rheinwaldner wrote:

So we can remove them from the equation and focus on the MAX.

Only if your prime focus isn't safety. Only if crashes with other types are acceptable. Ignoring a wake-up call that cockpit skills have been allowed to lapse isn't a virtue.

Francoflier wrote:

Please explain where ET's training is lacking and how it lead to the crash.

I hope this isn't a serious question.

kalvado wrote:

Given that there is something else wrong with the plane..

Hopefully you do not mean the bit flip issue or the small trim wheels.............

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

par13del wrote:

kalvado wrote:

Given that there is something else wrong with the plane..

Hopefully you do not mean the bit flip issue or the small trim wheels.............

I mean that increased yoke force is not the only thing happening. Airspeed disagree. Stick shaker. Sound of an impact from the bird... Or drone.... Or missile? How far did damage go? Why plane is moving nose down? What it destroyed? Did it also took out parts of the wing? Or stabilizer? Did the impact go down to electronics bay causing strange things? Maybe it was lightning frying electronics?
Confusion takes valuable seconds. Everything can be sorted out - it is the dact that there are also controls actuation during confusion period is the biggest problem.

planecane wrote:

rheinwaldner wrote:

morrisond wrote:

It seems like the amount of time to modify the MAX (isn't it being quoted as 120 hours?) seems a lot more than is needed to just load software and prepare the planes for flight.

I can imagine that the new electronic architecture requires hardware changes. I only wonder why they dont need a full regression test if the changes go so deep.

It has been stated multiple times (including reports with quotes) that the 120 hours is due to all the work to prepare the aircraft to return to service after being in storage so long that would be required even if there were no changes. There has been no indication of any hardware changes.

One has to wonder why Southwest is willing to, post ungrounding, accept fresh aircraft off the assembly line rather than the stored aircraft that's costing them money every day. I'm thinking if there was a hardware change (eg the electric trim wiring reversion to NG), it would be easier to conceal from public view if they could do it on the stored aircraft while airlines begin "RTS".

Hadn't seen this posted yet, apologies if I'd missed it.

https://www.nytimes.com/2019/10/02/busi ... e=Homepage

2175301 wrote:

Have you been following the "issues" that automated cars have been having during the testing and early production phase. A number of accidents where the driver did not respond fast enough to either a malfunctioning automatic system, or to a condition that the automatic system could not handle that a normal person driving a car would have avoided...

Automation is not always all it's cracked up to be...

Have a great day,

The car thing was an analogy, not a comparison. Yes, there have been a few high-profile accidents with automated cars. But it's a vastly more recent technology with a much, much smaller base of experience.

Automated aircraft are safer, so long as they're designed well. They're almost always designed well. In the case of MCAS, the design was pretty stupid.

sgrow787 wrote:

One has to wonder why Southwest is willing to, post ungrounding, accept fresh aircraft off the assembly line rather than the stored aircraft that's costing them money every day. I'm thinking if there was a hardware change (eg the electric trim wiring reversion to NG), it would be easier to conceal from public view if they could do it on the stored aircraft while airlines begin "RTS".

Same reason why Boeing spent most of their effort on a/c coming off the 787 production line versus repairing the terrible teens, economics.
When the grounding is lifted there will be three sets of 737's, those already delivered to carriers which have been stored in the desert will require the most work, in addition to implementing the fix (not sure if this has to be done by Boeing only) the a/c also has to be prepared for flight, these frames may have been stored at WN's expense with a Boeing reimbursement. The second set of 737's are those produced by Boeing and parked because the airlines cannot take delivery, these may require just as much work as those stored by the airlines, however, from our views of the parking lots, a bit less, but they also have some in Moses Lake so I would say similar work.
The third set are those rolling off the production line with the fix installed, they require no re-work just normal delivery activity, test flights and acceptance.
The contract workers that Boeing are hiring primary focus may be a/c not yet delivered to clients, if the fix is software only and can be done by the airlines, then Boeing can offer additional compensation to the airlines to use their staff, with over 100+ a/c stored, it will take months maybe a year or so to clear the backlog.

dolinja777 wrote:

Hadn't seen this posted yet, apologies if I'd missed it.

https://www.nytimes.com/2019/10/02/busi ... e=Homepage

I read the article early this morning and found it interesting. Of note, the guy who filed the complaint left the company after lodging the complaint, but was recently rehired and is now working on the 777 project. Also, the article does provide an opposing viewpoint which may or may not be relevant. Essentially, the complainant believed Boeing should have installed a "synthetic airspeed" sytem on the Max as a backup if the AOA sensors failed. He states the system was rejected as too costly and it shows that Boeing chose profits over safety A former employee who worked on the project states Boeing executives rejected the synthetic airspeed because it was "too complicated and risky" and further states the complainant "overstated the importance of such a system and understated the complexity of adding it to the 737 Max." He also did not recall Boeing executives citing pilot training as a basis for rejecting the system. Currently, only the 787 has this new system.

All interesting information. What I take away from the article is that you can only add so much new technology to an old design, which supports the argument that perhaps the 737 platform has advanced as far as it can go, and cannot support some modern safety systems.

I wonder if the 777 will have the synthetic airspeed system.

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

All the excuses for Boeing with an attack on the customers. And again the attack pilots.and their training. The next try to push blame from Boeing to everybody else.

As an engineer you should have come near the principle of best practice.

When the idea came to solve the behavior problem of the 737MAX with the MCAS, Boeing could look back on a successful design of a similar system for the 767 tanker.
A MCAS, with multible sensors for redundancy, only single activation when active and easy to counter or switch off with a serious pull on the stick. So everything what the 737MAX MCAS mk 2 should become.

What happened? Do engineers at Boeing not look at was has been done before? Was it to expensive? Needed an upgrade to the avionics? Would have taken to long a time? The engineers that made MCAS for the 767 made redundant right after finishing that design?

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

Then the MAX would have overwhelmed the next crew after a far too short time.

You seem to have missed the meaning of the statistics I have posted. Normally (as an average with all other aircraft) crew failure prevails many times over aircraft failure. In the case of the MAX we have the opposite. We see 33 times higher crash rate than with all other aircraft. As the MAX crews were not trained less than all other crews on average, the aircraft must be the predominant contributor to the horrible crash rate.

In absolute terms, we have the MAX causing a crash due to a technical failure 0.00000779 times per flight or once every 128 thousands flights. This compares to all other aircraft causing a crash due to a technical failure 0.00000003 times per flight or once every 33 millions flights.

AABusDrvr wrote:

I'm curious, for everyone calling for MAX specific training. Have you ever attended a formal simulator type rating course? What exactly do you think should be trained, and how much training time should be spent on it?

Off the top of my mind:
1) revised check-lists (including NNCs)
2) new memory items for safe flight with an inoperative MCAS (i.e. with an "AoA disagree" flag)
3) recovery from severe AND mistrim / high speed upsets (e.g. "rollercoaster" maneuver?)

Since MCAS 2.0 will - hopefully - have 2-channel input sanitation, pilots will never again have to wrestle control out of a MCAS-induced stabilizer runaway. But if you want to be on the safe side, you might add:

4) early recognition of automation-induced stabilizer runaways (this will cover both possible automation failure modes not yet uncovered by the revised FMEA and low-probability double sensors-in-lockstep failures)

I'm surely forgetting other important items - ask the "pilot training is the problem" crowd here - but this already looks to me like too much ground to cover for a 1-hour iPad refresher.

PixelFlight wrote:

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

PixelFlight wrote:

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

The two opinions are not mutually exclusive.

mjoelnir wrote:

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

Maybe because they're human, just like everyone else who messed up and contributed to planes going down. Endless excuses for everyone but one party involved. Why even have pilots in the cockpit if they can't be expected to save a malfunctioning plane with trained procedures? Why spend the money training them for procedures we don't expect them to execute?

rheinwaldner wrote:

Then the MAX would have overwhelmed the next crew after a far too short time.

You seem to have missed the meaning of the statistics I have posted. Normally (as an average with all other aircraft) crew failure prevails many times over aircraft failure. In the case of the MAX we have the opposite. We see 33 times higher crash rate than with all other aircraft. As the MAX crews were not trained less than all other crews on average, the aircraft must be the predominant contributor to the horrible crash rate.

In absolute terms, we have the MAX causing a crash due to a technical failure 0.00000779 times per flight or once every 128 thousands flights. This compares to all other aircraft causing a crash due to a technical failure 0.00000003 times per flight or once every 33 millions flights.

Pure speculation that the next crew would have overwhelmed with following what is assumed they've been trained for.

You're hung up on statistics in order to implement improvements. Stats don't tell us why there was a crash. From available information, we know the factors that caused the crashes and hence grounding. Correcting only one area of failure isn't acceptable in my view, and I hope it's not in yours.

morrisond wrote:

PixelFlight wrote:

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.
[...]
Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

Thanks for the interesting post, and apologies for the selective quoting.

I disagree with you on one point: IMO Boeing's key error was designing a control automation with unlimited authority, a single input channel and no input sanitation. All subsequent errors and omissions (in risk classification, FMEA, testing, qualification, certification, documentation, etc.) are all rooted in that original f***up of which, with your qualifications, I'm sure you can appreciate the exceptional magnitude.

A question for you: did you ever work with an automation vulnerable to catastrophic control runaway on a single failed sensor? A controller that - entirely by design, the only problem being a single failed sensor - would have destroyed an otherwise healthy plant unless a human operator intervened by manually cutting off the controller within a very limited time frame (a few seconds)?

Since you say you can believe this was a genuine error, I would really appreciate if you could share some real world examples out of your experience.

MSPNWA wrote:

Endless excuses for everyone but one party involved. Why even have pilots in the cockpit if they can't be expected to save a malfunctioning plane with trained procedures? Why spend the money training them for procedures we don't expect them to execute?

What I really want to see, hidden by all proprietary/confidential/personal data, are the stamps on MCAS paperwork. THere should be a personal PE stamp and signature for design, there should be a personal stamp or signature of FAA representative, there should be a personal QC stamp.
If you think about it, unlike pilots, who are not even burried in one piece, these are people working somewhere, their qualifications are not suspended, they may be on some other airspace project, including 777x today.
This is the worst part of it - people are calling for personal responsibility of CEO, or blaming pilots - but not even naming true murderers, who couldn't do their job in zero airspeed office!

MSPNWA wrote:

Maybe because they're human, just like everyone else who messed up and contributed to planes going down. Endless excuses for everyone but one party involved. Why even have pilots in the cockpit if they can't be expected to save a malfunctioning plane with trained procedures? Why spend the money training them for procedures we don't expect them to execute?

Please provides the list of trained procedures that could have saved ET302.

PixelFlight wrote:

morrisond wrote:

PixelFlight wrote:

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

Just my opinion, since every issue we are discussing right now are only opinions, as an airline pilot with experience in the 737, as well as airbus 320 series, and several other transport airplanes over the years. The issue isn't 737 type specific training here, it's the quality primary training, or rather lack of it thats the issue.

I don't understand why the Lion air crew watched the airplane trim AND 22 times, correcting with manual stab trim after every time, and then not doing the only appropriate QRH procedure. If nothing else, they should have known that if the automation keeps doing something you don't want it to do, you disconnect, or disable that system. What kind of transfer of control did they do, when the ca gave the airplane to the fo? It obviously wasn't good enough, because the fo lost control of the airplane, shortly after the ca gave it to him, after the ca did a respectable job of flying the airplane for several minutes.

IMHO the ET crew wasn't flying the airplane, it was flying them. The absolutely wrong thing to do was leave the auto throttles engaged, and try and engage the autopilot. Calling "stab trim cutout" twice, and then switching off the trim cutouts isn't "preforming the NNC", it's a panic response. Unless the CVR shows a proper challenge/response, and completion of the entire procedure, then I'll gladly retract that statement.

When you push out very low time pilots, with more simulator time, than actual aircraft flight time, you end up with good systems operators, that never really learned how to fly airplanes. And even the airbus can end up in a situation where it flies like every other non FBW airplane. The crowd will argue that 1500 hours in a Cessna doesn't mean anything, yes it does, it teaches you how to actually fly, not just manage automation. Both are important skills, some will argue automation management is more important in the modern airline pilot. It may be, right up to the point that the automation quits doing it's job properly, then you had better have some actual flying skills.

AABusDrvr wrote:

PixelFlight wrote:

morrisond wrote:

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

Just my opinion, since every issue we are discussing right now are only opinions, as an airline pilot with experience in the 737, as well as airbus 320 series, and several other transport airplanes over the years. The issue isn't 737 type specific training here, it's the quality primary training, or rather lack of it thats the issue.

I don't understand why the Lion air crew watched the airplane trim AND 22 times, correcting with manual stab trim after every time, and then not doing the only appropriate QRH procedure. If nothing else, they should have known that if the automation keeps doing something you don't want it to do, you disconnect, or disable that system. What kind of transfer of control did they do, when the ca gave the airplane to the fo? It obviously wasn't good enough, because the fo lost control of the airplane, shortly after the ca gave it to him, after the ca did a respectable job of flying the airplane for several minutes.

IMHO the ET crew wasn't flying the airplane, it was flying them. The absolutely wrong thing to do was leave the auto throttles engaged, and try and engage the autopilot. Calling "stab trim cutout" twice, and then switching off the trim cutouts isn't "preforming the NNC", it's a panic response. Unless the CVR shows a proper challenge/response, and completion of the entire procedure, then I'll gladly retract that statement.

When you push out very low time pilots, with more simulator time, than actual aircraft flight time, you end up with good systems operators, that never really learned how to fly airplanes. And even the airbus can end up in a situation where it flies like every other non FBW airplane. The crowd will argue that 1500 hours in a Cessna doesn't mean anything, yes it does, it teaches you how to actually fly, not just manage automation. Both are important skills, some will argue automation management is more important in the modern airline pilot. It may be, right up to the point that the automation quits doing it's job properly, then you had better have some actual flying skills.

I suspect this is what is called "survivor bias".
How many of the flights you operated were emergencies? ANd I mean not routine low fuel or go-around, but something that made it to, lets say, avherald?

morrisond wrote:

PixelFlight wrote:

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

Yes,the training for 737MAX pilots, that Boeing cut to the bone to spare themselves and the airlines cost. The training on MCAS that Boeing kept hidden. The training on 737MAX simulators, that were purposefully limited by Boeing, so they could not be used to train for MCAS and its failure modes.
Boeing sold minimal training for the 737MAX especially to Southwest,agreeing to pay 1 million USD for every delivered 737MAX frame if simulator training would become necessary. A similar story for Norwegian.

Can we talk about why the 737MAX is grounded? It is definitely not because of pilot training, but because of a bad design by Boeing.

AABusDrvr wrote:

Just my opinion, since every issue we are discussing right now are only opinions, as an airline pilot with experience in the 737, as well as airbus 320 series, and several other transport airplanes over the years. The issue isn't 737 type specific training here, it's the quality primary training, or rather lack of it thats the issue.

Safety improvement is not based on opinions, but on facts. Safety certification is a very formal process that left no place to opinion. http://www.flightlearnings.com/system-safety-process

kalvado wrote:

AABusDrvr wrote:

PixelFlight wrote:

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

Just my opinion, since every issue we are discussing right now are only opinions, as an airline pilot with experience in the 737, as well as airbus 320 series, and several other transport airplanes over the years. The issue isn't 737 type specific training here, it's the quality primary training, or rather lack of it thats the issue.

I don't understand why the Lion air crew watched the airplane trim AND 22 times, correcting with manual stab trim after every time, and then not doing the only appropriate QRH procedure. If nothing else, they should have known that if the automation keeps doing something you don't want it to do, you disconnect, or disable that system. What kind of transfer of control did they do, when the ca gave the airplane to the fo? It obviously wasn't good enough, because the fo lost control of the airplane, shortly after the ca gave it to him, after the ca did a respectable job of flying the airplane for several minutes.

IMHO the ET crew wasn't flying the airplane, it was flying them. The absolutely wrong thing to do was leave the auto throttles engaged, and try and engage the autopilot. Calling "stab trim cutout" twice, and then switching off the trim cutouts isn't "preforming the NNC", it's a panic response. Unless the CVR shows a proper challenge/response, and completion of the entire procedure, then I'll gladly retract that statement.

When you push out very low time pilots, with more simulator time, than actual aircraft flight time, you end up with good systems operators, that never really learned how to fly airplanes. And even the airbus can end up in a situation where it flies like every other non FBW airplane. The crowd will argue that 1500 hours in a Cessna doesn't mean anything, yes it does, it teaches you how to actually fly, not just manage automation. Both are important skills, some will argue automation management is more important in the modern airline pilot. It may be, right up to the point that the automation quits doing it's job properly, then you had better have some actual flying skills.

I suspect this is what is called "survivor bias".
How many of the flights you operated were emergencies? ANd I mean not routine low fuel or go-around, but something that made it to, lets say, avherald?

I've declared five emergencies while flying for the airlines, for other than medical reasons. Three were what I'd call "I want to be on the ground right now" events. One is actually on Avherald, the other two happened before the internet was a thing.

AABusDrvr wrote:

I've declared five emergencies while flying for the airlines, for other than medical reasons. Three were what I'd call "I want to be on the ground right now" events. One is actually on Avherald, the other two happened before the internet was a thing.

Avherald reference ?
Today's Internet give access to incidents before it was a thing: https://aviation-safety.net/database/

"The ASN Safety Database, updated daily, contains descriptions of over airliner, military transport category aircraft and corporate jet aircraft safety occurrences since 1919.
Airliners are considered here aircraft that are capable of carrying at least 12 passengers."

And if your emergencies are still not there, you can add them yourself: https://aviation-safety.net/wikibase/
Some are back to 1902 !

mjoelnir wrote:

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

All the excuses for Boeing with an attack on the customers. And again the attack pilots.and their training. The next try to push blame from Boeing to everybody else.

As an engineer you should have come near the principle of best practice.

When the idea came to solve the behavior problem of the 737MAX with the MCAS, Boeing could look back on a successful design of a similar system for the 767 tanker.
A MCAS, with multible sensors for redundancy, only single activation when active and easy to counter or switch off with a serious pull on the stick. So everything what the 737MAX MCAS mk 2 should become.

What happened? Do engineers at Boeing not look at was has been done before? Was it to expensive? Needed an upgrade to the avionics? Would have taken to long a time? The engineers that made MCAS for the 767 made redundant right after finishing that design?

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

This all supports the notion that Boeing knew they couldnt, or couldn't easily, implement dual AOA on the Max, and they knew it early. One could argue at or just before their G + AOA design attempt (MCAS 0.0). If this is proven true, then its not a very far hop to say their pilot performance assumptions were pure fabrication to fill a gap in their risk assessment, rather than a real sincere assumption that people here are making it out to be.

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

MCAS V1 as implemented wouldn't meet FAR25.267, regardless of wether hazard classification is "major" or "catastrophic" . It would be interesting to see the paperwork that traces to "Reset" portion of MCAS logic. The reset logic allowed multiple increments of MCAS activation, without output limit in place.

What's the status on manual trim effort issue?
Are they going to re-enable electric trim at high speed and meet dive recovery requirement some other way?

sgrow787 wrote:

mjoelnir wrote:

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

All the excuses for Boeing with an attack on the customers. And again the attack pilots.and their training. The next try to push blame from Boeing to everybody else.

As an engineer you should have come near the principle of best practice.

When the idea came to solve the behavior problem of the 737MAX with the MCAS, Boeing could look back on a successful design of a similar system for the 767 tanker.
A MCAS, with multible sensors for redundancy, only single activation when active and easy to counter or switch off with a serious pull on the stick. So everything what the 737MAX MCAS mk 2 should become.

What happened? Do engineers at Boeing not look at was has been done before? Was it to expensive? Needed an upgrade to the avionics? Would have taken to long a time? The engineers that made MCAS for the 767 made redundant right after finishing that design?

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

This all supports the notion that Boeing knew they couldnt, or couldn't easily, implement dual AOA on the Max, and they knew it early. One could argue at or just before their G + AOA design attempt (MCAS 0.0). If this is proven true, then its not a very far hop to say their pilot performance assumptions were pure fabrication to fill a gap in their risk assessment, rather than a real sincere assumption that people here are making it out to be.

The 767 had a completely different FCC architecture to start with. I would guess that on the 767 (I do not know this for a fact) the two AoA sensors were already checked against each other for their other functions.

It wasn't that difficult to implement the dual sensor solution on the 737 as evidenced that they had it done within a few months. The last several months of the grounding have been created by the bit flip issue causing a major architecture change in the software. The bit flip issue wouldn't have come up if they had gone 2 sensors from the beginning.

PixelFlight wrote:

Please provides the list of trained procedures that could have saved ET302.

No. If you need to be fed this information after extensive participation in these threads, I don't trust your motive for asking.

kalvado wrote:

I suspect this is what is called "survivor bias".
How many of the flights you operated were emergencies? ANd I mean not routine low fuel or go-around, but something that made it to, lets say, avherald?

I suspect this to be "shooting the messenger".

I couldn't agree more with AABusDrvr's opinion. We have people in the cockpit that are at the mercy of automation. It goes both ways. Just like we can't rely on pilots to compensate for bad designs, we also can't rely on design compensating for poor pilot skills.

AABusDrvr wrote:

… The crowd will argue that 1500 hours in a Cessna doesn't mean anything, yes it does, it teaches you how to actually fly, not just manage automation. Both are important skills, some will argue automation management is more important in the modern airline pilot. It may be, right up to the point that the automation quits doing it's job properly, then you had better have some actual flying skills.

In principle there is nothing wrong with what you write here. But how is it relevant on this thread about 737MAX grounding?

A fault in the automation tranforms the plane into a kamikaze plane, leaving the yoke mostly useless. In that situation one hour reading the manual is worth a lot more than 1500 Cessna hours, or 15 million Space Shuttle hours. What is needed is exactly an automation system manager who knows his systems in and out.

That of course is only possible when the systems are actually fully and correctly described in the manual.

Yes, we shall always try to improve training. But how is that "on topic" in a thread about 737MAX grounding? It belongs in a thread about airliner flight crew training.

The 737MAX is not grounded due to training issues. I am, however, afraid that the reason for grounding is purely due to the crashes. In a better world its faults would have been discovered independent of the crashes, or at least after the first crash, and then have initiated the grounding.

Let's get that plane fixed, and then continue to improve training procedures for Boeing and Bus drivers, or whatever you drive. And remember, the days are over when only a "stick and rudder man" saves the day. You need to know exactly how the systems behind the panels work. You need to be a proficient systems manager. That is often a lot more important than 1500 hours behind a Cessna yoke. Or 15,000 hours reading yesterday's newspaper behind a 777 yoke.

klm617 wrote:

SFOtoORD wrote:

klm617 wrote:

I think it's very telling that the FAA wants the new system to be trained on by 'Average pilots" meaning to me that the lack of understanding and awareness in the cockpit was a very large contributing factors in the 2 MAX 8 crashes. I see this as similar to letting your 14 year old child drive your new Ferrari and some point you are just asking for trouble.

The analogy only works if the 14 year old was required to have passed a drivers written and practical test and to have had 1000s of hours driving and years behind the wheel first. If not it’s an insult to the capabilities of your average professional airline pilot.

Sorry but I really don't want to trust my safety in getting from point A to point B in the hands of just an average commercial airline pilot.

Maybe you meant a Ferrari Formula 1 car in your analogy ? That most people couldn't drive (you need a whole team just to start it anyway).

In some countries, you can drive a car with minimal training. I don't know a country where you can fly a plane without significant training, and of course for an airliner it's much more than that.

An airliner has lots of complicated systems, but here we're talking about basic control surfaces, that are the same on pretty much all airplanes, from your ultralight built in a garage to an A380.

Pilots, even below average ones, should be able to fly the plane using these surfaces (and engine controls), and the aircraft shouldn't make that difficult in any way.

That last point is the problem with these accidents.

mjoelnir wrote:

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.

I do not believe it was intentional; and I can see how the mistakes happened (and having set up testing in nuclear plants for scenarios after modifications - where we commonly use the worst case "most bounding" test case - I really understand how it happened (and wonder what I missed in my past); and I believe that no one had asked which scenario produced the most alarms or other indications before in the nuclear world - of course during any major issue you have dozens if not hundreds of alarms flashing and screaming on a power plant control board). However, once they improperly classified an MCAS failure as only "major" then the rest that followed is just part of normal business practices to minimize cost for Boeing and Airlines. I fully believe that Airbus would have done very similar things for systems or issues that they classify at a similar level. The Key Error was the incorrect safety classification.

At the same time, I believe that in many cases that the Airlines have shortchanged procedures and training requirements to the minimal level needed to fly an aircraft - assuming no unusual issues; which is not realistic either and I do believe contributed to both the Lion Air and Ethiopian Crashes.

While I am not a licensed pilot. I did learn to at least fly a single engine piston 2 seat aircraft as a teenager (excluding landings - but did progress to take offs). I also practiced a lot in a WW II simulator that the CAP had (and fell off its stand if you tilted it too far - crash...). I do not recall any alarms at that level of aircraft. You were expected to be able to read the gauges and feel the aircraft and know what to do.

In my working experience with US Navy engine rooms and fossil (including gas turbine) then nuclear power plants I have operated, maintained, held various supervision, management, and engineering positions in plants that only had 2 alarms (low boiler water level, low lube oil pressure on Main Engine or Main Turbine/Generator) to alarm panels with hundreds of alarms and indications for a unit. I've worked with the most basic mechanical/hydraulic/pneumatic control systems to fiber optics and digital control systems (and effectively have an engineering minor in control technology). I've watched Power Plant controls go from where the operator ran everything manually, to each system had its own controller, to fully integrated computer control of everything, and its interesting to note that the newest power plants are going back to each system having its own controller as the fully integrated computer systems have never worked that well (and the operators tend to just trip the plant at even minor problems because they don't know how to operate things in a more manual mode). Of course, power plants have more room for alarm boards and people than do aircraft; and tripping the unit will not normally cause any harm to either equipment or personnel - unlike an aircraft which would fall out of the sky.

I've what would be considered high level engineering modification and testing experience of nuclear safety systems - and the processes parallel aviation in virtually every respect; I spent years on a nuclear plant human performance committee and am one of the few engineers at my plant who became root cause investigator qualified (same qualification that the NTSB uses).

So, I can see how the engineers at Boeing made a mistake in not including all the possible alarms. They tested what they thought was the worst case (fully runaway MCAS) without identifying which case would produce the worst alarm situation, and including those alarms. I am sure that will never happen again. I do not expect them to test every possible case in the future; but, do expect them to test the ones with the worst alarm situations. I find it interesting that the NTSB feels that the same situation may apply to other manufactures in other countries based on their recent report. They are more likely to know than anyone on this forum.

Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

The FAA followed their procedures, and I note that EASA did not identify the Airbus edge of envelope flight stability issues either that was found after the 737Max crashes and questions about flight envelope response (which I believe is why Airbus looked at it). The Airbus FMEAs did not identify the issue either. So, please be careful about criticizing the FAA without questioning if other certification organizations do not use similar methods and are subject to similar possible failures to catch issues.

However, I do not understand why there were not some kind of procedures at Lion Air (or compliance with such procedures) that would have had the pilots from the previous flight the day before describe the failure and flight control issue they had - and the solution - to any subsequent pilots flying the aircraft. I believe that is primarily the fault of the Airline (Lion Air). Had such communication occured I doubt that any Lion Air crash would have occured; and Boeing could have been clued in on the problem without loss of life and an aircraft.

I do not understand why the Ethiopian Training on the AD after Lion Air was done the way it was. Again, I believe that is primarily the fault of the Airline (Ethiopian).

While I suspect that there may have been certain aspects of Pilot and Co-Pilot behavior that may (note I said MAY) have involved individual errors; that is far less certain at this point - and no aircraft should crash based on normal minor human errors (you should be able to recover from those).

I also do believe that there is ample evidence from recent years that the Pilots and Co-Pilots are indeed lacking in basic flight skills; and increased training is appropriate (too many perfectly good aircraft have been crashed; what would happen in the event of even a minor issue?). I also believe that all that is mainly needed to provide adequate increased training would likely be if each Pilot and Co-Pilot was required to fly an entire flight (from take-off to landing) manually say once every 3 months (perhaps they could be relived in steady flight by their counterpart for a meal/restroom break). They should feel quite comfortable turning off the computers and flying manually. It also allows them to gain a feel for the aircraft.

I believe that many people use the term "Pilot/Operator Error" incorrectly. In the vast majority of cases its really improper procedures or training - which are the responsibility of the companies. I've certainly done enough nuclear plant event investigations to really know how often that is true (and only concluded once that the main factor was "operator error" - which launched a full criminal investigation by the FBI/NRC and I received one of those do not destroy any documents or records emails and spent months working with a major law firm's lawyers).

So, I do believe that there really is something here involved in these two crashes involving MCAS that involves inadequate training, and also inadequate procedures at the airline level.

Remember, it is extraordinarily rare for their only to be a single significant cause behind any major event. The industry has had a few Pilot suicides where the Pilot (Co-Pilot) wanted to take an aircraft and all the passengers and crew with them, and a few terrorist bombings. Those are about the only cases I can think of off the top of my head. Even the 2 cases of aircraft being shot down by military missiles likely have a sequence of errors behind the launch of the missile. I know that the US Navy investigated their situation and took actions to minimize that from occurring again.

Have a great day,

All the excuses for Boeing with an attack on the customers. And again the attack pilots.and their training. The next try to push blame from Boeing to everybody else.

As an engineer you should have come near the principle of best practice.

When the idea came to solve the behavior problem of the 737MAX with the MCAS, Boeing could look back on a successful design of a similar system for the 767 tanker.
A MCAS, with multible sensors for redundancy, only single activation when active and easy to counter or switch off with a serious pull on the stick. So everything what the 737MAX MCAS mk 2 should become.

What happened? Do engineers at Boeing not look at was has been done before? Was it to expensive? Needed an upgrade to the avionics? Would have taken to long a time? The engineers that made MCAS for the 767 made redundant right after finishing that design?

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

The KC 767 Tanker uses a much more modern control computer and systems with much more capability. Actually, I understand a version of what is in the 787. Previous post on this site indicates that it is based off of the Intel 80286 chip. I have not been able to find an easy reference for that.

However, the 737 computer is based of of a Motorola 68040; running 60 Mhz, with 4 MB static Ram, and 32 MB for program and database.

http://www.b737.org.uk/fmc.htm

I note that I have found other references that state the same for the 737 computer.

I am fully aware of the concept of best practice... It is not generally a good practice (and certainly not the best practice) to take a program written for a larger faster computer, and then expect it to operate on a smaller slower computer. I think my engineering understandings are intact.

Also, retrofitting in a 787 style cockpit and computer into the 737 would be a very major mod with many more risks than just the MCAS system.

Have a great day

AABusDrvr wrote:

The crowd will argue that 1500 hours in a Cessna doesn't mean anything, yes it does, it teaches you how to actually fly, not just manage automation. Both are important skills, some will argue automation management is more important in the modern airline pilot. It may be, right up to the point that the automation quits doing it's job properly, then you had better have some actual flying skills.

That’s about like saying someone who drove a car for a longer amount of time than someone else would make a better heavy haul truck driver. It could be true, but it too easily could not be true.

Take someone who has 1500 hours piddling around in their C172. After a few hundred hours after they get the licenses what they’re really doing is flying around by themselves probably building bad habits because they’re not under supervision of a company with SMS, SOPs, and training programs with recurrency testing/training; furthermore, Flying a 737 is nothing like flying a C172, if it were you have single crew member 737 flights and you wouldn’t need type ratings or type specific training. I could fly in circles in smooth, stable air for 1500 hours, if I do that, I’ve learned basically nothing. On the other hand I could be flying a Dash 8 or ATR or something like that learning from experienced crew and learning how to handle transport aircraft and also getting used to how a company operates, but I digress, the real issue is the 737 MAX.

I don’t know why we are debating what the real issue is here; the 737 MAX has a design flaw. You can say a different crew could’ve caused the flight to not end in an accident, but you cannot say this with any quantifiable certainty. You could be right, but you cannot measure to what degree. What you can say with 100% certainty is that neither of these flights would’ve ended in an accident of this nature at that stage of the flight had MCAS not existed because then the condition that opens the Pandora’s box doesn’t exist and their lack of knowledge on dealing with exactly what that failed system did is no longer relevant.

2175301 wrote:

The KC 767 Tanker uses a much more modern control computer and systems with much more capability. Actually, I understand a version of what is in the 787. Previous post on this site indicates that it is based off of the Intel 80286 chip. I have not been able to find an easy reference for that.

However, the 737 computer is based of of a Motorola 68040; running 60 Mhz, with 4 MB static Ram, and 32 MB for program and database.

http://www.b737.org.uk/fmc.htm

I note that I have found other references that state the same for the 737 computer.

I am fully aware of the concept of best practice... It is not generally a good practice (and certainly not the best practice) to take a program written for a larger faster computer, and then expect it to operate on a smaller slower computer. I think my engineering understandings are intact.

Also, retrofitting in a 787 style cockpit and computer into the 737 would be a very major mod with many more risks than just the MCAS system.

Have a great day

Your talking about the FMC which has nothing to do with with MCAS. The FMC is like the GPS on your car, MCAS is more like the computer that controls ABS.

This MCAS issue is more like a bug in the ABS computer that would lock up the front brakes on a wet corner at high speed. And then blame the driver for not being skilled enough to stop the car from going off the side of the road and crashing.

The driver should have known while travelling out of control at high speed with their front brakes locked up that they could pull a fuse out from under the dash and apply the emergency brake. It’s the drivers fault, not the car.

There is a real lack of reality with the expectations some people have with pilot responses.

Another Seattle Times scoop:
Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts.
It argued full compliance with the latest federal requirements would be “impractical” for the MAX and would cost too much.

https://t.co/KF0NsGCHLT

Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts

Damning evidence that Boeing put a price on safety.

morrisond wrote:

PixelFlight wrote:

morrisond wrote:

If training at ET had been better it's quite possible ET302 would never have happened.

EASA opinion (certainly more relevant than your):

"Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint."

Please ignore then the calls from the FAA, NTSB and Airbus that Pilot training needs to be improved.

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not. Neither were they in AF447 which the NTSB singled out as Airbus not having learned lessons from that either. So you either have to change the standards (lower them) or improve the training.

It's very simple.

Nice to see someone pointing out the root cause of the crashes - substandard pilots that flew a perfectly fine airplane into the ground because they failed to identify a simple fault and failed to work through a very simple memory item.

Revelation wrote:

Thus you show the fallacy of your 260x statistic: it compares the unfixed MAX to planes that had problems that got fixed and flew for decades.

In statistics you can compare things like they are. And having a crash causing failure rate, which is 260 times worse than normal, is where the MAX currently stands.

And what kind of weird mentality would cry foul because we compare the unfixed MAX with fixed aircraft? No other modern aircraft was ever "unfixed" on the level how the MAX was.

Revelation wrote:

Your words show that even you don't believe the implication of the 260x result, because you say MAX will converge to the norm once the fix is applied.

I absolutely stand behind my calculation. Its devastating for the MAX and shows at the same time, that the same crew proficiency, that was good enough to have excellent safety in aviation overall, played no role in the grounding.

Also in mathetmatics you don't "believe" in things. With my calculation I made a claim, which could be challenged, but so far nobody tried. Even those of my assumptions, which could be some percent off were not challenged. Anyway I consider it close to impossible to challenge the magnitude of this "260 times worse" factor. Therefore the implication stands. The MAX has a horrible safety record, has a crash causing failure rate 260 times higher than normal.

And finally, for the MAX to converge to the norm, you need to apply tricks by avoiding the first two years after EIS from the observation time span.

morrisond wrote:

I am not disputing that the MCAS isn't flawed it is - however what the crashes have shown is that training is lacking as well.

Under the existing standards Pilots were assumed to be able to handle an emergency of this type. Obviously they were not.

The assumption was wrong, not the pilots. The pilots were as good as any NG pilot is. But with NGs, the same pilot proficiency does not result in the horrible safety record, that the MAX got.

Also the existing standards are not at fault (-> see aviation safety sans MAX).

If you are really accurate, you have to say, that the existing standards and the pilots are not the problem. The problem was, that the nature of this emergency and how it was presenting itself was not at all understood by Boeing when they built MCAS V1. Lack of proficiency in Boeings design halls would be the correct verdict.

MSPNWA wrote:

You're hung up on statistics in order to implement improvements. Stats don't tell us why there was a crash. From available information, we know the factors that caused the crashes and hence grounding. Correcting only one area of failure isn't acceptable in my view, and I hope it's not in yours.

The stats help me to understand the following:
If the MAX would not have been as broken as it was, crews with average proficiency would have brought it down once every 4.7 million flights. Like crews with average proficiency do with all other modern aircraft types. But, as the MAX was flawed, it came down once every 0.25 million flights. One crash every 4.7 million flights to be expected by the given crew proficiency vs. one crash every 0.25 million flights by the MAX defects. Where do you see the most leverage?

Can't you see, that once the MAX will be fixed, it will be in line with the other aircraft again? Safety will be as good again as it was before the MAX. Arguably you can try to tackle the "One crash every 4.7 million flights by crew failure" but it will have nothing to do with the MAX then.

The MAX was broken, has devastating safety stats, is therefore grounded, requires a fix and will after the fix be fine again.

jollo wrote:

2175301 wrote:

Lets start my comment by stating that I believe Boeing messed up the original MCAS version on the 737Max. For that they are responsible.
[...]
Thus the pilots were overloaded beyond the test conditions used. Boeing is in my opinion responsible for that error.

Thanks for the interesting post, and apologies for the selective quoting.

I disagree with you on one point: IMO Boeing's key error was designing a control automation with unlimited authority, a single input channel and no input sanitation. All subsequent errors and omissions (in risk classification, FMEA, testing, qualification, certification, documentation, etc.) are all rooted in that original f***up of which, with your qualifications, I'm sure you can appreciate the exceptional magnitude.

A question for you: did you ever work with an automation vulnerable to catastrophic control runaway on a single failed sensor? A controller that - entirely by design, the only problem being a single failed sensor - would have destroyed an otherwise healthy plant unless a human operator intervened by manually cutting off the controller within a very limited time frame (a few seconds)?

Since you say you can believe this was a genuine error, I would really appreciate if you could share some real world examples out of your experience.

Thank you Jollo: To answer your question: Yes, I have been personally involved where a single failed sensor caused a potentially catastrophic event; and I have seen some really weird situations where it could have related to nuclear safety related on grandfathered systems that were "improved" to be closer to modern standards; which I believe is directly relevant to the 737Max issues.

The 1st case is not per say safety related, but certainly dangerous enough. Auxiliary boiler in a new base load coal fired power plant. I was writing "workable" operating procedures and "maintenance Isolation procedures" to safely shut down a piece of equipment while the plant was online to work on it, and then bring it back into service without affecting the plant.

This auxiliary boiler was about the size of a 1950's 1500 sq ft 2 story house (main base load power plant boilers are a small city block in size and 30 stories tall). Plant operators asked for me to get involved with it up front as they said it was really scary to start and operate based on the 1 page outline procedure they had been given by the AE. I dug up all the piping, sensors, and controls wiring diagrams and started from scratch. The plant operators trusted me as I operated in the US Navy and they liked my work on the Maintenance Isolation procedures. So the operator turned over the control panel to me to start it up. I mechanically line up all mechanical systems, ensure adequate water level; and hit the "start" button... The boiler immediately fired at 110% - and not the 10-15% it should have for start-up; and I immediately hit the trip button. Lets just say everyone was a little excited... (and the operators told me it had happened to several of them too). Then we started looking: found that one of the sensors was wired into the wrong computer controller input, found a sensor was located at the wrong side of the main isolation valve (would not read boiler pressure - would read pipe system pressure; which did not help if you starting a cold system with that isolation valve closed), and on the 3rd or 4th attempt to start the boiler a week or so later after those were fixed found that a malfunctioning safety sensor (with dual sensors) had a faulty single sensor. I redesigned the entire input and logic circuit (Programmable logic controller).

More concerning - and related to nuclear safety; and in many ways directly relevant to the 737 "improved" grandfather status was that most of my nuclear career was at a nuclear power plant designed before the NRC existed under the rules of the Atomic Energy Commission "Atoms for Peace" program. This power plant had multiple systems "improved" towards modern safety standards... and sometimes there were some real troubles with this.

In almost all cases the AEC and NRC shared similar end goals related to nuclear safety standards. But, how they got to those goals differed a lot in many cases (and someone fluent on the modern methods was often totally lost when presented with an AEC system approach). The NRC did implement a requirement for full dual (and later tipple) redundancy for certain systems for newly constructed plants; which often could not be retrofitted to an older plant even if you wanted to due to space and routing limitations though the maze of concrete walled rooms. Industry events also forced existing plants to do certain modifications (3 Mile Island lessons learned required retrofits on almost all nuclear units).

A key item is that the NRC has a safety classification system for plant events. Red meaning that if something had happened at the plant that it is likely that there would have been a major nuclear accident, and potential significant radiation release to the public. About a decade ago the NRC had issued a total of 3 Red Findings in the US Nuclear Industry with about 100 operating power reactors for several decades. 2 of those were at my plant and while I was there...

I'm not sure I can count the number of modified systems and equipment towards modern standards. My plant was designed as a "Hot Shutdown" plant (only needed to get the reactor to hot shutdown in an emergency). The modern NRC requirements was for a "Cold Shutdown" plant (get the reactor core to cold shutdown status and maintain it there). Our Closed cooling water and spent fuel pool cooling systems were not designed as Nuclear Safety Related. The NRC would not allow the plant to do certain things unless we upgraded those systems... except that it's impossible to get them to modern standards with full duplication of all equipment and piping. So, the piping stayed single train (with improved maintenance and monitoring) and we had to retrofit "safety related" controls onto the systems with as close to modern safety standards control strategies as reasonably possible (let's just say that did not always go so well - and yes we ran into cases where the failure of a single sensor would have created a real problem and faster than the operators would have normally noticed and responded).

The Auxiliary Feed-water system (adds water to the steam generators after plant trip to evaporate decay heat away during cool-down and in hot standby) was designed as Safety Related under AEC rules; but, the NRC considered it far from adequate for their rules. I think we spent at least $25 Million in modifications - and both of the Red Findings at our plant were related to the Auxiliary Feed water System Modifications not done correctly (and we never changed the base piping or valves).

In the case of the Spent Fuel Pool temperature standards were changed. We had to run a heat exchanger cooling capacity test during refueling when we had a "hot" full core offload which also required a cooling water temperature below a certain value; which was not normally a problem as refueling outages were in the late fall or spring (and we have winter here). During and early fall outage after a hot summer I figured out ahead of time that we could not run the NRC required test using the existing procedures with the new temperature limits. I had to go to Operations and have them change how they normally operated the system and also how we did the test in order for us to do it (All safety related procedures, etc.).

So yes, I know about single sensor failures in dual sensor systems - when things are not done right; and I also really know just how difficult it is to take an older grandfathered design and modernize it towards modern standards, or replace parts of it that meet modern standards. My personal experience, and everyone I knew at the plant agreed, that this is far more complicated than designing from scratch to the new rules... Yet we had no other economic choice as it was not feasible to upgrade the plant fully to modern nuclear rules (and nothing in our licensing required that).

I've seen a lot of problems up close and personal, and admittedly made some mistakes myself that other caught before field implementation.

As it relates to MCAS - I can really see how it could happen by people just making mistakes....

Have a great day,

flyingphil wrote:

Another Seattle Times scoop:
Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts.
It argued full compliance with the latest federal requirements would be “impractical” for the MAX and would cost too much.

https://t.co/KF0NsGCHLT

Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts

Damning evidence that Boeing put a price on safety.

There's always a price on safety. The debate has always been and will always be how much.

Interesting article, but it's another red herring distracting from the "simple" mistake that was MCAS 1.0. People are trying very hard to make more out it. To me it can only be called damning if you have a preconception and are looking for something damning.

seahawk wrote:

Nice to see someone pointing out the root cause of the crashes - substandard pilots that flew a perfectly fine airplane into the ground because they failed to identify a simple fault and failed to work through a very simple memory item.

Their point is not very valid. ET has a very good training system, their pilot and corporate standards are very high. Higher than many western airlines. That crew tried everything, and when the memory procedure did not work as they did not have enough strength to move the controls, they tried to think out of the box and turned the electric motors back on for assistance.

That aircraft was in an undesirable state because of a problem that the airframe caused. That is very different to AF447 where if the pilots had done nothing everything would have been ok. It was the pilots that flew the aircraft into an upset.

PixelFlight wrote:

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

It's quite basic - disregard the instruments giving bad information, and use the ones that are working. I was trained to recognize a failed instrument early on in my instrument training (as should every pilot) - and we still practice this today.

True, there was a single faulty airspeed indication and a stick shaker - but only on the Captains side. The FO had a set of fully functioning instruments right in front him (plus the standby) - yet he lacked the experience and professional confidence to simply say "my aircraft". Instead he let the Captain struggle for over six minutes. SIX minutes. Never pulling the thrust levers out of TOGA that entire time? My God, in a 737 you don't need an airspeed indicator to know you're over the barber pole - the sound alone will be deafening. All of this on a clear, VFR day. Blame MCAS all you want, but these guys let the aircraft get into an undesirable state long before MCAS even activated.

Airplanes break - period. All of our training is focused on managing those problems when they arise. This crew was handed a situation that they failed to manage.

zeke wrote:

Their point is not very valid. ET has a very good training system, their pilot and corporate standards are very high. Higher than many western airlines.

And they have the crashes to prove the high standards, right?

Zeke, in my opinion you should have never posted this. You've lost all credibility with me. It's simply a reversal of the truth.

MSPNWA wrote:

And they have the crashes to prove the high standards, right?

Zeke, in my opinion you should have never posted this. You've lost all credibility with me. It's simply a reversal of the truth.

Can you name a US carrier that has been around as long as ET (around 75 years) that has not had a crash ?

Why oh why are people arguing around this?

Firstly the plane as certified and delivered was flawed. That is Boeing and the FAA’s baby

Secondly the pilots might have been able to recover it if they had made different choices/had more experience/ had better training.

This thread is about the grounding to resolve the first issue. Why do we keep coming back to the second which will be covered in the specific accident reports.

barney captain wrote:

PixelFlight wrote:

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

It's quite basic - disregard the instruments giving bad information, and use the ones that are working. I was trained to recognize a failed instrument early on in my instrument training (as should every pilot) - and we still practice this today.

True, there was a single faulty airspeed indication and a stick shaker - but only on the Captains side. The FO had a set of fully functioning instruments right in front him (plus the standby) - yet he lacked the experience and professional confidence to simply say "my aircraft". Instead he let the Captain struggle for over six minutes. SIX minutes. Never pulling the thrust levers out of TOGA that entire time? My God, in a 737 you don't need an airspeed indicator to know you're over the barber pole - the sound alone will be deafening. All of this on a clear, VFR day. Blame MCAS all you want, but these guys let the aircraft get into an undesirable state long before MCAS even activated.

Airplanes break - period. All of our training is focused on managing those problems when they arise. This crew was handed a situation that they failed to manage.

I asked for a training procedure, a document that I can read, not a general story.

There was no known information to the pilots at that time that the speed would render the manual trim impossible to move after the MCAS put it in extreme trim and there cutoff the stab trim motor. There have to prioritize there workload on the immediate death thread, and for them it was the nose down attitude with no working procedure to fix it. It's only _AFTER_ the two accidents that the speed has been identified as why the procedure there implemented did not work.

A simple question..

If both sets of pilots had been flying the 737NG would 346 people be alive today?


So.. according to the Seattle Times the 737MAX Cockpit did not meet current Federal Regulations.. I think that is a big deal..

https://www.seattletimes.com/business/b ... ew-alerts/

barney captain wrote:

PixelFlight wrote:

Please provides the training requirement that was "lacking" relevant to "handle an emergency of this type".
Please provides the detailed procedures into the "standards Pilots" that "handle an emergency of this type".
Without any details, you simply blame without any verifiable facts.

It's quite basic - disregard the instruments giving bad information, and use the ones that are working. I was trained to recognize a failed instrument early on in my instrument training (as should every pilot) - and we still practice this today.

True, there was a single faulty airspeed indication and a stick shaker - but only on the Captains side. The FO had a set of fully functioning instruments right in front him (plus the standby) - yet he lacked the experience and professional confidence to simply say "my aircraft". Instead he let the Captain struggle for over six minutes. SIX minutes. Never pulling the thrust levers out of TOGA that entire time? My God, in a 737 you don't need an airspeed indicator to know you're over the barber pole - the sound alone will be deafening. All of this on a clear, VFR day. Blame MCAS all you want, but these guys let the aircraft get into an undesirable state long before MCAS even activated.

Airplanes break - period. All of our training is focused on managing those problems when they arise. This crew was handed a situation that they failed to manage.

Bad instruments on one side is one thing. Having the aircraft take over the flying on its own, without warning, any mention of what would happen, when and how often is quite another. I don't think even Boeing knew MCAS would have this roller-coaster effect in the real world. The phrase "what's it doing now" springs to mind.

100% of the blame for both accidents rests with Boeing, and it is about time they admitted it. Insinuating by proxy the now dead pilots were to blame for crashing their very safe aircraft won't fool anyone.

mjoelnir wrote:

How is Boeing able to make a working design once and fuck it completely up the next time something similar is needed?

I suppose the 767-C2 has synthetic AoA via the 787 (derived) glass cockpit ?

MCAS for the 767 was designed ( or hammered together ) framed by that environment.
next step is lifting MCAS from a "safe input data" environment
into the "two unconnected lobes, pilot checked data" brain of the 737. an interns job.
He/She couldn't know any better that exterminating the pilot out of the data check process
would go pear shaped fast. to make it effective ( causing havoc ) reach through
was significantly increased from certified values.

Boeing is desperately trying to color this a condonable oversight
and not the criminal negligence it really was.

StTim wrote:

Secondly the pilots might have been able to recover it if they had made different choices/had more experience/ had better training.

maybe it simply would helped if they would have known what really was going on

let's remember the situation after the lion air crash.
Back then, the public did not know what we know today.

There was an AD, there were suspicions, there were assumptions and there was a lot of criticism for the maintenance of lion air (which was - as it now looks like - pretty flawlessly and in accordance with boeing done).

Nobody outside Boeing and the FAA knew the full extent of what MCAS could do to a plane
Neither Boeing nor the FAA wanted to explain this to publicly, and they tried to solve the problem with the failed AD.

If Boeing and the FAA had made the entire problem scope of MCAS public at the time, and if the AD had been formulated properly, then the ET crash probably would not have occurred.

From this point of view, for me, the lion air crash was unavoidable and can be explained by a misjudgment of boeing (pilots as a backup of MCAS, the responsiveness and problem solving ability of cockpit crew underestimated).

But the ET crash was absolutely avoidable. It was made possible by trying to cover-up what Boeing and the FAA did wrong in certification.