I usually write the weekly AVweb poll early on Sunday morning, sometimes before the caffeine jolt has fully engaged. Later in the day, I come back to it and test the poll plumbing by making my own selection. To this week’s Would You Fly a 737 MAX Now?, I answered an unconsidered yes. But before I pushed submit, I hesitated.
Why did I think that? How do I know what I think I know and is it a rational, reasonable conclusion? Not everyone is so sanguine. As of Tuesday morning, some 25 percent of respondents said they wouldn’t fly a MAX. That’s hardly what I would call a full-throated vote of confidence, especially from an aviation audience. When I was constructing the poll, I also segregated the same question limited to airline pilots. Nearly one in five of them said they wouldn’t fly it, either. Is that surprising? It is to me.
Now I’ll admit that this kind of polling is to science as a Cracker Barrel is to cuisine—or even edible food. And I’ll stipulate that I have no way to know if all of those 157 answers were actually from airline pilots, but I’m also sure that a lot are, judging by some of the comments a few sent along.
In writing my share of the dozens of stories we published on the MAX fiasco, at this juncture, my conclusion is this: The 737 MAX was never an unsafe airplane; it was a flawed airplane. It was a roof with a small leak waiting for a heavy enough rainstorm. It wasn’t as safe as it could have been. As it should have been.
During our coverage of the story, we quoted and talked to sources ranging from pilots to big-airplane certification experts who know more about jumping a new design through the cert hoops than I’ll ever know. None of them described the process and the results of the MAX certification as anything like normal. Or perhaps traditional.
We know, for instance, that Boeing added the problematic MCAS to the MAX to give it control feel and handling qualities similar to previous models of the airplane. We know that after the FAA reviewed the design specs, Boeing gave the system more stab trim authority to the extent that it could roll in full nose-down trim. And we know that Boeing didn’t inform the FAA of this change. We know that engineers inside Boeing questioned this design and we know that Boeing justified reliance on input from a single AoA vane because MCAS wasn’t a critical system. And we know a congressional investigation found grossly insufficient oversight by the FAA.
Perhaps if the crashes hadn’t occurred, these things would have remained undiscovered or if revealed, just embarrassing political fodder and three stories about corrective ADs. But 346 people died in two crashes and these oversights aligned to produce the biggest catastrophe in Boeing’s history. As the story matured, a conceit emerged. It was that the crashes would have never happened to a U.S. or western-trained crew, ergo, there was nothing wrong with the airplane to begin with. Personally, I reject this reasoning. In the age of modern certification—say since the late 1980s—airplanes have grown more complex and more automated. But designers have tried to and have largely succeeded in not making them into flying puzzle palaces larded up with gotchas.
Boeing argued that pilots are well trained to respond to runaway trim. It’s a memory item, as pilots would say. But the MCAS misfire didn’t present as runaway trim because it was intermittent, there was no evidence that it was active and the pilots didn’t even know it existed. Airline pilots I’ve asked about this say, yeah, a U.S. crew could probably have resolved it. That’s what I call 95th percentile confidence, not the 10-9 reliability we strive to build into the modern air transport system. In any case, as far as we know, no U.S. crew was ever tested with an MCAS abnormal. We have the luxury of speculation unblemished by an actual example.
But two of the three developing-world crews who were tested failed. Recall that the day before Lion Air 610 plunged into the Java Sea in October 2018, pilots who had flown the same airplane the day before encountered the same abnormal and, thanks in part to a knowledgeable jump seater, resolved it. They reported the malfunction and maintenance techs failed to diagnose it correctly and thus failed to fix it, setting up the accident scenario. In the subsequent Ethiopian Airlines accident the following March, Boeing said—rightly—that the crew had been briefed on Lion Air and had a specific procedure to resolve malfunctioning MCAS. But a procedure is not the same as capability.
That they could not recover the airplane should have removed the scales from Boeing’s eyes about training standards in the third world. That’s the real world Boeing is selling airplanes into and not the one we all wish existed or we imagine is even plausible. It seems reasonable that building a less flawed airplane would be easier than jollying along those airlines to improve qualifications and training. In a truly safe system, you’re supposed to do both.
To the original question, why did I say yes, I’d fly in the MAX? Because I flew in it before the fix, on one of Southwest’s factory-fresh MAXes that the flight attendant thought was on its second or third revenue flight. It reeked of that new car smell. Even after the crashes, I still would have boarded one. But probably not one flown by a foreign airline.
Some will argue that the MAX is now the most scrutinized airliner in modern history and well, it ought to be. I’m more interested in how the airplane was fixed. Specifically, the new version of MCAS is driven by both AoA sensors and locked out if they disagree by more than 5.5 degrees. MCAS will activate just once, not repeatedly, and it’s incapable of applying full nose-down trim.
If Boeing and the FAA hadn’t broken the standing certification review process, these fail-safes might have been installed in the first place because someone in those cert meetings would have reminded that when homo the sap is in the loop, he’ll never behave in predictable ways when confronted with a novel situation. The argument against installing them, I suppose, is: not needed. Events proved otherwise.
That we have two tragic crashes pretty much proves they aren’t just window dressing but real fixes for a real flaw. One airline pilot said he wanted more. He wouldn’t fly the MAX “until MCAS gets a third input: AoA or synthetic airspeed and a comparator routine to identify and ignore the outlier. As of now, it’s still a lipstuck pig.”
The cynic’s definition of cynicism is that it’s the smoke that curls up from burned dreams. I’m a subscriber. Having spent a lifetime in publishing, I know painfully well that when a mistake is made, the odds of the correction compounding the error approach certainty. But even I am capable of drawing myself back from the black precipice to summon the faint conviction that this time, they’ve got it right. And it will work.
As 2020 draws to its whimpering, pathetic close, here’s hoping some damn thing does.
First impressions matter.
Difficult to trust Boeing’s core.
I won’t go!
Due to Boeing, the FAA, MCAS, etc., potential passengers have wisely developed some trust issues.
Question: Did any aircrew successfully deal with a runaway MCAS scenario such as what led to the two disastrous crashes?
Yes. The crew that flew the Lion Air 610 accident airplane the day before was presented with the same runaway, and they handled it.
The driving force behind the Max design band-aids is the fact that airline management want to limit the amount of training required. And as need to know information tends to be the only bits that filter through a lot of background info is lost to new generations of pilots. The trim runaway scenario has some consequences that are no longer mentioned in the ‘books’ – the simple memory items required to correct a runaway are not necessarily simple to execute. If within Boeing there was a lack of information sharing, how on earth would anyone expect the pilots driving it to then have the full picture? Some ‘old-school’ pilots might still recollect handling issues, but my experience is that many ‘new-school’ pilots will not have realized some of the fall-out.
The 737-Max is probably the most carefully and thoroughly sorted out airplane going right now. The training now required might well be the same. Who knows what defects and potential disasters are out there in the rest of the fleet?
I may be old (73) but I am becoming increasingly unsure as to the continual reliance on software to solve basic flying skills. Am I the only retired Boeing captain who remembers being taught during the 707 ground school, that the best way to stop a runaway stab was either to grab the co-pilot’s thigh and clamp it to the right hand stab trim wheel until his trousers caught fire (almost a joke – but it worked!), or alternatively hit the stab and mach trim cut-out switches off, and as a final fix, shout out “SAM255” and find the circuit breakers for the Stabiliser, Autopilot and Mach Trim on the P Panels 2,5 and 5. Essentially the same thing worked for the 727 and 737s. The breakers had white or yellow outlines to make them easy to find. Strange to tell, that for a very swept wing and moderately unstable beast like the 707, it did not have any Angle of Attack indication for the crew and most of us were taught recovery from unusual attitudes should still revolve around “needle, ball & airspeed” with a good look at one of three horizons to determine which was the odd one out. Or I am just old?
I agree with you. Job One is fly the damned airplane! Bells, horns, stick-shakers are warnings of impending problems or sometimes not. In this case, Boeing’s errors challenged the pilots, but it was the failure of the crew that caused the loss of life.
I’m typed in the 727, 737, 757 and 767 and instructed in the 737 as well as served as test pilot for AC coming out of maintenance. I instructed ATP’s for several years and also flew the line. No pilot that I instructed or checked would ever have failed to have disconnected the stab trim OR failed to fly the airplane.
And as an aside, can I point out that a triple autopilot, no-pilot AC would have come to the same end as the failed crews did. GIGO.
“…as an aside, can I point out that a triple autopilot, no-pilot AC would have come to the same end as the failed crews did. GIGO.”
Point and click. But you’re wrong.
The infamous MCAS is inoperative when the aircraft is being flown by the autopilot. MCAS exists to COMPLY with an existing certification REQUIREMENT for linearity of control forces presented to HUMAN PILOTS.
Be careful what you ask for.
I don’t quite understand the fascination with a three-AOA concept. The questioner seems to imply that the computers need to know which AOA signal is correct. They don’t. They only need to know that one of them is wrong, which means that the MCAS routine should not be employed.
Still, Boeing went a step further with an internal algorithm that functions as part of the comparator. To me, this is the very synthetic value that the questioners are asking for. And still it is not used to determine which one is wrong. Just that one of them is wrong, and MCAS should not be activated.
Calling the 737-MAX “flawed” is an understatement, and a semantic dodge. The gap between a “flawed”
and an “unsafe” aircraft is a distinction without a difference. Likewise, what an American crew might do
in an emergency is irrelevant, unless no one else is allowed to fly them. Should no one outside the U.S.
drive a Ford, or use a Black & Decker power tool? Moreover, if that all-American crew must compensate
for design errors and intrinsic defects, or must expect the worst to happen at any moment, then the only
ones on board should be test pilots, astronauts, and flying aces with a death wish. Even if the 737-MAX
is safe, what about the rest of Boeing’s fleet? After Ralph Nader wrote “Unsafe at Any Speed” (1965) it
became customary to praise GM for “fixing” the Corvair, as if that meant there was nothing wrong with
any of their other vehicles, or that the Corvair was merely an anomaly. Giving Boeing the benefit of the
doubt merely encourages them to return to business as usual, as if nothing had happened, or at least
nothing so serious as to require either a complete overhaul of their manufacturing process or else the
indefinite suspension of their operations, in the interest of public safety and of upholding standards of aircraft construction and maintenance. A quick fix is worse than none at all. While I share the hope
for better weather in 2021, it won’t happen without greater diligence and vigilance in all walks of life.
Wow!
I concur with Dennis R on this one.
I am insulted when commentators have the gumption to say this Max accident would never happen to an American pilot. That is out and out racist
Remember corporations are first responsible to their shareholders not their workers or spending on safety. It’s how much can we get away with from squeezing workers and incompetence of regulators.
I followed the 737 MAX accidents closely, and I’ve flown in Indonesia.
I wish the racism card would not be played so often, either for or against the two accident crews, as it obscures the realities of foreign operators.
Indonesia is literally on the other side of the world, gets delayed information, and struggles to maintain enough aircraft parts. So they are at a disadvantage that should be recognized. The least manufacturers can do is to not guinea pig operators that already have their hands full.
The Indonesian NTSB determined that blame for their accident shared equal blame between the pilots, mechanics and Boeing.
Boeing put those pilots into situations where they became test pilots, with a couple hundred passengers in the back.
“But two of the three developing-world crews who were tested failed. Recall that the day before Lion Air 610 plunged into the Java Sea in October 2018, pilots who had flown the same airplane the day before encountered the same abnormal and, thanks in part to a knowledgeable jump seater, resolved it. They reported the malfunction and maintenance techs failed to diagnose it correctly and thus failed to fix it, setting up the accident scenario.”
As I remember, the Lion Air Maintenance crew removed the failed or suspect AOA with a replacement AOA that was overhauled incorrectly by an American, FL based company. A bad AOA was replaced by a certified but equally bad AOA. It would be interesting to find out who might have built or overhauled the first failed Lion Air AOA as well as who might have built or overhauled the AOA installed on the Ethiopian MAX. I would hope the 400 grounded Max’s have those AOA manufacturers checked as well. To me, how do you fail to diagnose a system you don’t know is there?
As pointed out, the MCAS response with intermittent not a trim runaway that defines itself by getting worse in a very progressive but predictable way. Maybe it has happened, but I am not aware of a runaway trim system going full nose up then reversing itself going full nose down. Nor have a ever heard of a trim system being intermittent one way but responding to pilot inputs going the opposite way, yet going the other direction again or stopping depending on flap position, airspeed, or attitude. Once again, I can hear the choir singing, “if I were there, I would…”. But none of us were there in either crash aircraft. Plus, as the blog points out, no one in either maintenance nor the crash crew knew there was a thing called MCAS on board. For that matter, until the crashes, no MAX buyers knew it was on board.
Would I fly on MAX today? NO. Maybe sometime in the future after a few thousand more souls have already been used as paying guinea pigs including American pilots.
I can hear Bullwinkle asking Rocky “wanna see me pull a rabbit outta my hat?” After which Rocky says “Again?” Followed with Bullwinkle’s confident reply, “this time fer sure!” Boeing seems to be the new Bullwinkle saying this time fer sure.
Besides, Covid-19 needs requires the US to pull another rabbit out of its hat. I would like to know a verifiable solution to Covid before getting on any airliner. So far, all I am hearing is…this time fer sure. MAX is the least of my worries.
Let me add a little detail. The Lion Air 610 accident aircraft had its left AoA replaced on October 28 with a unit that was improperly overhauled by a company in Miami. The next day, it flew with that AoA and the crew that managed to recover from the MCAS misfire reported what they saw: IAS disagree. They couldn’t report AoA disagree because the aircraft didn’t have that capability.
The maintainers in Jakarta examined the IAS disagree fault and flushed both pitot systems. They didn’t touch or diagnose the faulty AoA because they had no reason to suspect it was faulty. And they didn’t know about MCAS or if they did, they didn’t connect the dots. I’m not sure anyone would have.
Have not seen it here yet, but I am sure it will come — the fact that some of the pilots on the crashed aircraft and elsewhere in the system “only had 350 hours”.
Yeah well think about it — that meant they were flying every day for a hour for a year. (Plus doing all the ground exams — with ATP boasts are Master Science level.
If you need longer than that to fly your areoplane there is a lot wrong with it.
“If you need longer than that to fly your areoplane there is a lot wrong with it.”
Or just maybe, there’s a lot wrong with the pilot.
“The gap between a ‘flawed’
and an ‘unsafe’ aircraft is a distinction without a difference.”
Really? So an aircraft with an out-of-service lavatory (clearly a flaw) is an “unsafe aircraft?”
By your reasoning, no aircraft can be safe, because – since nothing is perfect – all aircraft include flaws.
Perhaps your cited distinction actually includes differences.
YARS, keeping “flawed” in 737 MAX context is sound. I think.
“So an aircraft with an out-of-service lavatory (clearly a flaw) is an “unsafe aircraft?”
If you do not have a lavatory it cannot be out of service, therefore, it cannot be flawed, or, unsafe.
“There is no spoon.”
If you do not have an airplane, it cannot be unsafe.
“There is no fork.”
The more I read, the more I doubt. The more I doubt, the less I am inclined to fly anything that I do not own. If I need to get anywhere I will walk, ride my bike, ride my motorcycle, drive my car, truck, fly my airplane, or, I won’t go. Period. No hand wringing here.
>I will walk, ride my bike, ride my motorcycle, drive my car, truck, fly my airplane.
Every one of those things is a greater risk statistic than a commercial airline flight.
Yeah, sure Dave, whatever you say…
I think that there are cultural differences in how people will approach machinery. If you come from a culture which understands that mechanical devices will kill without warning because of an underlying problem then you will understand it is your job to stop the disaster before it can go further. If you assume the machine knows better the operator you won’t be able to stop it before the situation gets out of control. Airline pilots who fly and understand the systems logic of their airplanes understand mechanical faults and how they will jump out at the worst time. The “SAM255” is an example. The Air France 447 crash and the Tesla Harry Potter beheading are example of when the operator does not not understand his place in the chain of events.
The second “not” was a mistake. Sorry.
So Why Would You Fly A 737 MAX? Or Not. It’s an entirely different kind of flying… altogether.
The FAA has completely punted on the issue of whether it is legitimate to use a mere software patch to paper over a fundamental instability issue in a transport category aircraft.
To be sure, Boeing has been very careful to couch the existence of MCAS (when they were forced by circumstances to actually acknowlege its existence) as one of correcting the “feel” of the pitch axis in certain high AOA regimes of flight. “Feel” is merely a euphemism for instability, a word that Boeing shall not breathe.
The fact remains that if the lift of the much larger engine nacelles (forward of the CG) and higher thrust of the new engines causes the airplane to want to pitch up so badly (in high AOA and high thrust flight) that Boeing needed to add MCAS to crank in nose-down stabilizer trim, its is unstable. This violates a basic tenet of certification gospel: aircraft must be naturally stable throughout the flight envelope.
The FAA has, by their RTS approval, tacitly signaled that software patches for instability defects are now OK. I think this is dangerous. We need to have a full and thorogh debate about this question and not allow the FAA to sweep it under the carpet.
These software patch solutions might, in fact, be doable with modern technology but the issue needs to be thrashed out by healthy debate and design requirements stipulated so that the sort of sophomorically half-baked engineering errors Boeing demonstrated with the MCAS are not repeated.
In fact, the current “fix” for the MAX (now rebranded as the 737-8) ignores (among other things) the engineering principle of “critical triangles of agreement”; critical systems must have three inputs with a comparator routine to identify and disregard the outlier. As an example, modern jets have three pitot tubes, three Air Data Computers, three autopilots, etc. Boeing is still trying to do it on the cheap.
The FAA is allowing Boeing to get away with it.
I won’t ride on a MAX (-8).
Sent from my iPad