NYT: How Boeing’s Responsibility in a Deadly Crash ‘Got Buried’
Thread Starter
Join Date: Dec 2016
Location: Manchester
Posts: 58
Likes: 0
Received 0 Likes
on
0 Posts
NYT: How Boeing’s Responsibility in a Deadly Crash ‘Got Buried’
After a Boeing 737 crashed near Amsterdam more than a decade ago, the Dutch investigators focused blame on the pilots for failing to react properly when an automated system malfunctioned and caused the plane to plummet into a field, killing nine people.The fault was hardly the crew’s alone, however. Decisions by Boeing, including risky design choices and faulty safety assessments, also contributed to the accident on the Turkish Airlines flight. But the Dutch Safety Board either excluded or played down criticisms of the manufacturer in its final report after pushback from a team of Americans that included Boeing and federal safety officials, documents and interviews show.
Join Date: Jan 2020
Location: 900m
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
Same story on BBC news page quoting NYT concerning "suppressed data" from the Turkish NG, AMS Feb 2009 investigation.
They talk of a "single sensor" having had an input into the ATS - as far as I can see they mean the RA input.
Interestingly the left RA input was used for ATS speed control whether R or L system is selected. In the initial report BBC says that the crew may have discounted the Left RA failure, thinking it irrelevant while using ATS from the right side. Doesn't excuse monitoring IAS of course. Apparently the source of RA input was not made clear in the FOM.
I know it was on the MD-80. Left RA was mandatory for a Cat 111 approach for that reason.
They are hitting the single sensor aspect and drawing "striking" parallels to the Max AoA input case.
They talk of a "single sensor" having had an input into the ATS - as far as I can see they mean the RA input.
Interestingly the left RA input was used for ATS speed control whether R or L system is selected. In the initial report BBC says that the crew may have discounted the Left RA failure, thinking it irrelevant while using ATS from the right side. Doesn't excuse monitoring IAS of course. Apparently the source of RA input was not made clear in the FOM.
I know it was on the MD-80. Left RA was mandatory for a Cat 111 approach for that reason.
They are hitting the single sensor aspect and drawing "striking" parallels to the Max AoA input case.
Last edited by Twitter; 20th Jan 2020 at 13:46. Reason: to get rid of unwanted bolding
There is a fair bit of commonality with the gap between expected performance and actual performance of the crew in the THY1951 accident and the MAX losses. At first blush a simplistic view is that it has to be a deficient crew, and yet, these crews are correctly certificated by their respective regulators, as was the crew of AF447.
The emphasis and reliance on automation may benefit accuracy but it does increase response time when a fault occurs while in a monitoring state. For the MAX cases, the crew were specifically hand flying the aircraft in an abnormal condition, for which an argument may be made that the ability to manually operate the aircraft in the abnormal case was adversely affected due to the extent of reliance in normal ops on automation. I actually don't believe that is a strong coupling, would expect that the fundamental problem is the underlying variability of humans to cope with an anomaly that is not within their direct recognition primed responses and associated decisions. Analysis of a new condition takes time, and sods law is that a defensive mechanism for surprise events will be good on most occasions, but sometimes it will be inadequate or compounding of the problem. Consider the AA DC 10 accident at KORD, AA191; the Co pilot recognised the basic condition of a severe engine failure, and entered into his trained response, which was problematic on that day, as the LH slat had lost hydraulics, and had retracted, so diligently flying V2 as a target resulted in loss of control. In Amsterdam, the crew were conducting training which is an elevated risk condition, and were given a high and close pattern that preoccupied them. Yes, they had IAS indicators, noise and various cues to the fact that the automatics were not functioning as expected (loss [ramping to zero] of LH RALT resulted in the ATR entering the idle function which is unannunciated, and as the throttles were already back at idle, the crew were unaware that the throttle was not going to wake up and maintain commanded approach speed when the sink rate reduced on capturing the glide path). In AMS, the event deteriorated quite rapidly, and the crew did not recognise the signs of decaying energy. Essentially the crew were outside the loop (Boyd's OODA) For the MAX, both crews were outside the loop, and circumstances resulted in their attempts to get to grips with the problem being unsuccessful. As an industry we have spent a lot of time on warm fuzzy CRM issues, but have had inadequate emphasis on SA maintenance, recognition of SA loss, and associated training, including strategies to recover SA. The basic problem is akin to taking a knife to a gun fight. In the case of the MAX, uniquely, the actual failure mode was novel to the crews experience, it wasn't even a known system, and while the OEM suggests that the response would be consistent with a runaway trim system, that is only partially true, running away at 4 times the recovery trim rate is a surprise package, as is the removal of the yoke limit switch cutouts. Having an intermittent runaway is not something that occurs in the world otherwise of trims, and for the ET case, the recovery process added a new surprise with the problems of manual trim being effectively frozen by the elevator loads, which resulted in the crew putting the stab cutout switches back to normal, with disastrous results.
The average pilot is not well equipped today to cope with a novel, time critical, highly dynamic event. Much like Chernobyl reactor technicians. Working out what is trying to kill you in the absence of information is a challenge, and those occasions need to be minimised, with crews given training in SA matters. The good news is that these are exceptional events when the underlying engineering issues are resolved. There is no simple panacea to the issue of improving reliability of the human-machine system performance.
The emphasis and reliance on automation may benefit accuracy but it does increase response time when a fault occurs while in a monitoring state. For the MAX cases, the crew were specifically hand flying the aircraft in an abnormal condition, for which an argument may be made that the ability to manually operate the aircraft in the abnormal case was adversely affected due to the extent of reliance in normal ops on automation. I actually don't believe that is a strong coupling, would expect that the fundamental problem is the underlying variability of humans to cope with an anomaly that is not within their direct recognition primed responses and associated decisions. Analysis of a new condition takes time, and sods law is that a defensive mechanism for surprise events will be good on most occasions, but sometimes it will be inadequate or compounding of the problem. Consider the AA DC 10 accident at KORD, AA191; the Co pilot recognised the basic condition of a severe engine failure, and entered into his trained response, which was problematic on that day, as the LH slat had lost hydraulics, and had retracted, so diligently flying V2 as a target resulted in loss of control. In Amsterdam, the crew were conducting training which is an elevated risk condition, and were given a high and close pattern that preoccupied them. Yes, they had IAS indicators, noise and various cues to the fact that the automatics were not functioning as expected (loss [ramping to zero] of LH RALT resulted in the ATR entering the idle function which is unannunciated, and as the throttles were already back at idle, the crew were unaware that the throttle was not going to wake up and maintain commanded approach speed when the sink rate reduced on capturing the glide path). In AMS, the event deteriorated quite rapidly, and the crew did not recognise the signs of decaying energy. Essentially the crew were outside the loop (Boyd's OODA) For the MAX, both crews were outside the loop, and circumstances resulted in their attempts to get to grips with the problem being unsuccessful. As an industry we have spent a lot of time on warm fuzzy CRM issues, but have had inadequate emphasis on SA maintenance, recognition of SA loss, and associated training, including strategies to recover SA. The basic problem is akin to taking a knife to a gun fight. In the case of the MAX, uniquely, the actual failure mode was novel to the crews experience, it wasn't even a known system, and while the OEM suggests that the response would be consistent with a runaway trim system, that is only partially true, running away at 4 times the recovery trim rate is a surprise package, as is the removal of the yoke limit switch cutouts. Having an intermittent runaway is not something that occurs in the world otherwise of trims, and for the ET case, the recovery process added a new surprise with the problems of manual trim being effectively frozen by the elevator loads, which resulted in the crew putting the stab cutout switches back to normal, with disastrous results.
The average pilot is not well equipped today to cope with a novel, time critical, highly dynamic event. Much like Chernobyl reactor technicians. Working out what is trying to kill you in the absence of information is a challenge, and those occasions need to be minimised, with crews given training in SA matters. The good news is that these are exceptional events when the underlying engineering issues are resolved. There is no simple panacea to the issue of improving reliability of the human-machine system performance.
Last edited by fdr; 20th Jan 2020 at 14:43.
The pain of hindsight
Hindsight itself is not painful; it is the subsequent realisation that lessons were not learnt, advice not heeded, nor actions taken.
The NYT article is timely, and ‘unusually’ accurate and to the point, in comparison with some media reviews.
Full accident report: http://reports.aviation-safety.net/2...738_TC-JGE.pdf
Appendix B: Comments of parties involved - NTSB / Boeing, (Page 140) provides insight to the review process and particularly the theme of blame the pilots, checklists, procedures; ‘we have flow this in the M Cab and our pilots were able to recover the aircraft’. ~ Walter Mitty.
The response to remark #1 - was a timely ‘put down’ of the NTSB / Boeing’s opening distraction that reporting format reduces safety impact and lessons learnt, even more so for the Max. ~ Delusion.
Appendix M: Simulator Tests (after this accident), (Page 201)
‘Evaluation of the aerodynamic performance data showed that once the aircraft stalled (approximately 5 seconds after the onset of stick shaker) there was insufficient altitude for the airplane to be successfully recovered. Therefore, the post stall recovery flight regime was not investigated during the M-Cab simulation tests.’
The NYT article, and the accident report, should reinforce the wake up call emerging from the Max saga. Not specifically directed Boeing, FAA, NTSB, but for world manufacturing, regulation, investigation and operations.
Woods and Dekker, http://www.humanfactors.lth.se/filea...Dekker2001.pdf
http://www98.griffith.edu.au/dspace/...pdf?sequence=1
and for info: https://pure.uvt.nl/portal/files/773...01_09_2015.pdf
“case studies to show the interweaving of organizational and individual journeys, each of which began with the strength to inquire and to challenge assumptions.”
Is it possible to get a copy, or at least view the ‘Dekker report’. Noting its intended confidentiality, perhaps via PM.
Alternatively as a bold safety statement, publishing the report anonymously with the objective of learning and changing even at this late stage.
The NYT article is timely, and ‘unusually’ accurate and to the point, in comparison with some media reviews.
Full accident report: http://reports.aviation-safety.net/2...738_TC-JGE.pdf
Appendix B: Comments of parties involved - NTSB / Boeing, (Page 140) provides insight to the review process and particularly the theme of blame the pilots, checklists, procedures; ‘we have flow this in the M Cab and our pilots were able to recover the aircraft’. ~ Walter Mitty.
The response to remark #1 - was a timely ‘put down’ of the NTSB / Boeing’s opening distraction that reporting format reduces safety impact and lessons learnt, even more so for the Max. ~ Delusion.
Appendix M: Simulator Tests (after this accident), (Page 201)
‘Evaluation of the aerodynamic performance data showed that once the aircraft stalled (approximately 5 seconds after the onset of stick shaker) there was insufficient altitude for the airplane to be successfully recovered. Therefore, the post stall recovery flight regime was not investigated during the M-Cab simulation tests.’
The NYT article, and the accident report, should reinforce the wake up call emerging from the Max saga. Not specifically directed Boeing, FAA, NTSB, but for world manufacturing, regulation, investigation and operations.
Woods and Dekker, http://www.humanfactors.lth.se/filea...Dekker2001.pdf
http://www98.griffith.edu.au/dspace/...pdf?sequence=1
and for info: https://pure.uvt.nl/portal/files/773...01_09_2015.pdf
“case studies to show the interweaving of organizational and individual journeys, each of which began with the strength to inquire and to challenge assumptions.”
Is it possible to get a copy, or at least view the ‘Dekker report’. Noting its intended confidentiality, perhaps via PM.
Alternatively as a bold safety statement, publishing the report anonymously with the objective of learning and changing even at this late stage.
Last edited by alf5071h; 24th Jan 2020 at 14:46. Reason: Link update
Join Date: Jun 2019
Location: Tdot
Posts: 48
Likes: 0
Received 0 Likes
on
0 Posts
The average pilot is not well equipped today to cope with a novel, time critical, highly dynamic event. Much like Chernobyl reactor technicians. Working out what is trying to kill you in the absence of information is a challenge, and those occasions need to be minimised, with crews given training in SA matters.
The way to mitigate that is to include the human style responses into the training and develop systems to minimize the effect startle factor. Eg. We train for V1 engine failures, but rarely do we train for the bird strike, compressor stall at v1 failure. So the first time you hear the massive bang is when it happens in real life. But look at the reports and videos. The evidence points to this type of failure as a primary way an engine will fail at takeoff. Not just a flameout or fadec rollback.
Join Date: Aug 2002
Location: Castletown
Posts: 241
Likes: 0
Received 0 Likes
on
0 Posts
The RA was mentioned in the FCOM but it was very easy to miss. The same single source issue is also relevant to the 737 autobrake system in that it uses the L IRS for deceleration rates. Again the cut to training foot prints across type ratings ensures less systems understanding compared with the way type ratings used to be taught.
It is time safety was placed at the top of the Corporate tree instead of huge operating profits. Training is expensive but accidents aren't cheap either and then there is the loss of life ,which can never be replaced with money from law suits.
It is time safety was placed at the top of the Corporate tree instead of huge operating profits. Training is expensive but accidents aren't cheap either and then there is the loss of life ,which can never be replaced with money from law suits.
Join Date: Jun 2008
Location: Cambridge UK
Posts: 192
Likes: 0
Received 0 Likes
on
0 Posts
I always wondered why there was no real discussion about the s/w using an RA reading that was basically "off scale".
As a s/w engineer I always felt a sense of professional guilt that that the developers missed that one.
As a s/w engineer I always felt a sense of professional guilt that that the developers missed that one.
Join Date: Mar 2009
Location: Ottawa, Canada
Posts: 67
Likes: 0
Received 0 Likes
on
0 Posts
Bottom line on this accident folks: three pilots allowed the airspeed to fall 34 KIAS below the selected reference speed (110 vs 144 at 500 feet AGL). Don't blame the automatics folks, it is the pilots' responsibility to maintain a safe airspeed.
Join Date: Apr 2010
Location: Europe
Posts: 57
Likes: 0
Received 0 Likes
on
0 Posts
The average pilot is not well equipped today to cope with a novel, time critical, highly dynamic event. Much like Chernobyl reactor technicians. Working out what is trying to kill you in the absence of information is a challenge, and those occasions need to be minimised, with crews given training in SA matters. The good news is that these are exceptional events when the underlying engineering issues are resolved.
This article gives a good overview of the facts immediately preceding the Chernobyl accident, this article gives a bit more background on RMBK reactors, and this is a rather long official report (in English) into the matter.
There is a telling quotation from that last report:
1-5.2. The misguidedness of the practice of transferring emergency protection functions to the human operator owing to the lack of appropriate engineered safety features was highlighted by the accident itself: the combination of design deficiencies and the non-total reliability of human operators brought about the disaster.
The personnel were unaware of some of the dangerous features of the reactor and, therefore, did not realize the consequences of the violations. This fact in itself demonstrates the lack of safety culture, not so much on the part of the personnel, but rather on the part of the reactor designers and the operating organization.
"An operator must never be placed in a situation which an engineer has not previously analysed. An engineer must never analyse a situation without observing an operator's reaction to it"
Join Date: Sep 2014
Location: UK
Posts: 98
Likes: 0
Received 0 Likes
on
0 Posts
Level 2 thinking means considering why those people made a mistake, and how to prevent it.
Perhaps the level 2 thinking involves a bit of 'airmanship. Many years ago I was taught to guard the controls below Fl100/10,000ft. Also when approaching level off certainly within 1000 ft. If you.put your hand on the thrust levers you will feel them move, similarly with the yoke. Its all basic stuff, when you fly a light aircraft you guard the throttle, so why oh why don't we do it on large aircraft these days.
I see every day young and not so young modern pilots ignoring the controls, because the autopilot is in. Is it really that hard.
Training has to change as we really are becoming Children of the Magenta line.
I see every day young and not so young modern pilots ignoring the controls, because the autopilot is in. Is it really that hard.
Training has to change as we really are becoming Children of the Magenta line.
Join Date: Dec 2018
Location: Canada
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Dec 2018
Location: Canada
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
right rant over.
Perhaps the level 2 thinking involves a bit of 'airmanship. Many years ago I was taught to guard the controls below Fl100/10,000ft. Also when approaching level off certainly within 1000 ft. If you.put your hand on the thrust levers you will feel them move, similarly with the yoke. Its all basic stuff, when you fly a light aircraft you guard the throttle, so why oh why don't we do it on large aircraft these days.
I see every day young and not so young modern pilots ignoring the controls, because the autopilot is in. Is it really that hard.
Training has to change as we really are becoming Children of the Magenta line.
I see every day young and not so young modern pilots ignoring the controls, because the autopilot is in. Is it really that hard.
Training has to change as we really are becoming Children of the Magenta line.
Join Date: Dec 2019
Location: Derry
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
Could not agree more, I've had too much wine so apologies, but....someone should be monitoring what IThe aircraft is doing, if you don't like what you see do somthing about it. Jesus .....people this is basic airmanship, I am driven insane by the lack of it I see every day both on the Sim and on the line. The 737 is a doodle to fly, it's not complicated, so why make it. Stop playing with the f@@@ing FMC fly the bloody thing. 3 times table is not that hard is it? Today's sky gods are so full of themselves with all the latest shimmy kit, they don't have an inkling of airmanship.
right rant over.
right rant over.
you May have guzzled too much plonk ,but you speak the honest truth. In vino veritas.
i have been reading this thread with a growing sense of alarm. I have observed that exercise in the sim over and over with cadets barely more than children and they handle it flawlessly. You have to ignore six warnings to stall, and then screw up the stall recovery to crash. It’s so very basic airmanship and basic training that when I first saw the replay of the Turkish crash I thought somebody was leaving something out. It can’t have been that they sat there and ignored all the pre stall warnings and then the stall warnings. But it seems they did.
i think that what is becoming increasingly obvious is that there are plenty of folk out there who think that when things go wrong the pilots can’t really be expected to cope.
Its late and I need some wine. Zzz well
R Guy
Join Date: Dec 2019
Location: Derry
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
were getting there.
R Guy
Join Date: Dec 2019
Location: Derry
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
In airlines I know well that fly the 737 , the pilots are right there behind the thrust and controls throughout the approach. Any thing not right and the hands take over. During final approach you track the thrust levers to ensure they deliver the power required. During GA you press TOGA and then track the movement
to GA thrust. If it fails you just set it yourself. I’m sorry but this is so basic that I’m not quite sure why we are talking about it. Now I am talking Boeing here where the controls actually work in the normal way and the thrust levers move in line with thrust changes. Airbus? No you are right. None of this applies. Which is why the pilots on AF447:had no idea where the controls or thrust were set and what effect they were having.
Its why some people don’t like that design philosophy.
Youve guessed it. I’m pro Boeing.
R Guy
to GA thrust. If it fails you just set it yourself. I’m sorry but this is so basic that I’m not quite sure why we are talking about it. Now I am talking Boeing here where the controls actually work in the normal way and the thrust levers move in line with thrust changes. Airbus? No you are right. None of this applies. Which is why the pilots on AF447:had no idea where the controls or thrust were set and what effect they were having.
Its why some people don’t like that design philosophy.
Youve guessed it. I’m pro Boeing.
R Guy
Join Date: Dec 2019
Location: Derry
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts