
My Letter to the Editor of New York Times Magazine - kaboro
http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/
======
rswail
Blaming the user is a pernicious problem in UX engineering, especially when a
feature is introduced not for the actual users, but the executives making the
purchasing decisions.

MCAS was an economics driven decision by Boeing to be able to sell it as a "no
cost" upgrade to existing 737 fleets. "You get all this and you don't need to
retrain your people"

The entire concept of the 737 MAX was flawed, marketing an inherently unstable
aircraft with a patched undocumented system to control that instability. Then,
incredibly, making the safety indicators an _optional_ extra was criminal.

The FAA is also liable for regulatory capture and handing over its
responsibilities the actual organization it is supposed to be supervising.

Ultimately, it's an example of what happens when MBA execs, convinced that
they can run "any business" take over from a rigourous engineering culture.
The Harvard (and other) Business Schools have a lot to be blamed for.

~~~
PuffinBlue
> marketing an inherently unstable aircraft

The 737 Max is not an inherently unstable aircraft and to say so grossly
misunderstands the term and what MCAS was doing.

MCAS existed to make an inherently _stable_ aircraft handle in the same was as
previous 737 generations. Design changes had forced the addition of this
system in order to retain the same type rating because those design changes
caused the aircraft to handle differently to previous generations.

MCAS was about keeping the same type rating and the same handling
characteristics. It had absolutely nothing whatsoever to do with 'inherent
instability' \- the 737 Max is an inherently stable aircraft without MCAS.

Continuing to spread misinformation about what MCAS is and the 737 Max
stability is detrimental to the discussion.

EDIT - There is clearly a lot of misunderstand about the terms 'stable' and
'unstable'. These has a defined meaning in aircraft handling. I encourage you
to educate yourselves on the term, on what stability actually is in relation
to this discussion.

[https://www.boldmethod.com/learn-to-
fly/aerodynamics/3-types...](https://www.boldmethod.com/learn-to-
fly/aerodynamics/3-types-of-static-and-dynamic-stability-in-aircraft/)

The 737 Max is a stable aircraft. The 737 Max without MCAS activated is a
stable aircraft. It is an inherently stable design.

The 737 Max can and was flown without MCAS activated (even by the same
aircraft as crashed, the pilots of the previous flight pulled the stabiliser
cut out switches and went to manual trim control).

It is a stable aircraft.

~~~
m12k
According to this article [https://spectrum.ieee.org/aerospace/aviation/how-
the-boeing-...](https://spectrum.ieee.org/aerospace/aviation/how-the-
boeing-737-max-disaster-looks-to-a-software-developer) the engines had become
so big that they had to be moved in front of the wings instead of under them,
which in turn causes the plane to pitch up when the engines apply power (which
was not the case with previous 737s). Whether this can be called 'unstable' or
not seems to be a matter of definition. Sure it's not unstable the same way
that something that completely randomly pitches up or down is. But if you got
to drive a car that veers to the left at high speeds and to the right at low
speeds, and needs a computer to compensate (oh, and this computer compensates
based on sensor readings that may be faulty, so you might need to disable the
computer's compensation and compensate yourself), would you perhaps call that
unstable compared to a normal car? Doesn't seem unreasonable to me. It's
unstable in the sense that controls that are normally independent are not.

~~~
_ph_
All aircrafts with engines below the wings have the pitch up tendency at high
angles of attack. The only problem with that is, that it is required that the
stick force the pilot needs to apply need to increase with high angles of
attack. Therefore, most airplanes have some way of augmenting the stick forces
in those domains.

~~~
mannykannot
All airliners have a cylindrical body projecting forwards from the wing, which
produces a pitch-up moment at high angles of attack: it is called the fuselage
[1]. Normally, the effects of all such destabilizing aspects of the design are
compensated for by the correct positioning and sizing of the wing and
horizontal stabilizer.

Most airliners now flying do have additional augmentation of their handling
for a variety of reasons. Earlier versions of the 737 already had the elevator
feel and centering unit and mach trim, but they are much less aggressive than
MCAS, and, most importantly, _their presence and full scope of effect was not
obscured in order to avoid the cost of training pilots for their failure
modes._ Furthermore, in other cases where handling and stability augmentation
is powerful, _adequate redundancy is provided_ (even the 737 feel and
centering unit has more redundancy than MCAS.) The presence of handling
augmentation devices on other airliners does not justify the way Boeing
introduced MCAS.

[1] [https://leehamnews.com/2018/11/30/bjorns-corner-pitch-
stabil...](https://leehamnews.com/2018/11/30/bjorns-corner-pitch-stability-
part-2/)

~~~
Excel_Wizard
I really appreciate the increasing levels of technical accuracy the further
this thread grows. Hacker News draws in subject matter experts like moths to a
flame.

Reminds me of the old futurama quote- technically correct is the best kind of
correct.

------
IfOnlyYouKnew
Langewiesche is a terrific writer, but it does seem like the overwhelming
majority of people in the business consider his take on the 737MAX to be
misguided.

Reading his article, I got the impression that he has a certain idealised
image of what a pilot should be like. One that I have also noticed quite a few
people here on HN seem to be rather fond of.

Namely: that being a pilot should not just be someone's job, but their
calling. To use a weird phrase I once saw here, they are supposed to be
"fixed-wing enthusiasts".

There also seems to be a certain, somewhat outdated, concept of masculinity at
play here. And, of course, combining these expectations with stereotypes of
African and Asian companies (and people) initially led many to the conclusion
that these pilots were either incompetent ("because of a lack of calories in
early childhood" to quote one line of reasoning I saw (luckily not here)) or
incapable of independent thinking. Never mind that at least one of the
captains was trained in the US.

These ideas couldn't be farther from how the system is actually evolving, and
how it should be: Flying _needs to be boring_. If your pilot has a chance to
become a hero, the system has already failed. The goal must be a system of
technology, institutions, curricula, etc. that makes it perfectly safe to
trust any decent high school student to become a competent(-enough) pilot.
Candidates with a sense for adventure should be screened out, because flying
an airliner is dreadfully boring, and a volatile personality will soon find a
way to make it more exciting (drinking, usually).

And planes should become more and more automated. Software and design errors
tend to occur just once. Humans tend to make mistakes, even repeatedly, even
with the best training. The 737MAX disaster is a terrible outlier that
shouldn't obfuscate the fact that in the last 50 years or so, airline
fatalities have dropped by an order of magnitude, even thought miles traveled
have increased by a similar magnitude.

Combining the two: air travel today is 50 to 100x safer than it was in the
golden age of piloting so many seem to glorify.

~~~
seanmcdirmid
If flying becomes boring, it becomes a tedious job that requires a lot of
mental fortitude to slog through. Boring jobs are dangerous, because human
beings don’t do boring very well.

And I think we’ve already reached that point in aviation, as much of the work
has been offloaded to automated systems, making it easy for attention to doze
elsewhere, and making transitions to where manual intervention is unexpectedly
required even more difficult. It’s the same with self driving cars: the only
safe options seem to be no automation and all automation since humans simply
don’t do boring very well.

~~~
darawk
This is a very strange perspective to me. Clearly making flying boring has
_tremendously_ reduced the number of incidents. Certainly it's true that
making something boring will increase the incident rate...but what's
overwhelmingly clear from the data is that the reduction in incidents from all
that automation dwarfs that effect.

~~~
mpweiher
The problem is that both statements are true.

Yes, we want flying to be as boring as possible, and yes making flying this
boring has been the result of the amazing success of making flying safe.

Yes, with flying so boring, when something _exciting_ does happen it's in many
senses more of a problem.

This is a, maybe _the_ fundamental dilemma in aviation safety today. Part of
the solution is lots and lots of simulator training. Which of course is a
problem when the manufacturer claims that there is no need for simulator
training, because everything is exactly the same.

~~~
seanmcdirmid
Boring for the passenger doesn’t mean boring for the pilot. A bus driver has
to drive the bus, it’s routine yet never the same thing, their day goes by
pretty fast. Compare to someone watching over an automated train...it’s just
time they spend twiddling their thumbs, time crawls, they get really bored.

Flying is becoming less like flying a bus and more like supervising an
automated train, and that is what is dangerous. When something unusual
happens, the pilots are surprised and unable to adjust quickly, because
unusual isn’t usual.

Of course, if unusual happens all the time, or is too out of the norm, you are
pretty screwed, exciting is more dangerous than boring, but it doesn’t make
boring less dangerous.

~~~
mantap
Pilots still have a lot to do, they must monitor the radios, the weather,
fuel, etc. Since plenty of accidents have been caused by _not_ paying
attention to these things, I don't think you can say that having more time to
do them is a bad thing.

If there is a lack of manual flying ability it is entirely due to culture and
not the aircraft. Pilots can and do turn off the autopilot if they want to
practice, and most landings are done manually because it is softer.

------
harry8
Wow he didn't miss. It's a good example of an interesting change in our
information dissemination dynamic. 30 years ago he would have been waving his
arms trying to get other news organisations to run a counter-story and then be
subject to having quotes taken out of context and having his thoughts filtered
through the story the journalist was trying to write or that the editor
thought was more compelling. Giving everyone the best possible motives, which
was frequently reasonable, it had serious issues.

Now he writes the letter. Publishes it himself very cheaply. Then allows it to
be read by a very large number of people directly, un-edited. There are many
of examples of this kind of thing nowadays (and it's easy to see it doesn't
always work too). When it does work the world is just a little bit better.

~~~
gowld
The NYT had a Letters to the Editor section 30 years ago, just like the one
that published today's letter.

~~~
blowski
The letter wouldn't necessarily be published, and it would likely still be
edited. By having his own place to publish, we do know exactly what his words
are.

------
skybrian
Aviation accidents are typically about defense-in-depth being undermined (the
"swiss cheese model"). The object of an investigation should be to find
multiple vulnerabilities that could be fixed, at all levels. Focusing
exclusively on one of them to the exclusion of others would be a problem.

Sullenberger says the same: "we need to fix all the flaws in the current
system — corporate governance, regulatory oversight, aircraft maintenance, and
yes, pilot training and experience."

But this doesn't mean any particular article can't focus on one problem more
than others, so long as they don't claim it's the only problem.

Looking at the original article, the clickbait headline (typically not written
by the author) pretends we can find a single cause ("What Really Brought Down
the Boeing 737 Max?") but the subhead takes it back ("equally guilty"). The
article focuses on problems at some airlines, Lion Air in particular, and
alleged differences internationally in how airlines approach safety.
Apparently that's what the author wanted to focus on?

So I guess it comes down to a difference in emphasis?

~~~
rossdavidh
But...the whole concept of the 737 MAX was, "you don't need extensive
retraining of your pilots, it's still a 737, and if they can fly a 737 they
can fly this with minimal retraining." Otherwise, there was no purpose in
designing a plane with this design; if you started from scratch you would put
the wings higher up so that the engines would fit in the normal position, and
the MCAS wouldn't be necessary.

So, "equally guilty"...is equally wrong. If this pilot thinks it's not
reasonable to expect a typical 737 pilot to be able to react to an MCAS
failure in time, then (given two crashes in the first year of use), he's
probably correct.

------
phjesusthatguy3
I would suggest changing the title of this HN post. Maybe "The MCAS design
should never have been approved" or something to that effect. IMO, the current
"My Letter to the Editor of New York Times Magazine" is far too ambiguous.

~~~
iosonofuturista
The title is no good, but maybe a compromise would be "Capt. “Sully”
Sullenberger on the 737 MAX". Picking a just a sentence without the context
seems to be against the spirit of the no clickbait rules.

------
mpweiher
Central point of Sully's letter:

 _These emergencies did not present as a classic runaway stabilizer problem,
..._

Which flatly contradicts Langewiesche's claim that that is what they presented
themself as and therefore should have been handled by any competent pilot.

I have to admit I also found the Langewiesche article extremely tendentious
and...not sure "racist" is quite the right term, but it certainly felt close
to it.

Ethopian for example had an excellent reputation and safety record up until
the MAX accident, something never mentioned in the article. Instead we learn a
lot about Adam air, an airline that went belly up before the 737 MAX program
was even started. How that is supposed to be relevant except for a "well,
those Indonesiens ..." dismissal is beyond me, and of course there is no
connection to Ethopian except, well, darker skinned foreigners.

Not a good look, New York Times.

------
dombili
I'm glad Mr. Sullenberger spoke up about this. As some people have pointed out
in this thread, Langewiesche is indeed a terrific writer, but the tone of the
piece in question was off-putting.

For those who're interested, Patrick Smith (aka Ask the Pilot) also wrote a
critical piece about the article last month:
[https://www.askthepilot.com/plane-and-
pilot/](https://www.askthepilot.com/plane-and-pilot/)

------
phnofive
The article to which this letter is in response:
[https://archive.is/Rf4Yj](https://archive.is/Rf4Yj)

------
pulse7
That article in New York Times Magazine
([https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...](https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-
crashes.html)) seems like a part of the Boeing's PR action to win back the
public confidence in 737 MAX...

------
axaxs
> The MCAS design should never have been approved, not by Boeing, and not by
> the Federal Aviation Administration (FAA).

This is the line that stuck out to me. Basically, it never occurred to me that
the FAA has to approve aircraft designs. And if that assumption is correct,
who exactly would the approvers be, and are or can they even be qualified? It
feels like they'd just be mostly trusting Boeing's judgment as not to upset
the Juggernaut, which seems like a rather useless process.

~~~
inamberclad
The FAA actually does keep engineers on staff, and the aircraft manufacturer
will have to explain and demonstrate how their aircraft complies with
thousands of different requirements. This is actually one of the larger sub-
controversies of the whole MCAS issue; the FAA has been progressively
delegating more and more of airworthiness compliance to Boeing's engineers and
trusting their results instead of verifying it themselves.

With regards to the regulations, they're excruciatingly detailed. I encourage
you to read 14 CFR 23, Airworthiness Standards: Normal Category Airplanes, and
14 CFR 25, Airworthiness Standards, Transport Category Airplanes.

------
hlms
Sully's the man. His description of the experience of piloting in a crisis and
analysis of the design and regulatory issues reminds me of Sidney Dekker and
'Safety Differently': [http://sidneydekker.com/](http://sidneydekker.com/)

~~~
aussiegeek
Interesting story: Sully actually lost a copy of one of Sidney Dekker's books
in the forced water landing that he'd borrowed form the library.

------
ec109685
The worst thing about these accidents is the pilots never encountered the
situation in simulators.

For non-lethal failures, tech companies do extensive game day testing to
practice failure conditions and engineers responses. The fact that it wasn't
done in this case because the failure was too expensive, unlikely to occur and
the new plane wasn’t different enough was a huge failure on Boeing’s and the
FAA.

------
ablation
Worth noting that Langewiesche wrote a book about Sullenberger’s infamous
flight on the Hudson. Not a critical one, but they do have a previous
relationship at least of some sort.

~~~
starpilot
Calling it "infamous" is a bit critical, isn't it? "Famous" would make more
sense.

~~~
ablation
Not in my opinion. But entirely up to you how you take it.

~~~
starpilot
Well, I like to follow the rules of English, so that's how I take it.
[https://www.merriam-webster.com/words-at-play/infamous-vs-
fa...](https://www.merriam-webster.com/words-at-play/infamous-vs-famous)

~~~
ablation
Whatever blows your hair back, bud.

------
dgudkov
This letter is something the modern internet and media are sorely missing - a
real expert opinion instead of a flood of "armchair expert" opinions. I would
always prefer one opinion of someone who _does_ , over a hundred opinions of
those who _think_.

~~~
ken
OTOH, there's plenty of experts in every field who can and do say "I've been
doing this for 30 years, and I know that ..." and then mention something they
do which statisticians have since shown isn't effective.

Sully is worth listening to here because the facts are on his side, in terms
of blaming the victim versus analyzing the system as a whole. Sully is getting
a lot of airtime in the media because he's a famous public figure, but a new
pilot 6 months out of flight school would be just as correct with the same
facts.

He's a smart guy who is obviously familiar with the safety research done in
his field. His own decades of experience do not constitute research on their
own, though.

------
bumby
Even if the pilots are partly to blame it indicates a bad design philosophy.
The hierarchy of mitigation in safety critical systems is

1\. Engineer the hazard out so it no longer becomes possible

2\. Use other systems to detect and safe the system (ideally, if it's a
software hazard, use non-software mitigation)

3\. Procedural or administrative mitigation

#3 is by far the least desirable, meaning you only use it as a primary
mitigation if the other two are infeasible. If Boeing uses this defense I
would want to know why they were not willing to implement the other, better
methods, because it would seemingly point to managerial or technical
deficiencies

~~~
metalliqaz
The risk wasn't identified in the first place. Remember that the updated MCAS
was itself a mitigation.

~~~
bumby
The risk of MCAS was identified in the system safety analysis (SSA), but they
didn't appear to do a thorough job (in hindsight, at least). The biggest
mistake to me seems to be the erroneous severity attribute:

> Assessed a failure of the system as one level below “catastrophic.” But even
> that “hazardous” danger level should have precluded activation of the system
> based on input from a single sensor — and yet that’s how it was designed.[0]

[0] [https://www.seattletimes.com/business/boeing-
aerospace/faile...](https://www.seattletimes.com/business/boeing-
aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-
implicated-in-the-lion-air-crash/)

------
yread
Am I the only one surprised by the whole professional personal brand
management of Sully? Do they also sell mugs with his face?

It's not like he is the only person to ever glide with an airliner to a safe
landing

[https://en.wikipedia.org/wiki/List_of_airline_flights_that_r...](https://en.wikipedia.org/wiki/List_of_airline_flights_that_required_gliding)

~~~
colinbartlett
He is an author who does speaking and consulting on the basis of his
experience. I don’t believe his branding is anything abnormal or differing
much from that of prominent software development authors, speakers, and
consultants.

~~~
ken
It might be unique among professional pilots, though.

------
w-m
There was a HN discussion of the Langewiesche article that this letter makes a
reply to:
[https://news.ycombinator.com/item?id=21004683](https://news.ycombinator.com/item?id=21004683)

It made some similar arguments, but also quite a bit of Boeing PR bashing. It
got flagged.

------
wankeler
Interesting related discussion over on pprune and referencing relevant
material:

[https://www.pprune.org/rumours-news/623171-loss-control-
flig...](https://www.pprune.org/rumours-news/623171-loss-control-flight-
flight-crew-training.html)

[http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf](http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf)

[https://m.youtube.com/watch?v=35Zy_rl8WuM&feature=youtu.be](https://m.youtube.com/watch?v=35Zy_rl8WuM&feature=youtu.be)

------
mcguire
Sullenberger's testimony to the House Committee on Aviation:
[http://www.sullysullenberger.com/my-testimony-today-
before-t...](http://www.sullysullenberger.com/my-testimony-today-before-the-
house-subcommittee-on-aviation/)

And ironically, William Langewiesche (whose reputation for aviation is based,
aside from being a pilot himself, on his father, Wolfgang Langewiesche) wrote
a book on US Airways 1549:
[https://en.wikipedia.org/wiki/Fly_by_Wire](https://en.wikipedia.org/wiki/Fly_by_Wire)

------
ken
Not relevant to the content of this letter, but "this age-old aviation canard"
in a note about MCAS has got to be the best word choice I've seen all year.

------
justforyou
Another reason to steongly consider the Gell-Mann amnesia effect when reading
anything from the NYT.

------
WalterBright
> These emergencies did not present as a classic runaway stabilizer problem

I find this baffling. The stabilizer was clearly running and dangerously
pitching the nose down.

The pilots could have safely resolved the situation by:

1\. using the electric trim switches to override the runaway trim, which they
did

2\. then cutting off the stabilizer trim with the cutoff switches, which they
did not

(1) and (2) are true. See Aviation Week Aug 19.

~~~
salawat
August 19 is 4 months after March. That's a lot of time for details to have
finally been worked out about how MCAS _actually_ worked.

Also, they did cutoff the electric trim, but had to reenable it in order to
try to neutralize already present mistrim.

If the switches had been left alone from the NG, where the flight computer
could be isolated while maintaining the electric trim controls, they could
have been fine.

...Of course, if Boeing had actually _mentioned_ MCAS in training materials,
then things may have been different too.

~~~
WalterBright
Knowledge of MCAS was not required for (1) and (2) to work and be effective.
Note that the pilots were already doing (1). And the Stab Trim Cutoff switches
are there to cut off the stab trim.

Besides, at the time of the Ethiopian crash, the existence of MCAS was well
known:

[https://theaircurrent.com/aviation-safety/boeing-
nearing-737...](https://theaircurrent.com/aviation-safety/boeing-
nearing-737-max-fleet-bulletin-on-aoa-warning-after-lion-air-crash/)

Note that the bulletin, sent to all operators of MAX aircraft, is a longer
version of (1) and (2) that I mentioned, giving more detail.

~~~
ncmncm
No. The switches worked differently in the MAX than in the NG. Doing what
would work in the NG would not work in the MAX.

~~~
WalterBright
Read Boeing's bulletin on the matter in the link I posted. It works as I said.

------
dmtroyer
I think a flaw in his letter is that it is printed in all italics. ugh.

------
starpilot
Pilots do cause a lot of issues: [https://en.wikipedia.org/wiki/Pilot-
induced_oscillation](https://en.wikipedia.org/wiki/Pilot-induced_oscillation)

It's the aeronautical engineer's version of PEBKAC.

~~~
nostromo
If a model of car occasionally drives itself into oncoming traffic, "Drivers
also cause some accidents" would be a pretty ridiculous response.

~~~
czzr
Amusingly, that is exactly the response in every Tesla thread on HN.

