MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

[Maninthebar]

Originally Posted by Fly Aiprt

Agreed. I remember asking this question months ago...
Maybe, as the STS was there, they thought it convenient to just add a few code lines ?
The declaration of Muilenburg yesterday seems to support the idea : "the MCAS was just an add-on to the STS..."

He HAS to say that though, doesn't he, cos that was the basis of lack of requirement for separate training and documentation.

[Zeffy]

Senate hearings have often/typically/nearly-always been about political posturing. If anyone fancies enduring three hours of it again, here is the C-SPAN link:
​​​​​​https://www.c-span.org/video/?465677...ax-safety&live


Time might be better spent on this 12 minute video by Juan Browne -
737 Max hearings on Capitol Hill 29 Oct - Analysis and Opinion

You Tube

[WillowRun 6-3]

Paper chase

GordonR_Cape - Sen. Duckworth's placing the Lemme piece in the record might have gone essentially unnoticed by the Senators still in the hearing room at that point in yesterday's proceeding, but it didn't go unnoticed . . . . here. As she is one of the two Senators from my state, I contacted her office to register one constituent's strong approval for her work yesterday including the Lemme item.

Octane - on the Forkner emails and/or messages. I'm not taking bets exactly but lawyer instincts being what they are, I'd venture a kind of prediction. Lurking in the "destinations" effective U.S. civil discovery would reach - this includes in state court but more emphatically in the federal courts - there will be found a kind of subterranean edifice of knowing communications, assurances of being able to skate through it, of yes that dread Washington word, cover-up....we ain't seen nuthin' yet, or at best, tip-of-the-iceberg so far only. There was a "thing" (to mock today's vernacular) directed at keeping the lid on the MCAS mess. Proof? C'mon, a system pulled from the 767-into-tanker program and then changed into a different system altogether didn't just happen along, la-de-da. And speaking of iceberg, lettuce that is, follow the sales revenue. The SWA lawsuit? The Brazil CAA divergence on training? Again I'm not taking bets but if discovery had olfactory sense or dimension I would say I can smell it, the reams of printed information, emails, etc., showing a kind of mirror image of actions and omissions intended to keep the whole mess quiet, keep it low-key.
Just pause for a moment and imagine the deposition outline for Forkner -- yeah I know he's taken the Fifth (but if offered immunity, what then?). Every conversation with anyone at B about the MCAS? Block out a week on my calendar, baby-cakes.

[Tomaski]

Originally Posted by robocoder

I too was vexed by this but after reading the excellent analysis linked to in post 3536 (the one at Satcom Guru; sorry no permission to link), I think I understand the reasoning.

Here's the link.

Long read. Lot's of good, highly technical info and analysis. Better than what you would get in Aviation Week.

[spornrad]

Originally Posted by GordonR_Cape

One of the highlights, but barely noticed points in the testimony, was when Senator Duckworth asked that Peter Lemme's article be read into the record, and this was accepted with no comments!? This article: https://www.satcom.guru/2019/10/flaw...-disaster.html

After having re-read Peter's exhaustive and complex analysis of certification and safety assessment of the MAX several times, I dare trying a short summary. Peter Lemme comes up with three major conclusions, he calls

• Tail Wagging the Dog
• Level of Mistrim
• Ineligible Discount

- Tail wagging the dog: no Fail-Safe implementation was choosen reflecting an unacceptable safety culture during the design phase of the MAX, violating company precedence. The Fail-Safe mandate should have been obvious from the beginning, once the aft column cutout override was added. If nothing less, to follow the other Boeing model implementations (which are all Fail-Safe).
- Level of mistrim analyzes in detail the flawed assumptions regarding trim speed, cutout override and pilot dealing with multiple malfunctions within 3 s.
- Ineligible Discount was for me the most difficult to understand. Trying in my words, Boeing used an arithmetic trick in the SSA (System Safety Assessment) combining the probabilities for 1. MCAS false activation (1/10.000) and 2. being outside the normal flight speed envelope (1/1.000) in order to claim a combined MCAS false activation probability of 1/10.000.000. This math trick is called "discount" and allowed them to avoid the dual channel design requirement for a "hazardous" condition. Peter Lemme further asks, whether this trick has been pulled as well for other malfunction evaluations during certification.
The JATR report states, that this creative arithmetic is not in compliance with the relevant safety rules.

Besides, this math is simply wrong, because combined event probability is only equal to multiplied single event probabilities if events are independent. Since MCAS is designed to trigger outside normal speed envelope and has the authority to bring AC out of the envelope, these events are by no means independent. You can try this trick with your life insurance broker: My annual risk of dying is 1/1000. My risk of a motorbike crash is 1/1000. Therefore, my combined fatal crash risk is only 1/ 1 Mio ....

[Takwis]

From the Lemme article,

Stabilizer trim is susceptible to runaway without MCAS as a factor. Boeing has provided measures to limit the stabilizer mistrim in a runaway to ensure that the elevator remains effective.

The aft column cutout and the forward column cutout are switches that automatically stop the stabilizer from trimming in opposition to the column.

If the stabilizer is running away by trimming the airplane nose down, the pilot flying will respond with aft column travel to command sufficient airplane nose up elevator to exactly offset the stabilizer mistrim.

At the point the aft column cutout is reached, the stabilizer trimming is stopped, to which the level of mistrim is now prescribed by the rigging of the aft column cutout switch. If the switch is rigged at 50% travel, then the pilot still has the remaining 50% of travel available. It does not matter what type of runaway, when the pilot responds with column travel, the trim will stop with the same level of mistrim.

Boeing assumed that a pilot will take one second to recognize the runaway malfunction (by noting the nose starting to drop), and then three seconds to respond to the malfunction, which in this case is by pulling back on the column sufficiently to trip the aft column cutout.
. . .

The aft column cutout switch performs two functions.

1. Stop the stabilizer from running away
2. Limiting the level of mistrim to preserve elevator effectiveness.

Boeing has used the aft and forward column cutout switches starting with the 707 and then including 727, 737, 747, 757, and 767. In all those airplanes, over all those years, the column cutout switches performed exactly as designed.

What Lemme does NOT mention (unless I have missed it somehow), nor does anyone else mention (that I have seen), is that the MAX FRM still tells the pilots reading it that the control column switches still function exactly like they did in the 737NG, and the Classics, and the -200s, all the way back to the 707.

But it they don’t. The pilots have been (are still being) lied to.

Control column actuated stabilizer trim cutout switches stop operation of the main electric and autopilot trim when the control column movement opposes trim direction.

[hans brinker]

Originally Posted by Flapsupbedsdown

Hi, it seem you are confusing af 447 with some other event.

No, I am not, I was disagreeing with the general "an aircraft can't climb and be close to a stall" statement, that has been resolved...

[hans brinker]

Originally Posted by DaveReidUK

Is that true ?

No it isn't, I did not research and relied on friends stories and assumptions, will do better next time.

I do have a similar example though:
DC-9-11/87, MD88, MD90, B717-200 are all the same type, and I can't find more than a few switches shared in the cockpit between the B717 and the DC9. It would require more training I guess, but I know a TWA B717 pilot who after the AA merger got assigned the DC9, and was basically told "you are current in the type, so after indoc, straight to IOE", luckily they realized that wouldn't work.

https://registry.faa.gov/TypeRatings/

[hans brinker]

Originally Posted by Octane

Can someone please help me understand the following;

1.
"I'm doing a bunch of travelling though the next few months; simulator validations, jedi-mind tricking regulators into accepting the training that I got accepted by the FAA" .

What exactly is "jedi mind tricking" and why was Forkner so busy travelling the world "tricking"?

2.
Why was Boeing's 737 Chief Technical Pilot so busy selling product and not wholly focused on the technical development of a new aeroplane?

Thanks..

1) "keep the cost down" (always the real number 1 objective of a short term profit driven company, hence the need for strong government oversight)

2) Apparently B has design pilots and technical pilots, the technical pilots are working on getting the sims correct and working with the customers, so that could be valid....

[hans brinker]

Originally Posted by robocoder

I too was vexed by this but after reading the excellent analysis linked to in post 3536 (the one at Satcom Guru; sorry no permission to link), I think I understand the reasoning.

The expectation was that, faced with sudden pitch changes due to runaway trim, pilots would quickly (the 3-4 seconds) react by correcting with elevator (I can buy that). At that point, the column trim switches that prevent electrical trim in the opposite direction would activate. Thing is, these are precisely the ones that MCAS bypasses to operate against pilot elevator command.

So the next step in my interpretation is that B counted on pilots not reacting to the non-continuous trim inputs of MCAS, which not only are time-limited, but have a 5-second "grace" period between activations. Unlike regular runaways. Hence relying on the runaway trim checklist to downgrade MCAS risk (if that happened) is questionable.

So I'm still thinking that the rationale for simultaneous MCAS operation and safety is a case of having the cake and eating it too.

BTW, the article in Satcom has lots of juicy bits that I guess aren't entering the radar of this thread due to its length.

I have read the satguru. If MCAS activates, pilots pull back on the column within 3 seconds, but that doesn't stop the trim due to MCAS disabling the switch. next step is a memory item, switch the trim off, so at second 5 the trim is switched off, but the aircraft needed the full 10 seconds of MCAS to get back to an acceptable elevator control force level. Still don't understand how that was deemed acceptable. Definitely cake+eating!!

[Tomaski]

Originally Posted by hans brinker

I have read the satguru. If MCAS activates, pilots pull back on the column within 3 seconds, but that doesn't stop the trim due to MCAS disabling the switch. next step is a memory item, switch the trim off, so at second 5 the trim is switched off, but the aircraft needed the full 10 seconds of MCAS to get back to an acceptable elevator control force level. Still don't understand how that was deemed acceptable. Definitely cake+eating!!

While not explicitly stated in any Boeing statements, the cynical side of me believes the engineering team thought this design was okay because when the stick shaker went off and the pilots went into their stall recovery mode, they assumed the pilots would be so distracted that they wouldn't notice the MCAS working "in the background."

[BDAttitude]

Originally Posted by spornrad

Tail wagging the dog: no Fail-Safe implementation was choosen reflecting an unacceptable safety culture during the design phase of the MAX, violating company precedence. The Fail-Safe mandate should have been obvious from the beginning, once the aft column cutout override was added. If nothing less, to follow the other Boeing model implementations (which are all Fail-Safe).

There is an other very important aspect in the "Tail wagging the dog" section that struck me because I have witnessed it first hands before:
Hazard Analysis being done as a pro forma excercise to sign off an existing design, not as part of discovering subsystem requirements before implementing something.
But doing proper system requirements first, then discovering subsystem requirements is so 80ies. Today everybody is "agile", because it's faster and cheaper you know. And it has proofed to work for crappy IPhone apps.
So for this one top down company culture is to blame and nothing else!

[infrequentflyer789]

Originally Posted by GordonR_Cape

This is an extremely long article, but weaves together important points from both the JATR report and the Lion Air crash report, along with FAA regulations. It offers some new insights which were not clear in either of those individual reports, and provides coherent details of all of the multiple failures.

Speculation: It reads a bit like an expert witness report, ready for trial before a jury.

You were very close - Peter Lemme's paper has now been submitted and entered into the record of the Senate Committee hearings.

I guess it could still be used as expert witness report as well - with its use in the Senate hearings establishing credibility?

[OldnGrounded]

Originally Posted by WillowRun 6-3

Again I'm not taking bets but if discovery had olfactory sense or dimension I would say I can smell it, the reams of printed information, emails, etc., showing a kind of mirror image of actions and omissions intended to keep the whole mess quiet, keep it low-key.
Just pause for a moment and imagine the deposition outline for Forkner -- yeah I know he's taken the Fifth (but if offered immunity, what then?). Every conversation with anyone at B about the MCAS? Block out a week on my calendar, baby-cakes.

All the good lawyers I've worked with definitely bring strong and refined olfactory senses to the discovery process. I'm confident that the good ones signing up with plaintiffs in the various litigations arising from the MAX debacle are sniffing out utterly devastating storylines.

Don't you think there's a pretty good chance that the prosecutors will grant Forkner immunity? He's in such a central place in the story that his value as a witness must far outweigh any desire to prosecute him individually.

Boeing is probably going to be extremely reluctant to let any of the (how many?) suits go to trial, while the plaintiffs are going to be highly resistant to lowball settlements, because their counsel is likely to be quite comfortable with bringing the cases to juries. I think the big unknown is just how huge a number the total of the judgments/settlements will be. Could it, along with the rest of the costs of this disaster, be enough to present an existential threat to Boeing?

[Grebe]

I've boldfaced an interesting issue - From WSJ

Boeing Accused of ‘Lack of Candor’ as House Panel Probes 737 MAX Crashes

Boeing CEO Grilled by Senators on Handling of 737 MAX Problems
U.S. senators questioned Boeing CEO Dennis Muilenburg on the company's internal communications related to concerns about the 737 MAX’s flight-control system and pilots’ training on the system.
By Ted Mann,
Andy Pasztor and
Andrew Tangel
Updated Oct. 30, 2019 10:53 am ET

WASHINGTON— Boeing Co. ’s actions in launching its 737 MAX passenger jet came under fire again Wednesday as the House Transportation Committee opened an inquiry into the design and development of the aircraft involved in two fatal crashes that killed 346 people.

Lawmakers hammered Boeing executives a day after a similar Senate hearing with Boeing CEO Dennis Muilenburg, suggesting that commercial pressures and a failure to adequately inform pilots of design changes led to the doomed flights.

“There are a lot of unanswered questions that we need to get to the bottom of,” said Rep. Peter DeFazio (D., Ore.), the chairman of the House Transportation Committee.

“There’s been a lack of candor all through this,” Mr. DeFazio said, suggesting that pressures to keep costs lower for customers and preserve market share may have led Boeing to cut corners in the development of the MAX, including by failing to require new training for the MCAS flight-control system that led to two fatal crashes, in Indonesia and Ethiopia.

“I’ve talked to a lot of pissed-off pilots,” Mr. DeFazio said, adding that they felt uninformed about the system that malfunctioned in those crashes. “How can we be the backup if we don’t know something is going to take over our plane?’”

’Mr. DeFazio said House investigators had also learned of a Boeing manager who “implored the then-vice president and general manager of the 737 program to shut down the 737 MAX production line because of safety concerns,” before the first crash, in October 2018.

A day earlier, Mr. Muilenberg acknowledged to senators that he had been briefed on internal concerns about the control system after the first MAX crash. Boeing faces an overarching question as it responds to lawmakers, regulators and lawsuits: could a more urgent response to the first crash have saved the lives of the 157 who died on the second plane?

Boeing is also playing defense against newly skeptical lawmakers who question whether federal safety regulators have ceded too much authority to plane makers to check the reliability of their own designs. Lawmakers in both parties have also questioned whether the Federal Aviation Administration has grown too cozy with Boeing, the world’s largest airplane maker and one of the nation’s most important industrial companies.

Mr. DeFazio for some two decades has been an outspoken critic of what he views as often passive air-safety regulators catering to industry pressures. Mr. DeFazio has called the FAA’s actions between the two crashes “totally inadequate,” adding “it did not express any level of urgency.”

Based on his prepared opening statement and recent remarks about the goals of the hearings, Boeing’s cost-cutting efforts are likely to be a major theme of Wednesday’s session with lawmakers confronting Mr. Muilenburg with questions about whether schedule pressure on employees resulted in hasty or ill-advised design decisions on the MAX.

The hearing also is expected to reveal that before the Lion Air crash in Indonesia, a senior manufacturing manager on Boeing’s 737 MAX assembly line expressed serious concerns to the head of the MAX program about safety concerns related to ramping up MAX production.

“We’re aware of that,” Mr. Muilenburg said in a news conference Wednesday before the House hearing. “We’ve taken on those concerns and addressed those.”

In addition to questions about specific engineering and procedural missteps in government certification of the jet, the House panel is poised to delve into Boeing’s internal safety deliberations in the wake of the Lion Air crash.

Asked about what he knew before the second 737 MAX crash about a former Boeing pilot’s 2016 messages suggesting he experienced problems with a flight-control system and misled regulators, Mr. Muilenburg said: “That was a topic I was briefed on earlier this year. I’m sure that will be a topic of discussion in today’s hearings as well.”

And a few minutes ago- 8 42 AM Oct 30 Comment was made re what happened to CEO (Demotion from Chair of Board )- and that one person had been fired- but CEO got a 15 million bonus after the first crash . . .

oooopsie

[Flapsupbedsdown]

Originally Posted by Takwis

From the Lemme article,

What Lemme does NOT mention (unless I have missed it somehow), nor does anyone else mention (that I have seen), is that the MAX FRM still tells the pilots reading it that the control column switches still function exactly like they did in the 737NG, and the Classics, and the -200s, all the way back to the 707.

But it they don’t. The pilots have been (are still being) lied to.

Control column stab trim cutout switches! Perhaps some confusion here.

[OldnGrounded]

Originally Posted by Takwis

From the Lemme article,

What Lemme does NOT mention (unless I have missed it somehow), nor does anyone else mention (that I have seen), is that the MAX FRM still tells the pilots reading it that the control column switches still function exactly like they did in the 737NG, and the Classics, and the -200s, all the way back to the 707.

But it they don’t. The pilots have been (are still being) lied to.

Originally Posted by Flapsupbedsdown

Control column stab trim cutout switches! Perhaps some confusion here.

Neither the control column cutout switches nor the pedestal switches function on the MAX as on the NG.

[SteinarN]

Is there a link to todays hearing?

[GordonR_Cape]

Originally Posted by SteinarN

Is there a link to todays hearing?

Don't get too excited. House Transportation and Infrastructure Committee:
https://www.c-span.org/video/?465775...afety&live&vod

[Takwis]

Originally Posted by OldnGrounded

Neither the control column cutout switches nor the pedestal switches function on the MAX as on the NG.

That is true.

My my point is that the MAX FRM says that the control column switches DO function the same as on the NG. The function of the pedestal cutout switches are more accurately described.

Control column stab trim cutout switches! Perhaps some confusion here.

The nomenclature may be confusing to some. I have been operating both for more than 27 years, and have not been confused. The control column cutout switches that Lemme is talking about no longer function as originally designed. The FRM says they do. I quoted the relevant sentence in the MAX FRM above ( and several times over the last year).