March 19, 2019, © Leeham News: The impact of the grounding of the 737 MAX to Boeing will hurt, but the effect likely will be short term.
The most recent grounding of an airliner was the 2013 grounding of the 787. This cost Boeing an estimated $500m over the course of the three month grounding. A hardware fix had to be designed to contain battery fires. Installation in the field for 50 aircraft was required. Compensation to operators was necessary.
There are more than 370 MAXes grounded. Norwegian Airlines and Spice Jet already publicly said they will demand compensation. Deliveries are suspended.
This grounding should be much shorter than was the 787.
Boeing began work on a software upgrade to the MCAS stall recovery system shortly after the Lion Air crash pointed toward the system as a likely key contributor to the crash of a MAX 8 in October.
According to some reports, Boeing’s work was proceeding toward a January fix when the US government shut down, following Donald Trump reneging on a budget agreement. The government shut down, including the FAA.
After the Ethiopian Airlines MAX 8 crash this month, reports emerged that the shutdown delayed final development of the upgrade. The FAA denied these reports last week.
An investigation into the Ethiopian crash may clarify this dispute. Regardless, the upgrade may be ready by the end of this month, according to one media report. (Boeing hasn’t confirmed this.) It’s unclear if the FAA certification will be ready at the same time, or this will come in April. A week ago, the FAA said the upgrade will be mandated in April.
Reports indicate it will take an hour for airlines to download the upgrade.
Based on this, LNA sees grounding to be lifted upon the download, per airplane. When this begins remains to be seen, but LNA sees the groundings being up to six weeks at the outside.
The cost to Boeing is already being estimated by analysts.
Ken Herbert of Canaccord Genuity wrote in a note last week:
We see the financial risk for Boeing in three areas: 1) there is the direct expense of implementing the software upgrade that has been discussed; 2) there is the near term risk from delivery delays and progress payments on in-progress aircraft; and 3) there is the potential compensation for airlines and leasing companies for service disruptions. There is a risk around longer-term upside from the 737 MAX both from expected delivery rates above 57/month (potential backlog risk), and order activity (advances and backlog growth). But we do not expect better visibility, if any, on the longer-term impact for several months or even years.
Herbert goes on to write, “We believe the base cost for the software fix is ~$500M. Note that if the cause of the
two accidents is different, this cost could be substantially higher. We then see ~$1B in monthly FCF risk from the delays in deliveries. Specifically, we see about $260M as a result of not delivering the MAX aircraft, based on $8M in FCF per aircraft, and collection of $5M of this at the time of delivery (less advances already paid).
“The bigger potential impact here is if airlines stop paying advances on in-production.”
He sees a 6-8 week grounding.
Another analyst forecast a cost to Boeing of $550m over several years, including costs related to the grounding, lost revenue, compensation and lawsuits.
He also predicts a shift in revenue this year from the first and second quarters to later in the year due to delayed deliveries.
I think six to eight weeks is on the optimistic side.
What if the fix dont fix every issue with the stick force gradient and maybe behaviour in a developed stall? What if the reliability of the revised MCAS (AoA sensor disagree disables the MCAS?) is calculated to be too low? Other potential failures?
If this fix could be certified by Boeing/FAA the same way as before this debacle started, then yes, no problem. But we are not there anymore, now we are at the post Max crash era where there will be a LOT more scrutiny on the certification process at Boeing/FAA.
And then there are the other air traffic safety agencys, EASA and the chinese one. I am fairly sure that China will scrutiny every detail of this fix – as well as the underlying aerodynamic performance of the aircraft – before they will lift the ban in China. I think it is there the biggest risk for the Max lies.
Agreed, 6 weeks is way too optimistic.
There’s now a Department of Transport investigation in the 737MAX certification.
It would be astonishing if the FAA put the aircraft back into the sky with that investigation outstanding. The same article says that the Department of Justice has started issuing subpoenas and there’s a grand jury too…
And now that we all know that the MCAS system is electronically capable of putting the aircraft into a dangerous situation, a single piece of software alone is insufficient to guarantee that full nose down trim is not commanded. To avoid it being a safety critical piece of software there would have to be some other backstop (eg a couple of limit switches on the jack screw) to prevent the MCAS software, patched or not, correct or not, from doing that.
They cannot prove that the new software won’t do the same thing. All they can do with a single implementation of the software is demonstrate that it does what it’s supposed to do in tests. But what really matters for safety is proving a negative, which is nigh on impossible.
The importance of this is enhanced because were patched MCAS to apply full down trim (due to a bug) it would be causing the aircraft to behave in a way that the updated flight manual would explicitly say it shouldn’t. What hope then for the souls onboard?
I don’t expect the EASA or the Chinese to be satisfied with a software patch.
Oh and even if they did put MCAS limit switches on the jack screw, that’s not quite enough. If an aircraft developed a fault where the software went wrong and the limit switches where the only thing standing in the way of disaster, that couldn’t be allowed to fester unreported, unpatched. One day those limit switches will fail too.
@Matthew You are focused on the software. What if there were some kind of strange fault, perhaps an odd short circuit, that caused undesired stabilizer trim movements. A fault like that could potentially happen in any airliner. You seem to be assuming that the pilot can never be counted on to be a part of the safety system and to be able to recognize recoverable failure scenarios that they had never seen before. If that is the case, the overall aviation system is in far greater peril than you believe, since fail-safe aircraft do not exist.
Yes I am focused on the software because the best information available is that that’s all Boeing are planning on changing. That might be incorrect, they may be making more extensive changes.
Your point about failing switches is fair enough, except that it’s relatively easy to life, inspect, maintain and replace a switch. It’s routine, and it’s easy for a maintenance person to ensure that that aspect of the aircraft is safe. They can’t do that with software, other than verifying that the computer has passed its BIST and the right software is installed. If the software is wrong, they’ve no way of knowing. They rely on Boeing to say it’s correct.
Pilots are the final end-stop for safety, but as seems likely the relevant failure mode seems able to quickly overwhelm even forewarned pilots.
If the existence of that failure mode is purely down to software, and nothing else, then I’d say proving that the software *and its execution environment* cannot fail this way (ie drive the jack screw to full down trim quickly) is necessay, otherwise nothing has really changed. The probability may have reduced, but that’s unquantifiable, and the potential definitely remains. An unquantifiable improvement is likely not acceptable.
I am just trying to put your fears into perspective. No piece of software of any complexity can be proven correct. No manufacturer can prove that the flight control system of their airliners is without bugs or will never perform in an unplanned way. Still, they are flown everyday without a definitive way to quantify risk.
Moreover, there is a difference between software doing what it was designed to do and software doing what it was not designed to do. As far as we know, in the Boeing case, the software performed as it was designed and that the critical system element was hardware (likely improperly maintained hardware in at least one case) in the form of a failure of the angle of attack sensor. There may have been no failure in the actual performance of the software side of the system. The software elements that may be contributory factors to the accidents may have been in the human factor and other technical considerations that went into the policies of software design. That is a big step from saying the software itself failed in an unexpected fashion. A software upgrade reflecting new policy decisions would be the proper response to an understood problem.
My mentioning of an electrical fault was not so much in reference to this recent case, but to the overall aviation system and the role of pilots in it. The 737 is a classically stable aircraft that can be flown by hand. Pilots have the responsibility to understand how to strip the aircraft down to a basic, manual configuration when it is behaving in an undesired manner. In the case of Lion Air, reports indicate that the previous crew encountered a similar failure scenario and was able to manually fly the airplane, which demonstrates that the failure was recoverable.
While changes in design, software or otherwise, can help reduce risks, they can not eliminate risks. All parties that fly these airplanes need to take responsibility for their roles in it. Failure can come from anywhere, and not every failure can be planned for in a checklist or demonstrated in training. If an in-flight, recoverable failure occurs, you would hope and expect the pilots to land the airplane safely. If accidents are happening because pilots are not instinctively removing the authority of automated flight control systems in these jets, that should probably be a bigger concern for the traveling public than any correctable shortcomings in software design.
I think we can all agree that avoidance of automatically applied full down trim is a safety critical requirement – several hundred dead passengers / crew and two similar crashes seemingly says so.
The difficulty with saying software is software, airliners have flown with it for a long time is that overlooks the fact that Boeing’s MCAS implementation departs radically from the norms for safety critical systems. Therefore it cannot be considered from the same perspective, and it is improper to do so.
So far as I can see, MCAS’s implementation has no redundancy, no voting mechanism, nothing to guard against improper behaviour. And yet, astonishingly, it has full authority over a control surface, and will still do so after Boeing’s proposed software upgrade. With no redunancy, no voting mechanism, there’s nothing independently checking that the MCAS’s authority over the stab is not exceeding a specification.
And that’s it. It’s a safety critical requirement that the MCAS system’s authority is limited, but it’s purely down to a single implementation and execution of the software to deliver that limitation.
That is not normal. That’s how it has departed from the norms. It’s still, fundamentally, rotten.
Note that none of this depends on whether or not the software is being fed correct data or not. None of it is about whether the software is doing what it should do. It’s not about whether or not MCAS is an effective treatment for the high AOA handling characteristic.
It’s about proving that a system that can crash the aircraft won’t in fact do so, should something unexpected go wrong. Whilst that single execution of that single piece of software has full authority over that jack screw, it might.
I mention limit switches to disengage MCAS because they’re a very simple, very cheap, very easily analysed mechanism for meeting that requirement. If those switches disconnected MCAS from the jack screw when it had been moved a certain distance, then the quality of the MCAS implementation or the sensors feeding it is irrelevant to the safety certification of the aircraft.
Equally powerful would be a auto trim cut-off switch on the pilot’s control column, but that might be more expensive to fit.
It’s then trivial for every certification agency out there to understand, and easy for everyone to accept. Boeing seems to be in a position where, right now, that ease and triviality would be a good thing.
By going for just a software fix, they’re simply asking for more trouble from already deeply spooked certification agencies who are now very wary of botched software having sufficient authority to crash an aircraft, even if pilots are fully aware of its potential for doing so.
Hello again Justin,
Oh, and you referred to instinctive pilot reactions to faults they’re acquainted with. I don’t see how that instinct can be instilled into pilots if training, flight sims, certification, etc. don’t even mention the system that can exhibit a unique fault characteristic (as was the case right up to the Lion Air tragedy).
I don’t think that Boeing did themselves any favours by saying it should be handled the same as runaway trim; MCAS going wrong reportedly feels very different in the cockpit to classical runaway trim.
I think that by acknowledging that the software needs to be changed Boeing are heading into a world of pain; the type cert for pilots on 737MAX could readily end up being different to the NG, which would deeply annoy the airlines.
@Scott and @Bjorn, can the DoT prevent the FAA putting the 737MAX back into the sky?
@Matthew: Good question. FAA is part of DOT. I don’t know what the law allows WRT your specific question.
Given that the DoT is reported to be investigating the 737MAX certificaiton process, surely it would be a brave FAA manager to pretend that that’s *not* happening and put it back into the sky?
Can you imagine the fuss if the DoT doesn’t like what it finds, and grounds the 737MAX again? That then would make the subsequent compensation claim really, really messy. Boeing might (bravely?) make a case that this time it’s government that’s got things wrong, and that government had wasted Boeing’s time / money with misdirection?
If the DoT are on the ball they may very well foresee this outcome, and may prevent the FAA recertifying it in the next few weeks purely on that basis (currently we’re all blaming Boeing for the grounding – best keep it that way). There’s a lot of self-protection to be put in place – no one will want to take the ultimate blame for these tragedies and their implications – and if my rear was best protected by keeping that plane on the ground, I’d make sure that it stayed put. If I could. I’d certainly protest loudly and publicly if I couldn’t.
If US law works anything like it is does here in the UK, the government department would have a corporate responsibility for the actions of one of its agencies, no matter what the law specifically said. Basically, you own it, it’s your responsibility to make sure it’s fit for purpose.
I know that things are at least a little different in the US – for instance the FAA head is a presidential appointment, not a DoT appointment. Here it would simply be an advertised job, best candidate gets it.
FAA is an independent agency, with its own statutes, budget and its own Administrator appointed by President.
Technically the Administrator reports to the Transportation Secretary rather than the President, but I would doubt that gives much oversight.
It’ll be interesting to see how this one goes.
Presumably the DoT, which is part of the executive, wouldn’t just launch an investigation if that were contrary to the wishes to the presidential administration. Perhaps that’s an indicator of the lay of the land from this point onwards.
How often has a department said one thing and then turned around and said no we are not when the Ministration weighted in?
The only entity that has any ability to act outside the Trumpism is the DOJ.
The Grand Jury is the one to watch
Well and the Democrats on the Transpiration Oversight Committee.
The FAA reports to the Department of Transportation, which is a cabinet level position. Elaine Chao is the current Secretary of Transportation. She previously served in the Reagan, Bush 41 and Bush 43 administrations.
However, it’s the Office of Inspector General within the DOT that is investigating. Those offices are specifically designed to be completely independent and run internal investigations of each agency. Often, their reports are handed off to DOJ for criminal investigations.
As far as ties to the Trump administration, there have been complaints about the FAA’s credentialing process since the 90s and there was a previous Boeing investigation in 2012.
Trump entered office in 2017. This was long after the 737 Max series was approved by the FAA in 2015.
@Scott or @Bjorn, will the FAA keenly review the upgrade with a great deal of scrutiny? Or will the FAA stand on the sidelines and allow Boeing to self-certify the upgrade?
If the former is the case, does the FAA have the capability to judge whether the fix measures up? I recall reading in earlier articles that self-certification became the norm in the mid-2000s. This made me wonder if the myriad of FAA staff with domain expertise in various areas were made redundant?
Would the public feel at ease if EASA also reviewed?
The loss of confidence of the customer not booking flight ops by the max is accounted in loss revenues?
Any risk of lawsuits that could add to the cost?
And what about the flying public? If people try to avoid the aircraft for some time even after the fix, what impact might that have?
As on previous occasions, not all as dramatic as this situation, the question is again raised as to whether (the two big) regulators still have the expertise to effectively validate the type certification proposals submitted. The 787 battery story was the most high profile recent example of questionable certification and poor manufacturer judgement, the MAX issue may or may not be a parallel. More generally, most of those whose ability I respect who have tried working in both areas have decide they prefer the industry rather than the regulator.
Unfortunately there’s no real way of knowing for sure whether the regulators are up to scratch, until there’s a crash that can be attributed to a regulatory failure. For all we know EASA are too hands off but Airbus do a reliable job of it. That would be unsatisfactory, and unprovable. A second set of eyes on the certification process improves things, but those too are faliable.
What we’re observing in the self driving car sector is an attempt to avoid regulatory examination. Essentially they’re all gathering huge amounts of driving data, bunging it all into some machine learning algorithms, and then relying on crash statistics from test drives to prove their cars are safer than humans. It’s not working out very well. They’re no where near meeting their limited goals, and there’s a massive gulf between those goals and public perception of what a self driving general purpose car will be able to do. Funny old thing is that a simple piece of systems engineering could have told them all that before they spent all that money…
But it does illustrate the difficulty of fully understanding the safety of complex designs, such as modern airliners which seems to be as complex a system as we (as a species) can reasonably deal with. I don’t think we can go much further, without changing the risk profile some other way (eg unpiloted airliners have ejector seats for passengers…).
Another way to look at this is autmoation has not gone fare enough.
Why would you not feed all the air data into the computers?
Altimeter, VSI, Airspeed from all 3 sources, 2 (or 3 if on Airbus?) AOA, Attitude indicator.
Why in the case of AF447 would not not just shift to the carry through mode (or dealy the drop out of Full Control Law to Alternative 90 seconds (cruise and altitude Airspeed is only an issue if you make it one)
Boeing did something like that on the 787 (thank you Duke) with a a Gyro (GPS?)
Feed that in to.
The testing of the system will be more rigorous this time and might show a few other defects that need to be addressed.
EASA might demand flight testing with atificial induced erronious sensor outputs to see how the system works at flight tests at those high angles of attack for different, speed, altitude and c.g.
I don’t see it happening as fast as 6 weeks either.I don’t see other governing agency going thru it as fast as the first time. There will look at the fix a lot more and may ask for some fix of their own before they let it fly again.and who did the the certification on the US side the FAA or Boeing…….
I agree with the doubters, the FAA and US certification process has been shown to be highly flawed. China and Europe will not just give the FAA a “pass” on approval. Far more questions are going to be asked this time and rightly. The FAA has had 2 major certifications go bad recently, 787 and now MAX. Then the fact they delayed the call several days on grounding further stripped their credibility. These actions have really put US leadership of Aerospace at risk.
If the FAA is so toothless, how come they made Boeing put MCAS on the MAX? Or MCAS wasn’t required by the FAA, Boeing just put it on to decrease training? It would be interesting to see all the paperwork regarding the origin and evolution of MCAS.
This was what they were SUPPOSED TO FOLLOW…
14 CFR 23.672 – Stability augmentation and automatic and power-operated systems
§ 23.672 Stability augmentation and automatic and power-operated systems.
If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with § 23.671 and the following:
(a) A warning, which is clearly distinguishable to the pilot under expected flight conditions without requiring the pilot’s attention, must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system that could result in an unsafe condition if the pilot was not aware of the failure. Warning systems must not activate the control system.
(b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures without requiring exceptional pilot skill or strength, by either the deactivation of the system or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.
(c) It must be shown that, after any single failure of the stability augmentation system or any other automatic or power-operated system –
(1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;
(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configuration) that is described in the Airplane Flight Manual (AFM); and
(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.
[Doc. No. 26269, 58 FR 42164, Aug. 6, 1993]
Is the 11 billion the production payments for two months production of about 100 737s? Is that list price, or if typical discounts, maybe 6 billion?
Why is there no discussion regarding reliability of the failed AOA sensor or it’s supposed redundancy that would most likely have initiated these 2 events? No one has said the MCAS began to to operate without cause.
I have raised it repeatedly.
It is a key issue, as is the speed issue report in the Lion Air crash and suspect in this one.
MCAS clearly needed to be fixed but its also not the whole story, some go off on stability tangents without udne4rstaind what really is involved.
It’s just as likely to be something else, e.g. the wiring to the sensor. If its Resolver, which is the best I know at present, there’s lots of room for hard to diagnose wiring mistakes and faults.
Yea, huge questions that no one has answered yet.
It could be something like a wire touch to gro9und if its a current limited system.
I seem to recall the 737 Pitot could be hooked up wrong and the heaters on the Pitot not work or indicate it had failed. Why in the world would you allow that?
And why Air Speed issues in both case? (I believe that is correct reported for Ethiopian)
from WSJ today
By Andrew Tangel,
Andy Pasztor and
Updated March 18, 2019 11:38 a.m. ET
Federal prosecutors and Department of Transportation officials are scrutinizing the development of Boeing Co.’s BA -2.30% 737 MAX jetliners, according to people familiar with the matter, unusual inquiries that come amid probes of regulators’ safety approvals of the new plane.
A grand jury in Washington, D.C., issued a broad subpoena dated March 11 to at least one person involved in the 737 MAX’s development, seeking related documents, including correspondence, emails and other messages, one of these people said. The subpoena, with a prosecutor from the Justice Department’s criminal division listed as a contact, sought documents to be handed over later this month.’
Suspect more subpoenas will be coming for a few Boeing types and a few FAA types
I saw that and if it happens that would be a new one.
They have my full support. It might be rated as 3rd degree (negligent homicide) but at 350 people that could put some people in the cross bar hotel for life.
Keep in mind this is not an emotional law, each type of murder has levels you have to reach or exceed to convict.
Clearly there was no intent (1 and 2)
It certainly is a new one. This is the kind of thing that starts happening when something has gone very badly wrong. It’s a natural reaction by the even higher-ups to show that they’re doing their job in making sure that the lower-downs are doing their jobs properly, or finding out why they didn’t when something has gone wrong. Basically, making sure the consequences don’t float too high up the political hierarchy.
It’s this unprecedented direction of events that I think makes it very unclear as to when, or even if, the MAX is going to get its certificate of airworthiness back. We literally have no idea how this will go, or who it will suck in.
One thing I think we can be certain of is that, having assumed authority over the normal course of events involving a grounded aircraft type, the last thing the DOT or DOJ will do is permit anyone to fly it until all the questions are fully answered and all the actions carried out, if any. If they were to let it fly, and there were yet another crash, guess whose fault that’d be?
If it has no other issues I don’t think either can stop it.
Its a legally certified aircraft and unless there is a smoking gun suddenly, while they can review and make Boeing test and prove…..
Boeing can fly it in the meantime unless or until there is evidence otherwise.
I don’t see any slowdown (how many investigations is Trump undergoing and it may be years before he goes to jail.)
Trump will be the first one to tell DOT to approve it and then the other AHJ will decide based on legally and treaty what to do.
Its not their job to assess a 3rd degree murder charge(s) – its their job to assess if its safe.
Boeing will also be taking a (presumably temporary) big cashflow hit as they continue to build and store aircraft for delivery once the restriction is lifted.
Just rough ballpark figures if we assume Cost of goods sold for a MAX averages $50 million and they are producing 50 per month, that is $2.5 billion in cash per month being eaten up producing planes that can’t be sold.
The money (less interest and any storage cost) will eventually come back to Boeing assuming they are able to eventually deliver the inventory.
I believe that is the 11 billion dollar hit that moves down stream that was mentioned.
The situation has changed.
– The FAA with Boeing approving a software fix is not good enough anymore. The MAX certification process is now subject of investigation.
– MCAS & pitch stability needs to be looked at & re-certified in terms of total system interaction, including human factors. No isolated software fix.
– If the CAAC and/or EASA and/or CAA express doubts about any fix, no airline / pilot / FA or passenger is willing to fly the MAX. Two terrible crashes of fully certified, safe aircraft have made FAA “a” authority, not “the” on the MAX.
As bad as this is it will follow the norms and it will be back soon.
There is no proof that any other aspect was at issue (agreed its open)
The reality is that the world won’t wait, neither Airbus nor Boeing can make all the single aisles the world needs.
Thats why the Tylenol Ref falls flat.
All sorts of ways to get the same stuff J&J offered, aircraft are not the same as pills.
Airlines will take a tech reasoned look at this and not emotional and pick up where they left off.
I guess the estimates missed out the cancellation of firm order and potential order. Kenya said they are going to order something else instead of MAX already while Lion Air seems to stand at better position than few month ago on cancellation.
I agree 6 weeks. They have been working on the software for close to 5 months now.
The certification documents/data/reasoning are all there to go over and see if anything else but I doubt it.
I have a question about the flight characteristics of the 737 Max — in everyday use separate from the two catastrophic MCAS failures . . . .
Does the 737 Max have a tendency to stall during normal takeoff procedures? And when aircraft generate a legitimate and accurate STALL WARNING in the cockpit during flight, are those events recorded? I’d be very interested in what the accurate STALL WARNING statistics/per takeoff are on a variety of aircraft, including the base 737, 737 NG and 737 Max.
No it does not.
Still is at an extreme edge of the envelope. You have to realy force it to do that.
There are also a voice stall warning and the yoke shakes as you are at the edge of a stall.
There are no stall warnings on a 737 takeoff unless the AOA is wonky. The the Pilot Flying side is only involved if its on his side.
A new written software is useless if MCAS relies only on a single AoA-sensor. It needs a new hardware and three independent sensors which are constantly monitored. If one fails or is out of tolerance, it will be shut off and an alarm occurs. The two remaining sensors are much safer than only a single one and sufficient until the end of flight. In the MAX they may have saved the days and 346 souls.
That’s the philosophy in bigger power plants. In Germany we call it two-of-three-choice. Steam pressures of 200 bar, 530 °C and 1000 tons/h are not a child game. I spent many years of my life in that business. It would be good if plane manufacturers would be teachable, look over the edge of the plate and change to the state of the art.
I am a frequent flyer and increasingly distrustful when I watch the extremely computerized airplane electronics. The only purpose is to use less experienced pilots and to save money. In these days I prefer Airbus, although they also had made bad mistakes (instrumentation flaws A330, AF 447, tragic pilot errors ).
If you read up on the proposal for MCA correction (fix) it has multiple proposal.
Also, the 737 is simply a dual computer system, not a 3 computer system like the Airbus, so it has a different logic to it (quite a bit acualy)
The Fix has both AOA feedintin ito the MCAS softaere
It also has a limit on how often (once) the MCAS can acgive
It also has a limit on how far the MCAS can move the stailized
It also has a AOA disagreement light
I don’t know if its just a light or the display.
Both of those were options
Lion Air had a AOA disagreement on taxi but they did not have (maybe did not even know) it was an option or why they would need it.
My take is why they also do not feed airspeed int thsi )all 3 and why they do not have the Attitude Indicator Nose as well as VSI involved in the logic.
Airbus has done the same dive when 2 out of the 3 AOA (I think they have 3) went wonkers.
That is the real issue, it has nothing to do with aircraft as much as software, complexity and what it does when it is out of its program limits (turns it over to pilots who had not been flying really in a long time)
I call it he Mounds Almond Joy Candy Bar syndrome from a US add.
Sometimes I feel like a nut and sometimes I don’t.
the Airbus system is triple redundant, the current MAX system has single points of failure, which is pretty terrible. I think the single intervention is a mistake, I am not sure of the time window, I think multiple intervetions are ok, but the real death blow (literally) is the 2.5 degree creep per intervention. It leads the pilot to feel he can countermand the system…until he suddenly cannot. Then its over. Horrific and mind boggling logic.
Mark: The MCAS has a single point of failure based on a risk analysis. The entire air4fr is assessed on that (as are all others)
Airbus has to use triple because there is no mechaniol backups
737 has mechanical backups.
In that case its a dual logic with two different teams writing software to two different computers.
The code is not the same, how it works is.
You can argue all 737s should never leave the ground again based on that but legally they are certified and allowed.
The only aspect the regulators can change is how a given sub system is typed.
In this case they failed to assess it at what it was.
Boeing may have lied to them or covered it up and they did not catch it in the data.
It does not mean the 737 sans MCAS is not safe, it has as good a record as the A320 prior to this.
If Boeing satisfied the correct requirement and meets the terms, they have to let it back in the air.
There is no reasonable reasons currently to think it won’t be.
If they uncover other issues in the investigation then they can ground it again.
Try to do so and Boeing will sue and win.
No shutdown for the BEA.
“The Ethiopian accident investigation bureau has left @BEA_Aero after 3 days of coordinated technical work with our investigators and 1 day of debriefing.”
“Data from the FDR and CVR of flight ET302 of 10/03/19 has been transfered to the Ethiopian Accident Investigation Bureau by BEA as part of the investigation process.
The Ethiopian Accident Investigation Bureau « extends its deep appreciation to the BEA and the French Authorities for their cooperation and support in recovering the FDR and CVR data. »
As part of the recovery process, correct data extraction from both the FDR and CVR was verified by the Ethiopian Accident Investigation Bureau, BEA and NTSB. During the verification process of the FDR data, clear similarities were noted by the investigation team between Ethiopian Airlines Flight 302 and Lion Air Flight 610, which will be the subject of further study during the investigation.
BEA wishes to thank the Ethiopian Accident Investigation Bureau and the Ethiopian authorities as well for their trust.
The Ethiopian Accident Investigation Bureau intends to release a preliminary report within 30 days.”
Following the earlier Seatle times article, which stated that the MAX behaviour did not follow that stated by Boeing in their submission (essentially saying they lied to get it through ) it would be no surprise for a major authority to push back on Boeing and demand evidence for every claim made to support their airworthiness certificate. They may also rule as mentioned above that with further evidence that Boeing’s fix is not quite enough, just one such claim could put service entry back months
The safety of aviation has undeniably improved over the past few decades, largely thanks to the careful introduction of automated pilot assistance. It has, however, created a situation where some crashes probably shouldn’t happen, but they do (like these ones).
Done *properly*, automation assistance should do nothing to make the plane more dangerous than if it weren’t there, no matter how it goes wrong. Basically it should hand back controls to the pilot, with the aircraft benignly configured, allowing them to land it just like it was the good old days. Your safely shouldn’t depend on correct operation of the automated systems.
However, your safety should be improved if the automatics do work correctly, which is pretty much what the stats show.
Can it go too far? Well there’s plenty of discussion concerning AF447 in other forums.
Mathew: I don’t think careful introduction is remotely right.
The aiframers independently decide on what whiz bang features they want and then the put it in.
The AHJ is always behind that curve.
Boeing messed up Auto Throttle is a case in point.
In the now FLCH Trap, as a result of another mode change, it is taken off line entirley.
Airbus keeps it active (very nice) if it approaches stall speed and the ground.
In the case of the Asian 777 crash, gross negligence by two other pilots supposedly monitoring a much less experienced pilot on large aircraft (whose career was formerly Airbus)
The NTSB cited Boeing and told them it needed to be changed.
Boeing refused to do so and the FAA would not make them.
Now we are getting to the meat and potatoes of the issue. They all knew it and sat by.
Independent review works to the benefit of all.
Any AHJ that has not raised this with their government is complicit.
Boeing is a [edited] company that, aided and abetted by the FAA, put profit before safety. As a result, 346 people died. Mothers, fathers, brothers, sisters.
These two crashes occurred in uninhabited areas, but close to the airports that they departed from. Imagine if these crashes had happened to an aeroplane departing from an airport in a heavily urban area? New York, Heathrow? A crash into a school, a hospital.
Let us hope that some good comes from this: A better funded completely independent FAA, or, as others have said, a completely independent international certification agency. And, better leadership at Boeing that understands that it has moral obligations to more than it’s shareholders.
I think that might actually happen.
This is the first time I have seen the publicly high enough for change to take place
I am still skeptical, once its past the main news cycle will it continue?
PR wise Boeing is being grossly stupid no matter how they really feel.
Work force has got to be depressed. You work hard and put out good work just to be undone by nit noid cost cutting
You talking months not weeks for the global airlines and airworthiness agencies to buy in on the “fix” (software, hardware and new backup redundant systems). I think the world’s view of a 56 minute IPAD pilot training to qualify to move from 737 to a Max is going to cause the global fleet of Maxs to require real simulator training….that will take time and money!
“Some pilots said they did not know the MCAS system existed until after the Lion Air crash.
“It blew us away. It absolutely shocked us,” said Dennis Tajer, an American Airlines Boeing 737 pilot an a spokesman for the airline’s union, the Allied Pilots Association.
Switching from previous models of the 737 to the 737 Max entailed a 56-minute iPad training session, Tajer said. The FAA did not require additional training under the certification of the plane.”
Canada has said it will review max certification independently and new SW will be independently certified vs Canada accepting FAA cert. A huge blow in prestige to the FAA when Canada has always accepted FAA cert in the past.
Here is the bilateral agreement: https://www.tc.gc.ca/eng/civilaviation/standards/int-baa-usa-2000-3676.htm
Scott: Thank you.
“Any disagreement regarding the interpretation or application of this Agreement or its Implementation Procedures shall be resolved by consultation between the Contracting Parties or their civil aviation authorities, respectively. ”
As I expected there is a vehicle to disagree.
Technically it may wind up a standoff.
Bring in the Publicity and its amazing how fast the nit noid changes to full cooperation.
We had the Fire Department cite the city on a serious Building Code violation. City response was the code does not apply to us.
Fire Department simply went to the local newspaper and they listed the violation, why it was really an extremely important life safety issue (stairwell egress) and the fact their hands were tied.
The City could not change the contract quickly enough to correct the violations.
I suspect all it took was a word in the right ear after that for any other items that needed correction.
I don’t see much change at Boeing leadership. No humbleness, subtle diverting away from it’s own responsibility, buying time. Telling how good we are.
It’s same guy standing 100% behind the 737MAX, calling the prez when the writing was on the wall for everybody.
Here is the newslink
I think the external communication advisers of Muilenburg should alter tactics, or have Dennis listen to them.
“Boeing has been in the business of aviation safety for more than 100 years, and we’ll continue providing the best products, training and support to our global airline customers and pilots.”
Please, people are burying their loved ones & telling how great and dedicated you are is inappropriate self praising, showing a double agenda.
The public has a short memory, but not this short.. https://www.politico.com/story/2019/03/12/boeing-ceo-trump-737-max-safe-1218439
I’m not calling arrogant, but there seems to be some slow assessment in Chicago of the real situation.
keejse: I would have no disagreement with arrogant, callous is another good term for it.
When I made a mistake as a kid, I was taught to fess up, apologize and not repeat it.
That has worked well in my latter life quite well.
Boeing should admit it made a major mistake, apologize and then work to correct how it got to be the way it did.
They are doing nothing other than leaving a history long rotten reputations (justified) on what the company stands for (or doesn’t)
They can make clear they will financially compensate the living for their dead relations and be extremely generous in doing so. It won’t bring them back but it will allow them to not be devastated financially over it (they can live some kind of a life)
I suspect they will quibble and pay the minimum.
Per FlightGlobal, Air Canada has pulled the MAX from the schedule until July. Obviously they could rework the schedule if Canadian authorities lift the grounding sooner, but they aren’t being too optimistic, it seems.
I think they have to be pessimistic vs optimist.
Also it will take some time to get the pilots trained and the aircraft fed back into the system.
As there was a warning light on AOA disagreement involved in the so called OPTIONS, that is in play to be needed and (installed? ) or wired up.
note: of course Boeing was not telling anyone what would happen if you had that light and pulled up the flaps!
Right. It is horrifying to think that, if I’m reading it correctly, reconfiguring back to just flaps 1 would have stopped the MCAS (if it in fact was behaving as designed).
We don’t yet know the Egyptian circumstances, but if it is the case, as has been suggested by preliminary data, that retracting to clean flaps was the start of the loss of authority/control, moving to flaps 1 / 190 knots as part of circling back to land might have saved the day.
We don’t know, of course. But the utter lack of willingness to think through scenarios and train pilots other than the short iPad course after the Lion Air disaster seems mighty shortsighted.
I believe you meant Ethiopian not Egyptian? (and no I am not good at typos but that one I have seen in a major paper as well?)
Indonesia it did stop when they put flaps back down.
I don’t know there are words that describe Boeing’s actions and FAA allowance of them.
Short sighted is being unbelievably kind, Criminal seems to be the closest.
Oy, yes I made an error in my haste. Ethiopia was of course what I meant.
And as I noted, all treaties and agreements aside, when the stuff hits the fan, then agencies will act and no one will try to challenge them (well Trump might but once he goes down in flames the end result is still the same)
What people fail to understand, its not the laws, its the people belief and willingness to go by the laws.
If all ignore them, then laws are nothing more than words.
If the majority of a nation refuses to comply, then the nations leadership gets thrown out no matter how the documents say it should or should not happen.
For the most part it never gets there, but this clearly is a case where the AHJ’s can, will and should do whats needed.
And this is likely the end result though it was MCAS that pushed pilots into overload, so there is an issue with software that does that without any questions. You would hope the pilots are good enough to overcome it, we have seen two out of 4 flights they did not.
And this would be funny if not so tragic a result
Yes they used the process, which is not the same as using it correctly (or you can say it was subverted).
Have to love the spin masters.
Oh, well the process said that it was level 2 not level 1 criticality. The fact that Boeing pushed if not more for level 2 and the FAA agree or pushed its people to allow that? Just part of the process.
Some more clarity or not.
For those who wonder why Ethopia wanted other than FAA/NTSB to examine flight data, the self serving Boeing statement by CEO and his ( IMHO ) unethical request to Trump/FAA to NOT ground 737MAX – the attached/linked pdf file should open a few eyes. I’m sure the responsible brass in most countries are well aware of what Airbus/France did years ago. I sincerely hope that procedures put in place since then will prevent the same /similar game. from even being tried when ity comes to who is responsible . .
For a more complete story re airbus I’ve listed the wiki story, the pilot story and the airbus response below
This is the crash of the first FBW Airbus
This is the claim of tampering, etc
This is the later airbus response
hopefully the 737MAX game avoids this !
Note reading the airbus response as found on wiki and shown above- I note that zip nada is said about different flight recorders re position of reflective stripes-
per old meme – the ‘proof is left to the student- reader ‘
Good news video to watch…pilots mentioned they want input in the Max approval process and simulator training
Good news video mentions Canada will not the allow the Max to be used until July 2019
The Lion air crash was criminal negligence. The Ethopian crash was manslaughter. Knowing what happened on Lion Air, its pretty clear Boeing should have made a quick change to MCAS to limit its reboot cycle and its range to 2.5 degree. The escelation is really problematic.
Agreed at minimum Lion Air was criminal negligence, but I think 3rd degree murder is arguably due to the push back on a system that could overwhelm pilot control.
Ethiopian is simply clear 3rd degree murder (which I think in the US has replace manslaughter)
Doing a big of looking and the correct in the US would be Criminally Negligent Manslaughter.
Forcing a safety evaluator to the wrong category would certainly fall under negligent.
Who it gets applied to Boeing or FAA is unknown, it depends on what level the decision was made at.
Or if you can prove it was moved to the top levels.
And lookee here, suddenly wallah, a new administer proposed for the FAA
Do you think some pointed questions will be asked?
Delta not having any 737MAX on order.
Looks like the DOT is auditing the FAA certification
I think this puts the China shutdown in context. They can legitimately claim it was based on safety, despite the fact its loaded with political relevance as well.
they can always walk it back, or force a split.
They were late to the order party and there is openings for 919 if it has to compete with itself its a equal trade off.
The Chinese authorities early on banned the MAX They said they had for months being requesting specific questions about MCAS after the LionAir crash. They say they did not receive useful feed-back from Boeing / FAA. After repeated questioning and when Ethiopian MAX crashed and similairities became clear very early, they could take no risk and took action.
Some Press channels trying to dismiss it as political, probably have their own agenda. Apparently it hurts to see the Chinese had it right & Boeing and the FAA did not have right.
737 Rudder Issue: It would be instructive to know that Boeing was allowed almost 4 years to get the 737 Rudder fix into place.
How did they do that?
Simply by training pilot on how to handle it.
Works every time.
“They’re critical, and cost almost nothing for the airlines to install,” Bjorn Fehrm, an analyst at the aviation consultancy Leeham, told the Times. “Boeing charges for them because it can. But they’re vital for safety.”