Boeing Kept Mum to Customers, FAA About Disabling of 737 Max Warning System

Boeing made safety optional on its 737 Max to an even greater degree than was previously reported.

One factoid that had come out in previous articles on the 737 Max was that Boeing had made a safety feature that would have alerted pilots to the malfunctioning of the angle of attack sensors an option that an airline could obtain only by purchasing a package of safety upgrades. American Airlines did buy this suite of add-ons. The Wall Street Journal article that broke this story says that getting this alert back was one of the reasons it paid up to get the safety suite.

This matters because the infamous MCAS software system relied on input from that sensor (more accurately, only one of the two angle of attack sensors at any point in time) to decide if and when it needed to push the nose down to prevent a stall. Pilots could have ascertained the sensors were malfunctioning before takeoff, or if they got an alert during flight, they could have disabled the MCAS system, or been ready to do so if the plane started to misbehave.

This basic fact pattern has been revealed to be worse than it first appeared by virtue of Boeing not having been explicit that the angle of attack sensor alerts had been disabled on the 737 Max. Why should Boeing have cleared its throat and said something? Recall that the sales pitch for the 737 Max was that it was so much like existing 737s that it didn’t require FAA recertification or pilot simulator training. But the angle of attack sensor alert had been a standard feature in all previous 737s, meaning buyers would assume it was part of the plane unless they were told otherwise. And on top of that, the non-upgraded 737 Max did have lights in the pilots’ controls for this alert. But they didn’t work unless the buyer had purchased the package of safety extras.

And the proof that Boeing was playing way too cute with its pointed silence about its deactivation of what had been a standard feature? The biggest customer for the 737 Max, Southwest Airlines, had inaccurate information in its pilots’ manual because the airline had mistakenly assumed the angle of attack sensor alerts worked as they had on earlier 737s.

From the Wall Street Journal:

Boeing Co. didn’t tell Southwest Airlines Co. and other carriers when they began flying its 737 MAX jets that a safety feature found on earlier models that warns pilots about malfunctioning sensors had been deactivated, according to government and industry officials.

Federal Aviation Administration safety inspectors and supervisors responsible for monitoring Southwest, the largest 737 MAX customer, also were unaware of the change, the officials said.

The alerts inform pilots whether a sensor known as an “angle-of-attack vane” is transmitting errant data about the pitch of a plane’s nose….

Southwest’s management and cockpit crews didn’t know about the lack of the warning system for more than a year after the planes went into service in 2017, industry and government officials said. They and most other airlines operating the MAX learned about it only after the Lion Air crash in October led to scrutiny of the plane’s revised design.

“Southwest’s own manuals were wrong” about the availability of the alerts, said the Southwest pilots union president, Jon Weaks.

The Financial Times confirmed the Journal’s account:

Southwest Airlines says Boeing did not disclose that certain safety features on the troubled 737 Max aircraft were not “operable”, raising further questions about poor communication between the manufacturer and its customers ahead of its shareholder meeting on Monday.

Southwest, the largest global carrier with 737 Max aircraft in its fleet, told the Financial Times that it believed it had functioning alerts installed on its Max aircraft so that its pilots would be made aware when the jet’s two angle of attack (AOA) sensors disagreed, signalling a malfunction….

Aviation experts said it was not clear why Southwest was unaware that it did not have functional disagree alerts in its aircraft. American Airlines, another big US Max carrier, had both safety options installed and its pilots union was reassured by Boeing after the Lion Air crash that they were working, American said.

It gets better. After the Lion Air crash, Southwest asked Boeing to activate the alerts. The FAA considered having Southwest ground its 737 Max planes until they determined if pilots should have additional training on these these so-called AOA disagree alerts. Again from the Journal:

Less than a month after the Lion Air jet went down, one FAA official wrote that AOA-related issues on MAX jetliners “may be masking a larger systems problem that could recreate a Lion Air-type scenario.”

About two weeks later, other internal emails referred to a “hypothetical question” of restricting MAX operations, with one message explicitly stating: “It would be irresponsible to have MAX aircraft operating with the AOA Disagree Warning system inoperative.” The same message alluded to the FAA’s power: “We need to discuss grounding [Southwest’s] MAX fleet until the AOA Warning System is fixed and pilots have been trained” on it and related displays…

Within days, the concerns were dismissed….These people concluded that the alerts provided supplemental pilot aids rather than primary safety information, and therefore no additional training was necessary. Boeing and the FAA continued to publicly vouch for the aircraft’s safety.

It’s not hard to infer that the FAA didn’t want to go to war with Boeing over a safety concern that Boeing claimed would only come into play in very rare circumstances. No wonder foreign regulators are signaling they don’t trust the FAA and will do their own checks before they approve the plane for operation.

Boeing says it plans to retrofit all 737 Max aircraft so that will operate as part of its planned fixes to the MCAS software.

And Boeing is in more hot water. American Airlines pilots think the amount of training on the 737 Max recommended by Boeing is inadequate. From the Financial Times:

Meanwhile, as Boeing works to complete a software fix to prevent such crashes in future, pilots at American Airlines have said the training proposed by the aircraft maker, and endorsed by the FAA, does not go far enough….

The Allied Pilots Association, which represents pilots on American, one of the biggest US Max carriers, said in written comments submitted to the FAA that training should go beyond a one-hour iPad course originally provided to Max pilots. But they stopped short of demanding that training on flight simulators be required before the plane can be ungrounded. Requiring simulator training would substantially delay the return of the Max to service.

A second Financial Times story on Boeing says that 737 Max customers who had planes grounded are likely to hit Boeing up for their losses:

US and European airlines have warned that the grounding of Boeing’s 737 Max will shave hundreds of millions of dollars from their combined profits this year, raising the prospect that the aircraft manufacturer will face significant costs for compensating customers….

The total amount of compensation due to 737 Max operators is impossible to estimate, according to airlines, aerospace analysts and aviation industry sources, since the date when the plane can return to service around the world is still unknown….

Compensation was “unlikely to be in the form of a pile of cash”, said one person briefed on the process, noting that Boeing had in the past offered discounts on the price of future aircraft purchases or agreed to defer purchases to adopt a timetable that better suited carriers. A combination of both is also possible. 

And CNN reports, with little additional detail, that the FAA has opened a new Boeing 737 Max investigation based on employee whistleblower filings:

The day after Ethiopia’s minister of transportation released a preliminary crash report on Ethiopian Airlines flight 302, four Boeing employees called an Federal Aviation Administration whistleblower hotline that allows employees and the public to report aviation safety issues.

A source familiar with the matter says the hotline submissions involve current and former Boeing employees describing issues related to the angle of attack sensor — a vane that measures the plane’s angle in the air — and the anti-stall system called MCAS, which is unique to Boeing’s newest plane.

Not only is Boeing looking worse with every passing account, but its management and board are losing the PR battle. At a minimum, the board needs to hire a serious-looking firm to conduct an investigation, and plan to fire some executives. But Boeing, as part of a duopoly, recognizes that its customers have nowhere to go….at least for the next few years, which might as well be eternity as far as MBAs are concerned.

Print Friendly, PDF & Email

74 comments

  1. allan

    C-suite still in denial:

    Boeing suppliers ramp up schedule for MAX: 52/mo by July, 57/mo by August [Leeham News]

    Boeing reduced the production rate on the 737 line in mid-April from 52/mo to 42/mo in response to the grounding of the airplane by regulators worldwide.

    The company and others said they didn’t know how long the airplane would be grounded.

    But Boeing told suppliers to keep producing parts, components and the fuselage at rate 52. …

    Boeing already had a ramp-up plan in place;

    According to the information LNA learned at the, this is the schedule for ramping back up:

    • Rate 42/mo, April and May;
    • Rate 47, June;
    • Rate 51.5, July and August; and
    • Rate 57, September.

    Boeing originally planned to go to 57/mo in June or July. …

    Good luck with that. The upside is that this corporate controlled flight into terrain
    will someday make a great B-school case study.

    Edit: If you Captcha-train an autonomous vehicle not to run into bicycles, and it gets into an accident,
    are you legally liable? Asking for a friend.

    Reply
    1. shinola

      If the AV violated some traffic law or ordinance (such as failed to yield) then yes the owner and/or programmer** would be held liable.

      I’m not a lawyer but spent 30+ years in the insurance biz. & seen the results of hundreds of auto accident claims.

      **This sets up the possibility of litigation between the owner of the AV and the company/person who created the self-driving program if they are not one in the same. I don’t see standard insurance co’s offering liability coverage for AV’s any time in the near future – there’s not enough actuarial information available to set pricing.

      Reply
      1. Lambert Strether

        > I don’t see standard insurance co’s offering liability coverage for AV’s any time in the near future

        I think the State will have to step in on that one, much as it did with the legal structure for pedestrians when the automobile became dominant.

        Maybe some version of informed consent: “If you cross the street, you’re consenting not to sue if a robot car whacks you.” In fancier language.

        Reply
  2. Darius

    The MAX needs to go through the certification process. It has a radically new engine in a different position that makes it prone to stalling. No software overlay changes that.

    Reply
  3. The Rev Kev

    Oh man, this is bad. Really bad. This story just gets worse and worse over time. It’s like one of those Russian Matryoshka dolls – just when you think that you have a handle on what happened, you find that there is a whole new layer of ugliness underneath. When the hell did safety become an optional extra on Boeing aircraft? After reading this, I think that it was a minor miracle that there were no 737 MAX crashes in the continental United States. By the sounds of this article, it would have likely been a Southwest airliner if it had happened. I am wondering what else will come out of this saga that we don’t know about yet.

    Reply
      1. Arizona Slim

        I agree, flora. I also think that the Max is about to become the Chevy Corvair of airliners. As in, unsafe at any speed.

        Reply
      2. Wyoming

        I would say that Boeing easily falls into the ‘Too big to fail.’ category.

        So no matter what happened they will be either made whole (more defense contracts, taxpayer bailout if necessary, whatever is needed) or protected in some way tbd. They are a 100 billion a year company with 150,000+ employees and untold numbers of other contractors and jobs depending on their existence. Going away is just not going to happen.

        Reply
      3. ex-PFC Chuck

        Never underestimate the MICC’s* capability & inclination to look after its own.

        *Military Industrial Congressional Complex

        Reply
    1. Lambert Strether

      Boeing burned their major customer. Not a good look.

      Especially given this history. Quoting The Air Current:

      As Southwest Airlines neared delivery of the first 737-700 in the 1990s, late-founder and Chairman Emeritus Herb Kelleher made a deal with Boeing that was never written down. No airline on Earth would pay less for 737s than Southwest. And if they did, Boeing owed Southwest a check “no questions asked,” recounted another retired Boeing executive and confirmed by a second. “Just a handshake and it was honored.”

      Southwest isn’t just a customer to Boeing. It has closely guided the 737’s incremental development, serving as launch buyer for the jet’s last two generations, but it is also a strategic governor for Boeing, cushioning the company’s peaks and valleys in production.

      Obviously, Southwest is “just a customer” to Boeing, or Boeing wouldn’t have burned them. Reminds me of the fable fo the frog and the scorpion.

      Reply
  4. 737 Pilot

    Okay, Boeing screwed the pooch again, and they should have been more clear in their communications to the airlines. However, let me add some perspective as a 737 operator.

    Given the AOA malfunction in either the Lion Air or Ethiopian accidents, an “AOA Disagree” warning annunciation would have possibly been helpful, but not really crucial to the safe recovery of the aircraft. There were plenty of other indications that the AOA’s were disagreeing – namely that only one of the stick shakers was activated. Once you get over the initial surprise, it shouldn’t have been that hard to determine this fact. The lack of the AOA display and disagree annunciator is not what doomed these crews.

    Reply
    1. vlade

      I sort of agree and disagree.

      I’ve never had a flight emergency as a pilot, but had a few as a diver. I suspect that for both of those, when they hit, you need to resolve things quickly and efficiently, with panic being the worst enemy.

      Panic in my experience stems from a number of things here, but two crucial ones are:
      – input overload
      – not knowing what to do, or learned actions not having any effect

      Both of them can be, to a very large extent, overcome with training, training, and more training (of actually practising the emergency situation, not just reading about it and filling questionairres).

      So, if the crews were expecting to see AoA disagree but it wasn’t there, they could have easily be misled and confused. The crews weren’t (from what I’ve seen) hugely experienced. So any confusion would have made a bad situation even worse. How big an impact it made is hard to judge w/o any other materials.

      Reply
      1. 737 Pilot

        My observation has more to do with the role of AOA on the 737 (and airliners in general). It might surprise you to learn that we don’t really use AOA as a primary instrument on large aircraft, many pilots aren’t taught to use AOA as a reference, and really don’t include it in their instrument scan. A lot of large commercial aircraft don’t even have an AOA gauge to read. Given this background, the presence or not of this information doesn’t have a huge impact on how we operate. And to answer the obvious, even though the direct AOA values may not be not presented, it is used in the background to present displays of minimum maneuver speeds on the airspeed readout.

        An AOA failure will produce other indications (like divergent airspeeds), and we do have procedures to follow for those malfunctions. There are quite a cases in which a major aircraft system will fail, and the pilots don’t really have a clue as to how it failed, yet we still have established procedures to deal with those failures.

        Reply
        1. 737 Pilot

          And just to make it clear if you haven’t kept up with my previous commentary. Boeing really did mess this one up, as did the FAA, as did the airlines, as did the pilots. There was a chain of causation that resulted in these accidents, and every link of that chain deserves the appropriate level of scrutiny. This bit with the AOA warnings is indicative of sloppiness on Boeing’s part, but it wasn’t a direct cause of the accident.

          Reply
          1. marku52

            Well it is rarely just one thing that causes an “accident”. There are multiple contributors here. But the one basic overarching cause was Boeing’s insistence that there-will-not-be-any-additional-training.

            Without that management decree, the Max could be flown without the hack of MCAS, just that the pilots be trained on the new pitchup characteristics.

            And releasing MCAS into the wild without even alerting pilots to its existence, well, that is manslaughter, if not outright murder.

            Reply
          2. Lambert Strether

            > This bit with the AOA warnings is indicative of sloppiness on Boeing’s part

            I think the key point is not the chain of causality for the accident, but the business relationship between Boeing and Southwest. Southwest = the 737, as even consumers know. So Boeing put Southwest’s brand at risk, through a design and certification that really deserves more opprobium than “sloppy.”

            Reply
        2. CraaaaaaaaaazyChris

          My takeaway from the IEEE article was that the AOA sensor is almost a red herring. The dog that didn’t bark was a pitch sensor, and the cardinal sin (from a software perspective) was that the MCAS algo did not consider pitch sensor values when deciding whether or not to angle the plane towards ground.

          Reply
        3. Senator-Elect

          737 Pilot said:

          It might surprise you to learn that we don’t really use AOA as a primary instrument on large aircraft, many pilots aren’t taught to use AOA as a reference, and really don’t include it in their instrument scan. A lot of large commercial aircraft don’t even have an AOA gauge to read.

          Right, but IIRC, after AF447, there was a debate about whether to include AOA indicators in all commercial aircraft and to train pilots to use them. The idea was to let pilots know when they are stalling or close to stalling, or, as in the MAX crashes, when their instruments are giving contradictory readings. Obviously, the regulators decided not to pursue that option. Perhaps they should revisit that decision.

          Reply
      1. Alex V

        I suggest reading some of the other pieces on the 737 debacle on NC. There’s been extensive discussion of the details, and yes the pilots may be partially to blame, but are the least culpable out of all parties involved. 737 Pilot is explaining that the crew should have concentrated on flying the plane and then diagnosing the problem with the MCAS, instead of the reverse. This was however the last mistake in an often unforgivable chain of events starting in the C-suite at Boeing.

        Reply
          1. Janie

            Years ago there was a crash when the crew was focused on whether the landing gear was deployed or whether it needed to be manually deployed. Nobody remembered to fly the plane. Sketchy on details- sorry.

            Reply
    2. GooGooGaJoob

      Given that story states that Boeing was more or less silent on the disabling of the sensor alerts, it’s is reasonable to posit that any 737 pilot stepping into a 737 MAX would expect the sensor to be active.

      I can understand the position that a pilot still needs to be skilled enough to not be 100% reliant on sensors, warning lights etc. to fly the plane. However, if I already assume that a sensor is active and it’s not providing a signal that I would be potentially anticipating, it’s going to seed doubt in my mind in a scenario where you don’t have much time at all to think things through.

      Reply
      1. 737 Pilot

        Until this series of unfortunate events, I am willing to bet that the vast majority of 737 pilots had absolutely no clue that such a things as an “AOA Disagree” warning even existed. Yes, it is there somewhere in our literally thousands of pages of manuals, policies, and procedures, but it’s the kind of technical detail that gets lost in all the minutiae.

        Trust me when I say that when an AOA sensor fails in a significant way, I’m going to have all kinds of other warnings kicking off such that an “AOA Disagree” message is going to be quite redundant.

        Reply
    3. flora

      On the other hand: a safety light that is deactivated without telling the airlines and pilots gives false negatives to pilots at a critical juncture. They assume it’s active, check it, and see a false negative they don’t realize is false.

      Imagine having a ‘check engine’ or ‘oil’ light on your car’s dashboard that’s been deactivated. They never come on. But they’re still there. The driver assumes they’ll light if there’s engine trouble that needs attention.

      Boeing’s actions don’t pass the ‘reasonable man’ test.

      Reply
      1. Jim A.

        Yeah, normally if a mechanical gauge “knows” that it isn’t working there will be a little flag that pops up across the display. Leaving the light there but inoperative instead of either removing the light or covering it up with an “inoperative” cover is a really bad idea. It is EVEN WORSE than making safety features optional, and that is bad enough.

        Reply
    4. John k

      Let’s see…
      First, they didn’t know MCAS existed, so had no idea or training in what to do when it was erroneously engaged by system.
      Then, they think both Aos sensors are working properly.
      And, Boeing tells everybody plane is just like previous versions, no need for simulations.
      I’m glad I’m not one of the dead pilots you’re blaming.
      By the way, it’s apparently just chance that the bad sensors affected foreign and not domestic flights, no public reports that superior domestic pilots had no problem when it hit the fan on their watch… although some domestic airlines were told (warned) that bad sensor light was optional extra… so possibly a domestic plane cancelled flight on account of bad sensor.
      But imagine a really experienced pilot would have saved the day… so Boeing should say only really experienced pilots should fly the plane? Maybe simulators help you get really experienced, especially with unexpected emergencies?
      Personally, I’ll avoid the plane for a few years if simulators aren’t required… hate to have a pilot not experienced with what we now know is not such a rare event.

      Reply
      1. Old Jake

        We seem to be forgetting that, in the Lion Air case, a really experienced pilot did save the day the previous day on the same aircraft. The issue was reported, the airline neglected to repair the issue and nobody seems to have told the new aircrew about the issue. This seems to support 737 Pilot’s position. It is also another egregious failure, this time on the part of the airline.

        Reply
        1. dcrane

          That pilot was a third set of eyes. Since he didn’t have to fly the plane, he was free to observe and fortunately his attention eventually focused on the repeating trim wheel movements. A standard two-person crew doesn’t have this luxury. Worth keeping in mind.

          That lion crew also seems to have written up the problem incompletely. They didn’t mention, for example, that they had the stick shaker going for the entire flight.

          Reply
          1. JerryDenim

            Your point is legitimate but without the benefit of a CVR recording I think you may be affording too much credit to the jumpseating pilot who is rumored to have provided the flight crew with the excellent advice of disabling the electric stabilizer trim motor. Even if the story is entirely true it’s not like turning off the Stab trim motor was esoteric knowledge, maybe 737 pilot can correct me on this but I thought that procedure was a memory item for trim runaway emergencies, meaning the pilots were supposed to have that bit of knowledge firmly committed to memory and they were supposed to execute that procedure without any checklists or undue delay as soon as the condition was recognized. If not a memory item it was in the 737 QRC or QRH emergency procedures guide that is always present for immediate reference on the flight deck. The most important thing the crew of Lion Air 43(?) did (the flight previous to 610 that managed not to crash) was to simply not let themselves become so frazzled they forgot to pull the thrust levers out of the take-off detent after they reached a safe altitude, and not overspeeding an out of trim airplane making a bad situation worse. Maybe the jumpseating pilot had to scream at the crew to reduce thrust and maybe he had to slap the Captain and reduce the thrust levers himself, but absent a CVR recording to verify this slightly far-fetched scenario I would say the previous crew deserves the Lion’s share (sorry couldn’t resist) of the credit for landing safely.

            You are absolutely 100% correct when you point out the non-crashing Captain was far from exemplary. He laid an absolutely vicious trap for the ill-fated crew of flight 610 by failing to mention a great number of things he experienced, especially the uncommanded and unwanted nose down trimming that necessitated turning off the stab trim motor which he also failed to communicate. Not a shining moment for Lion Air pilots, mechanics or Boeing. Despite the obvious and multiple shortcomings and blunders of the Captain/crew of Lion Air 43, I believe that flight proves what the airline pilot commenters here have been saying all along, which is the 737 Max flaws were serious but survivable with a competent crew. That’s not the same thing as calling the airplane safe or airworthy and it’s certainly not excusing Boeing. They delivered a death trap. Perhaps a bad analogy, but a professional body guard should be able to easily disarm a five year with a knife, but that doesn’t mean a murderous five year with a knife isn’t dangerous or isn’t capable of killing you. Airplanes are machines which inevitably fail and mechanics are humans who make mistakes which is why pilots need to know how to hand fly airplanes absent automation. Reducing thrust during an emergency to avoid overspeeding your airplane really isn’t a tall ask for a professional pilot. Pilots get this, non-pilots don’t, and it’s a point I’ve grown quite weary of making.

            Reply
              1. 737 Pilot

                JerryDenim is correct.

                Aircraft non-normal procedures (we used to call them “Emergency” procedures, but someone decided that sounded to scary) are usually crafted in such a way that are agnostic to the technical reasons for a system failure.

                For example, there are a lot of moving parts in an engine that could cause a failure, but when that failure happens, we have one set of procedures to address that failure. We don’t really care what widget failed.

                Both MAX accidents ultimately devolved into two malfunctions for which there were published procedures. When the AOA vane failed, it created a malfunction we call Airspeed Unreliable. If the crew had followed the procedure for this malfunction, they would have been able to stabilize the aircraft and climb to a safe altitude. More importantly, they probably would have never retracted the flaps which was the the specific condition that allowed MCAS to activate.

                Once they did retract the flaps, MCAS activated. What MCAS will then do is attempt to trim nose down for 9 seconds, spinning the trim wheel about 37 times, and move the stab 2.5 degrees, all while the pilot is holding the flight controls in this hands. This action absolutely screams runaway stab trim, for which we also have an established procedures.

                Depending on the airline, these two procedures are either a “memory item” or on a Quick Reference Card (QRC) on the glareshield.

                Neither of these procedures were properly executed in either accident. If at least one of these procedures had been used, we probably wouldn’t be having this conversation today.

                Reply
                1. Yves Smith Post author

                  I have trouble with your cheery characterization because the problem was not that the AOA vane failed per se, but the AOA vane failure gave MCAS bad date which led it to nose the plane into the ocean. MCAS triggers off the AOA, not the flaps. All accounts indicate that. And the black box results from the Ethopian Air crash also are at odds with your claims. The pilots did recognize that MCAS was the problem, tried disabling that, and they were still unable to regain control of the plane. That would suggest that the “disable MCAS” instructions were at odds with what you assert are standard procedures.

                  I hadn’t doubted your remarks before, but this comment makes me question whether you are a bona fide 737 pilot or alternatively, whether your incentives are leading you to unduly blame the pilots of the downed craft, which happens to be Boeing’s party line. If you work for an airline that bought 737s, flights have been cut and will remain reduced until the 737 is approved for flight again. That means less opportunities for the pilots for those airlines to fly, which for some will mean them getting fewer hours than they wanted.

                  Reply
                  1. 737 Pilot

                    I’m apologize if it seems that my comments are “cheery.” I do attempt to avoid any emotional language because I view my purpose here as largely a technical one. It is often difficult for the non-pilot layperson to translate some of the very technical issues and draw the correct conclusions. From this technical perspective, there has been a lot of incorrect information published by major media sources leading to frankly ineffective lines of argument.

                    Trust me when I say that Boeing ought to be held accountable, a position that I have stated many times. However, aircraft accidents are usually the result of a chain of causes. In the aviation safety arena, we don’t just pick and choose which links in the chain we want to deal with. We look at them all, and we try to correct the lapses we find.

                    The fact that I provide more commentary regarding what goes on in the cockpit merely reflects the fact that this is where I work. I’m not an aircraft engineer or program manager. I am not an employee of the FAA. I am not in airline management. While I can see that errors were made in all these other departments, I really don’t have the credentials to make specific commentary on those areas.

                    I will say that one of my great concerns, and why I address flight crew issues so frequently, is that a big part of the story is being missed due to the focus on Boeing’s role. The professional pilot training pipeline has undergone some major changes in my 35+ years of aviation – some for the better, but some for the worse. The current training pipeline is producing an entire generation of pilot in which “systems management” is being emphasized at the expense of traditional pilot skills.

                    It is highly improbable that the next airline accident will involve MCAS in the chain of causation. It is reasonably probable that the next accident will involve lapses on the part of the crew.

                    A whole lot of folks are focused on the last accident. My focus is on the next one.

                    Reply
                    1. vteodorescu

                      737 pilot – I think you are missing the point.

                      A good pilot should not be required to deploy his best skills just to control a normal take off in good weather when a 300 usd part fails. Those skills should be saved for when both engines fail at low altitude, like the Hudson water landing, when an engine catches fire, falls off, severe weather etc.

                      My life as a passenger should not depend 50/50 on whether the pilot at the controls is an average pilot or a good pilot when a single 300 usd part fails. If the plane requires extreme skills in those circumstances, then something is seriously wrong.

                      My air credentials: airplane and helicopter pilot (private pilot and low hours), glider pilot, paraglider pilot

                      System design in software in the day job

                  2. Alex V

                    “MCAS triggers off the AOA, not the flaps.”

                    The system logic of MCAS only turns it on after flaps retract, as the plane is in a different aerodynamic configuration, with a different stall speed. When the flaps are extended, it is not on, and will not use AoA data (good or bad) to change trim. 737 Pilot is saying the crew likely missed a chance to avoid activating MCAS at all when they missed that they had a bad AoA sensor.

                    In regard to disabling MCAS, the procedure 737 Pilot is referring to is similar to what is discussed here…

                    https://www.youtube.com/watch?v=aoNOVlxJmow

                    This is for a 737 NG, but it is quite similar in the MAX. Mentour Pilot explains reducing power to reduce forces on the flight surfaces is one method that can be used for this problem, beyond the “memory item”, which is what the Ethiopian crew may have used. He also explains that this technique is not commonly taught any more and depends on the model, so if 737 Pilot is more experienced or flies for a different airline, it may be standard procedure to him.

                    The Ethiopian pilots likely correctly followed the book procedure for disabling stab trim. At a certain point they were overwhelmed by the situation, and were unable to think on the fly of other ways to get out of the corner Boeing had put them in. More experienced or thoroughly trained crew may have gotten luckier by remembering additional ways to escape runaway stab trim.

                    Reply
                    1. 737 Pilot

                      There are several conditions required for MCAS to activate. I won’t get into some of the arcane ones, but for the purpose of the accident in question there were three key ones: 1) High AOA value (in this case erroneous) 2) autopilot not engaged (could not be engaged with an active stick shaker warning), and 3) flaps retracted. Retraction of the flaps was the final condition to be met, hence my use of the word “trigger.”

                  3. JerryDenim

                    This looks to be a dead thread, but I’m going to jump on late because I feel 737 pilot has been treated unfairly.

                    I’m not a 737 pilot and I have very limited exposure to 737’s aside from a few hours in a Sim and riding the jumpseat of many 737’s and observing the crew, but I’m prepared to wager that’s more than most people here. I do have considerable experience working as an airline pilot from both sides of the airplane. I have avoided using the comments section to take any deep dives into the 737 systems for a few reasons;

                    1.) I don’t know the subject matter since I’ve never really flown the airplane or been through systems ground school for the 737,

                    2.) I’m too lazy to try and look it up and if I did I might get some of the finer technical points wrong.

                    3.) I’m highly skeptical, meaning in my extensive experience with previous aircraft types, the deeper you dive down into technical manuals about systems architecture and behavior the less likely it becomes the printed literature is going to match the real aircraft behavior in a rarely trained emergency situation. Sometimes airline emergency manuals contain contradictory or seemingly contradictory information if you dive deeply into the fine details, I would think these observations would be especially true of a new and relatively untested variant of aircraft like the 737 Max, which we now know had hasty and buggy software and poor systems architecture.

                    4.) In my opinion, it really doesn’t seem to matter that much. It’s almost beside the point. ‘737 Pilot’ is absolutely right that retracting the flaps on a normal speed schedule after take-off, while the stick shaker is going off, and while you have concerns your aircraft may be facing an imminent stall is absolutely the wrong thing to do. Flaps equals lift, so why retract? On a deeper level, if you had the systems knowledge, no flaps brings MCAS into play, but you would have to be a stone cold Ace with ice water in your veins to quickly run through that scenario in your head with the shaker going off at rotation. I never bothered making that point because I believe the vast majority of pilots, myself included, well-trained and highly experienced 737 pilots included, might do the exact same thing. Habit patterns are powerful. Based on statistics and case studies normal habits are the most likely behaviors to express themselves when humans are startled and stressed, even if they definitely know better from a classroom or armchair quarterback perspective. I would never pass judgement on a pilot for such an easy mistake. Flaps up or not, MCAS operating or not, Lion Air 610 and Ethiopian 302 did not ultimately crash due to Boeing software gremlins. Those planes ultimately crashed because the pilots failed to properly manage thrust and energy state during a runaway trim emergency and they failed to follow established procedures. There were many other contributing factors, Boeing malfeasance not being the least, but there’s no escaping the very large and obvious crew errors. I know I am about to be shouted down, but look at Asiana 214. An aircrew very accustomed to relying on automation stalled and crashed a perfectly good Boeing 777 with no malfunctions on a beautiful clear day in San Francisco due to automation mode confusion and a hesitance/inability to hand fly the aircraft. I’ve been beating this drum for a while now, but 737 pilot is absolutely right- The Ethiopians could not regain control of their airplane because they were badly rattled by the emergency situation and they had very poor hand flying skills and instincts. They never once thought to reduce their thrust setting/speed during a runaway nose-down trim emergency which is incredibly bad piloting. By the time they had disabled the stabilizer trim motor they were already past 300 knots. By the time they tried to use the manual trim wheel to trim away the nose-down control forces they had already exceeded Vmo, or the aircraft’s maximum speed, which is why the manual trim wheel did not work. It is never advisable to exceed Vmo, but it is especially unwise in a nose-down trim emergency. Speed compounds the problem making all of the negative tendencies worse. Once they turned the electric stabilizer trim back on, well past Vmo at this point, with the high speed warning clacker continuously sounding, the failed MCAS system predictably trimmed the aircraft nose down again, the Ethiopians finally lost control, and they hit the ground at 500 knots, 40 degrees nose down and with take-off power still set. Maybe that seems reasonable to non-pilots but that is akin to letting the cruise control on your car drive you into a concrete wall at 150 mph full throttle without ever once tapping the breaks or disabling the cruise control. Maybe people think I’m being cruel or uncouth to point out the mistakes of other pilots that tragically perished, but I promise you these actions will be front and center at any future trial and the Boeing attorneys will be even more unkind. Expect to hear about these pilot’s training records, what time they receiving texts and using the internet the night before, etc.

                    If 737 Pilot, who is a 737 pilot, who as I understand it has flown the Max, says the MCAS system doesn’t activate until the flaps are retracted then I would believe him. I would definitely believe him over some random hobby flyer or journalist attempting to speak with authority on the Max that are not professional pilots and are not type rated on the 737. Having systems that are disabled until after flap retraction is quite common on large commercial aircraft and since the story on MCAS was it was designed to mask certain aerodynamic tendencies of the new engine and pylon it would certainly make sense to have it kick in only after flap retraction since flaps affect lift, drag and change the mean chord of the wing.

                    I have no idea who 737 Pilot really is but he’s certainly never said anything to make me doubt his credentials. My two closet pilot friends are both 737 Captains, one just recently went through upgrade training at United and the other is a Check Airman on the 737, including the Max variant for a European carrier. Neither one of them thought the FAA grounding was necessary. I’m not saying I agree with their opinions, but both of them are thoughtful, circumspect guys. My point is “737 Pilot’s” opinions certainly don’t seem far out of step with his peer group, myself included. I for one have found his opinions to be far more accurate and enlightening than people like Gregory Travis.

                    Reply
                    1. Lambert Strether

                      > look at Asiana 214. An aircrew very accustomed to relying on automation stalled and crashed a perfectly good Boeing 777 with no malfunctions on a beautiful clear day in San Francisco due to automation mode confusion and a hesitance/inability to hand fly the aircraft.

                      I forgot the Asiana incident…

                    2. rd

                      Interesting thread.

                      A question to the 737 pilots. Is the MAX a plane which is more likely than other 737s to require “non-normal procedures” so is more likely to expose poorly trained crews? Or is two MAXs go down for the same reasons in short order just a random statistical thing like somebody shooting a dozen 3-pointers in a row or a monkey writing a Shakespeare play?

                      The reason I ask is that Boeing seemed to be playing up that the MAX didn’t require any significant additional training despite a fairly significant engine relocation on the wing. but this thread seems to be indicating that significant common training is critical for this and other 737s.

                      You need to have the same driving skills to take an AWD SUV with winter tires on ice compared to a mid-engine sports car with summer tires in case you spin out. But you are far more likely to exercise those skills in the sports car, so that will be more likely to expose deficient driving skills.

    5. JerryDenim

      I made the exact same argument here a couple of days ago, but I will say IF the system was engineered in a way it could have given the Ethiopians a warning prior to eighty knots or V1 (depending on training and pilot judgement) on takeoff, maybe they could have aborted and kept the plane on the ground avoiding the disaster. Having that disagree light or indication immediately after rotation on climbout could have soothed the nerves of the pilots and made them feel more confident trusting the perfectly normal instrumentation on the FO’s side of the airplane. But if the high speed clacker, the airspeed tape and the thrust settings aren’t enough information to convince a overwhelmed, elevator control fixated pilot that he/she has more than adequate speed to avoid stalling, and they should slow down, then it stands to reason a secondary warning indication would also not break through the mental logjam of two very overwhelmed pilots bombarded by warnings and data. In the case of Lion Air 610 the malfunctioning AOA vane had already caused multiple instrument malfunctions and improper nose down MCAS trimming on three other flights, so it seems like those guys were hellbent on flying that plane no matter what. Even if Lion Air would have had the optional warning system onboard the mechanics most likely would have deferred the warning system as broken. “Ops checks good”. They probably would have removed the bulb or stuck a placard on top of it.

      And before anyone feels the need to point it out, yes, I’m engaging in speculation, but so is everyone claiming this optional safety system would have made a difference in the two aforementioned tragedies. I’m engaging in speculation as a guy who has reviewed thousands of logbooks and had hundreds, possibly thousands of interactions with airline maintenance technicians. Some of those interactions include contentious debates over what is safe to defer or what can actually legally be deferred so I do have a bit of experience in this department.

      Boeing screwed up. They were hasty, they were greedy, they were cavalier, the MCAS trim system with a single point of failure was a terrible design that was most likely criminal. I’m just weighing in on 737 pilot’s contention. With a system as poorly designed as the MCAS stall protection trimming, every safety feature available should have come standard from Boeing, but sadly additional fault indications don’t always matter in emergency situations. Proper fault diagnosis is only part of any successful emergency outcome. Pilots still have to possess the knowledge and skill required to follow procedures and fly the airplane.

      Reply
      1. Lambert Strether

        > sadly additional fault indications don’t always matter in emergency situations

        Like on the Corvair: The solution wouldn’t have been to add a warning light on the dash that the car was about to go into a skid and roll over; the solution is to fix the suspension!

        Reply
        1. JerryDenim

          Bingo. Absolutely correct answer for a car manufacturer selling cars to the general public.

          But to be provocative, if the under-steer characteristic somehow improved performance, perhaps for a professional race car driver, the warning light would be the preferred solution???

          I think the more interesting question going forward post-Max disasters is what caliber of pilot is an airline transport category aircraft expected to be designed for? Currently all Boeings are supposed to be piloted by type-rated Airline Transport Pilots, not private pilots or hobby flyers. So the question becomes, are we talking ATP’s who are capable of manipulating the thrust levers manually and executing emergency procedures while things are malfunctioning or are we talking pilots that can only perform rote functions under normal rosy circumstances? Soon to be decided in courts and by markets. I already think I know how this turns out. It’s not less automation and more pilot control.

          Reply
    6. dcrane

      There were plenty of other indications that the AOA’s were disagreeing – namely that only one of the stick shakers was activated.

      I’ve read that it may not be so easy to tell because the columns are physically interconnected, so that both vibrate when one shaker goes off. Is this correct?

      Reply
  5. vlade

    The only planes I ever flew you’d fly w/o pretty much any instrumentation (WW2 trainers, hoping to fly a Spitfire or Mustang one day.. ).

    But in a modern plane, I’d think that _any_ instrument that is doubled or more (which implies some sort of criticality) should have an automatic “inputs disagree” indicator, which would not be possible to turn off.

    Not that you’ll have to buy it as a special feature.

    Reply
    1. JBird4049

      I have been thinking about the modern 737. My completely uninformed guess is that the original model, while less “safe” was more informative in a real way than the current one.

      In modern cars, especially something like a hybrid, there is not much “feel” to it. In an older old fashion gasoline engine car, there is. I could use the Volkswagen as an example, because it only had some colored lights and the speedometer, and none of the safety features of a modern car. However, I could sense, smell, see just about everything, often subconsciously, even before something went kablowie because there was nothing isolating me from the vehicle and the road. Today, I have to depend on my car’s sensors because it has been designed to be quiet and isolating as possible.

      Reply
      1. Jerry B

        Excellent point JBird!. I have a 2009 Subaru Forester. It is an awesome SUV and one of the best bad weather vehicles I have owned/driven in my 60 years on the planet.

        However, to your point, it does not have a lot of “gauges”. Specifically it does not have an oil temp gauge. I think, as you mention, it has lights that come on when the computer senses the oil temp getting high.

        In the old days I had several friends that had muscle cars and hot rods and they would add gauges to display things they wanted info on especially temp gauges, etc.. With all the computers in cars/trucks I think adding analog gauges is probably impossible.

        Reply
  6. John

    The downward slide of corrupt predatory capitalism is not a pretty picture. These cases will continue as long as the responsible executives know they have nothing to lose.

    Reply
    1. campbeln

      Just more proof that self regulation works, just look to our favorite sporting events!
      There’s no need to have refs on the field because everyone involved is a professional and would never cheat, disrespect the sport or do something against the rules because the fans would punish them!
      If our sports don’t need refs, then surely our markets don’t need regulators! Checkmate, big government stooges!

      Reply
      1. Synoia

        Absolutely correct. Throw away the huge NFL rule-book, and revert to the rules the of the Roman arena.

        It would save the NFL team owners huge amounts of money.

        Reply
  7. StarryGordon

    I suppose I am naive, but I am shocked that the behavior of Boeing’s management and the FAA are not being treated as a criminal matter. What happened was not a business mistake, it was a crime in which a number of persons deliberately and knowingly decided to risk other people’s lives in order to increase profits, as a result of which hundreds of people were killed. I believe the term is ‘negligent homicide’, upon conviction of which lesser beings than high management and bureaucrats go to jail. In some countries their next of kin would already have received a bill for bullets and services rendered.

    Reply
    1. Synoia

      It would be interesting in Ethiopia issues a criminal arrest warrant on these grounds for the Executives of Boeing.

      That being the country with jurisdiction for this second crash.

      Is there an extradition treaty between Ethiopia and the US?

      Reply
      1. JBird4049

        Unfortunately, according to Wikipedia, the United States does not have extradition treaties with either Ethiopia or Indonesia.

        Reply
    2. Spring Texan

      Agree. It’s truly shocking that there seems to be so little real attribution of responsibility to the CEO. On the radio they said no he’s not expected to lose his job even. Geesh!

      Reply
    3. John k

      The term used to be criminally negligent homicide, but this no longer applies to those wearing white collars.
      Otherwise we would see charges against bankers, opioid pushers, and others.

      Reply
  8. JBird4049

    But Boeing, as part of a duopoly, recognizes that its customers have nowhere to go….at least for the next few years, which might as well be eternity as far as MBAs are concerned.

    Even if it meant drastically reducing flights why would any airline buy airplanes that are not guaranteed to be safe? Losing money through fewer paying customers because you are choosing to have fewer flights is better than being boycotted or bankrupted by lawsuits, or arrested and criminally charged.

    Reply
  9. EoH

    It is inexplicable that Boeing shut off an indicator system for the Max that had been standard on earlier versions of the 737, when that AoA sensor disagreement indicator was even more important for safe flight.

    Turning it on in the Max version was possible but was made part of an extra-cost safety package. How would a purchaser know to buy it when Boeing downplayed its importance so as not to suggest how different the Max was from supposedly similar earlier versions of the 737?

    The more that comes out about the conduct of Boeing and its senior management’s decisions, the more they look criminally reckless.

    Reply
    1. marku52

      I like the idea of a check box on the order form

      “Check here if you don’t want your plane to fly into the ground at 500mph….”

      Reply
  10. WestcoastDeplorable

    The FAA is mostly responsible for this fiasco because they have a misguided mission. Safety should be their only concern, but over the years that’s eroded into a “sort of safety” attitude but mostly being a cheerleader for the aviation industry.
    And you can’t trust bastards like Boeing to “self-certify” anything, apparently!

    Reply
  11. Carey

    Scott Hamilton at Leeham News on Boeing’s CEO:

    “..It took months before Boeing CEO Dennis Muilenburg issued a video in which, among other things, he said, “We own it.” He was referring to safety of the MAX.

    This was widely interpreted as Boeing stepping up and taking responsibility for at least some of the causes of the Lion Air and Ethiopian Airlines crashes.

    Last Wednesday, he took it all back.

    On the first quarter earnings call, Muilenburg denied there was any “technical slip or gap” in designing the now famous MCAS system. He said “actions not taken” contributed to the crash, a thinly veiled reference once again to pilot error..”

    https://leehamnews.com/2019/04/29/pontifications-we-own-it-but/

    Reply
    1. JerryDenim

      It sure looks like a clear signal that Boeing is battening down the hatches and going on a war footing now. The attorneys are steering the ship and approving any press statements. It appears Boeing is preparing to blame the pilots, the mechanics, airline training departments and anybody else who played a role in the twin 737 Max tragedies that’s not affiliated with Boeing. Ralph Nader and thirty-five different lawsuits plus a Justice Department criminal investigation have changed this from an extremely bad PR crisis to an existential threat for Boeing. This is a well-worn path. Airlines and Aircraft manufacturers love blaming pilots. It’s all too easy. The cockpit voice recorder (CVR) and the digital flight data recorder (DFDR) while improving safety and helping give birth to the study of “human factors” training which has made aviation far safer, has also made it incredibly easy for skilled accident attorneys to hang pilots out to dry while helping everyone else avoid blame. Maybe we need a boardroom and engineer CVR to record all of the misdeeds and evil machinations of greedy executives. I would love to know if between the Lion Air crash and the twenty billion stock buyback in November if any of the Boeing executives discussed the merits of attempting to fix their flawed MCAS system versus the financial upside of using the Lion Air crash as selling point to increase the sales of their optional ‘AOA vane disagree’ feature. That would be really disgusting and really damning in court. Maybe Nader can dredge up some emails or perhaps a thoroughly disgusted whistle-blower archived some dirt for posterity. Should be an interesting legal battle for future text books.

      Reply
  12. VietnamVet

    Boeing and FAA are criminally negligent especially for the Ethiopian Airline crash. The recovered horizontal stabilizer screw jack from the Lion Air crash was found in the full nose down position that forced the plane to dive into the sea. It should have never be in this is flight critical position. Grounding the fleet should have been immediate until the cause and fix were found. On top of all this, it is simply criminal for Boeing to charge Southwest Airlines for additional safety features and then turn them off not telling the airline.

    It is tragic that it appears that Americans will have to rely on China to force Boeing to actually fix MCAS and along with Canada to shame the FAA into requiring pilot training on Flight Simulators before flying passengers on the Max.

    A Boeing C-Suite executive has to go to jail. If not, there is no chance for the United States of America to survive. With government run by and for profiteers, long term planning is dead. Profit over people. A plague, an economic crash, a world war, a middle-class revolt, flooded coasts, or an autocratic Caesar become inevitable.

    Reply
  13. vidimi

    It’s not hard to infer that the FAA didn’t want to go to war with Boeing over a safety concern that Boeing claimed would only come into play in very rare circumstances. No wonder foreign regulators are signaling they don’t trust the FAA and will do their own checks before they approve the plane for operation.

    this is what i’ve been wondering about. how is the FAA still regarded internationally? FAA accreditation should be meaningless now to any other country’s aviation authority who ought to be doing their own checks.

    Reply
  14. jfleni

    RE: Boeing Kept Mum to Customers, FAA About Disabling of 737 Max Warning System.

    Its just like buying a s##tbox, you can rely on getting wheels
    and steering, but everything else is optional!

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *