In the days since the horrific Ethiopian Airlines crash, I have received a lot of email from pilots, aircraft engineers, and others with experience in aviation. These have been in response to three previous posts: first here, then here, then most recently here (with quotes from pilots’ observations about the Boeing 737 Max via NASA’s Aviation Safety Reporting System).
While I sift through the other messages, let me start with one from a highly experienced pilot and flight instructor. His name is Wally Magathan, and he has worked as an airline pilot, an Air Force pilot and C-5 Galaxy flight instructor, and an instructor in airline L-1011 flight-simulators. I know him through COPA, the organization of pilots and owners of Cirrus’s small single-engine airplanes.
With Magathan’s permission, I quote a post from him, offering a professional’s view of risk-management after these two Boeing 737 Max tragedies.
(For brief background, and as a reminder: the Boeing 737 Max has different handling characteristics from previous 737 models, because its engines are in a different place on the wings. This new engine placement increased the tendency of the plane to “pitch up”—that is, to point its nose upward, in a way that could increase the risk of aerodynamic stall. The MCAS system was added to offset this tendency, when detected and when the plane was being hand-flown, by automatically pointing the nose back down. The main hypothesis about last fall’s Lion Air crash, in Indonesia, is that this MCAS system went out of control, because of a failed sensor reading, and pushed the nose down, down, down, until the plane plunged into the sea. The main question after that crash was whether the Lion Air pilots had been appropriately informed about how MCAS worked, and trained on how to turn it off. No one yet is sure whether the same problem was part of the recent Ethiopian Airlines crash.)
Magathan says this about training, design flaws, and who should be grounded, when:
-Boeing’s design deficiency [JF note: having the MCAS rely on a single data source, the “angle of attack” indicator, without backup or comparative sensors] sets up the need for pilot training on how to overcome it.
-Boeing’s failure to highlight the change resulted in no specific MCAS pilot training.
Those two big mistakes, it now appears, likely caused two tragic major catastrophes. Shame on Boeing if the final analysis bears these points out.
The corrective action is simple and within the capabilities of any competent airline captain to execute. Certainly easier than dealing with an engine fire or loss of multiple hydraulic systems.
There is a broad spectrum of abilities in any group of pilots, and without an emphasis training, some of them will be unable to overcome the design deficiency, even if the emergency procedure is simple to carry out. All the lights and buzzers going off will freeze the less capable pilot who has not been trained to drill down to what is going on, and to flip the switch. Training has to be to the lowest level of ability, if you’re operating an airline with any significant number of pilots. They all can't be Sully Sullenbergers.
To me, from the standpoint of an airline pilot, there was no need to ground the fleet. Just ground each and every 737MAX pilot until he or she has been trained on the MCAS.
After two accidents, require a week in the simulator—for overkill to make sure it penetrates even the dimmest bulbs. But nobody flies again until they have it. In effect that grounds the fleet, but only so long as the training takes. At the same time, regulatory bodies can require Boeing to eliminate the design deficiency so that the training on the MCAS need not be so intense, a process that could take months if not years.
But if I were speaking as a non-flying member of the public, and as a politician who must answer to them, I would say: ground the fleet now. As far as the public is concerned, the industry had its chance and blew it. I would have no confidence in the plane nor the industry until an explanation is found and the design changed. Nor would I buy a ticket on such a plane.
Once the public pressure became too great, the grounding of the fleet was inevitable—but not because the plane is unsafe when flown by a properly trained crew. Boeing will pay a price for this, if the final analysis holds these accidents would not have occurred in a 737 model that had no MCAS.
Obviously (as I know from the inbox) other pilots and engineers have a range of views. But I thought this was a particularly lucid description of the relationship between technology and training, and about the difference between views from inside the industry and reactions from outside.
Please read on for another message from another airline pilot, which has just come in.
I have heard from a person who now flies 737s as a captain for a major U.S. airline, and who has worked over the decades as a crash investigator on projects for NASA, the FAA, and the Air Lines Pilots Association. In those roles, he says, he has “read and analyzed thousands of ASRS reports.” He has a cautionary note about current coverage of the 737 Max.
He begins by referring to some of the ASRS reports I was quoting, including one that is harshly critical of Boeing (and that has been cited in many newspaper reports). This pilot writes:
It seems to me that the media in general has grossly, and frankly irresponsibly, mischaracterized this data.
I believe it is almost certain that the two reports [JF note: among those I quoted] describing a pitch down when the autopilot was engaged are describing the same event; one is from the captain, one from the FO [First Officer — the pilot sitting in the right-hand seat in the cockpit, and with three strips on the epaulet, versus four for the captain]. This is an artifact of the ASRS de-identification structure [i.e., removing personally identifying info from the reports].
In any event, MCAS is not supposed to be operative with the autopilot engaged. Further, when MCAS operates, it will move the pitch trim wheel. Neither report discusses any unwanted trim motion. Ergo, this does not represent an actual MCAS malfunction. It would actually have been useful to know whether this crew made any maintenance logbook entries about this incident.
The report discussing the auto throttle malfunction also has no bearing on MCAS; there is no relationship between them.
I could go on at length about my concurrence with the report discussing Boeing’s failure to include the MCAS material in the [flight manual]; however, that report also does not represent an actual MCAS malfunction. Ditto for the first officer who felt unprepared.
There was an additional report included in the original package put out by various media outlets, which you did not include. I assume that’s because you have done your own homework … This one described an intermediate level off at FL 340 when they had been cleared to FL 360; this occurred because the crew had failed to update the FMC [Flight Management Computer] with the new cruise altitude. Everybody has done that at one time or another. This, too, has no bearing on the MCAS problem.
It has been enormously distressing for me to see material such as these ASRS reports used as proof that there was some kind of hidden problem being covered up by the powers that be. That may still be true (I rather doubt it, but in the accident investigation world, rule no. 1 is never fall in love with your pet theory). We have a real problem here, and its resolution will require accurate, careful and probably very technical analysis. The media firestorm has created a very difficult atmosphere within which to do that work.
At this point, the principal problem we face in resolving the issue lies in defining the criteria we will use to return the Max to flight status. Unlike the previous groundings of the DC-10, ATR, Concorde and 787, the Max was grounded without any clear technical understanding.
As such, there is no clear technical path to follow in order to restore it to flying. If the Ethiopian accident does indeed mirror the Lion Air case (which I also consider very unlikely, but…) then that path will be clear but very, very painful and arduous.
If, on the other hand, the two are not related, then we will have to develop a technical rationale for returning the aircraft to flight with not one, but two unrelated and still open accident investigations. We are really in uncharted territory….
For example, if, as Simon Hradecky has reported on his Aviation Herald website, the Ethiopian crew encountered an unreliable airspeed situation, then a poor handling of that condition could have actually triggered a genuine, proper operation of the MCAS. The presence of that data point in the DFDR data [Digital Flight Data Recorder, roughly approximating “the black box”] will muddy the waters almost impossibly for the media, politicians, and certainly for Trump. And yet it would represent a scenario very different from what we know so far about Lion Air.
I’ll add that while this has been going on, we also have an open investigation into the Atlas 767 crash at Houston. [This was a cargo flight crash, near Houston, last month that killed the three crew members aboard. But it was in a type of plane, a Boeing 767, also used by airlines.]
In that case, we know that some manner of elevator deflection led to a pitch down to 49˚. There are plenty of 767’s still flying passengers, so this, too, is a very critical investigation. Yet, as far as I can tell, the NY Times has not run a single story on this that has not been authored by either Reuters or the AP. [JF note: The Washington Post has also mainly run AP coverage; the Wall Street Journal has had some stories by its own staff.] This is incredibly disturbing, as it strongly suggests a primary interest in body count and sensationalism, as opposed to genuine public interest.
Thanks to these two pilots. More to come.