change we saw in the 1980’s, when the -300,-400 and -500 series were released. So it hasn’t been an issue till now?
You also suggest that you can ‘just look out the window’. Well of course you can, assuming the weather is VMC.
Airline manufacturers are in the business of creating safe aircraft. I suggest you do a slight bit of research before you write articles like these. Even a basic Wikipedia read would have helped.
I have to support your point that moving forward of the engine is NOT the major flaw… you are right the -300,-400 and -500 series have it and even the Airbus models have it too.
To be precise, the more forward position of the engine is even positive… because with the weight of the engine and the negative angle between thrust vector and cord line of the airfoil it increases the force vector (like a lever) created by the engine mount on the wing that compensates the pitch momentum of the airfoil.
By doing so it actually de-loads the elevator (which is good).
The critical act was to raise the engine relative to the cord line of the airfoil (instead of redesigning the landing gear) and reducing the negative angle I described above. This is the culprit that actually reduces the force vector created by the engine mount on the wing and makes the whole arrangement ineffective for managing the pitch momentum of the airfoil.
As a result, the load on the elevator increases – which was proven afterwards by the simulator test with the Swedish pilots who were barely able to move the trim wheel manually.
In last crash, Ethiopian airlines, pilot did everything as per Boeing recommendation (cut of the switch) after Lion Air crashed. And still, it didn’t work. So….
You think this is a new problem? This type of automation problem goes back at least a decade, and it isn’t even just a Boeing problem. This is in my opinion a little political as well. Here’s a recent story about Airbus.
Big Strike #4: It would have been incredibly simple to build redundancy and fault tolerance into the MCAS software to turn it off (without a manual pilot process), think literally a few lines of code. The arrogance was in the approval of the system design specification not the coding itself.
Depending on how aerodynamically unstable this seemingly serially butchered and jerry rigged airframe really is, it could be darned near unflyable without constant software correction….
It continues to make absolutely no sense to me for Boeing engineers not to have duplexed inputs to this critical system. There is a profound difference in actual system failure rates between one device with 99.99% uptime and two such devices in parallel: A single device gives you 53 minutes downtime per year, sounds pretty good unless it’s just started on your flight, whereas two such devices acting in parallel gives 31 seconds per year downtime, a more than 99.4% reduction in system failure window.
I’ve been in a lot of mtbf catfights over the years, and I can’t imagine ever losing one this straight up, and mine never sent anyone home in a casket if I lost…just locked screens by the thousands, cleared parking lots and made you wish you were dead.
I sooner believe an awshit happened somewhere in the MLC system than that a group of avionics experts sat around a table one day and agreed that single-point=of-failure was the smart way to go on this.
I think that you are forgetting two other aspects of their decision parameters: the first was that the failure/malfunction condition was categorized as “dangerous”, not “catastrophic”. My understanding is that if it were the latter, then yes, they would have required 2 inputs instead of just 1. The second is that in the back of their minds, they were thinking that the system could always be turned off, and that the standard operating procedure for dealing with uncommanded attitude changes is to turn off the automatic trim system.
Yes, both decisions made by software engineers, instead of seasoned pilots. I’m quite sure that if a pilot were there, things may have gone differently.
“I’m quite sure that if a pilot were there, things may have gone differently.”
Which resolves to: If pilots need to tell machines what to do, they need to learn to express themselves such that machines can understand them.
No. It resolves to when doing systems analysis, somebody needs to see the big picture. I’ve been in similar meetings where the minutea is nitpicked to hell, but it is often for nought if people don’t realize what the stakes are. I bet that during those meetings, the only things being discussed was whether the requirements were fulfilled, and if everything operated within constraints.Nobody bothered asking, “what happens in a Garbage In scenario? Garbage out?” or “What happens if the pilot forgets to turn off the system during an emergency?”
Actually, I’m under the impression that somebody may have asked the latter question regard emergencies, but I bet they had blinders on and were only thinking of a real stall emergency, rather than a “fake stall” that only exists in the mind of the MCAS system (due to bad inputs).
“It resolves to when doing systems analysis, somebody needs to see the big picture.”
“Somebody” can “see the big picture” all he wants. But unless that somebody can formulate what he is seeing in a way that the machine charged with executing it can understand, the machine won’t be able to execute what he is seeing.
Boeing must re-engineer the frame of the plane..
Make the plane higher and fit the engines comfortably under the wings. Software fixing remains a shortcut…and too risky!
The problem with that is that the longer, and therefore heavier, landing gear will also change the center of gravity of the plane. Then do you fix that by once again having software to automatically trim the plane for the difference in CG and “feel” as compared to a standard 737 feel?
And then how do you account for pilots who are used to particular visual cues when they are landing an airplane that is X feet closer to the ground? Do passengers just have to suffer through hard landings each time a pilot forgets they are landing a plane that will touchdown sooner than the other 737s that they are used to?
When a pilot cannot disengage an autopilot or other such flight control augmentation system and fly the airplane manually, the potential for an uncontrolled crash escalates. Modern airplanes are the most complex systems in the world, and when passengers get on board, they rightly assume that the pilots are in total control of the aircraft. Apparently, not so. The controls are controlled by computer chips, servos and fly-by-wire. Perhaps they have become too expensive and too complicated and a method of simplifying the redundancy needs to be found.
I wonder if they tested these failures in the simulator?