Aviation Herald has posed these questions to the FAA who declined to answer them while the investigation was ongoing. The last two questions were missed:
"With respect to the certification of the 737 MAX aircraft, in particular the MCAS system, I'd like to raise following questions:
- when was the certificate for the 737 MAX 8 requested, and when was the certification issued?
- what risk assessments were done within the certification procedures, in particular again with respect to the AoAs and MCAS?
- were the ADR (Air Data Reference) algorithms reviewed with respect to AoA?
- was the risk assessed that one of the AoA sensors could be damaged by a bird strike, hail strike or similiar and could show a substantially too high angle of attack?
- did the certification deem not necessary that an "AoA Disagree" message was to be introduced?
- Why was the MCAS permitted to operate on the base of a single AoA value showing too high angle of attacks? Why does the MCAS not consider the other AoA value?
- Was the risk assessed according to Boeing's last sentence in the notice to operators: "If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.", in particular what possibilities existed for that conditions to persist?
- what should the system response have been in case the AoA values disagree? How would the systems determine which value is plausible and which is erroneous? Is there any such check at all? Would MCAS not need to be prohibited if left and right AoA disagree?
- considering the scenario that happened to Airbus twice (the crash in Perignan and the Lufthansa A321 near Bilbao losing 4000 feet), that at least two AoA sensors froze in same positions during climb, was the risk of such a scenario on the 737s assessed, too?
- Did the certification consider a massive change in the function of the AoA when MCAS (as actor in the flight controls) was introduced in addition to stick shaker (monitoring only)?
- What is the reasoning behind the certification permitting to allow a system modify the aircraft's equilibrium (via trim) in manual flight in a way that the trim could run to the mechanical stop and thus overpower the elevator?
- Was the AoA input to the MCAS (or in general) ever being cross checked, e.g. by taking into account altitude, IAS, vertical speed to compute TAS via altitude, density and IAS and the angle of the airflow by computing the angle of the flight trajectory with TAS and vertical speed? Could such an crosschecking algorithm not even detect if two or more AoA sensors were frozen/faulty?
- is the FAA going to review the certification of the 737 MAX family (and perhaps previous 737 versions) following the findings by the KNKT so far?
- Russia's MAK revoked the certificate of airworthiness for the entire 737 family (from 737-100 to 737-900) three years ago claiming they found an issue in the pitch/altitude control system of the aircraft (suggesting that at least the Tatarstan crash in Kazan as well as the Flydubai crash in Rostov may have been the result of that weakness) but did not receive a satisfactory response by the FAA and Boeing, also see News: Russia suspends airworthiness certification for Boeing 737s, but does not prohibit operation of 737s. What was the issue they found?
The questions we forgot to add:
- How the certification deal with spurious faults and spurious functions, in particular during maintenance? The maintenance manuals define a test to be run, then list maintenance steps one by one, the test is to be repeated after each step. If the system is found to be working during the test the maintenance task aborts with the message "You have solved the issue", which may trigger a wrong analysis and premature end of troubleshooting without removing the fault if the test apparently works correctly by random chance.
- Why do the FIM procedures for airspeed disagree, altitude disagree, feel difference light, inexplicable stick shaker activation etc. not reference the possibility of an AoA issue although AoA has a crucial influence onto all these error conditions, thus not guiding the AME to verify proper action of this input in each of these error conditions?"