U.S. Senate panel reviewing whistleblower claims on aviation safety: panel chair
WASHINGTON (Reuters) - The U.S. Senate Commerce Committee is investigating claims by a number of whistleblowers that aviation safety inspectors, including some who worked to evaluate the now-grounded Boeing 737 MAX, were not properly trained or certified, the committee chairman said on Tuesday.
More than 300 Boeing 737 MAX jets have been grounded worldwide after two crashes - in Indonesia in October and in Ethiopia last month - killed nearly 350 people.
Senator Roger Wicker, a Republican, said in a letter to the Federal Aviation Administration that the FAA may have been notified about the training and certification concerns as early as August 2018 - before the Indonesia crash - citing information from the whistleblowers and documents.
The letter did not disclose if the whistleblowers worked for Boeing, the FAA or another entity. The FAA has come under criticism for delegating some of its certification responsibilities to Boeing and other manufacturers.
In his letter, Wicker asked acting FAA administrator Daniel Elwell to provide answers to detailed questions by April 16.
Asked about the claims, the FAA referred to Elwell’s testimony at a Senate hearing last week in which he said “the FAA welcomes external review of our systems, processes, and recommendations.”
The FAA has a “very good whistleblower program”, Elwell said at the hearing, and added: “There were no comments made by employees to our knowledge.”
Wicker’s letter said the whistleblowers alleged that safety inspectors without proper safety training could have been participants on the Flight Standardization Board that evaluated the 737 MAX 8 to “determine the requirements for pilot type ratings, to develop minimum training recommendations, and to ensure initial flightcrew member competency.”
Wicker’s letter also says the committee is “led to believe that an FAA investigation into these allegations may have been completed recently.”
Boeing said last week that it was reprogramming software on its 737 MAX passenger jet to prevent erroneous data from triggering an anti-stall system that is under mounting scrutiny following the two deadly nose-down crashes.
The world’s largest planemaker said the anti-stall system, which is believed to have repeatedly forced the nose lower in the Indonesia accident, would only do so one time after sensing a problem, giving pilots more control.
On Monday, Boeing and the FAA said Boeing’s planned software fix and training revision would be submitted to the FAA for approval in “the coming weeks.” The company previously said it planned to deliver the fix for government approval by last week.
https://www.reuters.com/article/us-ethi ... SKCN1RE256
Reuters Top News
BREAKING: Investigators of Ethiopian crash found piece of stabilizer with trim in unusual position similar to doomed Lion Air jet - sources
the recent government shutdown delayed work on fix
trump has not yet put a person in charge of FAA
Boeing 737 MAX 8 planes grounded after Ethiopian crash
https://www.cnn.com/world/live-news/boe ... index.html
CEO Dennis Muilenburg spoke by phone with trump, urging him not to ground 737 Max 8s after Sunday’s crash.
Muilenburg has tried to cultivate Trump. He visited Mar-a-Lago after AF1 dust-up, & Boeing donated $1M to Trump inaugural.
Boeing Flights Grounded Across the Globe, but Not in the U.S.
Boeing 737 Max 8 pilots complained to feds for months about suspected safety flaw
3 hrs ago
Pilots repeatedly voiced safety concerns about the Boeing 737 Max 8 to federal authorities, with one captain calling the flight manual "inadequate and almost criminally insufficient" several months before Sunday's Ethiopian Air crash that killed 157 people, an investigation by The Dallas Morning News found.
The News found at least five complaints about the Boeing model in a federal database where pilots can voluntarily report about aviation incidents without fear of repercussions.
The complaints are about the safety mechanism cited in preliminary reports about an October plane crash in Indonesia that killed 189.
The disclosures found by The News reference problems during Boeing 737 Max 8 flights with an autopilot system, and they all occurred while trying to gain altitude during takeoff — many mentioned the plane turning nose down suddenly. While records show these flights occurred during October and November, the information about which airlines the pilots were flying for is redacted from the database.
Records show that a captain who flies the Max 8 complained in November that it was "unconscionable" that the company and federal authorities allowed pilots to fly the planes without adequate training or fully disclosing information about how its systems were different from previous 737 models.
The captain's complaint was logged after the FAA released an emergency airworthiness directive about the Boeing 737 Max 8 in response to the crash of Lion Air Flight 610 in Indonesia.
An FAA spokesman said the reports found by The News were filed directly to NASA, which serves as a neutral third party for reporting purposes.
Tuesday evening, the agency issued a statement from Acting Administrator Daniel K. Elwell, saying that it "continues to review extensively all available data and aggregate safety performance from operators and pilots of the Boeing 737 MAX."
"Thus far, our review shows no systemic performance issues and provides no basis to order grounding the aircraft. Nor have other civil aviation authorities provided data to us that would warrant action," Elwell said in the statement.
A federal audit in 2014 said that the FAA does not collect and analyze its voluntary disclosure reporting in a way that would effectively identify national safety risks.
U.S. regulators are mandating that Boeing upgrade the plane's software by April but have so far declined to ground the planes. China, Australia and the European Union have grounded the 737 Max 8, leaving the U.S. and Canada as the only two countries flying a substantial number of the aircraft.
Sen. Ted Cruz of Texas, who leads a Senate subcommittee overseeing aviation, said in a statement Tuesday that U.S. authorities should ground the planes.
"Further investigation may reveal that mechanical issues were not the cause, but until that time, our first priority must be the safety of the flying public," Cruz said.
At least 18 carriers — including American Airlines and Southwest Airlines, the two largest U.S. carriers flying the 737 Max 8 — have also declined to ground planes, saying they are confident in the safety and "airworthiness" of their fleets. American and Southwest have 24 and 34 of the aircraft in their fleets, respectively.
"The United States should be leading the world in aviation safety," said John Samuelsen, the president of a union representing transport workers that called Tuesday for the planes to be grounded. "And yet, because of the lust for profit in the American aviation, we're still flying planes that dozens of other countries and airlines have now said need to be grounded."
The fifth complaint from the captain who called into question the 737 Max 8's flight manual ended: "The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error-prone — even if the pilots aren't sure what those systems are, what redundancies are in place and failure modes. I am left to wonder: what else don't I know?"
A 737 Max 8 captain noted problems on takeoff (p. 2)
Selected portion of a source document hosted by DocumentCloud
View the entire document with DocumentCloud
The Maneuvering Characteristics Augmentation System (MCAS) was included on the Max 8 model aircraft as a safety mechanism that would automatically correct a plane entering a stall pattern. If the plane loses lift under its wings during takeoff and the nose begins to point far upward, the system kicks in and automatically pushes the nose of the plane down.
After the Lion Air crash, the FAA issued an airworthiness directive that said: "This condition, if not addressed, could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain."
Officials have not yet determined what caused Ethiopian Airlines Flight 302 to nosedive into the ground on Sunday, but many experts have noted similarities between this week's crash and the one in Indonesia.
A Boeing 737 Max 8 goes nose down suddenly during takeoff, pilot reports incident. (p. 10)
Selected portion of a source document hosted by DocumentCloud
View the entire document with DocumentCloud
A spokesperson for Dallas-based Southwest Airlines told The News that it hasn't received any reports of issues with MCAS from its pilots, "nor do any of our thousands of data points from the aircraft indicate any issues with MCAS."
Fort Worth-based American Airlines did not respond to questions from The News.
The FAA issued a statement to The News Tuesday that said that it is "collecting data and keeping in contact with international civil aviation authorities as information becomes available."
"The FAA continuously assesses and oversees the safety performance of U.S. commercial aircraft. If we identify an issue that affects safety, the FAA will take immediate and appropriate action."
Jon Weaks, president of the Southwest Airlines Pilots Association, said in a press release Monday night: "We fully support Southwest Airlines' decision to continue flying the MAX and the FAA's findings to date."
Boeing, which posted a record $101 billion in revenue last year, issued a new statement Tuesday saying that no grounding of planes was necessary. "Based on the information currently available, we do not have any basis to issue new guidance to operators," the company said.
Samuelsen of the transport workers union said it's "unconscionable" that the FAA has not yet grounded the planes in the U.S., given the number of deaths that have occurred.
"This pressure should not be on these pilots to overcome an engineering flaw that Boeing themselves acknowledges," said Samuelsen.
https://www.dallasnews.com/business/air ... afety-flaw
Countries are piling on to ban Boeing’s new plane from their airspace
Ashley NunesMarch 12 at 2:04 PM
Investigators look over debris from the crash site of Ethiopian Airlines Flight ET 302. (Jemal Countess/Getty Images)
The European Union has just joined Australia and China in banning Boeing’s 737 Max 8 jetliner from their airspace, after Britain, France and Germany individually did so earlier Tuesday. This is likely to lead to greater pressure for a worldwide grounding of the aircraft. That will have big consequences for Boeing for the aviation industry, and perhaps for the U.S. economy.
The ban is a response to two crashes
The nations that have banned the 737 Max from their airspace are responding to Sunday’s horrific crash. Ethiopian Airlines Flight 302 had just left Addis Ababa for the Kenyan capital of Nairobi when it reported technical problems and requested permission to turn back. Its wreckage was found moments later on the outskirts of Africa’s political hub, near the small town of Bishoftu. Everyone on board was killed.
The crash marks the second time in five months that this new type of Boeing aircraft was involved in a fatal crash. In October, another 737 Max belonging to Indonesian low-cost giant Lion Air plunged into the sea, killing 189 passengers and crew.
Big money is at stake
Sunday’s crash was an enormous tragedy, which killed, among others, many humanitarian workers and aid professionals. Yet there is also another dimension to the crash: money. The 737 has long been one of Boeing’s best-selling products. First introduced in 1968, thousands of these airplanes have been sold to date. The Max — a newer, more fuel-efficient version of the original 737 — is particularly important for Boeing. With global airlines expected to buy over 37,000 airplanes — valued at over $5 trillion — over the coming decades, Boeing sees the Max as key to winning the jet order arms race against its European rival, Airbus. The world’s dominant plane makers have long been locked in a tussle for market share.
Sales in the Asian Pacific market are particularly important to Boeing. According to the International Air Transport Association (IATA), an airline trade group, the region will be the biggest driver of air travel demand over the next decade with over half of all new passenger traffic coming from countries including Indonesia and China. Since Sunday’s crash, the Max has been banned from operating in both countries. The move by Chinese authorities is particularly worrying given the country already operates one of the largest fleets of the 737 Max in the world. The Chinese air safety regulator said the move was in line with its principle of “zero tolerance of safety hazards.” Now, the swift action from the E.U., together with tweeted complaints from President Trump, may transform a regional market crisis into a global one.
Regulators’ response has been mixed
On Monday, U.S. Transportation Secretary Elaine Chao told reporters, “If the Federal Aviation Administration (FAA) identifies an issue that affects safety, the department will take immediate and appropriate action.” Chao’s Canadian counterpart — Minister Marc Garneau — voiced similar sentiments. Garneau’s comments come as his country’s flag carrier sought to reassure nervous travelers. In a statement, Air Canada — which operates 24 of the Max jets — said, “These aircraft have performed excellently from a safety, reliability and customer satisfaction perspective.”
However, one member of an influential U.S. air safety group sounded the alarm. Paul Hudson — a member of the FAA Aviation Rulemaking Advisory Committee — said the agency’s “'wait and see attitude risks lives as well as the safety reputation of the U.S. aviation industry.” Hudson called for the immediate grounding of the Boeing 737 Max. So did Jim Hall — the former head of the National Transportation Safety Board — as did Sen. Richard Blumenthal.
Blumenthal (D-Conn.) on Monday said the planes “should be grounded until the FAA can assure American travelers that these planes are safe.” On Tuesday, other U.S. lawmakers joined the chorus, calling on the FAA to take action.
It will take time to figure out what happened
Crash investigators are expected to comb through the wreckage looking for clues. However, a report summarizing their findings is unlikely to be made public anytime soon. Investigations can often take months, if not years. In the meantime, back-to-back crashes of American-made airplanes may have political ramifications.
For one thing, these events undercut Trump’s claims that his policies have made flying safer than ever. In a widely reported 2017 tweet, the president claimed that air safety had improved because he’d been “very strict on commercial aviation.” Defensiveness over these comments may explain why he on Tuesday complained that “airplanes are becoming far too complex to fly.”
If Boeing aircraft sales are suspended, there are likely to be indirect consequences for American jobs. Following October’s Lion Air crash, the airline threatened to cancel over $22 billion worth of jet orders. If airlines start to believe that there is something inherently wrong with Boeing’s prized offering — or, even worse, if consumers start to identify the new 737 models as unsafe — it will have serious ramifications for Boeing.
Ashley Nunes studies regulatory policy at MIT.
https://www.washingtonpost.com/politics ... 4b20c30dca
[/quote]NATIONAL
U.S. Lawmakers Call To Ground The Boeing 737 MAX 8. FAA Says 'No' For Now
March 12, 20197:42 PM ET
Brakkton Booker at NPR headquarters in Washington, D.C., November 7, 2018. (photo by Allison Shelley)
BRAKKTON BOOKER
Rescuers work at the scene of an Ethiopian Airlines flight crash. Countries around the world have grounded their Boeing 373 MAX jets and there is growing political pressure on the Federal Aviation Administration to do the same.
Mulugeta Ayene/AP
As countries worldwide continue to ground their Boeing 737 MAX 8 aircraft, aviation officials in the U.S. have been hesitant to follow suit.
The Federal Aviation Administration says there is "no basis to order the grounding of the aircraft." That's according to a statement Tuesday evening from Daniel Elwell, the acting FAA administrator.
"The FAA continues to review extensively all available data and aggregate safety performance from operators and pilots of the Boeing 737 MAX," the statement reads. "Thus far, our review shows no systemic performance issues and provides no basis to order grounding the aircraft. Nor have other civil aviation authorities provided data to us that would warrant action."
Ethiopian Airlines flight 302 crashed on Sunday, killing all 157 passengers and crew on board. Just five months earlier, a 737 MAX jet flown by Lion Air crashed off the coast of Indonesia killing all 189 people on the plane.
Dozens Of Countries Ground Boeing's 737 Max 8 Following Deadly Crash In Ethiopia
Tuesday, the European Union Aviation Safety Agency announced it was suspending all flight operations of the Boeing series of jets involved in the crashes. That follows similar moves by China, the United Kingdom, Singapore, Australia and others to either ground the planes or temporarily ban them from their airspace.
And on Capitol Hill there is a growing chorus of lawmakers from both parties calling for the FAA to do the same.
Speaking on NPR's All Things Considered, Sen. Richard Blumenthal, D-Conn., said the FAA has a responsibility to put "safety ahead of airline profits."
"Right now there's more than ample reason for airline passengers to be greatly concerned. In fact, justifiably frightened about the safety of these airplanes and the ability of pilots to handle a malfunction," Blumenthal said.
Sign Up For The NPR Daily Newsletter
Catch up on the latest headlines and unique NPR stories, sent every weekday.
"I believe it would be prudent for the United States likewise to temporarily ground 737 Max aircraft until the FAA confirms the safety of these aircraft and their passengers."
Cruz, the chairman of the Subcommittee on Aviation and Space, said he plans to hold hearings on the matter, "to investigate these crashes, determine their contributing factors, and ensure that the United States aviation industry remains the safest in the world."
Sens. Elizabeth Warren, D-Mass., Dianne Feinstein, D-Calif., and Mitt Romney, R-Utah have also called on the FAA to ground the planes.
According to NPR White House Correspondent Scott Horsley, President Trump spoke to Boeing CEO Dennis Muilenburg on Tuesday. It's a sign of just how extreme the stakes are for one of the nation's most prominent companies.
In a pair of morning tweets, which came before the Trump's conversation with Boeing's CEO, the President weighed in on Ethiopian Airlines tragedy by lamenting that present-day planes are becoming "far too complex to fly. Pilots are no longer needed, but rather computer scientists from MIT."
The FAA said in its notice on Monday that as part of its "ongoing oversight activities" it expects Boeing to complete flight control system enhancements "which provide reduced reliance on procedures associated with required pilot memory items."
The FAA said it expects those updates sometime next month.
https://www.npr.org/2019/03/12/70279744 ... no-for-now
The inspector is ordering FAA to preserve documents at certain FAA offices.
Prosecutors, Transportation Department Scrutinize Development of Boeing’s 737 MAX
A grand jury’s subpoena seeks broad documents related to the jetliner
https://www.wsj.com/articles/faas-737-m ... 1552868400
Yeah, that is a huge story as well. Those Seattle reporters were on that story, seeking questions days (11, right?) before the Ethiopian 737 Max went down. The Seattle reporters were all over it and not getting answers! Must reading.
Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system
Dominic GatesUpdated March 17, 2019 at 12:06 pm
A worker is seen inside a Boeing 737 MAX 9 at the Renton plant. The circular sensor seen at bottom right measures the plane’s angle of attack, the angle between the airflow and the wing. This sensor on 737 MAX planes is under scrutiny as a possible cause of two recent fatal crashes.
(Mike Siegel / The Seattle Times)
Federal Aviation Administration managers pushed its engineers to delegate wide responsibility for assessing the safety of the 737 MAX to Boeing itself. But safety engineers familiar with the documents shared details that show the analysis included crucial flaws.
As Boeing hustled in 2015 to catch up to Airbus and certify its new 737 MAX, Federal Aviation Administration (FAA) managers pushed the agency’s safety engineers to delegate safety assessments to Boeing itself, and to speedily approve the resulting analysis.
But the original safety analysis that Boeing delivered to the FAA for a new flight control system on the MAX — a report used to certify the plane as safe to fly — had several crucial flaws.
That flight control system, called MCAS (Maneuvering Characteristics Augmentation System), is now under scrutiny after two crashes of the jet in less than five months resulted in Wednesday’s FAA order to ground the plane.
Current and former engineers directly involved with the evaluations or familiar with the document shared details of Boeing’s “System Safety Analysis” of MCAS, which The Seattle Times confirmed.
Most Read Business Stories
The safety analysis:
Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document.
Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward.
Assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed.
The people who spoke to The Seattle Times and shared details of the safety analysis all spoke on condition of anonymity to protect their jobs at the FAA and other aviation organizations.
Both Boeing and the FAA were informed of the specifics of this story and were asked for responses 11 days ago, before the second crash of a 737 MAX last Sunday.
Late Friday, the FAA said it followed its standard certification process on the MAX. Citing a busy week, a spokesman said the agency was “unable to delve into any detailed inquiries.”
Boeing responded Saturday with a statement that “the FAA considered the final configuration and operating parameters of MCAS during MAX certification, and concluded that it met all certification and regulatory requirements.”
Adding that it is “unable to comment … because of the ongoing investigation” into the crashes, Boeing did not respond directly to the detailed description of the flaws in MCAS certification, beyond saying that “there are some significant mischaracterizations.”
Several technical experts inside the FAA said October’s Lion Air crash, where the MCAS has been clearly implicated by investigators in Indonesia, is only the latest indicator that the agency’s delegation of airplane certification has gone too far, and that it’s inappropriate for Boeing employees to have so much authority over safety analyses of Boeing jets.
“We need to make sure the FAA is much more engaged in failure assessments and the assumptions that go into them,” said one FAA safety engineer.
Certifying a new flight control system
Going against a long Boeing tradition of giving the pilot complete control of the aircraft, the MAX’s new MCAS automatic flight control system was designed to act in the background, without pilot input.
It was needed because the MAX’s much larger engines had to be placed farther forward on the wing, changing the airframe’s aerodynamic lift.
Designed to activate automatically only in the extreme flight situation of a high-speed stall, this extra kick downward of the nose would make the plane feel the same to a pilot as the older-model 737s.
Boeing engineers authorized to work on behalf of the FAA developed the System Safety Analysis for MCAS, a document which in turn was shared with foreign air-safety regulators in Europe, Canada and elsewhere in the world.
The document, “developed to ensure the safe operation of the 737 MAX,” concluded that the system complied with all applicable FAA regulations.
Yet black box data retrieved after the Lion Air crash indicates that a single faulty sensor — a vane on the outside of the fuselage that measures the plane’s “angle of attack,” the angle between the airflow and the wing — triggered MCAS multiple times during the deadly flight, initiating a tug of war as the system repeatedly pushed the nose of the plane down and the pilots wrestled with the controls to pull it back up, before the final crash.
On Wednesday, when announcing the grounding of the 737 MAX, the FAA cited similarities in the flight trajectory of the Lion Air flight and the crash of Ethiopian Airlines Flight 302 last Sunday.
Investigators also found the Ethiopian plane’s jackscrew, a part that moves the horizontal tail of the aircraft, and it indicated that the jet’s horizontal tail was in an unusual position — with MCAS as one possible reason for that.
Investigators are working to determine if MCAS could be the cause of both crashes.
Boeing 737 MAX planes sit in a row last week behind the Renton plant on the south shore of Lake Washington. (Mike Siegel / The Seattle Times)
Boeing 737 MAX planes sit in a row last week behind the Renton plant on the south shore of Lake Washington. (Mike Siegel / The Seattle Times)
Delegated to Boeing
The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.
Early on in certification of the 737 MAX, the FAA safety engineering team divided up the technical assessments that would be delegated to Boeing versus those they considered more critical and would be retained within the FAA.
But several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing.
A former FAA safety engineer who was directly involved in certifying the MAX said that halfway through the certification process, “we were asked by management to re-evaluate what would be delegated. Management thought we had retained too much at the FAA.”
“There was constant pressure to re-evaluate our initial decisions,” the former engineer said. “And even after we had reassessed it … there was continued discussion by management about delegating even more items down to the Boeing Company.”
Even the work that was retained, such as reviewing technical documents provided by Boeing, was sometimes curtailed.
“There wasn’t a complete and proper review of the documents,” the former engineer added. “Review was rushed to reach certain certification dates.”
When time was too short for FAA technical staff to complete a review, sometimes managers either signed off on the documents themselves or delegated their review back to Boeing.
“The FAA managers, not the agency technical experts, have final authority on delegation,” the engineer said.
Inaccurate limit
In this atmosphere, the System Safety Analysis on MCAS, just one piece of the mountain of documents needed for certification, was delegated to Boeing.
The original Boeing document provided to the FAA included a description specifying a limit to how much the system could move the horizontal tail — a limit of 0.6 degrees, out of a physical maximum of just less than 5 degrees of nose-down movement.
That limit was later increased after flight tests showed that a more powerful movement of the tail was required to avert a high-speed stall, when the plane is in danger of losing lift and spiraling down.
The behavior of a plane in a high angle-of-attack stall is difficult to model in advance purely by analysis and so, as test pilots work through stall-recovery routines during flight tests on a new airplane, it’s not uncommon to tweak the control software to refine the jet’s performance.
After the Lion Air Flight 610 crash, Boeing for the first time provided to airlines details about MCAS. Boeing’s bulletin to the airlines stated that the limit of MCAS’s command was 2.5 degrees.
That number was new to FAA engineers who had seen 0.6 degrees in the safety assessment.
“The FAA believed the airplane was designed to the 0.6 limit, and that’s what the foreign regulatory authorities thought, too,” said an FAA engineer. “It makes a difference in your assessment of the hazard involved.”
The higher limit meant that each time MCAS was triggered, it caused a much greater movement of the tail than was specified in that original safety analysis document.
The former FAA safety engineer who worked on the MAX certification, and a former Boeing flight controls engineer who worked on the MAX as an authorized representative of the FAA, both said that such safety analyses are required to be updated to reflect the most accurate aircraft information following flight tests.
“The numbers should match whatever design was tested and fielded,” said the former FAA engineer.
But both said that sometimes agreements were made to update documents only at some later date.
“It’s possible the latest numbers wouldn’t be in there, as long as it was reviewed and they concluded the differences wouldn’t change the conclusions or the severity of the hazard assessment,” said the former Boeing flight controls engineer.
If the final safety analysis document was updated in parts, it certainly still contained the 0.6 limit in some places and the update was not widely communicated within the FAA technical evaluation team.
“None of the engineers were aware of a higher limit,” said a second current FAA engineer.
The discrepancy over this number is magnified by another element in the System Safety Analysis: The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight.
One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.”
“So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said.
Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.”
Swiveling the horizontal tail, which is technically called the stabilizer, to the end stop gives the airplane’s nose the maximum possible push downward.
“It had full authority to move the stabilizer the full amount,” Lemme said. “There was no need for that. Nobody should have agreed to giving it unlimited authority.”
On the Lion Air flight, when the MCAS pushed the jet’s nose down, the captain pulled it back up, using thumb switches on the control column. Still operating under the false angle-of-attack reading, MCAS kicked in each time to swivel the horizontal tail and push the nose down again.
The black box data released in the preliminary investigation report shows that after this cycle repeated 21 times, the plane’s captain ceded control to the first officer. As MCAS pushed the nose down two or three times more, the first officer responded with only two short flicks of the thumb switches.
At a limit of 2.5 degrees, two cycles of MCAS without correction would have been enough to reach the maximum nose-down effect.
In the final seconds, the black box data shows the captain resumed control and pulled back up with high force. But it was too late. The plane dived into the sea at more than 500 miles per hour.
Recovery work continues around the crater where the Ethiopian Airlines plane crashed shortly after takeoff last week near Bishoftu, southeast of Addis Ababa. Flight data analysis is yielding clues about the cause of the crash. (Yidnek Kirubel / The Associated Press)
Recovery work continues around the crater where the Ethiopian Airlines plane crashed shortly after takeoff last week near Bishoftu, southeast of Addis Ababa. Flight data analysis is yielding clues about the cause of the crash. (Yidnek Kirubel / The Associated Press)
System failed on a single sensor
The bottom line of Boeing’s System Safety Analysis with regard to MCAS was that, in normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.
In the case of an extreme maneuver, specifically when the plane is in a banked descending spiral, an activation of MCAS was classified as a “hazardous failure,” meaning that it could cause serious or fatal injuries to a small number of passengers. That’s still one level below a “catastrophic failure,” which represents the loss of the plane with multiple fatalities.
The former Boeing flight controls engineer who worked on the MAX’s certification on behalf of the FAA said that whether a system on a jet can rely on one sensor input, or must have two, is driven by the failure classification in the system safety analysis.
He said virtually all equipment on any commercial airplane, including the various sensors, is reliable enough to meet the “major failure” requirement, which is that the probability of a failure must be less than one in 100,000. Such systems are therefore typically allowed to rely on a single input sensor.
But when the consequences are assessed to be more severe, with a “hazardous failure” requirement demanding a more stringent probability of one in 10 million, then a system typically must have at least two separate input channels in case one goes wrong.
Boeing’s System Safety Analysis assessment that the MCAS failure would be “hazardous” troubles former flight controls engineer Lemme because the system is triggered by the reading from a single angle-of-attack sensor.
“A hazardous failure mode depending on a single sensor, I don’t think passes muster,” said Lemme.
Like all 737s, the MAX actually has two of the sensors, one on each side of the fuselage near the cockpit. But the MCAS was designed to take a reading from only one of them.
Lemme said Boeing could have designed the system to compare the readings from the two vanes, which would have indicated if one of them was way off.
Alternatively, the system could have been designed to check that the angle-of-attack reading was accurate while the plane was taxiing on the ground before takeoff, when the angle of attack should read zero.
“They could have designed a two-channel system. Or they could have tested the value of angle of attack on the ground,” said Lemme. “I don’t know why they didn’t.”
The black box data provided in the preliminary investigation report shows that readings from the two sensors differed by some 20 degrees not only throughout the flight but also while the airplane taxied on the ground before takeoff.
No training, no information
After the Lion Air crash, 737 MAX pilots around the world were notified about the existence of MCAS and what to do if the system is triggered inappropriately.
Boeing insists that the pilots on the Lion Air flight should have recognized that the horizontal stabilizer was moving uncommanded, and should have responded with a standard pilot checklist procedure to handle what’s called “stabilizer runaway.”
If they’d done so, the pilots would have hit cutoff switches and deactivated the automatic stabilizer movement.
Boeing has pointed out that the pilots flying the same plane on the day before the crash experienced similar behavior to Flight 610 and did exactly that: They threw the stabilizer cutoff switches, regained control and continued with the rest of the flight.
However, pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway, because that is defined as continuous uncommanded movement of the tail.
On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times.
In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled.
These differences certainly could have confused the Lion Air pilots as to what was going on.
Since MCAS was supposed to activate only in extreme circumstances far outside the normal flight envelope, Boeing decided that 737 pilots needed no extra training on the system — and indeed that they didn’t even need to know about it. It was not mentioned in their flight manuals.
That stance allowed the new jet to earn a common “type rating” with existing 737 models, allowing airlines to minimize training of pilots moving to the MAX.
Dennis Tajer, a spokesman for the Allied Pilots Association at American Airlines, said his training on moving from the old 737 NG model cockpit to the new 737 MAX consisted of little more than a one-hour session on an iPad, with no simulator training.
Minimizing MAX pilot transition training was an important cost saving for Boeing’s airline customers, a key selling point for the jet, which has racked up more than 5,000 orders.
The company’s website pitched the jet to airlines with a promise that “as you build your 737 MAX fleet, millions of dollars will be saved because of its commonality with the Next-Generation 737.”
In the aftermath of the crash, officials at the unions for both American and Southwest Airlines pilots criticized Boeing for providing no information about MCAS, or its possible malfunction, in the 737 MAX pilot manuals.
An FAA safety engineer said the lack of prior information could have been crucial in the Lion Air crash.
Boeing’s safety analysis of the system assumed that “the pilots would recognize what was happening as a runaway and cut off the switches,” said the engineer. “The assumptions in here are incorrect. The human factors were not properly evaluated.”
The cockpit of a grounded Lion Air 737 MAX 8 jet is seen at Soekarno-Hatta International Airport in Cengkareng, Indonesia, last week. The crash of an Ethiopian Airlines plane bore similarities to the Oct. 29 crash of a Lion Air plane, stoking concerns that a feature meant to make the upgraded MAX safer has actually made it harder to fly. (Dimas Ardian / Bloomberg)
The cockpit of a grounded Lion Air 737 MAX 8 jet is seen at Soekarno-Hatta International Airport in Cengkareng, Indonesia, last week. The crash of an Ethiopian Airlines plane bore similarities to the Oct. 29... (Dimas Ardian / Bloomberg) More
On Monday, before the grounding of the 737 MAX, Boeing outlined “a flight control software enhancement for the 737 MAX,” that it’s been developing since soon after the Lion Air crash.
According to a detailed FAA briefing to legislators, Boeing will change the MCAS software to give the system input from both angle-of-attack sensors.
It will also limit how much MCAS can move the horizontal tail in response to an erroneous signal. And when activated, the system will kick in only for one cycle, rather than multiple times.
Boeing also plans to update pilot training requirements and flight crew manuals to include MCAS.
These proposed changes mirror the critique made by the safety engineers in this story. They had spoken to The Seattle Times before the Ethiopian crash.
The FAA said it will mandate Boeing’s software fix in an airworthiness directive no later than April.
Facing legal actions brought by the families of those killed, Boeing will have to explain why those fixes were not part of the original system design. And the FAA will have to defend its certification of the system as safe.
Seven weeks after it rolled out of the paint hangar, Boeing’s first 737 MAX‚ the Spirit of Renton‚ flies for the first time Jan. 29, 2016, from Renton Municipal Airport. (Mike Siegel / The Seattle Times
https://www.seattletimes.com/business/b ... air-crash/
