Another Indonesian aircraft down

[3WE]

…We…

Have you written a sternly-worded letter to 737 operators?

[Evan]

Right. I am sure that the 10x safety improvement has nothing to do with improvements done in the 737. It's all that humans make fewer mistakes these days and are less prone to hijackings or suicide. I am sure that the 737-200-adv would have 1 fatal hull loss accident every 10,000,000 take offs if it were operating today with current pilots.

There are far less hijackings these days, thanks to better security. Most importantly, lessons have been learned and safety cultures have improved. Stable approach criteria has made those dive-and-drive debacles a thing of the past. GPS and EGPWS has made CFIT less common. TCAS and more flight phases on more precise automation has almost eliminated midairs. There's a lot to this that has little to do with the airplane type.

So what? Do we go ahead and permanently ground all 737's out there now? Do we keep Boeing from completing the MAX product line that will (note future tense) be an excellent business for Boeing and the airlines and also have an excellent safety record, about as good as any? Exactly what would that accomplish?

We further the investigation, look for weakness in the system, add redundancy, make it more robust and issue an AD with timely but reasonable compliance times. If the CTSM had worked, the autothrottle would have disengaged before things got too out of hand and the pilots would have most likely realized the problem and recovered.

Better still, we recognize the folly in this and get back to the business of designing the world's most advanced aeroplanes.

[Gabriel]

Again, what do these gross stats reveal specifically about airframe safety? Most of those were due to pilot error unrelated to design issues. Some were hijackings or murdercide. Some were destroyed on the ground. What is important from the mindset of improving aviation safety is addressing known design issues that can result in disaster.

Right. I am sure that the 10x safety improvement has nothing to do with improvements done in the 737. It's all that humans make fewer mistakes these days and are less prone to hijackings or suicide. I am sure that the 737-200-adv would have 1 fatal hull loss accident every 10,000,000 take offs if it were operating today with current pilots.

The way you put design issues and pilots issues in separate boxes is very disconnected from reality.

MCAS should have grounded the -Max after the first crash. It was certainly going to happen again.

I agree 100%.

And here we have a known condition where the CTSM failed to work as designed and the investigation cannot explain why. So this could very well happen again.

Possibly. I still don't understand the issue well enough or what actions will be taken as lesson learned. But let's grant it.
Again, note that a not very conspicuous engine roll back would have likely ended the same way under these conditions. So eliminating this "throttle cable binding" thing is not enough if you don't want this to happen again.

So what? Do we go ahead and permanently ground all 737's out there now? Do we keep Boeing from completing the MAX product line that will (note future tense) be an excellent business for Boeing and the airlines and also have an excellent safety record, about as good as any? Exactly what would that accomplish?

[Evan]

Look at the trend:

Again, what do these gross stats reveal specifically about airframe safety? Most of those were due to pilot error unrelated to design issues. Some were hijackings or murdercide. Some were destroyed on the ground. What is important from the mindset of improving aviation safety is addressing known design issues that can result in disaster. This is how AD's work. They don't look at an issue and say, "well, yes, but look at the overall safety record..." They look at an issue and say, "This is unsafe and must be made safe by this deadline." The key to aviation safefy does not lie in statistical analysis; it lies in foresight, in preventative vision. MCAS should have grounded the -Max after the first crash. It was certainly going to happen again.

And here we have a known condition where the CTSM failed to work as designed and the investigation cannot explain why. So this could very well happen again.

It will require the perfect storm of cavalier maintenance, low grade piloting and a pre-2003 build NG, but that doesn't exactly reduce it to unlikely these days.

[BoeingBobby]

There was a day when we just flew the aircraft. Cable or hydraulic controlled. Not to long before I retired I was flying a Citation X with a young new co-pilot into LAS. Descending thru FL180 I turned the auto-pilot off. Tops where about 15,000, bottoms about 1500. In a startled voice he said "are you going to hand fly thru the clouds?" I said "yes".

I used to love the sound of almost terror in their voice and the look of bewilderment when I would hand fly the 74 to cruise altitude on a nice day and well rested.

[kent olsen]

There was a day when we just flew the aircraft. Cable or hydraulic controlled. Not to long before I retired I was flying a Citation X with a young new co-pilot into LAS. Descending thru FL180 I turned the auto-pilot off. Tops where about 15,000, bottoms about 1500. In a startled voice he said "are you going to hand fly thru the clouds?" I said "yes".

[Gabriel]

Evan, again? I acknowledged your point and agree with almost everything that you said above (except things like "lack of visual / tactile feedback being unimportant because pilots rarely hold or observe the levers except during departure and approach", really? Not that these are the most critical phases in a flight anyway).

The question is how much impact does it actually have in real-life operation. And the answer is unmeasurably small. The best answer you gave is that there is a difference but it is so small that is undetectable behind the noise of all reasons for accidents mixed.

I absolutely want Boeing to replace the 737 (and 757) with a modern airliner. With FBW, simple throttle mechanisms, envelope protections, and EICAS. I do think that Boeing was lazy and prioritized short-term profits over engineering and even safety considerations.
But I will not say that the 737 should be retired now, or that the MAX should not exist, or anything like that. The NG has 25 years in service with an excellent safety record. The MAX will do the same, or likely better.

You don't want to compare with the A320? Fine. Let's compare it with the 737. Look at the trend:

Hull loss / fatal hull loss (accidents per million departures)

737 original: 1.81 / 0.91
737 classic: 0.79 / 0.26
737 NG: 0.18 / 0.09 (exactly 10-fold improvement over the original)
737 MAX: 3.76 / 3.76 (data includes up to 2021, today the number of MAX flights more than doubled and there were no new hull losses, the A320 Neo has 0 / 0, both families accumulated less than 1 million hours at the time of the report, so a single hull loss would blow the numbers by more than an order of magnitude compared with the previous generation).

Of course the MAX started very bad with 2 hull losses, both of them fatal, in a type of accident that will never happen again, when the type was very young. These 2 in my opinion belong to a different bag (it was a criminal design, not a direct consequence of keeping modernizing the 737, could have happened with the NG, with any other current plane, or with a true 737 replacement, had the design been done so criminally negligently). But even if you do count them, in 25 years the numbers will look better than the NG (which has with 22 hull losses in 25 years with 7000+ in service, while the MAX is just starting its life and already has 5000+ orders). and it will look similar to other competing airplanes (of which I cannot think of many other than the A320 Neo family)

[Evan]

1 in 10 million is the gold standard. Certification requirements prohibit catastrophic single-point failures unless they are extremely unlikely, and the likelihood threshold for that qualification is 1 in 10 million flights. Fatal hull losses in the 737 and A320 are at about 8 per 100 millón flight, which is slightly better than 1 in 10 million. And, according to you, most of them are not design-related neither in Airbus (where you claim it is zero) nor in the 737.

Let's put this in perspective:

Let's not... I didn't intend for this to get into a Gabrielesque discussion on statistics. No matter what the stats say, three full-fatality crashes set in motion by system malfunctions that—on their own—caused upsets, says it all. Nor did I intend it to be specifically an A320 vs 737 battle.

It's more interesting than that. This is about opposing philosophies driving autothrottle (autothrust) design: Analog vs Robotic vs Digital. It's all about fail-operational design.

In the beginning, there was hydromechanical engine throttle control connected to the thrust levers by cable runs. Analog EEC was first introduced to a passenger jet on the Concorde, as was full-flight autothrottle. Instead of physical cable runs, throttle control was done through thrust lever resolvers and wired connection to the EEC units. But Concorde was well ahead of its time. AFAIK, Boeings had cable-connected hydromechanical controls at least until FADEC was incorporated into the 757 in 1984, and the 777 was the first to be designed without cable runs. But these 'transitional' aircraft designs of the 1970's had analog EEC as a 'supervisory control system', driven by cables but modulated through the autothrottle by electronics. This is robotic autothrottle. As such, it operated by using servo-motors to move the mechanically-connected thrust levers. If a throttle linkage became jammed, the corresponding autothrottle command would be jammed as well. This is not fail-operational, nor is it fail-passive if the opposing autothrottle is still operating during a large commanded thrust adjustment, and quick pilot intervention is required to avoid a roll upset.

The Airbus A300 (and subsequently, the A310) operated this way as well. But, with the advent of the FBW A320, Airbus chose to evolve the Concorde EEC approach to a digital FADEC system. The obvious benefit is that it is a fail-operational design. The thrust levers lack the cables or clutches that cause jams and, should the assembly become jammed in some other way without pilot input (which is almost certainly impossible), the autothrottle will continue to function normally. If the levers jam when the pilot is moving a thrust lever manually, the jam and TL positions are clearly obvious to the pilot.

This sheds light on the age-old question: 'Why don't the thrust levers back-drive on the Airbus common cockpit?'.

The downside is a lack of visual and tactile feedback. I believe Airbus saw this as unimportant since the pilots rarely hold or observe the levers except during departure and approach, making most of their thrust adjustments as speed, flight path or mode changes via the MCP, and a visual indication of the commanded TLA is provided on the primary engine readings along with the autothrust mode in the FMA. That should provide plenty of situational awareness when using autothrust.

The other, extremely rare downside is Thrust Lock if the automation suddenly fails. But then the pilots have all the above cues plus an ECAM priority action prompt and a CRM procedure that—if they are Airbus pilots—they will have been trained on.

Again, my ideal solution is to backdrive the levers in a mechanically simple and reliable manner whereby a jam is next to impossible and will not inhibit the A/T thrust commands. But, if that isn't possible, given the risk made glaringly apparent by this crash, I favor the current Airbus design in tems of safety.

[TeeVee]

blah blah blah. gabe, get this straight: evan is an airbus fanboy. he hates boeing's philosophy and their business-minded culture (i agree on the latter). you can cite facts, stats, math, probability and sensibility. evan is not going to agree or acquiesce.

[Gabriel]

You surprise me. Aviation safety is so very very very strict because 1 fatal hull loss in five million flights is still a terrible tragedy. This is why I don't see the value in gross statistics, but only in the statistics that matter the most. We cannot tolerate an airframe design that has the proven potential to cause upset on its own. At all.

1 in 10 million is the gold standard. Certification requirements prohibit catastrophic single-point failures unless they are extremely unlikely, and the likelihood threshold for that qualification is 1 in 10 million flights. Fatal hull losses in the 737 and A320 are at about 8 per 100 millón flight, which is slightly better than 1 in 10 million. And, according to you, most of them are not design-related neither in Airbus (where you claim it is zero) nor in the 737.

Let's put this in perspective: 0.08 per million means that if you take 2 flights per day every single day of your life since you are born, on average you would become involved in your first fatal hull loss at the age of 17000 years old. And that doesn't even mean that you would necessarily die, since many fatal hull loss accidents have survivors, sometimes almost everybody survives a fatal airplane crash (think for example Asiana's 777 at SFO). And then chances are that the accident was caused by design are slim. Even in a 737 NG or MAX evolved from an archaic design of the 60's.

This is why the certification authorities demanded so much assurance from Airbus in developing the first FBW in a commercial airliner. The expected rates of failure leading to auto-upset or loss of controllability had to be virtually zero. And they have been.

I consider a small fraction of 8 every 100 million to be virtually zero. Feel free to disagree.

I can make it clear and simple and save you all that followed: I am ONLY talking about design issues that can result in the plane causing the upset, not the pilot reaction. Pilot error is another thing altogether. But, as I've said before about MCAS, you can never tolerate a design feature that creates upset, because that creates pilot error.

So what about upsets caused by single-event upsets? To which electronic digital systems are susceptible but not analog electronic, mechanical or hydraulic systems? Every time you opt for a digital system instead of an "older" one, you are opening the door.

Not to mention that the place where you draw the line is arbitrary. If the pilot causes the upset with the help of a confusing modern interface that makes that mistake more likely, how is that any better than the system causing the upset and the pilot not reacting to it correctly?

And, again, would an engine roll back to which the pilots don't react correctly qualify under you capricious boundaries?

The A330 in the hands of AF447 did not (significantly) depart from level flight by itself. If the pilots had followed correct procedure, it never would have. No double standard there.

If the pilots of this thread's accident would have followed procedure, the upset would have never happened either.

Center of gravity issues were one reason. The other reason was that the new position of the nacelles created added lift that could exacerbate the pitch-up moment at critically high angle-of-attack.

Of course the engineers foresaw this. But the suits just said, "It has to work! Just fix it somehow!" [wipes sweat from brow]

Story of the 737.

I think you didn't read that part correctly. Please go back and read it again, CG in itself has nothing to do. Engine placement relative to the CG, both longitudinally and vertically, has to do.

Would MCAS or something similar NOT have been needed had the engines been placed further back and further down?

A) No
B) Yes
C) Maybe

Are systems similar to MCAS (that automatically add trim nose-down trim at high AoAs and in response to thrust-induced pitch moment) installed in clean-sheet XXI-century-worthy design types?

A) No
B) Yes
C) Maybe

Could any of these systems in any of these planes be susceptible to fatal failure modes if designed.... in an unsafe manner in a corrupted environment?

A) No
B) Yes
C) Maybe

[Evan]

1- Hull losses are extremely rate, hull losses where the airplane design is a significant factor are very rare among the extremely rare hull losses, and it is in that niche of a niche that Airbus performs better than the 737 o that. Ok, I can live with that.

You surprise me. Aviation safety is so very very very strict because 1 fatal hull loss in five million flights is still a terrible tragedy. This is why I don't see the value in gross statistics, but only in the statistics that matter the most. We cannot tolerate an airframe design that has the proven potential to cause upset on its own. At all.

This is why the certification authorities demanded so much assurance from Airbus in developing the first FBW in a commerical airliner. The expected rates of failure leading to auto-upset or loss of controllability had to be virtually zero. And they have been.

2- This is the part where we diverge. When pilots get confused by something due to the 737 being "old school" or something adapted to keep up with the "old school" origin. It is the plane. When a pilot says goodbye to the world uttering "and what it is doing now", it is the pilot. Not fair.

I can make it clear and simple and save you all that followed: I am ONLY talking about design issues that can result in the plane causing the upset, not the pilot reaction. Pilot error is another thing altogether. But, as I've said before about MCAS, you can never tolerate a design feature that creates upset, because that creates pilot error.

Oh no, but [AF447] was 100% pilot screw up. The modern airplane design had nothing to do.

The A330 in the hands of AF447 did not (significantly) depart from level flight by itself. If the pilots had followed correct procedure, it never would have. No double standard there.

Why was MCAS needed again?

Center of gravity issues were one reason. The other reason was that the new position of the nacelles created added lift that could exacerbate the pitch-up moment at critically high angle-of-attack.

Of course the engineers foresaw this. But the suits just said, "It has to work! Just fix it somehow!" [wipes sweat from brow]

Story of the 737.

[Gabriel]

I take your word for it that A320 and B737 hull losses per flight cycle are closely matched.

Don't take my worry. I provided link to the quite-reliable source.

I accept the reality that, ALL THINGS CONSIDERED, they enjoy a nearly equal safety record. This is because hull loses are rarely the fault of the aircraft itself.

The reality, however, is also that hull losses (or the upset that leads to them) are much more the fault of the airplane on the B737, whereas I don't know of any that are the fault of the A320.

So...

1- Hull losses are extremely rate, hull losses where the airplane design is a significant factor are very rare among the extremely rare hull losses, and it is in that niche of a niche that Airbus performs better than the 737 o that. Ok, I can live with that.

And it is my understanding that the ones involving the B737 often involve the things added or adapted to keep it 'modern'.

2- This is the part where we diverge. When pilots get confused by something due to the 737 being "old school" or something adapted to keep up with the "old school" origin. It is the plane. When a pilot says goodbye to the world uttering "and what it is doing now", it is the pilot. Not fair.

Yes, the upset subject of this thread may have happened due to some less than perfect adaptation of the old 737 to the new world.
But, as I said before, it is still just an engine rolling back. An engine may roll back for a lot of different issues. The pilot flying a twin jet is supposed to be competent in flying it single engine.

One thing that I dislike much more than this feature, though, is having the autopilot suddenly quitting without need and without early warning. And that is something that A and B (and everybody else) have in common. That brings us to....

Don't waste your time trying to convince me that the performance of the AF 447 pilots was pathetic. It was. They would have likely crashed a carousel airplane if given the chance. But:
- Installed pitot were more prone to ice blockage than other pitots available.
- The plane didn't have synthetic airspeed. The manufacturer made a safety feature optional.
- The autopilot just let go at the worst moment, when the fit hit the sham, when it didn't need to (if it had been better designed).
- To follow the procedures, the pilots should have set climb thrust by moving the thrust levers out of the climb detent.
- Pilots very likely thought that it was ok to pull up hardly because you cannot stall an Airbus.
- The flight director (that the pilots should have turned off) gave spurious commands, including pull-up commands.
- Interconnected yokes might have helped prevent dual inputs and gain awareness by the pilot monitoring of what the pilot flying was doing (not a guarantee, though, as another serious AF incident demonstrated this year, this time with a yoky 777)
- The movable horizontal stabilizer accompanied the mainly-pull-up commands by moving all the way up, a hair short of its full-up stop. That made a full nose-down input not be that much nose-down unless you kept it there to let the stabilizer unwind. By the way, the 777 and 787, also FBY, do not do that. Neither does the 737.
- The stall warning (in certain extreme conditions) is silent when you increase the AoA and starts to scream STALL STALL when you reduce the AoA.

Tell me that there is nothing in this design that could have been made to make such a situation less confusing for the pilots and the chance of such an accident less likely.
Oh no, but that was 100% pilot screw up. The modern airplane design had nothing to do.

A pilot reacts incorrectly by a system-failure-induced engine rol back?
Oh, no. THERE it is mainly due to old crappy design that Boeing tries to keep alive with stupid magic tricks.

Double standard anyone?

- MCAS should never have been needed in the first place.

Do you really KNOW that?

Why was MCAS needed again?

There was not enough room between the wings and the runway to fit these very- high-diameter very-high-bypass turbofan engines. So they had to move the engines forward. The more ahead the engines are from the GC, the mode pitch-up moment they create (especially at high angles of attack).

What would have been a logical solution? 757-like long legs to make more room and instead of placing the engines further ahead, place them further down. Because engines that are further down under the CG do not produce a stronger pitch-up moment? Especially at slow speeds which tend to correlate with a higher AoA?

And, again, 777, 787, and all the Axxx, ALL have autotrims that compensate for engne-induced pitching moment. They are especially useful and active when suddenly adding high amounts of thrust at slow speed / high AoA.

In any of these modern XXI century clean sheet types, develop the autortim... how was that?

in an unsafe manner in a corrupted environment

... and you may very well end up with a MCAS copycat accident, even in a true clean-sheet XXI century airplane. No archaism required.

[Evan]

Dude, I am not ignoring your point. I acknowledged it. It is you who are ignoring mine. I answered you a question like 20 times and you refuse to answer it.

Your line of thinking seems to make sense, but is inconsistent with reality. I am sorry but reality wins.

I take your word for it that A320 and B737 hull losses per flight cycle are closely matched. I accept the reality that, ALL THINGS CONSIDERED, they enjoy a nearly equal safety record. This is because hull loses are rarely the fault of the aircraft itself.

The reality, however, is also that hull losses (or the upset that leads to them) are much more the fault of the airplane on the B737, whereas I don't know of any that are the fault of the A320. And it is my understanding that the ones involving the B737 often involve the things added or adapted to keep it 'modern'.

And we clearly don't agree on MCAS. At all. I thought we agreed that the original design and certification was criminal and people should be jailed.

We agree on that. I extend it further. I think the people who derailed the Y1 replacement for short-term stock performance and made the rushed and corrupted -Max program necessary—the people who poisoned the culture at Boeing for their own greed—are criminal and should be jailed.

But these are two different things:

- MCAS was developed in an unsafe manner in a corrupted environment
- MCAS should never have been needed in the first place.

[Gabriel]

Dude, I am not ignoring your point. I acknowledged it. It is you who are ignoring mine. I answered you a question like 20 times and you refuse to answer it.

Your line of thinking seems to make sense, but is inconsistent with reality. I am sorry but reality wins.

And we clearly don't agree on MCAS. At all. I thought we agreed that the original design and certification was criminal and people should be jailed.

[Evan]

The evolution also happened in the 737. The NG and MAX have little to do with the -100 and -200 (especially pre-adv).

You're either missing my point or ignoring it. The 737 evolved awkwardly, and does (the -NG at least) still have a lot to do with the original, as cerfified airframe. The issue in this case is that it still uses cables and pulleys that could (and did) bind on occasion, causing the autothrottle to malfunction and leading to stealthy asymmetrical thrust conditions. It occurred frequently enough to require a software safeguard and an AD to install it. Airframes designed after the advent of EEC use rigid links with less complexity.

As airframe design has evolved, it has become more reliable and maintainable through less mechanical complexity. That is one of the core benefits of EEC and FBW.

The 737, on the other hand, has relied on a sometimes overly-complex merging of legacy mechanical aspects and systemic fixes to evolve. I once posted here detailed diagrams of the complex mechanics of the empenage involved in the rudder hardover crashes. Boeing lawyers had them removed. If you're trying to market a 1960's design as a modern airliner, I can understand why.

The 200-Adv got upgraded to the Sperry SP-177 toward the end of its production run. It got Cat-III capabilty in 1982. In terms of autoflight, not a lot changed between then and 2003, when the NG got its first truly modern Rockwell Collins autoflight system and a rudder channel that could compensate for thrust asymmetry (and Cat-IIIb).

My point is that the NG was pushing it a bit far. The -Max was just desperation and should never have happened. They really should have phased out the 737 in the 90's.

3? Are you counting the 2 MCAS ones? That one was because the MCAS was criminally designed and certified, not an intrinsic fault of the airframe.

Adding complexity adds risk of failure, including the risk of design shortcomings and oversights and poor maintenance. For systems that can cause upsets, bewilder pilots and/or inhibit pilot control, that's only an acceptable tradeoff when it is unavoidably needed. A modern airframe with gear height for high-bypass fans would not hve needed this added complexity and therefore wuld not have crashed as a result of it. So yes, I'm counting those. It's the point I'm making.

You are cherry picking and deciding where you want to draw the line between what is a design issue and what is gross pilot error.

As I said, I'm drawing the line at crashes resulting from systems or system failures that DIRECTLY caused flight path upsets that were challenging or impossible to recover from.

AF447 was upset by pilot inputs. The plane responded correctly to those inputs. The same is true of AirAsia 8401.

TAM 3054 was egregious pilot error. The L thrust lever was left in CL. The thrust asymmetry was caused by the pilots, not the plane. And, as you know, a hand is required on the thrust levers on final so don't talk to me about visual and tactile feedback in this case.