Bjorn’s Corner: Time to reassess the safety standards for our airliners

By Bjorn Fehrm

April 26, 2019, ©. Leeham News: In the wake of the 737 MAX crashes the standards to which Boeing and the FAA qualified and approved the 737 MAX MCAS function is questioned.

FAA has called the world’s aviation regulators to a meeting on the 23rd of May to discuss how the revised MCAS function will be approved. But it’s time to discuss more than how the updated MCAS shall pass.

What needs to change: the Pilots or the Aircraft?

I wrote in a previous Corner “we have over 200,000 pilots flying our airliners around the world“. This figure was wrong, we dug deeper and there are more than 300,000 pilots flying our airliners today and there will be more tomorrow.

As the world’s airline traffic increases and reaches new markets, there is a shortage of pilots to fly all the airplanes. Pilots are recruited from all the world’s corners with different backgrounds and brought to proficiency through different training systems.

Given the vast number of operational pilots and new recruits, how practical are the outcries from the Old Garde stating “The crashes show we need better pilots with better training“? Is this the practical fix?

Isn’t it easier and safer to safeguard six departments (the flight safety departments of Boeing, Airbus, Embraer, Bombardier, ATR and United Aircraft) and their oversight authorities, which qualify our airliners for safe flight, are having standards which are high enough? And that these realize what standard to qualify to for these 300,000?

To think the solution is to screen and retrain 300,000 pilots is not living with the present. The worldwide airline industry has changed and it’s not changing back.  It’s more straightforward to change the acceptance level for what we can expose the pilot’s to in an emergency than change those 300,000.

Here’s a case in point.

The wrong checklist

The implementers and oversight of MCAS convinced themselves a miss-functioning system already had an emergency checklist: Trim Runaway.

The Trim Runaway checklist was conceived after several accidents where the pitch trim got stuck in an on-position, either nose up or nose down. Pilots get trained on how to recognize this condition in their yearly recurrent simulator training and what to do about it.

As the trim runs continuously in one direction the checklist prescribes “hit the cut-out” without further ado. The continuous trim in one direction is unlike anything the aircraft normally does, so it’s easy to identify, and once identified time is pressing.

This doesn’t fit at all for MCAS. As Boeing’s Vice President of Product Development and Product Strategy, Mike Sinnett, said when presenting the MCAS fix last month “MCAS is part of Speed Trim System”. Now, Speed Trim System is active every 737 takeoff and every 737 approach. It behaves in very much the same way as MCAS but triggers by Speed change, not Angle of Attack.

In fact, Speed Trim is so similar to MCAS none of the pilots for Lion Air JT043 or JT601 could see or feel the difference. So to rely on a checklist and training for something totally different is just not good enough. Not when 300,000 pilots need to play Sherlock while flying hundreds of passengers and connect a variant of Speed Trim which is dangerous with a checklist which has little to do with Speed Trim.

Further, MCAS can be countered by manual trim, a trim runaway many times not (if the fault is downstream of the opposite force Yoke column cutouts). So an MCAS emergency checklist shall stress how to separate it from Speed Trim and how to trim to neutral stick force while keeping speed in check and then hit trim cutout.

My focus is not the correct MCAS checklist, it’s to have the standards for the safety work where a substandard solution to a problem, relying on an existing, non-suitable emergency procedure to be “good enough”, is not good enough.

Because we design and certify our airliners for a pilot workforce which will soon hit 500,000. And the product and the procedures around the product must adapt to this reality. The days of the old airline industry are gone.

We have entered the mass transportation market and the industry and its players must adapt. And it’s easier to adapt the tools for this transport then how hundreds-of-thousands of individuals shall behave.

92 Comments on “Bjorn’s Corner: Time to reassess the safety standards for our airliners

  1. there does need to be a world wide standard for pilot certification. That standard needs to address corruption. Such as buying simulator certification and using dual log books.

  2. In the future the 2:nd pilot might be a combination of programmed systems on board (enhanced FMS) and computer programs running at Boeing or Airbus, Airport controllers sending digital instructions for flight in 4D together with secure satellite worldwide communication. Like a Global Hawk++ system.
    Some might weant to add the famous dog in the cockpit that bites the captain if he touches something unless the warning bell rings.

  3. In my opinion the pilots need more support when it comes to make a timely analysis of a situation. That is, a system that tells from the data what possible went wrong and what should be done.
    When you look at a FDR data plot, you usually see pretty well went wrong when (see for example Björn’s analysis of the ET301 accident). Now, the data shown is exactly what is available at that moment in the aircraft. However, the crew cannot interpret all the data as it does not have the mental ressources nor are all data actually displayed (for example AOA, both sensors, and AOA history).
    We can’t train all the pilots on becoming data interpretation experts (especially as the chance they ever encounter such a situation is substantially below once/lifetime). Therefore a “artificial intelligence” that tracks the normal sensor data and provides feedback what is going wrong, learned on previous incidents/accidents (or simulated incidents/accidents).
    That would be perfectly in the scope of current technology, would not take away authority from the pilots, and in many cases work across aircraft types, even manufacturers (unreliable airspeed looks similar on a Boeing or Airbus aircraft).

    • I disagree. “AI” as it is currently formulated is actually pretty rubbish, and has no role to play in a safety critical system, which is what your suggestion of a “robot flight engineer” would be.

      The self driving car startups such as Waymo, etc. have been discovering this at great expense, making very little progress in the recent past.

      • Matthew, I agree the implementation of AI in direct control applications is premature and immature, at best.

        As a diagnostic tool, though, it excels at dealing with large amounts of complex and potentially conflicting information. It complements human abilities and extends them, but does not replace them.

        For a pilot dealing with an in-flight emergency, the AI could do the necessary pattern recognition and quickly focus the pilot on possible causes, as well as listing methods of resolution. It can make multiple hypotheses and test them in seconds. A pilot would also get there eventually, but time is important in the decision tree. Recovery options steadily dwindle as time goes on, especially if altitude is being lost.

        So the pilot’s situational awareness is increased, without having to act as engineer/technician to figure out what’s gone wrong. It keeps the pilot in the role of controller and decision-maker, but he/she has reliable information with estimates of confidence. It helps to remove the guesswork that is otherwise involved, and also levels the playing field for pilot experience.

        • Let’s consider the possibility that AI would have been able to function as a “3rd seat” pilot in the Max. By definition, AI uses patterns fed to it by humans to learn to recognize similar patterns without humans and then extend to learning new areas not foreseen. Just the initial process of setting up such an AI 3rd seat pilot would have likely produced in its makers the strong realization that the first MCAS addition to speed trim had a clear and plausible pathway to total disaster. This hypothetical example demonstrates that, for now, we really just need to focus on carefully analyzing the basics of such systems which can be shown to have egregious design flaws, despite Muilenburg’s absurd statement to the contrary. Frankly, I do not understand why computer simulations are not part of this basic process as those would have identified the dire consequences of small delays and errors by operators. The number of variables involved is entirely tractable.

      • I would disagree about your example. Self driving cars have made absolutely outstanding progress. If you went back 10 years I’m sure that it would have been thought to be many years in the future before we could have self driving cars. Now we are down to perhaps the most challenging part – the edge cases – but there seems to be continuous progress with that.

        What we have seen with real pilots is that they sometimes have difficulty handling the edge cases – those which are at the limits of normal behavior. The two recent crashes are examples of that.

        So in a real world AI might improve things even if it can’t do every edge case. If we are rational it only has to do better than very good pilots.

        In the case of accident with the self driving car in Phoenix (which stopped testing) I wonder what are the chances that a real driver would not have hit a woman under the influence of drugs pushing here bicycle into the middle of a busy road.

        • Self driving cars have made some progress, but they’re still fundamentally rubbish. See Waymo’s unbelievably limited and not very successful trials, Uber’s woes, etc. They’ve all got to, say, 75% of the way there and then got stuck. Unfortunately for them there’s no market unless they get to 99.9999999%.

          If you want an AI to dispense the kind of sage wisdom expected from an experienced flight engineer at moments of crisis (such as when MCAS is trying to kill you), that advice has got to be “right”, and proven to be so to a very high standard.

          Presently there are no methods for analytically assessing the correctness of an AI in performing a given job. The only way we have of doing it is giving it a go and building up a large body of statistical evidence in its favour (if it works at all). This is the approach being followed by the self driving car projects, and what they’re all finding is that the statistical evidence is not good. As a senior Uber project lead was quoted saying, “We should not be crashing every single day”.

          Want to try that with passenger carrying airliners?

          Even that’s not adequate for a truly safety critical role; you cannot discover systemic issues that way.

          Also, it seems clear that there have been some major failings within Boeing. Would you trust them to get an AI right when that technology is, at best, a dubious choice for a safety critical role?

          Humans are demonstrably very good at dealing with edge cases, far better than any machine. To be able to maximise that potential, humans have to be given a chance. If they’re overwhelmed by the fast moving behaviour of a poorly thought out machine, such as MCAS, then all bets are off.

          • Matthew, not sage wisdom, statistical probability based on thousands of iterations, tested and driven by data measured at the time. Observation, pattern recognition, hypotheses, test with data, estimate of confidence interval. That cycle repeated many times within seconds as confidence improves. Report results to pilots when confidence threshold is reached

            This process is used to beat humans at chess, for medical diagnosis, to play Jeopardy, and other things. It’s not a substitute for a human being, that is the part people get wrong. At least not yet. But it can be a valuable aid.

            Humans are also very good at this process, but they are slower and their performance drops off as the data set becomes large or complex, or if they are under stress. AI is not affected by those issues.

            Agreed that pilots need the best chance we can give them. AI can be one element of that provision.

            Robert has it right, AI in direct control cannot account for all the possible edge cases, but does better than humans in routine cases.. Elon Musk’s argument is that statistically, it’s still safer than human behavior. The problem is, no one wants to be the statistical anomaly.

            So we will need humans for awhile yet. We will accept human error, we don’t accept machine error. One we see as an inevitable part of life, the other we see as absolutely avoidable. So AI can provide information but is not yet suitable for direct control.

      • What ever happened to the KISS prinpal? A passenger carrying aircraft should be designed to be a stable platform, not unstable.

        • Well an aircraft is both a car (ground ops) and then flies 100 or so MPH up to 500 MPH from ground level to 35,000 of so.

          Makes for an interesting design challenge.

          By aircraft definitions the 737 is stable.

          Like all aircraft when you get to the edge of the envelope things get interesting.

          MCAS done right simply keeps it away from one of those edges.

          Done wrong as it was, it pushes the aircraft over into other edges that were fatal.

      • “Robot Flight Engineer” is probably a good term.
        Things that regularly kill pilots and passengers such as unreliable airspeed and mis-trim can be perfectly identified by a pilot. The current systems usually alarm when options are getting scarce.

        An early example is the EGPWS. The early GPWS simply warned when altitude became low. That resulted in famous “GPWS Flow Chart” (Google it). The Enhanced GPWS uses terrain information and some other sources to make a better prediction. That has effectively erased CFIT as cause of accidents.
        Same is possible for current aircraft. A simplified aircraft model can be run on rather small computer, and it can predict the flight path 10-20 seconds into the flight. As I said, the data is there!
        Look how obvious the failure of the AOA sensor was. Even a very simple logic could easily identify this AOA as faulty, warn the pilot that MCAs will activate and tell him that he shall use electric manual trim continuously or extent the slats immediately.

  4. Another excellent article, trying to bring some kind of order or clarity when perhaps there is no order or clarity.

    I can’t agree more with the view that safety or regulatory departments of OEMs must be protected to maintain competence and integrity. National regulators will never have the people, so national regulators will always have to work through such departments.

    I do need to pick up on what Mike Sinnett said, “MCAS is part of [the] Speed Trim System”. Well that means it’s not a ‘Stall Protection System’, which is what everybody has been told. I think Boeing do need to clearly set out the purpose of MCAS. Then perhaps there will be order and clarity

    In climb and descent, speed trim is about maintaining a constant climb angle or descent angle for a given speed. Or at least that’s my definition. Perhaps Boeing or others have a different definition.

    The thing that bothers me is that MCAS isn’t active when the flaps are extended. So climb out of airport and descent into airport are not part of the purpose of MCAS.

    I get more confused every minute about the purpose of MCAS. What I do know is that MCAS 1.0 was given the right to use aggressive stabiliser AND deflections, which we are now being told is unnecessary because MCAS 2.0 won’t be allowed to use aggressive stabiliser AND deflections on the grounds that the elevators decome inoperable and manual trim becomes inoperable.

    I also think that the aggressive stabiliser AND deflections used by MCAS were never tested, otherwise it would have been known that the elevators became inoperable and manual trim became inoperable. In other words, MCAS was given the right to act outside of the known envelope. Why?

    • Philip:

      Its a matter of separating Boeing BS (self justifications) from the reality

      Using the same system for a different purpose is probably a better explanation of MCAS.

      In my control systems there are also overrides . No matter what one part of a program wants to do, a part that has higher authority will not let it put freezing air into a building

      And that is what MCAS does, it take over trim to stop the air-frame movement into stall (Ver 1.0 screwing up the other aspects of flight)

  5. I think both are needed. We need better quality control so that potential failure scenarios are scoped out and accounted for in the development phase. This is highlighted by the fact that MCAS had failure modes that were unaccounted for, even in the software, much less in communication to pilots.

    Then we also need pilot training that places greater emphasis on abnormal conditions, and allows time for that. This is highlighted by the fact that some pilots dealt successfully with unexpected MCAS activation while some did not. Time pressure during a flight emergency may not allow for reasoning things out, and the information available at that time may not be sufficient.

    This also depends crucially on information flow from developer to pilot, so that systems are well understood and failure modes are reviewed. Also if artificial intelligence can be employed as a diagnostic aid for pilots, as suggested above, that too would be beneficial. This is already being done on newer designs, the 737 is obviously an older design.

    We have to remember that accidents are an event cascade, they don’t usually have a single cause. So it follows that they don’t have a single solution. We have to take a systems-wide approach, improving everywhere we can. All systems have unintended and unanticipated holes, we want to misalign them so there is no easy path to failure.

  6. “Isn’t it easier and safer to safeguard six departments (the flight safety departments of Boeing, Airbus, Embraer, Bombardier, ATR and United Aircraft) and their oversight authorities, which qualify our airliners for safe flight, are having standards which are high enough?”

    Any reason you do not mention Mitsubishi or – perhaps on purpose – the Chinese?

    • Only because they are not delivering any aircraft internationally yet.

  7. My first thought after reading the article is that Boeing has stretched the life of the 737 too far with at least one too many patches. Boeing’s next error was to not let the pilots know there was a MCAS system. How can we expect a pilot to suspect that a system is malfunctioning if the pilot has not been trained on the system and doesn’t know it exists. I suspect that the mechanics who worked on the Lion Air flight after the plane was saved on the previous flight didn’t know there was a MCAS system, threated it like runaway trim and after finding the trim worked just fine, signed it off as something like “ground checks O.K.”.
    I flew the KC-135, B707, L-1011, DC-10. B757 & B767. None of those aircraft had systems like MCAS that I can remember. IMHO, the B757 was the best aircraft that Boeing ever made – two clicks to turn off the autothrottles and two clicks to turn off the autopilot and bingo – now you had an airplane. Most of the flying not done at altitude was hand flown. I never saw a pilot who couldn’t do that well.
    Maybe the past is the path to the future?

    • The latter group had trim control.

      737 technically is a dead end but not a bad extensions if not for self inflicted implementation of MCAS and corporate BS on commonality. The cockpits don’t look the same.

      But the 737 is also competitive with the A320NEO so it makes an interspersing discussion as to how poorly aeronautics have improved in the last 50 years vs engines.

      As far as I am concern baldy written software also lead to the AF447 crash (aided and abetted by a bad system of training pilots at the time)

      When people do not hand fly aircraft they loose complete touch with what they are about.

      Envelope protection does not stop you from doing stupid things.

  8. Are we not also saying that no national authority has or will have the resources to do an effective job of reviewing plane design and operations of an increasingly sophisticated nature?
    An obvious solution would be a global certifying agency with funding provided from individual nations on some basis (# of flyers or airplanes?) but there are issues, a.o.:
    – red tape inertia and resistance.
    – political will initially, and political manipulations down the pike (withholding funding a la UNESCO)
    – enforcement in corruption rife environments, not all of them third world (Boeing tanker story).
    – and always the final question : Quid custodiet ipsos custodies

    • There probably should be a global certifying agency, though I’m far from convinced that it would have more resources and a greater ability to oversee the work of OEMs than the present bodies entrusted with this (the FAA, EASA, etc).

      There is, kinda, if one squints a bit, a body to serve as a model for what that organisation could be. The ITU is an effective UN body (with a history back to 1865) that has ensured that telecomms globally just works and interoperates properly. It’s a detailed and dull technical job, and modern telecommunications is the successful, beneficial and profitable result. That’s why everyone wants the ITU to work well – cooperation is demonstrably of benefit to all.

      [BTW the Internet world largely sits outside the ITU, and it shows; the chaos surrounding IPv4 and IPv6 still shows no sign of being sorted out, and it’s come about because there’s no one body that can enforce taking a measured approach to developing useful standards]

      However, the ITU doesn’t really have to do much enforcement, so there’s no really good model out there on which to base the “enforcement” role. I’m not sure that national interests would entertain the idea of a UN body having a superior level of jurisdiction.

      Regarding your final question, who guards the guards, that’s easy. The scrutiny of a free press does that. That’s a bit problematic in some parts of the world…

    • I have to admit, I’m not a fan of global or universal anything. To put all power in the hands of one institution has been shown to be dangerous. So I prefer a federations with each part of the federation independent.

      In the end the 737 MAX was grounded because independent regulators took independent action.

      Having said that, much better coordination between regulators would benefit everybody. I do like what the FAA are doing with this 3 month review. Specificslly inviting other regulators to be part of the review. But then I liked the FAA’s initial response to the Lion Air crash for they issued an emergency AD that totally contradicted Boeing. But within days that came to an end. The FAA returned to being Boeing’s poodle.

      Anyway we will see for after the 3 month review there will either be an agreement or there won’t.

      • Interesting about the AD conflict between FAA and Boeing.

        As far as I can tell the FAA said in its original AD
        “This AD requires revising certificate limitations and operating procedures of the airplane flight manual (AFM) to provide the flight crew with runaway horizontal stabilizer trim procedures to follow under certain conditions.”

        While Boeings point of view was that the existing ‘memory item’ of runaway horizontal stabilizer trim procedure was sufficient, regardless of source of problem.
        (‘The procedure involves flipping switches to turn off the automatic system, manually resetting the horizontal stabilizer and manually flying the airplane for the rest of the flight’.)

        I dont think the questions raised here have been resolved yet as of course ‘runaway trim’ seems to be a different problem as discussed by Bjorn
        https://leehamnews.com/2018/11/14/boeings-automatic-trim-for-the-737-max-was-not-disclosed-to-the-pilots/

        It seems that the ET302 pilots did follow the FAA revised runaway trim procedure
        https://leehamnews.com/2019/04/05/bjorns-corner-et302-crash-report-the-first-analysis/

  9. Pitot static system. FAILIURE.

    I think you flying boys need go back to the books on this one.
    The MAX8 has one pitot intake to the left and one to the right.
    The flying pilot from the left can not use the pitot intake from the right, a stall warning will come one. There is no air pressure to speed and altitude on the instruments on the left. But they function on the right. What the flying pilot needs to do is to move the pitot handle from right to left. That opens for pitot intake airpressure to the left instruments. This the pilots of Ethopinian Airlines schould have known. But they failed to notice.

    • I don’t believe there is any swap of Pitot systems.

      You have to swap to the non flying pilot. I have yet to read what mechanism does that (maybe the pilot shift switch).

      There is a third completely Independent Pitot static system that supplies data to the backup instrument cluster in the middle.

    • I’m sorry to say, but this is plain rubbish. You are blaming the Ethiopian pilots for not having used a system that simply doesn’t exist in any 737 model. And they didn’t have any faults where the non normal procedures would lead them to switch EFIS source from one side only. Sigh, there are too many commenters who have no idea of what challenges these guys were faced with.

    • What checklist was this ‘the flying pilot needs to do is to move the pitot handle from right to left. ‘
      I understand that both airlines in this situation didnt have the optional cost angle of attack display that would show extremely high readings and help to decide to ‘try the other side’

      • Duke:

        The problem with the AOA disagree and the readout is tyhat all it tells you AOA has an issue.

        Unless it was combined with the knowledge that AOA woud kick in MCAS ……..

        Maybe it would have helped in Ethripoain case, but thyere looks to have been confusion there as well.

        My take is you need to train on the systgem as installd with the displays as insalled (and the MAX is different)

        There was still throttle management, not getting flaps back down etc.

        I am not saying its pilots fault, I am saying those were the signs of confusion that they did not know exactly through training how it worked and you can add in the stabilizer loading that screwed up the manual trim system (and I believe no training on the manual trim in its worst case either)

        I continue to think you should not put pilots in that position in the first place.

        Pilots are not Chuck Yeager who knew intimately every aspect and system of he birds he flew.

        They are operators. Test pilots are a rare breed and if we have to have test pilots then aviation is doomed. Not a profession I would voluntary enter.

        • Yes I get the point about normal pilots – well those with air transport ratings .
          I wondered if there really was a ‘checklist item’ for moving pitot handle from one side to the other on a 737 ?
          Apparently these checklists arent something that are released publicly by manufacturer or airlines

          • Duke: There is no Pitot handle.

            There is a method to shift who is piloting (controls take precedent)

            I believe on Airbus its the last input.

            Pitot systems are totally separate for the reason you don’t want cross missing problems.

            The third system that feeds the backup instrument cluster is also separate.

            Its one way to break the tie of which system is wrong (you have to cross deference your AH, VSI as well as Turn and Bank)

      • It turns out that airlines in the US didn’t have the AoA disagree warning either, according to the WSJ. They thought they had got it, which is why it was mentioned in, say, South West’s manuals, but Boeing hadn’t actually enabled it.

        Unbelievable. Throughout this entire tragic saga I’ve been thinking, “it can’t get any worse”, but it keeps doing so.

        We’ve also recently learned of whistle blowers referring FOD to wiring (including the AoA sensor wiring) to the FAA.

        The fact that this stuff keeps dribbling out means that Boeing themselves aren’t fully corporately aware of how bad it is. That alone should be cause to close them down. If they can’t preemptively list all the problems, that means they’ve not been looking for them. And if they’ve not been looking, they’ve no idea what the true quality of their aircraft is, and nor has trhe FAA. Which means all Boeings are flying on a wing and a prayer.

  10. Whenever someone is asking for AI in something, you have to keep in mind that AI is mostly machine learning today and so inevitably facing into the past. I’ve seen this-and-that pattern in the past and thus the most lightly outcome is this-and-that. This would necessitate that you need some crashes or at least near crashes to get this history of data. The problem is nicely described by this comic: https://www.smbc-comics.com/comic/rise-of-the-machines. From my point of view AI is mostly a highly sophisticated application of statistics. People working in this area are called Data Scientist and not AI tamer for a reason.

    Or you have to simulate this. However in order to simulate you have to know what to simulate. And this leads to the point that you have to know the right questions, anso called AI could answer.

    What Bjorn could easily infer from the data, isn’t something in the realm from AI as we have it today. It’s great for other jobs like for example concluding from a behaviour of an engine what’s probably happen next based on a lot of data.

    • I think the needed AI training data could be acquired from the simulator training of Bjorn’s 150,ooo new pilots. The idea would be to make that collective knowledge and experience available to pilots as a diagnostic tool, in the cockpit during an emergency.

      Not a substitute for pilot knowledge or experience, and not in direct control. But an advisor when needed most, not subject to stress or confusion or anxiety.

      • Like anything, an AI would have to be done very right to work.

        Does it talk louder than the co pilot?

        Amidst alarms and voice message from Betty which gets first position?

        There is a difference in a flight control center where its calm and you have time to ensure things are not going out of hand in fractions of a second.

        Or do you let it take over the aircraft when it knows whats going on?

        In real space fight, you assign a target before its close and then the AI shoots it.

        Not so easy on a flight deck when the emergency is in your face.

        • Nothing as complicated as that, just a display that the pilots can consult if they choose, to help clarify the situation.

          More modern aircraft have the beginnings of this, checklists can be pulled up on a display. The AI would identify relevant information to display. Kind of like context-sensitive help but enhanced with situational awareness based on live data.

          If I am a pilot and what’s happening in front of me doesn’t seem to make sense, I’d look to this screen and hopefully the AI would have pulled up useful information, that would help me make sense of it.

          The goal would be to jump to any relevant information that might not be obvious, or overlooked in the emergency. In one MCAS flight, a third pilot in the cockpit figured it out. So the goal would be something like that, an assist of critical information.

          AI is not based on control logic like other systems, it’s based on observation and experience, more like a human thought process. So it can quickly sift through information to find a pattern that matches, and make suggestions. It can also test those suggestions if it has access to flight data, and determine a confidence value for them.

          Given enough time, the pilots would do this same process, and likely with far fewer deduction steps (humans are much smarter). But the AI can do thousands in the time it takes the pilot to do one. So the relative stupidity of the AI is outweighed by its speed, and the breadth of data it has available. It can get there faster, and is not trying to fly the plane and avert disaster at the same time, as the pilots are.

  11. Software really can be used to help !

    Why should the pilots have to try to work out the difference between a Trim runaway, and an MCAS / speed trim issue ?

    The software should highlight that MCAS is active, pilot taps MCAS checklist button , and all other non essential gauges, notifications fade out leaving the pilots with exactly what they need to see. Prominent AOA disagree warning, AOA indicators as default (no extra charge for safety !!)

    It goes without saying that you have to test thoroughly, and that includes all edge / boundary conditions.

    MCAS designed to protect against a stall at altitude ?, fine test that of course, but also test what happens if it kicks in for any reason at all 1000 feet AGL immediately after take off.

    Would you buy a car where ABS brakes were an optional extra ? Salesman says the car is perfectly safe as it has brakes, but if you want to make a safe car even safer, you can buy the ABS option (hardware is standard fitting to save the manufacturers money, ABS enabled/disabled in software).

    Salesman : “I find it hard to believe that a customer would save a couple of dollars on an option that might improve safety,”

    Customer : “I find it hard to believe that a safety company like an automobile manufacturer would try to make a couple of dollars on an option that could save lives”

  12. The technology needs to compliment the pilot, and the pilot needs to compliment the technology. Neither one replaces the other.

    I believe the standards and training for pilots need to be raised in many cases, and certainly standardized in many areas. I remember one pilot on an American carrier a few years ago telling me the company SOP was to hand fly the first 300 feet and the last 300 feet. Otherwise, they had to justify why they hand flew it. His comment still sends shivers down my spine.

    The best machine in the world is only as good as the person running it.

  13. I still don’t understand why three crews, when faced with a stick shaker at liftoff, decided the proper course of action was to retract the flaps.

    What state of training does this indicate?

    Boeing deserves censure for initial MCAS implementation but is basic airmanship no longer a flight crew requirement?

    • Bucky: I believe that is one of Bjrons main points.

      Not what the best pilots would do, but the least capable.

      Where are you going to find say 150,000 pilot let alone another 150,000 pilots ?

      How much is the public willing to pay for that? Flying has become a right.

      What this tells us is 3 (4 I think) crews faced with the same situation did not act corrcly (flaps not up or flaps back donw)

      Why did AF447 pilot pull that into a stall? That is equally stunning (and lethal)

      We have to deal with reality not what it should be.

      Yes that can be better training and the US and EU have put that in place and its a work in progress.

      A 757 pilot with the same loss of speed as AF447 dove his aircraft (again why? – you are descending in a non mountainous area and your speed stops – logic says loss of speeds – if you speed goes to zero – you have hit something and are dead, diving is not an option, ergo you have not hit something.

      What we can do is not have hardware and software do something that puts a pilot into that decision/confusion mode in the first place.

    • They were doing over 200 knots. The stick shaker was false. They worked that out.

      • Actually, they didn’t work it out. 737 QRH says don’t retract flaps with an active stick shaker.

        While the stick shaker was false, how did they know that? It could have been a slat panel failure that defaults to the Flaps up stick shaker schedule. If a slat panel had actually failed, retracting Flaps might have caused an immediate stall.

        Why didn’t they follow the QRH procedure?

          • Yes, they accelerated from 150 KIAS to 250 KIAS (Flaps 5 placard) and then raised the Flaps despite the Boeing procedure calling for no Flap retraction with an active stick shaker. Can’t see how you can call this as “working it out”.

  14. If getting the cert agencies together results in a more coordinated, and therefore better, certification process and regulations, them I’m all for it. I think they should meet more regularly in the future, and drive improvements forward. Continuous improvement.

  15. Airlines would a have a mostly passive role since even in general it should focus on complying with / adjusting to standards originating in the remaining entities in the process.

    Can we clearly say that a main factor in this accident was airlines’ non compliance with pilot training?

    Even if it is still not absolutely clear whether failure in its function lays at the feet of Boeing’s engineering or management or FAA’s supervision, given the information that has come to light I am inclined towards gross management disauthorization of engineering. Evidence of the latter should not be hard to come by if push comes to shove.

  16. If you say that certification standards should change to adapt to modern realities, what does that say about grandfathering certifications ?

    What does that say about the need to re-certify planes after say 20 years ?

    • Aircraft life is easily 30 years.

      Some aspect can be updated, some can’t (inerting fuel tanks?)

      How much economic impact are we willing to pay for?

      • Money and effort are limited, so if we are rational we will attempt to compute the cost/benefit ratio and see how it compares with the benefit from alternative actions.

        Unfortunately we are not rational and so some things get more attention than others. I personally tend towards the more rational, but I don’t rule the world…

        I’m not saying that we should require re-certification after a certain period, only that if one component that is important to safe travel changes, should we not consider whether other components in that same system might need to change.

        If the abilities of the pilots changes for any reason, does that mean that other things might need to change ?

    • grandfathering isn’t really about “(not) re-certify planes after say 20 years” but about keeping certification details valid though the plane around those details has vastly changed.
      Overall this touches more an brinkmanship than anything else.

  17. It is a smaller part of the total picture you do a good job of painting, Bjorn, but I also take issue with Boeing making some safety items ‘optional’. That AA chose to have the AOA disagree light but the other USA operators didn’t (and probably globally, that ratio might even be high) suggests that bean counters not safety officers drive too many decisions.

    Anything even marginally core to the flight deck having proper situational awareness shouldn’t be optional. Yes that may make the Cost per Available Seat Mile a few tiny increments more. But what price safety? How many billions will the two MAX crashes end up costing the myriad stakeholders?

    Likewise the excessive focus at Boeing and the customer airlines on reducing difference training to a few cheap minutes on an iPad app. Unacceptable when changes are as significant as NG to MAX has turned out to be.

    • Shouldn’t the crew have known they had sensor disagreement when they had stick shaker on only one side? That is a much more obvious indication than a light.

  18. In this day and age, when a computer can ingest data from a variety of sensors and make a data-based decision, it is just not fair to ask an average pilot to debug a complex system failure under a life or death situation, with very little time to solve the problem. Complex systems must be designed for an average user, if needed by using computers and artificial intelligence, and KISS (keep it simple, stupid) principle must be invoked at all times. Even pilots with thousands of hours in the same aircraft cannot be expected to debug successfully a failure mode that they have never encountered before or never trained for. Therefore, it makes sense to design systems so that such a situation is never encountered (responsibility of OEMs and Aviation agencies) but still train every pilot appropriately so even an “average” pilot can take care of the problem without having to consult a QRH, while he and his passengers are plummeting to death.

    This is where I find the FAA policy of requiring 1000+ hours before being allowed to pilot an aircraft is wrong-headed. I just cannot see how piling up zillion hours in a propeller-driven two-seater, with no pressurized cockpit (thus limited to low altitudes), can prepare anybody to pilot a twin jet with hundreds of people on board. Isn’t it better to substitute substantial simulator training instead, so that the pilot knows how to handle rare but complex situations in an actual jet he is going to fly?

    I wonder if I can persuade Bjorn to tell us his thoughts on this matter. After all, he is a pilot as well as an expert in matters related to the performance and control of modern aircraft.

    Anyway, as usual a well thought-out article on an issue of great importance to the flying public. We cannot overemphasize the gravity of the problem!

  19. Boeing failed twice with MCAS. Firstly by imposing a system on pilots that didn’t go through a proper design and test process. Secondly by coming up with ineffective mitigation after the problem had been identified. Put together it looks like the bigger problem is a lack of governance at the company. Or put it another way, management isn’t investing a safety culture at Boeing.

  20. I’m just a passenger and work in the software development field completely unrelated to the aviation industry.

    Long time ago one of my colleagues who works in the reputable international financial institution, told me: “Before I joined the bank, I thought that banking software had been developed to some sort of higher standard. Now I know that it’s the same sh*t”. Does the MCAS come to mind?

    We live in the XXI century, and having better certification procedures or better aviation agencies is simply not enough. All organizations are prone to degradation and failure, so no institutional solution will be good enough if it doesn’t include orders of magnitude greater certification transparency.

    Whether we buy food, medicine, land or inquire public institutions inner workings or court cases, there is so much available under our fingertips! Compared to that todays aviation certification seems to be a relic of some ancient project.

    In the world of open-source software, when I make a decision to use some application or component, not only it is possible to inspect its source code, more often than not I am able to view the entire development history of this application or component. This means ability to see who and when made every change in the application source code.

    Today, most of the worlds computer servers run on open-source operating systems. And it doesn’t preclude companies that base their products on such systems to protect their trade secrets or intellectual property rights.

    For example, you probably don’t realize this, but when you buy Android smartphone, it is based on a great deal of open-source software, too.

    My vision of the future as an aviation industry outsider is this:

    The source code of the safety critical systems must be open, and this means providing the complete toolchain to run and modify said code in education purposes. If this means that large corporations must open some of their trade secrets, the framework must be implemented to protect their intellectual property rights and at the same not stiffle the competition.

    The great deal of other certification documents must also be available for everyone to see.

    If MCAS was open-source from the beginning of the certification process, none of these accidents would have happened. Not a chance that it would have sneaked from the view of some outsider enthusiast to alert all of the industry and consumers about it.

    If I am supposed to entrust the life and well-being of me and my family to the MCAS system, I want to know exactly how it works, be able to view the code, modify and run it in the simulation myself. Right now this is doable for lot’s of code in your smartphone, you know.

    “Believe us, peasants, we won’t show you that thing, but remember, the King has said that it’s OK!” This is so XXI century!

    “You can tell I’m a dreamer…” This future is decades away, but it good to have a higher goal even if unachievable in it’s copleteness.

    • By the King I meant certification agencies and the aircraft manufacturer.

      • Ivan, I write control software, and the difference with that is liability.

        Open source is great for things where the penalty for failure or flaws is that no one uses your software. When there is the potential for personal injury or death or financial injury, there has to be a chain of responsibility. Someone has to be accountable.

        I have written control software for a large experimental engine. The power involved was in the multi-megawatt realm. I required a waiver of liability as my company could not survive the potential damages if something went wrong. The customer accepted all liability as an experimental risk. That could not be done for a production environment.

        • Rob, I think that I understand your concern. To make myself clear, by open-source I mean the opening of the program source code in a literal sense. My main point is achieving much greater transparency of certification and (to some lesser extent) development.

          I’m not proposing that the airplane manufacturer use the so-called Open Source Development Model, which means the decentralization of software development, accepting changes to the software based on their merit from complete strangers.

          The chain of responsibility has to be kept unchanged, but from some point in the transport aircraft certification process, the development has to become considerably more open. Which means that the public must be able to access information on who made such and such change, when and why.

          The proposed changes make no difference in the way of determining the liability.

          I can see no good justification on why the complete data (bar the trade secrets) on the development, testing and certification 737 MAX is not available to the general public. The rules can be developed to protect the manufacturers trade secrets and employees personal data.

          The organization processes such as the ones that led to MCAS development and certification must become transparent to the industry and the flying public. This will add safety and help the engineers who try to do the right thing to fight off attacks by management.

          Keeping the processes that led to MCAS development behind closed doors helps no one except negligent employees of the manufacturer and certification authority.

          The business processes being automated, means that it’s possible to automate the curated publication of the details of these processes.

      • Rob, I think that I understand your concern. To make myself clear, by open-source I mean the opening of the program source code in a literal sense. My main point is achieving much greater transparency of certification and (to some lesser extent) development.

        I’m not proposing that the airplane manufacturer use the so-called Open Source Development Model, which means the decentralization of software development, accepting changes to the software based on their merit from complete strangers.

        The chain of responsibility has to be kept unchanged, but from some point in the transport aircraft certification process, the development has to become considerably more open. Which means that the public must be able to access information on who made such and such change, when and why.

        The proposed changes make no difference in the way the liability is determined.

        I can see no good justification on why the complete data (bar the trade secrets) on the development, testing and certification 737 MAX is not available to the general public. The rules can be developed to protect the manufacturers trade secrets and employees personal data.

        The organization processes such as the ones that led to MCAS development and certification must become transparent to the industry and the flying public. This will add safety and help the engineers who try to do the right thing to fight off attacks by management.

        Keeping the processes that led to MCAS development behind closed doors helps no one except negligent employees of the manufacturer and certification authority.

        The business processes being automated, means that it’s possible to automate the curated publication of the details of these processes.

  21. After Three Mile Island, the Nuclear Regulatory Commission switch nuclear power plants to using symptom-based emergency checklists versus event-based as used in aviation. Event-based checklists require the operator to draw a conclusion as the to the cause of the event. “I have run away trim.” Symptom-based checklists point the what the operator is experiencing. “I have intermittent nose-down trim.” This would be different from continuous nose down/up trim (speed trim). Even with no knowledge of MCAS, the operator is directed to the proper steps. This method doesn’t require memorizing how various systems may interact in order to draw a cause conclusion as do event-based checklists.

    • Thank you, that is an interesting distinction. For those interested a bit of further background on this policy change is found here: https://inis.iaea.org/collection/NCLCollectionStore/_Public/31/029/31029701.pdf?r=1&r=1

      In particular the following comment which seems particularly relevant to the concept of using the Trim Runaway procedure for MCAS failure:

      “Therefore, the SB EOPs cover emergency situations and accidents not considered by the design, and even partially involve accidents beyond the design basis. As a result, the above-mentioned deficiencies of the EB EOPs are sufficiently compensated by the use of SB EOPs.”

  22. “FAA has called the world’s aviation regulators to a meeting on the 23rd of May to discuss how the revised MCAS function will be approved. ” Why has the FAA already decided to approve the Boeing MCAS software? It certainly sounds like a foregone conclusion. Why shouldn’t the FAA say that the airplane without MCAS, has a safety issue with the engine mounted too far forwards, and force Boeing to place the engine where it should’ve been in the first place, redesign the landing gear, and then deal with whatever certification tests and maybe a new type rating for the new aircraft? It sounds like Boeing initially sold this to the FAA, saying it’s just a feel-ability issue, and the trim will be in a small amount. (not a stick force issue, but, changed the trim). Was this really an oversight, or were they intentionally misleading the FAA? Then, they make the change to more trim, and at a fast rate. Boeing has a lot invested in this MCAS approval, but, I think, in the long term, they will lose more than they hope to gain, by not fixing the fundamental problem, and going for the expedient solution. I can hear the Boeing managers, when first presented with the pitch up problem. “Can’t we just….”

  23. There will always be accidents due to mishandled failures.

    It is almost impossible to prevent human error.

    • Human error on Boeing’s part. Rush to market with an unstable airplane, ‘cuz AB is selling more aircraft to a new market that Boeing didn’t envision. Simple as that. IMO, this a/c should have never been given an airworthiness certificate.

      • In the gun world they finally came up with the right term.

        Negligent Discharge. Prior it was refereed to as accidental discharge.

        Negligent says it all, you did not follow the well know process and procedures to enure a gun was not loaded.

        It also applies to a gun you know is loaded and you fire it anyway (you don’t put your finger on the trigger unless you intend to fire)

        These crashes were pure Negligence. Accidental should be stricken from the language.

        • Ravio:

          Should the NG been allowed as well?

          Its got the same manual trim issues as the MAX.

          As does the so called Classic (which should be the original) and the 100/200 series.

          • The NG as well as the others that you mention, weren’t given much larger engines mounted more forward than acceptable from what I’ve read since the tragic accidents. IMO Boeing built an unairworthy a/c and then added the much addressed MCAS with insufficient training or high lighted notations in the flight manuals.

      • It is time to restore the quality of pilots to improve air safety.
        It is time to stop producing substandard pilots.

  24. This is going so far back that my memory may be hazy. But I will put it out there anyway.

    In days gone by, sofware was developed by separate teams and in different languages. Each team installed their own software on their own computer and the airplane flew with each team’s software. The purpose was to minimise the same error. If there were three computers to allow voting, then three teams were necessary.

    Deep in my memory, either Boeing or Airbus scrapped this way of developing sofware, claiming it was design issues that led to sofware failure, so separate design teams were put together instead. Am I right or as my memory completely failed?

    I accept that design isssues are at the root of the 737 MAX problems. In other words, I don’t think there are bugs in the actual FCC software, the software is working as designed

    • If memory serves me correctly, the Space Shuttle had 5 AP-101 IBM computers. 4 of these worked together (voting), with the 5th being for the Backup Flight System.

      The 4 primary computers all ran the same software HAL/S I think, but the 5th was independently programmed.

      I think the US Airforce still use the AP-101s in B1 bombers, probably programmed in JOVIAL.

      I think the fly-by-wire software in the 777 is written in ADA, as is quite a lot of aerospace software.

      Challenger, and Columbia saw 7 Astronauts killed in each disaster.

      346 people killed in the 737 MAX crashes, with the cost of hardware these days, perhaps the airframers need to up their game with the next generation of airliners, 3 voting computers, and inputs should be the very bare minimum.

      • Boeing by the nature of the old mechanical 737 system uses two different software groups for the things like speed trim and MCAS (and yes I would love to see the logs of what each team saw)

        I don’t know how Airbus does it on the 3 computer system.

        Supposedly the 3rd system on 737 is purely mechanical and requires no software nor can you vote with two computers.

      • JD . New airliners havent used the old mechanical systems like the 737 since the A320 was indroduced with FBW/Computer control in the 80s.
        It was also implemented by Airbus on an existing plane the A300 when it was updated to A330/340
        Its used on high end business jets and even Embraers mid range business jets, The Cseries and the E series have it as does Mitsubishis MRJ which bring it to the 70+ seater regional jet level level.
        Boeing is the outlier with its 737, 747 and 767 transports and has very large customers like Southwest ( 9100 pilots) who are very resistant to change between 737 ‘generations’ ( They didnt even want an auto throttle on the new classic series)

  25. Aircraft have warning system to alert pilot of approaching terrain. Would it be possible for MCAS developers to incorporate the other system to improve on safety of the B737 Max 8?

    • GPWS for approaching terrain are only useful when the plane is in stable flight and its only a warning signal ( Terrain Pull Up, among others) it doesnt move any flight controls like the MCAS did, and even then there may not be time for the pilots to climb quickly enough for very steep terrain without stalling.
      https://en.wikipedia.org/wiki/Ground_proximity_warning_system

  26. I’m surprized nobody so far has focussed on grandfather rights for design and requirements for the 737 MAX.

    The increasingly Boeing dependent FAA radicaly changed their mind on this, in the timeframe inbetween in late nineties and 737MAX development.

    https://www.flightglobal.com/FlightPDFArchive/1996/1996%20-%200036.PDF

    https://www.flightglobal.com/news/articles/faa-rules-kill-39grandfather-rights39-in-usa-and-europe-67064/

    What requirements was the MAX certified against system level, were changing human interfaces covered or waived?

    Why did FAA change their grandfather rights policy when the MAX showed up? Was safety #1?

    • >Why did FAA change their grandfather rights policy when the MAX showed up? Was safety #1?

      Indeed, if the MAX is build for 20 years and an aircraft lasts for 30 then in 2068 we will see the retirement of an an aircraft with design elements that entered into service 100 years prior. I do wonder what pilots in 2068 will think of the MAX’s manual trim wheel?

      As for your question, of course economics forces were a part of this. Without the MAX SouthWest, Ryan Air and any other all 737 airline would have need to become a split fleet (about right now). Boeing would be fighting to win any 737NG replacement sales in an open competition based on merit. With the MAX Boeing wins by default. Of course with long grandfathering baked in Airbus is now in the same spot with the likes of EasyJet.

      This grandfathering makes everything very comfortable for Boeing and Airbus. No constant fighting to keep your customers, the common certification enabled by grandfathering keeps the customers locked in.

      The to some degree the same extends to the airlines. If there are only two manufactures both making the same planes, improved in lock-step then there is no danger of disruption by some upstart airline buying a disruptive aircraft.

      This is why the c-series faced such headwinds. No one wanted to disturb the cozy arrangement. This is also why the interesting things are happening in the business jet space, there is real competition in that space because fleet commonality is not a constraint on innovation.

      • I dont think the flight control airworthiness requirements are grandfathered- new ones are added all the time.
        What is grandfathered is the structural side with airframes. The 737 is well known as subject to fatigue failure, even for mid life planes in the classic series. Some very early planes were extremely high cycles when they peeled open, but in the last decade Southwest had two similar in flight failures and the cost of strengthening the rest of its -300 fleet when they reached the critical number of cycles saw them replaced early by -700 models from the used market.

    • That is one take, another is they had no training in how to handle the failure as it was multi dimensional.

      Kind of a case of you got pushed over a high cliff and did not think to bring your parachute.

      If you had known that was going to happen and you had a parachute and knew how to deploy it the odds go up to successful landing.

      Been there and I can thank some good genetics and background in crisis to have survived.

  27. The smear campaign by Boeing and the American airlines is going great, “deteriorating pilot skills “article in business insider(I haven’t actually read it, its behind a paywall).Perhaps you need to talk to Petter at Mentourpilot about Ryanair, very low hours, very highly regarded training programme, very safe airline.NG was a very safe aeroplane and the dead pilots were able to cope with it. Personally I reguard the accidents as more of a human factors problem than anything else,simply asking to much of the pilots.

    • ET pilots did switch the trim stabilizer off – as per Boeings check list- still couldnt control plane. Made decision to switch it back on again.
      Its well understood now that the system should never have been certified in the way it operated , not just one issue but multiple separate ones and to top it off no mention in ‘quickie’ conversion training.
      After this all said and done it will join the 787 build program as a classic study on ‘how not to do it’. The pilots may have a very minor role, nothing like most pilot error where everything is smooth and dandy until….

    • What I trust is that for the most part things go right, but always know they could not.

      Me? I would like to be at least in the co pilots seat to keep an eye on things.

      On many small flight I have been put there by those who knew my background. We would rather have you up there where you might be able to do some good than one of us who has not a clue.

  28. Does MCAS comply with the following FAR, considering that there is/was no indication of MCAS even being in the plane, never mind showing a failure. Was there any indication for an AOA sensor failure?
    ==================
    Sec. 25.672 — Stability augmentation and automatic and power-operated systems.
    If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with §25.671 and the following:

    (a) A warning which is clearly distinguishable to the pilot under expected flight conditions without requiring his attention must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system which could result in an unsafe condition if the pilot were not aware of the failure. Warning systems must not activate the control systems.

    (b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures of the type specified in §25.671(c) without requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.

    (c) It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system—

    (1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;

    (2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configurations) which is described in the Airplane Flight Manual; and

    (3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.

    [Amdt. 25–23, 35 FR 5675 Apr. 8, 1970]

    • Thanks for finding that . Makes sense along with reports saying Boeing ‘misrepresented’ to FAA how MCAS worked as they couldnt have let it pass, even under relaxed oversight, as it was.

      • I think the FAA was familiar with MCAS as they had certified it before, in other models. But possibly they thought the implementation would be the same, when it was not. Some safeguards were not carried over to the 737 MAX. The investigation will need to get to the bottom of why/how that happened.

        Similar to the AoA disagree indicator, no one apparently knew that had been dropped as well.

        There seems to be a bias against AoA indication in the industry. Both Boeing and Airbus have said it isn’t necessary for pilot display. Sullenberger has said it would be useful for confusing situations where things become uncertain. Seems like if the automated systems are using it, the pilot should be able to see it.

  29. CFM had these LEAP engines in development for quite a while (2009)
    https://www.airfinancejournal.com/docs/Events/NYFIED09/10.LEAP.pdf
    Boeing had wind tunnel test data for quire a while (2012)
    https://www.arabianaerospace.aero/wind-tunnel-testing-begins-at-qinetiq-for-boeing-737-max.html
    Were they really that pressed for time, to implement MCAS or was it simply to save money? In aviation, you generally avoid cutting corners. Even now, after things are crystal clear that MCAS can be a problem, and that there is some other pitch up problem, they are trying to save money rather than fix the problem. I think this will cost Boeing more in the long run, rushing to get the 737-MAX in the air, rather than fixing the root cause of the problem.

  30. The FAA has new rules for Airline pilot training that has gone into effect just recently. From Martch 12th 2019, the training materials now have “upset training” including full stall training in simulators, needed for all recurrent training. Details here.
    https://www.faa.gov/other_visit/aviation_industry/airline_operators/airline_safety/info/all_infos/media/2017/InFO17017.pdf
    Here’s a neat Alaska Airlines training video, showing a sample, thanks to Aviation Week. https://www.youtube.com/watch?v=zCJco59tqoQ It will be interesting to see how the 737-MAX simulators with the new MCAS software, operate from a pilot perspective when they start this. Or, will MCAS be involved in this required simulator recurrent training?

  31. “What needs to change, the pilots or the aircraft”
    MCAS has been the catalyst for this discussion as can seen in the many comments. I believe Bjorn’s question was meant to cover, in more general terms, the future of commercial aviation vis-a-vis pilots and aircraft due to the huge numbers that will be required in the future. I think the numbers of pilots quoted (500,000) is hinting at the impossibility of training to the known acceptable standard, so improving the equipment will do the trick. Every operator has an obligation to ensure that each individual occupying a flight deck seat has been trained and given the tools to do the job, regardless of the numbers.
    Coping with “emergencies” is not the be-all and end-all of what is required. Technical failures in isolation are relatively easy to cope with, it is the decision-making that comes with the result of them that can paint one into a corner. Even if we have the perfect aircraft which will never have a defect, humans will find a way to get themselves into a tight spot. The value of an experienced and capable Captain together with a well-trained and assertive F/O cannot be emphasized enough. Will AI eventually be the solution?

Leave a Reply

Your email address will not be published. Required fields are marked *