This question, very similar to “how high is up” has been much in people’s thoughts this week with the Boeing 737 MAX and its two recent crashes.
In an interesting duality that reflects how public debate has not flourished in the social media era, there was first a clamor of people demanding all 737 MAX planes be grounded, and then, as each successive national authority duly did so, even more pressure was felt by the remaining jurisdictions until finally, on Wednesday, Canada and then finally the US grounded the plane and banned them from operations in their airspaces.
Astonishingly (or not, depending on your degree of developed cynicism), instead of approval, the accomplishment of this outcome was immediately greeted by outcries of concern that aviation safety policy was now being made by mob-rule, by people who have no understanding of airplanes or safety. This outcry was bolstered by the uncomfortableness, to many, of having the US ban announced not by the FAA, but by President Trump, a fact that sadly causes some people to automatically take the opposite side of any issue.
In fairness to our President, his role in the decision was not to contradict or overrule the FAA but possibly to support it – the Boeing CEO called President Trump, seeking to reassure him about the plane’s safety and the lack of need for FAA intervention, but Trump chose not to accede to pressure from Boeing and instead supported the FAA’s eventual decision, based on newly received information, to ban the plane.
As for the superior “experts” decrying the general public’s inability to comprehend the complexity of aviation safety policies, we disagree. It isn’t rocket science to comprehend a plane plunging out of the sky, explode into tiny pieces, and kill everyone on board. Neither is it rocket science to count to two : One crash at the end of October last year, a second crash of the same plane type and in a similar fashion in early March this year. Sure, most passengers (and sadly, too many pilots) don’t understand the complexity of the issues as to why the October Lion Air crash occurred, and we’re still too early for clear theories on the second event; but when you’re on a plane that’s crashing, your concern isn’t about which widget broke or why, rather you’re totally fixated that instead of flying calmly and normally, your plane is nose diving into the ground.
So we totally reject the notion that only experts have a say in determining what is safe and acceptable, and what is neither.
We do understand however that two crashes for two different unrelated reasons is a more benign event (if crashes can ever be called benign) than if the two crashes were for related reasons. There’s an interplay between “bad luck” which might possibly be an excuse in the former scenario, and “design fault” which is more likely in the latter scenario. And so it has been the string of similarities between the two crashes, and the lack of an ultimate fix to the problem discovered in the first crash, that has made the second crash deemed to be more alarming.
What are the Chances of a 737 MAX Crashing?
Let’s consider what the chances would be of a third crash and whether they are sufficiently concerning to justify the world-wide ban on the latest version of the long-lived and generally very reliable and successful Boeing 737 family. How many flights did the planes make before the first crash, and how many more before the second crash?
The information to ascertain this is hard to accurately obtain. Even the number of 737 MAX planes delivered is unclear – Boeing says 376, Wikipedia says 350, and if one actually adds up Wikipedia’s count (74 delivered in 2017, 226 in 2018 and 20 in 2019) you get 320, but if you look at their analysis of deliveries, they are totaled to 355. Probably Boeing’s count is most accurate, because it is the most recently updated (as of the end of Feb 2019).
It has been hard to get a count of actual 737 MAX planes delivered monthly rather than total 737 deliveries, so we’ve made some guesses as best we can.
The easier part of this calculation is to look at what happened between the two crashes – Lion Air on 29 October and the Ethiopian Airlines crash on 10 March. We’re going to say that there were 360 planes operational on 10 March and 253 on 29 October, so an average of 290 planes during that period. We’re going to guess than an average 737 MAX flies four or five flights a day, so let’s call that 4.5 flights, and there are 132 days between the two crashes. So that comes to very approximately 172,000 flights, plus or minus a fairly large number depending on the accuracy of our assumptions.
As for the flight count prior to the first crash, that’s a bit harder, but keeping the same 4.5 flights/day, and a staged estimate for deliveries and operational airplane counts, we estimate in the order of 240,000 flights up to that point.
Perhaps surprisingly, the 240,000 flights before the first crash and additional 172,000 flights before a second crash are reasonably close, considering the assumptions and the random factors, and so it seems possible to infer from this, but without much confidence, that on average there could be one fatal crash of a 737 MAX every 200,000 flights or so (say somewhere between 150,000 – 300,000).
If anyone comes along with more accurate data, we’ll eagerly defer to their better numbers, but for now, one crash every 200,000 flights seems a number to work with.
How Safe is Safe Enough? How Risky is Too Risky?
Is this guess of one fatal crash per every 200,000 flights good or bad? Acceptably safe, or unacceptably dangerous? Well, that’s a very subjective question. To put it another way, even the most frequent of fliers is unlikely to fly more than perhaps 20 737 MAX flights a year. So, on that basis, they could fly the 737 MAX for 5,000 years before their chance of being in a crash grew to even odds.
So, by this measure, it seems that the 737 MAX, even at present, is so amazingly safe as to surely not need any further discussion and the planes should be allowed back into the air.
But, the other element of this evaluation is a comparative evaluation – “How safe is normal for modern passenger jets?”.
We discuss the safety of air travel in general, and how to maximize your chances of survival, in a four-part series – click the link.
In general, it seems that there is one fatal crash about every ten million flights. So, with these rough and ready numbers, it could be said that the 737 MAX is 50 times more dangerous than the average airplane, and when you consider that the average airplane is probably something over ten years old, whereas the average 737 MAX is less than one year old, that’s starting to become more significant, and when you assume/expect that more modern planes are safer than older planes, that’s another point of surprising variance.
We can say that if the crash rate remained the same, in a year or two we’d see 737 MAX planes crashing once a month. And that would be unheard of – even the perceived as most dangerous passenger planes ever only crashed a few times before major corrective action was taken (think way back to the Comet, or more recently to the DC-10, and the DC-10 in particular had several unrelated issues).
Or to put it another way, if all the flights in the US were operated by 737 MAX planes, and with these days 15 million flights a year, there’d be one crash every 5 days. That’s clearly a ridiculously high and unacceptable level.
If modern industry “best practices” see other planes being designed and operated with 50 times better safety, surely it is reasonable to expect the 737 MAX to conform to similar best practices and offer a similar level of safety.
And whether one crash per 200,000 flights is good or bad, it is relatively atrocious if the industry average is closer to one every 10,000,000 flights. We’re not certain that this calls for grounding the plane, but we are certain it calls for positive and effective actions, and to be blunt, those have clearly not happened between the October crash and the second one in March.
The Relevance of the Reasons for the Crashes
A valid excuse for not grounding the planes would be if the two crashes were for unrelated reasons. In such a case, you might be seeing simply bad luck rather than a systematic fault, and if that is so, there’s less cause for grave concern.
Air crashes these days (and, indeed, always) are a mixture of (bad) luck as well as specific issues/problems with the planes, their systems, and the pilots flying them. It is hard to correct a “one in a million” string of coincidences and bad luck events that end up causing a crash (although, note, that in reality, safety is so amazing that this “one in a million” chance is more like “one in ten million” in reality).
It is only when you see something that is more obviously a design weakness or a risk that can easily be reduced that you start to focus in on a specific response, and if you see the same flaw causing two crashes within a short period, that is when you definitely need to do something to correct the matter.
The growing sense of the second crash has been to observe more and more similarities in the events as they are currently perceived to be, so as to suggest that the problem that caused the Lion Air crash, a vulnerability still present and unchanged in the planes, may have caused a second crash. To be fair, if it is a problem with the automatic pitch adjusting system, it is a relatively easy problem for the pilots to solve if they are aware of the risk and quick-witted enough to solve the problem by killing the automatic system. Some other pilots have successfully countered this problem, and if advised and trained, all pilots should be able to do so.
So while it is a poorly thought out automatic system, the ultimate point of failure is the poor response on the part of the pilots, an interpretation that not many of the pilot unions and advocacy groups have been rushing to share.
A Non-Technical Explanation of the Reason for the Crashes
To start with, it is important to appreciate that the 737 has changed enormously over the years, but as we understand it, has never undergone an entirely new FAA certification process. Instead, the currently certified latest generation planes have been built over modification to the grandfathered certifications that flow all the way back to the 737-100 that first flew 52 years ago, in April 1967. The 737-100 carried 85 passengers, and had a 1,780 mile range. Its engines each delivered 14,000 lbf of thrust.
The original 737-100 was short-lived and not very successful, selling only 30 units before being quickly replaced by the 737-200, which sold just over 1100 units. Today’s MAX series are the fifth generation of the 737 series. They carry up to 188 passengers (in a two class configuration), fly up to 4,450 miles, and its engines deliver up to 29,300 lbf of thrust.
That’s an enormous transformation, albeit over five different model lineups and 50 years. During these evolutions, just about every part of the plane has been massively changed. The plane has been increasingly an awkward combination of new and old, and design compromises have created some slightly unstable issues, which automation has been created to minimize. This article talks delicately on that topic and why Boeing has been slow to replace the 737, a point we’ve repeatedly made before, including most recently back in January.
One of these problems is that the new more powerful engines (now twice as powerful) and their position with respect to the plane’s center of gravity can sometimes cause the plane to pitch up higher than it should, with the biggest concern being too much of an upward tilt can cause the plane to “stall”, lose its lift, and fall out of the sky. This is not a good thing, and a “clean sheet” new plane design would hopefully be laid out so that the engine thrust vector was more aligned with the plane’s center of gravity (if nothing else it is more efficient to have the engine thrust going in the direction you want it to go).
But Boeing decided to simply come up with a cheap and fast “fix” rather than confront the increasingly overdue need to redesign the entire plane. The new MAX series planes (the MAX 7, MAX 8, MAX 9 and MAX 10) have a system – the MCAS (Maneuvering Characteristics Augmentation System) that automatically moves tilts the elevator (the “wings” at the back of the plane) to cause the plane to return to a better angle of attack (AOA) – its angle as it flies through the sky. It determines the plane’s AOA based on a sensor on the outside of the plane near the front.
The plane has two of these sensors, but the MCAS only uses one of them (we believe it automatically swaps between them from time to time). The problem with relying on data from a single sensor (or even from two sensors) is that if the sensor fails (or one of the two) then the automatic system gets confused.
In comparison, most Airbus planes have three sensors, so that two sensors can “outvote” the third sensor, giving protection against single sensor failures. When you’re using automation to make critical decisions from censors, this seems prudent and necessary.
So, in the Lion Air case, and perhaps in the Ethiopian Airlines crash as well, the single sensor the MCAS relied on became faulty. Sadly, this did not trigger an alarm in the cockpit (there is an optional extra feature that would add an alarm that indicates when the two AOA sensors are not agreeing with each other – we believe that the Southwest and American Airlines MAX planes have this extra feature), and the MCAS didn’t realize that its single sensor input was wrong. So it did what it was programmed to do, automatically pitched the plane’s nose down, thinking it was correcting a “pointing too far up” condition but actually creating a “pointing the nose to the ground” condition. It did not tell the pilots it was doing this, and prior to the Lion Air crash, Boeing had not updated its flying manual to tell the pilots that there was a MCAS and that it might do this.
The pilots noticed the plane had pitched down, and they didn’t know why, so they pulled the nose back up. The MCAS noted that its correction had “failed to work” and so moved the elevators still further. The pilots reacted again, the MCAS reacted even further, and before you know what is happening, the MCAS “won” its unannounced battle for control of the plane and the plane crashed into the ground.
Boeing and the FAA’s Curious Refusal to Conform to Public Pressure
There was justifiable outrage after it was learned what the MCAS was and how Boeing had failed to refer to it in the plane manual. Boeing said, with the smoking ruins of the Lion Air 737 metaphorically in the background, that it didn’t think the pilots needed to know, the pilots already had to learn a lot and this would have been too much for them. This explanation was not well received.
So an official notice was sent out to advise airlines and their pilots of the new MCAS and what to do if it went haywire – basically, turn it off being the solution. Not a complicated solution at all. Boeing also promised to modify the software controlling the MCAS so that it would make changes more slowly and not to such an extreme amount, giving the pilots more time to work out what was happening and to turn the MCAS off before it caused the plane to crash and burn.
The Lion Air crash was on 29 October, and some time in November Boeing undertook to develop a software change and distribute it to its airline clients. But as of now, that software is still being developed.
So both Boeing and the FAA found themselves simultaneously saying that the plane was perfectly safe and there was no need to worry, but also saying that, well, yes, maybe it could be made safer, and please patiently wait for the software to come out at the end of the month or thereabouts.
Both Boeing and the FAA were quite clear that there was no need for any grounding of the 737 MAX fleet.
But as the coincidences and similarities between the two flights became more and more apparent, and as, one by one, the safety authorities in other countries, or even airlines voluntarily on their own, stopped flying 737 MAX planes, on Tuesday, the FAA seemed to be about to change its mind. This was the point where Boeing CEO Dennis Muilenburg phone to try and convince President Trump to in turn convince the FAA that there was no need for action.
President Trump refused, and announced himself the immediate ban on 737 MAX flights in the US, making it the last nation operating 737 MAXes to do so.
And then, guess what. Boeing, without a shred of embarrassment, said that it was happy the FAA had grounded the 737 MAX fleet, and even had the audacity to say that it had recommended the grounding to the FAA.
The Bottom Line
The 737 MAX is delightfully safe, and we could all spend much of the rest of our lives doing nothing other than commuting nonstop on the plane.
But it is also something like 50 times more dangerous than the average airplane today, and we know exactly what it is that is causing this hazard. Fixing the danger is a minor trivial thing to do, and so should be done and must be done. The fix is trivial, and would cost very little to implement, because it is nothing more than a little more pilot training and a patch to the plane’s software routines.
We’re not sure the plane needed to be grounded while this fix was being promulgated, and it shows both how safe aviation is as a whole and how extraordinarily risk-averse the flying public has become that there became a strongly felt need to ground the 737 MAX.
One more thing. One of the quieter parts of this narrative is that the problem with the MCAS has occurred many more than two times. In other cases, the pilots were able to defeat the automation; it is regrettable this didn’t happen with the Lion Air crash, and truly puzzling, if it was the same problem, that it didn’t happen with the Ethiopian Airlines crash. Is there a 737 MAX pilot in the world who didn’t sit up and take notice when the Lion Air plane crashed, and who didn’t read the Boeing bulletin on 6 November about what to do if they experienced a similar problem?
