The Cultural Origins of Aviation Safety

A Boeing 737 makes its final approach for landing
A Boeing 737 makes its final approach for landing Regis Duvignau / Reuters

Previously on this topic: “Is It Time to Worry About the Boeing 737 Max?,” “A Shorter Guide to the Ethiopian Tragedy and the 737 Max,” “What Was On the Record About Problems With the 737 Max,” “‘Don’t Ground the Planes, Ground the Pilots,’” “The Implications of the 737 Max Crashes,” “Training, Regulation, and the 737 Max,” and “The Jump-Seat Pilot and the 737 Max.”

Yesterday I mentioned a new Bloomberg report on the background on the crash of the Lion Air 737 Max last fall, in the ocean off Indonesia. The crucial detail in the Bloomberg report, still to be confirmed by other sources, is that just one day before the Lion Air crash, the very same airplane had reported a similar pitch-control anomaly. But in that case, a third pilot, who happened to be in the cockpit aboard a jump seat, recognized what was happening, and helped the flight crew overside the errant system.

If this report holds up, its implications could be significant—at least for the Indonesian crash. To lay them out as clearly as I can, for emphasis:

  • A specific 737 Max airplane reportedly had a pitch-control problem, of the sort associated with the new MCAS software on the 737 Max.
  • The three pilots reportedly in the cockpit that day—two from the regular crew, plus one more who happened to be there—together recognized and dealt with the problem, so the flight continued to its destination.
  • The same plane returned to duty, full of passengers, the very next day.
  • That next day, the same airplane had a serious pitch-control problem. But the two pilots in the cockpit that day were not able to deal with it, for whatever reason, and they plus 185 people went to their deaths.

At face value, something about this does not make sense — in addition to being horribly tragic.

  • If the doomed Lion Air plane indeed had a runaway-pitch episode the day before the fatal crash, wouldn’t the flight crew have noted that in the plane’s logbook, at the end of the flight?
  • And if this episode were noted, wouldn’t the next day’s crew have seen it on the routine logbook inspections all professional flight crews are supposed to make, and done something about it? “Done something” in this case would include: asking the maintenance crew what had happened; requesting a different airplane; refusing to take off until they knew the full story; and so on.

At face value, this does not make sense. The Bloomberg report addresses it, saying that the previous-day flight crew “didn’t mention key issues with the flight after they landed, according to the [Indonesian] report.” If this really is the case, it is … inexplicable. No matter where in the world, you would expect professional pilots for a commercial airline always to have logged an anomaly this serious, after landing. You would expect the next day’s crew always to have looked through the log book before agreeing to take off.

For this next installment of reaction from people in the aviation world, here are messages stressing “human factors” and cultural questions. For instance:

1) Why did the third pilot matter? Perhaps because he had additional bandwidth and mind-share. Several pilots and others have written in to make a point like the one in the message below:

Regarding the 3rd pilot who had managed to troubleshoot the problem on the previous day’s Lion Air flight, another possibility could be that it was not that that the 3rd pilot had special knowledge but that because he was not personally flying the plane, he could step back to consider the problem and find a solution.

In a situation where something abnormal happened, the pilots may just not have had the bandwidth to consider all the possibilities because they were fully occupied just trying to keep the plane aloft.

The parallel is with the Qantas A380 near-disaster when their engine blew up shortly after leaving Singapore. There were five pilots in the cockpit when the incident occurred and that meant that the workload of going through all the checklists and trying to figure out what was going on could be spread out over more pilots.

While the official ATSB report said that two crew could have landed the aircraft safely, just being able to discuss the situation with other experienced pilots in the flight deck no doubt raised the confidence level of the Captain and reduced the chance of him making a mistake.

Qantas was lucky that day. Unfortunately, the pilots of the two recent 737 Max crashes didn’t have that luxury.

For an illustration of how task-saturation and “reptile brain” can take over in small-airplane aviation, check out this video by Paul Bertorelli on AVWeb. It describes how the parachute built into all Cirrus single-engine airplanes, like the ones I have flown, has given small-plane pilots an option when panic and disorientation overtake them.

On another aspect of why another set of eyes in the cockpit might have made a difference:

I don't think the survival of the plane with the jump-seat pilot  necessarily means that pilot knew about MCAS or what was causing it.

It is possible that, from his location at the back of the cockpit, he saw the trim wheels spinning in a "Downward" direction [JF note: These are the wheels through which pilots can set the plane’s “pitch trim,” which visibly move when the automated systems are at work]. He might then have realized that the pitch movement needed to be stopped, and the quickest way to stop that was by flipping the switch.

Getting more details on how the previous flight solved the problem
might be very interesting.

On a related expected-standards point, a reader in the U.S. writes:

You should be aware that in the US, Boeing and/or the FAA can issue notices to operators that they must follow in order to keep flying particular aircraft.  Given the complexities of modern aircraft, these notices are pretty common as experience is developed with the design.

Boeing and the FAA however, have no power over foreign operators of aircraft.  These notices are issued to foreign operators, but they are under no compulsion to follow through on them.  This is one of the reasons that foreign carriers typically have poorer safety records than US operators, as they tend to ignore a fair amount of these.

[JF note: The previous sentence may sound like a generalization, but data show that commercial airlines in North America and Europe, plus Japan and South Korea, in fact have a dramatically better safety record than those in other parts of the world. According to the latest tabulation from IATA, the international airline organization, these are fatality rates per million departures from 2012-2017, by region of airline: North Asia, 0.00; Europe, 0.14; and North America, 0.22. By contrast, the rate for African airlines as a whole was 2.22; Middle East and North Africa, 0.71; Latin America, 0.53. Airlines from the former Soviet Union had  a fatality rate of 1.17, or more than ten times the European rate. Richer-country airlines, in fact, do have much better safety records.]

Here in the US training is typically thorough and I'd be surprised if pilots were not trained to recognize and recover from a failure in the MCAS system, including simulator time in which the failure was induced and the pilots trained on responding properly.  This is one reason I believe as to why there was no order from the FAA to ground the aircraft.  The FAA was probably confident that US pilots had been properly trained.

2). Unexpected consequences, or: Fighting the last war. An experienced military and civilian airline pilot suggests that efforts to “learn the lessons” of previous airline disasters might have inadvertently created the conditions for this  one.

Here’s the crucial background to the case he makes: In most aircraft in most situations, the first step to take when a plane is nearing a dangerous aerodynamic stall is to push the nose of the plane down. The word push is generally emphasized, in part because this step means physically pushing a control stick or yoke forward in the cockpit. This, in turn, lowers the plane’s nose, reduces its “angle of attack” against the oncoming wind, and begins the stall-recovery process. Even private pilots like me have been through countless repetitions of stall-recovery drills, with a memorized list of steps that always begin with push.

In two fatal airline disasters a decade ago—the Colgan commuter plane that crashed on approach to Buffalo in 2009, and the Air France crash into the Atlantic that same year—the professional flight crews (for differing reasons), failed to push and prevent a stall when they should have. The pilot who writes in now says that Boeing may have been over-learning the lessons of those disasters in building in its automatic nose-pushing software. This pilot writes:

  1. My bonafides:  Air Transport Pilot, Certified Flight Instructor, captain with major U.S. airline, extensive flying experience in 737s (but not the Max), former military instructor pilot who taught, among other things, the out-of-control flight curriculum for other  instructor pilots.
  2. There may be an unexplored cultural aspect to the Max mishaps.
    1. After the Air France and Colgan Air mishaps, a consensus seemed to form that pilots weren’t good enough at recognizing and responding to stalls.  My airline responded, in part, by training pilots in the All-Attitude Upset Recovery Strategy.  The strategy boils down to “Push, Roll, Power, Stabilize.”  I conjecture that this was an attempt specifically to address the failures of the Air France and Colgan flight crews.  Had the pilots of those flights led with “push,” their mishaps may have been averted.
    2. I strongly suspect that Boeing engineers involved in the Max update were reacting to Air France and Colgan when they designed the Max’s “automatic nose down, can’t be outmuscled by pilots” feature.  After all, both of those mishaps occurred specifically because those pilots failed to respond to stall indications and insisted on pulling back on their respective flight controls.  The Max’s system, if I understand it correctly, may have averted both of those mishaps.
    3. In other words, Boeing may have seen the airplane’s ability to ignore pilot inputs as a feature, not a bug.  This may have been a significant causal factor in both Max mishaps.
  3. You’ve noticed that I use a lot of qualifiers.  That’s on purpose: I’m just speculating.  I’m not involved in the investigation, I’ve never worked at Boeing, etc.  However, I haven’t seen any journalists tease out this link, and I think it bears investigation.

The questions mount up, as preliminary answers emerge.