[bumby]

I don’t disagree but there are clear hierarchical criteria on how these hazards should be addressed. The reason behind engineering mitigation being favored is because they make the less reliable procedural mitigations moot (I.e., they improve the overall reliability by removing one of the points of failure, in this case the pilot). Forgoing engineering mitigations in favor of procedural fixes goes against good engineering practice at best and is a cheap, lazy fix at worst.

I can understand if the AD was intended as a short term fix but I would question the rationale if it were considered a long term solution

[WalterBright]

> I can understand if the AD was intended as a short term fix but I would question the rationale if it were considered a long term solution

It was not, Boeing at the time was working on a solution.

Regardless, however, the pilots MUST know how to deal with runaway trim. This was true before MCAS, and is true after. It was true on the 757 (I spend 3 years working on the design of the 757 stab trim system). The cutoff switches are prominently within easy reach on the center console for very good reason, 40 years before MCAS.

It is not acceptable that pilots were unaware of the cutoff switches. It is unacceptable that MAX pilots did not read, understand, and remember the Airworthiness Directive sent to all MAX crews.

Similarly, airplane engineers work hard to keep the airplane from catching fire. But pilots also MUST learn to properly use the airplane's fire suppression systems. Most of pilot training consists of learning emergency procedures.

It's why airplanes still have pilots, instead of using automation instead.

Boeing still deserves blame for the flawed MCAS implementation. But there were other contributing factors in the crashes that must be dealt with.

[inferiorhuman]

It is not acceptable that pilots were unaware of the cutoff switches. It is unacceptable that MAX pilots did not read, understand, and remember the Airworthiness Directive sent to all MAX crews.

The Ethiopian crew tried the cutout switches and found they couldn't trim the airplane with the hand cranks because Boeing lied. How is that a pilot training issue?

But there were other contributing factors in the crashes that must be dealt with.

A Boeing employee concern trolling over pilot training is pretty rich considering that Boeing knowingly hid crucial details from pilots.

[WalterBright]

> The Ethiopian crew tried the cutout switches and found they couldn't trim the airplane with the hand cranks because Boeing lied. How is that a pilot training issue?

The Emergency Airworthiness Directive to all MAX crews says:

"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."

https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...

> A Boeing employee

I left Boeing about 40 years ago.

[inferiorhuman]

Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.

If the graphs are to be believed neither the electric commands nor hand crank were able to move the stabilizer. Again, how is that a pilot training issue?

[WalterBright]

I don't know what graph you're looking at. The reports I saw was that the EA pilots did not follow the procedure:

1. trim to normal with the electric trim switches

2. cut off the stabilizer trim

What the EA pilots did was:

1. cut off the stabilizer trim

2. try to use the hand cranks to trim to normal

[inferiorhuman]

I don't know what graph you're looking at.

Graphs of the FDR data from the (preliminary) accident reports. The Ethiopian authorities even annotated theirs with things like "automatic trim command with no change in pitch trim". You can see quite plainly the stabilizer was not moving as intended.

2. try to use the hand cranks to trim to normal

Per Boeing's documentation this should've worked. Unfortunately Boeing's documentation is mostly wishful thinking. Boeing's also suggested that a pilot try unloading the stabilizer with a roller coaster type maneuver. Unfortunately Boeing removed detailed instructions on this maneuver decades ago and the FAA's already demonstrated that with the altitude that the Ethiopian crew had, unloading the stabilizer would've just flown the plane into the ground.

There's a reason Boeing's largely backed off of the whole pilot error nonsense: the 737 MAX crashed due to shitty design not pilot error.

[bumby]

I don’t think we disagree on any of the above.

But there were other contributing factors in the crashes that must be dealt with

I don’t necessarily disagree with this either, but it does come across as if we’re being distracted by proximate causes rather than focusing on the root cause. To someone on the outside, it sure seems like there are deeper engineering and cultural problems that deserve a greater priority at this point. Not to belabor the point, but simply issuing a procedural AD doesn’t appear to address the root causes and should just be a stop gap measure

[WalterBright]

It wasn't a "procedural" AD, it was an "EMERGENCY" AD. It says so right at the top:

https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...

Put another way, would you want to board an airplane where the pilot did not take EMERGENCY instructions seriously? I wouldn't.

> distracted

Pretty much 100% of the popular media (and its repeated appearances on HN) has been on the MCAS design shortcomings. Which distract from dealing with the other causes of the accidents.

As I mentioned previously, the AD was issued as a stopgap measure while Boeing worked on an MCAS fix.

[bumby]

I think we're miscommunicating what is meant by "procedural" vs. "engineering" mitigation.

Procedural is meant as an administrative action as opposed to a designed engineering action.

Think of a hazardous system that has software involved with controlling a pressure hazard. A procedural mitigation may be to have an operator monitor system pressure and push a non-software shut-off emergency button if the system overpressurizes. Even though it's an emergency, it's still a procedural mitigation. An engineering mitigation, on the other hand, may have mechanical pressure relief devices in place to mitigate the hazard. Whether or not it's an "emergency" just relates to the severity and time criticality of the hazard, not the mechanism of mitigation.

In safety design the hierarchy of hazard control preference is generally engineering controls, followed by procedural controls, followed by PPE as the least desirable control scheme.

Which distract from dealing with the other causes of the accidents.

One of the common flaws in mishap investigation is jumping to “solving” proximate causes at the expense of finding the root cause. This is applicable to MCAS as well if that isn’t the root cause (although my hunch is MCAS will be closer to the root issue than pilot actions). As long as people aren’t pointing to the AD as the “fix” I think there’s not a problem with it being an interim measure