There are many, many things that went wrong:

1. The stuck AOA instrumentation on the plane.

2. MCAS not using redundant AOA information and being fooled by the stuck instrumentation.

3. Lack of clear indication of what MCAS was doing contributing to flight crew confusion.

4. Improper execution of the runaway trim procedure/checklist by flight crew.

5. Training shortcomings about MCAS in particular.

6. Operator / national regulator training shortcomings in dealing with runaway trim procedure.

If you remove any of these links in the chain, the crash is less likely to happen. Good risk management tries to improve all of them.

#5 that you mention is important. #4 / #6 are important, too -- jurisdictions that emphasized this training produced flight crews that did the right things and survived. #2 and #3 are most important, IMO, and even #1 deserves some thought (can the instrumentation be made better/more reliable?)

I say #2/#3 are most important because using training alone to fix a system that does tricky things at a difficult time is a band-aid, and is going to let some of the accident scenarios through.

Specifically it's the argument in the article that large disasters often have multiple causes. "Perrow says, Murphy's Law is wrong—what can go wrong usually goes right. But then one day a few of the bad little choices come together, and circumstances take an airplane down. Who, then, is really to blame?"

In large disasters, sometimes several not very likely simultaneous failures happen at the same time.

"The ValuJet accident is different. I would argue that it represents the third and most elusive kind of disaster, a "system accident," which may lie beyond the reach of conventional solution, and which a small group of thinkers, inspired by the Yale sociologist Charles Perrow, has been exploring elsewhere—for example, in power generation, chemical manufacturing, nuclear-weapons control, and space flight. Perrow has coined the more loaded term "normal accident" for such disasters, because he believes that they are normal for our time. His point is that these accidents are science's illegitimate children, bastards born of the confusion that lies within the complex organizations with which we manage our dangerous technologies. Perrow is not an expert on commercial flying, but his thinking applies to it nonetheless. In this case the organization includes not only ValuJet, the archetype of new-style airlines, but also the contractors that serve it and the government entities that, despite economic deregulation, are expected to oversee it."

But that's exactly what's disingenuous about the GP's claim. Many disasters do indeed involve a sequence of mistakes of different sorts but that's not really the case here. The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design.

"His point is that these accidents are science's illegitimate children, bastards born of the confusion that lies within the complex organizations with which we manage our dangerous technologies."

This kind of disaster certainly can happen but the situation with the 737 Max was Boeing pushing an old design far beyond it's limits because of the threat of losing market share and regulators allowing this.

MCAS is a badly designed system, but many other stabiliser control failures could cause the aircraft to rapidly lose altitude. The solution is the same in all cases - flip the cutoff switches to disconnect automatic stab control and trim the stabiliser manually using the wheel on the center console.

The flight crews in both MCAS-related disasters showed serious failures in airmanship and a lack of understanding of the fundamentals of flight. They were taken by surprise by MCAS, but they should have been more than capable of swiftly handling that situation; their inability to do so is symptomatic of broader failings in the training and culture of pilots in many emerging markets.

https://www.nytimes.com/interactive/2018/11/16/world/asia/li...

https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...

ET302 tried this-- maybe slightly late, but MCAS is weird/sneaky. Still, it's hard to fault their response at this point.

They were unable to budge the trim wheel because of overspeed. They were barely climbing at Vmo. This left them in a difficult position.

Ideal response would be to reduce power (prevent overspeed), keep climbing at Vmo. During this, try to turn trim wheel. If necessary, once they had sufficient altitude, they could aerodynamically unload and trim. Instead they, for some reason, decided to turn the stabilator trim system back on (whoops 1), and then used it an insufficient amount to get trim to a reasonable place (whoops 2), and then left it on for MCAS to trigger again (whoops 3).

You accuse me of being disingenuous and immediately follow it with a false claim.

This is untrue. Stabilator trim can be turned off. Indeed, before Lion Air 610 the previous flight had experienced the problem and had dealt with it correctly.

Also, re-trimming using the trim switch disables MCAS for some number of seconds.

In the case of ET302, they turned the system off, but allowed the aircraft to overspeed and were, as a result, unable to retrim manually. Still, they had a positive rate of climb. It is only when they turned it back on in violation of training/checklist and inexplicably did not use it to retrim nose up that they were doomed.

> This kind of disaster certainly can happen but the situation with the 737 Max was Boeing pushing an old design far beyond it's limits because of the threat of losing market share and regulators allowing this.

I strongly disagree. I think it's a badly engineered system but things like this are part of the normal design refinement that happens when planes are stretched and iterated upon. The 737 has bad handling on pitch during departure; bigger, more powerful 737's have it worse, and it makes sense to fix this.

In this day and age, I'm suspicious and annoyed even small effort to improperly spread blame when that spreading serves powerful interests.

Either approach is wrong: just pointing to the pilot and saying "hah-hah error" without considering what led to the error is what aviation did for decades. "Crash less!" we said to pilots, and were surprised when things didn't improve much. But you can't ignore crew performance, either.

The crews that crashed did not do great. But if a system is regularly putting crews to the test in a way that requires high levels of personal performance to survive, that's a bigger problem.

And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions).

Not necessarily fair since one didn't even know what they were up against, and the other was trusting a Boeing checklist that wasn't guaranteed to work, and only stood a realistic chance at working if the failure did not occur at a critical stage of the flight, where a currently undocumented maneuver could be performed. (The 'roller coaster' by which the pilot allows the plane to dive to unload the stabilizer so it can be trimmed)

>And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions).

This is just poppycock, if you ask me.

MCAS was a desperate attempt to satisfy a prescriptive behavior requirement (FAR 25.173, demonstration of longitudinal stability) during which the plane should not experience slackening control forces all the way to the stall in a wind up turn, which non-compliance with would disqualify the airframe from certification under the grandfathered 737 type certificate and as a Civil Transport Airplane.

There would have been no need to consider the skill of the pilots if due diligence and proper redundancy concomitant to the actual hazards of the design had been done, which weren't due to management's pressure to get this damn plane flying on time at any cost.

Well, it did get them back to positive rate climb, didn't it? :P Just, dubious subsequent actions gave that back.

> This is just poppycock, if not straight up, grade A bullshit; no personal disrespect intended to you, fine sir.

Well, it is absolutely personal disrespect, and adding qualifiers amplifies rather than undoes it. A decent person should do better.

> There would have been no need to consider the skill of the pilots if due diligence and proper redundancy concomitant to the actual hazards of the design had been done, which weren't due to management's pressure to get this damn plane flying on time at any cost.

I already said MCAS is awful, kthx? At the same time, it's exposed that many air crews in developing countries don't know how to deal with trim runaway. And trim runaway happens: switches get stuck. So the other links in the failure chain should be dealt with, so that they don't conspire to bring down aircraft under other conditions.

In the Lion Air penultimate flight, the situation was handled thanks to a third pilot in the cockpit with no other responsibilities contributing extra attention and reasoning. This is not available on every flight, and should not be considered a proof of safe operability. The mental model of a pilot unconcerned with the immediacy of flying the plane is more accommodating to unconventional occurrences due to being removed from the majority of learned perspective.

>Also, re-trimming using the trim switch disables MCAS for some number of seconds.

It also resets the activation cycle, and increments the amount by which the trim is activated. Both these details were unknown to all pilots at the time.

>In the case of ET302, they turned the system off, but allowed the aircraft to overspeed

And did nothing wrong. Given the stage of flight the problem occurred, they left the throttle in exactly the position they should have. Addis Ababa is also a "hot & high" airport, meaning the engines were already in the uppermost range of their operating envelope anyway. Furthermore, when the AoA sensor went bonkers, that leads to an airspeed unreliable checklist due to bad AoA figures throwing off the airspeed indicators which are dependent on AoA being correct for calibration. The airspeed unreliable checklist requires advancing throttles to the appropriate setting for the current stage of the flight regime, which was climb out.

>...and were, as a result, unable to retrim manually. Still, they had a positive rate of climb. It is only when they turned it back on in violation of training/checklist and inexplicably did not use it to retrim nose up that they were doomed.

They turned it back on in the hopes that the electronic trim could overpower the aerodynamic load where they could not, they did not realize that closing the circuit would give at most five seconds before MCAS dove again. Also, by this point, they were out of checklist.

It is almost as if I've heard these arguments before. (I have. We discussed it long ago when most things were conjecture.)

Sibling poster is correct. We've worked through this, and the pilots really couldn't have done any better considering the amount of information there was out at the time.

Also, later on, Boeing also notified airlines that only the MAX 10 I believe should be used in hot and high airports. The MAX 8 could take off due to Addis Ababa's extra long runway, but it just goes to ram home how uncomfortable a margin the Engineering firm was with safety margins afterwards.

It's basic airmanship to know that if you are not in climb attitude, that high power is going to overspeed in anything slick. Combine that with "overspeed" alerts and you should maybe realize it's time to pull the power back.

> They turned it back on in the hopes that the electronic trim could overpower the aerodynamic load where they could not, they did not realize that closing the circuit would give at most five seconds before MCAS dove again. Also, by this point, they were out of checklist.

They turned it back on, clicked the trim switch briefly, and then left it alone, despite knowing they were way out of trim. Can you explain why this makes sense? Why turn it on and not get back to nominal trim?

Also, they were still climbing at Vmmo (or overspeed). It would have always been an option to climb a bit...

OK, we put bigger engines on. The 737 is kinda already sporty and easy to get the nose too high on departure. Now it's a little worse with bigger engines.

This is part and parcel for what happens when you stretch planes, adapt new engines, etc; there are minor, associated design changes you need to make to improve handling, etc. Software is a reasonable way to do it.

The criticality of this was badly misunderstood and mis-characterized.

You disagree with the statement that roughly the urge to avoid recertifying pilots caused Boeing to not mention MCAS even in manuals, leading directly to these deaths? Because from my pov, Boeing introduced a new failure mode (MCAS failure leading to intermittent forcing of the nose down) without any warning to the pilots.

Now maybe the pilots' standard training should have compensated, and there are obviously maintenance or training deficiencies, but Boeing also knew good and well they were selling planes to pilots with these existing training deficiencies. And should have designed a plane to be operated by real world pilots.

Very curious for your thoughts; thank you!

I think there were failures across the board. The fundamental analysis of MCAS was flawed: it was much less reliable than was thought, and failures of it provided a much more difficult situation for pilots than anticipated.

I suspect the analysis boiled down to "MCAS provides a little defense against getting the nose excessively high on departure; it shouldn't be necessary so no big deal if it fails. And the worst failure we can think of is like stabilator trim runaway, which everyone knows how to deal with."

This was compounded by the fact that many developing countries do not require pilots to demonstrate they can deal with runaway trim as part of a checkride and recurring training.

Not disclosing information about the system made the problem even worse-- and this is harder to attribute purely to being part of bad initial analysis.

I do not understand some of the aircrew actions, even in retrospect. If I am fighting pulling the yoke back-- I am going to have my finger on the trim switch to try and get rid of those control forces, even before I am thinking about the problem. This would have inhibited MCAS and retrimmed the plane. I think that Boeing assumed that this would happen. I am lazy and would rather not have to tug the yoke so I use trim a lot. :P

Actually, I have one thing to contribute, that I often think of whenever I read about an air disaster. Experts frequently say "why didn't the operators do logical thing X?", and I think there is a practically universal answer. Whenever something unusual goes wrong, it is likely to upset your existing logical model. You know either your logic is faulty or the inputs to your model are wrong, but which is it and how?

It's easy to say "just do A, B, and C as trained", but once jolted out of your mental context, you probably can't regain it in a few seconds or minutes before crashing. The impossible task is not to know the necessary actions according to the book, but regaining the trust that they are the right ones in the face of something unexpectedly violating your assumptions.

Developing a new logical model for reality is very difficult even for highly trained people, particularly under time constraints and life-or-death pressure. Or, even the meta-problem of knowing whether it is time to develop a new model of reality.

I have already stated that MCAS was a horrible screwup and failure in analysis and regulation. Any system that routinely puts people to the test requiring high performance to avoid death is bad.

That doesn't mean one should ignore the other weaknesses. Given that both the countries with crashes didn't require pilots to demonstrate coping with stab trim runaway as part of type training... and pilot understanding of the stab trim system under stress seems lacking... maybe that should be addressed too.

It's building in a new control system and not telling the pilots about it that seems crazy to me.

Thanks so much for your thoughts!

Thank you for the discussion and questions!

I know that aerodynamic instability requiring continuous correction by fly-by-wire systems has become common on fighter jets because it's necessary to achieve some of the maneuvering characteristics necessary to make them competitive. These are, of course very different priorities from commercial passenger aircraft.

Has a jetliner been certified before the 737 MAX that is aerodynamically unstable in any of the tests that it's required to pass without control inputs made by the computer without direct input from the pilot, or in contravention of the pilot's input? I know Airbus is fond of its "do what I mean" system, but that in some circumstances, Airbus flight control systems revert to essentially emulating an analog airplane. Would their flight characteristics pass certification in that mode?

I don't know if Airbus would meet certification requirements in direct control law. I suspect not. Definitely not in mechanical control law.

Just like more conventional jetliners wouldn't meet certification guidelines without all of their control rigging, counterweights, and trim systems. It's just now tempting to make adjustments to those systems with software instead of fiddling with everything else.

Many airplanes require functional (electronic) yaw damping to be safe in various flight conditions, because of dutch roll. There are also e.g. electronic control feel systems in some aircraft that must be operational to exceed certain speeds and/or altitudes and not be excessively vulnerable to PIO, etc.

Is it harder than I'm imagining in big jets, or in specific aircraft due to peculiarities of their handling characteristics?

Aircraft with swept, low wings exhibit dutch roll worse than other types (e.g. airliners). It's also worse at high speeds and high altitudes.

Yaw dampers vary based on aircraft and flight regime to "attenuating somewhat that annoying-bouncing-back-and-forth-feeling in the back of an airliner during cruise (imagine how bad it would be without active damping!)" to "preventing an oscillation from building in 2-3 cycles to a point where it will cause structural failure".

Thanks for all your input in this discussion. I find both flight in general and the case of the 737 MAX fascinating. Previously the implementation of MCAS sounded absolutely insane to me, but I can mostly understand how they got there after reading your comments.

The people who built MCAS thought they were taming a 737 handling weakness that was worsened by the new engines. Again-- a normal kind of thing to have to work on when stretching jets.

https://www.skybrary.aero/index.php/Flight_Control_Laws#Norm...

Boeing has mostly avoided that. MCAS is kind of an unusual form of control augmentation as far as Boeing is concerned.

Automation definitely has directly killed people, though, too.

So is trimming the stabilizer.

Boeing was proven wrong by the two crashes but it's not a priori obvious that pilots wouldn't know to manually trim the stabilizer and then pull the cutout after MCAS kept kicking in.

It was climbing at Vmo; they could have pulled back the power to not let the plane overspeed, rather than exceeding Vmo.

Hopefully at Vmo they could move the trim wheel, but if not, they could wait until they had a few thousand feet more height, aerodynamically unloaded and trimmed.

> So they reenabled the electric trim, at which point MCAS jumped in again and everybody died.

They re-enabled the electric trim, and touched the electric trim switch a couple of times but left the plane far out of trim. I can't figure this out-- there's even an indicator that makes it obvious you're out of trim. Why re-enable electric trim and not really use it?

Then after a timeout after they pushed the trim switch, MCAS jumped in again and everyone died.

It's easy now to point the finger and say "Airmanship" when you know the innards of the damn thing. They had one airworthyness directive, and maybe a grand total of five paragraphs in the entire manual, plus a memory item checklist that didn't accurately reflect the detail of an MCAS failure. An MCAS failure is not continuous uncommanded trim. It's discrete pulses,

I appreciate the detail and effort, and you certainly speak as an experienced member of the industry; but pushing this off to the pilot's when there is so much that had to happen before the plane left the factory for them to be in that position is a bit much.

There is whistleblower testimony that the decision to not implement a multi-sensor MCAS was intentional to avoid the financial consequences of having to have pilots put in simulator time.

You can't sit here and say the pilots weren't good enough when the manufacturer went out of their way to make sure they could skulk a plane by regulators with the least amount of training humanly possible, safety be damned. To do so is not just mad, it's unconscionable. It's the very thing of insanity. A Catch-22 if I've ever heard one.

This is not the behavior I expect from someone whom I'll voluntarily talk to.

So again, what was improper? Especially ET302 where they absolutely did run the checklist rather immediately and by that time it was already in a mistrim situation.

A contributing factor to ET302 is that mechanical trim wheel rotation can be very difficult in some flight regimes.

A further contributing factor is ET302 left an unreasonable amount of power in and got to an overspeed situation, which makes rotating the trim wheel yet more difficult. Being trimmed a bit nose down should not kill you. It should be the kind of thing you experience in training.

> It's much more aggressive than the kind of runaway trim pilots are trained for.

Bullshit. A stuck stabilizer trim switch will run away much faster than MCAS, and this is the primary thing they're trained for. The problem with MCAS is that it's an insidious, intermittent runaway-- an unlikely failure mode for a switch.

But sure, add to my list that "the trim wheel is often very hard to rotate manually", and "the flight crew left the thrust levers nearly full-forward creating an overspeed condition".

>ET302 ultimately turned the electric trim back on which was their death knell, in violation of procedures.

No it wasn't, they'd run out of checklist, and were deep in "oh shit" territory.

>A contributing factor to ET302 is that mechanical trim wheel rotation can be very difficult in some flight regimes.

>A further contributing factor is ET302 left an unreasonable amount of power in and got to an overspeed situation, which makes rotating the trim wheel yet more difficult. Being trimmed a bit nose down should not kill you. It should be the kind of thing you experience in training.

It was absolutely not unreasonable given the environment and stage of the flight (initial climbout) and the fact that pulling power would have led to nose drop (the opposite of what the current desired tendency of the plane was). Also, the plane was suffering by definition airspeed unreliable which dictates advancing throttles to the appropriate throttle position for the desired state of flight and leaving them there.

And what training? Oh! You mean that training they should have had because MCAS was a two sensor system, and therefore required level D simulator time that never happened because the manufacturer decided to cut corners to make more sales of their "best selling plane of all time"? That training?

https://youtu.be/QytfYyHmxtc

Or the one hour glorified PowerPoint training that never mentioned a single detail of a flight control computer algorithm, or the disabling of a trim override switch built into the yoke, or the changing of the functionality of the STAB TRIM CUTOUT switches on the console to degrade the granularity of control with regards to which systems were electrically isolated from the trim motors because a hidden AoA dependent control routine had to be allowed to run uninterrupted because to do so would jeopardize their competitive advantage/ability to generate shareholder value by disqualifying their airframe outright or severely delaying its delivery because regulators started asking really inconvenient questions? That training?

http://www.seattletimes.com/business/boeing-aerospace/boeing...

The training unacceptable because Boeing would owe USD 1,000,000 per airframe to one of their largest customers if they implemented their safety system correctly in accordance to engineering best practices? That training?

https://www.seattletimes.com/seattle-news/times-watchdog/the...

The training that would have to happen anyway after their hacked together design had already killed 400 people, increasing scrutiny, causing them to finally do analysis they should have done in the first place, but didn't, because they were too busy trying to financially engineer the company after absorbing the management that drove McDonnell Douglas into the ground?

That training?

https://www.seattletimes.com/business/boeing-aerospace/newly...

https://www.mymoneyblog.com/boeing-engineer-dream-job-nightm...

https://www.bloomberg.com/news/features/2019-05-09/former-bo...

I get it. You sound like a knowledgeable dude, but you also sound like someone who has absolutely not sat front and center, day in, and day out, as companies try to go through the wildest mental gymnastics to avoid being held responsible for complying with regulations that have a damn good reason for being there.

You know what? Those pilots might have made mistakes. But the entire job of an Engineering firm is to ensure that the opportunity for those mistakes to occur are as rare and infrequent as practicable, with a dash of practicality thrown in; at least enough to keep the bean counters and management from sweating bullets. That means clearly communicating details of safety critical systems, being willing to admit a system is safety critical, and putting your bloody books behind in priority to getting the job done right as much as is reasonably necessary.

I'm a hobbyist. I do Quality Assurance as my day job. I could see plain as day the issues and risks they would be taking. I sat down and calculated the bloody forces that would have to be applied to the screw jack to actuate against the airstream at those velocities, and the torque numbers I got without even factoring in the extra pressure from the elevators was well into the output range of an automotive engine. I could also tell, just from the press releases over the development years the type of culture they had slipped into. That complacency by management kills, and did kill people.

Those pilots were the very last thing between those people and that crater, and did everything to the letter to the moment they had to improvise, and even then, they went into it insufficiently informed on the particulars of their aircraft.

I've bounced the details of this entire event passed maintenance people, passed crash investigators, passed anyone who'll care to listen. Boeing did things that are pretty much universally amongst them considered "things no one in their right mind should do."

If you want to buy in to "oh, they just sucked as pilots", fine. I'll give you Lion Air, but Ethiopian Airlines has a stellar safety record, and can fly in American airspace. So they obviously can't be that bad.

Oh, almost forgot!

>Bullshit. A stuck stabilizer trim switch will run away much faster than MCAS, and this is the primary thing they're trained for. The problem with MCAS is that it's an insidious, intermittent runaway-- an unlikely failure mode for a switch.

I call Bullshit right back, sir, seeing as, just as you mentioned, MCAS manifests differently from the classical stab trim runaway. Something which could be cause for pause for someone expecting a continuous runaway.

Just because they weren't you now does not mean primary fault can or should be attributed to them.

They walked onto that plane, cocksure, and as full of enthusiasm as you would have on any day. Up until the point Boeing's reckless design decisions came to light, no one had a clue just how different the MAX was from the 737's every airline pilot is familiar with.

You want to trade places with them? Ask God. He may oblige. Then mayhaps 150 or so may still be alive. That doesn't change the fact Boeing created an unsafe plane, hid the fact/didn't analyze hard enough to determine that fact at the pressuring of management, and to add insult to injury, tried to firmly pin the blame on the pilots, your comrades. It isn't even the first time they've done it if you recall the nastiness of the rudder reversals in the 90's, and some of their difficulties getting the 727 certified in Europe back in the 60's.

I'm frankly shocked you're so willing to jump to Boeing's defense in light of the mountain of evidence that has hitherto come to light, considering it's you they want to pin the blame on to avoid taking responsibility for what they decided to do.

Good day, sir. I only hope people take the time to do their own research.

After you've spouted invective and abuse at me? I see you've edited it out since.

> > ET302 ultimately turned the electric trim back on which was their death knell, in violation of procedures.

> No it wasn't

Wrong. Boeing OMB, dated November 6, 2018:

"In the event an uncommanded nose down stabilizer trim is experienced... do the Runway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight."

Followed by an airworthiness directive requiring the immediate revision of flight manuals and familiarity of pilots with this OMB.

ET302 was 10 March 2019.

It goes on to state that you should neutralize trim forces before going to STAB TRIM CUTOUT.

"Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT."

I told you before that MCAS was faulty. It's the most important link in the failure chain, but it sure is unwise to advocate ignoring the rest of the links.

As I said to you elsewhere: "The crews that crashed did not do great. But if a system is regularly putting crews to the test in a way that requires high levels of personal performance to survive, that's a bigger problem." This summarizes my thoughts on this topic. MCAS should get fixed; Boeing should be found liable for the accidents; Pilots should be better informed about the systems on their aircraft... AND we've proven that pilots that don't get recurrent training and evaluation on stab trim issues do badly with them.

> I sat down and calculated the bloody forces that would have to be applied to the screw jack to actuate against the airstream at those velocities, and the torque numbers I got without even factoring in the extra pressure from the elevators was well into the output range of an automotive engine.

OK, and humans can exert torques on trim wheels with a handle "well into the output range" of an automotive engine, too, so you've established nothing.

You've still declined to answer my simple question in the other posts, too-- which I suspect is because you don't have an answer.

Your cite says Boeing said:

>The actions of the pilots played a role in the chain of events that caused the crashes

Which isn't blaming them and is factually correct in both crashes. The Lion Air pilots didn't disable electric trim and the Ethiopian air ones turned it back on. Those actions played a role in the crashes. Whether that makes the pilots responsible and at fault for the crash is a separate question.

>If you want to fix the problem, you must know what the problem is.

And, again, the problem (among other problems) was that the designer of the aircraft made assumptions about pilots that were incorrect.

Planes are going to get dumber, but there will be a lot more connected planes for remote troubleshooting/control

Literally no one disputes the importance of experience. But you keep throwing it out as relevant to LNI610 and ET302 without any explanation or causal connection. In the case of Colgan Air 3407, the two pilots had 5500+ hours of experience between them, each well over the current ATP experience of 1500 hours total time requirement, and yet the captain inexplicably, likely due to startle factor, pulled back on the yoke contrary to his training, and made the stall worse and the airplane unrecoverable. Who cares if 5000+ hour pilots know to drop flaps in an emergency if they get startled in a stall and make the stall worse by pulling back on the yoke!

Sustainable for what exactly? Being good enough to handle complex emergency procedures?

There will always be a more experience subset of pilots plus new ones coming in. They have the benefit of having two pilots (sometimes more) so they can even off the average experience in the cockpit.

Although newbie co-pilots have contributed to crashes in the past as well.

At the end of the day, this is the foundation of the problem.

I think MCAS represents a change for Boeing where it will start doing things without asking.

When an airliner goes down, the airline, the pilots union and the airline manufacturer all point fingers.

That is what happens. When Boeing says we should use "average pilots" there is subtly in the statement that assigns blame.

Boeing should have said, "we should use pilots who are trained through normal training procedures, rather than over trained test pilots."

That statement would not have assigned blame and OP is probably correct that the statement choice was intentionally designed to shift blame back to the pilots.

This is a corporation putting a product on the market with a critical safety system that lacked redundancy and poor training given to pilots. Yes, there is blame to be placed here. Individuals who worked on the system aren’t the issue here, a greedy corporation is and I feel no sympathy for the company itself.

> when 400 people die for a company to save money

Let me take a step back and ask: Why?

Is it because we're vindictive, and demand blood? Or is it because this actually does something to help keep people from dying in the future?

If the latter is more important than the former -- which I hope is the case -- how can we trust that we're pursuing a course that improves the future of society while also using rhetoric to the effect of "when 400 people die for a company to save money"?

Consider, for instance: Part of reason for the company "saving money" is that it results in lower costs for planes, and ultimately lower airfare for customers who pay airlines' capital expenses, potentially resulting in fewer miles driven and fewer accident. Is reducing this statistical danger more or less than the danger of the planes? Quite possibly, it's not -- but using this rhetoric certainly won't help us find out.

More broadly the "omg greed" narrative, which -- to me, at least -- just doesn't make too much sense. If the corner-cutting that led to 737 Max problems is to be understood as a "greed" move, it's a pretty incompetent one, because Boeing is almost certainly out billions over the mess. People who seek to maximize profits for their own self-interest also seek to mitigate risk, for the same reason. I would suggest that a "hubris" narrative, or something similar, is probably more appropriate here.

If this is so, the remedies are entirely different, and the assertion that we MUST jail people, because it fits our "greed" narrative and whatever cognitive bias we drag into the picture, ensures that we will not remedy the problem effectively. This means people may die.

You don't send people to jail because of "greed", broadly speaking you might divide it into two categories: A) this specific person is a threat to society; B) this person did something morally unconscionable, irresponsible, negligent etc. The reasoning for following through with B is not merely vindictive, it's societal value is in sending a message that this behaviour is not OK! that is a preventative measure - "you must be morally responsible".

This is entirely applicable to this scenario: greed is NOT the problem, trying to make cheaper planes is NOT the problem, trying to beat the competition is NOT the problem - The problem is attaining those goals by gambling with peoples lives by cutting corners that significantly compromise safety, that is gross negligence.

... So yes! send the people responsible to jail, please show the next in line that this behaviour is not tolerated.

Incompetence and greed aren’t mutually exclusive.

If you take the word of all of the good engineers who were pushed out or quit in frustration over the financialization of the company after the McDonnall Douglas merger, then “omg greed” really does explain everything.

Note that this could have been (and was) predicted by anyone with half a brain:

“On some level, though, he saw it all coming; he even demonstrated how the costs of a grounded plane would dwarf the short-term savings achieved from the latest outsourcing binge in one of his reports that no one read back in 2002.*“

https://newrepublic.com/article/154944/boeing-737-max-invest...

They lost big thus time, but they were winning big, with more orders than they could make.

When Boeing mgt declared that they 'no longer needed [to spend money on] senior engineers because these are mature products', and successfully pushed for the same type rating for a plane with deadly different handling characteristics (to save money on pilot training), both were explicit greed moves.

And yes, irresponsible managers who ignored the reality of physics and put their profits over the safety of passengers should go to jail for their criminally bad decisions.