Hacker News new | past | comments | ask | show | jobs | submit login
Boeing 737 Max pilots complained to feds for months about suspected safety flaw (dallasnews.com)
627 points by mbgaxyz on Mar 12, 2019 | hide | past | favorite | 292 comments

Some context:

1. There have been 865 737 related ASRS reports since 1/1/2018

2. I don't know how to quickly separate out 737-MAX reports from the non 737-MAX reports, as the ASRS database doesn't include 737-MAX as an airplane type! From scanning, I can say that there are more than five MAX related reports, though.

[1] All 865 737 reports since 1/1/2018

CSV - http://s000.tinyupload.com/index.php?file_id=546686797940621...

DOC - http://s000.tinyupload.com/index.php?file_id=726497188798253...

[2] Airplane model filter with no MAX option: https://imgur.com/a/09rRtzX

[3] ASRS database: https://titan-server.arc.nasa.gov/ASRSPublicQueryWizard/Quer...

[4] Document linked in the article with plane models listed under 737-800 or 737-Next Generation Undifferentiated https://www.documentcloud.org/documents/5766398-ASRS-Reports...

Some other MAX reports:

1583028: B737 MAX-8 Captain reported the engine fuel burn was higher than expected. Maintenance confirms that several 737-MAXs are burning fuel faster than expected.

1593699: ATIS sheet fell through the slot forward of the center pedestal and the blank off plate. We had Maintenance come out to remove it. We discovered 20 other ATIS sheets mixed into the wiring. The aircraft is only six months old. Severe potential fire hazard!

1538699: B737 MAX pilots reported flying through the final approach course and descending below published altitudes due to confusion with the new style instrument displays.

Another one:

1603376: B737 Captain reported the flight recorder light was inoperative, which led to the discovery that the flight data recorder was not installed.

Can anyone anyone with more experience with this say whether this is normal for a new aircraft? I get that it's easy to forget parts of the assembly process, but how do you put an aircraft into service without verifying that all the parts (especially important parts like this one) are installed?

That's got to be illegal, having no flight recorder?

Wouldn't it fail preflight checklists? Depending on the country I'd have thought that's a "lose your license to operate" kinda deal??

The oss ur probably got caught in preflight. We don't know how much the plane was used before that though.

IIRC, The flight recorders are tested by Boeing before delivery to the customer. Planes undergo several weeks to a month of tests by Boeing before delivery and sometimes undergo even more testing by the customer after delivery.

Most likely, the part is pulled for maintenance and its not properly recorded. If its not properly recorded, the plane can be put back into service without the part that was removed.

Air Canada Flight 143 is an example of maintenance records not being kept properly. https://en.wikipedia.org/wiki/Gimli_Glider

1555013: B737 MAX First Officer reported feeling unprepared for first flight in the MAX, citing inadequate training.

1593017: B737MAX Captain expressed concern that some systems such as the MCAS are not fully described in the aircraft Flight Manual.

Edit: A CSV of all incidents that include "MAX" in their report text: https://pastebin.com/ezhffWRn

1593699 is amazing.

To me, it's rather scary that even the aviation industry is now seemingly changing the UI and confusing users; HN (and a lot of other people) love talking about how much they hate a redesign of some site or software because it broke their workflow and hid/removed critical functionality, and now it's happening to pilots in life-or-death situations.

I use webflow regularly. Recently they updated the UI but didn't bother addressing the hundreds of other requests for obvious missing features. If anyone here has the capacity to make a dumb webflow - you'll make a lot of money. Include all the basic building like drop-down menus, tabs, carousels etc... And make some freely available premium themes (I can help with this) and you have yourself some loyal users myself included.

Nothing is more infuriating than a UI redesign to fix what's not broken.

I'm generally okay with fixing what's not broken. At worst it's a waste of time. What most people hate is intentionally creating breakage by removing and/or shuffling around features they'd been relying on.

Please get in touch. Email in profile.

It's not just the civilian aviation industry who has this problem, by now it's even an issue with military hardware [0]

[0] https://arstechnica.com/information-technology/2017/11/uss-m...

I have to wonder at the fit-and-finish that would allow full-sized pieces of paper to fall inside an instrument console.

This reminds me of a Romanian joke about the national car maker, going something like this:

Some reporter is wondering around the international car expo, discussing with various car makers. Mercedes tells him "our car is the most air-tight ever produced. It scored 24 on the cat test!" The reporter wonders - "cat test? what is that?" ""Oh, it's a novel test! We put the cat in the car, closed all of the windows and doors, and 24 hours later it drew its last breath".

Impressed, the reporter moves on to Ferrari. They tell him the same story - most airtight car ever made! He asks them knowingly - "How did the cat test go?" to which they proudly reply - "Oh, very well, very well! We put the cat in the car, closed all of the windows and doors, 12 hours later the poor thing was dead".

Next he wonders to the Renault-Dacia stand. They also tell him about the air-tightness of their car, again he asks how the cat test went. The Dacia representative beams: "Oh, wonderful! We put the cat in the car, closed all of the windows and doors, and wherever its head poked out, we quickly plastered over".

Maybe Boeing poached the guys responsible for Tesla's panel gaps, who knows?

Speaking of panel gaps.

<90s Saturn> The panel gaps shrink in warm weather. </90s Saturn>

In case anyone was wondering that was actually a thing with early plastic body panels. They eventually refined it to the point where the gaps don't change noticeably and now pretty much every car has some plastic body panels.

Saturn had a lot of fit-and-finish issues, but man the S-series was reliable. I had one for 13 years/250,000 miles and barely put more than tires, brakes, and oil into the car.

The oil, though, was interesting. The s-series engine had a design flaw with the oil control piston ring where it would get stuck in its groove due to carbon build-up. The engine would then start burning prodigious amounts of oil — mine burned 1 quart every 500 miles. I put the cheapest oil I could find in as a result and when I did a filter change I’d save the old oil to pour back into the engine (diluted — about 1 qt of old oil and 3 qts of new.). By the time I used up all of the old oil it was time to change filters again.

What I've heard (i.e. this may just be hearsay) was that for much of its history Saturn used engines that had bores with a fairly rough surface finish which resulted in them holding more oil and reducing wear on the bores and rings but at the cost of burning more oil. Sometimes they burned quite a lot of oil as they got old.

GM treated Saturn like a throwaway brand so they used them for a lot of R&D they didn't want to risk "important brands" over and consequently there's a bunch of random Saturn cars that have features that even some new cars don't have. My friend had one from the early 2000s that would vary radio volume with speed and window position.

The rough cylinder bore didn’t help, but the root cause was the design of the bottom ledge of the oil control ring grooves and the lack of proper drainage.

A popular shade tree mechanic fix was to drill drain back holes in the oil control ring groove: https://m.youtube.com/watch?v=UrnblJ8VZtY

Probably southwest pilots. If it’s not analog it’s too much for them.

Well this shit doesn't sound any better:

1565207 At cruise flight, our Wi-Fi stopped working. I then saw that I was unable to access the Pilot Mobile app. Since I do not routinely copy the flight plan to iBook or acrobat (we are not required to do this), I was unable to access the flight plan. I've lost Wi-Fi before but not had this problem. Maybe it's a 737max thing. My First Officer had a copy on iBook and airdropped it to me. Later we were able to restore the Wi-Fi and I could login to pilot mobile but the [flight plan] was not there anymore.

It's time we make radio with the ATC VoIP. Just run an asterisk on the plane.

Boggles the mind on several levels: 1. That airlines would use consumer tablets without hard-copy backup as matter of procedure. I remember Air Canada announcing it and how it would save so much weight for both pilots and the airplane, and thinking... I print my Google Maps as a backup for roadtrips, I sure as heck would do it on a flight!

2. Perhaps I'm misjudging, but the tone and perspective of pilot makes me worry for their approach and technical skills. Does not routinely copy to local device before takeoff? "Maybe it's a 737max thing"? Airdropping as a solution?

This does not smell off setting up for success... :<

I'd be curious to know what "WiFi" means here exactly. If it means "my flight plan is stored on the internet and I didn't save a local copy" then yeah, I think that's insane. But if it's a local WiFi network it doesn't seem so weird to me. You should, in the course of day to day operation, be able to expect a WiFi router will work.

Of course, it'll fail at some point, but it's not like they were cut off from the world, they could have radioed for the information if the copilot didn't have it, or something.

> You should, in the course of day to day operation, be able to expect a WiFi router will work.

My experience with WiFi routers is the opposite. I will wire anything important.

I very much doubt they're using consumer grade Linksys boxes in there, though.

Enterprise WiFi networks work better but my experience has still been far from what I'd call reliable.

I'd like to say an airplane might work better as a controlled environment than an office building, but probably not if you have 300 passengers in the back, half of whom have forgotten their MiFi devices running in their carryon.

Yeah me too.

You know if WiFi was so awesome, wifi routers wouldn't have wires in them!

As a non technical person, who is about to fly an 80 ton vehicle for extended distances, local backups of WiFi dependent data is not likely to be a major concern.

Especially if (a) it’s not part of your extensive checklists, which would reasonably be expected to be included if it was important, and (b) you’ve lost WiFi in other planes before without losing your flight plan.

I’m a technical person and it is a major concern.

They were in cruise, which means the flight plan was already set and can be viewed on the MCDU. Sure they lost a fancy map on the ipad but that doesn't mean they suddenly don't know where to go.

There are a number of situations where the checklist calls for reinsertion of the flightplan during flight, they would be lost in those situations.

I know nothing about piloting, but I would have expected a flight plan to be stored on the plane itself. Accessible directly on some screen in the cockpit or something. Why rely on consumer devices that require wifi?

It is called "electronic flight bag" https://en.wikipedia.org/wiki/Electronic_flight_bag . I see it as a technical loophole that allows to gives handy tools to pilots and airlines with reduced hassles of certification processes.

The appeal of the 737 MAX for airlines was that it was intentionally made so that you could take crews with a 737 qualification and put them in.

I.e the airlines could save money on training.

The main design constraint on that bird was that it should pass most of the old paperwork so that Boeing nor airlines would need to go through expensive training and quification.

Yet, they modified the plane quite a bit - but they could not modernize several systems since they would have to then go through rigorous and expensive testing. ..

Nobody seems to underline this fact.

I bet that's the actual reason they didn't put the automatic pitch modification system to any documentation - it would not fit on the description of "just old 737 nothing new here hop in".

> The appeal of the 737 MAX for airlines was that it was intentionally made so that you could take crews with a 737 qualification and put them in.

Really? Everything I heard so far sounds like the 737 MAX has a few new, unusual or counter intuitive features that require extra training, and that training material skimped on training for that.

> "just old 737 nothing new here hop in"

Am I correct in understanding that was a blatant lie?

Not an expert, I'm basing my comment on stuff I've learned from third party sources.

It does not sound to me like lying, more like a confusion of project constraints. I.e. "make the plane better but don't touch this and this and this arbitrary system".

In short: the safety requirements for doing it properly are so high that they were artfully avoided. The aeronautical analog to byzantine password requirements that only make people susceptible to post-it password management?

regex? I just grepped "B737 max" and found 11 entries.

"737.{0,20}max" (case insensitive) yields 20. [0]

[0] CSV output: https://pastebin.com/87N023cx

searching for mcas and its long form might do as well.

So 20 MAX-related issues out of ~850. How is that significant?

> So 20 MAX-related issues out of ~850. How is that significant?

To build on what @ggm and @siwatanejo noted. The 737 debuted in 1967, so it is 52 years old now. The 737 MAX is 2 years old. In terms of number of issues per year since the aircraft was introduced the 737 is at ~15 incidents per year and the 737 MAX is at ~10/year. But as @ggm notes, it's important to look at when in the life cycle many of the non-MAX 737 incidents occurred.

Another way to look at this is by number of aircraft produced. The Boeing website[0] gives production numbers for various classes of the 737. In terms of incidence per number of aircraft delivered the non-max 737s have 0.082 incidents per delivered aircraft while the 737 MAX has 0.05 incidents per delivered aircraft.

Both of those suggest that the 737 MAX may not be any worse than the non-max 737s, but a more careful statistical analysis is probably necessary to draw strong conclusions.

[0] http://active.boeing.com/commercial/orders/displaystandardre...

I’d look at incidents per flight hour. Some of those 737s have been in the air for decades. I suspect the numbers for the 737 MAX will stand out more on this analysis.

It’s also worth noting that the MAX should benefit from 5 decades of accumulated experience and regulation. So you’d expect far lower incidents.

The problem might not be with the plane per se but rather with Boeing rushing a bit and relying on the fact that “it basically the same plane but better so why would there be issues”.

Note that 15 vs 10 incidents per year is also not accurate since there are far fewer 737 MAXs out there.

It's likely that a given plane gets more incidents at the start of its life. It might not be statistically significant

So then why did I get downvoted so hard?

I didn't downvote you, so I can't speak for those who did. But I replied because simply saying "20/850 is small" isn't sufficient to argue there isn't a difference between the two planes. Partly because the timescales for the two incident counts are different and so are the number of planes constructed. So normalizing the incident counts against those quantities is a first step at getting towards their significance. Though as @ggm and @ansy point out, the incident rates also vary as a function of time through the lifetime of that airplane model. So really that behavior needs to be examined as well.


Personal attacks will get you banned here. Please review https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.

We'd need some meta analysis of the rate of issues for other plane types by release date to track the declining exponential curve of bugs to legacy.

"all new systems have bugs. this may not be unusual"

I don't think anything else has been pushed as far as the 737. The closest are probably the De Havilland DHC-8 and the Douglas DC-9/MD-80/MD-90/717, and maybe the DC-10/MD-11. The The Q400 had some pretty serious landing gear issues, the MD-11 was notoriously tricky to land, the MD-80 had that undocumented auto throttle issue, and the MD-90 had those extra flaps next to the engines.

we're talking about a plane model that is only 2 years old?

Yes and no. The basic 737 design dates to the 1950s. The first ones flew in the 1960s.

The 737 Max is an augmented version of the original.

Right, I'm (we're) obviously talking about 737MAX

> Right, I'm (we're) obviously talking about 737MAX

I think @ams6110 is saying that it may not be fair to identify the 737MAX as a completely new plane, since the 737MAX can be identified as more of an evolution of the 737 rather than a new, from-scratch plane design.

And that is bullshit. As long as you're not just changing the resolution of the seat's screens, it's a completely different model, for all intents and purposes.

It would be ironic if the lack of 737-MAX category for reports is why these reports never made it to the people who needed to see them, which caused the issue to go unnoticed.

1555013 is pretty damning in telling how the airlines treated the MAX as the same type as the 737-800:

"I had my first flight on the Max [to] ZZZ1. We found out we were scheduled to fly the aircraft on the way to the airport in the limo. We had a little time [to] review the essentials in the car. Otherwise we would have walked onto the plane cold.My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely.

The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).

We were unable to navigate to systems pages and lacked the knowledge of what systems information was available to us in the different phases of flight. Our weather radar competency was inadequate to safely navigate significant weather on that dark and stormy night. These are just a few issues that were not addressed in our training.

I recommend the following to help crews w/ their introductory flight on the Max:Email notification the day before the flight (the email should include: Links - Training Video, PSOB and QRG and all relevant updates/FAQ's)SME (Subject Matter Expert) Observer - the role of the SME is to introduce systems navigation, display management, answer general questions and provide standardized best practices to the next generation aircraft.Additionally, the SME will collect de-identified data to provide to the training department for analysis and dissemination to the line pilots regarding FAQs and know systems differences as well best practices in fly the new model aircraft."

[EDIT] Fixed ACN Number

Wow. That's the same type of training material we would get when I worked at a coffee shop (large chain) and we came out with a new drink. Maybe even less - At the coffee shop we had to do a test with the manager for them to see that we could make the new drink successfully to standard.

Wow... I wonder how much of this could have been avoided if the 737-Max had just been given an entirely new model name like "738".

I'd assume that when the 777's came out even pilots with experience on the 767 and other Boeing planes were still given ample training beforehand. The minor difference in the Max's model name disguises the seemingly large difference in their operation.

Boeing fought extremely hard to avoid having this happen, since then any pilot wanting to fly the Max would have to first achieve a type rating certificate for the new type of plane, and the FAA would have to test and certify it instead of Boeing "self-certifying" that it was a type of 737.

The determination to shoehorn what aerodynamically kind of is a new type of plane into the 737's type rating seems likely to be the root cause of these deaths.

> seems likely to be the root cause of these deaths.

Given that investigation in both accidents is still ongoing and all we know is wild speculation your conclusion is premature even though it finally may turn out to be true.

You're quoting the phrase "seems likely". It's not a conclusion. It's my guess at what's most probable based on what we know today.

(Also, I don't agree that we only know "wild speculation" about the Lion Air crash. The investigators have told us much about the proximate cause of the crash, even though their final investigation is not yet complete.)

Maybe it’s my English. What probability do you assign to “seems likely”? Above 50% (the way I read it)? Or does it mean it’s a possible outcome among many others, all with very low probability?

I would read it the same way, but personally I would want to attach an additional qualifier: It's likely that this is one of the causes.

There may or may not be something inherently problematic about the way the MCAS works, but more thorough training would likely have lowered the chance of these accidents happening - having the same type rating was one of the root causes for the lacking training

Flip that around: would you expect that pilots flying a new aeroplane without any conversion training would be more likely to cause an accident.

It's a damning indictment of Boeing, and whichever authorities let them get away with it, that they pushed through an aircraft with a different pilot UI/UX knowing that pilots would then be under trained when using it: like someone said we train baristas better.

I've driven minibuses before and always ensure to get an hour of driving a new model before taking passengers.

At least in this particular instance... how is it Boeing and aviation authority's faults that pilots are given an hour's notification they'll be flying a new model of plane?

That would seem to fall directly on the operator / carrier.

Boeing takes responsibility if the training manuals were not comprehensive. Aviation authorities take responsibility if they under-mandated training. But ultimately neither know a given carrier's scheduling and pilot allocation.

I assume an hours notice is quite typical for pilots to find out which specific airplane they will be flying.

If the carrier was told by Boeing and the FAA that no additional training was needed, why would they use any different procedure.

Because their pilots had previously told them they didn't feel comfortable? (See report)

At some point this falls back on nannyism. Either you have a functional company, where your employees are empowered to communicate internally, and your company does something about it... or you don't.

Boeing's job is to engineer the billion things required to keep an airplane flying. The government's job is to validate Boeing performed due diligence and mandate what training is required to the carriers. The carriers have a job too.

I wouldn't be surprised if Boeing pushed hard to have it same type certified. Why wouldn't they? Ultimately, regulatory agencies agreed. Maybe that was correct, maybe not.

But absolving the pilots' direct parent company of responsibility is bullshit. Aerospace is a different industry, but it's not that different vis what a healthy, functioning company does.

Boeing was doing what the airlines wanted, which is provide a new more efficient airplane that requires minimal training for existing 737 pilots to fly, much like the A320neo. Airlines are the ones who schedule the pilots and their training, and from what we have heard, there _is_ training for pilots new to the Max that apparently some airlines have not administered.

Ultimately Boeing and the airlines share responsibility for ensuring the training is adequate, thats why many airlines have lots of training that goes above and beyond what Boeing supplies.

To be fair, this is extremely common, this isn't something Boeing invented yesterday. The whole series of Cessna business jets are on the same type rating. The A330/A340/A350 share a type rating. The 757/767 share a type rating. There are almost certainly more differences between a 757 and a 767 than a 737-800 and a Max.

Not that 90 minutes on a tablet constitutes a reasonable level of training though.

Initial eyewitness reports are of fire, smoke and debris trailing the aircraft before it went down. I would caution against the use of the word "likely" here.

Eyewitness testimony is some of the most unreliable there is. See the gorilla experiment for instance.

It's likely that people rewrote their memories of the event. It's also likely that the MCAS induced stresses on the plane caused a turbine flameout.

The Ethiopian Airlines CEO has disclosed that the pilot experienced a control issue. So a fire, if one existed, was probably a consequence, not a cause.

It wouldn't even be surprising if the aerodymanic stress had caused a breakup, though that doesn't seem to have happened judging by the crater.

Engine flame outs could occur at high AoA due to stall turbulence in the inlet.

Correct me if I'm wrong, but I remember reading somewhere that this is one of the reasons Airbus aircraft are popular with airlines and pilots: their fky-by-wire common cockpit allows a pilot certified on say the A320 to safely fly an A330 since all instruments, displays, controls and what-nots are exactly the same, only a quick "refresher" certification is required, so pilots get a feel for the aerodynamics and response of the bigger/smaller model they are certifying for..

Why would boeings shuffle around such critical human+machine interfaces?

Even if Boeing didn't change anything in the UIs, different models have different features and pilots need to know these differences before the airline can say they can safely fly a given plane.

> if the 737-Max had just been given an entirely new model name like "738"

That model name would’ve been worse. The 737-800 is very commonly abbreviated to 738 in the industry (739 being 737-900, 744 being the 747-400, etc).

That's just awful practice! It's got a name, use it!

(Yes, that sorta stuff annoys me ;) e.g. people talking about v2.04 of $project, when they really mean v0.204 - sure, I get it, but at some point the searchability for issues on the internet is going to be screwed!)

It's not in this case. B738 is the official icao code for the aircraft, just like B38M is for the max.

Oh, well that's totally different then. Still feels weird to "consume" other potential model numbers like that though :)

When you have limited space to show some information, sometimes the space it takes up needs to be reduced.

Generally airline pilots only fly one type of aircraft at a time. So yeah, when 777 came out some would have become 777 pilots.

> The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).

Are these changes not noticeable until you're in the air or should pilots have been refusing to take off in a plane they're not familiar with?

> Are these changes not noticeable until you're in the air or should pilots have been refusing to take off in a plane they're not familiar with?

I'm not familiar with the plane and I'm not a pilot, but from reading the report it sounds like they were able to do the checks OK – but that took time.

It also sounds like the instrumentation displays on the plane very helpfully have modes and some kind of menu system. The references to stages of flight make it sound like these modes become available dynamically. So it seems quite probable that it isn't possible to actually navigate the screens in the air in the same way as on the ground.

Compare the 737 MAX8 cockpit [0] with the 737-800 cockpit [1] and the 737-300 cockpit [2]. Then consider that all of these planes are under the same type rating [3] – so a pilot trained on one of them is good for all of them.

There's also a lot of commercial pressure on pilots to not refuse to take off in a plane – which could lead to bizarre consequences like the airline questioning their competence for their current type rating.

[0] https://i.ytimg.com/vi/tCXPJkC7ZwI/maxresdefault.jpg

[1] https://drscdn.500px.org/photo/35641948/m%3D2048_k%3D1_a%3D1...

[2] https://magazin.lufthansa.com/content/uploads/2016/07/Boeing...

[3] https://en.wikipedia.org/wiki/Type_rating

I can conclude they are different enough just based on display layout. How could aerospace experts not?

If you want an RCA of the last two crashes in 737 MAX's, please see the parent. Ridiculous gyrations to avoid new aircraft regulations creates dangerous scenarios for pilots and passengers.

This is I think what is very very close to the truth. Some pilots are trained on the MAX, but later, untrained pilots are arbitrarily assigned to these planes. I am not sure that even emails help - with the amount of newsletters, and ad mails we receive, this email might be missed, or even when read, its importance might be missed.

As a passenger I would feel safer knowing that last information and instructions are not send a day before the flight but a pilot gets actual training?

Maybe that’s just me

In theory, regulators agree.

However, Boeing seems to have marketed this plane under the regulatory fiction that it was the same plane as the 737, and that therefore no retraining was needed.

Is this the right #? 1517486 points to something about a tug crew error.


No – it should have been 1555013. Must have had the wrong number in the clipboard.

I've got to say it's massively comforting to see that many pilots treat this stuff with such a level of professionalism and sense of duty.

Yet another way in which Boeing's marketing/regulatory insistence that the MAX was the same type as the 737 caused safety problems.

Thanks for the documents! I searched through item 1 for 'trim', and while I found some trim failure reports, and the complaint about Boeing's nondisclosure of MCAS in its documentation, I did not notice any concerns over disabling a runaway trim situation.

Not a pilot here (developer) but doesn't "nose down" imply trim? If so, one of those pilot reports in the Dallas News story does say that they experienced uncommanded nose down. Both pilots were aware of MCAS and discussed it before the flight. Another one who also knew of MCAS reported uncommanded leveling-off at the wrong altitude. Is that not trim, too?

"Nose down" does not imply a trim adjustment, as the primary control in pitch is performed by the elevator, while trim adjustment, on this airplane, is done by rotating the horizontal stabilizer. From the fact that the pitch changed, we cannot tell whether it was commanded by the autopilot or MCAS, but as MCAS is supposed to be disabled when the autopilot is engaged, and this occurred when the autopilot was engaged, it appears less likely that it was MCAS than it was the autopilot.

Furthermore, the signature feature of the MCAS failure that downed the Lion Air flight was runaway trim, and there is no indication in this report that the crew had to take any action to stop it by disabling MCAS (setting STAB TRIM CUTOUT to CUTOUT, the documented procedure for doing so), or to restore the correct trim manually (as far as I know, it would not revert to the correct setting simply because MCAS was disabled.)

Not sure what that means though.

As far as I am aware (totally a layperson), there have been potentially only 3 potential 737-MAX MCAS trim issue occurrences:

1. The Lion Air flight prior to the fatal lion air flight

2. The Lion air flight which crashed

3. The Ethiopian flight which crashed

Of course I don't think any of those 3 are absolutely confirmed, but I do think it seems likely the three had MCAS trim related issues. If the success rate for pilots dealing with this issue just 1 in 3, does that say anything regarding the MCAS issue difficulty/complexity or the skill/training of pilots?

From the article's title, one might get the impression that pilots have been saying that MCAS is dangerous. What I was trying to do was distinguish between possible MCAS incidents and safety concerns, complaints about Boeing's nondisclosure of MCAS, and pitch-down incidents that had other causes (incidents of the last case seem to be related to the autopilot, rather than MCAS.)

The latest crash certainly looks suspicious, but we don't really know yet, and the Lion Air crash occurred before the details about how MCAS could behave on sensor failure had been revealed. One would certainly hope that after this was revealed, all Max-8 pilots would be well prepared to recognize the situation and handle it, which might suggest that there is something more (or different) about this case (which could be worse news for Boeing).

> One would certainly hope that after this was revealed, all Max-8 pilots would be well prepared to recognize the situation and handle it

Far from certain, becaus Boeing is selling and the companies indeed treat it as "the same plane like old" even if it obviously isn't:


There certainly seems to be a regrettable attempt to diminish the differences between this model and its predecessors in that case. With regard to the MCAS specifically, once the cause of the Lion Air crash was determined, the FAA issued a new Airworthiness Directive [1], and I would be surprised if this information was not sent to all operators globally.

For obvious reasons, pilots tend to take a keen interest in matters of aviation safety, so I wonder if this was not simply a repeat of the Lion Air crash (which, as I said elsewhere, might be even worse news for Boeing.)

[1] https://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf...

From the database, #1597286, "agressive" uncommanded nose down.

Day 3 of 3 departing in a MAX 8 after a long overnight. I was well rested and had discussed the recent MAX 8 MCAS guidance with the Captain. On departure, we had strong crosswinds (gusts > 30 knots) directly off the right wing, however, no LLWS or Micro-burst activity was reported at the field. After verifying LNAV, selecting gear and flaps up, I set "UP" speed. The aircraft accelerated normally and the Captain engaged the "A" autopilot after reaching set speed. Within two to three seconds the aircraft pitched nose down bringing the VSI to approximately 1,200 to 1,500 FPM. I called "descending" just prior to the GPWS sounding "don't sink, don't sink." The Captain immediately disconnected the autopilot and pitched into a climb. The remainder of the flight was uneventful. We discussed the departure at length and I reviewed in my mind our automation setup and flight profile but can't think of any reason the aircraft would pitch nose down so aggressively.

This sounds very similar to the MCAS problems on the other flights, and these pilots were aware of MCAS (this is post Lion Air).

MCAS is not active with autopilot engaged, according to Boeing.

"should not", not "is not". That's why boeing promise a software fix ...

Is your statement true, and that is what they are fixing with the software update, or is that just your conjecture?

I have not read in detail yet about the proposed update to MCAS they are working on

Great links! Here are the three 737-related ASRS reports that mention MCAS:

ACN: 1597286

"Day 3 of 3 departing in a MAX 8 after a long overnight. I was well rested and had discussed the recent MAX 8 MCAS guidance with the Captain. On departure, we had strong crosswinds (gusts > 30 knots) directly off the right wing, however, no LLWS or Micro-burst activity was reported at the field. After verifying LNAV, selecting gear and flaps up, I set "UP" speed. The aircraft accelerated normally and the Captain engaged the "A" autopilot after reaching set speed. Within two to three seconds the aircraft pitched nose down bringing the VSI to approximately 1,200 to 1,500 FPM. I called "descending" just prior to the GPWS sounding "don't sink, don't sink." The Captain immediately disconnected the autopilot and pitched into a climb. The remainder of the flight was uneventful. We discussed the departure at length and I reviewed in my mind our automation setup and flight profile but can't think of any reason the aircraft would pitch nose down so aggressively."

ACN: 1597380

"It was day three of six for me and day three with very good FO (First Officer). Well rested, great rapport and above average Crew coordination. Knew we had a MAX. It was my leg, normal Ops Brief, plus I briefed our concerns with the MAX issues, bulletin, MCAS, stab trim cutout response etc. I mentioned I would engage autopilot sooner than usual (I generally hand fly to at least above 10,000 ft.) to remove the possible MCAS threat.

Weather was about 1000 OVC drizzle, temperature dropping and an occasional snow flake. I double checked with an additional personal walkaround just prior to push; a few drops of water on the aircraft but clean aircraft, no deice required. Strong crosswind and I asked Tug Driver to push a little more tail east so as not to have slow/hung start gusts 30+.

Wind and mechanical turbulence was noted. Careful engine warm times, normal flaps 5 takeoff in strong (appeared almost direct) crosswind. Departure was normal. Takeoff and climb in light to moderate turbulence. After flaps 1 to "up" and above clean "MASI up speed" with LNAV engaged I looked at and engaged A Autopilot. As I was returning to my PFD (Primary Flight Display) PM (Pilot Monitoring) called "DESCENDING" followed by almost an immediate: "DONT SINK DONT SINK!"

I immediately disconnected AP (Autopilot) (it WAS engaged as we got full horn etc.) and resumed climb. Now, I would generally assume it was my automation error, i.e., aircraft was trying to acquire a miss-commanded speed/no autothrottles, crossing restriction etc., but frankly neither of us could find an inappropriate setup error (not to say there wasn't one).

With the concerns with the MAX 8 nose down stuff, we both thought it appropriate to bring it to your attention. We discussed issue at length over the course of the return to ZZZ. Best guess from me is airspeed fluctuation due to mechanical shear/frontal passage that overwhelmed automation temporarily or something incorrectly setup in MCP (Mode Control Panel). PM's callout on "descending" was particularly quick and welcome as I was just coming back to my display after looking away. System and procedures coupled with CRM (Resource Management) trapped and mitigated issue."

ACN: 1593017

"The recently released 737 MAX8 Emergency Airworthiness Directive directs pilots how to deal with a known issue, but it does nothing to address the systems issues with the AOA system.

MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aisle stand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

This description is not currently in the 737 Flight Manual Part 2, nor the Boeing FCOM, though it will be added to them soon. This communication highlights that an entire system is not described in our Flight Manual. This system is now the subject of an AD.

I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models. The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone--even if the pilots aren't sure what those systems are, what redundancies are in place, and failure modes.

I am left to wonder: what else don't I know? The Flight Manual is inadequate and almost criminally insufficient. All airlines that operate the MAX must insist that Boeing incorporate ALL systems in their manuals."

What I'm gathering from these reports is not encouraging:

(1) The third report says that MCAS only operates in manual flight. The second report appears to confirm that since the pilot says he engaged autopilot sooner than usual to remove the possible MCAS threat.

(2) However, both the first and second reports describe uncommanded pitch down events while in autopilot. That means there is another problem in addition to the MCAS issue, since the latter should not be engaged at all when in autopilot. (If the root problem is an unreliable angle of attack sensor, that would explain both issues, since the AoA sensor would be used by the autopilot as well as by the MCAS.)

(3) We have an aircraft type that is known to have repeated uncommanded pitch down events while in autopilot, and it's still flying. Unfortunately, we already have other aircraft types (from Airbus, not Boeing) that have the same known issue that have not been grounded either. So the system as a whole simply seems to accept the risk of this happening without warning, and hoping that pilots will be able to respond as these pilots did (well done to them) and avoid an actual incident.

Which Airbus model is affected?

Probably referring to A330: https://en.wikipedia.org/wiki/Qantas_Flight_72 They never quite figured out the root cause of the un-commanded dives

> Probably referring to A330

A330 has figured in the incidents, but AFAIK the flight control software and angle of attack sensors that are implicated in those incidents are the same in all of the Airbus models.

> They never quite figured out the root cause of the un-commanded dives

Yes, they did. Read the "Conclusion" under the "Final Report" section. The "design limitation" they're referring to is that, first, the autopilot is not driven by an average or majority vote of the three angle of attack sensors, but by one of them only (which one depends on whether the captain or first officer's position engaged the autopilot), and second, the other two angle of attack sensor inputs are not used to check the sensor that is driving the autopilot, so if that sensor gives faulty input (the "multiple spikes" described), the faulty input is allowed to trigger uncommanded events such as the violent pitch down that happened on Quantas Flight 72.

What should happen is that the input from all three angle of attack sensors should be combined: as long as all three of them are within some tolerance, the average of the three becomes the angle of attack used to drive the autopilot. If one goes out of tolerance compared to the other two, its input is discarded until it comes back into tolerance (so "multiple spikes" from one sensor would simply be ignored). If it takes too long for the one sensor to come back into tolerance compared to the other two, that sensor gets ignored for the remainder of the flight and the pilots get notified. If it gets to a point where no two of the sensors are within tolerance of each other, the autopilot gets disengaged and a big red light goes on in the cockpit. I am unable to understand why that is not how the system is designed, but the investigation reports make clear that it isn't.

In both the first two cases, the pilots knew about potential MCAS issues and discussed them with each other before take-off -- and they still had (terrifying) problems.

In those cases (if they are not two reports of the same incident), while MCAS was discussed prior to the flight, the actual incident appears to be autopilot related, and there is no mention of the trim running away and having to be disabled. In fact, the Captain's report mentions that he chose to engage the autopilot earlier than usual, "to remove the possible MCAS threat."

I'm a developer and not a pilot but I think that's pretty relevant. In both of those (two separate) cases, the pilots were aware of MCAS (it's not supposed to run when autopilot is on, right?) and tried to avoid any interference from it, yet they experienced interference anyway. One of those examples was nose down which sounds like MCAS and the other was unexpected leveling off at the wrong altitude.

There is no evidence, in these reports, that 'interference' from MCAS had anything to do with it. The fact that the problem occurred when the autopilot was engaged (and MCAS, therefore, supposedly disabled) and was resolved by disengaging the autopilot, suggests a problem with the autopilot, not MCAS. The captain's report speculates about possible causes, but MCAS failure is not on the list, even though, as we know, the captain was aware of MCAS and its failure modes.

From the reports:


B737MAX Captain reported an autopilot anomaly in which led to an undesired brief nose down situation.


B737 MAX First Officer reported that the aircraft pitched nose down after engaging autopilot on departure. Autopilot was disconnected and flight continued to destination.

These all sound extremely serious and damning, but it's hard to know whether these match the typical tone and content of these kind of reports. Is this is well inside the standard for adjusting to a new aircraft or does this suggest a serious hazard left unaddressed?

Judging the other reports that people are posting for more mundane issues, this seems to be of an unusually serious tone.

> I would generally assume it was my automation error, i.e., aircraft was trying to acquire a miss-commanded speed/no autothrottles, crossing restriction etc., but frankly neither of us could find an inappropriate setup error (not to say there wasn't one).

Regardless of the usual tone, I find this particular paragraph a fairly terrifying indictment of cockpit human factors across the board. Apparently it's not unusual for aircraft behave unusually with the pilots not understanding why - and the poor pilots "generally" blame themselves!

If you ever have some time, you should try playing microsoft flight simulator and you will come to an understanding of this phenomenon.

Aircraft have many states, and there is a lot of information to process to fly an aircraft, even in normal flight. When situations develop in real time, it takes a lot of mental horsepower to understand the situation and react appropriately. Despite all this, aviation is safer than driving a car.

It is one of the reasons I find aviation to be inspiring. Conscientious humans have mastered this unforgiving domain through effort and power of will. When you talk to a real pilot, there are certain mannerisms that they share that tend to show that the practice of flying really makes you a thoughtful person.

You probably dont want to listen to Captain Warren VanderBurgh on YouTube, then. Iirc, his idea of the most common phrase in the cockpit is, "What's it doing now?"

I wish our bugzilla reports were that good

Wow good finds! None of those ACN sound good for Boeing's stance.

"The fact that this airplane requires such jury rigging to fly is a red flag"

The first and second report look to be the FO's and Captain's for the same incident. And don't make sense as I though MCAS is during manual flight. Why would Auto Pilot need MCAS, it's like Auto Pilot using Auto Pilot?

In ACN 1597380 - why would MCAS kick in if he wasn't manually flying (pilot states autopilot was engaged specifically to avoid MCAS)?

I'm wondering if the autopilot contains the same correction algorithm that MCAS is using.

I'm wildly speculating here, but since wing loading is also a factor in calculating the angle of attack at which a potential stall condition could occur, I'm also wondering if it relies on the accuracy of the weight and balance the pilots enter into the flight computer. Pilots have missentered such critical information before.

Is it possible auto pilot altitude target was set to zero by mistake?

Not at all.

Thank you

What if there is no target altitude in the SID.

I'm only an "interested layperson" in the subject so I don't know details.

But I know that for instance there are plenty of alarms warning the pilots about the proximity to terrain.

Besides, there were excellent visibility conditions at the time of the accident so, even if the autopilot were able to drive the plane into ground, the pilots would have realized that not only by seeing the other instruments but looking through the window as well.

The available radar data also shows there's been a struggle to keep the airplane flying. An autopilot-controlled flight into terrain wouldn't show such pattern.

A key question is whether the plane's advanced flight management system -- the autopilot -- might have played a role in the most recent crash as it did in the fatal crash of an Indonesian Airlines 737 MAX 8 last October. In that crash, it appears the pilots failed to disengage the autopilot when the plane's nose began pitching up and down,

No.. this is not about the autopilot. The suspicion (which is only a suspicion so far) is about another system called MCAS. Roughly speaking (specially because I have not enough knowledge to speak on this regard with confidence), this is meant to help pilots prevent a stall.

The MAX family has more powerful engines, and they are a bit projected ahead under the wings. This makes the plane susceptible to point its nose up during full throttle, which could lead to a stall.

This system shouldn't be confused with the regular autopilot. It plays a completely different role and, the way it's designed, it should engage only under very specific conditions.

Holy shit this almost explain all there is.

For a car analogy, imagine Tesla creates a new model that under certain conditions tends to over-steer left. To prevent any accidents because of that, they have added a system that turns the steering wheel clockwise. To disable the system it is not enough to try to prevent by force the steering wheel from turning, but you have to press a button that disables electric steering assistance.

Notice they have never briefed you about this new system because they didn't want to retrain you.

You happily drive along the highway at 70mph when the system malfunctions and incorrectly thinks the car is over-steering left, so the steering wheel starts rotating clockwise. The car swiftly moves to the lane in your right as you use all your strength to prevent it and manage to bring the car back in the lane.

In the mean time all kind of lights and sounds go off on your cockpit. In 5 seconds, while you are trying to find out what to make out of all the lights flashing, the steering wheel starts turning the card right again. This time you are not so lucky and you crash into the truck on your right.

I feel like every time someone insists on making a car analogy, it just piles on more evidence that car analogies never work.

At least you don't have to get a new endorsement on your license for every model of car.

Analogy implies partial similarity. Of course there will be differences.

> At least you don't have to get a new endorsement on your license for every model of car.

In Germany, if you get your drivers license on an automatic car, then you are only allowed to drive automatic cars, and have to extend your license to drive manual cars.

Analogy implies that people could die. They have died.

Incorrect analogy. Runaway trim is a common and known problem with a solution to pull the electric trim breaker. MCAS failure is very similar in appearance and have exactly the same solution.

MCAS failure is very similar in appearance and have exactly the same solution.

MCAS doesn't behave like a runaway stabilizer. MCAS adjusts the trim periodically and will back off if you apply opposite trim.

The steps to deal with runaway trim are[1]:

1 Control column . . . . . . . . . . . . . . . . . Hold firmly

2 Autopilot (if engaged) . . . . . . . . . . . . . Disengage

Do not re-engage the autopilot

Control airplane pitch attitude manually with control column and main electric trim as needed.

3 If the runaway stops:

  ■   ■   ■   ■ 

So someone trying to make sense of MCAS would logically stop at step 3 and not actually disable MCAS.

1: http://www.737ng.co.uk/737-800%20Quick%20Reference%20Handboo...

Why did you leave off steps 4 and 5?

4. If the runaway continues: STAB TRIM CUTOUT switches (both) . . . . . . . . . CUTOUT

If the runaway continues: Stabilizer trim wheel . . . . . . . . . . Grasp and hold

I don't see why someone would stop at step 3, given that the MCAS pause cycle is only 5 seconds long.

Why did you leave off steps 4 and 5?

Because that's where many pilots would stop. The "runaway" stops when the pilot inputs opposite trim.

Can you think of a better car analogy? I'm genuinely curious.

All cars that drive only the front wheels experience a phenomenon called torque steer: as the engine produces more power the car tends to veer off into one direction or another. This is typically only a problem with more powerful engines.

Many manufacturers will use different length driveshafts to each front wheel, maybe they'll use fancy mounting hardware, maybe they'll reduce the maximum power at low speeds, maybe they'll apply the brake on one wheel as you start to move in a direction other than where the steering wheel is pointed.

Let's say a car company put out a little front wheel drive car so powerful that simply applying the brakes or cutting power would make the car much less fun to drive. So let's say our miracle company decided to have the computer steer the car in the opposite direction when you press the accelerator pedal instead.

Then one day the dongle that determines how far you're pushing the accelerator pedal breaks. The wiper on one of the potentiometers is dirty and instead of sending no signal it's sending an erratic and inaccurate signal. It's not a problem for the engine computer, there are two pots and it's picked the good signal and limited engine power just in case. For some reason cruise control doesn't seem to work, but other than that the car seems to drive fine.

But the torque steer doohickey is using the bad signal. The bad signal is erratic and makes the computer think you're trying to accelerate rapidly and yanks the wheel to the left for no apparent reason. You yank the wheel in the other direction and the car drives fine for a bit so you continue. As you accelerate onto the freeway onramp it happens again. You yank the wheel the other way and keep going. Then you try to change lanes to pass a slow truck in front of you. It happens again, only this time as you're trying to turn left you can't counteract the insanity. Instead your car tries to make a ninety degree turn at freeway speeds.

You know that you need to break when you get close to another veichle in front. Now you have a new shiny cruise control (without latest distance keeping feature). Well, you still need to break when you get close to a veichle in front of you.


An unfortunate typo.

That analogy doesn't really hold. My understanding is that these angle correction issues are due to the oversized engines for the 737 fuselage. The correction system is there as a solution to that which doesn't involve scrapping the line and staying with larger plane sizes .

This is off topic. But I've been skeptical of the commercial aviation accident risk compared to cars.

I'm not saying cars are safer. But using accident count per mileage seems a bit odd, especially when the most risky parts of flying are taking off and landing.

A plane travelling 400 more miles doesn't incur much more risk. But a car travelling 400 more miles incur a much bigger risk (e.g. fatigue, car malfunctioning). So, of course, the stats for planes is going to look much better.

I wonder if anyone has an insight into why we are using this metrics, and what is a better metrics?

The relevance of the metric depends on what you're using it for. If you decide whether to drive or fly to a destination based on how safe it is, risk/distance is a perfectly reasonable metric. Since flying is a means of transportation, it seems reasonable to judge the risk relative to the amount of transportation you get out of it.

That doesn't discount the fact that most of the risk is in take-off/landing, so if you use fleet-average statistics you'll bias the risk of short flights low and long flight high. Air safety studies do also use additional metrics like accidents/hour and accidents/segment, but those are mostly useful for comparing between different types of aviation.

I'm not sure how your comment addresses the core problem that risk/distance is not a reasonable metric if long-distance driving is less risky than short-distance driving, and you apply the short-distance driving risk to long-distance driving.

As a passenger on either it doesn't matter where the risk is concentrated . I am only interested in the outcome of how safe my journey is going to be.

As a technology such differentiated metrics helps to understand aspects of flying which is why broken metrics are used by the industry in more focused forums.

But that's exactly my point. As a passenger, it matters if the calculation of how safe your journey is is wrong. And the calculation is wrong if it doesn't take into account how long the drive is.

Wikipedia has a pretty handy table of metrics here: https://en.wikipedia.org/wiki/Aviation_safety#Transport_comp...

Ignoring the silly ones (Space Shuttle, Skidiving and Paragliding), we see that Motorcycles are by far the most dangerous mode of transport, across all metrics. Buses do very well, only losing out to Aircraft on distance.

When you look at Aircraft by number of journeys, the risk is significantly higher - nearly 3 times higher than car journeys!

That said, there are othe factors to consider here: these metrics only track _deaths_. So non-fatal incidents (of which the majority involving cars are) aren't considered.

Thanks for sharing it.

It seems, if the risk is based on the distance, then air is 60x safer. But, for per journeys, air travel is worse. For per hours, the air travel is only 3x safer.

The popularized concept of air travel's risk gave me the impression that air travel was sooo much safer than car. smh. If you asked me a month ago, I would say air travel should be, at least, 1000x safer than car.

Read the paragraphs below the table.

I read it, but I don't know what you are trying to convey. Please elaborate. Thank you.

The same sort of problem occurs on the other end when you try to compare the risk of driving vs walking. Cars are 5 times faster in the city and 20 times faster on the highway than walking. The trips are almost always shorter on foot, you drive to the far away big box store but would walk to the neighbourhood store. Better metrics than risk per unit of distance would be risk per unit of time spent or risk per trip.

I would point out that in a similar way few people drive between continents but flight is common.

It's a useful metric because, when comparing auto and plane safety, consumers are usually deciding between taking a plane and a car for the same distance. We could give them risk as a function of distance by taking the increased takeoff/landing risk into account, but generally people only compare the two for fairly long trips.

For the context of driving long distance, that makes sense.

Do the car incident statistics only take into account long distance trips?

For cars they count all passenger-miles equally. Car accidents are much more strongly correlated with distance than aircraft accidents, but I don't know the actual risk factors - these are all heuristics for much more detailed models that I'm sure some academic is building.

What is eye-opening here is that: Aviation industry insurers base their calculations on the deaths per journey statistic while the aviation industry itself generally uses the deaths per kilometre statistic in press releases

from https://en.wikipedia.org/wiki/Aviation_safety#Transport_comp...

So, insurers don't wanna use this death per distance.

Perhaps a better metric would be accidents per unit of time.

Or accidents per departure and arrival. Since take-off and landing are the two most dangerous times, gauging accidents based on how many times one leaves and arrives could provide a more direct way of measuring how dangerous any one departure/arrival actually is?

I'd say it's accidents per person/hour. And I've read somewhere that the figures used to be similar for cars and airplanes (though aircraft safety is constantly improving, cars probably less).

Cars have been improving safety significantly over time as well. However, the fatality rates seem to be significantly better for airlines.


For the sake of argument, assume cars travel an average of only 10 mph, and air carriers carry just 50 passengers (low estimates tilt the comparison in favor of cars). That would mean cars had 1.1 fatality for every 10 million hours in 2015. The corresponding figure has been between 0.0 and 0.6 for the last decade, and airlines come out way ahead even after amortizing the 5.8 from 2001 over the following years. And this is with very conservative assumptions.

On the other hand if you add in non-occupant deaths, the numbers might work out better for cars, even after using less conservative assumptions, once you amortize the non-occupant deaths from 9/11.

Accidents? Or fatalities? Cars today are certainly safer than cars 50 years ago.

Per passenger might be off because a passenger doesn't affect the risk. The number of flights vs. the number of trips might be more fair.

We use it because there is really no good metric to compare the two.

Maybe just # of accidents in vehicle/# of trips taken in vehicle ?

Not to mention you have a fairly good chance of surviving a car accident whereas a plane falling out of the sky is almost ways bad news for passengers.

I have always thought the only relevant statistics is accidents per travel. But good luck getting this data.

Seems to be here: https://en.wikipedia.org/wiki/Aviation_safety#Transport_comp...

And traveling by air seems to be 3x more deadly than by car, if measuring by journey.

There are at least three inter-related issues here: 1) Was MCAS an issue in the Ethiopian Airlines crash? 2) Did Boeing err, prior to the Lion Air crash, in not informing pilots of the existence of MCAS, and the way it changes how a failure is experienced by the flight crew? 3) Does MCAS pose a risk that cannot be adequately addressed through appropriate awareness and training?

IIRC, after the existence of MCAS was disclosed, the US pilots' unions were divided over this issue, with the union representing Southwest pilots castigating Boeing for its nondisclosure, while that representing United pilots did not consider it to be a big issue. Unfortunately, this article does not make it clear where pilots stand on issue 3, and the investigation of the Ethiopian Airlines crash might reveal additional issues.

The forthcoming software upgrade for MCAS certainly implies that there were improvements to be made.

Another issue is that the engines on the Max version are larger than the NG version and didn’t fit under the wing. So they had to raise the mounting point forward and up as well as extend the nose gear 18 inches. These changes caused the plane to have a different flight profile to the NG version. However it would have been disasterous if pilots already certified for the 737 couldn’t fly the 737 max. So boeing implemented the MCAS so make the max handle like the NG. That move is drawing a lot of skepticism because if the computer screws up then the pilots were never really trained to fly the Max


I'm ignorant of aviation, oversimplifying, but my summary: they fixed issues with the hardware in software.

A little scary?

The alternative would have been redesigning the 737 such that it would be a different plane. There are advantages to keeping it as similar as possible to the previous generation. Boeing was in a bit of a bind. They had a plane (the 737) originally designed for different requirements (the plane is low to the ground) in wide spread use that the airlines wanted them to make more fuel efficient to stay competitive with Airbus’s latest models. If they introduced a new plane that would require the airlines to retrain all their 737 pilots among other things. So Boeing found a way to put new engines on while keeping the plane similar enough as not to make it a new type.

From what I understand, MCAS is a reasonable solution. Where it gets questionable is in not informing the pilots of this new system (but again, there were reasons for that, maybe as it turns out not good reasons), allowing the new system to override the yoke input (Boeing reasoned there was already a procedure for runaway trim pilots would follow), and keying the new system off a single AoA sensor and only having two AoA sensors total so it’s not clear what to do when they disagree.

I'm not clear on why having different engines, different handling and MCAS makes it not-a-new-plane, but having the landing gear extend further down would make it a new plane?

I don't think it is a binary 'either its a new plane or its not' situation. I think every change has to be scrutinized for its safety implications, and for MCAS the analysis seems to have been, in part, that a failure could cause a trim runaway, but trim runaway is a circumstance for which there already exists a response, and that would not need changing (what this overlooked was that the pilots would experience it differently, as pulling back will not stop it, and if they stopped it with the trim button but didn't disable it, it would start up again ten seconds later.)

Putting a longer undercarriage on an airplane is not a trivial matter. You have to design it, test it, get it certified (a new undercarriage raises obvious safety issues) and put it into production. It's not just the undercarriage - it won't fit into the existing wheel wells, and furthermore, the legs might have to be moved further out on the wing, and then you have to rework that, as well.

> A little scary?

Perhaps, but it’s not unprecedented. The B2 stealth bomber, for example, famously lacks a vertical stabilizer (tail fin) and so is inherently unstable and relies on computerized control surfaces to maintain stable flight [1].

This seems to have worked fine, although the things definitely log way fewer flight hours than an airliner. I believe several other aircraft do this as well (fighter jets and such).

Still, the idea of it would give me the willies if I were in charge of flying one.

[1]: https://en.m.wikipedia.org/wiki/Northrop_Grumman_B-2_Spirit#...

Fighters, in particular, are designed to be unstable to increase their control authority. That is, as an intended design feature they are easy to turn intentionally, which means they are also prone to turn unintentionally.

I've also been reminded of that. But performance / safety tradeoffs are totally different for military vs civilian aircraft. Military pilots have agreed to far greater risks than civilian pilots. And far^N greater risks than civilian passengers.

i don't know anything about aircraft, but i would be inclined to think that the lack of tail fin on a B2 isn't just a design flaw or technical debt from the previous model and that there were other reasons for it.

You’re right— the B2 was designed like it was in order to minimize radar cross-section at all costs.

One could see, though, how a Boeing engineer could point to the B2 and fighters that rely on software for safe flight and say “See? They do it and it’s fine!” as a justification. Not that I’m saying that makes it right.

i've read that B2's simply cannot be flown manually.


edit: oops someone already said this 30min ago

From a software development standpoint, it sounds like it. And that is scary (and unfeasible).

> The forthcoming software upgrade for MCAS certainly implies that there were improvements to be made.

Not according to Boeing... "Boeing has been developing a flight control software enhancement for the 737 MAX, designed to make an already safe aircraft even safer."[1]

To me an incredibly infuriating statement. The 737-MAX has a fatal crash rate of ~4 per million, when compared to .1 per million for the 737-NG models (40x). There is no currently flying major commercial aircraft which has a higher fatal crash rate than the 737-MAX [2] [3] Of course the MAX has a small sample size, but that's still not evidence of safety.

What data is Boeing looking at to show that their aircraft is considered a safe aircraft?

[1] https://boeing.mediaroom.com/news-releases-statements?item=1...

[2] https://finance.yahoo.com/news/boeing-737-crashes-liability-...

[3] http://www.airsafe.com/events/models/rate_mod.htm

It really does not matter what spin Boeing comes up with regarding the cause of these crashes.

The reality is in a very short space of time two 737-MAX have fallen out of the sky.

You only have to look back at the McDonnell Douglas DC-10 to understand once a plane gets a bad reputation, it is doomed.

For an example of how this can go bad so very quickly, here in Australia this issue has become so new worthy, it's now been revealed one our major carriers is planning to introduce the 737-MAX in November.

I suspect just that little fact is going to become a major headache for that particular carrier.

The DC-10's infamous cargo door was a grievously poor design choice, violating well-understood safety principles for the sake of a little more cargo space. It's everything you fear about psychopath executives rolling the dice on safety because what do they care?

The DC-10 deserved its ignominious reputation and the McDonnell-Douglas deserved every bit of the scorn they received and more.

It might turn out that the MAX situation is a similar roll of the dice.

That would also be my take on this situation.

The fact remains two brand new, state of the art aircraft have some how managed to fall out of the sky and the best the builder of the plane can offer is the plane is safest plane ever.

I don't see how that spin will not stick and I too suspect the public perception will grown to a point were this plane is also branded a lemon.

> 3) Does MCAS pose a risk that cannot be adequately addressed through appropriate awareness and training?

If it fails this frequently, yes. Obviously pilots need to be informed about the failure modes of the planes they fly - but they also need to not be constantly subjected to them. Modern commercial aircraft are supposed to be waaay more reliable than this.

How frequently it fails seems to depend on the answer to question 1 - unless you are aware of other incidents beyond the Lion Air crash?

I don't know the answer to 1 or 2, but regarding 3, if the issue in the reports via this article are the same issue, which it seems like they may be, then no I don't believe it poses a risk that can't be addressed through training. Through awareness these pilots and FOs filing reports seemed to know, at least through intuition if not outright knowledge of the new MCAS system, to disconnect the autopilot system when the nose goes down inappropriately.

My question is, should the onus be on the pilots? Yes, they should know about it if they're going to be piloting an aircraft with it, but is this expected behavior? To me it seems more like a bug than expected behavior...why would you want to pitch downwards in a climb?

I don't really understand defense of Boeing in any scenario. This seems like a mistake in any case, whether it's just lack of instruction or documentation in the relevant flight manuals, or an outright system failure.

>why would you want to pitch downwards in a climb?

Because due to the different shape and position of the nacelles, there are aerodynamic effects that cause the plane to want to pitch up at high AoA. If you are already close to a stall condition, and you were caught unawares, bad times would be had.

The major issue though is pilots were left to 'just figure this out' instead of being informed of the change. I have a feeling Boeing felt justified doing this because they pitched it as a "reconfiguration" of an old airframe, not warranting any explanation.

As with any task I've attempted that involves deadly failure modes, this should have struck someone as being a terrible idea.

From what I have read, the NG series had the habit of pitching up under go-around conditions and this system exists because Boeing expected that issue to be more prevalent on the Max and also to try and solve it.

So its not a new thing on the Max, its just expected to be more prominent.

>why would you want to pitch downwards in a climb

To avoid stalling?

The thing that worries me most is that, based on mere amateur observations in the media, the number of incidents involving user interfaces, repeated changes to procedures, and software fixes to "unexpected" corner-cases seems to have been in the increase.

To the uninitiated, it seems that problems in airline incidents used to revolve around mechanical failures, bad wiring, sensor malfunctions, toasted electronics causing smell of smoke and such. Plain and simple. Issue a fix in the design and apply to all planes of the same type, and you'll end up reducing the failure surface bit by bit.

I might be totally wrong about this because I don't track actual data. But if I've spotted the trend right it's scary because the problems are shifting into our space, i.e. software engineering. And being a software engineer, I know we're pretty much fucked at that point. We've only ever managed to write reliable and trustworthy software when we've split it into very tiny pieces that we can verify and kept the number of pieces small.

Maybe aviation computers used to be much simpler that they could be verified more throughoutly. Maybe airplanes used to have less features and they could keep the complexity sufficiently down and functionality orthogonal. Maybe there was enough human glue in between the systems so that there was a live sanity-check during flights and pilots could react properly if the computers didn't agree on something.

But now I sense a new category of error conditions that are eerily similar to what we've had in non-critical software for decades where assumptions are laid on top of other assumptions, and when they fail the whole stack comes crashing down. Only this time there might be a whole plane coming down instead of getting a curious SIGSEGV on the screen with a blinking cursor. It might start as an innocent "couldn't access flight plan because of wifi went down" but such interdependencies between certified and uncertified systems grow exponentially and this will snowball into the unmanageable very soon.

I think you are on the right track about one of the underlying problems. From another comment on a different thread.

> My company's error rates have increased on the "common fleet" by almost triple. [1]

The aircraft manufacturers and carriers want to get the most change with the least impact: updated jets with better gas mileage that don’t require pilots to retrain. It seems the FAA and other regulators have become too lenient in letting the manufacturers put significant changes into aircraft without requiring them to have different type ratings or at least add new training requirements.[2] Not communicating the MCAS changes seems to indicate a broken process at Boeing too.[3]

But you are also observing the Swiss cheese model of safety.[4] As the easier individual issues are fixed (mechanical) more difficult compound issues cause the accident, where multiple things (pilot training, bad communication, new system) all need to line up.

[1] https://news.ycombinator.com/item?id=19376565

[2] https://en.wikipedia.org/wiki/Type_rating

[3] https://news.ycombinator.com/item?id=19377220

[4] https://en.wikipedia.org/wiki/Swiss_cheese_model

If you split a complex systems into a tiny pieces, you imo just shift a locus of problems from individual modules into their more and more complex network of interactions and emergent behaviors.

Hence you keep the number of pieces small to avoid the exponential interactions. You only ever implement what is really needed instead of letting feature creep and excess convenience work their way into your plane. It's not like N times more of that sweet complexity is required to fly a plane today than what was needed in the 80's or 90's.

> The News found at least five complaints about the Boeing model in a federal database where pilots can voluntarily report about aviation incidents without fear of repercussions.

Is this a lot?

They mostly seem to agree with each other which is the scary part. Several of them reference a completely unexplained pitch up/down behavior during a climb. During landing an unplanned nosedive would be disastrous.

MCAS can only activate when flaps are raised, it shouldn't cause any unexpected trim changes during landing. This is why the Lion Air flight had a normal takeoff/climb until they raised the flaps.

Aren't the flaps up during landing?

Flaps are deployed to lower the stall speed of the aircraft by increasing the lift coefficient of the wing at the expense of higher drag.

I think you're confusing flaps with air brakes. Flaps are wing extensions that deploy downwards to increase lift and drag, air brakes are panels that deploy upwards to produce lots and lots of drag to slow the plane down after landing, like a parachute.

Ah, that makes sense, thanks.

Flaps are down during landing and take offs (to different extents).

There have been 865 total 737 reports in the ASRS database since 1/1/2018 (linked the results of my search in another comment in this thread). There doesn't appear to be a 737-MAX filter (groups all 737-800s and 737-900s together it seems), so it's tough to say.

In addition, it seems like some pilots were motivated to submit reports on their MAX experiences due to the Lion Air incident.

We’d need the number of reports for other plane models to know if that’s a lot or a little or the norm. Can you compare?

Exactly my reaction.

I'm appalled at Boeing's response, and I agree with the Europeans, other countries, and Senator Cruz and others that the planes should probably be grounded, at least very briefly.

But the news reporting that an unknown-relative-to-other-planes percentage of complaints were filed by pilots, especially when those reports could theoretically be merely annoyed pilots responding to a perceived lack of training, or piling on after Lion Air, doesn't tell me a whole lot I didn't already know.

Yes. Recalls with autos happen more often with a lot less. Consider the amount of cars out there. It only takes a few to put one in play.

ASRS doesn't deal with reports about auto-safety.

eg. search for ACN 1337942 here https://asrs.arc.nasa.gov/search/dbol.html (i'm too dumb to figure out how to link to a specific nasa report), and there's a report about the captain's side AOA vane being busted and causing the captain's stick shaker to vibrate constantly.

edit: here's another one: 1097906, talking about inconsistent airspeed readings between the captain and first officer and then on descent, the airspeed readings went super wonky and the plane pitched nose down.

If the US would treat car safety like airplane safety there would be no SUVs driving out there.

Airplane safety should be more strict than car safety, because the damage an airplane crash causes is a handful of orders of magnitude higher than a car accident...

Yet deaths in the latter vastly outpace adverse events in the former. What is the criteria by which public safety should operate? Is it biggest explosion?

Opportunity cost of safety improvements to vehicles. Airliners cost like $100 million each, so they can afford to perfect safety. You can’t get airliner-level safety in a vehicle that costs less than $50,000.

Maybe not airliner level of safety, but based on the top causes of car accidents, they could probably be reduced by an order of magnitude with relatively inexpensive improvements:

  1. better driver training
  2. breathalyzer ignition interlocks
  3. speed limiters (even more reduced speed at night/rain)
  4. traffic light detection/automatic braking
  5. enforced following distance
(I'd add "sleep/impaired driver warnings", automatic emergency braking (including pedestrian detection) even though it doesn't quite relate to the top causes of accidents))

Here's the top ten:

  1. Distracted Driving
  2. Drunk Driving 
  3. Speeding
  4. Reckless Driving
  5. Rain
  6. Running Red Lights
  7. Night Driving
  8. Design Defects/Maintenace
  9. Tailgating
 10. Wrong-Way Driving/ Improper Turns

Far more cars (than planes), far more drivers (than pilots), far less rules for permission (than a driver's license). Kind of an unfair comparison here.

Please make a conscious choice when flying 737 Max on US domestic flights. It is your right to know the type of aircraft when you are booking your flight. Switching to a reasonably expensive alternative is worth more than any foreseeable trouble.

> It is your right to know the type of aircraft when you are booking your flight.

This is not actually any kind of right in the US. The airline can switch to using a MAX just before the flight boards without breaking any law or contract with you, and would not have to honor your request to travel on a non-MAX aircraft instead.

At this point I wouldn't be booking on a Max for a while just in case they ground them all, if nothing else.

This article is less compelling than the title would suggest.

After the Lion Air crash the FAA released a Emergency Airworthiness Directive, these five comments are in response to that directive. That differentiates it from pilots that had a negative run-in with MCAS or other defects in the 737 Max 8 (which would be significant news).

This article might inform you pilots are unhappy, but that fact has been widely circulated elsewhere since the Lion Air crash. The fact that five pilots submitted official comments doesn't add to what we knew.

These comments for example wouldn't have helped inform the FAA's decisions, since the FAA told the pilots about the issues in the Emergency Airworthiness Directive that these comments are based upon.

The Dallas News report shows two separate complaints where the pilots knew of and discussed MCAS on the flight deck before take off and still had serious problems with it.

They had serious problems with the autopilot, which also disables MCAS.

I assumed they were talking about nasa reports. You can find a few if you search for 737-800 and AOA on the asrs site.

The comments seem to be recounting personal experiences of those pilots though, not their reactions to the initial disclosure.

Many of them are recounting how they didn't receive enough training and only found out after the initial disclosure. Nobody said they weren't personal experiences, just that those experiences are about the FAA directive/training rather than with the aircraft itself/MCAS.

In the wake of the previous Boeing 737 Max crash:

"Boeing Co. withheld information about potential hazards associated with a new flight-control feature suspected of playing a role in last month's fatal Lion Air jet crash, according to safety experts involved in the investigation, as well as midlevel FAA officials and airline pilots."

"Safety experts involved in and tracking the investigation said that at U.S. carriers, neither airline managers nor pilots had been told such a system had been added to the latest 737 variant — and therefore aviators typically weren't prepared to cope with the possible risks."


If I am reading the article correctly, the complaints all came after JT610? It would have been more damning if they had been complaining about this for the last couple years.

That's impossible, 737 MAX hasn't been in service for 2 years yet.

I meant in round numbers ;). It's been pretty close to two full years now, so I wrote "a couple years" instead of 22 months.

You can see the archive.is copy of it without jumping through hoops: http://archive.is/GsHVR

man fuck canada and the usa. how are we the only ones in the world to not care about safety. even if its a 0.5% chance 150+ people die, isn't that enough to warrant temporarily grounding a handful of planes. sigh common

This is a great video that does a concise and understandable of the main theory for the issue that occured on the LionAir flight: https://www.youtube.com/watch?v=zfQW0upkVus

It was very helpful for me to understand exactly what "runaway trim" meant. Essentially, it's a force (down or up) on the elevator on the horizontal stabilizer. The pilot still controls it from his yoke, but the more trim applied the more it pushes the result in a given direction. If the system applies trim consistently to push the nose down (to avoid what it thinks is an imminent staff), it will progressively more difficult for the pilot to counteract that and pitch up. Eventually, it's too much to handle.

This situation should be easily detectable, from what I understand, due to large wheels moving visibly in the center console, and the pilots can counteract the trim in a known procedure.

I think it would've been cool to have a database for anonymous complaints at most of my previous jobs.

I assume you’ve heard of GlassDoor but don’t consider it sufficiently anonymous?

that's a very interesting idea! let's build it :D

reminds me of ratemyprofessor

Can anyone at this point provide a legitimate argument for not grounding this model?

A best it's reactionary as we simply don't have enough data. The FAA said it will review once the crash investigation has been completed.

Sometimes clustering occurs, such as Maylasian airlines being shot down and lost in an ocean and never found. We didn't ground the whole airline.

It sounds like you're going for a "innocent until proven guilty" approach to the Max's airworthiness, if I'm understanding your comment correctly. That seems opposite to the culture of air safety, where planes are certified airworthy because the data prove them to be so.

I don't think the data prove airworthiness of the Max anymore.

However no data that originally certified it as airworthy has changed. All we have is two incidents, one of which we have no information about. For all we know it was a hijacking, or a drunk pilot.

Absurd ideas, however in my mind without any evidence it is equally likely. They have the CVR and I'm sure very shortly we'll know for sure.

If it turns out to be MCAS then we can ground the fleet, the extra day of delay doesn't seem like the highest risk factor.

That's not really true. MCAS can not be argued to meet https://www.risingup.com/fars/info/part25-672-FAR.shtml, so it's not airworthy. The FAA's allowed them to continue flying anyway while they disclose the problem and workarounds, and deploy a fix which is now very delayed. That's a much more questionable decision now that another flight with similar characteristics has crashed.

That's my take, accidents at the edges of the safe flight envelope are concerning but don't imply the aircraft is unsafe in general. Two losses during ordinary weather, operations, and daytime is extremely concerning.

> Nor have other civil aviation authorities provided data to us that would warrant action,

What, except for the data of the two crashes happening? The person that wrote this statement is a fucking idiot.

>> Thank you for being a patron of the Dallas Morning News. Unfortunately, our site is unavailable to European Union visitors

Please learn some basic geography. Norway (and Switzerland) are not in the EU.

GDPR applies to Norway, even if it's not in EU

Well, they give same message for Ukraine.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact