MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
Not sure where you got this but the MAX has the same mechanism which allows one side to operate controls in case of a jam on the other side. Someone posted a chart of the FDR traces awhile back showing the differing force inputs on CA and FO's control columns. In the Lion Air crash there indeed was indications of a split after the Captain handed off the aircraft to the FO. Since we haven't heard anything about an actual jam or mechanical failure with the controls the most likely explanation seems to be a case of the FO kneecapping the Captain when he pulled full back on the column in response to an MCAS input, and thhen the subsequent clusterf**k would have contributed to the subseqent loss of control. If that's what happened the final CVR transcripts would tell the story.
Join Date: Jun 2019
Location: Tdot
Posts: 48
Likes: 0
Received 0 Likes
on
0 Posts
The engine certification including containment is not dependent on the size of the engine, the outcome for the blade separation is constant. For a ruptured disk, history has shown that no design is able to be protected from the release of the disk, and no real protection exists beyond avoiding having disk failure. Control system redundancy is nice to have, no doubt, but the A380 burst was looking at a wing fire as much as any other outcome, in an aircraft that had redundancy, which was mostly lost from the destruction wreaked by a single failure...
SWA 1380 lost #13 fan blade on the CFM56-7B just outside of the dove tail. That liberation resulted in the subsequent failure of the nacelle, and liberated components of the nacelle caused the decompression and fatality of the passenger. The earlier SWA3472 liberated a blade forward of the the nacelle, and the nacelle was destroyed by the out of balance loads. As devastating as that outcome is, the fan blade was technically contained in both cases. Had a disk failed, then all bets are off, disk rupture usually results in 3 and occasionally 4 major sections of the disk being released, and each one has catastrophic kinetic energy levels, as in it doesn't matter what flavour the plane is, you don't want to be any where near it. The LEAP engine fan blade is required to be mitigated by the cowl, as the -7B was, a disk, is mitigated by clean living, religion and good maintenance inspections.
As frustrating as the MCAS shambles has been, and the manual trim issue, I would have thought that the manufacturer was justified in the position of the control issues notwithstanding queries by the FAA TAD that may have occurred.
The probability of a disk failure is expected to be an extremely remote event. The disruption of the rudder cable would require the part of the disk, (say 3 items liberated...) with about a 1' arc at about 20 radius hitting the cable/cable supports etc. that ends up being 3 x (1+1) /126 or about 5% likelihood of impact, if you assume that the release is able to be of 3 parts at the same time. The physics of the release don't permit that to be the case, they are released with a slight latency, which reduces the likelihood of a specific part being hit. The rough likelihood of hitting the rudder control is less than 5% on a liberation, between 1.5-3.5%... of an extremely remote initial failure.
The CFM 56 is approaching 1 billion hours of engine operation, and a liberated fan blade caused a single fatality in that time, and no failure of a rudder control has occurred from any disk failure. Halve that time for the aircraft flight hours, and it is still well outside of the area of interest as a risk factor for a certified design.
The rudder control has a risk from being severed by a meteor strike that would be similar levels of likelihood.
Assuming that a failure occurs, then the catastrophic outcome that has caused gnashing of teeth, wailing and renting of cloth is not certain to lead to a hull loss unless it occurs at high speed on a take off roll, and in the early stages of the takeoff flight path up to around V2 +40. Above that speed, control can be maintained effectively with aileron alone, but at the cost of an increased stall speed, well above a normal "in balanced flight" stall, due to the vagaries of yaw-sweep-spoiler rise and the resultant AOA increase required for a given flight path. (the "40kts" is the amount that the actual stall was increased in the RAAF B707 accident off Sale in the late 80's, where a double asymmetric demo was undertaken with rudder boost inhibited... the resultant roll rate was enough to throw an engine off the pylon). A disk failure surprisingly doesn't have a propensity to occur on a takeoff, they happen at idle, cruise, power reduction, and more or less anywhere the 600lb gorilla wants to sit, they are random in nature, and therefore the probability of their occurrence on any takeoff where a loss of a rudder control would then be catastrophic is a function of exposure alone, and that is about 0.25%-0.5% of the total flight time of the B737... multiply that by the overall likelihood, and the likelihood of a consequent rudder problem and you are much more likely to get taken out by the meteor.
I don't object to control systems that have redundant and separated control architecture, that is just good design practice particularly coming from a military background, but I don't think that amongst the other serious issues that have been raised that hysteria is helpful to successfully getting Bill Boeing back in the air with an adequate product that does a fair job for the industry.
The risk following a fan blade failure is that the stabiliser is severely damaged by the subsequent loss of the nacelle, shades of foam shedding on the SST.
SWA 1380 lost #13 fan blade on the CFM56-7B just outside of the dove tail. That liberation resulted in the subsequent failure of the nacelle, and liberated components of the nacelle caused the decompression and fatality of the passenger. The earlier SWA3472 liberated a blade forward of the the nacelle, and the nacelle was destroyed by the out of balance loads. As devastating as that outcome is, the fan blade was technically contained in both cases. Had a disk failed, then all bets are off, disk rupture usually results in 3 and occasionally 4 major sections of the disk being released, and each one has catastrophic kinetic energy levels, as in it doesn't matter what flavour the plane is, you don't want to be any where near it. The LEAP engine fan blade is required to be mitigated by the cowl, as the -7B was, a disk, is mitigated by clean living, religion and good maintenance inspections.
As frustrating as the MCAS shambles has been, and the manual trim issue, I would have thought that the manufacturer was justified in the position of the control issues notwithstanding queries by the FAA TAD that may have occurred.
The probability of a disk failure is expected to be an extremely remote event. The disruption of the rudder cable would require the part of the disk, (say 3 items liberated...) with about a 1' arc at about 20 radius hitting the cable/cable supports etc. that ends up being 3 x (1+1) /126 or about 5% likelihood of impact, if you assume that the release is able to be of 3 parts at the same time. The physics of the release don't permit that to be the case, they are released with a slight latency, which reduces the likelihood of a specific part being hit. The rough likelihood of hitting the rudder control is less than 5% on a liberation, between 1.5-3.5%... of an extremely remote initial failure.
The CFM 56 is approaching 1 billion hours of engine operation, and a liberated fan blade caused a single fatality in that time, and no failure of a rudder control has occurred from any disk failure. Halve that time for the aircraft flight hours, and it is still well outside of the area of interest as a risk factor for a certified design.
The rudder control has a risk from being severed by a meteor strike that would be similar levels of likelihood.
Assuming that a failure occurs, then the catastrophic outcome that has caused gnashing of teeth, wailing and renting of cloth is not certain to lead to a hull loss unless it occurs at high speed on a take off roll, and in the early stages of the takeoff flight path up to around V2 +40. Above that speed, control can be maintained effectively with aileron alone, but at the cost of an increased stall speed, well above a normal "in balanced flight" stall, due to the vagaries of yaw-sweep-spoiler rise and the resultant AOA increase required for a given flight path. (the "40kts" is the amount that the actual stall was increased in the RAAF B707 accident off Sale in the late 80's, where a double asymmetric demo was undertaken with rudder boost inhibited... the resultant roll rate was enough to throw an engine off the pylon). A disk failure surprisingly doesn't have a propensity to occur on a takeoff, they happen at idle, cruise, power reduction, and more or less anywhere the 600lb gorilla wants to sit, they are random in nature, and therefore the probability of their occurrence on any takeoff where a loss of a rudder control would then be catastrophic is a function of exposure alone, and that is about 0.25%-0.5% of the total flight time of the B737... multiply that by the overall likelihood, and the likelihood of a consequent rudder problem and you are much more likely to get taken out by the meteor.
I don't object to control systems that have redundant and separated control architecture, that is just good design practice particularly coming from a military background, but I don't think that amongst the other serious issues that have been raised that hysteria is helpful to successfully getting Bill Boeing back in the air with an adequate product that does a fair job for the industry.
The risk following a fan blade failure is that the stabiliser is severely damaged by the subsequent loss of the nacelle, shades of foam shedding on the SST.
And despite what the FAA and Boeing have stated during hearings etc, the aircraft apparently does not meet certification standards.
This assumes, of course, the NYT article is accurate.
This assumes, of course, the NYT article is accurate.
Join Date: Aug 2005
Location: Devon, England
Posts: 249
Likes: 0
Received 0 Likes
on
0 Posts
MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
Seems all was not well in the relationship between FAA and Boeing
https://www.nytimes.com/2019/07/27/b...7-max-faa.html
https://www.nytimes.com/2019/07/27/b...7-max-faa.html
Join Date: Jun 2019
Location: Tdot
Posts: 48
Likes: 0
Received 0 Likes
on
0 Posts
Indeed. In this case though, the authors of the article don’t have to understand the intricacies of certification standards. They just have to have those who do understand on record. And it seems that that is the case here. The FAA engineers were overruled by FAA managers on account of Boeing’s bottom line, and not the actual safety of the aircraft.
So assuming they are accurately reporting from their sources, it is definitely not good.
Failure to meet the one-in-twenty requirement contained in the rotor burst Advisory Circular doesn't mean it's not compliant. An AC outlines an acceptable method of compliance, but not the only allowable method of compliance. The regulation requires the risk due to rotor burst be minimized - the AC helps quantify how to do that - but there is a proviso about taking 'reasonable' steps to minimize the risk when the risk is already small. Boeing argued that replacing the existing (very reliable) rudder system was not 'reasonable' (and those with a good memory might recall why Boeing might not be keen on rushing to design a new rudder control - United 585 and USAir 427). The FAA agreed - that makes the design complaint by definition.
You can argue if it was appropriate for the FAA manager to overrule the specialists, but not if it's compliant.
You can argue if it was appropriate for the FAA manager to overrule the specialists, but not if it's compliant.
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes
on
0 Posts
I am not sure that I am understanding you. You can't be saying that it is compliant because of the difficulties in meeting the spec, but that is how I am reading what you wrote. In my world, "it was too hard to do it right" doesn't tend to satisfy the inspectors.
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Indeed. In this case though, the authors of the article don’t have to understand the intricacies of certification standards. They just have to have those who do understand on record. And it seems that that is the case here. The FAA engineers were overruled by FAA managers on account of Boeing’s bottom line, and not the actual safety of the aircraft.
So assuming they are accurately reporting from their sources, it is definitely not good.
So assuming they are accurately reporting from their sources, it is definitely not good.
Again, the issue is not whether or not the new engines really did create an unacceptable risk to the control cables. The problem is that FAA engineers believed that they did, FAA managers agreed that the design didn't meet agency guidelines and, nevertheless, permitted B to (self-)certify the design. If, of course, the Times story is correct, but, except for generalized suspicion on the part of some posters, we have no reason to believe that the Times' reporting on the story is other than careful and accurate. If it is other than that, we can expect that anyone who feels misquoted or misrepresented will soon speak up.
I had a personal experience with this several years ago - we were certifying updated FADEC hardware which incorporated "Commercial Off The Shelf" (COTS) hardware. As others here know, mil-spec electronics are pretty much extinct now days - COTS has taken over (screened to a higher standard for aviation use than whats in you laptop or phone, but the same COTS components). The new hardware had been fully certified Part 33 by the engine company - all I was doing was certifying the installation on the aircraft (basically showing intended function with a flight test). We have a standard, FAA accepted (and actually FAA dictated) flight test program to do this. Yet this particular specialist rejected my plan - he wanted dozens of hours of additional flight testing (at ~$50,000 per hour, so this was a big deal). I requested a face-to-face at the FAA. During the meeting, I finally got the specialist to admit that he didn't believe COTS hardware was acceptable and what he wanted was to do reliability testing. His manager was sitting right next to him and immediately stepped in and basically told the specialist to shut up - that he was completely out of line since the COTS hardware had already been certified Part 33 and the specialist was overstepping his authority. When the meeting ended, my original plan had been accepted with only minor comments. Oh, and if you're wondering, this was all pre-ODA.
Most of the specialists I had dealings with at the FAA were good, sharp, reasonable people. But not all. One of the FAA specialists quoted in the NYT article fell into that latter group.
Join Date: Jun 2019
Location: Tdot
Posts: 48
Likes: 0
Received 0 Likes
on
0 Posts
I'm saying that it's not black and white - the rotor burst requirements have 'judgement' involved. The one-in-twenty is not a requirement, it's one method of showing compliance, but it's not the only way of showing compliance. People tend to treat what's in the ACs as hard requirements, but they are not. Reasonable people can disagree on what's required, and this wouldn't be the first time someone at the FAA got overruled by a higher up that determined that the specialist wasn't being reasonable.
I had a personal experience with this several years ago - we were certifying updated FADEC hardware which incorporated "Commercial Off The Shelf" (COTS) hardware. As others here know, mil-spec electronics are pretty much extinct now days - COTS has taken over (screened to a higher standard for aviation use than whats in you laptop or phone, but the same COTS components). The new hardware had been fully certified Part 33 by the engine company - all I was doing was certifying the installation on the aircraft (basically showing intended function with a flight test). We have a standard, FAA accepted (and actually FAA dictated) flight test program to do this. Yet this particular specialist rejected my plan - he wanted dozens of hours of additional flight testing (at ~$50,000 per hour, so this was a big deal). I requested a face-to-face at the FAA. During the meeting, I finally got the specialist to admit that he didn't believe COTS hardware was acceptable and what he wanted was to do reliability testing. His manager was sitting right next to him and immediately stepped in and basically told the specialist to shut up - that he was completely out of line since the COTS hardware had already been certified Part 33 and the specialist was overstepping his authority. When the meeting ended, my original plan had been accepted with only minor comments. Oh, and if you're wondering, this was all pre-ODA.
Most of the specialists I had dealings with at the FAA were good, sharp, reasonable people. But not all. One of the FAA specialists quoted in the NYT article fell into that latter group.
I had a personal experience with this several years ago - we were certifying updated FADEC hardware which incorporated "Commercial Off The Shelf" (COTS) hardware. As others here know, mil-spec electronics are pretty much extinct now days - COTS has taken over (screened to a higher standard for aviation use than whats in you laptop or phone, but the same COTS components). The new hardware had been fully certified Part 33 by the engine company - all I was doing was certifying the installation on the aircraft (basically showing intended function with a flight test). We have a standard, FAA accepted (and actually FAA dictated) flight test program to do this. Yet this particular specialist rejected my plan - he wanted dozens of hours of additional flight testing (at ~$50,000 per hour, so this was a big deal). I requested a face-to-face at the FAA. During the meeting, I finally got the specialist to admit that he didn't believe COTS hardware was acceptable and what he wanted was to do reliability testing. His manager was sitting right next to him and immediately stepped in and basically told the specialist to shut up - that he was completely out of line since the COTS hardware had already been certified Part 33 and the specialist was overstepping his authority. When the meeting ended, my original plan had been accepted with only minor comments. Oh, and if you're wondering, this was all pre-ODA.
Most of the specialists I had dealings with at the FAA were good, sharp, reasonable people. But not all. One of the FAA specialists quoted in the NYT article fell into that latter group.
If it is the case that the decision was made on the cost issue alone, then that is where the problem lies. If there were additional engineering considerations the FAA managers took into account then that would change the optics.
When more information comes out this could get worse or turn into a non issue. But right now it doesn’t smell good.
The same guy that wanted 100% assurance that a reverser would never unlock in flight even with 3 locks and that no mathematical analysis of 1 in 20 for non containment could be substituted for meeting what the FAA wanted in a design. While the rest of us were dealing with the realization that even perfect sounding designs fully certified by the FAA were still failing and we damn well needed to upgrade the wordings in the AC or acceptable means of compliance.
Indeed. In this case though, the authors of the article don’t have to understand the intricacies of certification standards. They just have to have those who do understand on record.
I have seen this on two occasions and it has left me with a deep distrust of "the media".
He who pays the piper calls the tune.
So arguing over what you think happened or was said between the FAA and Boeing based on trite media reports is foolish in the extreme.
Join Date: Feb 2013
Location: 60 north
Age: 59
Posts: 17
Likes: 0
Received 0 Likes
on
0 Posts
tdracer
Thanks again Td for educating us and shining Your light of knowledge in the dark corners when we get scared of a imaginary ghost here there and everywere.
On a general not , I am looking forward to the NTSB report promised within , now , 7 weeks.
Quite a saga, this one , and it is effecting some of us directly, and it is no fun.
I have hope that the MAX re -certification, and the other beef that anyone have with FAA/Boeing can be separated so we can start flying the Max soon.
Then again I can be naive at times!
Regards
Cpt B
On a general not , I am looking forward to the NTSB report promised within , now , 7 weeks.
Quite a saga, this one , and it is effecting some of us directly, and it is no fun.
I have hope that the MAX re -certification, and the other beef that anyone have with FAA/Boeing can be separated so we can start flying the Max soon.
Then again I can be naive at times!
Regards
Cpt B
Last edited by BluSdUp; 31st Jul 2019 at 10:06. Reason: it
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes
on
0 Posts
Inaccuracies usually arise when the information failed to be passed on to the media people in a way easily understood by the layperson.
So the ball may be in the specialist people's court...
Join Date: Dec 2018
Location: Florida
Posts: 246
Likes: 0
Received 0 Likes
on
0 Posts
WSJ 7/31/19 : Regulators Found High Risk of Emergency After First Boeing MAX Crash
An FAA analysis found it ‘didn’t take that much’ for a malfunction like the one confronted by the plane’s pilots
Andrew Tangel andAndy Pasztor
Based on the findings, the regulator decided it was sufficient to inform pilots about the hazards of an onboard sensor malfunction that led to a flight-control system pushing down the plane’s nose. The belief was that if pilots were aware of the risk and knew how to respond, it was acceptable to give Boeing and regulators time to design and approve a permanent software fix to MCAS, the flight-control system
implicated in the crash, according to the agency official and people briefed on the findings.The FAA’s early goal, one of these people added, was: “Get something out immediately and then mandate something more permanent.”Specifically, the FAA’s analysis suggested that a warning to pilots would be enough to provide Boeing about 10 months to design and implement changes to MCAS, according to a person close to the manufacturer. Boeing had been planning to complete the changes by April, within the 10-month period, this person said.Boeing and the FAA’s risk projections faced a real-world crisis in less than five months. Ethiopian Airlines Flight 302 went down on March 10 in a similar nosedive prompted by the same type of automated MCAS commands pilots couldn’t overcome. The dual crashes took a total of 346 lives.
Investigators quickly focused on the central role of MCAS, and regulators around the world grounded the aircraft. The FAA has said it doesn’t have a deadline for approving the final package of fixes but won’t allow the planes back in the air until all safety issues are resolved.A Boeing spokesman said: “Boeing and the FAA both agreed, based on the results of their respective rigorous safety processes, that the initial action of reinforcing existing pilot procedures…and then the development and fielding of a software update, were the appropriate actions.” He added: “The safety of everyone flying our airplanes was paramount as the analysis was done and the actions were taken.”The FAA’s internal analysis, prepared in the days immediately following the Oct. 29 Lion Air crash, is called a TARAM, an acronym that stands for Transport Airplane Risk Assessment Methodology. It essentially involves a spreadsheet with formulas that consider a number of factors—such as fleet size, probability that sensors will fail, passenger counts—and aims to predict how many people could die over a certain period because of potential hazards, according to people familiar with the process.There is also a subjective analysis that, along with the TARAM’s numerical forecasts, informs FAA managers and engineers about what types of actions to take and when—for major but also less-serious air-safety issues. “It’s kind of a cold way of looking at it,” the person briefed on the analysis said, adding: “It’s not foolproof. It’s a tool.”The analysis determined that the underlying risks from the MCAS design were unacceptably high without at least some FAA action, that they exceeded internal FAA safety standards and that the likelihood of another emergency or even accident “was over our threshold,” according to the FAA official. “We decided…it was not an acceptable situation,” the official said.
implicated in the crash, according to the agency official and people briefed on the findings.The FAA’s early goal, one of these people added, was: “Get something out immediately and then mandate something more permanent.”Specifically, the FAA’s analysis suggested that a warning to pilots would be enough to provide Boeing about 10 months to design and implement changes to MCAS, according to a person close to the manufacturer. Boeing had been planning to complete the changes by April, within the 10-month period, this person said.Boeing and the FAA’s risk projections faced a real-world crisis in less than five months. Ethiopian Airlines Flight 302 went down on March 10 in a similar nosedive prompted by the same type of automated MCAS commands pilots couldn’t overcome. The dual crashes took a total of 346 lives.
Investigators quickly focused on the central role of MCAS, and regulators around the world grounded the aircraft. The FAA has said it doesn’t have a deadline for approving the final package of fixes but won’t allow the planes back in the air until all safety issues are resolved.A Boeing spokesman said: “Boeing and the FAA both agreed, based on the results of their respective rigorous safety processes, that the initial action of reinforcing existing pilot procedures…and then the development and fielding of a software update, were the appropriate actions.” He added: “The safety of everyone flying our airplanes was paramount as the analysis was done and the actions were taken.”The FAA’s internal analysis, prepared in the days immediately following the Oct. 29 Lion Air crash, is called a TARAM, an acronym that stands for Transport Airplane Risk Assessment Methodology. It essentially involves a spreadsheet with formulas that consider a number of factors—such as fleet size, probability that sensors will fail, passenger counts—and aims to predict how many people could die over a certain period because of potential hazards, according to people familiar with the process.There is also a subjective analysis that, along with the TARAM’s numerical forecasts, informs FAA managers and engineers about what types of actions to take and when—for major but also less-serious air-safety issues. “It’s kind of a cold way of looking at it,” the person briefed on the analysis said, adding: “It’s not foolproof. It’s a tool.”The analysis determined that the underlying risks from the MCAS design were unacceptably high without at least some FAA action, that they exceeded internal FAA safety standards and that the likelihood of another emergency or even accident “was over our threshold,” according to the FAA official. “We decided…it was not an acceptable situation,” the official said.
Join Date: Dec 2013
Location: South Coast, UK
Age: 67
Posts: 55
Likes: 0
Received 0 Likes
on
0 Posts
..”The FAA’s internal analysis, prepared in the days immediately following the Oct. 29 Lion Air crash, is called a TARAM, an acronym that stands for Transport Airplane Risk Assessment Methodology. It essentially involves a spreadsheet with formulas that consider a number of factors—such as fleet size, probability that sensors will fail, passenger counts—and aims to predict how many people could die over a certain period because of potential hazards, according to people familiar with the process.There is also a subjective analysis that, along with the TARAM’s numerical forecasts, informs FAA managers and engineers about what types of actions to take and when—for major but also less-serious air-safety issues. “It’s kind of a cold way of looking at it,” the person briefed on the analysis said, adding: “It’s not foolproof. It’s a tool.”The analysis determined that the underlying risks from the MCAS design were unacceptably high without at least some FAA action, that they exceeded internal FAA safety standards and that the likelihood of another emergency or even accident “was over our threshold,” according to the FAA official. “We decided…it was not an acceptable situation,” the official said.
Oh boy. That will become a field day for lawyers. You might google „Pinto Memo“ to get an idea how good those calculations are regarded by non technical people like lawyers and judges.
If the WSJ is correct, perhaps it shows that the functions of the FAA need to be simplified.
One function is Safety. - One would hope this is Science/Engineering based.
Another function is Promoting USA's Aviation. - This is Politics.
These two should not be in the same Agency. (BA will remember this due to their 3 engine flight - the Politics over-rode safety for some time)
One function is Safety. - One would hope this is Science/Engineering based.
Another function is Promoting USA's Aviation. - This is Politics.
These two should not be in the same Agency. (BA will remember this due to their 3 engine flight - the Politics over-rode safety for some time)
If you have ever been close enough to an incident or accident to know some of the facts and details, then you read media reports of that occurrence, you will be left shaking your head at the media incompetence or maleficence (take your pick).
I have seen this on two occasions and it has left me with a deep distrust of "the media".
He who pays the piper calls the tune.
So arguing over what you think happened or was said between the FAA and Boeing based on trite media reports is foolish in the extreme.
I have seen this on two occasions and it has left me with a deep distrust of "the media".
He who pays the piper calls the tune.
So arguing over what you think happened or was said between the FAA and Boeing based on trite media reports is foolish in the extreme.
Join Date: Jul 2002
Location: Ireland
Posts: 596
Likes: 0
Received 0 Likes
on
0 Posts
A regulator should regulate and nothing else, especially where safety is concerned. Anyone in a European regulatory body who put commercial concerns ahead of or even on a par with safety, would end up in jail.