I wonder if the FAA is even properly equipped to examine, test, and certify software like the MCAS law even in the best of times, much less under the current administration.
Considering they essentially abandoned doing certification themselves over 20 years ago, I would kind of doubt they have the institutional memory or people to conduct that function.
And yet, over that time, airline travel has become unprecedently safe. I think it is reasonable to assume that the FAA can function effectively in this manner, if (and only if) it is adequately funded for that role, and its independence is respected and protected.
This is an example of why humans are terrible at evaluating risk that comes with a time lag. Airline travel was becoming safer on regulatory standards and decisions probably made for the most part 20 years ago at critical design stages of the current fleet of aircraft.
"Past performance is not a predictor of future results."
I still upvoted your comment even though I disagree with the sentiment because I see this a lot when risk management is considered by many. Unless risk management is your domain expertise, or you've been to lots and lots of different organizations to observe what works and what didn't, it is a very human perspective.
Risk management is not performed by saying, "Nothing bad has happened even less, therefore let's keep with the status quo or make it more lax to save money." Reactive risk management based upon the rear-view mirror is a great way to invite extinction-level tail risk into the organization's house.
We could play an exciting game of Cognitive Bias Bingo [1] with such a perspective, though.
Air travel has gotten much safer over the past half century and an usually high percentage of 737 Max aircraft have suffered a complete hull loss with all passengers and crew dying. As has been mentioned before "past performance is not predictive of future results".
As best as Wikipedia can tell me, Boeing has delivered 130 Max's which flew ~120,000 flight hours. Even if we completely disregard all MCAS failures that the pilots were able to mitigate, two 737 Max 8's were destroyed within the first two years of operation, representing ~1.5% of the aircraft actually in operation in two years. That is a pretty alarming statistic, and points to the Max 8 genuinely being an unsafe aircraft.
The FAA didn't even want to ground the Aircraft. It was completely reactionary after every other jurisdiction did and was reportedly demanded by the president. They are fundamentally untrustworthy, they thought 2 fatal crashes were not worthy of grounding a brand new design.
The deregulation process is the issue, which was a major effort of Bush'43.
“The roots of this crisis can be found in a major change that the FAA instituted in its regulatory responsibility in 2005. Rather than naming and supervising its own ‘designated airworthiness representatives,’ the agency decided to allow Boeing and other manufacturers who qualified under the revised procedures to select their own employees to certify the safety of their aircraft. In justifying this change, the agency said at the time that it would save the aviation industry about $25 billion from 2006 to 2015. Therefore, the manufacturer is providing safety oversight of itself. This is a worrying move toward industry self-certification.” -- https://www.dcreport.org/2019/03/18/how-deregulation-made-fl...
Obama should be faulted for oversight perhaps, but the ball was rolling long before.
While I'm not a 737 expert, I have evaluated flight software (FSW) and vehicle management systems (VMS) on Gov't programs. Mr. Ewbank points out systemic deficiencies in the 737 VMS and controls.
It would seem the question to be answered by the FAA is whether they intend to address these systemic deficiencies or just the proximate causes of the crashes. It would be a valid, and more rigorous view that since these aircraft are already out of service in an unprecedented way, these systemic issues should be addressed as well. To be clear, it will involve significant engineering work to do so.
There will be immense pressure on the FAA, especially since the aircraft has been out of service and damaged Boeing economically so much already, to just deal with the proximate cause (i.e., stay the course they're on now). That will come from Boeing of course, but also internal management and their perceptions, as well the implicit or explicit pressure from the political class.
Speaking purely for myself, I hope the FAA does force the root causes to be dealt with as Mr. Ewbank advocates (I don't know him, but have immense respect for his coming forward like this - you have to know and understand the systems to be able to provide this kind of critical review).
However, I wouldn't at all be surprised if the fact they have already started down the path they're on causes them to retrench and leave these root causes unaddressed.
> The FAA allowed the regulations to be modified to fit the 737’s preexisting design
Terrible.
I wonder, if the FAA gives the 737 MAX the all clear, but no one else does, what does that mean for the aircraft? Would a US-only certification still be an effective grounding in all but name? I guess there are a bunch of routes within the US, but there must be crap-tons elsewhere too (and presumably international from US<->* that formerly used 737 MAX)?
It'd certainly be a disaster for international airlines or operators, and I'm fairly certain an extremely powerful statement in terms of catalyzing domestic pushback. To be frank, if I worked at the FAA, I'd be kicking and screaming to resolve any level of concern raised by engineers in good faith before giving the go ahead. It may not necessarily appear as such, but the FAA, while having taken a credibility hit, has not taken one severe enough to unseat it as a leading international authority.
If it goes ahead and gives the green light when the rest of the world isn't sold on it, then we can unambiguously say the entire regulatory institution is irredeemably defective.
At that point the only real fix is an absolutely amazing change in the Executive branch, or a Legislative solution; and I have doubts on the efficacy of the latter, since a regulator is only as good as the people staffing it at the best of times.
> To be frank, if I worked at the FAA, I'd be kicking and screaming to resolve any level of concern raised by engineers in good faith before giving the go ahead.
I agree and I'd like to add that in my opinion the airplane now needs to actually be better than its competitors.
If it isn't and there is another accident (big or small, that might or might not involve deaths but which might even slightly be related to MCAS or other systems having similar design flaws) then I think that there would be again another (bigger?) round of repercussions: for the plane itself, for Boeing and for the FAA.
Saying this because I imagine that a negative event might become a final public and/or political confirmation that 1) the FAA & Boing cannot be trusted and that 2) the airplane has just too many flaws that need to be addressed.
Therefore, to avoid this, the plane must be absolutely rock-solid otherwise if anything happens people will immediately ask Boeing and especially FAA "why did you create/approve this thing - are you incompetent and/or stupid and/or unscrupulous?".
The 737 isn't really designed to fly longer international routes - it's mostly used for domestic short haul flights. However, the international market is absolutely gigantic, especially the Asian one, and not being able to fly 737s in countries other than the US would be a godsend for Airbus and a tremendous blow for Boeing.
The irony being that the FAA bent over backwards to make it easier for Boeing to certify this aircraft, and they’ve probably done more damage to Boeing than anyone could’ve ever imagined.
Turns out competent safety regulation matters, who knew?
A big part of the Max’s sales proposition was that it shared a type certification with the old 737. This meant that pilots would need minimal retraining, and could easily swap back and forth between the two easily. This requirement is why the MCAS software wasn’t properly documented; to avoid expensive retraining requirements that would be unattractive to buyers.
Ignoring the training issue (which is already long gone), the inability to take the Max abroad would be a serious hindrance for sales. It means that it would require that airlines track them separately for routes, making sure to never take the Max 8 outside of America, which is exactly what Boeing was hoping not to do with the Max 8.
> It would seem the question to be answered by the FAA is whether they intend to address these systemic deficiencies or just the proximate causes of the crashes.
There are really two separate questions: first, should the FAA address other deficiencies particular to the 737 MAX, and second, should the FAA go beyond that to require Boeing to fix issues that are common to all 737 models?
I agree with Mr. Ewbank that the answer to the first question is yes; but he also argues that the answer to the second question should be yes, since the issues he points out in the latter part of the paper are not specific to the 737 MAX, as far as I can tell, but affect all 737 models. I don't agree that Boeing should be forced to address those issues, since that would amount to decertifying all 737s, which is not justified by the safety data; no other 737 model has an accident record that justifies any such decertification.
The key difference is the 737 MAX is a new airplane intended for many more decades of service. Presumably the older 737s will age out and already have well known behaviors that are not as troublesome due to a more forgiving pairing of engine size and airframe balance.
It bothers me that when lives are lost, our first response as a greedy capitalistic society is to cut funding, considering there aren't really many competitors, and the switch-over costs for airlines would be prohibitive.
We should be funding efforts to investigate the heck out of this and make sure it doesn't happen again. I'm not sure how one would structure such funds to make sure they aren't abused, but I certainly don't want Boeing cutting more corners and hiring less-competent lower-salary aircraft engineers because they are now low on funding and need to get the plane out before some damn quarterly earnings report.
Boeing paid $11.7 Billion dollars in stock buybacks in the two years preceding this fiasco. All the money they ever needed was already there.
Instead, they spent the money inflating executives portfolios. And now you want more money going to them? If they want to privatize the gains, they can privatize the losses. Your sympathy is very misplaced, IMHO.
No, I clearly said "I'm not sure how one would structure such funds to make sure they aren't abused". I want more money going to engineers, not the executives. But I do like to think with a forward-thinking mindset about how to make that possible instead of dismissing the problem and saying cutting funds in the right answer, because that definitely doesn't get more money in the hands of engineers to debug problems.
Perhaps more money to engineers + a third party audit company appointed by the court + fire the executives that did wrong, I don't know, but I'd like to be optimistic about it. Taking away funds is only going to strip engineers even further of funds for fixes, make unsafer planes, that's for sure.
The executives that inflated their portfolios while knowing there was going to be safety issues -- I support punishing those individuals. Not Boeing as a company though, since we pretty much depend on them.
Boeing paid $11.7 Billion dollars in stock buybacks in the two years preceding this fiasco
I didn't know that. What kind of development budget did the Max have? If they'd taken 10% of that to do $1B more safety related engineering during the project, might that have helped?
probably not. As the joke goes, how long will it take for you to finish the project? one year. How long will it take if we put 5 devs on it? two years. How about if we put 50 devs on it? It'll never be done.
I read a good portion of the FAA's preliminary report that came out a couple months ago. They are completely incompetent. The report didn't include ANY data about rate of failure of AoA sensors, number of engagements of MCAS in the field, or number of flights where the plane was landed without MCAS enabled.
It contained vague statements like 'rare set of circumstances' with ZERO data on the expected probability. As we know in the software world, a 1 in a billion chance could happen many times per interval given the scale of any particular problem.
Yeah it is really sad, but Alaska Airlines and Southwest airlines may become untouchable for me in the future if they proceed to integrate the MAX back into their fleet.
Does it matter? The 737 wasn't cancelled back then after 2 crashes. Point is that they solved the problem and the plane went on to fly successfully and the public forgot about it. They didn't second question the entire aircraft design over one fault like we are doing today.
Wrong. They didn't solve the problem. A pilot that happened to press the opposite rudder pedal saved the plane. They were only able to 'solve' the problem after someone heroically saved a plane full of people by doing the exact wrong thing intentionally. The FAA deserves exactly 0 credit for that, as they were willing to let more people die.
The thing is, you are really punishing the airlines by doing this instead of Boeing. Boeing also produced the 787 and 777 and the same time they were working on the 737 MAX and those aircraft have superlative safety records. I think you leave the decision up to Boeing with the caveat being that if the plane crashes again due to a design flaw, it will never fly again which would be devastating to Boeing. If they are confident in moving forward with those stakes, then I would fly on it.
> I think you leave the decision up to Boeing with the caveat being that if the plane crashes again due to a design flaw, it will never fly again which would be devastating to Boeing.
What is the downside for Boeing to just say "let's put the plane back in the sky"?
They already took that gamble and lost, twice. Would not be surprised to see them gamble with human lives again. Got to hit those quarterly sales figures.
I think you scrap the plane, then start over with a wholly compliant design. This whole ordeal is a great example of regulatory capture. You have a plane with a ton of new flaws, and all the flaws of the old design, and business decided it was cheaper to pressure the regulator to be okay with these flaws and to kill a few hundred people than to build a proper plane, but let's give them one more chance to kill a few hundred more people, so they're not financially inconvenienced over a problem of their own making.
There have been thousands of passenger jet crashes and on the broad scheme of things this plane is still extremely safe. The fact that it wasn't a redesign means it builds off all the lessons learned over the 30+ years the 737 has been in service.
"Got to hit those quarterly sales figures."
An aircraft that crashes is pretty detrimental to achieving this goal. Achieving sales figures doesn't preclude safety
Chasing short-term profits at the expense of long-term losses is a popular pastime of management/C-suite executives who are motivated more by "what's good for me" than by "what's good for my company/employees/customers". It creates a culture where everyone is acting more out of self-interest than they ought to.
Eventually, the company pays for it, but it can take a while.
The culture at Boeing has changed, and it seems to me that the quarterly numbers are more important now than previously.
>The fact that it wasn't a redesign means it builds off all the lessons learned over the 30+ years the 737 has been in service.
No, obviously it didn't, since the redesign changed the fundamental flight dynamics of the plane. It was not improving the design, it was piggybacking off the good record and past training of the old design to push out a fundamentally different product as quickly and cheaply as possible.
>Achieving sales figures doesn't preclude safety.
Then how did these fatal 737 MAXs ever get released in the first place?
Some of these points seem really sensible and well thought out. For example being able to silence the stick shaker and overspeed warnings.
However, some of them seem completely over the top. A complete review of the 737 control system for example, given its operating record across the fleet, would as likely result in introducing new failures as eliminate some as yet unknown failure mode.
Question: my understanding is that the purpose of MCAS is to make the 737 MAX behave very similar to prior 737s in some unusual flight situations. There are two main reasons for this:
(1) Existing 737 pilots would not need to be recertified for the MAX. They would just need to read a short document that updated the procedure for handling runaway trim.
This would make the plane more attractive to airlines because it meant not having to pay for expensive recertification of pilots, and
(2) The plane itself would not need to be certified as a new aircraft type. The requirements for certifying new tapes change over the years, and older planes like the 737 would not meet today's requirements. By making it fly similar enough to the existing 737s, it could be classified as a variant on the existing model and be grandfathered in on the old certification.
Certifying a new type is very expensive and takes a long time.
My question is this: how long does the MAX have to be grounded before the costs of it not being service end up more than (1) the costs of recertifying pilots, and (2) the costs of making the other design changes that would be needed to certifying as a new type under current rules and then getting it certified?
To answer this, you'd need to compute the costs of the up-front engineering associated with trying to re-certify as a new type, and also the costs of the modifications. Additionally, there's always negotiation in the certification process: how will the manufacturer substantiate compliance, and if they can't, can they convince the regulator that the regulator's intent has been "met" within some acceptable level of risk? That can't be rigorously computed until the dialog with regulators takes place.
I don't know that Boeing has computed likely values of such costs, and that if they did, that they would allow them to be publicly known. Moreover, Boeing would probably focus on their worst-case numbers to justify to everyone why the only viable path is to minimally modify the design.
MCAS does not typically activate at all. It only activates when the flight control systems think the plane is nearing a stall, the flaps are up, and the autopilot is off. Most commercial flights should not come near conditions triggering an MCAS activation.
It activated in the two crashed flights (and the earlier flight by one of those same planes) because of bad data from an AOA sensor leading the flight control systems to think the plane was about to stall.
The parent is incorrect. They all have 2 AoA sensors. The option was a "AoA disagree" warning. It's probable that given the wide variety of warnings the pilots were experiencing in both instances it would have made little difference.
Whether it didn't have to or not is immaterial, it did activate, and did so within minutes after take-off. If it was rare then we would not have had any crashes at all.
You don't have that data, and the FAA did not release the data. I looked for this information specifically in their report, they did not report this data whatsoever.
So, making ANY statement about the rate of activation is pure speculation, and it's merely a Boeing talking-point.
There's no need to speculate. The FAA should be proving these statements. "Unusual" is an empty phrase when you're talking about millions of flight hours. Is it 1/100 flights unusual? 1/10 million flights unusual?
The FAA can and should have obtained data on the activations of MCAS from the world wide fleet, and also compare on other similar aircraft (other 737s) how often MCAS activation conditions would have been met.
I suspect that is because that would really blow up. It would show how many 'near misses' (thanks, George Carlin) there were and that number is likely a lot higher than the number of crashes.
Keep in mind that without that data we are all focused on the two times MCAS led to crashes, we are all in the dark how widespread the problem really was and once that data is out in the open the FAA's reputation (or what is left of it) will be further down the drain.
Getting into the region of flight where MCAS operates by design on a commercial flight is already embarrassingly sloppy flying. The number of sick bags required on the flight would be a fair proxy.
Unless we are talking about the number of times MCAS activated outside of its design criteria but didn't result in a crash. For example, as is presumed to have happened on the flight before the Lion air accident.
> Unless we are talking about the number of times MCAS activated outside of its design criteria but didn't result in a crash.
Yes, that was what I had in mind. You can bet that on every plane that did not have the secondary input to the MCAS system this happened. Two crashes are the very ugly tip of a much larger iceberg and the FAA has a vested interest in keeping that iceberg submerged.
> Getting into the region of flight where MCAS operates by design on a commercial flight is already embarrassingly sloppy flying.
You assume. If we had the data, we'd know how often the 737 MAX, which has different flight characteristics than other aircraft, was actually in those conditions.
In the same way in which one assumes pigs don't fly. You seem to be in the belief that 737 Max aircraft are uniquely predisposed to being hand flown around the sky on the edge of the stall while in the clean configuration and are expecting evidence of the contrary to be provided to you.
> expecting evidence of the contrary to be provided to you.
I'm expecting evidence to confirm the assumptions of the system. I'm assuming any and all available data would be gathered and analyzed. I assume the MCAS system from top to bottom is riddled with bugs and flaws, designed by committee rather than engineers. There's no reason to trust any line of reasoning from Boeing on this matter, they've already demonstrated their incompetence and are not trustworthy.
You seem to not want the FAA to verify the claims of the system with data. I don't know why that would be undesirable. Even if they only confirm what is being stated about MCAS activation, that data would be valuable and demonstrate that the FAA has at least the competence to gather the data. Publishing the raw data along with their conclusions would allow the public to verify their competence at drawing conclusions.
We know that it has false-activated at least 3 times, and each time has been a few minutes after takeoff.
This is because if the sensor fails on the ground, MCAS will always activate a few minutes into the flight, when the flaps are retracted, because the rule that activates it is disabled when the flaps are down.
>> My question is this: how long does the MAX have to be grounded before the costs of it not being service end up more than (1) the costs of recertifying pilots, and (2) the costs of making the other design changes that would be needed to certifying as a new type...
Not sure how long, but they passed that point a long time ago. From what I've read, one of the goals was to not require pilot training on the new plane, and that is already going to be required now.
> My question is this: how long does the MAX have to be grounded before the costs of it not being service end up more than (1) the costs of recertifying pilots, and (2) the costs of making the other design changes that would be needed to certifying as a new type under current rules and then getting it certified?
This was the gamble that management took. Hopefully, they still get their bonuses. (/s)
By now, it would have been cheaper to put in a proper triple or quad redundant flight control system and have pilots retrain for the type than to ground the fleet and lose orders.
The bad decisions that led to this are well known. Southwest Air has a business model based on having only one type of aircraft, the Boeing 737. They insisted that the 737 Max behave exactly like the other 737 models, and not require that pilots be trained and rated for two different aircraft. So Boeing tried to make Southwest happy.
A deeper bad decision is that Boeing doesn't have a 737 replacement. The original 737 is from the 1970s. By now, Boeing should have had a new plane out in that size range. Airbus does. COMAC is coming out with one, if it works well. But Boeing guessed wrong on the sizes of aircraft airlines would want. They thought the future was widebody, not mailing tubes full of seats. The 767, 777, and 787 are all widebodies. So, of course, was the 747. The 757 was a great airplane for passengers and pilots that airlines didn't want because it cost more and used more fuel. So Boeing had a huge lineup of widebodies, and no good competitor for the Airbus narrow-body options.
Hence the 737 MAX, a 737 with engines too big for the airframe and a software kludge to compensate for that.
It's not just to make the 737MAX behave similarly to the 737NG. The 737MAX has objectively bad handling at high AoA due to the engine positioning. Once you're at high AoA, it doesn't have good static stability, and has too much of a tendency to pitch up further into a stall.
The cause of this though is as you say, the desire to make the 737MAX be on the same type certificate as the NG rather than do a clean sheet design.
Obviously in hindsight, Boeing would have been better off with the clean sheet design. At this point though, I think either they have to get the MAX recertified or they go bankrupt. They could potentially be bailed out by the government and a clean sheet design started, but even the bailed out company would be a shell of its former self with no narrowbody aircraft to sell.
I think you'll see Boeing get the MAX recertified or die trying.
What's going on at the FAA is going on elsewhere with regulators as well, it's just that this one happens to be in the press a lot. IOW, they will not be going to prison. Do what you can in your role as a world citizen to support intelligent regulators with integrity that are empowered to represent the public's interest.
At this point, I think, the gov should go in and do a wholesale investigation of the company, it’s culture, and ensure these lapses would be difficult to occur again. At this point the management of Boeing commercial is untrustworthy. Gov needs to clean house and punish those who allowed or fomented a derelict culture to emerge.
"It's a beautiful plane. Nobody else can build beautiful planes. It flies. In the sky. It can carry more people than any other plane. Lot of people don't realize that. But I know that. Not like those planes from China."
The problem isn’t the marketing or the cheerleading, it’s the management (corruption) and organizational structure that forces engineering to take shortcuts.
It’s a sad statement about falling social trust, but I would not fly on a re-certified 737 Max. I do not have enough faith in Boeing and the FAA, which appears to be completely captured by Boeing, to properly value my safety above short term profits. I’d abandon a ticket at the airport if I found out that it was on a 737 Max; no trip I take is worth risking my life for.
Practically speaking this might require that I start buying more tickets with airlines that prefer Airbus aircraft.
Personally, I think my trust of US pilots is enough to outweigh my concerns about MCAS. I feel pretty confident that if I get into a MAX8 in the US that the pilots in the cockpit know their shit. The most common reason that planes crash is still pilot error. I'd rather fly in a MAX8 operated by a reputable airline than a perfect airplane operated by a sketchy third-world airline.
> [Chesley] Sullenberger says he recently experienced scenarios similar to those facing the pilots of the doomed Ethiopian and Lion Air jetliners in a simulator and says he understands the difficulties they had trying to maintain control of the planes. "Even knowing what was going to happen, I could see how crews could have run out of time and altitude before they could have solved the problems," he said.
For sure, the issue is bad, should be resolved, and should have never been certified in the first place. But given the amount of attention the problem has received from all stakeholders, I think any further worries about MCAS from the flying public are misguided. The least likely thing to kill you is usually the issue that everyone is thinking about and is actively working to mitigate. Mechanical issues are especially terrifying because they remove any sense of human agency, but the good thing is that humans are good at fixing them. Human fallibility is a much tougher problem to solve and is still by far the most common reason airplanes crash.
If the plane tries to crash itself during take off, it’s only a matter of time before a pilot doesn’t react quickly enough to prevent the plane from killing everyone on board. Blaming the pilot for not reacting quickly enough is really to miss the point. Really the plane shouldn’t be trying to dive into the ground after takeoff, this is an undesirable property for an airplane to have.
The fact that the same plane kept repeatedly trying to plow itself into the ground after takeoff really underscores the basic premise that the 737 Max is a bad aircraft, and should have never been certified.
The flight crew on Lion Air 610 were experienced. They had a combined total of nearly 10000 hours on 737s. These guys "knew their shit".
American Exceptionalism is a dangerous myth. They didn't crash because they were Indian/Indonesian. What happened to these guys is that they faced a situation that tested the limits of human abilities, and it's the reason a whole domain of engineering called Human Factors exists.
Forgive me if I made any impression otherwise -- I am not saying those specific pilots were inexperienced. (I mentioned the US solely because I am familiar with their safety record, not because I don't think other high-income nations don't also have good pilots)
I am saying, in general, if you are going to get on a plane today, you are much more likely to be killed because of human error than any other reason. Humans are good at fixing, mitigating, and recognizing mechanical issues. Other planes in the past have had mechanical issues and later returned to service with a good safety record. Human error is really what you should be worried about, both statistically, and in terms of mitigation difficulty.
>I am saying, in general, if you are going to get on a plane today, you are much more likely to be killed because of human error than any other reason.
Sure, but the issue with the 737 MAX in particular is that the aircraft is unsafe from a design perspective, so I find your arguments that US aircrews are less likely to make a mistake to be both nonsensical and irrelevant (from a 737 MAX perspective).
The 737 MAX is flawed in a way that was not only concealed from the operators, but in a way that causes a failure mode that is not easily avoided or averted because of Human Factors, even by an aircrew that "knows their shit".
Your faith in the MAX 8 flown by US operators is unfounded.
The DC10 also had design flaws. Mitigations were implemented and it returned to service with a safety record similar to its peers. Both planes had an engineering problem, both can be solved by engineering a solution.
I don't understand. If the engineering problems around MCAS are solved, then why would it matter if the crews are American (and thus "know their shit")?
Because you still need a good pilot to fly the plane, even if it was engineered perfectly.
They don't need to be American, I merely listed it as an example of a place where people who fly planes can be reasonably expected to have a high level of competency. (In contrast to situations like PIA 8303)
Most engineering problems also include elements of human interaction -- once again, the DC10 cargo door issue is a good example. One would expect that even if MCAS is re-engineered to work correctly, a pilot would still need to understand the operation of the system. Part of the problem is that Boeing tried to sell it as if it was of little to no importance to understand.
> but in a way that causes a failure mode that is not easily avoided or averted because of Human Factors, even by an aircrew that "knows their shit".
This is negated by the fact that the pilots on the flight before the Indonesian crash were able to save their aircraft because they recognized the symptoms of runaway trim quickly.
Yes, pilot error is the most common cause of aircraft incidents. But poor aircraft design is additive to that risk. If you genuinely believe that the Max 8 is a bad airplane, as I do, then you're accepting the risk of the pilots making a mistake plus the risk of bad aircraft design killing you.
With that in mind, I would still choose to fly a regular 737, even if I already trust the pilots to "know their shit", since adding risk for no gain is a silly thing to do.
I am addressing the idea that the plane type would make-or-break someone's decision to fly. If human error is the larger factor, then why would you make the decision based on a smaller factor?
I wouldn't get off a MAX8 operated by Quantas and instead board an A320 operated by PIA
I was never going to fly with an airline with a bad track record, so this is a false dichotomy you’re putting up. For me the question is would I fly with one reputable airline on a max 8, or on another with a a321neo. The answer here is clear.
FAA should be closed down and then a new organisation should be created that ensures no former FAA associate would ever be hired.
The same with Boeing. Anyone involved with 737 Max should never find employment in this industry.
This behaviour needs to be ruthlessly rooted out.
102 comments
[ 4.2 ms ] story [ 178 ms ] threadhttps://en.wikipedia.org/wiki/Organization_Designation_Autho...
The FAA relies on certification paperwork, which was falsified for the 737 MAX.
So the FAA was completely cut out of the certification process.
I still upvoted your comment even though I disagree with the sentiment because I see this a lot when risk management is considered by many. Unless risk management is your domain expertise, or you've been to lots and lots of different organizations to observe what works and what didn't, it is a very human perspective.
Risk management is not performed by saying, "Nothing bad has happened even less, therefore let's keep with the status quo or make it more lax to save money." Reactive risk management based upon the rear-view mirror is a great way to invite extinction-level tail risk into the organization's house.
We could play an exciting game of Cognitive Bias Bingo [1] with such a perspective, though.
[1] https://en.wikipedia.org/wiki/List_of_cognitive_biases
As best as Wikipedia can tell me, Boeing has delivered 130 Max's which flew ~120,000 flight hours. Even if we completely disregard all MCAS failures that the pilots were able to mitigate, two 737 Max 8's were destroyed within the first two years of operation, representing ~1.5% of the aircraft actually in operation in two years. That is a pretty alarming statistic, and points to the Max 8 genuinely being an unsafe aircraft.
“The roots of this crisis can be found in a major change that the FAA instituted in its regulatory responsibility in 2005. Rather than naming and supervising its own ‘designated airworthiness representatives,’ the agency decided to allow Boeing and other manufacturers who qualified under the revised procedures to select their own employees to certify the safety of their aircraft. In justifying this change, the agency said at the time that it would save the aviation industry about $25 billion from 2006 to 2015. Therefore, the manufacturer is providing safety oversight of itself. This is a worrying move toward industry self-certification.” -- https://www.dcreport.org/2019/03/18/how-deregulation-made-fl...
Obama should be faulted for oversight perhaps, but the ball was rolling long before.
Trump _has_ made broad efforts to force _further_ FAA dereg. -- https://www.forbes.com/sites/marisagarcia/2019/03/18/did-tru...
While I'm not a 737 expert, I have evaluated flight software (FSW) and vehicle management systems (VMS) on Gov't programs. Mr. Ewbank points out systemic deficiencies in the 737 VMS and controls.
It would seem the question to be answered by the FAA is whether they intend to address these systemic deficiencies or just the proximate causes of the crashes. It would be a valid, and more rigorous view that since these aircraft are already out of service in an unprecedented way, these systemic issues should be addressed as well. To be clear, it will involve significant engineering work to do so.
There will be immense pressure on the FAA, especially since the aircraft has been out of service and damaged Boeing economically so much already, to just deal with the proximate cause (i.e., stay the course they're on now). That will come from Boeing of course, but also internal management and their perceptions, as well the implicit or explicit pressure from the political class.
Speaking purely for myself, I hope the FAA does force the root causes to be dealt with as Mr. Ewbank advocates (I don't know him, but have immense respect for his coming forward like this - you have to know and understand the systems to be able to provide this kind of critical review).
However, I wouldn't at all be surprised if the fact they have already started down the path they're on causes them to retrench and leave these root causes unaddressed.
> The FAA allowed the regulations to be modified to fit the 737’s preexisting design
Terrible.
I wonder, if the FAA gives the 737 MAX the all clear, but no one else does, what does that mean for the aircraft? Would a US-only certification still be an effective grounding in all but name? I guess there are a bunch of routes within the US, but there must be crap-tons elsewhere too (and presumably international from US<->* that formerly used 737 MAX)?
If it goes ahead and gives the green light when the rest of the world isn't sold on it, then we can unambiguously say the entire regulatory institution is irredeemably defective.
At that point the only real fix is an absolutely amazing change in the Executive branch, or a Legislative solution; and I have doubts on the efficacy of the latter, since a regulator is only as good as the people staffing it at the best of times.
I agree and I'd like to add that in my opinion the airplane now needs to actually be better than its competitors.
If it isn't and there is another accident (big or small, that might or might not involve deaths but which might even slightly be related to MCAS or other systems having similar design flaws) then I think that there would be again another (bigger?) round of repercussions: for the plane itself, for Boeing and for the FAA.
Saying this because I imagine that a negative event might become a final public and/or political confirmation that 1) the FAA & Boing cannot be trusted and that 2) the airplane has just too many flaws that need to be addressed.
Therefore, to avoid this, the plane must be absolutely rock-solid otherwise if anything happens people will immediately ask Boeing and especially FAA "why did you create/approve this thing - are you incompetent and/or stupid and/or unscrupulous?".
A very interesting topic, in my opinion :)
Turns out competent safety regulation matters, who knew?
Ignoring the training issue (which is already long gone), the inability to take the Max abroad would be a serious hindrance for sales. It means that it would require that airlines track them separately for routes, making sure to never take the Max 8 outside of America, which is exactly what Boeing was hoping not to do with the Max 8.
There are really two separate questions: first, should the FAA address other deficiencies particular to the 737 MAX, and second, should the FAA go beyond that to require Boeing to fix issues that are common to all 737 models?
I agree with Mr. Ewbank that the answer to the first question is yes; but he also argues that the answer to the second question should be yes, since the issues he points out in the latter part of the paper are not specific to the 737 MAX, as far as I can tell, but affect all 737 models. I don't agree that Boeing should be forced to address those issues, since that would amount to decertifying all 737s, which is not justified by the safety data; no other 737 model has an accident record that justifies any such decertification.
It bothers me that when lives are lost, our first response as a greedy capitalistic society is to cut funding, considering there aren't really many competitors, and the switch-over costs for airlines would be prohibitive.
We should be funding efforts to investigate the heck out of this and make sure it doesn't happen again. I'm not sure how one would structure such funds to make sure they aren't abused, but I certainly don't want Boeing cutting more corners and hiring less-competent lower-salary aircraft engineers because they are now low on funding and need to get the plane out before some damn quarterly earnings report.
Boeing paid $11.7 Billion dollars in stock buybacks in the two years preceding this fiasco. All the money they ever needed was already there.
Instead, they spent the money inflating executives portfolios. And now you want more money going to them? If they want to privatize the gains, they can privatize the losses. Your sympathy is very misplaced, IMHO.
No, I clearly said "I'm not sure how one would structure such funds to make sure they aren't abused". I want more money going to engineers, not the executives. But I do like to think with a forward-thinking mindset about how to make that possible instead of dismissing the problem and saying cutting funds in the right answer, because that definitely doesn't get more money in the hands of engineers to debug problems.
Perhaps more money to engineers + a third party audit company appointed by the court + fire the executives that did wrong, I don't know, but I'd like to be optimistic about it. Taking away funds is only going to strip engineers even further of funds for fixes, make unsafer planes, that's for sure.
The executives that inflated their portfolios while knowing there was going to be safety issues -- I support punishing those individuals. Not Boeing as a company though, since we pretty much depend on them.
I didn't know that. What kind of development budget did the Max have? If they'd taken 10% of that to do $1B more safety related engineering during the project, might that have helped?
That, except for money.
It contained vague statements like 'rare set of circumstances' with ZERO data on the expected probability. As we know in the software world, a 1 in a billion chance could happen many times per interval given the scale of any particular problem.
I'm never stepping foot on a MAX.
I will never fly on that plane
https://en.wikipedia.org/wiki/Boeing_737_rudder_issues
What is the downside for Boeing to just say "let's put the plane back in the sky"?
I think you scrap the plane, then start over with a wholly compliant design. This whole ordeal is a great example of regulatory capture. You have a plane with a ton of new flaws, and all the flaws of the old design, and business decided it was cheaper to pressure the regulator to be okay with these flaws and to kill a few hundred people than to build a proper plane, but let's give them one more chance to kill a few hundred more people, so they're not financially inconvenienced over a problem of their own making.
"Got to hit those quarterly sales figures." An aircraft that crashes is pretty detrimental to achieving this goal. Achieving sales figures doesn't preclude safety
Eventually, the company pays for it, but it can take a while.
The culture at Boeing has changed, and it seems to me that the quarterly numbers are more important now than previously.
No, obviously it didn't, since the redesign changed the fundamental flight dynamics of the plane. It was not improving the design, it was piggybacking off the good record and past training of the old design to push out a fundamentally different product as quickly and cheaply as possible.
>Achieving sales figures doesn't preclude safety.
Then how did these fatal 737 MAXs ever get released in the first place?
However, some of them seem completely over the top. A complete review of the 737 control system for example, given its operating record across the fleet, would as likely result in introducing new failures as eliminate some as yet unknown failure mode.
(1) Existing 737 pilots would not need to be recertified for the MAX. They would just need to read a short document that updated the procedure for handling runaway trim.
This would make the plane more attractive to airlines because it meant not having to pay for expensive recertification of pilots, and
(2) The plane itself would not need to be certified as a new aircraft type. The requirements for certifying new tapes change over the years, and older planes like the 737 would not meet today's requirements. By making it fly similar enough to the existing 737s, it could be classified as a variant on the existing model and be grandfathered in on the old certification.
Certifying a new type is very expensive and takes a long time.
My question is this: how long does the MAX have to be grounded before the costs of it not being service end up more than (1) the costs of recertifying pilots, and (2) the costs of making the other design changes that would be needed to certifying as a new type under current rules and then getting it certified?
I don't know that Boeing has computed likely values of such costs, and that if they did, that they would allow them to be publicly known. Moreover, Boeing would probably focus on their worst-case numbers to justify to everyone why the only viable path is to minimally modify the design.
It activated in the two crashed flights (and the earlier flight by one of those same planes) because of bad data from an AOA sensor leading the flight control systems to think the plane was about to stall.
You don't have that data, and the FAA did not release the data. I looked for this information specifically in their report, they did not report this data whatsoever.
So, making ANY statement about the rate of activation is pure speculation, and it's merely a Boeing talking-point.
The FAA can and should have obtained data on the activations of MCAS from the world wide fleet, and also compare on other similar aircraft (other 737s) how often MCAS activation conditions would have been met.
Keep in mind that without that data we are all focused on the two times MCAS led to crashes, we are all in the dark how widespread the problem really was and once that data is out in the open the FAA's reputation (or what is left of it) will be further down the drain.
Unless we are talking about the number of times MCAS activated outside of its design criteria but didn't result in a crash. For example, as is presumed to have happened on the flight before the Lion air accident.
Yes, that was what I had in mind. You can bet that on every plane that did not have the secondary input to the MCAS system this happened. Two crashes are the very ugly tip of a much larger iceberg and the FAA has a vested interest in keeping that iceberg submerged.
You assume. If we had the data, we'd know how often the 737 MAX, which has different flight characteristics than other aircraft, was actually in those conditions.
I'm expecting evidence to confirm the assumptions of the system. I'm assuming any and all available data would be gathered and analyzed. I assume the MCAS system from top to bottom is riddled with bugs and flaws, designed by committee rather than engineers. There's no reason to trust any line of reasoning from Boeing on this matter, they've already demonstrated their incompetence and are not trustworthy.
You seem to not want the FAA to verify the claims of the system with data. I don't know why that would be undesirable. Even if they only confirm what is being stated about MCAS activation, that data would be valuable and demonstrate that the FAA has at least the competence to gather the data. Publishing the raw data along with their conclusions would allow the public to verify their competence at drawing conclusions.
This is because if the sensor fails on the ground, MCAS will always activate a few minutes into the flight, when the flaps are retracted, because the rule that activates it is disabled when the flaps are down.
Not sure how long, but they passed that point a long time ago. From what I've read, one of the goals was to not require pilot training on the new plane, and that is already going to be required now.
This was the gamble that management took. Hopefully, they still get their bonuses. (/s)
The bad decisions that led to this are well known. Southwest Air has a business model based on having only one type of aircraft, the Boeing 737. They insisted that the 737 Max behave exactly like the other 737 models, and not require that pilots be trained and rated for two different aircraft. So Boeing tried to make Southwest happy.
A deeper bad decision is that Boeing doesn't have a 737 replacement. The original 737 is from the 1970s. By now, Boeing should have had a new plane out in that size range. Airbus does. COMAC is coming out with one, if it works well. But Boeing guessed wrong on the sizes of aircraft airlines would want. They thought the future was widebody, not mailing tubes full of seats. The 767, 777, and 787 are all widebodies. So, of course, was the 747. The 757 was a great airplane for passengers and pilots that airlines didn't want because it cost more and used more fuel. So Boeing had a huge lineup of widebodies, and no good competitor for the Airbus narrow-body options.
Hence the 737 MAX, a 737 with engines too big for the airframe and a software kludge to compensate for that.
The cause of this though is as you say, the desire to make the 737MAX be on the same type certificate as the NG rather than do a clean sheet design.
Obviously in hindsight, Boeing would have been better off with the clean sheet design. At this point though, I think either they have to get the MAX recertified or they go bankrupt. They could potentially be bailed out by the government and a clean sheet design started, but even the bailed out company would be a shell of its former self with no narrowbody aircraft to sell.
I think you'll see Boeing get the MAX recertified or die trying.
The people previously running the FAA should go to prison.
Maybe the outdated aircraft can be converted to house some of the growing homeless population.
Practically speaking this might require that I start buying more tickets with airlines that prefer Airbus aircraft.
> [Chesley] Sullenberger says he recently experienced scenarios similar to those facing the pilots of the doomed Ethiopian and Lion Air jetliners in a simulator and says he understands the difficulties they had trying to maintain control of the planes. "Even knowing what was going to happen, I could see how crews could have run out of time and altitude before they could have solved the problems," he said.
https://qz.com/1576597/off-duty-pilot-saved-lion-airs-737-ma...
The fact that the same plane kept repeatedly trying to plow itself into the ground after takeoff really underscores the basic premise that the 737 Max is a bad aircraft, and should have never been certified.
American Exceptionalism is a dangerous myth. They didn't crash because they were Indian/Indonesian. What happened to these guys is that they faced a situation that tested the limits of human abilities, and it's the reason a whole domain of engineering called Human Factors exists.
I am saying, in general, if you are going to get on a plane today, you are much more likely to be killed because of human error than any other reason. Humans are good at fixing, mitigating, and recognizing mechanical issues. Other planes in the past have had mechanical issues and later returned to service with a good safety record. Human error is really what you should be worried about, both statistically, and in terms of mitigation difficulty.
Sure, but the issue with the 737 MAX in particular is that the aircraft is unsafe from a design perspective, so I find your arguments that US aircrews are less likely to make a mistake to be both nonsensical and irrelevant (from a 737 MAX perspective).
The 737 MAX is flawed in a way that was not only concealed from the operators, but in a way that causes a failure mode that is not easily avoided or averted because of Human Factors, even by an aircrew that "knows their shit".
Your faith in the MAX 8 flown by US operators is unfounded.
They don't need to be American, I merely listed it as an example of a place where people who fly planes can be reasonably expected to have a high level of competency. (In contrast to situations like PIA 8303)
Most engineering problems also include elements of human interaction -- once again, the DC10 cargo door issue is a good example. One would expect that even if MCAS is re-engineered to work correctly, a pilot would still need to understand the operation of the system. Part of the problem is that Boeing tried to sell it as if it was of little to no importance to understand.
This is negated by the fact that the pilots on the flight before the Indonesian crash were able to save their aircraft because they recognized the symptoms of runaway trim quickly.
https://qz.com/1576597/off-duty-pilot-saved-lion-airs-737-ma...
Yes, pilot error is the most common cause of aircraft incidents. But poor aircraft design is additive to that risk. If you genuinely believe that the Max 8 is a bad airplane, as I do, then you're accepting the risk of the pilots making a mistake plus the risk of bad aircraft design killing you.
With that in mind, I would still choose to fly a regular 737, even if I already trust the pilots to "know their shit", since adding risk for no gain is a silly thing to do.
I wouldn't get off a MAX8 operated by Quantas and instead board an A320 operated by PIA
"Pulling a circuit breaker is not generally an appropriate or intuitive crew action."