LarryJ

I am trying to correct misconceptions, many formed by the numerous inaccurate media reports. People should be focused on the real problems, not those that came from misunderstandings and the media's desire for a sensationalized story.

These two accidents, and one incident, bring up two main issues that should each be discussed, and addressed, separately.

The first is the unscheduled MCAS activations. It is clear that these events should not have happened. Lots of moral outrage directed at Boeing over this but it's based mostly on misinformation. The design of MCAS meets certification standards. The design of MCAS is consistent with how all aircraft systems are designed. The appropriate safety assessment process and hazard analysis were applied and completed.

The second is that once the unschedule MCAS activation occurred, why were two of the three crews unable to maintain control and land safely? The media portrays an unscheduled MCAS activation as so catastrophic that the crews didn't have a chance. The data show the opposite.

Boeing has addressed the second point in two ways. First, they reminded crews, in a service bulletin that became an FAA airworthiness directive, that the appropriate response to any runaway stabilizer is the existing stabilizer runaway procedure and that this particular type of runaway stabilizer could be accompanied by specified other warnings and indications and that they should not distract from accomplishing the correct procedure. Second, they set out to change the MCAS triggering criteria so as to reduce probability of an unscheduled MCAS activation.

Safety is not regulated by emotion. A safety investigation proceeds the same whether the issue was brought out by a crash killing hundreds, a cargo jet crash killing three, or battery fires on the ground with no fatalities. The issues that are uncovered in each investigation are issues that affect the safety of hundreds of thousands of passengers and crews who will fly those aircraft in the future. Repeatedly quoting fatality statistics is an example of the appeal to emotion fallacy and is not helpful in evaluating a safety issue.

Similarly, ad hominems do not advance the discussion nor strengthen your arguments. My personal opinions of Boeing aircraft are mixed. I am a fan of the 767 and 757 that I flew at a previous job though they lack a lot of improvements seen in the newer 737, 747, 777, and 787. The 737's strength is its economics. It is cheaper to operate than any competitor in it's class (-800/-8 models and larger). The MAX is more efficient than the comparable neo models from Airbus just as the NG model was more efficient that he non-neo Airbus models. The Airbus is more comfortable both for pilots and passengers due mainly to the larger fuselage cross-section (which is also the main reason it is less efficient). The new A220-300 (former CS300) should outperform both the 737-7 and A319neo in comfort and efficiency with a similar number of seats. I fly the 737 because, at my seniority, it gives me the best trips and best layovers of any of the fleets that my airline operates but that has nothing to do with the merits of the airplane itself. The one thing that the 737 does do very well, other than efficiency, is RNP approaches. It does those very well down to the lowest RNP 0.10 specification.

Plato90s

Safety is also not regulated by the time-to-market considerations for Boeing.

The fact that it is possible for pilots to intervene and save the passengers is true.

It is also irrelevant. The point remains that Boeing deployed a dangerous airplane. The 737-Max has significant safety risks due to MCAS software and the false reassurances by the manufacturer that additional pilot training was not necessary.

When it comes to safety, it was unacceptable for Boeing (and its defenders) to suggest that pilots should/could have saved the flight(s) and thus the plane is safe.

As a professional standards matter, the fact that the 737-Max was grounded by every major regulator is de facto evidence of safety being compromised - even if a 737-certified pilot thinks otherwise.

osamede

That's a fallacy.

Every time you anyone else boards a plane, they are subjected to a highly regulated security kabuki that does not reflect the fact that they have a higher chance of a fatality in the taxi that they took to the airport, than of any security related event.

jrl767

literalist alert: even though MANY people (in and out of the media) conflate the terms, there's a significant difference between SECURITY and SAFETY

DenverBrian

A difference without a distinction in this case. Though security is meant to provide safety from humans, and safety is often used in the context of making machines safe, both have safety as their ultimate goal - the preservation of human life and the prevention of injury/illness/death. So I can wrap my brain around the previous poster's comparison point. <shrugs>

Boraxo

LarryJ as always you bring a valuable viewpoint from the pilot community to FT. I think we will have to agree to disagree with your assessment of Boeing and the MCAS system, but I would be interested in your professional views of the following:

(1) Retrofit of half-century old plane design with new engines and MCAS technology to address potential stall hazards resulting from placement of engines
(2) Failure of a single sensor causing software malfunction, which in turn brings down the plane
(3) Adequacy of training, particularly for overseas pilots who may not have as rigorous a program as US-based airlines.
(4) I think we can all agree that takeoff and landing are the most critical and dangerous parts of the flight and when most reported accidents have occurred. Are there any other systems that take control of the plane away from the pilots based on sensor input or otherwise? My understanding is that the normal autopilot is used at cruising altitudes.
(5) Do you think a simple software tweak is sufficient to prevent this problem from re-occurring? Would it not be better simply to have the sensor (defective or not) set off stall alarms rather than taking control of the plane?

LarryJ

I don't have time to do a reply justice at the moment. Remind me in a couple of days if I forget to come back to it.

N830MH

Hopefully the 737-MAX8/9 grounding is lifted soon. Boeing or FAA will have decide to resume flying the 737-MAX8/9 again. If they has been resolved it. They will be approved from FAA once the investigation is complete.

Plato90s

It's not just FAA - other regulatory agencies are unlikely to simply accept FAA certification on the 737-Max.

I suspect the grounding will be lifted on a per-regulator basis and require weeks even after the FAA signs off.

Even then, pilots may well throw another wrench by demanding model-specific training.

84fiero

And the fact is that there are conflicting opinions being expressed by pilots and others in the industry about the MAX and its return to service, not everyone shares the same viewpoint as our resident FT 737 pilot. Those views have been captured in a number of articles throughout the thread and elsewhere. International regulatory agencies seem to be hedging their bets so far. While nothing says there should be unanimity, it should be no surprise, then, that much of the public would remain skeptical to date.

Nothing happens in a vacuum. Shareholder value, market, public perception, risk analysis, and legal implications were and continue to be part of Boeing's actions along with safety. To pretend that any manufacturer operates as a pristine organization that makes absolute safety the main driver is naive (which doesn't mean the product is necessarily unsafe). Regulators perform a balancing act, as well, though hopefully to a lesser extent than the industry they oversee.

The fact that Boeing didn't catch the error in its software, where the AOA disagree light only worked if the AOA indicator was present - contrary to what Boeing intended, hurts its credibility even though this didn't impact the accidents themselves. What other software errors did Boeing not discover? Hopefully none.

EmailKid

Um, as I understand it that was not an error in software, that was intentional to have only one AoA sensor for data, though there was a possibility to purchase an option where a second one was also sending info,

chipmaster

I am no pilot but a pretty good engineer, no question the original design is/was robust, the history of extending it again and again and pushing the engineering envelop for TTM and value is a reasonable business and engineering tradeoff.

But let's not lose sight of the additional engineering bandaids that are now necessary and on the airplane. Some may say it is simply advancement of technology and automation/safety but the reality their need/purpose on the Max is / would be materially very different than on a complete new design.

Two planes falling out of the sky simply says something was/is wrong! Now is it fixable, likely, is it the best design possible, not even close, but is it safe enough, only another few decades and millions of hours will tell.

Aviation history is littered with learning coming from accidents, the Max isn't the first nor the last, but for such a high profile / profit and heavily used plane the impact to us all is large, hope Boeing got it right this time.

LarryJ

MCAS is not a stall prevention system. The 737 MAX's stall characteristics are completely conventional and do not require any such system.

You've left out a lot of steps between the single sensor malfunction and the accident. Most systems on any airliner are run from a single source. There is nothing unusual about that.

I have no direct knowledge of the training these crews would have received so can't point to any specific shortcomings. In the US, and other western countries, we have developed safety systems such as CRM, VVM, TEM, AQP, ASAP, etc. over many decades. Most of these programs came from what we learned from accident investigations (remember the DC8 and L1011 that both crashed while the crews were working to resolve unsafe landing gear indications due to burned out light bulbs?)

We also benefit from having very experienced pilots who have been able to use their experience to successfully handle situations for which there wasn't any training preparation. A 737 losing a large section of fuselage, a 747 losing a cargo door over the Pacific, a DC10 losing all hydraulics and primary flight controls, etc. Those successful outcomes didn't just come from good training, they came from experienced pilots who had been well trained. There is a lot of downward pressure on pilot experience level around the world as well as in the US though it hasn't yet reached the mainline level in the US.

MCAS does not take control away from the pilots. It operates the stab trim and can be overridden by the primary electric trim switches and disabled with the trim cutout switches. It is also inhibited with flaps extended or autopilot engaged. An out-of-trim airplane can still be flown, it just becomes progressively more difficult as the out-of-trim condition increases.

On the 737, the minimum autopilot engagement altitude is 800' on takeoff and must be disconnected no later than 50' above touchdown unless an autoland is being accomplished. Most pilots usually hand-fly much more than that but the A/P must meet certification requirements for malfunctions at those minimum altitudes. The dual, or triple, sensor inputs are not required unless accomplishing an autoland which requires the autopilot to fly the airplane all the way to touchdown.

Your question implies a misunderstanding of the purpose of the AoA sensors and MCAS.

The AoA sensors have many functions other than providing input to MCAS. A failed AoA sensor will set off other warnings such as IAS DISAGREE and a respective-side stick shaker.

The function of MCAS is not to prevent the aircraft from obtaining high-AoA conditions (or a stall), it is to improve the handling characteristics of the airplane when in those high-AoA situations.

As AoA increases, the expected condition is that the pitch forces needed to maintain, and continue to increase, the AoA should progressively increase. i.e. you have to keep pulling harder in order to keep increasing the AoA. Due to the lift generated by the larger engine nacelles, the pitch forces did not increase as much as desired in those situations which produced pitch forces that were too light. MCAS provides a nose-down bias, in those situations, through the application of nose-down stabilizer trim. This results in the desired, progressively increasing, pitch control forces to meet certification standards and provide a similar feel to the 737 NGs, on which many MAX pilots are dual-qualified.

DYKWIA

Once it's overridden, it's down to brute strength to manually re-trim. As has been shown, this is impossible once a certain speed is reached.

Your response will probably be "they should have reduced speed"... but that would also have pushed the nose down, and at about 1000 feet, that's not exactly what you want.

Doddles

That sounds like an opinion presented as fact. There are investigations ongoing about the certification process. I would prefer to see their conclusions before being so certain.

Instructions are sometimes not sufficient, if a problem occurs in a new and unexpected situation or context. Aircraft systems are not only designed based on what crew *can* do - they're based on the human factors of what crew might *likely* do, which is context-dependent. Systems are designed to be robust to likely crew failures. They can never be perfect, but the investigations will ascertain whether Boeing's *instructions*, and decision that extra *training* was not required, were sufficient for the Max.

Raising the questions of i) whether the system was indeed as safe as they claim, and ii) whether their action in this regard was sufficiently swift.

Regardless of whether it is meant to be or not, the reality is that it *is*.

Here's a question: If the Max is as safe as you say it definitely is, having passed all required certifications etc., and if safety is not regulated by emotion, why is the Max grounded and investigations ongoing about its safety?

I hope this post doesn't come across as snarky - not my intention and I do appreciate your comments and perspective. Also, written from the perspective of a researcher of human stress response and cognitive performance, but not in the aviation field (yet).