A parable or “thought experiment” to help explain the 737Max
The 737 has a long and well-deserved history of being reliable, simple to operate and simple to maintain. To many pilots, the modern “seven-three” is a refreshingly manual machine that coexists with airliners that are much more automated and complex. Explaining why the failure of a system called MCAS on the newest version of the plane, the Max, can be so confounding to pilots who didn’t know of its existence before the crashes has proven to be beyond my abilities. But I think I can explain the situation AS I SEE IT with the following story.
Let’s Begin…
On the planet Urf there exists a beautiful string of tropical islands which are called collectively the Mudspike Isles or, simply, “Mudspike”. Mudspike was discovered by Your-Rope-eans centuries before the modern age. The Islanders were almost immediately branded with a reputation of laziness and a notable lack of curiosity. It was recognized early on that Mudspikers had an outsized capacity for memorizing data but this was attributed to a strict system of “rote learning” instilled at an early age by island elders. Those early colonizers were not equipped with sufficient mathematical knowledge to observe how Mudspikers had independently arrived at the concept of zero and had invented the binary decimal system which later would be the foundation for Urf’s digital revolution. Modern Mudspikers worked hard to shake generations of colonial prejudice. They were mostly successful. Mudspike was, in addition to being a tourist haven, a digital hub with an educated and driven populace. Recently however, Mudspikers developed a weird (to the outside Whirled) addiction to flight simulations. In the First Whirled, jokes were commonly made about Mudspikers with their pasty white skin (despite the near-constant tropical sun) shopping indoors with the whole family wearing VR headsets and waving their arms around mysteriously. Everyone it seemed, perhaps most of all Mudspikers themselves, appreciated the jokes. But, like most cultural tics, the practice was greatly exaggerated by people who new little about life as a Mudspiker. Mudspike was led by its hugely popular Moderant (their term for “president”), Chris AV8tor. Moderant AV8tor was like most Mudspikers in that he gave himself an aviation themed name once he came of age. This was another source of snickering in the First Whirled. There was a certain irony that contrasted the Mudspiker love of flying with that old unshakable reputation of rote learning and rigid thinking—two things generally not compatible with good Airmanship.
Most of the joking came from the First Whirled powerhouse nation of Murrr’ka. Murrr’ka was the proud home of Sezna, by far the largest producer of airplanes in the Whirled. The Sezna 172 was so ubiquitous that it was the plane envisioned by non-pilots regardless of the actual airplane being discussed in conversation. For example:
“I fly helicopters.”
“Oh, really!? What kind? A Sezna 172?”
You get the idea. The 172 trained at least half the Whirled’s pilots. And no wonder. It was extremely simple and robust. It had few whistles and bells. A four-place fuselage hung below a “Hershey bar” wing all pulled along by a fixed-pitch metal prop. Sezna also made more complicated planes as did their arch-rival BeachKraft. BeachKraft’s latest design had an order book that was quickly dwarfing that of Sezna’s old standby, the 172. To compete, Sezna came up with a new design called the 172Max. The Max would share most of the features of the existing 172 fleet. But for the first time it would have a retractable landing gear and a variable pitch propeller. These new features gave it performance characteristics that matched or exceeded those of the latest BeachKraft. The problem for Sezna and her customers was that the changes would make the Max a “complex” aircraft. That in turn would require extra training in order for existing 172 pilots to be qualified to fly it. The associated training costs destroyed the economics that otherwise gave the Max such potential. So Sezna came up with a series of automatic features that would hide these changes and allow 172 pilots to operate the new plane just as they have the old. The landing gear would be totally automatic. It would retract when climbing through 1000’ RA and extend when descending through the same level. No gear handle nor any sort of manual extension capability would be provided. The variable pitch prop mechanism was even more complicated — and transparent to the pilot. The throttle and mixture would be the only direct engine controls and would operate identically to the existing 172 fleet. The engine gauge would be labeled “POWER” instead of “RPM” but the analog values would remain unchanged. Max power might be “2700” but that value could be any combination of prop rpm and manifold pressure, as optimized by the engine’s FADEC system. The “mixture” knob controlled no such thing. It was just an engine On/Off switch controlled with the same vernier handle as on the old fleet with the forward 80 percent of travel counting as “On” and the aft 20 percent, “Off”. The pilot would be told little about the system and nothing about the variable pitch properties of the new propeller. The only mention of the system in the flight manual would be…
“The new 172Max incorporates changes to the engine and propeller that will optimize torque and efficiency during all phases of flight and in all possible atmospheric conditions. The pilot no longer needs to worry about RPM redline as the new digital engine control will prevent overspeed so long as the Max is operated within the approved speed envelope. Pilots may notice different engine sounds which could be interpreted as “growls” or “surges”. Such aural feedback is perfectly normal and should not be of concern.”
The “Eff Aye-Aye” was Murrr’ka’s aviation governing body. Recent changes within the agency and within the nation as a whole refocused the role of government to get out of the way where possible and let business do what it does best: build things and keep the economic wheels turning. The “Eff Aye-Aye” handed over much of the traditional oversight concerning development and certification of the new plane to Subject Matter Experts (SME’s), most of whom came from the private sector and, in some cases, Sezna itself. The 172Max required radical changes to traditional training requirements that would not have been possible under certification regimes in place just a few short years before. Existing 172 pilots could qualify to fly the 172Max by downloading a 1 hour GladPad training module from Sezna and passing a 20-question multiple choice quiz. The new plane was an instant sensation.
If any of the nations on Urf were to still have a royal family then Scarlett Hojanssen might have been it’s princess. The supermodel-turned-actress was beloved Whirled-wide. She was smart, charitable, perfect. Scarlett had many would-be suitors but her exclusive love for the last two years was Mudspike’s rock-star Moderant, Chris AV8tor. The citizens of Mudspike were a rare race among the people of Urf. They practically never exhibited the trollish behavior that was part of everyday life in the rest of the Whirled. In other words, Mudspike basically ran itself. That left Moderant AV8tor and his lovely mate to play, travel and effortlessly perform their role as the Whirled’s most admired couple. What the two loved to do most together, at least in public, was fly. The Moderant was the first on Mudspike to take ownership of a brand new 172Max. He was an experienced pilot and so was she. The timing of their Max delivery could not have been better. The biggest event of the year for Mudspikers was the annual Christmas Island Fly-In. Moderant AV8tor and his princess would, of course, be the toast of the event. But their shiny new Max might well have upstaged them both at the Fly-In. That is, if they had made it.
The Whirled was stunned by their disappearance. Hope ruled the first few hours. Some assumed that maybe it had been some sort of elaborate joke — not unheard of with those two. Perhaps the couple had secreted off to one of Mudspike’s many sparsely populated islands for a rare moment away from the pomp and paparazzi. But the plane was soon found floating in the sea. The couple most likely survived the ditching unharmed but were quickly eaten by a vicious Mudspike Kraken.
The Sezna’s digital flight data recorder was recovered and flown to Murrr’ka within hours of the recovery. It was determined that an oil ring in the prop governor had developed a leak. As counterweights acted against the lowering governor pressure, the prop blades increased pitch. The couple likely interpreted the change in sound as a loss of power. Their confusion could only have been compounded by an aural warning moments later:
“Too low! Gear!”
“Too low! Gear!”
A plausible theory is that oil from the leak might have damaged one of the two radar altimeters causing it to send conflicting altitude signals to the automatic landing gear system. System logic states that both altimeters must agree in order for the system to process a command to raise or lower the gear. But if there is a disagreement between the two sensors, a variety of warnings can be triggered. The GladPad app for the Max taught 172Max pilots nothing about this. A repetitive warning about the landing gear at 3500 feet would make no sense to a pilot already dealing with the stress of a possible engine failure. Humans react to conflicting information in unpredictable ways. An airplane screaming information that seems so at odds with the reality of the moment can make a pilot doubt his perception of facts. Panic and doubt mix into a debilitating brew that clouds a human’s ability to react appropriately. The reaction chosen by AV8tor and Hojannsen was to quickly apply full throttle. The rapid change in oil pressure blew out the bad ring entirely causing a total loss of oil. The engine seized within minutes.
Buried deep within the Sezna 172 manual is a curious statement. Not a Limitation. Not a boldface or Memory Item. Just the following few lines in the Systems section: “If experiencing a loss of power, a prudent first course of action should be to check oil pressure.” Nothing more. The same comment migrated over to the new Max manual unchanged. Calling the manual “new” is being generous. The first deliveries were shipped with the original Pilot Operating Handbook with the new POH still awaiting a final sign-off and printing. AV8tor and other new Max owners were given a link to a PDF document which highlighted changes deemed notable by Sezna. Manual aside, no Sezna pilot was taught to react to a power loss by checking oil pressure. Intuitively a pilot would first confirm what he was hearing with the RPM gauge and add throttle. If the problem continued he should check the mixture and fuel quantity and search for a landing spot while troubleshooting further. Sezna saw things differently. They immediately picked apart Moderant AV8tor’s first response as the fatal one. Media talking heads who, up to this point, couldn’t tell a prop from a strut began parroting concerns about AV8tor’s training, his experience and his “background”. It didn’t seem to matter that AV8tor flew WartRemover’s for the MITUAF* in his youth. What mattered, at least to the worst journalistic offenders, was that he was from “over there”. As the horror of the loss was beginning to sink in around the Whirled, an alarming number of pilots began reporting of having had similar problems. Some managed the prop surge without causing further oil loss. Others were faced with seized motors but were able to glide in over more favorable terrain. To experienced 172 pilots, it was quite clear that the new airplane had serious flaws. Pilots imagined themselves in the same situation as Chris and Scarlett over a kraken-filled sea. Some were certain that they themselves would have made it to Christmas Island. Others were more empathetic to the fear and conflicting information that the couple faced. Those initial doubts that Sezna posed about Moderant AV8tor’s skill and training were successful in softening the initial criticism about the new plane. A torrent of such criticism would eventually come, forcing needed structural changes both within Sezna and the “Eff Aye-Aye”. However, that initial damage to the reputation of those two pilots and by extension, pilots the Whirled-over, were impossible to reverse. In hearings, Sezna could point to those doubts which they themselves had planted as cover. They called the event a “a string of unfortunate errors”. They created in the minds of the public a sense of, “Sure, the plane had problems but they were problems that GOOD pilots could easily have managed.” Some aviation experts from Murrr’ka and Your-Rope took it even further. GOOD pilots are “here”, over there…well…c’mon! It’s Mudspike for kryssakes!
What no one knew, outside Sezna and the “Eff Aye-Aye”, until weeks after the crash was the existence of the variable pitch propeller system. Pilots were gobsmacked. “How could Sezna, a company famous for building PILOTS’ airplanes, keep such a fundamental system secret from us?” There is a trust that all pilots develop with the machines they fly. They can never be expected to know everything. But they have the very valid expectation to be told of all subsystems that have the ability to alter major controls. To pilots, this is the pact they have with the people who make their planes. That pact was broken in an unprecedented way when the first Max rolled out of the Sezna hangar.
Agencies of oversight in Murrr’ka and Your-Rope determined the following to be areas in need of correction before the 172Max could return to service:
— The prop system needed a redesign in two areas: oil distribution and the direction the blades should turn in case of a loss of oil pressure.
— The Power gauge needed to be an accurate representation of what the engine is doing. RPM and manifold pressure, even if not directly controllable must be displayed.
— A radar altimeter disagreement must not trigger a gear warning. If the sensors disagree, a Caution should be triggered requiring the crew to confirm aircraft altitude. The bad sensor can then be eliminated from the automation loop based on this input.
— There must be a manual/emergency backup to control RPM directly.
— There must be a manual/emergency backup to raise and lower the gear.
— There must be standard gear position indicators and aural gear warnings.
— Pilots must be trained on the existence and use of all of these systems.
— A GladPad app must never serve as a sole training aid to certify pilots on new equipment.
The 172Max did return to service. Much of the Whirled professed that it would never set foot “in that deathtrap”. An understandable reaction. Of those, only a small percentage would actually follow through. Once corrected, the Max proved to be the same simple and reliable machine that made its predecessor such a success. It took more than a year for Sezna to be fully contrite about how the rush to certification directly led to an airplane with substantial flaws. Poor communication at both Sezna and the “Eff Aye-Aye” allowed these flaws to grow in severity unnoticed. Sezna’s rush to beat BeachKraft was very nearly their undoing. Honesty, late though it was, saved the company and the plane. Sezna was able to repair the trust lost with the flying public and with pilots. The “Eff Aye-Aye” returned to its traditional role as a protector of public safety rather than facilitator of corporate expediency. How unfortunate it is that it took such a tragedy to force systematic changes that were so obvious in hindsight.
That is my long parable. May you sleep well knowing that the skies over Urf are now safe.
