737 Max: Loose Rudder-Control Fastener Issue.
So design/manufacture and maintenance are not my area of expertise, but I offer a few thoughts…. Whilst, clearly, aircraft that are in service need to be checked, I would like to think that a thorough investigation is carried out at Boeing to understand how such a manufacturing error made it through to delivered (and delivery-ready) aircraft. Although this particular error may, arguably, not be critical, what confidence is there that other, more critical errors are not being made. And, further, is there a weakness in the FAA oversight processes which could/should have picked this up at an earlier stage.
Good spot, finding this fault. A disaster averted.
Not necessarily terrifying; we hardly touch the rudder with the foot pedals in normal (jet transport) flight - the yaw damper puts in most rudder movements that are required for turn coordination and yaw damping.
Cross-wind take offs and landings, and of course engine failure are another matter. You obviously wouldn't take off with this fault; but to get you back on the ground; losing foot control of the rudder in flight would not be a biggy, as long as the yaw damper and trim were serviceable, and providing the rudder itself didn't go hard over, which would be unlikely if the control rods just became disconnected. It would certainly allow an into-wind landing
Not necessarily terrifying; we hardly touch the rudder with the foot pedals in normal (jet transport) flight - the yaw damper puts in most rudder movements that are required for turn coordination and yaw damping.
Cross-wind take offs and landings, and of course engine failure are another matter. You obviously wouldn't take off with this fault; but to get you back on the ground; losing foot control of the rudder in flight would not be a biggy, as long as the yaw damper and trim were serviceable, and providing the rudder itself didn't go hard over, which would be unlikely if the control rods just became disconnected. It would certainly allow an into-wind landing
And, given that we're told the issue isn't something that's detectable between C checks, I'd hazard a guess that the in-service aircraft found without a nut at all was delivered in a similar state.
Join Date: Dec 2005
Location: Watford
Age: 70
Posts: 106
Likes: 0
Received 0 Likes
on
0 Posts
It was drilled into me,firstly by the RAF & then by the CAA that any disturbance of safety critical parts had to be a duplicate inspection by two suitably type qualified engineers.
Don't Boeing do that on manufacture?
Don't Boeing do that on manufacture?
Quite: from my post #16: Old fart here recalling his early days and a quaint Air Registration Board (predecessor to CAA) regulation that splitting or installation of any primary control MUST be signed off with a duplicate inspection by another licensed engineer. This long-retired pilot and LAE thinks that a "rudder will no longer respond to pilot pedal inputs" would have terrified him. He certainly would not have flown with it.
Glad to see someone else raising this basic regulation (not a rule).
Exam answer from memory of 60 yrs ago: What is a duplicate inspection? Answer: A duplicate inspection is first made by a licensed engineer or qualified person and certified, and then made by a second licensed engineer and again certified. Basically it meant two heads on the block if something went wrong.
Glad to see someone else raising this basic regulation (not a rule).
Exam answer from memory of 60 yrs ago: What is a duplicate inspection? Answer: A duplicate inspection is first made by a licensed engineer or qualified person and certified, and then made by a second licensed engineer and again certified. Basically it meant two heads on the block if something went wrong.
Last edited by Geriaviator; 7th Jan 2024 at 16:00. Reason: Add definition of duplicate insp
Salute!
As a fellow, really old aviator, with Geri, I would really be "concerned" in a multi engine plane without a rudder when one motor quit. Especially if I could not feather the prop, although a pure jet/turbofan might be slightly easier,but not so with swept wings ( roll due to yaw worse on bent wings).
All the yaw dampers and aileron-rudder interconnect and FBW control laws are no substitue for cranking in some rudder when it is required to keep the pointy end forward.
Just my thots from a mostly single-engine or multi-engine, centerline thrust dude, although the over-powered A-37 needed an awful lot of rudder on a single engine go-around (lost two that way, but then trained folks to use lottsa rudder early). My LEF adventure also required plenty of rudder that the FBW laws did not command.
Gums sends...
As a fellow, really old aviator, with Geri, I would really be "concerned" in a multi engine plane without a rudder when one motor quit. Especially if I could not feather the prop, although a pure jet/turbofan might be slightly easier,but not so with swept wings ( roll due to yaw worse on bent wings).
All the yaw dampers and aileron-rudder interconnect and FBW control laws are no substitue for cranking in some rudder when it is required to keep the pointy end forward.
Just my thots from a mostly single-engine or multi-engine, centerline thrust dude, although the over-powered A-37 needed an awful lot of rudder on a single engine go-around (lost two that way, but then trained folks to use lottsa rudder early). My LEF adventure also required plenty of rudder that the FBW laws did not command.
Gums sends...
Is this just another indication of the decline in quality standards? Not just at Boeing.
Decline in standards..nah..
in the early 1970s after a DC10 had a cargo door locking mechanism fail after being hit by a coffin there was a mandatory modification. A new DC10 destined for Turkish airlines had the mod signed off and inspected which hadn’t been carried out. The aircraft ended up in a forest outside of paris with 346 dead.
in the early 1970s after a DC10 had a cargo door locking mechanism fail after being hit by a coffin there was a mandatory modification. A new DC10 destined for Turkish airlines had the mod signed off and inspected which hadn’t been carried out. The aircraft ended up in a forest outside of paris with 346 dead.
Decline in standards..nah..
in the early 1970s after a DC10 had a cargo door locking mechanism fail after being hit by a coffin there was a mandatory modification. A new DC10 destined for Turkish airlines had the mod signed off and inspected which hadn’t been carried out. The aircraft ended up in a forest outside of paris with 346 dead.
in the early 1970s after a DC10 had a cargo door locking mechanism fail after being hit by a coffin there was a mandatory modification. A new DC10 destined for Turkish airlines had the mod signed off and inspected which hadn’t been carried out. The aircraft ended up in a forest outside of paris with 346 dead.
Our Navy had a Sea King accident in Indonesia while on a humanitarian mission following an earth quake, nine deaths and two seriously injured. Caused by a missing split pin on a castellated nut in the cyclic control system.
The investigation found that meeting the mission had priority and things such as maintenance, training and leadership took a back seat. Maybe Spirit (Boeing) is suffering the same pitfalls, get the aircraft out the door and focus being lost on the process.
The investigation found that meeting the mission had priority and things such as maintenance, training and leadership took a back seat. Maybe Spirit (Boeing) is suffering the same pitfalls, get the aircraft out the door and focus being lost on the process.
Our Navy had a Sea King accident in Indonesia while on a humanitarian mission following an earth quake, nine deaths and two seriously injured. Caused by a missing split pin on a castellated nut in the cyclic control system.
The investigation found that meeting the mission had priority and things such as maintenance, training and leadership took a back seat. Maybe Spirit (Boeing) is suffering the same pitfalls, get the aircraft out the door and focus being lost on the process.
The investigation found that meeting the mission had priority and things such as maintenance, training and leadership took a back seat. Maybe Spirit (Boeing) is suffering the same pitfalls, get the aircraft out the door and focus being lost on the process.
By all accounts the final rigging of the door plug is done at Boeing, and that's after the locking bolts have been removed and later replaced so the plug can be opened to improve access to the rear cabin while the interior is being fitted out.
As an ex technical auditor, speaking with my nit-picking audit hat on, no.
A dual inspection does not prevent collusion, witting or unwitting. You need evidence. A signed entry in a log-book is suggestive, but is certainly not proof that something was done.
Where possible, it can be good to take a photograph of the finished job. It documents that the job was done at the date and time the photograph was taken. Ideally, you have a tamper-resitant display in the image that shows the current date and time. It does not provide proof that the finished job was not disturbed later.
In nuclear weapons installations, tamper evidence can achieved by sealing equipment with epoxy which has glitter mixed in with it. A stereoscopic picture of the seal is then taken, and subsequently it can be compared to the in-situ seal to show if the epoxy has been removed and replaced. Unsurprisingly, much work has gone into working out how to duplicate or move these apparently unreproducible seals.
I'm not suggesting that glitter epoxy is used to seal locking bolts. It's almost certainly over-egging the pudding and would add unnecessary mass to the airframe; but there are ways of providing physical/documentary proof of things that don't reply so much on fallible humans.
For example, you can keep an accurate inventory, so if you see that four bolts, castellated nuts and length of locking wire and/or cotter-pins have not been used, you don't roll out the airframe. Keeping such an inventory is non-trivial.
Or, you can mark each item with a unique serial-number (or pattern) and keep track of them - if the S/N shows up in a photograph, so much the better. Larger items can have RFID tags attached. They are cheap enough to be used in inventory management for fashion clothing.
Professional aircraft technicians will do their best to not leave jobs incomplete or make mistakes, but they are human, and our experience of having humans 'in the loop' is that they tend to generate mistakes or mishaps, so we need compensating systems. Dual sign-off is better than nothing, but by no means infallible,
A dual inspection does not prevent collusion, witting or unwitting. You need evidence. A signed entry in a log-book is suggestive, but is certainly not proof that something was done.
Where possible, it can be good to take a photograph of the finished job. It documents that the job was done at the date and time the photograph was taken. Ideally, you have a tamper-resitant display in the image that shows the current date and time. It does not provide proof that the finished job was not disturbed later.
In nuclear weapons installations, tamper evidence can achieved by sealing equipment with epoxy which has glitter mixed in with it. A stereoscopic picture of the seal is then taken, and subsequently it can be compared to the in-situ seal to show if the epoxy has been removed and replaced. Unsurprisingly, much work has gone into working out how to duplicate or move these apparently unreproducible seals.
I'm not suggesting that glitter epoxy is used to seal locking bolts. It's almost certainly over-egging the pudding and would add unnecessary mass to the airframe; but there are ways of providing physical/documentary proof of things that don't reply so much on fallible humans.
For example, you can keep an accurate inventory, so if you see that four bolts, castellated nuts and length of locking wire and/or cotter-pins have not been used, you don't roll out the airframe. Keeping such an inventory is non-trivial.
Or, you can mark each item with a unique serial-number (or pattern) and keep track of them - if the S/N shows up in a photograph, so much the better. Larger items can have RFID tags attached. They are cheap enough to be used in inventory management for fashion clothing.
Professional aircraft technicians will do their best to not leave jobs incomplete or make mistakes, but they are human, and our experience of having humans 'in the loop' is that they tend to generate mistakes or mishaps, so we need compensating systems. Dual sign-off is better than nothing, but by no means infallible,
Last edited by Semreh; 8th Jan 2024 at 13:34. Reason: Remove some formating errors and a typo. Fallible. See?
As you mention nit-picking, may I question your use of the term "dual sign-off" which implies the engineers perform the inspection together? In my day we didn't: we went by the book definition which stated "A duplicate inspection is first made by a licensed engineer or qualified person and certified, and then made by a second licensed engineer and AGAIN certified." The point being that there are two separate operations confirmed by two signatures on the log book or works record, and two heads to roll if something goes wrong. Of course this implies extra cost, extra delays in production and similar stuff to annoy the bean-counters.
As you mention nit-picking, may I question your use of the term "dual sign-off" which implies the engineers perform the inspection together? In my day we didn't: we went by the book definition which stated "A duplicate inspection is first made by a licensed engineer or qualified person and certified, and then made by a second licensed engineer and AGAIN certified." The point being that there are two separate operations confirmed by two signatures on the log book or works record, and two heads to roll if something goes wrong. Of course this implies extra cost, extra delays in production and similar stuff to annoy the bean-counters.
But the point stands that one signature, or two signatures, in a log does not mean that the job was done.
People who have worked together for a period can build up a level of trust. Bob can say to Fred that Bob has done Job No. XP/371A and present the log book. Fred can go back to the aircraft, unscrew the access panels that Bob has replaced and check the job was done, or just take Bob's word for it. Of course he should check. But it is human nature: they have a good working relationship, and Bob has never made a mistake before...
Yes, it is unprofessional, and it should never happen. But it, or something very like it, happens often enough that we need systems to detect and prevent it. Ideally, no-one is ever tired, or under pressure to meet a deadline, or makes a mistake looking at panel C instead of panel D, or misses the fact that Job XP/371A opens three panels, not two because one page of the worksheet goes missing.
As an auditor, I was actively disliked because I distrusted people professionally. It didn't matter how well-intentioned people were, or professional, they still made mistakes. And so did I. Questioning peoples procedures is often taken personally: questioning the integrity of the process is often taken as questioning the integrity of the person following the process. Eventually I learned enough 'people-skills' to depersonalise the issues for most.
We should not expect people to do things without error. We should design systems that effectively and efficiently identify when things go wrong, and provide effective and efficient mitigation. Relying on humans to get things right every time is unreasonable.