Indonesia’s MAX Report: Why Separate Man From Machine?

48

The just-released Indonesian accident report on the 737 MAX crash in October 2018 will have something for each of us and one thing for all of us: It’s a poster child for that unassailable nugget of aviation wisdom that accidents comprise a chain of errors leading to a blackened crater. The chief investigator said as much and rattled off the nine links.

For those hard-bitten cynics who said the Indonesian report would be a political whitewash absolving the airline and the pilots, squint a little and you can support that. Read hierarchically, Boeing’s at the top, aircrew performance near the bottom. But it’s not nearly the puff ball some predicted and, in my view, is relatively evenhanded. It lets the pilots and airline off easier than I would and Boeing a lot easier.

In the almost year to the day since this accident occurred, I’ve read enough to sense a powerful yearning to blame one of two entities: Boeing or the pilots. The pilots or Boeing. But as with most accidents, it’s not so simple. The blame-the-pilots argument was eloquently argued by famed aviation writer William Langewiesche in a 14,000-word New York Times magazine article assuredly titled What Really Brought Down the Boeing 737 Max? A month and half before the fact, the deck on that article presaged the accident report: Malfunctions caused two deadly crashes. But an industry that puts unprepared pilots in the cockpit is just as guilty.

Both of those things are true, but unsatisfying if you want to assign relative weight to links in the chain. Was the pilot link 70 percent and the rest, added up, the remainder? Or were Boeing’s tragic missteps in certifying the MAX the overwhelming driver, with the pilots merely abetting? “Cause” and “contributing” are two different things.

Take your pick. Mine is that the relative weight doesn’t matter because accident investigation isn’t intended to assign blame but to learn enough to prevent the next one. And it seems clear to me—although the Indonesian Transportation Safety Committee didn’t say as much—that this was a systemic failure; an uncharacteristic lurch back to the bloody days of the 1950s, when multiple crashes a year made it worthwhile to maintain flight insurance kiosks in airports.

We don’t do that anymore because the contemporary airline accident rate is functionally zero, at least in the U.S. On the hardware side, we got there with an ever more refined science- and data-driven certification process jollied along by just enough internationally standardized regulatory oversight to protect the industry against its own excesses. But given how the FAA’s Organization Designation Authorization has worked, the industry—mainly Boeing and Airbus—has done impressively well at avoiding disasters. Until the MAX came along. And two crashes of the same type within six months is a disaster.

The Indonesian investigators didn’t venture into these waters, at least not very deeply or vigorously. They offered a vague recommendation that the FAA review the ODA process. We reported that the Joint Authorities Technical Review, a consortium of international regulators, concluded that the FAA went overboard on Boeing’s ODAs and needs to step up and step in. But former NTSB Chairman Chris Hart, who chaired that group, insisted the system isn’t broken.   

“The U.S. aviation system each day transports millions of people safely, so it’s not like we have to completely overhaul the entire system, it’s not broken. But these incidents have shown us that there are ways to improve the existing system,” Hart said is a speech before the JATR report was released.

Credible and soothing as that sounds, it’s still a soft pedal. Boeing declared or at least thought the MAX had the vaunted 10-9 reliability and the FAA’s job was to at least check the math. It failed to do so, in part because Boeing wasn’t entirely forthcoming with the FAA and had unrealistic expectations of what pilots could be expected to handle and fix. The report did say that. That’s a backhanded way of saying it was Boeing’s fault that the pilots couldn’t handle the emergency that MCAS—a system they didn’t know about—threw at them.

The immediate payoff of that was two crashes and 346 deaths. The longer term is playing out in the “MAX effect” as certification projects at all levels are getting additional scrutiny from an FAA now fearful of political blowback. Justified or not, the delays are piling up.

The report was critical of the MCAS design, relying as it did on a single AoA sensor operated by buggy software that failed to apprise the pilots of faults in a system that they knew nothing about because it wasn’t described in the documentation. In a world of perfect maintenance, this might never have surfaced as a problem, but Lion Air’s maintenance was anything but perfect.

By international standards, its record keeping was shoddy and its understanding of the MAX’s complex systems was incomplete, culminating in the dispatch of a flyable but unairworthy airplane. Aggravating that, and related to Boeing’s poor documentation, the crew that flew the flight immediately prior to the accident flight experienced the same faults as the accident crew.

But those pilots failed to convey the information that the left-side stick shaker was activated continuously and that the trim was in an intermittent runaway condition—operated by a system they didn’t know existed. That meant that both maintenance technicians and the next crew were in the dark. Because of that and the fact that documentation didn’t alert the crew or the maintainers that the airplane lacked AoA disagree capability, the technicians fixed the wrong thing. They flushed the pitot system and released the airplane for service, all but assuring that the accident crew would confront an abnormal that didn’t present as plain-vanilla runaway trim.

The previous crew, aided by a jump seater, had contained the misfiring MCAS system by using the stab trim cutout switches and while their handling of the abnormal was admirable, the captain still decided to proceed normally to the destination with the stick shaker continuously activated when he should have landed immediately. Confronted with the same situation, the accident crew wasn’t as competent. It failed to declare an emergency and mishandled the response to the runaway trim. Local ATC added to pilot workload by issuing a stream of directives. Eventually, the pilots of Flt. 610 lost the trim tug of war with the faulty MCAS activation.

Among the accident report’s 82 detailed findings was the conclusion that Boeing thought the failure of a single AoA with MCAS activation was beyond extremely improbable, thus it justified its decision not to document the system. This was supported by sim flights and other testing that didn’t consider the ramifications. The Indonesian report found that Boeing’s confidence in pilots to sort out such faults was misplaced. In the dry language of the post mort, “assumptions … about pilot response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.” This contradictory finding can be read to suggest Lion Air needed better pilots or that Boeing just expected too much of all pilots.

As for the pilots themselves, the report found the captain’s CRW skills were wanting and that the first officer was confused and didn’t know required memory items for airspeed disagree alerts. Its review of his training records found numerous complaints about his skills and handling of simulator exercises. He complained of an early duty call on a day he wasn’t scheduled to fly and the captain had the flu, with a hacking cough. Could the pile have been made any higher?

The safety committee issued a long list of recommendations related to oversight of certification and human factors such as training manuals, crew behavior in emergencies and the effect of multiple alarms and how pilots deal with them. While it dinged Lion Air for suboptimal hazard reporting methods and record keeping, it was curiously silent on the lack of an overall safety culture and on pilot training.

If there’s a shortcoming in the investigation, that might be it. I’ve heard professionals argue—some themselves MAX pilots—that the crew should have been able to handle the MCAS runaway and that if they had, neither of the 737s would have crashed. I think this is undeniable. But also undeniable is that through a series of bad decisions and lack of regulatory oversight, Boeing built an airplane that confronted the pilots with a confusing abnormal. The fact that it happened twice in six months shows that Boeing was wrong in its understanding of how improbable such an event could be, regardless of what ignited it and irrespective of what acceptably skilled pilots should be able to handle.

In that sense, I think it’s wrong to separate what the pilots knew, didn’t know or did from what Boeing knew, didn’t know or did. By design and with great success, we’ve lumped everything into one internationally approved safety-driven system. And in this case, the system failed.

Other AVwebflash Articles

48 COMMENTS

  1. Best explanation: “ But also undeniable is that through a series of bad decisions and lack of regulatory oversight, Boeing built an airplane that confronted the pilots with a confusing abnormal.”

  2. “The U.S. aviation system each day transports millions of people safely, so it’s not like we have to completely overhaul the entire system, it’s not broken.” Ok, but how many of those people are being transported on aircraft certified under the ODA system?

    • “Ok, but how many of those people are being transported on aircraft certified under the ODA system?”

      Probably all of them. The FAA simply doesn’t have enough inspectors to cover the entire aviation industry and taxpayers would never sit still for the cost of doing so. It isn’t just airliners. It is everything from Boeing to Grumman to Cessna and Carbon Cubs. I would guess that similar certification systems exist in any large industry from medical equipment to cars and utilities. There simply aren’t enough inspectors and society must rely on self policing.

    • ODA is the very best thing to happen to a regulatory system. I work under it every single day. The RCE/RCI personnel (Regulatory Compliance Engineers & Inspectors) are extremely conscientious; they know who’s tail is on the line. A government inspector who fails is likely to keep their job.

  3. Excellent piece, Paul. Thank you.

    One nit to pick; subtle but important:
    Boeing’s MCAS software was NOT “buggy.” It was flawed.

    A “bug” exist where code fails to achieve the intent of its author. Typically, this manifests as undesired behavior – it doesn’t do something that it’s supposed to do, or it does something that it’s not supposed to do, or both.

    Code can be deeply – sometimes fatally – flawed. But if it does exactly what its designer wanted it to do, it’s free of “bugs.”

    That doesn’t mean that it’s not junk. Its flaw lies in the INTENT of the Systems Designer. Sometimes it’s a bad design. Sometimes it’s ineffective conveyance of a good design.

    You’ll look foolish complaining that you wanted a hamburger, after you ordered a hot dog.

    IMWO, Boeing’s MCAS system is a case-study example of Bad Design. At the highest level (“First-Order Principles”), the design flaw was a (fatal) misjudgement of the extent to which the Systems Design could/should rely upon actions of the flight crew, to handle “an unusual” occurrance.

    With appologies to Capital One, “How long is YOUR leash?”

    • YARS,

      If the MCAS doesn’t fit the definition of “buggy” then the Max Display System software might. Boeing intended there to be an AOA DISAGREE message in the basic 737Max software package, just like it is in the 737NG. The AOA angle indication is/was always an option.

      But somehow the Max was released with the AOA DISAGREE feature only included when the AOA indicator option was purchased by a customer.

      That might be considered a bug, since the behavior is not what the designer intended. It was a mistake made by the programmer.

      • I doubt that a coder made a decision to suppress a feature based on a sales order customer choice. That sounds like a directive from above.

        If that were the case, however, it should have been discovered in rudimentary testing – the presence or the absence of that display feature is literally in front of your face. The sales order is supposed to determine whether or not it is displayed. On a go-forward basis, Boeing will display it as a standard feature. Good idea. But…

        Knowing that your ship’s two AOA sensors disagree isn’t a cure for what ails MCAS. Somebody (something?) would have to decide which of the two available AOA values is reliable, and then re-direct THAT sensor output to the MCAS system. More complexity. This is one of the dangers inherent to any situation in which multiple independent boxes are granted authority to monkey with the flight controls.

        If/when in doubt, turn the damned thing off, and fly the airplane.

      • It always amazed me that on aircraft that cost eight and nine figures, simple safety devices are still options.

  4. Learning from our mistakes the 737 Max, A300 ( AA587) and the A330 (AF447) aircraft may be remembered as “flawed” or “confusing abnormal” or as “bad designs” extruded into service. Kinda like “buggy” too.

    • A budget foreign airline with shoddy maintenance and questionable pilot decisions to fly AFTER a known issue was reported by the previous flight crew. Then 5 months another later another budget foreign airline with shoddy maintenance and flying after the previous accident was all over the aviation news did exactly the same thing.

      I don’t see “learning” being exemplified by budget foreign airlines.
      The learning is that we need more bubble-wrap and soft edges and waring labels on products because products go to those who by their actions DON’T learn.

      • In a sense, one could almost argue that MCAS itself was the “bubble-wrap”, except it ended up having razor blades in the bubbles.

        Yes, sitting comfortably in my chair on the ground, it’s easy to say that the pilots should have been able to control the aircraft. But when a hidden aircraft system is actively working against the crew that is trying to do the right thing (not nose-dive the plane into the ground), that is a flawed system that needs to be corrected. That’s not bubble-wrapping the issue, that IS the issue.

        • Crash #1: The previous crew (that declared an emergency on Lion Air 610) barely escaped with their lives! Budget foreign airline did not save CVR after that incident. AoA was not tested after “repair”, the plane was not grounded, and it was returned to service…

          Crash #2 was some 5 months later after extensive investigation of crash #1 and published in the aviation media. It was no surprise what the symptoms were, what the MCAS system does, and what could be done do mediate a problem. Budget foreign airline #2 did not lean from Budget foreign airline#1.

          • I’m familiar with Indonesian airlines.

            Calling LionAir a “budget airline” is not accurate – it’s one of the busiest airlines in the world, and they have their own terminals.

            But being at the end of the world and not fluent in English, they need reliable, self-diagnosing systems, not junk like MCAS.

            Indonesia and the United States have had a special aviation relationship for decades, and Boeing really let everybody down – globally. Personally, I’m beyond disgusted.

      • As best I can tell, there was nothing shoddy about the maintenance at Ethiopian.

        Yes, they failed to learn the lesson of the earlier crash.

  5. Sure looks like Boeing and the FAA dropped the ball on the Max. But kudos to the FAA on the 1500 hr rule. Maybe all foreign airlines should adopt the regulation to be allowed into U.S. airspace. Oh, and the additional 1000 hr to qualify as Captain.

    • Hours do not make a pilot good. Skills and knowledge make a pilot good. Test for that, don’t look at the hours.

  6. > …in part because Boeing…had unrealistic expectations of what pilots could be expected to handle and fix.

    But why? Every Boeing airliner since the 707 has been equipped with an electric trim system, and pilots flying Boeing airliners have trained for more than half a century on how to respond to a malfunction of that system. What is “unrealistic” about expecting a pilot properly trained in Boeing aircraft to immediately recognize and respond to the danger of uncommanded trim movement?

    My fear is the that the investigation’s failure to address pilot training demonstrates a failure to learn ALL the important lessons to be learned from this tragedy, which ultimately will move the focus toward “idiot proofing” aircraft rather than airmanship.

    • When a system becomes extremely reliable, training for the rare occurrence is generally a waste of time; the more rarely a situation is to appear, the more of them there are. You could spend weeks on training for them all.
      In the US, under proper maintenance, an AoA failure may present a vanishingly small chance of happening. But more than one plane has been brought down by failure of same, due to maintenance issues.
      Still … the runaway trim procedure did work, at least whilst it was being implemented.

  7. If you address only Boeing’s and the FAA’s primary complicity in the matter, it sure looks a lot like the NASA management errors which led to the space shuttle Challenger disaster in 1986. Management’s incessant prioritization of shareholder value (aka profit), stressing quantity over quality, adherence to unrealistic schedules and project optics at the expense of good closed loop engineering and safety/quality reviews are at the center of the matter. Murphy’s Law dictates that — sooner or later — a less than stellar aircrew will occupy the cockpit of a less than healthy airliner and take the wrong actions when the machine doesn’t do what it’s supposed to. Fool us once, shame on Boeing and FAA. Fool us twice, shame on the “system.”

    I see that today, Dennis Muilenburg, is testifying on the magic red carpet of Congress. He’ll tap dance, they’ll provide the optics of doing something and everyone will live happily ever after in fairytaleland. The FAA bears responsibility, too. I watched the acting Administrator testify on MCAS and it, too, was a sham. What ultimately changed … not much.

    Mark S is right. The likely end result will be further “idiot proofing” of airliners. OH! We already have Airbus. “Why did it do that? What’s it gonna do next?”

    • After all the above persons get done testifying, those Congresspersons and Senators who voted for the provision in the last FAA authorization to mandate the FAA increase the the amount of work done by company designees should also have to testify. Congress has just as much responsibility for the 737MAX mess as Boeing!

  8. I find it interesting that no one is talking about the miss-calibrated AOA that was installed on the Lion Air MAX. This makes an argument for MCAS actually working as designed. The FAA just pulled the Part 145 Repair Station license just hours after the Indonesian Lion Air crash investigation report was made public.

    So, we have an American FAA Repair Station overhauling and signing off an American 8130 as a correctly overhauled, calibrated, and checked AOA, being installed IAW American written instructions by Boeing, into an American certified and American built air-frame. Then the American designed, engineered, yet unknown to maintenance and crew MCAS, worked as designed. No “bugs” no flawed “codes”.

    The only thing(s) “flawed” was the data MCAS was getting, the purposeful change of speed and range of MCAS activation by Boeing of stab trim range from .6 to 2.5 degrees which at 2.5 was impossible to over-come by manual pilot inter-action (without letting the FAA know), lack of AOA differential information displayed ( of course why would you display that if you were not planning to tell anyone pilot or maintenance MCAS even existed based on 10 to the 9th power of failure odds), and an American FAA Repair Station that failed to do what was promised, expected, and FAA regulated by sending out a sub-standard part. In the final “settlement” with the FAA, the repair station waived any right for appeal in any court or to the NTSB. It appears they had a long history of poor performance.

    Now we can add a potentially physically sick captain, a less than stellar performing first officer, and a maintenance crew that was doing all they knew to do, installing an AOA 21 degrees out of calibration nose up. Plus to this sick mess a previous crew who flew the airplane with the left stick shaker activated for the remainder of the flight, but fails to tell the next crew of this significant abnormality. However, they did have a third crew member in the cockpit to help manage this obviously stressful flight that the crash crew did not have available.

    In early flight testing of the V-tail Bonanza, it was learned that accelerating from VNE of 204 mph to 286 mph design limit of the V-tail took just under six seconds at 30 degrees nose down. It has been well know, that in high stress accident scenarios that the average human, including trained pilots it normally takes 4-7 seconds to recognize and accept “Houston, we have a problem”. Recognizing a problem, overcoming denial, followed with “fly the airplane” takes some time. I would think a 737 MAX probably has a better drag coefficient that a slick Bonanza. It would not take much nose down attitude to pick up significant speed. it would be very confusing to have all this unexpected and unusual data sending off conflicting alarms visually and audibly requiring repeated recognition, denial, and then action which eventually became beyond physics to overcome. Two healthy, well trained Sulley/Skiles would have their hands full.

    If there was no Colgan crash, the American airlines, the American Congress, and the American public would have no heartburn with a 400-500 hour co-pilot. Nor with 1500-2000 hour captains in regional type of airplanes. I don’t know the official safety statistics prior to the Colgan crash, but to my memory, the American airline accident rate was really low, somewhat similar to what it has been post Colgan. To imply that foreign airlines using crews with less time than current US, knee jerk Congressional initiated standards, doesn’t necessarily make for unsafe operations. It appears that both Lion Air and Ethiopia Airlines was and is using similar pre-Golgan crash crew times as first previously used by many US carriers national or regional. Without the Congressional mandate, we would still be using those standards. Our pilot shortage has made this a hot topic. But if implemented by a foreign airline, suddenly, it is now sub-standard.

    If there was no MAX crashes, we would be all flying them or boarding them as a passenger. Ignorance can be bliss. Or in the case of the folks aboard the two ill-fated MAX crashes…not.

    There is no doubt there is even more than nine causal chain of events that killed 346 people. But we must be very careful in what we opine to be within the blame game. There be unintended consequences for every pilot and aircraft owner that will inevitably suffer as a result. Already, there is a back log of approvals for aviation items that among them, are probably a safety improvement that we all could be benefiting from but will not be speedily implemented because of the back-lash the 2 MAX crashes are causing. We could be reaping what we are currently sowing and not be happy with the harvest.

    There are several course corrections that will have to be in-acted by airplane manufacturers, the FAA, and flight training departments relatively quickly that the two MAX crashes have revealed necessary. We may not like how those course corrections will affect us. Blame is one thing…proper, needed corrections are another. And we have not seen the litigation maelstrom that will explode in the coming days adding more cannon fodder for our aviation ignorant public, Congress, and national media. These two crashes are forcing into the discussion many complex and never simple issues. We like simple cut and dry solutions. Won’t happen here.

    • I find it frightening that no one is talking about how a miss-calibrated AOA was installed on the Lion Air MAX and NOT TESTED after the install to see if it ACTUALLY FIXED the mis-match that was seen on the previous flight. They assumed the old one was bad and assumed the new one would correct the problem seen on the previous flight. Who does that to a new flight crew and a load of passengers?

  9. Mark F…How do you test the calibration of an AOA? In many cases, certain tests cannot be performed during line maintenance. And none of us know what Boeing’s maintenance manual requires.

    The purpose of the 8130 is to form a paper verification that a part is airworthy, being signed off by a person at an FAA repair station. With two AOA’s on board, the other one they did not change was working. It appears from my understanding of the what has been reported regarding maintenance, there was no conflict between the two when tested on the ground. If I saw that both were reading the same, that would be a pretty good verification that it appears to be calibrated correctly. And if there is a procedure, maintenance failed to follow in the calibration testing, I am convinced we would have heard about it by now…or will really soon when the lawyers get fully involved. No one knew this AOA, good or bad, was driving an unknown computer trimming the horizontal stab when ever it got what it determined was too much nose up trim.

    My contention is, had maintenance known MCAS existed, was on this particular airplane, there would been addition procedure checks in the maintenance manual for the AOA driving MCAS to make certain it’s calibration and data was indeed accurate. It won’t be hard for the lawyers to determine the Boeing Maintenance Manual procedures for AOA calibration tests pre-Lion Air crash vs today’s enhanced version of the Boeing MAX Maintenance Manual post-Lion Air’s crash. They will be different.

    As an A&P, I have installed parts that have passed all available ground checks, that fail in flight only. And when rechecked on the ground after flight failure, they still check good. It does not happen every day but does happen. Especially with avionics that have anything to do with flight controls, trim, or flight data.

    I will bet you and everyone reading these posts have had to deal with a pesky check engine light that eventually can leave you stranded when it finally tells the cars computer to stop functioning, go into limp mode, or shuts down a fuel pump…and it quits cold. Yet all the diagnostics available cannot determine what is wrong or says the mechanic has fixed the problem and then re-appears 10 miles down the road. This is part of the responsibility nightmare all A&P’s can be subjected to. Until we know, maintenance ignorantly or intentionally by-passed Boeing maintenance protocol, I believe they and the crew were confident they had fixed the airplane properly and signed their signature determining the airplane was airworthy.

    Now we have those folks having to deal with the horror that 346 people including the crew they knew are no dead. None of those maintenance people are the same today as a result. Boeing shares a responsibility in the change of their lives too.

    • I would urge you, and anyone else, but especially Mark, to read the full report to inform your comments. The investigation revealed that the documentation the maintenance people had did not match how the airplane was configured. It indicated the airplane had AoA disagree. That said, there was no documentation that Xtra Aerospace, which overhauled the assembly, ever performed a calibration.

      Further, the airplane, which was only four months old, lacked an unbroken trail of records. At least 31 pages were missing. In any case, in an example of colossal understatement, Boeing’s Muilenburg said yesterday that Boeing screwed up the AoA implementation. Gee, ya think?

      Outrage at the maintainers or the pilots or even Boeing fails to grasp the reality of what happened here.

    • “How do you test the calibration of an AOA? ”
      The previous flight before the crash reported burning smells in the cabin and control problems so severe that the crew declared an in-flight emergency. HOW DO YOU INSTALL AN AoA AND THEN CALL THE PLANE GOOD TO GO? I agree Paul, there is still a lot of information missing and, i’m guessing, all sides are not fessing up. Still, the decision to fly a plane full of passengers WITHOUT testing the “fix” after an emergency is nuts.

      It becomes frighteningly apparent that scheduling was put above safety.

  10. I would also add that the industry’s (airlines and Boeing’s) insistence on not starting with a clean sheet design for these single-aisle workhorses is also part of the problem. The reason MCAS was designed in the first place was because Boeing had to shoehorn in high-bypass engines which were so much bigger than previous that they had to position them further forward than the original design. That led to the issue where at high angles of attack the lift (or drag, not sure which) of the engines, combined with the lever arm of their new positions, induced the plane to start pitching up further.
    I understand SouthWest and others wanting to continue to use the same design plane for economic reasons, but then insisting on it continuing to improve on economies beyond what the fundamental design would allow required that Boeing perform unnatural acts to achieve those specs.
    In the ‘80s, Porsche came out with a great car called the 928. It was a a wonderful, clean sheet design with fantastic performance. It didn’t sell well because it didn’t look like the 911 and it had its engine (gasp!) in the front. As a result, Porsche continues to milk the aged 911 design, also performing unnatural acts of engineering and relying on computers to keep the pointy end going straight, in order to satisfy the market.
    The MAX should be the last incarnation of the 737. Stick it in a museum and start from scratch. As an design engineer, I constantly tell myself to not fall in love with your own designs. If a better idea comes along, even if it’s not yours, toss the old idea into the trash and don’t look back.
    Yes, it costs money. Everything costs money. But in the long run everybody benefits.

    • Fundamentally, the MCAS was/is a (misguided?) effort to replicate the hand-flying characteristics of legacy 737s.

    • Excellent analogy with Porsche, James. The 928 was a great car but the misinformed public couldn’t wrap their heads around it. The 911 still defies gravity with computer controls. I’m not sure how purists buy into that.

      The aviation safety problem is multi layered and I don’t see anyone taking the bigger picture, which to my neophyte understanding is that business as usual should be anything but. Bottom line is that we can’t justify “razor thin margins” dictating human safety. Perhaps it’s time to justify salaries at every level, including those who are not paid enough to fly us safely in the air? Again, I don’t have the wider angle but I’m working on it. Things have to change at every level.

  11. Yars: “If/when in doubt, turn the damned thing off, and fly the airplane.”

    This single statement continues to resonate with me every time I see it. As pilot’s, we are trained to expect the unexpected. When the unexpected happens, “fly the airplane.” When all hell breaks loose, “fly the airplane.” When sh__ hits the fan, “fly the airplane.” When asteroids, hurricanes, earth quakes, tsunami’s and wind sheer present themselves, “fly the airplane.”

    So, what does “fly the airplane” mean to me? It means I turn everything off that does not give me complete 100% control of power, pitch, roll and yaw with absolutely no outside interference to the extent that the abnormal flight situation will allow. I want absolute control to “fly the airplane.” I will get the airplane to fly straight and level to the extent the situation will allow. Then I will hopefully be able to take a breath and figure out what my next step will be. Plain and simple, nothing else needs to happen. This procedure to some extent had already taken place with this airplane previous the two accidents. So we know it works. No one died. Then it didn’t take place and people died.

    At the end of the chain of errors are the pilots. No matter how you cut it, the pilots are the last stop gap in the chain of errors that took place in both accidents and in both accidents, the pilots failed to, or, were unable to disengage all outside control to manually fly the airplane. Had the pilots taken control manually and “flew the airplane,” we would not be talking about these accidents.

    You don’t have to know about, or, concern yourself with GPS, VOR’s communicating with ATC or anything else I can think of to “fly the airplane.” Just keep the damn thing going in one direction straight and level. Isn’t that what we’re taught in the first hours of instruction? Resort back to the basics.

    This really is not that difficult to figure out. We get lost in all of the technical garble, maze and minutia. We get all tangled up in the details that have nothing to do with “fly the airplane” when, at that moment, “fly the airplane” is all that matters.

    • At the end of the day, MCAS introduced one more possible failure mode that can result in a runaway stabilizer. The crews of these aircraft failed to properly identify and respond to a critical flight control malfunction that has been taught for more than half a century. What’s more, unlike the Lion Air crew, the Ethiopian Air crew was forewarned of the possibility of a malfunction and (purportedly) been made aware of the action required to prevent catastrophe.

  12. A quick reading of the accident report indicates that the crew experienced a problem at rotation. The Capt’s stick shaker commenced shaking and the airspeed indicator tape displayed anomalies. Twelve seconds after rotation the PM/FO announced “indicated airspeed disagree”. By my count, they experienced four significant anomalies before the mains left the ground. I’m a Airbus pilot, not currently a Boeing pilot, but the std procedure for airspeed errors after V1 for inadvertent stall warnings during rotation, etc, is: fly pitch and power. For the A320 it’s simply pitch to 15degrees and apply TOGA power with AutoThrottles/AutoThrust OFF (for the initial climb segment). The report indicates that Boeing has somewhat the same procedure. The accident report and numerous reporters take the FO to task for not performing the unreliable airspeed checklist.

    Flying the airplane is the “PILOT FLYING”S JOB! If the PF doesn’t know how to deal with unreliable airspeed and a stick shaker at lift off, he/she/zhee shouldn’t be in that pilot seat. Blaming the PM for not knowing unreliable airspeed procedures is at best a misdirection by the investigators. There’s much more, but I see no need to go past this initial failure to fly the airplane as it regards pilot actions.

    Nothing in the accident report that I see when perusing thru it indicate that pilots are expected to be able to fly with stick and rudder skills, I see nothing more than an expectation that they are able to manage, but not to fly. Sad.

    As far as MCAS goes, the trim wheel spins EVERY time the stab trim moves. Boeing had every right to assume that MCAS malfunctions would be handled by procedures applicable to trim run away. I know,”There but by the grace of God go I”, but how in the world could one not realize the trim was running when every time it pitched down, the wheel spun. That wheel not only spins frantically, it has a white line on it’s perimeter to enhance the visual effect that it is moving; and it makes a distinctive sound as it moves. But a simple read of the report makes plain that MCAS activation was the flnal straw, not the cause.

  13. Like it or not commercial aviation is a system, consisting of many institutional players (the Federal Aviation Administration (FAA), various foreign certification agencies, manufacturers, airlines, pilot unions) and individual players (engineers, pilots, instructors, executives, bureaucrats, etc.), all of whose actions (and interactions) played a role in the final, fatally flawed outcome. This was a SYSTEM failure, and there is plenty of evidence Boeing and the FAA dropped the ball, multiple times. The best synopsis of what happened is the guy who said “From what we know, there are nine things that contributed to this accident, if one of the nine hadn’t occurred, maybe the accident wouldn’t have occurred.” Total validation of the “Swiss Cheese” model. Looking at this as the individual failures of four pilots only ignores the systemic issues and sets the stage for more deadly accidents down the road.

  14. Paul B, quoting your article of the final report…”The agency also said an AoA disagree alert—which would alert crews to a failure of one of the MAX’s two AoA vanes—wasn’t correctly enabled and thus didn’t allow flight crews to diagnose the fault nor the airline’s maintenance technicians to diagnose a mis-calibrated sensor, which had been bought from a Florida company as an overhauled replacement part.”

    “The committee said it couldn’t determine if the installation of a repaired AoA vane was properly tested, but it said the mis-calibration wasn’t detected and the airplane took off in an unairworthy condition.”

    Software for AoA disagree was not enabled which prevented both flight and maintenance crews from diagnosing a miss-calibrated sensor. If you cannot diagnose it, how can you diagnose it? If you don’t know it is there, how do you use what you don’t know? If you cannot diagnose it being miss-calibrated, how do you do a ‘proper” installation check, other than comparing it to the one you did not change? Without the AoA disagree enabled what benchmark would you use? Did the installation check follow Boeing procedures? The report said it was unable to determine if the AoA was properly tested. It may have been tested. However, by which maintenance manuals and procedure? As you said, those manuals did not conform to that airplane. But did maintenance know that? My suspicion is if those manuals did conform, the software enable/disable feature would have been known, MCAS and it’s actions being driven by a single AoA would have been known, and proper procedures outlining installation checks would be known…and Boeing would start getting questions about these new but previously unknown additions to the air-frame. Think of those questions that would pour from airlines, maintenance crews, flight crews when that cat came out of the bag…which it inevitably did after 700+ people died. This mess is going far enough at the present time, for the Southwest Pilots Union and others suing Boeing. Back to my original question, what was the proper maintenance procedure to properly test this overhauled AoA?

    Unless we armchair quarterbacks have access to the same maintenance manuals the Lion Air maintenance people had when that particular airplane required maintenance, access to the logbook entries that summed up what was actually done, the 31 pages of missing documents, and interviewed those who actually did the work, we are still speculating. But those who issued the final report you published make it clear that what is integral for determining an AoA conflict was not enabled. Why not? Who enables it, who shuts it off? Here we go again.

    “Outrage at the maintainers or the pilots or even Boeing fails to grasp the reality of what happened here.”
    Exactly! There is much lack of complete, accurate, and transparent information in this MAX debacle. What is disappointing, frightening, and downright disgusting is how MANY participants have played key roles in the causal chain of events leading to these two MAX accidents. And even at this late date, accurate information from many of these players requires incredible extraction. The scope of this boggles my mind. A dominant theme to me is how many people involved in these MAX crashes and subsequent investigation appear to not care about aviation safety, and summed up well by Don L… “where has the value of life gone?” At this stage of the investigation, another dominant but similar theme is percolating to the top…that being…I am not sorry for my actions, I am just sorry I got caught.

    This is a highly emotional series of accidents as most of us have had to deal with in-flight emergencies. In all cases our decisions would and will have an affect on ourselves, passengers, those on the ground, and our families. These events cause us all to look both inward and outward igniting a huge amount of passion and outrage. How we channel these emotions for the best benefit to all is the challenge.

    If participating in aviation is all about self, that attitude ignores the harsh facts that anything that goes wrong in flight will have a huge impact on a huge numbers of others beyond self. No matter if we fly a single seat ultra-light or a modern commercial airliner. Aviation is not just all about us.

    • As more unfolds–chiefly the lawsuits, I suspect–we will learn more But thus far, it appears that Boeing’s decisions were significantly shaped by two beliefs: That the likelihood of MCAS activation in service would be remote and thus the probability of inadvertent activation due to a failed sensor remoter yet. And anyway, if it did happen, the pilots would handle it as a plain-vanilla runaway trim, something it was not.

      Many pilots have told me–most in fact–that these crews should have been able to cope with this. I dunno. I’d like to put some pilots in a sim unawares and run this scenario…hey, see if you can handle this.

      • “Many pilots have told me–most in fact–that these crews should have been able to cope with this. I dunno. I’d like to put some pilots in a sim unawares and run this scenario…hey, see if you can handle this.”
        This is a back handed slap Paul and you know it. These 737 MAX pilots are trained and tested relentlessly in the airplanes they fly. They are supposed to know everything about the airplanes they fly so in the event of failure their response is nothing short of mechanical. And, in the event they do run into something that has not been included in their training, they are supposed to fall back to the basics and “FLY THE AIRPLANE.”

        If for whatever reason a pilot, or, crew does not know how to IMMEDIATELY address a quickly deteriorating situation, the next focus and action should be to “FLY THE AIRPLANE” until the situation is stable enough to move on. That reaction should be knee jerk.

        A drowning person does not let themselves sink below the surface while they determine which stroke they want to use. Hmmm 🤔, let me think 🤔, should I use the breast stroke, or, crawl? No, they immediately start treading water (back to the basics) to keep their head above water and then and only then do they think about what their next course of action should be.

        • Not a slap at all, Tom. In my correspondence with pilots–including a few of who have flown the max–I would say seven in 10 say the pilots could and should have managed the MCAS misfire. But those three weren’t so sure and they’re the ones charged with actually doing it.

          After the fact, it’s easy. Even I could probably manage it since I know all about the cutout switches and even the roller coaster technique. Now. But if you didn’t know all that. I’m not so sure.

          • Ok, I apologize. I read into it wrong.
            However, I think you may have somewhat missed my point.

            “But if you didn’t know all that. I’m not so sure.”
            And, that is my point. When you don’t have all of the info at hand, when you are on the verge of panic, you immediately regress to the basics. Fly the airplane. It should be as natural as breathing air. Thinking should not be necessary.

      • Well, I know of at least one airline pilot that was thrown the Lion Air scenario in the sim after Indonesia but before Ethiopia. His first thought was “why is the trim wheel spinning?” Followed soon after by hitting the cutout switches and flying the plane… just like a Cessna.

        Would he have done the same before the accidents? Hard to un-ring that bell and run the experiment again, but it didn’t seem to be an ‘abnormal’ abnormal to him.

        My gut says the U.S. carriers have been flying many more hours in many more 737 MAX planes, yet without incident. Was it due to better maintenance so the failures never occurred? Or better training that handled the failure without fanfare? Or just pure dumb luck in that the failures simply never happened? I’d be curious to see how many (if any) U.S. carriers had similar MCAS failures.

  15. As a professional computer programmer who flies small airplanes in his spare time, I’m doubly offended by the whole affair. It sounds as if Boeing broke a rule I learned early in my career, which makes the top entry in my list of Famous Last Words: “Oh, don’t worry about that; it’ll never happen.” In my experience, “never” usually turns out to be about six months. Murphy never sleeps.

    It is inconceivable to me how anyone would consider designing MCAS to be fed by only one AOA sensor. What happened to the redundancy that we pride ourselves on? Every little puddle-jumper has had dual ignition systems for the better part of a century. And making the AOA disagree indicator an option? Since when has safety been an option? Don L. asks, “Where has the value of life gone?” There are armies of actuaries out there who will tell you exactly where – and plenty of large corporations who take their word as gospel.

    But let’s get back to the original point of this article. As satisfying as it may be to select a scapegoat and punish the hell out of it, we must put our petty urges aside and look for real solutions. Complex problems can have many causes, and we must have the maturity to deal with as many of them as we can.

  16. “…in the event they do run into something that has not been included in their training, they are supposed to fall back to the basics and “FLY THE AIRPLANE.””

    I don’t remember the specific flight numbers, but there have been several instances where pitot-static system components have been blocked and upon rotation the pilots get both stick-shaker stall warnings and over-speed warnings, and the cockpit is a mess of contradictory warnings. It’s easy in retrospect to say “any good pilot should have been able to resolve it”, but it’s not always so easy when you’re in the middle of it.

    Yes, these pilots “should” have been able to recognize it as a runaway trim issue, but so should the crew of Colgan Air recognize that their situation was a main wing stall, and they were a US crew. But both crews had some deficiencies going in to the situation which made the hill they had to climb to resolve the situation even steeper. Start with a crew that isn’t 100%, then add in some contributing factors that reduce their performance even further, and when an unexpected situation arises, they’re just short of the performance that they need to successfully recover from.

  17. I totally agree with all of Tom Cs comments like “FLY THE PLANE”.
    Panel display failures or disagreements should be no big deal in 121 A/C since the independently powered standby horizon should be the #ONE gage to go to! Using that & cruise power will safely allow time to resolve problems.

  18. Watching the Boeing CEO testifying before the House again on CPAN overnight, a question never brought up here in any of the blogs pops into my thoughts.

    Beyond the issue of MCAS taking command of the trim system under certain conditions of flight, WHY was the only way to turn it off to turn the whole trim system off? I liken MCAS to an errant Flight Director taking command of the autopilot. You can turn the Flight Director off and still have the autopilot fly the airplane, if necessary. I now also see where — early in the design iterations — an MCAS warning light WAS planned but never implemented. The nine points in the accident chain notwithstanding, the crew of the Ethiopian airplane knew of the existence of MCAS, DID disable the trim switches but then found they couldn’t manually trim against the forces of high speed flight (when they failed to retard the power levers). Had they been able to turn MCAS off yet retain the powered trim system, things may have gone different on the second accident. Had an “MCAS Active” light come on, a switch to disable it been present and a bit of training, the outcome would have been different.

LEAVE A REPLY