Boeing Board to Call for Safety Changes After 737 Max Crashes

[OldnGrounded]

(Not sure whether this should be here or in the ongoing MAX thread.) Posted to the Times website a couple of hours ago:

Boeing Board to Call for Safety Changes After 737 Max Crashes (https://www.nytimes.com/2019/09/15/business/boeing-safety-737-max.html)

For the past five months, a small committee of Boeing’s board has been interviewing company employees, safety experts and executives at other industrial organizations in an attempt to understand how the aerospace giant could design and build safer airplanes.

The committee is expected to deliver its findings to the full Boeing board this week, and call for several meaningful changes to the way the company is structured, according to three people briefed on the matter who spoke on the condition of anonymity because the report has not yet been submitted.

The recommendations will include that Boeing change aspects of its organizational structure, calling for the creation of new groups focused on safety and encouraging the company to consider making changes to the cockpits of future airplanes to accommodate a new generation of pilots, some of whom may have less training.

More (https://www.nytimes.com/2019/09/15/business/boeing-safety-737-max.html)

[DieselOx]

If these last 3 paragraphs are any indication of the state of communication between Boeing and regulators, things are not looking good for the MAX flying soon:

In August, Boeing met with officials from the F.A.A. and other global aviation agencies to brief them on its efforts to complete fixes on the Max. Regulators asked detailed questions about adjustments to the Max’s flight control computers, which the Boeing representatives there were not prepared to answer.

Instead, the company representatives began to display a PowerPoint presentation on their efforts, according to people briefed on the meeting who spoke on the condition of anonymity because it was not public.

At that point, the regulators ended the meeting. Weeks later, Boeing has still not answered all their questions.



Sounds a lot like public comments on the nature of the Brexit negotiations by Boris Johnson (much progress being made in negotiations), contrasted with statements from the EU (nope, not happening).

Talking past each other? Not a good sign. Must be missing something, I thought FAA was working closely on final fix details, getting ready to start test flights?

[fdr]

(Not sure whether this should be here or in the ongoing MAX thread.) Posted to the Times website a couple of hours ago:

A great development.

However,

Boeings real problems are not in the aircraft, they are in the corporate managements failure to live up to their code of ethics. When they do an RCA and ascertain why they elected to act as they did with the QA engineers that discovered the non compliant parts being put onto the first years of the NG production from their supplier, then perhaps they will be able to implement appropriate changes. They appear to only respond to adverse outcomes instead of being proactive in maintaining the ethical standards that once upon a time they were famous for, rather than being infamous.

Boeing has the technical competency and the ability to be innovative if they choose to be. For the last 40 years, a great deal of the innovation has been acquired by takeovers of other companies and their programs, which achieves the desired outcome, but can lead to organisational problems. However, the .767 Tanker ethics issues, the 737 production non compliance and their response, the MAX, 767 FOD, 787 production line concerns point to corporate changes being necessary. Boeing is still a global leader, but they could be working towards being the supplier of last resort as competent alternatives to their programs exist.

The legacy holdover of the 737 has been forced mainly by the airlines, and that is probably reaching a logical end following the MAX debacle. Airbus went a smarter route with the CCQ, Boeing needs to go back to some basic assumptions as to what needs to be taught, and consider green field designs in the future that train for necessary differences, which frankly has little to do with flying the aircraft, it has a lot to do with the system architecture, for which the crew need a modicum of knowledge. To avoid excessive training overhead, the current variant, MAX holds over outdated system architecture. Yet the MAX event resulted from a lack of knowledge of the crew as to the existence and the function of the MCAS, and the historical issues with the manual trim, which would appear to contradict a position suggesting that generic training is appropriate. Each systems FMA should be fully known by the manufacturer, at the time of design. That would result in a requirement to observe a fault, and respond accordingly. MCAS was an "unknown unknown"... a failure of the FMA process in the design of the system.

Applying (or mis-applying) the Pareto Rule, 20% of operators will benefit from having highly detailed knowledge on the systems and design, the other 80% want to know what page to turn to in the QRH. 100% are required by operating protocol to adhere to the QRH, and not go out doing heroic intervention from the get go. It is interesting to note that culturally, the groups that want or expect greater background information are those that also have the highest levels of individualism and the lowest level of compliance with formal procedures.

The fundamental problem is not a technical issue, that is the glaring consequence. The problem is a cultural one that has been growing in extent for decades, and has been spack filled by the corporation to date.

COOB, fix the root cause, stop fluffing around on the periphery of the problem; Nero's fiddle playing didn't help Rome (1).

time for a Sapporo


(1) In July, 64 A.D., the fiddle didn't exist, but citharas did. Nero had sung on sacking Troy, and Tacitus appears to have conflated the two by his writings:
"pervaserat rumor ipso tempore flagrantis urbis inisse eum domesticam scaenam et cecinisse Troianum excidium, praesentia mala vetustis cladibus adsimulantem", [‘the rumour had spread that, at the very moment when Rome was aflame, he had mounted his private stage, and, assimilating the ills of the present to the calamities of the past, had sung the Destruction of Troy’]. Nero was 30 miles from Rome when the 6 day fire of July started ... but legend gives the parable of his playing an instrument that didn't exist for another millennia, a behaviour that is contrary to accounts by others at the time of his leadership in combatting the conflagration. However, it is a simple parable describing inappropriate interventions.

[ATC Watcher]

Superb post fdr ..
the article also mentioned : Chris Hart, the former chairman of the National Transportation Safety Board, is leading a task force reviewing how the Max was certified.The report is expected to include about a dozen recommendations, with a focus on improving transparency in the certification process.
If the report will be only a list of recommendations how how to do it in the future, that will be good for safety , however by highlighting the past failures it has also the possibility to open a fresh cans of worms if one really look at the past certifications..
Sometimes it is better to learn from the past and look and concentrate only at the future.

[OldnGrounded]

A key point from the article, focusing on something discussed in some depth in these threads:

One of the report’s most significant findings concerns the reporting structure for engineers at the company. At Boeing, top engineers report primarily to the business leaders for each airplane model, and secondarily to the company’s chief engineer. Under this model, engineers who identify problems that might slow a jet’s development could face resistance from executives whose jobs revolve around meeting production deadlines.

The committee recommends flipping the reporting lines, so that top engineers report primarily to Boeing’s chief engineer, and secondarily to business unit leaders.

[etudiant]

A great development.

However,

Boeings real problems are not in the aircraft, they are in the corporate managements failure to live up to their code of ethics. .

Sadly true, based on the evidence to date.
That is entirely the fault of the Board, isolated in an Chicago tower far from any of the operations. They rely on corporate presentations to make decisions, but those presentations may be at variance with reality.
Do note that this kind of separation of the leadership from the operations is also in effect in the defense sector, where most big firms are headquartered around Washington. There are obviously similar consequences there, but it is less visible.

[safetypee]

“The plight of Boeing shows the perils of modern capitalism. The corporation is a wounded giant. Much of its productive capacity has been mothballed following two crashes in six months of the 737 Max, the firmʼs flagship product: the result of safety problems Boeing hid from regulators.”

https://www.theguardian.com/commentisfree/2019/sep/11/boeing-capitalism-deregulation

[safetypee]

“ Development is a series of tradeoffs, often with incompatible constraints. Multiple factors compete for attention, each factor often demanding a solution that is incompatible with that required by another factor. Marketing, engineering, usability experts all champion their favored approach, each correct in their assessment, but nonetheless, each voicing different and incompatible concerns.

… success in the early stages of the technology marketplace favors technology-centered, feature-driven products. Customers clamor for more and better technology: engineers become experts at providing a stream of continual improvements in power, increased features, all at decreased cost. In this world, engineering rules the show.
Engineers reluctantly cede a place for marketing, and the reluctance is quite visible.

Marketing, moreover, becomes primarily feature-driven: query the existing customers for the features they desire most and pressure the engineering team to add them to the product, often with little regard, understanding, or even interest upon the impact on the coherence and integrity of the product. These are technology-driven customers, customers who purchase their products based upon technological accomplishments, upon novelty and lists of features.

In the latter stages of a technology, the game changes considerably. The technology is taken for granted. Factors such as the total user experience play a major role: customers want convenience and lack of hassle. This new entry, user experience, is not well established. Nobody quite knows how to deal with it.

The engineering team thinks it already understands user experience. After all, their previous customers were happy. The engineers themselves have no trouble with the product. Who are these new customers who need so much hand-holding? What’s the matter with them, anyway.

The marketing group thinks it already understands user experience. After all, marketing is in close touch with the customer: it knows first-hand what they want. Do they want ease of use? Sure, add it to the list of features. Do they want an attractive product, sure, hire a graphics designer to make it look pretty. Each item gets added to the list of things to be accomplished, as if the total user experience were a feature like “more speed” or “more memory” that can be purchased or added on to an established design.

… user experience is just another add-on … ease-of-use comes late in the game: after all, how can you make a product easy to use before it has been built?
First we build it, say the engineers, then we bring in those user interface folks to add some graphics and menus and make it easy to use.
… technical writers: how can you describe how to use a product until it is all finished, so there is actually something to write about? The writer’s job comes at the end.

Marketing provides a list of essential features: the engineers state what neat new technical tricks and tools they are ready to deploy. The engineers build the device, putting as many new technologies to work as they can within their allotted time and budget, squabbling with marketing along the way over which of those features really matter and which don’t. Then after all is finished and the product ready to ship, call in the technical writers to explain it to the customers. Call in the graphics and industrial designers to make it look pretty. Call in the user interface experts to make it usable.

Guess what: this process doesn’t work. … simply have to look around us at those high-technology products. “
… why so many telephone help lines are required, (but not available in flight).

Read on … https://www.nngroup.com/articles-want-human-centered-development-reorganize/
‘The Invisible Computer’ Don Norman 1998 https://jnd.org

Also https://jnd.org/people-centered-not-tech-driven-design/

If you can think of a clever solution in a few hours, assume many others have already done so.
I learn more by being wrong than by being right
It's not you. Bad (systems) are everywhere.
Failures? No -- Learning Experiences
Simplicity is in the mind
Design for real people
Don't be logical

P.S. also ‘Being Analog’ https://jnd.org/being_analog/

[EEngr]

The legacy holdover of the 737 has been forced mainly by the airlines, and that is probably reaching a logical end following the MAX debacle.

I wonder about this. Boeing just needs to call their bluff. An airline that won't spring for a few hours of classroom and simulator time to learn a new subsystem isn't likely to start their flight crews from scratch with a side-stick.

[Ian W]

“The plight of Boeing shows the perils of modern capitalism. The corporation is a wounded giant. Much of its productive capacity has been mothballed following two crashes in six months of the 737 Max, the firmʼs flagship product: the result of safety problems Boeing hid from regulators.”

https://www.theguardian.com/commentisfree/2019/sep/11/boeing-capitalism-deregulation



It actually shows the opposite.
In a command socialist society Boeing would be commanded to continue. In the capitalist society people stop flying in the Max so air carriers stop buying the Max and the company building the Max suffers a financial loss. The companies that sell better aircraft start winning more orders. This is capitalism controlling the market to ensure better quality aircraft. Similarly, the company making a loss removes those who made the incorrect decisions, learns from their failures and works to regain market share.

[Water pilot]

It actually shows the opposite.
In a command socialist society Boeing would be commanded to continue. In the capitalist society people stop flying in the Max so air carriers stop buying the Max and the company building the Max suffers a financial loss. The companies that sell better aircraft start winning more orders. This is capitalism controlling the market to ensure better quality aircraft. Similarly, the company making a loss removes those who made the incorrect decisions, learns from their failures and works to regain market share.

Um, I think that you have that example backwards in an industry that is not exactly a shining example of the free market anyway. In this case, government agencies commanded airlines to stop flying the 737 MAX. If it were up to the airlines and Boeing (or the FAA), they would still be in the air and I am sure at least some people would still be boarding them. If the only plane that gets you to where you want to go is a MAX do you walk?

[RatherBeFlying]

Upper management types consider themselves masters of the universe, cf. Trump's sharpie showing Dorian on track to hit Alabama and the attempted retaliation against NOAA truth tellers:}

Engineers (and other techies) understand there's no bending the laws of physics and math.

To be honest, the aerodynamics folks have a much better record of success than the software folks – dead bodies are harder to explain away than failed software.

I have seen several failed software projects. Management has the blinkers firmly screwed on and hangs on to MBA hallucinations.

[OldnGrounded]

I wonder about this. Boeing just needs to call their bluff. An airline that won't spring for a few hours of classroom and simulator time to learn a new subsystem isn't likely to start their flight crews from scratch with a side-stick.

True, but the ones with existing contracts (at least SWA) probably will want to enforce the $1 million per unit penalty. Of course, that might seem like a minor expense, at this point.

[OldnGrounded]

The companies that sell better aircraft start winning more orders. This is capitalism controlling the market to ensure better quality aircraft.

What we actually have is an example of unrestrained capitalism destroying competition to the point that the "market" provides only two choices for purchasers of large airliners. It doesn't much resemble a "free" market at all.

[rightseatNsweating]

(Not sure whether this should be here or in the ongoing MAX thread.) Posted to the Times website a couple of hours ago:

.....to the cockpits of future airplanes to accommodate a new generation of pilots, some of whom may have less training.

Having had some recent exposure to training/examination in parts of Africa, I do think part of the problem lies here. I see aviation schools churning 100s of students per year through a completely broken system. They learn to work the system which requires zero understanding of the basics, just a mix of corruption and rote memorization to get through laughable exams. It would not surprise me to find the same was happening in other parts of the world such as East Asia.

I can only trust that they then get serious on-type training when they move onto the big carriers, but they are essentially starting from zero. They must have unpredictable but fundamental gaps.

[LowObservable]

One of many problems with the Grauniad story is that it gets history backwards. It was the pre-McMerger Boeing that hadn't had a peer competitor since the 1970s, a result of the suicide-pact development of the DC-10-10 and L-1011 - those were the last two all-new non-Boeing airliners launched in the US, 51 years ago. That was why Boeing could afford the massive overruns on the 777. Not until the late 1990s did Airbus really start to catch up and put some pressure on Seattle.
Neither was "classic" Boeing perfect: the Macs crew had nothing to do with the botched launch of the 737NG, the result of the "engineer-driven" culture's failure to fix a ramshackle system of configuration control that dated back to the Flying Fortress.
That said: the current obsession with share price is not a good thing. Share price is an indicator of the company's worth, but when management focuses solely on share price, it's like a school "teaching to the test": buybacks and dividends are used to pump the price.

[Less Hair]

The stock exchange has become so important for financing they even moved their group HQ from Seattle to Chicago to be closer to the east coast financial markets and media.

[triploss]

Having had some recent exposure to training/examination in parts of Africa, I do think part of the problem lies here. I see aviation schools churning 100s of students per year through a completely broken system. They learn to work the system which requires zero understanding of the basics, just a mix of corruption and rote memorization to get through laughable exams. It would not surprise me to find the same was happening in other parts of the world such as East Asia.

I can only trust that they then get serious on-type training when they move onto the big carriers, but they are essentially starting from zero. They must have unpredictable but fundamental gaps.
First post on this forum, and already trying to resurrect the bad pilots theory of the Ethiopian and Lion Air flights? Seems reasonable.

[Preemo]

What we actually have is an example of unrestrained capitalism destroying competition to the point that the "market" provides only two choices for purchasers of large airliners. It doesn't much resemble a "free" market at all.

Not to divert the thread, but aviation is not an example of unrestrained capitalism. The more regulation and red tape, the more socialistic the industry, and there are few industries with as much government involvement as aviation.

[OldnGrounded]

Not to divert the thread, but aviation is not an example of unrestrained capitalism. The more regulation and red tape, the more socialistic the industry, and there are few industries with as much government involvement as aviation.

I don't want to diver the thread, either, but I need to point out that regulation in a capitalist economy is *not* socialism. If the aircraft manufacturers were operated under a socialist system, ownership, pricing, and probably the costs of labor and materials would be controlled by the workers/community/government. The same is true of operators, etc. We don't have that anywhere in the West.

Back to Boeing.

[anson harris]

It actually shows the opposite.
In a command socialist society Boeing would be commanded to continue. In the capitalist society people stop flying in the Max so air carriers stop buying the Max and the company building the Max suffers a financial loss. The companies that sell better aircraft start winning more orders. This is capitalism controlling the market to ensure better quality aircraft. Similarly, the company making a loss removes those who made the incorrect decisions, learns from their failures and works to regain market share.

Were that to be true if Boeing hadn't hoovered up all the major US manufacturers. Now their greed for power and market share has put the whole picnic in peril.

[maxter]

It actually shows the opposite.
In a command socialist society Boeing would be commanded to continue. In the capitalist society people stop flying in the Max so air carriers stop buying the Max and the company building the Max suffers a financial loss. The companies that sell better aircraft start winning more orders. This is capitalism controlling the market to ensure better quality aircraft. Similarly, the company making a loss removes those who made the incorrect decisions, learns from their failures and works to regain market share.

Or is capitalism in this case 'pushing the edges until the death rate becomes intolerable.' Surely there must be a compromise where we can have innovation but not at the expense of lives. I think we see too much going wrong across many industries where 'let the market decide' is not working well

[Tomaski]

First post on this forum, and already trying to resurrect the bad pilots theory of the Ethiopian and Lion Air flights? Seems reasonable.

I also think one can reasonably discuss inadequate training and adverse corporate culture without going down the path of labeling anyone as a "bad" pilot.

[FlightDetent]

I also think one can reasonably discuss inadequate training and adverse corporate culture without going down the path of labeling anyone as a "bad" pilot. Towards which I submit the following:

Recent comms by B.A. suggest an angle where the global achieved skill standard needs to be reviewed due to anecdotal evidence that assumptions about pilots capabilities the manufacturers and regulators hold are overly optimistic, upsets my stomach.

It actually is true, though. Namely, Ethiopean had 2 and LionAir too many to count. Still there's a bad tail about such win-win statements, subtly suggesting the Runaway Trim NNC was enough to keep souls alive. Flying brick it wasn't!

Our much beloved industry need Boeing to raise reborn out of all this, the ideas at the beginning of this thread need to be applauded and we all hold fingers crossed.

[fdr]

[QUOTE=FlightDetent;10572486]Towards which I submit the following:

Recent comms by B.A. suggest an angle where the global achieved skill standard needs to be reviewed due to anecdotal evidence that assumptions about pilots capabilities the manufacturers and regulators hold are overly optimistic, upsets my stomach.

It actually is true, though. Namely, Ethiopean had 2 and LionAir too many to count. Still there's a bad tail about such win-win statements, subtly suggesting the Runaway Trim NNC was enough to keep souls alive. Flying brick it wasn't!

Our much beloved industry need Boeing to raise reborn out of all this, the ideas at the beginning of this thread need to be applauded and we all hold fingers crossed.[/QUOTE

Hmmm...

OK....


​​​
And Air France had, let's see, an off at Toronto, a splash in the Atlantic, and a huge number of other events. There was the forest pruning at Habsheim, and Air Inters FPA vs FPM into Strasburg. Those were all Airbus products, not Boeing, (there are sundry antics with Boeing by AFR as well along the way, Delhi, Papeete come to mind). In the period since the Max had issues, non ET and JT planes have gone off the end of runways in countries that are considered first World, English speaking... and we have splashed one or two as re runs of one of the pointed commentary events.

Pan Am knew the 7 seas, they left debris in each one.

The pilots we have today are the product of the desires of the industry. The pilot is not responsible for a standard being great or otherwise.

Flying is a dynamic task, that requires engagement and participation by all concerned, not just the crew that get selected.

Not picking on Air France in particular... But it doesn't have a lost in translation issue, and assuming that the ills of the aviation world today is due to the pilot, 3rd World, Boeing, does not hold up to any level of scrutiny.

S. A. Maintenance is the pernicious, intractable issue, that dates back before the Red Baron took a. 303 round in a soft
​​spot. Fix the root problem, not the symptoms.

Other than in quantum physics, our universe has time flowing from before to after, so fix the root cause, which is not what most of the strident calls on this forum hold as causation.

Before. >>>>>>> not before

FD, if you think the ET crew didn't have a considerable HQ issue to deal with, which was not fully covered in the AD and NTC, then you should start reading the applicable threads again from the beginning, or have a chat with people who fly the737 or are involved in flight test involving HQ.

Your jet manages to kill competent people today, that aren't out of Sea or Africa, including for loss of control, remember Excel at Perpignan.?

[rightseatNsweating]

I also think one can reasonably discuss inadequate training and adverse corporate culture without going down the path of labeling anyone as a "bad" pilot.

Exactly. I am angered by some (let’s be honest, racist) comments about 3rd world pilots. However, it is a fact that many pilots in Africa do emerge from deeply flawed training systems, built on deeply flawed education systems. I have personally seen this forcing a mentality of working the system and playing the odds rather than focusing on developing core skills and knowledge. These kids do not choose to work like that, the system forces them into it.

It is also a fact that the responses of the Ethiopian and Lion Air crews were less than perfect. None of us can be sure how we would have responded to the situations that they found themselves in. But particularly in the case of ET, there were (in)actions that in the cold light of day are hard to understand. I weep for the young ET FO apparently getting it right at first but subsequently doubting his own judgement.

Dropping in and out of here for a while, I was triggered to post by the comment about Boeing being advised by their own board to design aircraft for less well-trained pilots. That may be a cynical ploy to keep the pressure on pilot error as the real cause, but we must work to maintain the reputation of the profession in the face of a growing tendency to portray pilots as robotic button pushers.

[FlightDetent]

fdr you seem to be arguing against things that I oppose myself. Hence the overall tone of you reply is a bit confusing, and there are chunks lost in translation I cannot make any sense of at all. Shall try to rephrase mine when there's bit more RnR time. Off to test the stickforces on Airbus approaching stall.

Oh, that. Could we please not spoil Boeing threads with (anti) Airbus-connected agenda, which you are actually very bad at? Just to reiterate we paddling on the same boat: AF of not so distant era deserves to be picked on by all means possible.

[Mac the Knife]

If the aircraft manufacturers were operated under a socialist system, ownership, pricing, and probably the costs of labor and materials would be controlled by the workers/community/government.

There. Fixed that for ya'

Mac

[OldnGrounded]

If the aircraft manufacturers were operated under a socialist system, ownership, pricing, and probably the costs of labor and materials would be controlled by the workers/community/government.

There. Fixed that for ya'

Mac

You didn't fix it. You just demonstrated an overly-narrow understanding of the concept of socialism.

[twochai]

I also think one can reasonably discuss inadequate training and adverse corporate culture without going down the path of labeling anyone as a "bad" pilot.

Absolutely true - here's a very good piece in today's NYT from the great aviation writer, William Langewiesche 'What really brought down the 737 MAX?'

https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html?action=click&module=Top%20Stories&pgtype=Homepage

[OldnGrounded]

Absolutely true - here's a very good piece in today's NYT from the great aviation writer, William Langewiesche 'What really brought down the 737 MAX?'

https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html?action=click&module=Top%20Stories&pgtype=Homepage

To me, Langewiesche's piece reads very much like pilot-blaming (especially blaming "third-world" pilots) with a strong slant toward minimizing Boeing responsibility for the MAX crashes.

[GordonR_Cape]

To me, Langewiesche's piece reads very much like pilot-blaming (especially blaming "third-world" pilots) with a strong slant toward minimizing Boeing responsibility for the MAX crashes.

I stumbled on a link that discusses many technical errors and omissions in the article: https://www.moonofalabama.org/2019/09/14000-words-of-blame-the-pilots-that-whitewash-boeing-of-737-max-failure.html

[pilotmike]

Some quotes"from the great aviation writer, William Langewiesche"...

Like thousands of new pilots now meeting the demands for crews — especially those in developing countries with rapid airline growth — his experience with flying was scripted, bounded by checklists and cockpit mandates and dependent on autopilots. He had some rote knowledge of cockpit procedures as handed down from the big manufacturers, but he was weak in an essential quality known as airmanship. Sadly, his captain turned out to be weak in it, too.
Airplanes are living things. The best pilots do not sit in cockpits so much as strap them on.
... airline pilots who never fly solo and whose entire experience consists of catering to passengers who flinch in mild turbulence, refer to “air pockets” in cocktail conversation and think they are near death if bank angles exceed 30 degrees.... The worst of them are intimidated by their airplanes and remain so until they retire or die. It is unfortunate that those who die in cockpits tend to take their passengers with them
twenty-five seconds later (a long interlude in flight), Harvino requested a clearance to “some holding point” where the airplane could linger in the sky. The request was surprising. The controller did not provide a holding point but asked about the nature of the problem. Harvino answered, “Flight-control problem.” He did not mention which kind, but before they die, pilots are rarely so descriptive.
After both accidents, the flight-data recordings indicated that the immediate culprit was a sensor failure tied to a new and obscure control function that was unique to the 737 Max: the Maneuvering Characteristics Augmentation System (MCAS). The system automatically applies double-speed impulses of nose-down trim, but only under circumstances so narrow that no regular airline pilot will ever experience its activation — unless a sensor fails. Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane’s flight manuals.

=The system in question is complicated, and we will return to it later, but for now it is enough to know that after the loss of Lion Air 610, the company suggested that the 737 Max was as safe as its predecessors. Its tone was uncharacteristically meek, but not for lack of conviction. The company seemed hesitant to point the finger at a prickly customer — Lion Air — that had several billion dollars’ worth of orders on the table and could withdraw them at any time. The dilemma is familiar to manufacturers after major accidents in which it is usually some pilot and not an airplane that has gone wrong. Nonetheless, Boeing’s reticence allowed a narrative to emerge: that the company had developed the system to elude regulators; that it was all about shortcuts and greed; that it had cynically gambled with the lives of the flying public; that the Lion Air pilots were overwhelmed by the failures of a hidden system they could not reasonably have been expected to resist; and that the design of the MCAS was unquestionably the cause of the accident. But none of this was quite true. The rush to lay blame was based in part on a poor understanding not just of the technicalities but also of Boeing’s commercial aviation culture. The Max’s creation took place in suburban Seattle among engineers and pilots of unquestionable if bland integrity, including supervising officials from the Federal Aviation Administration.
After President Trump weighed in on the basis of no perceptible knowledge, and the F.A.A. was forced to retreat from its initial defense of the airplane, Boeing had to accept a public onslaught. The onslaught has included congressional hearings, federal investigations, calls for the criminal prosecution of Boeing executives, revelations by whistle-blowers, attacks in the news media, the exploitation of personal tragedy and the construction of a whole new economic sector built around perceptions of the company’s liability. Boeing has grown largely silent, perhaps as much at the request of its sales force as of its lawyers. To point fingers at important clients would risk alienating not only those airlines but others who have been conditioned to buy its airplanes, no matter how incompetent their pilots may be.

"William Langewiesche is a newly named writer at large for the magazine. He is a former national correspondent for The Atlantic and international correspondent for Vanity Fair, where he covered a wide variety of subjects throughout the world. He grew up in aviation and got his start as a pilot before turning to journalism. This is his first article for the magazine."

Shocking. I hope this might be his last article.

[DaveReidUK]

Not forgetting The Atlantic Dusts Off Discredited Conspiracy Theory to Accuse MH370 Pilot of Hijacking (https://www.thedailybeast.com/the-atlantics-william-langewiesche-dusts-off-discredited-conspiracy-theory-to-accuse-mh370-pilot-of-hijacking)

Suicide-murder by the captain, in case anyone was wondering, according to Langewiesche.

[Preemo]

I don't want to diver the thread, either, but I need to point out that regulation in a capitalist economy is *not* socialism. If the aircraft manufacturers were operated under a socialist system, ownership, pricing, and probably the costs of labor and materials would be controlled by the workers/community/government. The same is true of operators, etc. We don't have that anywhere in the West.

Back to Boeing.

I did not say it was socialism, but what I did say was, “The more regulation and red tape, the more socialistic the industry.“

Back to Boeing

[Preemo]

Or is capitalism in this case 'pushing the edges until the death rate becomes intolerable.' Surely there must be a compromise where we can have innovation but not at the expense of lives. I think we see too much going wrong across many industries where 'let the market decide' is not working well

Any drive to an extreme at either end will end badly. In my view this is a failure of the regulator - when the FAA put the fox in charge of the chicken run, bad things were more likely to happen. When the FAA has conflicting goals (safety and the encouraging travel). There is some good background on this alleged example of regulatory capture in the FAA wikipedia article.

[OldnGrounded]

Not forgetting The Atlantic Dusts Off Discredited Conspiracy Theory to Accuse MH370 Pilot of Hijacking (https://www.thedailybeast.com/the-atlantics-william-langewiesche-dusts-off-discredited-conspiracy-theory-to-accuse-mh370-pilot-of-hijacking)

Suicide-murder by the captain, in case anyone was wondering, according to Langewiesche.

Yikes.

In the comments below today's Times article, posters who question Langewieshce's analysis are being asked (paraphrasing): Do you know who he is and who his father is? People often perceive expertise based upon fairly irrelevant factors.

[n5296s]

To be fair to Langewische, he is a decent writer and does actually know something about aviation, unlike most people who write about it. However he does seem to have taken a serious overdose of Boeing Kool-Aid here.

In fact, even if he were right that all right-thinking 'murcan pilots would have flown their way out of this (and there are certainly plenty of those who believe that) - it's STILL irresponsible (at best) to build an aircraft that can't be flown by 75% of the pilots who will get to do so. Suppose Toyota or Ford built a car that had 10x the fatal accidents of other cars, and their defence was "but the drivers just needed better training, it's terrible how under-qualified today's drivers are". I don't think that would go down very well. Maybe in 1960 it would have (the Renault Floride c. 1960 was indeed pretty much undrivable by normal mortals).

[GordonR_Cape]

Absolutely true - here's a very good piece in today's NYT from the great aviation writer, William Langewiesche 'What really brought down the 737 MAX?'

https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html (https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html?action=click&module=Top%20Stories&pgtype=Homepage)

I was prepared to give Langewiesche the benefit of the doubt in only focusing on the pilots, but now mainstream media are using his article as 'proof' that the crashes were not Boeing's fault: https://www.businessinsider.com/737-max-blame-inexperienced-pilots-boeing-nyt-report-2019-9
A damning new report on the 737 Max blames 'inexperienced pilots' and the low-cost airlines who employ them — not Boeing

[OldnGrounded]

I was prepared to give Langewiesche the benefit of the doubt in only focusing on the pilots, but now mainstream media are using his article as 'proof' that the crashes were not Boeing's fault: https://www.businessinsider.com/737-max-blame-inexperienced-pilots-boeing-nyt-report-2019-9

I think that's exactly what was intended by the writer and those who enabled the placement of the op-ed (not a "report").

[fdr]

Some quotes"from the great aviation writer, William Langewiesche"...








"William Langewiesche is a newly named writer at large for the magazine. He is a former national correspondent for The Atlantic and international correspondent for Vanity Fair, where he covered a wide variety of subjects throughout the world. He grew up in aviation and got his start as a pilot before turning to journalism. This is his first article for the magazine."

Shocking. I hope this might be his last article.

You may be on to something there...

Dear FAA STDS person, I was reviewing my PQS document for a student, and my copy is missing the PQS details for the required strapping on of an aircraft. I found the spurs to be removed before flight and the requirement to fly only when there is lift in the air, but somehow my copy from the printer was missing the strap on performance standard. Please rectify at your earliest convenience,

Yours faithfully,
Otter Lillienthalhammerburgvillestreet.

No 49A
No fixed Abode
Kill Devil Hills
Outer Banks
NC
USA, USA, USA

90012

(202)555-5555

[ATC Watcher]

Langewiesche.articles ( remember the AF447 one) are written like mini-novels , with drama, adding personal " human " quotes, and therefore they are well received by the public . The problem here , like in the AF447 and the MH270 ones , is that he speculates a lot and present some of his ideas , or even rumors as kind of facts.
That said , his audience is the general public, not aviation professionals.
To his defense, he knows aviation and goes on to location to interview people ( or try to ) to write his pieces, something many other journalists fail to do.

His piece about the kids school in Jakarta is correct , yes it is just like this. I have been there and talked to the people running this "academy" which is run like a military camp. Yes those kids will be in the RHS of a 737 or 320 a year later after max 75h or real flying in a TB20. . But same in other parts of the world including Europe.
One thing that he does not emphasize in his piece is that the very poor accident rate in the country is vastly due to equatorial weather conditions and extremely poor infrastructure, lack of nav aids, etc.. Add corruption at all levels preventing any oversight, plus everybody else working around the system receiving extremely low salaries , forcing them to get a second , or sometimes 3rd job to sustain a family, and you get the environment .
The actual quality of the pilots is not the real problem in Indonesia, as this article would want the public to believe. I think this article is just preparation work to reassure the US public that it will be safe to fly again in the max in the coming months because they will be operated by US pilots. .
Clever.

[Thistle42]

Langewiesche.articles ( remember the AF447 one) are written like mini-novels , with drama, adding personal " human " quotes, and therefore they are well received by the public . The problem here , like in the AF447 and the MH270 ones , is that he speculates a lot and present some of his ideas , or even rumors as kind of facts.
That said , his audience is the general public, not aviation professionals..........The actual quality of the pilots is not the real problem in Indonesia, as this article would want the public to believe. I think this article is just preparation work to reassure the US public that it will be safe to fly again in the max in the coming months because they will be operated by US pilots. .
Clever.
Agree, that article looks like a softening up prep for the public in North America. I feel for the flight crew who will have to fly the damn things or walk away from their job. It plays on the meme of ‘foreign pilots bad, our pilots good’ especially when you read the last line of that article.

[LowObservable]

The Langewiesche piece is taking 14000 words to sell the same message as some forum members here tried to sell: that real "airmanship" would have saved the day. But in the process the writer:

- downplays or simply ignores the fact that AoA-failure-induced MCAS action doesn't look like runaway trim, because it responds to cancellation with the yoke switches
- skates over the fact that a condition with failed power trim, AND trim and high speed can rapidly become very difficult to handle, hence the "roller-coaster" maneuver
- simply doesn't mention the simple fact that this particular failure was fatal two out of three times it occurred, and that once an erroneous MCAS action kicked in, the crew had become test pilots,

Now, maybe Langewiesche simply believes that flight training standards are inadequate and that pilots need experience in manual-control airplanes that they'll never fly professionally. But the missing bits of the story - including no "I asked Boeing to comment on XYZ and they declined", which is boring narrative but good practice - makes it sound consciously pro-Boeing to those familiar with the issues. On the other hand, even an attentive layman reader, or a general-interest editor, will not be aware of what was left out of the story.

I would think Boeing would be crazy to try to plant a story like this, because of the blowback should any linkage be revealed. But there is crazy - and there is desperate.

[Tomaski]

I am cautious about wading into the commentary about the Langewiesche NYT article, but I'm going to suggest that there is a middle ground here.

There is an old saw that goes something like, "What you see depends heavily on where you stand." Different people can look at the information surrounding the MAX crashes through different lenses and come away with different viewpoints. That's not necessarily a bad thing. Accident investigations provide the opportunity to identify multiple ways in which the aviation system can be improved, even if there is disagreement regarding the primary causes.

I read the article through several times and I'll admit that I don't agree with everything Langewieshe says, but I don't disagree with all of it either. Clearly, Boeing fell far short of everyone's expectations in how they rushed through the MAX design and production process. Just as clearly, these accidents demonstrated that there is significant room for improvement in regulatory oversight, aircrew training, aircraft maintenance, and overall corporate (both airline and manufacturer) attitudes toward safety. All of these areas need work, so there is no need to pick and choose. Boeing absolutely needs to step up and fix their design process. The FAA and other certificate authorities absolutely need to step up and improve their oversight. By the same token, airlines also need to re-evaluate their aircrew training and aircraft maintenance practices with an particular eye toward improving safety as opposed to minimizing costs. It all needs work, so I really don't think it is necessary to emphasize one problem area at the expense of another.

[Diavel]

But it has been a while since Boeing was a market leader,even without the MCAS calamity, B737 is badly overdue for a replacement. The B787 has a “ cheap charlie” feel to it. As a pilot I much prefer the A 330 to the B787, having flown both.
If Boeing wants to be a market leader again, they need to go ahead with a 737 replacement. It was a very bad idea to scrap the 757 tooling.

[fdr]

But it has been a while since Boeing was a market leader,even without the MCAS calamity, B737 is badly overdue for a replacement. The B787 has a “ cheap charlie” feel to it. As a pilot I much prefer the A 330 to the B787, having flown both.
If Boeing wants to be a market leader again, they need to go ahead with a 737 replacement. It was a very bad idea to scrap the 757 tooling.

Can't argue on the 737 or the 757. Having also flown both the 330 and 787, would say the choice, as beauty lies in the beholder. The flight deck setup of the 787 is better. As I have said often, I prefer the control C* of Airbus over C*U of Boeing, but when there is a crosswind, fault or other anomaly ill take the Boeing every day of the week. The 757 was a great pilots plane, and had a great performance mix but the financial didn't make much sense. Boeings rationale for the continuation of the 737 is not entirely of their making.

[HFP]

When we focus on 'human error' as the cause of an accident rather than the error being the consequence of a deeper flaw, we fail to look for the conditions which caused the undesired outcomes, and or behaviour. Boeing may well have helped create these conditions. Leave these conditions in place, and the same bad outcomes may happen again no matter how many posters, articles, or pilots we blame with fancy phrases such as loss of situational awareness, lack of proficiency etc. All we are doing is giving 'human error' a nice name, but we are not explaining why this happened, and we are not removing the conditions. A few well trained pilots during WWII regardless of skill, and or experience reported that they sometimes made errors using cockpit controls. The airforce did not blame them, rather they got the manufacturer to design better equipment in accordance with human requirements. Pilot behaviour on the two doomed aircraft is just the symptom of the trouble, not the cause of it. It has been proven time and time again, that skill and experience is not enough, but changing the conditions is, so lets focus on that rather on blaming the pilots with fancy error names.

[alf5071h]

HFP, :ok: :D

Well stated; a much needed reminder, a refocusing of safety prioritises for the industry.

[ferry pilot]

Not forgetting The Atlantic Dusts Off Discredited Conspiracy Theory to Accuse MH370 Pilot of Hijacking (https://www.thedailybeast.com/the-atlantics-william-langewiesche-dusts-off-discredited-conspiracy-theory-to-accuse-mh370-pilot-of-hijacking)

Suicide-murder by the captain, in case anyone was wondering, according to Langewiesche.

A writer needs credentials and credibility, not popular acclaim. MH370 and the two Max accidents are among the most controversial in aviation history when it comes to separating fact from fiction, in spite of, or maybe because of, the evidence that appears to support whatever side of the argument you happen to be on. Who are we to look to for the real truth? CNN? The current culture of partisan political correctness has almost cleared the field of true investigative journalists, so let’s give this one the credit he deserves. He may not have all the answers, but I am willing to bet we are closer to the truth now than we were before he wrote his articles on all three of those accidents.

[Airbubba]

Looks like another Board is also calling for safety changes.

NTSB Issues 7 Safety Recommendations to FAA related to Ongoing Lion Air, Ethiopian Airlines Crash Investigations

9/26/2019​WASHINGTON (Sept. 26, 2019) — The National Transportation Safety Board (http://www.ntsb.gov/)issued seven safety recommendations Thursday to the Federal Aviation Administration, calling upon the agency to address concerns about how multiple alerts and indications are considered when making assumptions as part of design safety assessments.

Aviation Safety Recommendation Report 19-01 (https://go.usa.gov/xVv7P)was issued Thursday stemming from the NTSB’s ongoing support under International Civil Aviation Organization Annex 13 to Indonesia’s Komite Nasional Keselamatan Transportasi (KNKT) investigation of the Oct. 29, 2018, crash of Lion Air flight 610 in the Java Sea and the Aircraft Accident Investigation Bureau of Ethiopia’s investigation of the crash of Ethiopian Airlines flight 302 near Ejere, Ethiopia. All passengers and crew on board both aircraft – 346 people in all – died in the accidents (https://go.usa.gov/xVvGA). Both crashes involved a Boeing 737 MAX airplane.

The seven safety recommendations issued to the FAA are derived from the NTSB’s examination of the safety assessments conducted as part of the original design of Boeing’s Maneuvering Characteristics Augmentation System (MCAS) on the 737 MAX and are issued out of the NTSB’s concern that the process needs improvement given its ongoing use in certifying current and future aircraft and system designs.

“We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would,” said NTSB Chairman Robert Sumwalt. “Those assumptions were used in the design of the airplane and we have found a gap between the assumptions used to certify the MAX and the real-world experiences of these crews, where pilots were faced with multiple alarms and alerts at the same time. It is important to note that our safety recommendation report addresses that issue and does not analyze the actions of the pilots involved in the Lion Air and Ethiopian Airlines accidents. That analysis is part of the ongoing accident investigations by the respective authorities.”

The NTSB notes in the report (https://go.usa.gov/xVv7P)that it is concerned that the accident pilots’ responses to unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that were used for flight control system functional hazard assessments as part of the Boeing 737 MAX design.

The NTSB’s report (https://go.usa.gov/xVv7P)further notes that FAA guidance allows such assumptions to be made in certification analyses without providing clear direction about the consideration of multiple, flight-deck alerts and indications in evaluating pilot recognition and response. The NTSB’s report states that more robust tools and methods need to be used for validating assumptions about pilot response to airplane failures in safety assessments developed as part of the U.S. design certification process.

The seven recommendations issued to the FAA urge action in three areas to improve flight safety:

Ensure system safety assessments for the 737 MAX (and other transport-category airplanes) that used certain assumptions about pilot response to uncommanded flight control inputs, consider the effect of alerts and indications on pilot response and address any gaps in design, procedures, and/or training.
Develop and incorporate the use of robust tools and methods for validating assumptions about pilot response to airplane failures as part of design certification.
Incorporate system diagnostic tools to improve the prioritization of and more clearly present failure indications to pilots to improve the timeliness and effectiveness of their response.
NTSB investigators continue to assist the KNKT and AAIB in their ongoing investigations. The NTSB has full access to information from the flight recorders, consistent with standards and recommended practices for the NTSB’s participation in foreign investigations.

The KNKT’s accident report is expected to be released in the coming months, and their analysis of the Lion Air accident may generate additional findings and recommendations.

Aviation Safety Recommendation Report 19-01 (https://go.usa.gov/xVv7P)is available online at https://go.usa.gov/xVv7P.













https://www.ntsb.gov/news/press-releases/Pages/NR20190926.aspx

[DaveReidUK]

For anyone else who can't get those links above to work, here are the 7 Safety Recommendations made to the FAA:

Require that Boeing (1) ensure that system safety assessments for the 737 MAX in which it assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs, from systems such as the Maneuvering Characteristics Augmentation System, consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-10)

Require that for all other US type-certificated transport-category airplanes, manufacturers (1) ensure that system safety assessments for which they assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-11)

Notify other international regulators that certify transport-category airplane type designs (for example, the European Union Aviation Safety Agency, Transport Canada, the National Civil Aviation Agency-Brazil, the Civil Aviation Administration of China, and the Russian Federal Air Transport Agency) of Recommendation A-19-11 and encourage them to evaluate its relevance to their processes and address any changes, if applicable. (A-19-12)

Develop robust tools and methods, with the input of industry and human factors experts, for use in validating assumptions about pilot recognition and response to safety-significant failure conditions as part of the design certification process. (A-19-13)

Once the tools and methods have been developed as recommended in Recommendation A-19-13, revise existing Federal Aviation Administration (FAA) regulations and guidance to incorporate their use and documentation as part of the design certification process, including re-examining the validity of pilot recognition and response assumptions permitted in existing FAA guidance. (A-19-14)

[Airbubba]

For anyone else who can't get those links above to work, here are the 7 Safety Recommendations made to the FAA:

I've attempted to patch the NTSB typo in the last link and I've attached the Safety Recommendation Report to this post.

[lomapaseo]

For anyone else who can't get those links above to work, here are the 7 Safety Recommendations made to the FAA:

From my view this is not just a Boeing problem, but applies throughout the industry.

In my simplistic view, somehow we can no longer assume that the man machine interface will stop arguing to the point where the recovery is impossible. What does it take to teach the man otherwise?

[GordonR_Cape]

Very interesting report, which reinforces several comments made in this thread!

One minor technical point which was argued (inconclusively) in previous threads, seems to have been definitively stated as a fact:
As originally delivered, the MCAS became active during manual flight (autopilot not engaged) when the flaps were fully retracted and the airplane’s AOA value (as measured by either AOA sensor) exceed ed a threshold based on Mach number. When activated, the MCAS provided automatic trim commands to move the stabilizer AND. Once the AOA fell below the threshold, the MCAS would move the stabilizer ANU to the original position.

This stabilizer reset process never took place in the accident cases with a stuck AOA. The consequences of this part of the fault-tree was not examined properly at the design stage.

[tdracer]

This stabilizer reset process never took place in the accident cases with a stuck AOA. The consequences of this part of the fault-tree was not examined properly at the design stage.

Not really - at the design process is was assumed that if the stab trim started doing anything the pilots didn't like, they'd immediately disable it. However it was also assumed that the pilots would be trained to know about MCAS so they could recognize if it wasn't acting properly. This lead to a malfunction of MCAS being classified as no worse than Major. Everything downstream was a result of those two flawed assumptions - including MCAS using a single AOA sensor - since that was all consistent for a system that wasn't judged to be flight critical.

[Aihkio]

So nobody thought what would happen when the duty AoA sensor misbehaves for some reason, like getting stuck at lets say 25 deg. Multiple warnings and an activated MCAS. Maybe all primary sensors should be analysed.

[OldnGrounded]

So nobody thought what would happen when the duty AoA sensor misbehaves for some reason, like getting stuck at lets say 25 deg. Multiple warnings and an activated MCAS. Maybe all primary sensors should be analysed.

I'm uncertain what to make of this, in the NTSB report:

As originally delivered, the MCAS became active during manual flight (autopilot not engaged) when the flaps were fully retracted and the airplane’s AOA value (as measured by either AOA sensor) exceeded a threshold based on Mach number.

Emphasis added.

[GordonR_Cape]

I'm uncertain what to make of this, in the NTSB report:

" (as measured by either AOA sensor)"

Emphasis added.

I'm pretty sure that's just a compressed version of a much longer paragraph, and not literally true as written. The original interpretation could be that either AOA value could trigger MCAS, depending on which side FCC was active (alternating between flights).

[OldnGrounded]

I'm pretty sure that's just a compressed version of a much longer paragraph, and not literally true as written. The original interpretation could be that either AOA value could trigger MCAS, depending on which side FCC was active (alternating between flights).

OK, you're probably right. If not, the system is even stranger than we thought.

[CurtainTwitcher]

So nobody thought what would happen when the duty AoA sensor misbehaves for some reason, like getting stuck at lets say 25 deg. Multiple warnings and an activated MCAS. Maybe all primary sensors should be analysed.
Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:

Comparing AoA signals could generate a warning.
AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
Boeing choose to categorise an uncommanded MCAS runaway (https://www.pprune.org/rumours-news/621879-max-s-return-delayed-faa-reevaluation-737-safety-procedures-66.html#post10580258) as only "major" and not hazardous
Therefore Boeing choose not compare AoA
The design failures between a single faulty AoA sensor and continuous MCAS activation have not been fully revealed.

[WillowRun 6-3]

From my view this is not just a Boeing problem, but applies throughout the industry.

In my simplistic view, somehow we can no longer assume that the man machine interface will stop arguing to the point where the recovery is impossible. What does it take to teach the man otherwise?

On some distant sideline of the 40th ICAO Assembly, two very interesting events. One, a discussion with a rising, young leader of a Member State delegation, whose combined diplomatic and flight-training career exemplifies, by all accounts, how to get things in pilot training right - and though saying this ventures somewhat of an educated guess (I don't claim specific factual background knowledge) - getting things right within that country's system for training generally, not just her individually.
Second, a presentation by the DG of EUROCONTROL. In which the increasing role of automation was prominent.
Extraction of thread-related comment: as to the second event, the aviation safety ecosystem better get goin' on the advancement and refinement of the human factors subparts. Which aren't going away. Especially with the management and/or cultural issues laid bare at Boeing, and in the certification process.
As to the first, on one hand ICAO IATA ACI and the rest cheerily forecast large, large gains in traffic, and of course advocate for the capacity building needed to sustain it. But the pioneering spirit, and dedication, this young leader has needed to sustain just to establish a rightful place in international aviation diplomacy is telltale, perhaps. It reveals, I sometimes worry, that the flood of new pilots needed for that doubling of traffic will consist way too much of rote checklist types (to reiterate: the leader is highly well-trained) of any and all the many demographics involved. And saying, "oh you old weeping willow, don't fret none, it'll all be computerized." In Zuckerberg We Trust, I guess....thanks, but no thanks.

[ST Dog]

The bullet points are:

Comparing AoA signals could generate a warning.
AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
Boeing choose to categorise an uncommanded MCAS runaway (https://www.pprune.org/rumours-news/621879-max-s-return-delayed-faa-reevaluation-737-safety-procedures-66.html#post10580258) as only "major" and not hazardous
Therefore Boeing choose not compare AoA



A bit out of order. The FHA said it was a major hazard so didn't need the comparison. That came first.

The AoA miscompare alert was already there* but MCAS didn't need to use it per the FHA. You don't just add stuff with no requirement and the FHA didn't support adding the requirement.

*I know the alert was not enabled. As discussed it was supposed to be. But again, it wasn't considered serious enough (FHA again) to rush the update.

[fdr]

Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:

Comparing AoA signals could generate a warning.
AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
Boeing choose to categorise an uncommanded MCAS runaway (https://www.pprune.org/rumours-news/621879-max-s-return-delayed-faa-reevaluation-737-safety-procedures-66.html#post10580258) as only "major" and not hazardous
Therefore Boeing choose not compare AoA

The design failures between a single faulty AoA sensor and continuous MCAS activation have not been fully revealed.

Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.

[alf5071h]

Our industry is at the boundary of rule #1; technological capability, need for automation, economics, balanced by human judgement in complex processes of design, checking, testing, and approval.
Human judgement, either in these process or ultimately in operation (last opportunity to avoid / mitigate), is now limiting.
The critical issue is do we know that, wish to acknowledge that, or act, - but only with the illumination of hindsight.
We are the robots of our thoughts.

https://thenextweb.com/artificial-intelligence/2018/02/23/are-asimovs-laws-of-robotics-still-good-enough-in-2018/?utm_source=copypaste&utm_medium=referral&utm_content=Are%20Asimov%27s%20Laws%20of%20Robotics%20still% 20good%20enough%20in%202018%3F&utm_campaign=share%2Bbutton
Note the principles 1-6 from Cambridge, and problems to address 1-5 via Google.

Also;
https://www.scientificamerican.com/article/asimovs-laws-wont-stop-robots-from-harming-humans-so-weve-developed-a-better-solution/

[Tomaski]

Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.

Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.

[Grebe]

Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.

FWIW from this SLF engine-ear


Boeing analyzed what would happen if, in normal flight mode, MCAS triggered inadvertently up to its maximum authority and moved the horizontal stabilizer the maximum 0.6 degrees.

It also calculated what would happen on a normal flight if somehow the system kept running for three seconds at its standard rate of 0.27 degrees per second, producing 0.81 degrees of movement, thus exceeding the supposed maximum authority.



OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ...

But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"

seems that the higher math involved was beyond the management involved...:mad:

[Octane]

"OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ..."

Not to mention at low level. A system that is unknown to the crew which aggressively and repeatedly tries to dive the aircraft at low level is insane and diabolical however which way people choose to look at it. Arguably, it is criminal..

All the rhetoric by some re pilot training/ incompetence/ error is just a smokescreen to cover the obvious. Poor management decision making/ leadership, poor aircraft design/ sloppy system design (MCAS), poor communication to Airlines/ pilots and complete fixation re the iPad training only mandate are among the causes of these tragedies.
Boeing designed a pig and the lipstick didn't work. The Swiss cheese had so many holes, it's not surprising they lined up..

[CurtainTwitcher]

The Swiss cheese had so many holes, it's not surprising they lined up..
These numbers telling, valid 1959 to 2017, as compiled by Boeing.
https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/2000x1493/screen_shot_2019_09_28_at_5_42_21_pm_21cbef47414c1f4a362813c 55794751e1f922b9d.png
Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017 (http://www.boeing.com/resources/boeingdotcom/company/about_bca/pdf/statsum.pdf)


Another source, Airsafe.com has compiled 737-MAX departures at 0.65 million, and quotes a hull loss rate of 3.08 per million departures.

https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/1222x1106/screen_shot_2019_09_28_at_5_48_07_pm_535a233632ca9812cfb6cc0 cd33f5ebd30c6cdb5.png
source: Airsafe.com Plane crash rates by model (http://www.airsafe.com/events/models/rate_mod.htm)

Even more dramatic is the accident rate by phase of flight:

https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1850x1386/screen_shot_2019_09_28_at_6_09_18_pm_20305b8b63c1ade879d13ec d7fdd3cd69daae0ef.png


Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017 (http://www.boeing.com/resources/boeingdotcom/company/about_bca/pdf/statsum.pdf)

[Tomaski]

OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ...



Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.

That being said, it was still a terrible design to have an unknown "background" system input this much stab trim. Assuming the MAX does fly again, this large MCAS input will still be needed in an actual low-speed stall to address the control force issue at high AOA. Keep in mind that in an actual stall, MCAS is offsetting a lightening of the control forces, and not forcing the nose down. However, as I currently understand the system, when the pilots reduce the AOA to break the stall there would no longer be a nose up moment generated by the engine nacelles and the MCAS input would then effectively convert to a large nose down moment. That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver.

[Octane]

"That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver."

If that is so, it would contradict the whole rationale for the existence of MCAS in the first place..

[Fly Aiprt]

Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.

What about this "not and anti-stall device" thing, implying the MCAS is supposed to activate before a stall AOA is reached ?

[Tomaski]

What about this "not and anti-stall device" thing, implying the MCAS is supposed to activate before a stall AOA is reached ?

First, a historical note - in the past, airliner stall avoidance training in the sim was directed at the "approach to stall" region. We never actual put the aircraft in the stall because 1) recognition and recovery prior to the stall was the objective, and 2) the sims were never programmed to simulate a full stall in the first place. Thus all the various stall-related warnings and system responses would actually kick in before a full stall was reached. In the aftermath of AF 447 the FAA mandated full-stall training, but that is just now coming on line due to the time required to gather accurate real world data and reprogram the sims.

The whole debate about whether MCAS is an "anti-stall" system is part semantic and part technical. If you browse through FAR Part 25, the particular section dealing with transport category aircraft certification, you will not find any requirement for an "anti-stall" system. On the other hand, you will find requirements for stability and control feel response as the aircraft approaches the stall. The only reason MCAS exists is to meet these requirements. It just so happens that in meeting these requirements, MCAS does assist with control and recovery through the approach to stall region - but technically it is not an "anti-stall" device. That being said, MCAS and a host of other warning indications and system responses in this area of the flight envelope do aid in the stall recovery and could be informally referred to as "anti-stall" devices. While they are technically correct, Boeing and their helpmates have not done themselves any favors by trying to win this technical argument with a largely non-technical audience.

[Smythe]

But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"

seems that the higher math involved was beyond the management involved

It was first set at 0.6 for the high speed departure and maneuvering issues, which is reasonable.

THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.
The change was made apparently without regard to the flight conditions...

This is why you have 2.5 degrees at high speeds.

[DaveReidUK]

THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

[lomapaseo]

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

In actual fact? or what the computer that's flying thinks?

[Fly Aiprt]

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

Coffin corner ?

[Tomaski]

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

I would rate the most likely case would be an aircraft upset followed by an nose-low recovery at a speed approaching Va (max maneuvering). Not sure how often this sort of thing has happened in the real world, but the FAR certification requirement that drove the need for MCAS cannot be waived because the possibility of such an event is deemed unlikely.

[Smythe]

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

Wasnt it on DEP, where, at a certain point, the nacelles added lift and pushed it close to the stall envelope?

I thought it was on DEP when there was a climbing turn?

[CurtainTwitcher]

Wasnt it on DEP, where, at a certain point, the nacelles added lift and pushed it close to the stall envelope?

I thought it was on DEP when there was a climbing turn?

satcom Guru: 737 MCAS - Failure is an Option (https://www.satcom.guru/2018/11/737-mcas-failure-is-option.html)

Boeing describes MCAS as a result of a handling quality shortcoming encountered in an accelerated stall, that would be likely be tested as a wind-up turn. The pilot holds airspeed and progressively increases bank angle and back pressure to result in stalling at high load factors. The flight condition is most likely entered with the aft column travel beyond the column cutout threshold. If the aft column cutout was active, MCAS would be inhibited before it could do anything. For this reason, I think Boeing decided to disable the column cutout feature for MCAS, via autopilot software change.

[Turbine D]

Wall Street Journal article published 09/29/2019:
Before 737 MAX, Boeing’s Flight-Control System Included Key SafeguardsEarlier military version of MCAS had features to prevent misfires implicated in two 737 MAX crashesBy
Alison Sider and
Andrew Tangel
Sept. 29, 2019 7:00 am ET
After Indonesia’s Lion Air crash, Air Force officials were worried their tanker, the KC-46A Pegasus, shared the same problems as Boeing’s 737 MAX.
 (https://quotes.wsj.com/BA)
Boeing (https://quotes.wsj.com/BA) Co. engineers working on a flight-control system for the 737 MAX omitted key safeguards that had been included in an earlier version of the same system used on a military tanker jet, people familiar with the matter said.

Accident investigators have implicated the system, known as MCAS, in two deadly crashes of the jetliner that killed a total of 346 people.

The engineers who created MCAS more than a decade ago for the military refueling plane designed the system to rely on inputs from multiple sensors and with limited power to move the tanker’s nose—which one person familiar with the design described as deliberate checks against the system acting erroneously or causing a pilot to lose control.

“It was a choice,” this person said. “You don’t want the solution to be worse than the initial problem.”

The MAX’s version of MCAS, however, relied on input from just one of the plane’s two sensors that measure the angle of the plane’s nose. The system also proved tougher for pilots to override. Investigators have implicated the system in the fatal nosedives of Indonesia’s Lion Air jet (https://www.wsj.com/articles/plane-with-188-people-on-board-crashes-off-indonesia-1540784983?mod=article_inline&mod=article_inline&mod=article_inline&mod=article_inline&mod=article_inline) in October 2018 and of an Ethiopian Airlines MAX in March. Indonesia is expected to fault that MCAS (https://www.wsj.com/articles/indonesia-to-fault-737-max-design-u-s-oversight-in-lion-air-crash-report-11569185664?mod=article_inline) design, in addition to U.S. oversight lapses and pilot missteps, in their final report on the first crash, The Wall Street Journal has reported.

Now, Boeing’s expected fix for the 737 MAX will make its MCAS more like the one used in the tanker, according to people familiar with the matter.

Details of the system’s history and engineers’ desire to build in safeguards on the tanker version of MCAS haven’t been previously reported. The existence of a version of MCAS on the tanker was earlier reported by Air Force magazine.MCAS stands for the Maneuvering Characteristics Augmentation System. A Boeing spokesman declined to explain why the systems differ on two airplanes, but said, “The systems are not directly comparable.” The contrast in design highlights how different teams of Boeing engineers wound up including protections on one airplane but not on a later model of another aircraft. Boeing has said the MAX, with its revised MCAS, will be among the safest airplanes ever to fly.

After the MAX operated by Indonesia’s Lion Air crashed, Air Force officials said they were concerned their tanker, known as the KC-46A Pegasus, shared the same problems. An Air Force spokeswoman said senior officials met with their Boeing counterparts to confirm the tanker’s MCAS complied with military requirements for designs that prevent a single faulty sensor from causing a system to fail.

Boeing developed the MCAS for the military tanker around the early 2000s, another person familiar with the project said. The tanker was a military derivative of Boeing’s wide-body 767 commercial jet and included pods on its wings used for air-to-air refueling of fighters and other war planes. Those wing pods added lift and caused the tanker’s nose to pitch up in some flight conditions, risking the plane’s ability to meet Federal Aviation Administration safety requirements, people familiar with the matter said. So engineers devised MCAS software, which automatically pushes down the tanker’s nose if necessary, to comply with FAA standards, these people said..

In a key difference from the subsequent version of the system used on the MAX, the system on the tanker moves the plane’s horizontal stabilizer—the control surface perpendicular to the airplane’s tail—once per activation and not repeatedly, the person familiar with the tanker project said.

The tanker engineers also gave the system only limited power to nudge the plane’s nose down to ensure that pilots would be able to recover if it accidentally pushed the plane into a dive, said the person familiar with the tanker’s MCAS design. That meant MCAS had little authority over the stabilizer, which made it much easier for pilots to counteract.

Boeing began developing the MAX in 2011 amid competition with rival Airbus SE, which had been enticing airline customers with its new single-aisle passenger jet.

The MAX’s new fuel-efficient engines were larger and placed farther forward on the wing than on previous 737 models. That caused the plane’s nose to pitch up in certain extreme flight conditions, endangering the plane’s ability to win FAA certification, people familiar with the matter said. The large engines on the MAX essentially had the same effect on the plane’s aerodynamics that the refueling pods had on the military plane.

Engineers who had worked on the tanker suggested MCAS as a possible solution for the MAX engineers, people familiar with the matter said.

Boeing said it isn’t aware of any consideration to rely on both sensors that measure the angle of the plane’s nose when its engineers designed MCAS for the 737 MAX. A single “angle of attack” sensor was deemed sufficient, and Boeing has said it complied with safety and regulatory requirements. Other systems on earlier 737s relied on single sensors, former Boeing engineers and others familiar with the designs have said.

Boeing instead relied primarily on pilots as the backstop should that plane’s MCAS misfire. MAX engineers determined pilots would quickly identify an MCAS misfire as an emergency known as a “runaway stabilizer,” then counteract the system with a longstanding cockpit procedure.

The more advanced flight-control computer systems on the tanker also made it easier for MCAS to compare data from multiple sensors, the person familiar with the tanker project said. “The underlying architecture was there to take advantage of,” this person said.

Aside from sensors, the tanker MCAS has another key safeguard. Pilots of the tanker can override MCAS by simply pulling back on controls, according to a senior Air Force official and others familiar with the matter.

“We have better sensor data,” Will Roper, an assistant Air Force secretary who is the branch’s procurement chief, said. “But most importantly, when the pilot grabs the stick, the pilot is completely in control.”

On the MAX, MCAS’s design required it to remain active even if pilots pulled back on the controls, making it more complicated to stop the system from forcefully and repeatedly pushing down the nose.

Since days after a second 737 MAX crashed in Ethiopia in March, that aircraft has been grounded world-wide. The flight ban has thrown a wrench into airline finances and planning, and disrupted customers’ travel plans.

The new MCAS for the 737 MAX is expected to rely on two sensors to verify data. It will fire once, not repeatedly, each time it activates. And pilots will be able to override the system by pulling back on the controls.

—Andy Pasztor, Elisa Cho and Jim Oberman contributed to this article.

[Octane]

"Boeing has said the MAX, with its revised MCAS, will be among the safest airplanes ever to fly"

Nice rhetoric from Boeing but perhaps they mean to say "among the the safest MCAS airplanes ever to fly"? Quite likely it would be very safe if it had no MCAS at all, with the drawback it wouldn't be certifiable..
Why they didn't implement the MCAS safeguards on the MAX they did on the military aeroplane is a question possibly the accountants in Chicago can answer. Especially considering the enormous revenue the MAX was going to generate. Alternatively, they could have tried designing a state of the art aircraft in the first place.

"Boeing instead relied primarily on pilots as the backstop should that plane’s MCAS misfire. MAX engineers determined pilots would quickly identify an MCAS misfire as an emergency known as a “runaway stabilizer,” then counteract the system with a longstanding cockpit procedure."

Really? Expecting line pilots to troubleshoot a malfunctioning system they didn't know existed (Lion) in a critical flight phase? (and not deactivated by control column inputs a la Tanker version).
Since when did airline pilots have double duty as Boeing test pilots?
Lawyers will be busy for years...

[robocoder]

It boggles the mind. So pilots are expected to identify an unknown system as misfiring and at the same time let it do its thing when firing properly. An unknown system designed to work as a runaway trim for up to nine seconds at a time.

[ST Dog]

The tanker version appears to target a different issue.

On the MAX it was specifically to counter a situation where the stick was being pulled back well past the cutoff switch activation point.


I also question the statement about repeated cycles. We know on the MAX a manual electric trim input resets the system. If not for the MET input it wouldn't move the stabilizer again until AoA decreased, and then it would take out the stab trim it added.

What resets the system on the tanker?

[ST Dog]

It boggles the mind. So pilots are expected to identify an unknown system as misfiring and at the same time let it do its thing when firing properly.

When it was designed to be active it wouldn't be noticed as it would make the plane act as expected (steady increasing pull needed to increase pitch up). And it was a max of 9s but not always 9s.

But at other times (when not at high AoA) it would appear to be runaway since nothing is expected to run that long. 3 seconds was supposed to be enough to note runaway which suggests auto trim is usually less than 1s. If system cutout in 3-6 seconds you still have a controllable plane.

Level flight and sudden trim like that I'll bet would be noticed. And acted on, though probably not fast/correctly since it's not practiced.


I wonder if any crew would survive a real runaway trim (like a fault in the motor) during take off.

Boeing misjudged the detection speed with all the alarms. They incorrectly assumed the memory items would be followed quickly from memory.

And I think they just didn't consider an AoA failure to high reading during the takeoff phase of flight.

They need to revamp the safety process and the assumptions used in it.

[Rated De]

What we actually have is an example of unrestrained capitalism destroying competition to the point that the "market" provides only two choices for purchasers of large airliners. It doesn't much resemble a "free" market at all.

Precisely.

The assumption that capitalism equates "competition" is erroneous.

The natural state is comfortable duopoly.
The myth was eloquently destroyed by Johnathan Tepper: The Myth of Capitalism