NYT: How Boeing’s Responsibility in a Deadly Crash ‘Got Buried’
 

Same story on BBC news page quoting NYT concerning "suppressed data" from the Turkish NG, AMS Feb 2009 investigation.

They talk of a "single sensor" having had an input into the ATS - as far as I can see they mean the RA input.

Interestingly the left RA input was used for ATS speed control whether R or L system is selected. In the initial report BBC says that the crew may have discounted the Left RA failure, thinking it irrelevant while using ATS from the right side. Doesn't excuse monitoring IAS of course. Apparently the source of RA input was not made clear in the FOM.
I know it was on the MD-80. Left RA was mandatory for a Cat 111 approach for that reason.

They are hitting the single sensor aspect and drawing "striking" parallels to the Max AoA input case.

Boeing tech is rudimentary at best. Airline CEOs and shareholders really ought to wake up to this fact.

There is a fair bit of commonality with the gap between expected performance and actual performance of the crew in the THY1951 accident and the MAX losses. At first blush a simplistic view is that it has to be a deficient crew, and yet, these crews are correctly certificated by their respective regulators, as was the crew of AF447.

The emphasis and reliance on automation may benefit accuracy but it does increase response time when a fault occurs while in a monitoring state. For the MAX cases, the crew were specifically hand flying the aircraft in an abnormal condition, for which an argument may be made that the ability to manually operate the aircraft in the abnormal case was adversely affected due to the extent of reliance in normal ops on automation. I actually don't believe that is a strong coupling, would expect that the fundamental problem is the underlying variability of humans to cope with an anomaly that is not within their direct recognition primed responses and associated decisions. Analysis of a new condition takes time, and sods law is that a defensive mechanism for surprise events will be good on most occasions, but sometimes it will be inadequate or compounding of the problem. Consider the AA DC 10 accident at KORD, AA191; the Co pilot recognised the basic condition of a severe engine failure, and entered into his trained response, which was problematic on that day, as the LH slat had lost hydraulics, and had retracted, so diligently flying V2 as a target resulted in loss of control. In Amsterdam, the crew were conducting training which is an elevated risk condition, and were given a high and close pattern that preoccupied them. Yes, they had IAS indicators, noise and various cues to the fact that the automatics were not functioning as expected (loss [ramping to zero] of LH RALT resulted in the ATR entering the idle function which is unannunciated, and as the throttles were already back at idle, the crew were unaware that the throttle was not going to wake up and maintain commanded approach speed when the sink rate reduced on capturing the glide path). In AMS, the event deteriorated quite rapidly, and the crew did not recognise the signs of decaying energy. Essentially the crew were outside the loop (Boyd's OODA) For the MAX, both crews were outside the loop, and circumstances resulted in their attempts to get to grips with the problem being unsuccessful. As an industry we have spent a lot of time on warm fuzzy CRM issues, but have had inadequate emphasis on SA maintenance, recognition of SA loss, and associated training, including strategies to recover SA. The basic problem is akin to taking a knife to a gun fight. In the case of the MAX, uniquely, the actual failure mode was novel to the crews experience, it wasn't even a known system, and while the OEM suggests that the response would be consistent with a runaway trim system, that is only partially true, running away at 4 times the recovery trim rate is a surprise package, as is the removal of the yoke limit switch cutouts. Having an intermittent runaway is not something that occurs in the world otherwise of trims, and for the ET case, the recovery process added a new surprise with the problems of manual trim being effectively frozen by the elevator loads, which resulted in the crew putting the stab cutout switches back to normal, with disastrous results.

The average pilot is not well equipped today to cope with a novel, time critical, highly dynamic event. Much like Chernobyl reactor technicians. Working out what is trying to kill you in the absence of information is a challenge, and those occasions need to be minimised, with crews given training in SA matters. The good news is that these are exceptional events when the underlying engineering issues are resolved. There is no simple panacea to the issue of improving reliability of the human-machine system performance.

The pain of hindsight
 

Hindsight itself is not painful; it is the subsequent realisation that lessons were not learnt, advice not heeded, nor actions taken.
The NYT article is timely, and ‘unusually’ accurate and to the point, in comparison with some media reviews.

Full accident report: http://reports.aviation-safety.net/2...738_TC-JGE.pdf
Appendix B: Comments of parties involved - NTSB / Boeing, (Page 140) provides insight to the review process and particularly the theme of blame the pilots, checklists, procedures; ‘we have flow this in the M Cab and our pilots were able to recover the aircraft’. ~ Walter Mitty.

The response to remark #1 - was a timely ‘put down’ of the NTSB / Boeing’s opening distraction that reporting format reduces safety impact and lessons learnt, even more so for the Max. ~ Delusion.

Appendix M: Simulator Tests (after this accident), (Page 201)
‘Evaluation of the aerodynamic performance data showed that once the aircraft stalled (approximately 5 seconds after the onset of stick shaker) there was insufficient altitude for the airplane to be successfully recovered. Therefore, the post stall recovery flight regime was not investigated during the M-Cab simulation tests.’

The NYT article, and the accident report, should reinforce the wake up call emerging from the Max saga. Not specifically directed Boeing, FAA, NTSB, but for world manufacturing, regulation, investigation and operations.

Woods and Dekker, http://www.humanfactors.lth.se/filea...Dekker2001.pdf

http://www98.griffith.edu.au/dspace/...pdf?sequence=1

and for info: https://pure.uvt.nl/portal/files/773...01_09_2015.pdf
“case studies to show the interweaving of organizational and individual journeys, each of which began with the strength to inquire and to challenge assumptions.”

Is it possible to get a copy, or at least view the ‘Dekker report’. Noting its intended confidentiality, perhaps via PM.
Alternatively as a bold safety statement, publishing the report anonymously with the objective of learning and changing even at this late stage.

I would argue that the average pilot was never equipped to cope at any point in history, not just today’s pilot. Pilots are humans and suffer broadly the same natural response when faced with a novel, time critical, highly dynamic event.

The way to mitigate that is to include the human style responses into the training and develop systems to minimize the effect startle factor. Eg. We train for V1 engine failures, but rarely do we train for the bird strike, compressor stall at v1 failure. So the first time you hear the massive bang is when it happens in real life. But look at the reports and videos. The evidence points to this type of failure as a primary way an engine will fail at takeoff. Not just a flameout or fadec rollback.

The RA was mentioned in the FCOM but it was very easy to miss. The same single source issue is also relevant to the 737 autobrake system in that it uses the L IRS for deceleration rates. Again the cut to training foot prints across type ratings ensures less systems understanding compared with the way type ratings used to be taught.

It is time safety was placed at the top of the Corporate tree instead of huge operating profits. Training is expensive but accidents aren't cheap either and then there is the loss of life ,which can never be replaced with money from law suits.

I always wondered why there was no real discussion about the s/w using an RA reading that was basically "off scale".
As a s/w engineer I always felt a sense of professional guilt that that the developers missed that one.

Bottom line on this accident folks: three pilots allowed the airspeed to fall 34 KIAS below the selected reference speed (110 vs 144 at 500 feet AGL). Don't blame the automatics folks, it is the pilots' responsibility to maintain a safe airspeed.

Chernobyl was, in part, caused by the operators being instructed/required to run an experiment, outside the normal operating parameters, which they had not been trained on. In principle they 'should' have refused.

This article gives a good overview of the facts immediately preceding the Chernobyl accident, this article gives a bit more background on RMBK reactors, and this is a rather long official report (in English) into the matter.

There is a telling quotation from that last report:

And, quoted within this report from the 3-Mile Island report:

I think, mutatis mutandis, the same applies for pilots operating aircraft.

As long as we have placed the blame on the "right" people, that is all that matters. That is Level 1 thinking.

Level 2 thinking means considering why those people made a mistake, and how to prevent it.

Perhaps the level 2 thinking involves a bit of 'airmanship. Many years ago I was taught to guard the controls below Fl100/10,000ft. Also when approaching level off certainly within 1000 ft. If you.put your hand on the thrust levers you will feel them move, similarly with the yoke. Its all basic stuff, when you fly a light aircraft you guard the throttle, so why oh why don't we do it on large aircraft these days.
I see every day young and not so young modern pilots ignoring the controls, because the autopilot is in. Is it really that hard.
Training has to change as we really are becoming Children of the Magenta line.

It is also the aircraft manufacturer's responsibility to be forthright about the aircraft systems. 😏

Very well said.

Could not agree more, I've had too much wine so apologies, but....someone should be monitoring what IThe aircraft is doing, if you don't like what you see do somthing about it. Jesus .....people this is basic airmanship, I am driven insane by the lack of it I see every day both on the Sim and on the line. The 737 is a doodle to fly, it's not complicated, so why make it. Stop playing with the f@@@ing FMC fly the bloody thing. 3 times table is not that hard is it? Today's sky gods are so full of themselves with all the latest shimmy kit, they don't have an inkling of airmanship.
right rant over.

Word of advice: don’t bid for an Airbus job.

Dear Brian
you May have guzzled too much plonk ,but you speak the honest truth. In vino veritas.
i have been reading this thread with a growing sense of alarm. I have observed that exercise in the sim over and over with cadets barely more than children and they handle it flawlessly. You have to ignore six warnings to stall, and then screw up the stall recovery to crash. It’s so very basic airmanship and basic training that when I first saw the replay of the Turkish crash I thought somebody was leaving something out. It can’t have been that they sat there and ignored all the pre stall warnings and then the stall warnings. But it seems they did.
i think that what is becoming increasingly obvious is that there are plenty of folk out there who think that when things go wrong the pilots can’t really be expected to cope.
Its late and I need some wine. Zzz well
R Guy

That’s three people on this thread who seem to understand that you fly the plane- not let it fly you.
were getting there.
R Guy

In airlines I know well that fly the 737 , the pilots are right there behind the thrust and controls throughout the approach. Any thing not right and the hands take over. During final approach you track the thrust levers to ensure they deliver the power required. During GA you press TOGA and then track the movement
to GA thrust. If it fails you just set it yourself. I’m sorry but this is so basic that I’m not quite sure why we are talking about it. Now I am talking Boeing here where the controls actually work in the normal way and the thrust levers move in line with thrust changes. Airbus? No you are right. None of this applies. Which is why the pilots on AF447:had no idea where the controls or thrust were set and what effect they were having.
Its why some people don’t like that design philosophy.
Youve guessed it. I’m pro Boeing.
R Guy

In what way was Boeing not forthright about 737 at Amsterdam design please? Not being picky- just don’t get the point.
Thanks
R Guy

There was no information in the FCOM to indicate that the AT was always controlled based upon inputs from the left RA, even when the right FCC was active.

Boeing and Safety
 

It is an uncomfortable fact that automation has made flying safer. Another uncomfortable fact is that in the days when pilot's 'flew' the plane the accident and fatality rates were far higher than now. The issues with pilots responding appropriately to unforeseen circumstances are unfortunately not due to the increase in automation of the flight envelope. If one studies the accident reports of the past one recoils in horror at the mistakes made by pilots hand flying aircraft. We need to avoid rose-tinted spectacles about the past and focus on the real issue here. There will always be pilots who are unable to respond effectively in an emergency or anomalous situation just as there are pilots who can do so successfully. The question is what to do about these pilots as short of putting them in an emergency it is often difficult to tell who falls into this category. This is where the aircraft manufacturer comes into play - designing aircraft which are robust and easy to fly and putting safety above profits. There seems to be a failure of risk management and ability to appreciate that aviation accidents are all 'black swans' in the ranks of Boeing. Analogies have been drawn with the nuclear industry and these I think are appropriate. Cutting corners on safety is not an appropriate response and trying to bury or influence the results of a safety report so it is more favourable to the company is particularly abominable.

OC

No. There will always be emergencies in which pilots respond effectively, as well as emergencies when pilots do not do so. And the very same pilots might find themselves in either situation on any given flight.

Life is complicated and humans are all human.

I very much see your point - however, a detailed reading of accident reports unfortunately tends to reinforce the proposition that it is mostly pilots who create emergencies. Your emphasis is very much the lesser cause of accidents but I think we can say of the MAX affair that the pilots were the victims of badly designed and conceived software and a rather perverted desire to put saving money above safety.

OC

What is Airmanship??
 

This thread has sparked a thought, one that has lingered through the MAX saga.

What is "airmanship??"

I know what I think it means, and I know what a lot of posters here on PPRuNE think it means, but in concrete terms what exactly is airmanship??

Before you answer with a concrete definition let me share my day with you. This morning started at 0400 in Fountain Valley, CA where I was staying with my son for a hockey tournament. Come 1100 we were on our way home to Half Moon Bay, through the entirety of the LA basin, the Grapevine, the endless expanse of Rt 5 to the Pacheco pass etc. When we started I was reasonably coherent and my usual race-car driver (for real) self. By the time it started to rain five hours later on Rt. 5 just before Los Banos my eyes were blurry with fatigue and I had to use every ounce of energy I had to maintain focus on the road and the copious (and insane) traffic around me. Was I unsafe?? I do not think so. (If I did think so I would have stopped) But could I have responded to a series of life-threatening events occurring in quick sequence with the same level of reaction time and cognition that I had five hours earlier in LA?? Nope. Not a chance.

I've spent roughly 4,400 hours of my life at the pointy end of flying objects in full responsibility for returning them to the ground in the same state that they left it. I failed to do this once- and I have the caterpillar pin to prove that on that day my "airmanship" was enough to at least keep my ass from dying, even if it could not save the airplane. So do I have "airmanship??" I honestly have no idea, but if I do I also know that given enough fatigue, distraction or illness it can be erased in a heartbeat.

Anyway I return to the question: What the heck is "airmanship" and why is it so great at saving airplanes that have been poorly designed??

Warm regards- apologies for the length- as stated the day started quite awhile ago.
dce

Airmanship is the safe and efficient operation of an aircraft, both in the air, and on the ground.

As slf that article gives me shivers and i think this thread should be deleted asap.
we all know that the airplane had an issue with this aensor because the airplane gave a silly warning while it was still perfectly fine to fly manually.
The turkish became very aggressive to clear the crew of any mistakes but this accident is purely on the crew they had the time to figure out why the machine was complaing about configuration before they let the machine land itself.
There is in our world no other way of automation possible then we currently have.
Sensors which need air to flow passed them or use some magnetic interference measurements it is how it is we will not get the super robots you see in hollywood movies no auto healing of the machines , pilots should learn to deal with that.
This article is just Boeing bashing but an airbus would crash just as well if you dont troubleshoot the fault and let the faulty sensor fly it

True. However.
Why didn’t the 737 get any “fundamental” upgrade since it was initially designed??? It has sooo many KNOWN design flaws, it is almost funny. Almost, because they are deadly. To name a few:
-split cockpit, wherein the left side does not know where the righthand side is going.
-airco switches design, whereby it is very difficult to see/determine how they are positioned(helios crash)
-single channel determines deceleration of the autobrakes. (Left irs only)
-single channel auththrottle, with input of single RALT. (Turkish at AMS)
-identical wailer for T/O config, OR cabin ALT. What the hell. Seriously.
-Recall system knob is prone to mishandling. Do NOT push it too hard or it will not indicate anything.
-Probably many more.

The reason for keeping all these stupid design flaws in there, is Boeing’s attempt to maintain one type rating. So according to Boeing, it is better for THEM to keep it cheap and competitive, while some people die in some third world country because of their incompetence.
Glad I dont fly it anymore. Later models of Boeing are better.
The only up-side of flying a 737, is that it makes you a better-than-average pilot. If you can fly a 737, than you can fly ANY Boeing airplane.

Thanks. That’s true. The manuals should of course be accurate. That said the majority of pilots I have known wouldn’t have derived any benefit from that knowledge in the AMS situation . Ask any pilot, if you know any, without warning “ How does speed trim work”. “Describe the hydraulic system A and what services it supplies”, or any question that goes just a little deeper than superficial. You might be surprised at the response. Fact is that it wasn’t that the crew didnt understand the wiring diagram for the Rad Alt and it’s relationship to the FCC and the avionics related to Autothrottle/ RA interface. Very few would, even if it were in the manuals in bold underline. What they didn’t know what to do was fly the plane, which I would argue is their primary function when things don’t work as expected. So in this case the autothrottle didn’t “wake up”, as it didn’t in ASIANA SFO 777. Both planes crashed due to pilot inability to recognize that the plane was deviating seriously from the desired flight path and did not initiate a manual recovery in time.
Thats my view and I’m not alone. Clearly, from some of the comments earlier.
It is very good we’re discussing these issues because they lie at the heart of the future of aviation safety.
Best wishes
R Guy

?
 

Sorry Maxxer, I couldn’t make head nor tail of that. Must have been a long night?

The “issues” you describe are easily sorted through SOPS. Example Aircon switching. Helios didn’t follow SOPS. It was truly shocking to read the report on that.

But to move on, you are right. If you can fly a 737 you are on one of the most robust and delightful planes ever built and a combination of that long safety record and good pilot skills makes the 737 a very safe plane indeed but you do have to know how to fly I accept. And that’s our problem isn’t it.
I think this is coming up more and more as we unravel the Max issues. It seems that Boeing do indeed seem to expect a solid level of pilot training and ability. Hence just an AD post Lionair reminding everyone that when the stab wheel runs unexpectedly- just do the procedure. And we now know that ET still didn’t do that 5 months later. So the debate must now be about “is it reasonable to expect pilots to have the same skill levels as the previous generation”. It’s going to be a long and interesting battle. Airbus just said freighters with no pilots (one pilot ?) in 5 years. Others saying train the pilots! I hope I’m around long enough to see how this unR Guy

TLB, there is a significant difference between being responsible and being able to exercise responsibility. Thus, neither automation or pilots, but the combination, interacting with the situation being experienced - context.
See appendix N of the report - previous incidents. The outcome of all of these was success, but the context differed - more altitude, alternative alerting - situation awareness, and thus time available.

“...no matter how hard they try, humans can never be expected to out perform the system which bounds and constrains them. Organisational flaws will, sooner or later, defeat individual human performance.”
Gary Parata of Air Nelson

- - - - - -

wonkazoo, Ascend Charlie, et al,

“Airmanship is a personal attitude to flying, why we do it, how we do it. Airmanship must grow with training, experience, and personal exposure. It is not just about staying alive or not bending the airplane or yourself, it is about walking off the airfield knowing that you have both performed and crafted an activity. You have been totally aware of what you have done and why you enjoyed it, and a that point you owe nothing to anyone.” Slide 13
https://www.dropbox.com/s/bhpin7se6m...light.ppt?dl=0

fdr, average pilot, :=
No such thing as an average pilot. ;)

statistically, there must be. And also statistically, nearly half of your pilots will be below average.

Don't design products to be safe only if used by the average pilot

Serious question - has anyone ever come off a long duty period and into a sim to see how their fatigued self reacts in an emergency?

Chernobyl and the MAX (and THY @ EHAM) share common features of unintended behaviour by the system which the operators were not aware of. For Chernobyl, the paradoxical effect of hitting the scram button ("AZ-5") which would cause a displacement of water from the control rod channel, removing a neutron absorption mechanism, and replacing that initially with the graphite tip acting also as a moderator, leading to a massive spike in power output, many orders of magnitude above rated power output. The management of the team did not permit concerns of operators to the precipitous drop in power output from xenon-135 poisoning to terminate the test, and the consequences of the RBMK control design became known after the event. The decision making in the process was made without all the information to hand that was necessary to make a safe determination. Humans, experts and non experts don't have great batting averages with decision making under uncertainty, experts reach a position in a shorter period of time, that may be important, but the decision merit is still hit and miss. OTOH, computer systems are effective where the actual conditions are as envisioned by the programmer, any part out of round gets an poor outcome, and that is the benefit of the human in the loop; humans can ponder anomalies, and given time, can establish a counter measure. Temporal constraints have severe consequences; given time, an tentative intervention can be assessed for merit, whether the outcome is being achieved. Without time, statistics come into play. For THY at AMS, had the flightpath been at 10,000' AGL when encountering the loss of SA, then recovery would have been likely. getting to hover in a 737 at a couple of hundred feet has a high probability of ending badly. Yes, the crew missed a stack of cues as to the energy state of the aircraft that appears remarkable in the cold light of reflection, much like the splashdown of AZ-214, but that is what happened on the day, to crews that woke up expecting to have another boring day.

Recovery from a loss of SA is a challenge, and all humans suffer from SA losses at various times in their activities.

Seems an odd statement given they wanted no additional training and hid the existance of MCAS.

Odd that the wave of new posters keep turning up with nothing but an agenda to blame the pilots, as one seems to disappear a new one turns up.

It might have been beneficial for them to know that the recognizably-faulty data from the left radio altimeter was actually feeding the autothrottle logic. As it was, they knew the reading from that RA was bogus, but they thought it didn't matter.

Synggapa, #35,
'statistically' most issues can be identified as having an average. The important point is if this is meaningful; useful in achieving a specific objective.
Failures in aircraft components can be quantified - counted and divided; human performance is qualitative - a judgement which might at best be classified. Interpreting opinions as hard numbers defies meaning. Note rating assessments for CRM.

This inability to quantify humans creates uncertainty which challenge assessors and designers, who may be biased towards numerical techniques. The industry does not design for 'average' people, everyone has to be considered in context. Thus context - those situations which could challenge people and equipment have to be considered.

Recent accidents suggest that Boeing resorted to a numerical view of pilots (blame according to an arbitrary 'averge') when defending their products, deflecting suggestions of poor design. Their product design could have been well designed according to their ground rules, but then either human judgement or the range of situations considered were mistaken; work as conducted was not as imagined.
Perhaps this reflects erroneous cultural (organisational) beliefs; everyone should be the same as us - false consensus bias; - not considering the realities in a rapidly changing world.
https://www.dropbox.com/s/7425e8yykg...20%2B.pdf?dl=0

Statistical Thinking: http://iase-web.org/documents/intsta....Pfannkuch.pdf

https://www.stat.auckland.ac.nz/~wil...easurement.pdf

I wasn't aware of that to be honest. Let me read the report again. I wasn't aware that the crew had any idea what was going wrong, let alone diagnose the effects of an RA failure at around 1500 feet. I think from memory that the first inkling they had that something was wrong was when the stick shaker went off but I may be wrong.
Remember that by that time the plane was in takeoff attitude of around 12-15 degrees and the airport would have disappeared from view out of the window.
But I think my point remains - the AT can malfunction at any time and it it does (SFO 777) you need to take over the power immediately and if necessary fly the plane to safety. `I don't think I would have known what an RA failure at a 1500 meant except that it precludes at CAT 111 approach and auto land. But as the speed started falling below Vref +15 (approach speed) and long before the other six warning kick in, I hope I would have seen the speed falling below the desired value and applied power.
Anyway good point and I will have a look at the recording again.
Many thanks
R Guy

I don't think anyone is arguing that the Turkish Airlines crew wasn't largely responsible for the AMS crash. The point is simply that Boeing also had some responsibility and worked hard, apparently along with US regulators, to keep references to that out of the investigative reports.

I'm only a bug smasher former pilot, but letting the speed decay to 110kts against a ref of 134 is just not acceptable and to allow it at low altitude is .....

Working in domains where thinking is highly valued, I'm always an advocate of systems thinking, but such a basis transgression of the principles of airmanship is surely not a topic for deep thinking? One pilot flying, one monitoring - even on a training flight, surely there are procedures to maintain this safeguarding?

I remember having a safety pilot onboard to keep a lookout when I was under the hood in a PA28 and there was a very clear briefing from the instructor/pic about R&R during critical phases of flight.