Two Tragic Accidents And We’re Arguing About Sim Time?


When the last human pilot exits the cockpit and the cockpit no longer even has a door for a human, we’ll still be arguing about the benefits of aircraft automation. For the time being, this much is true: There is general agreement that widespread automation is eroding pilot physical skills, if not judgment acuity along with it.

If this is so, last week should have been a tipping point in the discussion, although it probably won’t be. Significantly, a pilot union—specifically American Airlines’ Allied Pilots Association—questioned both the way Boeing implemented automation in the 737 MAX and whether proposed fixes include adequate training.

Perversely, even in the face of two major hull losses, Boeing is improving the automation and training pilots on its characteristics by offering—you guessed it—more automation in the form of computer-based training that doesn’t require simulation. This is largely for cost reasons because, as the Seattle Times has reported, Boeing was on the hook to offer discounts to customers if special training was required. It was a competitive cudgel and Boeing wanted to use it. That contract fine point may have served as a Petri dish for what followed.

Before I read the Times story on how Boeing got itself into the MAX mess in the first place, I had a neutral view. Let the airlines and their pilot unions figure it out. Now I think Chesley Sullenberger, who roasted Boeing last week for what he viewed as a fundamentally flawed certification of the MAX, is right in insisting pilots should get sim training on MCAS abnormals. Just add it to the training routine.

One reason they did not was Boeing’s hubris in believing that the system’s likelihood of failure was so infinitesimally small that not only was training not needed, pilots didn’t even need to know of MCAS’s existence. Two crashes within six months proved the company was tragically wrong and, I think, exposed profound flaws in the Boeing certification organization. In modern certification, one crash might be a fluke, two is a five-alarm fire stoked by plaintiff lawsuits.

Boeing assumed that in the unlikely event that the system failed, pilots would be the last backstop to keep things from spinning out of control. But consider what the pilots of Ethiopian Airlines Flight 302 that crashed in March faced. The list included an active stick shaker inaccurately warning of an impending stall, an overspeed clacker, an aural “don’t sink” warning and several other disagree and warning lights. Sullenberger said he struggled to regain control in a simulator run mimicking the accident flight.

If you’re flying in a system where little is supposed to be left to chance, is it good enough to experience all that on an iPad or would you prefer the muscle memory input of the simulator? I know what I’d pick. The fact that I haven’t seen any stories explaining how Boeing has been to the mountain on this makes me wonder if anything has changed. Is saving a few million on the contract price worth the risk of another crash, which would prove staggeringly expensive?

In delivering his testimony, APA President Daniel Carey was blunt in brushing back a budding movement to blame the pilots. “I can tell you that the members of APA are offended by remarks made by those who seem to blame the pilots killed in those two crashes,” he said. “I am here to tell you that I worked in Africa and trained African pilots to fly large aircraft. I am very familiar with Ethiopian Air’s pilot training program and facilities, and I can tell you that they are world-class,” he added.

While I found his testimony convincing, he did not address—nor has Boeing—the fact that both accidents were caused in part by failed angle-of-attack sensors on aircraft operated by foreign airlines, Indonesia’s Lion Air and Ethiopian Airlines. Whether this proves a relevant part of the accident chain is unknown, but it can’t be isolated from system safety because the world is striving for one high level of safety. And if Boeing thought MCAS failure odds were in the trillions, they couldn’t have been paying attention or at least understanding their own data.

This has implications for general aviation as automation and eventually autonomy advance. In the coming months, you’ll see some surprising developments in cockpit automation. These will once again test the notion of where the pilot fits in. The NTSB continues to raise the alarm about loss-of-control accidents and the topic has become a staple of aviation journalism.

So there’s the tipping point again. If pilots can’t hand fly airplanes proficiently to the point where loss of control is just an occasional thing, do we give up on training them or lard the airplanes up with ever more gizmos? Are we at the point where homo the sap is just a lost cause, an inevitable cast aside of useless evolutionary junk? Maybe we’ve evolved into a black gap where neither the pilot nor the automation are up to the task.

I’m quite certain I don’t know. I’m not a gauzy-eyed stick-and-rudder, tailwheel-flying romantic. I like the idea of automation; I dig technology. But it doesn’t matter what my opinion is.

Boeing is supposed to know and from what I’ve seen so far, I don’t think they have much of a clue either.

Other AVwebflash Articles


  1. In Sullenberger’s first book he seemed to mention the pay cuts that airline pilots had to take in every chapter. While it is fun to complain about how much some folks make for what we would consider “easy” jobs I always thought that part of their pay was to allow them to fly, and keep their basic flying skills up to date. I knew an airline pilot who was out in the pattern in a Cub at least once a week. The airlines don’t force the pilots to hand fly and the accountants don’t like the cost of hand flying so we find ourselves watching the erosion of skills without any way to change it.

  2. Are we proving (over and over) that partial automation is a less than ideal choice? Perhaps we need to make the call – is the pilot in control, or is the computer? If the pilot is in control, the computer should not be making inputs.

    We could go fully-automated – pilot out of the loop, monitoring only (humans kinda suck at this, so the less monitoring, the better). Like an always-on autopilot that does everything, gate to gate. More development is needed here, but it is a solvable problem.

    We could go non-automated and stop adding ‘features’ that provide inputs that the pilot isn’t commanding and thus potentially confusing him and leading to disaster. The pilot will need to ‘fly’ more than is becoming common today, but how is that not a good thing when things go awry?

    The middle ground seems to be increasingly littered with tragedy, eroding piloting skills, and confusion (“what is it doing now?”).

    • Recently talking with a famous pilot most of you here know of, this exact subject came up. The comment was made regarding automation in Airbus’ that the two most commonly heard comments in the cockpit aree, “Why did it do that,” and, “what’s it gonna do next?”
      I recently had a similar ‘spat’ with a newer pickup I have. Some meathead designed a failsafe software routine in the ECU that shut the engine down while it was being driven. When driving it IN traffic, the thing shuts down and I had to wait 5 minutes before it’d allow a restart. Turns out the ECU had gotten ‘stupid’ while it was parked for six months. The software allowed it to be started in some “fail safe mode” but then it’d shut down and I’d have to wait. In the hands of a different driver, this could have lead to disaster. Same story, different vehicle. You can’t see, feel, touch or even know of software … it’s invisible.
      So when I hear that Boeing is designing new software for the Max airplanes … WHOA! I want sim time AND I want to know what those software routines are potentially gonna do to the airplane.

  3. As for non piloted transportation aircraft, I suggest we wait to see how non human driven cars for transport of humans works out. We need to give that plenty of time and there will be some accidents but hopefully less than caused by human driven surface vehicles. Lets work it out in 2D before we take it to 3D.
    As for commercial and military pilots (both our cream crops), I have found that only 10-15% have time or interest in staying in the loop of hand flying small GA aircraft. In the heavies, they don’t get to practice real stalls (both coordinated and uncoordinated) and also don’t get much time doing slips or flying on the edge (which or course you don’t want to do in heavies).
    Our GA Glass panels don’t have a presentation of coordinated flight that can compete with a turn coordinator in my opinion.
    Let’s work on that Garmin, Avidyne, Aspen, etc. Most glass panel presentations of standard rate turns and half standard rate turns are nowhere near as easy to use as a turn coordinator in my opinion. and certainly the substitute for a ball is not even close as the ball in a curved tube indicator that we have been using since the ’30’s.
    The computer data may be as good or better but the presentation sure doesn’t seem as good to this writer!
    For now we need to make existing pilot better. Staying in touch with GA aircraft might a route to take along with more innovations in the flight training industry which sorely needs it, regardless of the progress we have been making.

  4. I am a retired aerospace engineer who has worked for Lockheed, Boeing and Douglas, on missile guidance, navigation and control.

    I worked for Boeing on the SaturnV Moon rocket (We were Systems manager). Even 50+ years ago Boeing knew enough to provide triple-redundancy, with voting logic, in its flight control systems. I cannot FATHOM why they failed to provide this feature in the 737 MAX 8.

    I have been reading the Wall Street Journal’s features on this problem, where they reported that Boeing effectively froze their test pilots out of the design loop. The software people must have imposed an arrogant approach to the design. In my experience, some of the software people dismisse the input of people working with their product, resulting in embedded bugs.

    I would also fault Boeing’s decision to move corporate HQ away from Seattle to Chicago, while retaining engineering and manufacturing in Seattle, Charleston and elsewhere. This very move isolated company management from their own engineers, who could have access to report problems, face-to-face..

    • I wholeheartedly agree that moving HQ from SEA to ORD was a bad move. CEO’s and executives who are close to their products/services are much more apt to be hand’s on and intimately involved in the entire process. They might as well have moved to Wall ST to advance their purpose.
      It is a fact that operators of equipment or services must be intimately involved in the design and testing phase if the product or service if it is to succeed out of the box. It took Garmin a while to learn it, but they have nailed it.

  5. Is anyone else bothered by the Seattle Times’ (as well as other media outlets, including AvWeb) continuing claims that Boeing has not accepted blame? Muilenburg’s statements following the Ethiopian Air crash included the following:

    > We at Boeing are sorry for the lives lost in the recent 737 MAX accidents.

    > [The] accidents were caused by a chain of events, with a common chain link being erroneous activation of the aircraft’s MCAS function.

    > The history of our industry shows most accidents are caused by a chain of events. This again is the case here, and we know we can break one of those chain links in these two accidents. As pilots have told us, erroneous activation of the MCAS function can add to what is already a high workload environment. It’s our responsibility to eliminate this risk. We own it and we know how to do it.

    Are these statement untruthful or misleading? What would a blame-acceptance statement satisfactory to the media mob look like?

    The main theme of these articles seems to be that since Boeing has redesigned the way MCAS operates it should admit fault in the original design process; either its process is flawed, or it didn’t follow the process. Is it possible that Boeing did indeed follow proper design/test/implementation processes AND that those processes failed to take into account all factors involved in the pilot/system interface? Isn’t that the case with pretty much all aviation accidents traced back to aircraft design? Humans design something they believe will function in a particular way, or that pilots will interact with in a particular way, only to find they lacked a full understanding of how that something works in the real world.

    If Boeing actually cut corners in its design process the public absolutely has a right to know. But shouldn’t we have proof before smearing a company that deserves a large share of the credit for a decade of unprecedented aviation safety in which some 90 million commercial flights were conducted with only a single fatality? The Seattle Times article includes the statements of “people involved with the program” (who are they?) “[t]wo people familiar with the discussions” (who are they?), “an engineer” (who?), “two people familiar with the details” (who?), “one of the people familiar with the MCAS design” (WHO!!?), but stops short of making any direct claims about Boeing’s behavior, choosing instead to rely on innuendo. I guess we can take comfort in the fact the Seattle Times recognizes that innuendo is not proof.

  6. There are serious flaws in the reasoning put forth in this article. The first is the tacit implication that required simulator training would have somehow “fixed” the flawed MCAS certification. If an experienced pilot like Sully “struggled to regain control” after a single point failure in a scenario he knew was coming, then the system should have failed certification as designed. No amount of simulator training can correct a serious flight control problem with effects like those. Now, a “software fix” has been proposed and is under review. The MCAS system now has, presumably, substantially different failure modes and effects. The decision as to whether or not additional simulator training should be required will depend upon a thorough review of those failure modes and effects. The MCAS certification process was a tragic failure – let’s not jump to conclusions about what is required to correct it.

  7. FAA approval of minimal training is nothing new. Back in the 90s, a large multi billion-dollar concern operated dozens of 757 aircraft. When they bought new 767s, the training consisted of a workbook and videotape. The only hands-on training required was how to the open and close the door. I’m not kidding.

  8. Decades ago the 737-300 series had a problem with a rudder hardover as flap was extended on approach. The fix was a 10kt increase on the flap/speed schedule for flaps 5 thru up, however one airplane was lost before thi was done. The 700NG had a revised rudder fit and the problem disappeared. When the TCAS system was retrofitted on the 747-412 the airline gave every crew a 2hour sim detail to familiarise.It is surprising that the revised & reformed MCAS will not require a similar presentation with the new software.

  9. Mr. Bertorelli has consistently written about the MAX in a vitriolic fashion. It is a truth that a second vane input should have been an input for MCAS. It is also a truth that both of these accidents could have been prevented had the pilots used their left thumb. Boeing was in the process of re-working the MCAS when the second accident occurred and had issued bulletins to operators. The final accident reports and findings are not complete in either of these accidents. In either case a blame game does not serve safety. Yup….its the fault of the software designers. Right.

    • Vapid comment. It’s about 357 lives lost and the loss of public confidence in the aircraft.Boeing erred, people died, design malfunction not yet controlled, several hundred aircraft grounded, a Boeing nightmare yet the spin continues.

      Mr. Bertorelli is correct.


  10. It is clear to me, there is a basic disconnect by designers/engineering/manufacturing, with the art of flying. Automation is supposed to augment or replace hand-flying. To accomplish that, the design team has to clearly understand flying. Not only from the basic lift/thrust/drag/gravity, but how an airplane feels when flying in all regimes of flight. Likewise, when pilots are largely depending on the automation to bear the heaviest burden of the flight from gear up to short final, it is not hard to understand the loss of hand-flying skills. Throw in the cost matrix of both certification for the manufacturer and hand-flying time expense to the airline, we have created the perfect storm of “who’s flying the airplane”.

    Where does automation start/end and where does hand-flying start/end? And who or what should be intervening when either the automation or hand-flying skills go south? And what do you do when both systems are failing at the same time?

    I have always believed that in both crashes, the crews were doing everything they could to save the airplane. I have always believed they were well trained. So far, the data from both crashes have demonstrated both crews were facing significant conflicting information and initially did exactly what Boeing said needed to be done, in the order Boeing had dictated. When all of that failed, both crews explored other options…all of this in a matter of a short period of time. Even Sully, well prepared for an MCAS event, seems to barely have managed to regain control…and he was in a sim, not an airplane full of people.

    As sims are so good to mimic actual flight, it is still only simulation, in a sim in perfect mechanical condition mimicking a brand new airplane. Throw in 800+ hours air-frame/engine time in a particular density altitude/wind/visibility/cloud cover with 800+ hour engines, control responses, etc… in other words an airplane whose dynamics are slightly different than a brand new one.

    But a sim does not mimic a “used” airplane. Real life flying in “used”, dirty, chipped, possibly previously abused airplanes is what the art of flying is all about. The art of flying dictates how we handle an airplane that has had much maintenance done on airplane and the degradation that can cause. All of the above contributes to the actual conditions and the flying characteristics of those two MAX airplanes at the very moment MCAS went bonkers. This is where the art of hand-flying is so important.

    We are facing the harsh realities of the collision between automation, eroding flying skills, designers disconnected from the realities of used airplanes while actually in flight. Simulation is great, tactile feed-back is sorely needed, but in the end, the art of hand-flying cannot be replaced by automation that believes every flight is in a brand new airplane, in a flight regime that is only as good as the minds of the programmers. And if those programmers do not fully understand the realities of “used’ airplanes” in a largely polluted environment, it is only capable of simulating things in a perfect world.

    We don’t live in a perfect world, nor do we fly perfect airplanes.

  11. With all due respect to earlier posters, Muilenberg’s public announcements amount to little more than carefully worded lawyer-speak. Boeing has circled the wagons and nothing comes out that hasn’t been sanitized by the legal department. What ever internal changes come out of this will be kept behind closed doors, but we can only hope they have learned a lesson.

    With regard to cockpit automation, any new system can lead to a deterioration in flying skills if the pilot is willing to let it happen. Let’s face it; it is human nature to allow something that eases our workload to become part of our flying “process” over time. The insidious problem is that sometimes it tries to help when we least expect or don’t need it. Case in point for GA is the new generation of autopilots that include some measure of envelope protection to keep us from exceeding certain airspeed/AOA/bank angle limits. The autopilot, whether turned on or not, begins nudging us back to where it thinks we should be. Good or bad? You decide. Paul B. has legitimate concerns, especially if there are significant new developments coming soon. In the end it is incumbent on all of us to throughly understand how any new system we install works and to what degree it affects how we fly the airplane.

  12. In the USAF at bases where high value / limited quantity airframes exist and flight time is a problem, they use lessor airplanes to “nimble up” the crews. Example, (SR-71), U-2 and B-2 crews use T-38’s to maintain proficiency. I know of other flight operations which do the same thing with GA airplanes. Why couldn’t airlines do the same IF “muscle memory” is a root cause issue?

  13. Sadly, automation is feeding the biases of the beancounters. Every company out there with an airplane also has a beancounter. The more airplanes on the ramp, the more beancounters behind desks. Beancounters are necessary, just like hangers, ticket counters, maintenance facilities, and belt loaders if the company wants to succeed, or at least stay in business. If nothing else, a good group of beancounters will keep the IRS away from the door.
    The problem with beancounters is their totally skewed view towards training. While we aviators all “know the value” of good training it is clear that beancounters do not. They, as a group, tend strongly towards treating training as an overly negative cost center. They scream and yell at meetings that training costs too much for the lack of obvious value received. They love CBT because there is no travel of accommodation costs involved. The fewer times that crews have to get formal training per yer the better!! “Save that penny but we will overlook the potential dollar the training could have saved! We can’t define that saved dollar because it doesn’t really exist”. To add to this negative effect, managers everywhere have become thoroughly indoctrinated into this attitude of “save money-cut training”.
    Now. computers and automation are putting beancounters and management into a feeding frenzy of cut-cut-cut. Cut training, cut crew members, heck, cut seats in the cockpit. We don’t really need two (or any?) pilots up there, just somebody to make sure the lights stay on. Computers cannot fail, cannot fail, cannot fail……..
    Beancounters and the management they have influenced will continue to degrade aviation to the point where I, with my 20K+ hours of flight time won’t climb into any aircraft I am not personally sitting at the controls of. Good luck to the rest of the flying public.