Either the mitigation is acceptable to make the plane safe to fly, or it’s not. “Well this one already existed before we knew about the issue, whereas this one is new” doesn’t actually change the risk calculus nor the effectiveness of the mitigation.

The FAA has many, many safety rules, but which ones apply to a particular situation depend on a number of factors. For example, if you're flying by yourself in a small airplane, you don't even need a pilot's license! (solo student)

In the world of aircraft certification, on one end you have experimental aircraft that untrained people designed and built and may be extremely dangerous. The FAA is relatively hands-off on this as long as you put EXPERIMENTAL in big letters on the side and don't charge anyone for a ride. When you start to get into heavier, faster planes, like people who buy MiGs, there are rules about where they can operate that are intended to protect the public on the ground, but not the pilots/passengers. On the other hand, a new Boeing commercial jet is subject to intense scrutiny in almost every aspect. Obviously you see an enormous difference in accident rates between commercial airliners and experimental homebuilts.

One other dimension of this is grandfathering. Once a design is set, can be very expensive to change it. You might like the 737 to have better redundancy in its hydraulic system, and if Boeing ever designs a replacement for it, they will have to put that in. However, if every regulation the FAA made applied to existing designs, either the FAA would have to keep the new regulations to an absolute minimum, which would harm safety going forward, or Boeing would have to redesign their planes every year, or maybe even send all of the old planes to the scrapyard!

This is not economically feasible, so the FAA only grounds aircraft for very serious safety issues. Parts are allowed to have tolerances in service that they aren't allowed to coming off the production line. Similarly, old design aircraft are allowed to have features that a new design aircraft wouldn't.

What this allows the FAA to do though is to improve safety incrementally as new designs are created. Since it's so much cheaper to put in a new feature in a new design, it's economically feasible to provide safety for progressively more unlikely failure scenarios for these aircraft. Gradually, the old aircraft are retired, and safety gets progressively better.

The 737MAX notwithstanding (and you could make a strong argument that Boeing abused the grandfathering rules with that aircraft), the progressive and dramatic improvements in airline safety over the past 100 years is a testament to the wisdom of this approach.

Except the type certificate issued by the FAA for a given aircraft is by definition the FAA saying that the type meets all applicable standards and is safe to fly. So is the granting of exceptions to any applicable requirements.

The FAA doesn’t say “eh maybe, it’s a judgement call” to an aircraft manufacturer when telling them whether or not the plane can board passengers. They may include various factors, probabilities, and judgement calls in their own determination of if the type gets certified or not, but ultimately there _is_ a determination made: either it can fly in a given context, or it cannot.

If the argument is “we learn and get better over time, and just because we approved something yesterday doesn’t mean we approve it today”, I fully agree with that, but within reason. And while I don’t agree with this mitigation being an acceptable exception, I also don’t think it’s “insane” or incredulous for Boeing to ask for it, given that the FAA already approved the same thing previously.

Even given that a type certificate has been issued, whether or not it is legal to fly depends on the circumstances of the flight. Just as an example, under part 91 (private flying), complying with manufacturer's service bulletins is optional, but under part 135 (charter) or part 121 (airline), it's generally mandatory.

Therefore, is the FAA saying it's safe to fly a plane that doesn't hasn't completed its manufacturer service bulletins? No. They're saying the acceptable level of risk under part 91 is higher.

The more dangerous the plane is to people on the ground, the more severe the limitations. For example for the really dangerous ones, they'll give you a limitation of "Flight over a densely populated area or in a congested airway is prohibited."

Grandfathering aircraft that exist indefinitely makes sense to me, but I don't see why designs should be grandfathered indefinitely for new builds, when we have learned a lot and increased our expectations significantly in the intervening years.

That’s also why service bulletins exist.

To illustrate why this matters, imagine a more extreme situation, where it was somehow discovered that a similar flaw existed in all Boeing and Airbus jets. If a single new jet were being developed that had a similar risk, it could be enough to prevent certification, but we wouldn't stop all air travel because of it - the cost would be too high.

Grounding just MAX jets obviously wouldn't have that degree of impact, but the cost to airlines and to passengers would still be significant.

And exception is a deviance that must be tracked and taken care of adding mental load to the list of things a pilot has to do.

The normalization is pushing this deviance into a new system that isn't complete and therefore has no refit requirement over a large base of aircraft.

The MAX8 does not have a fix, it has a complicated checklist of workarounds for dynamic behaviors that should be automated.

Then the next level of failure you're inducing is that ' 8 = 7 '.

The combined systems of the MAX8 are not and do not equal the combined systems of the MAX7. You have re-asses the mitigation on every airframe that differs or you end up with a field of people splattered everywhere. If Boeing actually does the reassessment as they should, it will be about as intensive as actually removing the issue and reducing the workload of the pilot in the first place.

That's why a lot of people are pissy about this, as Boeing is trying to say they did it once and that work transfers to a new system perfectly. Didn't work so well with the other MAX8's that splattered themselves.

Even if you disagree with this mitigation, every time a new MAX 8 rolls off the production line and enters service, the problem grows larger. Why is this okay, but not with the same for a MAX 7?

Again: either the mitigation is effective enough for MAX variants, or it’s not. I see no reason the two variants should be treated differently here.

No it is not. Here, you are doing just the normalization of deviance I'm talking about.

An airplane is parts, and an airplane is a system. Just because you use part X in system 1 doesn't mean a mitigation strategy for part X works the same in system 2. For example system 2 (or the MAX 7 in this case) could also have an addition dysfunction in cold weather that by itself is low risk, but when coupled with this procedure now represent a significantly higher risk of loss of aircraft event.

This is the the kind of problem that shows up in new/changed systems when accepting risk from previous systems at their previously measured outcomes.

[edit- the fact boeing can extort congress is scary]

It defies how we made it through the first hundred years of commercial aviation with pilots having to deal with more complex tasks than an "up/down" switch.

Please refer to this chart that shows the accidents/incident rates over time and their incredible trend towards zero!

https://i.imgur.com/PVaPAdX.png

That didn't happen just by itself!

Those planes have been retrofitted over time or are in significantly decreasing use for passenger aircraft.

Over reliance on automation is an issue, to be sure, but in the macro sense, it is one part of a significant downtrend in fatalities.

Just imagine that automated future. MCAS everywhere! We should start the debate now which language all that automation should be written.

That being said, I'm also on the "this mitigation is ridiculous" camp. They can't even have a humidity sensor that turns the de-icer on and off?

But it doesn’t take a genius to see that in this particular case, there is no evidence (at least none provided in the article, nor none that I’m aware of) that the 7 is different from the 8 or 9 in regards to how the engine icing system works (or doesn’t, in this case).

Boeing should fix their shit. Not melting the nacelle is a simple feedback loop. Humans shouldn't be running that loop.

Why not? As you appear to agree, it's the same problem for all of them, and the problem is a simple one that should never have reached this point in the first place. So all of them should be held to the same standard. If that means not certifying the 7, it should also mean revoking the certification of the 8 and 9 until the issue is fixed.

> Boeing should fix their shit.

Indeed. And since the same shit is on Max 8 and 9, they should fix those too now that the shit has been discovered, and be held to the same standard for all. I don't understand why you aren't arguing for that.

If the plane’s issue is the exact same issue and the mitigation is the same mitigation that’s already been approved by the FAA as effective, yes, and this is currently how things work. See the MEL. If mitigation X is approved for situation Y, then it is approved for all situations of Y (within the same context). You don’t have to go to the FAA to get a new approval to take off every time Y happens, you just do X and you’re approved.

That's basically the argument Boeing is making. However, there is a counter argument that the FAA could make (though I don't know if they are): in order to limit the risk exposure now that this issue has been discovered, the same mitigation should not be allowed on any new variants not already in service, even though it is allowed for the ones already in service, because taking variants out of service is a much bigger deal than not allowing new ones into service.

But if that was the argument, then that would also mean that we shouldn’t allow any newly built 8s and 9s to enter service, and I don’t see that happening.

Yes, that's a fair point, although doing that would require some sort of modification of the existing certification of 8s and 9s, and I'm not sure how that would work. If those certifications were simply revoked, all 8s and 9s already in service would be grounded until the issue was fixed. But if they are simply left alone, new 8s and 9s can come into service since those variants are certified. An Airworthiness Directive, which is what is currently issued by the FAA for 8s and 9s, by itself doesn't prevent new units from coming into service.

Or they misunderstood your comment, or they skimmed it badly, or you wrote it badly.

The most obvious example is the button to enable the anti-ice systems. If you don't push that button upon encountering icing conditions then you die. Of course you don't really die in either of these cases. At least not right away. Lots of other things have to go badly first.

This is why aviation relies on checklists. There are myriad things that must be turned on and off in each phase of flight, and checklists ensure that pilots don't forget.