Leeham News and Analysis
There's more to real news than a news release.
Leeham News and Analysis
- Boeing unlikely to meet FAA’s 90-day deadline for new safety program April 18, 2024
- Focus on quality not slowing innovation, says GKN April 18, 2024
- Boeing defends 787, 777 against whistleblower charges April 17, 2024
- Dissecting Boeing CEO’s statement next new airplane will cost $50bn April 15, 2024
- Bjorn’s Corner: New engine development. Part 3. Propulsive efficiency April 12, 2024
FAA: No MAX certification until 2020; analysis forecast 15 more crashes if MCAS not fixed
Dec. 11, 2019, © Leeham News: A new round of Congressional Hearings about the Boeing 737 MAX got underway today.
FAA Administrator Stephen Dickson, testifying today before the US House Transportation Committee in a hearing about the Boeing 737 MAX.
Before the hearing began at the House Transportation Committee, FAA Administrator Steve Dickson appeared on CNBC today. Among his statements: recertification of the MAX will slip to 2020, confirming what had become apparent for some time.
“Like I said there are a number of processes, milestones, that have to be completed,” Dickson said in an interview on “Squawk Box.” “If you just do the math, it’s going to extend into 2020,” he told CNBC.
- Transcript of CNBC interview: CNBC Dickson transcript 121119
House Hearing
At the House hearing today, Dickson said the FAA is not delegating any authority to Boeing to recertify the MAX.
He said certification flight test needs to be performed; the Joint Operations Evaluations Board needs to complete its process; and the Technical Advisory Board, which is providing an independent technical review, still has work to do. Dickson said he won’t sign off until he flies the airplane.
- Dickson’s statement to the House Transportation Committee: Dickson Written Testimony 121119.
Matt Kiefer, a member of the TAB, says there are “action items” that must be “closed.” He said the changes to MCAS are sound.
Peter Defazio, the chairman of the House Transportation Committee, said an FAA analysis following the Lion Air accident but before the Ethiopian Airlines crash concluded there would be 15 fatal MAX accidents if there was no fix to MCAS. DeFazio asked Dickson why wasn’t airplane grounded then? He did not have an answer.
See also the Wall Street Journal article today on this forecast.
Dickson said the safety system “is not broken,” but there was inadequate communications and failures in certifying the MAX.
The hearing continues live, here. (Posted 11am EST, Dec. 11.)
I m very curious about the their estimation method. Did they assumed 1 crash per 320 aircraft delivered?
They may have based it on the probability of an in-flight AoA failure, which could either be based on the MTBF for the sensors (about 93,000 hours, with typical 100,000 hour airframe life), or the historical rate of about 1.5 per year, over the last 17 years, with roughly 8 to 10 million 737 flights per year.
If we look at the NG airframe life, the typical life is about of quarter of that isn’t it? Based on current quality control across Boeing, I’d say achieving the NG lifecycle will be optimistic.
I was quoting Peter Lemme’s site, and his analysis of the AoA sensor failure. If the maximum life of a 737 is 60,000 cycles and a typical flight is 2 to 4 hours, the lower bound would be about 120,000 hours.
Obviously that varies a lot depending on the service routes of the individual airframe. This data is always subject to generalities, it describes the fleet population in general but not individual airframes.
Crashes tend to be accounted in “per flight hour” or “per cycle”. ( you can crash a a frame only once 🙂
but riddle me this:
“DeFazio asked Dickson why wasn’t airplane grounded then? He did not have an answer.”
together with this:
“Dickson said the safety system “is not broken,” but there was inadequate communications and failures in certifying the MAX.”
The system may not be broken but links in the chain are and unless those are fixed, you don’t have a functioning sytem.
Focus on just on the MCAS and what they are doing to deal with it misses what MCAS revealed, that is clearly an ability of Boeing to arm twist through a piece tech garbage (be it hardware ala batteries or the MCAS software )
Its not just going back to a former system, that also did not work.
Its reforming the system so it can’t occur period. Seattle FAA regional needs to be brought into FAA nationwide and a detachment form a buddy buddy relationship with Boeing to a professional one.
It may have worked at one time due to the professionalism of the Boeing engineers and the power they had, that is no longer true and it never is the best practice regardless.
It is well worth reading the early Boeing 707 on history to understand how far the FAA has alwyas been behind.
@TransWorld – maybe Boeing can “arm twist” the FAA (doubt that’s happening now) however there is NO way Boeing will be able to “arm twist” any other federal regulator (Europe, China, etc.).
IMHO the B737MAX will be the most scrutinized plane in history before entry into service.
US administration is already ramping up political pressure all around. Guess why the feisty WTO “we are so hurt, that must cost gobs of money” thing is kicked off now.
This will be a protracted political war campaign from the US and not a sensible change towards an improvement.
I am trying to understand how come there is so Little outrage over this Admission that they had evaluated another 15 accidents over the aircrafts lifetime and with this Information, still did not immediately ground the MAX after the second Crash.
Jacobin777,
I don’t doubt you are correct about the MAX will be the most scrutinized airplane in history bevor ist re-entry into Service.
On the other Hand, I do believe Boeing has had an unhealthy influence over FAA related decisions over the last decade.
Your Assertion that Boeing cannot arm Twist other federal aviation Regulators is correct but does not take into account that These Regulators had up until now, taken a more “back seat” Approach to programmes under FAA authourity. Not that they showed no interest, all Regulators have certain issues that they try to Keep under control, especially as far as interiors, emergency Exits, lighting and so forth are concerned.
But up until now, it was understood and assumed that the FAA was in control of the Situation.
As you have indirectly stated, that is no longer the case.
What sort of Impact this will have going Forward will be most interesting?
Will there be tit for tat? Will other Regulators be found to be also as lax in their duties? Will their be politics involved?
The answer to the last one could almost already be yes, at least judging by some of the comments of the People here in other Posts.
TW, given that past failures with MAX certification means that being seen to do it absolutely by the book in future is of utmost importance if trust is to be restored, one way of demonstrating that is changes such as you suggest.
For the FAA too this is important. The likes of EASA, CAAC have in effect said they no longer trust the FAA to do its job adequately. For Boeing, that could mean designing and certifying under the auspices of the EASA alone could be cheaper than under the FAA and EASA separately (I’m assuming that the FAA would accept an EASA certification of a Boeing product…). If that’s the way things went, what purpose then is the FAA serving? None, really.
For me the FAA needs to demonstrate to the world that it has reformed itself as much as Boeing needs to demonstrate that it has reformed itself too and embraces a more challenging certification burden. Not answering questions like “why wasn’t it grounded when your own analysis suggested there’d be more crashes?” isn’t a good start for the FAA.
I don’t believe there is any mechanism for an American company (Boeing or not) to certify another EASA, Japan etc.
Brazil might be an interesting study.
Boeing will have to certify under the FAA (if they ever com out with a new aircraft) and then we see what the rest of the world does. )
Anything from lip service to actual checks.
As this is a moving situation if the FAA gets its act together it may resume the previous agreements.
I believe no one should get a slam dunk acceptance and I think there is a middle ground.
“FAA Administrator Steve Dickson didn’t have an answer” ??????
“Dickson said the safety system “is not broken,” ”
If it’s not broken then I don’t know what is.
Maybe just pretty badly dented.
Sort of like a “written-off” car.
Quite PR symantics for me: System is not broken (hurraaa) , it’s ONLY not functioning (hush hush).
“Peter Defazio, the chairman of the House Transportation Committee, said an FAA analysis following the Lion Air accident but before the Ethiopian Airlines crash concluded there would be 15 fatal MAX accidents if there was no fix to MCAS. DeFazio asked Dickson why wasn’t airplane grounded then? He did not have an answer.”
Wow. How did that analysis not set off alarm bells at the FAA? It makes you wonder whether FAA had become the industry’s captive.
I suspect that was over the lifetime of the MAX airframes, which might be 30 to 40 years. Thus they did not expect another accident to occur before the MCAS solution was in place. The rollout of the fix was delayed by the government shutdown. Boeing says 5 weeks, FAA says it wasn’t that long. But in retrospect that seems especially tragic.
The probability of another in-flight AoA sensor failure within 90 days was 1 in 22 million, using the most conservative numbers. Some estimate it at more than 1 in 100 million. So it was not a likely event.
I think they also felt that making pilots aware of MCAS and reviewing the checklist would greatly mitigate the risk, but that was not the case with the Ethiopian flight.
The fact is, even after Lion Air, Boeing did not provide the correct recovery method. It was wron and depended on manual trim. It should have been –
revert to 30% power, activate min flaps use electric trim to trim plane, land plane. Kiss the ground on disembarking.
If you knew some event would occur once in the next five years, isn’t the probability that it will occur in the next three months 1 in 20?
Ted, in order to get to that risk level, requires millions of flights. So to assign a flight risk, it’s viewed as either per hour of flight time or per flight cycle. Those are the most applicable methods. The statistics I gave were per flight. So 1 in 15 million for a given year, 1 in 22 million for 90 days. But those numbers can shift up & down according to the estimates used.
Also to calculate probability that a second event will happen in a given time frame for a given occurrence rate, you actually start with the probability that it won’t happen for given period, say 1 day, then multiply those together to get the probability that it won’t happen for 90 days, then subtract from 1 to get the probability that it will happen in 90 days.
That method appropriately scales the probability that a second event will happen, from being very small for the very next flight, to being certain at a large enough number of flights.
It is probable that all this probabilty calculating is just so much theoretical nonsense that should be thrown out the window as soon as one accident occurs.
The fact is that playing the probability game cost lives.
The more damning fact is that the FAA had to be forced into grounding the MAX only after pretty well every other Regulator had already done so.
Aero, it’s pretty unfair to say they gambled with lives, or that they murdered people as someone else here said. It’s not common for another accident to occur after pilots have been advised of a possible control issue. FAA actions were consistent with many prior actions after accidents or upsets. Grounding is an extreme action, used only a handful of times.
In hindsight and after some very improbable events, we can say they should have acted differently. But that was not apparent at the time.
Also just to clarify, the chairman of JATR commended the FAA for waiting to see the data before making the grounding decision. He stressed the importance of making data-driven decisions, especially when responding to an emotionally charged situation. Even if they were personally outraged and wanted to act, they had to verify first.
The story that Trump forced them came from Trump, who is renowned for bombastic claims about his own importance. America does a collective eye-roll at many of his similar statements.
“In a statement issued after Trump’s remarks, the FAA said the administration was reversing course based on “the data gathering process and new evidence collected at the site.”
I think Twain’s quote sort of applies here, there are three kind of lies, lies, damn lies, and statistics. Because is it really appropriate to pick a number that is acceptable for a crash?
But decisions are based on data. If the probabilility of a fleetwide crash in 90 days is determined by qualified satisticians, what is the acceptable probability number to keep flying? 1 in a 100, 1 in a 1000? Who picks that number, the FAA, Congress? There’s a hot potato.
Ted, I don’t think they pick a number. Instead they look at the circumstances and try to take the most prudent actions they can at that moment, with the information they have available, and with the assumption of more complete analysis and possibly additional action to follow on later.
Immediately after Lion Air, they knew that MCAS had falsely activated due to AoA sensor failure, that the captain had trimmed against and maintained control, then handed control to the first officer who didn’t maintain that control. At that point, none of the design or regulatory failings of MCAS were known.
So they released a bulletin that tried to correct the problems they knew. They reminded pilots of the procedure needed to deal with un-commanded trim. And they directed Boeing to make corrections to MCAS to remove the single-sensor dependency and add bounds. Boeing agreed and scheduled the software update for early spring.
All the subsequent information about MCAS, did not come out until after the Ethiopian crash. The response then was to ground the aircraft, because they saw MCAS was again involved, and something more might be going on. That turned out to be true, in spades, so they have not ungrounded the MAX, and won’t until they are satisfied the design and testing process has been done correctly.
@Rob, December 12, 2019
“Aero, it’s pretty unfair to say they gambled with lives, or that they murdered people as someone else here said.”
Boeing’s behavior shows all the aspects of accepting a fatal outcome on profit grounds.
* Deciding on a flawed design.
* Carefully creating an argument path that hides this being intentional.
* Hiding MCAS and thus the design flaws from view and thus frustrating any outside introspection into their deed.
* Significantly increasing MCAS “reach through” in a further level of secrecy
* smear campaigns against both crews and operators.
* giving false witness on reasons for design decisions around the MAX.
IMU this shows all the aspects of accepting a crash, certain death for crew and pax for “personal” gains. Obviously the US “scot free environment” for corporations …
Uwe, the “they ” in my comments was meant to be the FAA, not Boeing. They acted on the basis of what they knew after the Lion Air crash. They calculated the probability of another A0A sensor failure, if no action was taken. Then they took actions to mitigate the risk, consistent with what they knew at that time
It’s easy in hindsight to blame them, to say they should have known, or done more, given what we know now. By the same argument, it’s easy to blame the pilots, to find fault in their actions, given what we know now. But we refrain from that because we recognize it isn’t fair.
With regard to Boeing, they certainly are far more culpable, in terms of what they knew, but we don’t know what their motivations were. I don’t think they made the cold calculation that it was cheaper to kill people than to increase the quality of their product.
I’ve seen a staggering level of corporate incompetence in my career. There’s an expression known as Hanlon’s razor:
“Never attribute to malice that which can be adequately explained by stupidity.”
Also I think Kruger-Dunning theory may have played a role as well:
“Cognitive bias in which people mistakenly assess their ability as greater than it is.”
Taken together, these resulted in confirmation bias as the major cause:
“The tendency to interpret or favor information in a way that affirms one’s prior beliefs or hypotheses.”
In other words, with MCAS they saw what they wanted to see (the benefit) and ignored what they didn’t want to see (the hazard). And they justified this by their inflated notion of their own abilities (we don’t need to check).
Kruger-Dunning found that people of high ability are highly aware of complexity, and thus constantly worry they might be wrong, then check and double-check their work. People of lower ability are more likely to be unaware of complexity, have complete confidence in their ability, and not check their work.
So much so, in fact, that a reluctance to check your work can be a rough indicator of true knowledge and ability. And it becomes reinforcing because without checking your work, you don’t find your own mistakes, hence your confidence is bolstered.
If the above has become ingrained in the culture at Boeing, especially in the management, that is a huge problem. Hopefully the cost of the whole fiasco (both human and financial) will wake them up. They should be keenly aware of their mistakes now.
So that is my view, anyway. I don’t think any more than this was necessary to explain the faults at Boeing. I realize many here will disagree.
“The fact is that playing the probability game cost lives.”
AeroNinja
Probability game is in everything engineering related. And with aviation even more due to limited engine power, weight limits…
example: 4 engines or 2 engines for transatlantic flight?
Rob, if that’s the way they were thinking, 15 incidents in 40 years, then they were gravely and, tragically, demonstrably naive.
Whilst the stats might suggest an acceptable average incident rate over 30, 40 years, analyses of this sort cannot guarantee that they will occur evenly spaced, or that it won’t be 30 crashes, or only 5.
The people looking after the EC135 helicopter certification made a similar mistake in my opinion. They got the gearbox inspection rate down to once per flight for “safe operation”. Whatever analysis they did would have to have had error bars. That’d mean sometimes the gearbox could fall to bits after only 0.5 flights, which is exactly what happened.
Yes, it’s true that random events can occur at any time. But it’s quite normal to assume that they won’t, and instead assess risk based on statistics and probability.
Also, they didn’t believe that an AoA failure with MCAS engagement, was an automatic crash, since the pilots have a large element of control. But as it happened, both accidents essentially became an automatic crash, with MCAS driving the stabilizer full deflection.
Sadly real MAX rate was closer to 1 crash per 3.000.000 hrs if I counted well superficially – 6 months * 30 days * 350 aircrafts * 20 hours * factor 2 because they were flying before. So those 15 crashes in 20 years span was a wishful thinking.
It only shows how irresponsable is to make statistical assumptions when something is really badly made. Statistics needs stability to be accountable.
That is (again) wishful thinking.
MAX numbers ramped up from zero in / 05/2017
to 120 around 05/2018. ( having accumulated 120khours )
see: https://en.wikipedia.org/wiki/Boeing_737_MAX#Introduction
deliveries continued till march 11 to a total of 387.
I’d be surprised if more than an equivalent of 120 frames were available over those 22 month.
at the date of the global rounding accumulated hours probably did not exceeded 600k hours.
simplistic: one crash per 300k hours.
That is ten times the probability you have floated.
the FAA calculation seems to have taken the full order book, lifetime flying _AND_ fully_ informed crew … resulting in 15 further crashes.
Average flight time is about 2 – 4 hours for 737’s. So at 3,000,000 hours, that would be every 1,000,000 flights.
That rate seems way too high, that would be about one in-flight failure per month, or 12 per year. The historical rate has been about 1.5 per year, over about 8 to 10 million flights per year.
Also an in-flight failure does not automatically mean a crash. As we saw in Lion Air 610, it depended on which pilot was flying.
I’m sure they thought that issuing the MCAS directive would substantially lower the risk, but unfortunately it didn’t, a different set of circumstances occurred in the Ethiopian flight.
I went through the numbers in the FAA risk analysis to understand them. You can find them here: https://twitter.com/javierirastorza/status/1205518896922550274?s=19,
I guess you might have seen that after the comments you wrote, but yes, they took that 1 crash per 370k FH.
” Thus they did not expect another accident to occur before the MCAS solution was in place.”
Do we know what Boeing’s original “MCAS solution” (before the Ethiopian crash) was?
I think similar to the MCAS 2.0 we see now. Perhaps not as robust or detailed, as all the scrutiny has since mandated.
The tragedy of the whole thing is that such simple changes would have erased a great deal of risk. Like bounding the inputs and outputs, which is basic programming for a controls engineer. I believe that alone would have prevented the accidents. MCAS would have ignored the bad AoA data as unrealistic, and/or limited the output to 2.5 degrees of deflection, which is recoverable with elevator. You might have an upset but no crash.
Rob,
This comment of yours, in contrast with your others on the risk analysis, illustrates what good engineers are generally good at: designing robust systems. They are, however, bad at building accurate statistical models of risk (which are hard to extremely hard to build for complex systems). When engineers create safe systems, it’s not because of some statistical model. It’s due to throwing multipliers in there, and using sound judgement, etc.
There is no way that the FAA’s analysis, which relies on pre-determined probability distributions in a spreadsheet, could have produced a useful result. With made-up numbers plugged in as parameters (e.g., 0.01 Pr of fatal pilot error mitigating erroneous MCAS activation) the result is basically GIGO. I’m surprised that the number, 15 over the life of the model, shocks people here. And FAA practitioners surely thought they were reducing the specific risk by 100x or 1000x. They probably figured that it was going to move in line with the NG numbers overall (7 fatal crashes 1993-2017). The trouble is, they had absolutely no idea how to assess the likelihood of the next 37Max crash. They also lacked the data to do so (since even the simulator work did not replicate the full event – alarms, stick shaker, etc. – and there was no random sample of pilots tested).
To further complicate matters, it utterly lacks rigor to look at the average AoA failure over many years. Batches matter, as you know well, I’m sure. A repaired AoA sensor is not the same as a new one, etc. So there is plenty of error there to propagate.
The botched “statistical” analysis that they did distracted them from using their engineering minds to think hard about the problem. Dennis Muilenburg says that if they’d known then what they know now, they would have grounded the plane after Lion Air and Peter Lemme asked (paraphrasing) what have they learned that they could not have known then? An engineer currently at Boeing told me that he considered the analysis inside the company after Lion Air to have been an utter failure. It was not done well, but then a 7 sigma event just happened or something like that.
Not good enough?
“Do we know what Boeing’s original “MCAS solution” (before the Ethiopian crash) was?”
Press Release: “Pilot Error. case closed.”
Seems to have been upheld for quite some time
even after the ET crash.
Presumably the FAA communicated these statistics to the other national authorities so that they could decide if this was an acceptable risk? Maybe they told them immediately after the second crash when they were trying to decide whether to ground?
The odds of an accident are way to complicated for someone like me to work out, but they must have been no where near the usual hundreds of thousands or millions to one
Grubbie, the odds of the first sensor failure were about 1 in 15 million. The odds of a second occurring within 90 days were 1 in 22 million. But as has been pointed out here, if it’s a truly random event, it can happen at any time. So statistics are meaningful over a large sample size, but each individual sample is still vulnerable. It might have happened on the very next flight, or it might not have happened for 6 months to a year. No way to tell.
Also the above number can go up or down depending on estimates made. The Boeing guys got 1 in 100 million. I tried to be conservative.
Ya, 15.373 not 15. The fact that a report would show those extra decimals to me just shows the safety process is lost in the weeds and missing the big picture.
Agreed. Even rounding it up to 16 is wrong. The fact that the number was > 0, or even > 1 should have been a clue…
Wow!! so the FAA has just admitted it could have saved those people and chose not to act. The first crash was bad, the second one was murder.
Front page article on the WSJ web site.
Check it out.
Ouch!
What a debacle. BA like IBM a while back are a good case study on what not to do. FAA is tarnished for sure. Internal FAA studies said one crash crash within 2-3 years after the first crash… and no grounding?
Ouch!
One crash per 12,000,000 flights? Doesn’t sound quite so bad, about the same as winning the lottery.
Winning the lottery along with your family and 150 poor barstards.
Odds of winning Mega Millions and Power Ball are 175,000,000 to one.
In Europe, Eurojackpot has odds of 95,000,000 to one and Euromillions 140,000,000 to one.
In other words, you would have crashed 14,6 times on average before winning Mega Millions, and you would have still crashed 7,9 times on average before winning Eurojackpot.
Not odds I would go for, to be honest.
Also, there hadn’t been anywhere close to 12m MAX flights before two crashes occurred, so the 12m odds are off by quite a lot.
Actually the odds are correct, but as others have pointed out here, the random nature of the event means it can happen at any time. The probabilities and statistics only describe the likelihood within a large sample population. But each individual sample remains vulnerable.
No, the odds are computed for “a known caveat/defect.
1 crash with MCAS and its “special” fallout being an unknown.
1 crash with (very) half assed misdirecting knowledge.
All inside 4..600k flight hours.
FAA computation was done for a known dangerous design aspect.
This is clearly going to be very uncomfortable for both Boeing and the FAA.
To add to that discomfort, I hear from a reliable chum that Airbus have kicked off a programme to develop a new single aisle aircraft, certification some 10+ years away. So whilst Airbus is forging ahead with a new programme, Boeing / FAA are still justifying – unconvincingly so far – that they know what it takes to be able to properly build a safe aircraft.
If my chum’s reliability holds good, that underlines the point that today’s MAX customers are buying into an obsolete platform and have expensive re-training costs coming up. Worse, had they swapped to, say, Airbus 10 years ago, the number of pilots to retrain would have been smaller then than it will be in 10 years from now (assuming their fleets and therefore pilot cadre continues to grow).
Wow that is some scoop from your contacts. Airbus is studying a new single aisle product someday to replace the neo.
Gone back and checked, wrong end of stick grasped. Probably not true. Apologies all.
EASA in full control.
This will take a looong time.
I wonder when Boeing will stop production.
Without replacing the complete management nothing will change.
TAB, will they be handcuffed too? Elwell should …
Does certification grandfathering (a term that I think has its origins in American slavery) exist for other companies and agencies in other countries?
Is Boeing defrauding investors? Is the continued production of the Max a sham?
I once knew a retired French Air Force general who was part of the French accident investigation team. I think a 747 had just crashed because of some problem with a valve transferring fuel between the wings. I asked him about the crash. One thing I remember is that he said: we know these things almost right away. I wonder how much has been known by certification engineers and accident investigators about the Max. It came out in the EASA power point and the JATR report, I think. But there has been a lot of PR smoke blown that obfuscates what seems to be clear to engineers.
Has Boeing honestly been so radically incorrect on its Return to Service estimates?
Boeing shares up
I think what he meant is that at least one prime factor is almost immediately identified (e.g. MCAS and single AoA reading) but they still do a complete Investigation to ensure what other factors (there are always multiple factors) were involved have been identified, analyzed and categorized.
Just curious,
What are the chances of an airplane crashing on any given day?
I’m pretty sure insurer have some type of numbers, no?
Winning the lottery along with your family and 150 poor barstards.
In 2018 there were 0.39 crashes for every million flights (commercial aviation).
https://theblogbyjavier.com/2019/01/02/aviation-safety-evolution-2018-update/
Well, this seams appropriate. Friends, and all those who appreciate logic…
A) We can find four stances regarding the MAX’s stability:
a) “thinking that MAX is” unstable
b) having moderate/strong suspicions that MAX is unstable
c) having moderate/strong suspicions that MAX is stable
d) having “settled” that it is stable
Note that only A.a) and A.d) express certainty, but are also mutually exclusive as are A.b) and A.c). Speaking for myself and as I began to approach this from a more informed point of view, I fit in position strong b). There may be those that are neutral but we can skip that stance.
B) Before going further in this logic exercise, lets keep the simple intuition that stability is the ability for an aircraft to return to its trimmed regime (AoA and airspeed) after being affected by any disturbance (it balances itself out). But lets suspend the technical discussion regarding the concept and agree that static stability is defined authoritatively in CFR part 25:
C) It simply follows that for one to assert objectively about the stability of an aircraft, one needs only to observe dispositions in §§25.173 through 25.177 and to know the results of the tests from the section §25.175 Demonstration of static longitudinal stability, and in addition prove compliance with §§25.671 and 25.672.
D) Lets also agree that those tests are a requirement, having failed the tests an aircraft can’t be said to comply with defined static stability. One cannot state any aircraft or rock is longitudinally stable until those tests are made and turn positive. IMPORTANT – it establishes the onus being on the claim of stability, not on otherwise. ie. by convention an aircraft is as stable as a ballistic rock until proven otherwise!
E) FORMAL facts granted:
1) Only flight tests provide certainty either way.
2) Only Boeing had access to the results of the full batch of certifying tests (with and without MCAS).
3) FAA/EASA/Regulators only had access to partial results of tests (with MCAS only).
4) Only FAA/EASA/Regulators can technically validate the tests and formally emit the certification, in this order.
5) Technical Experts/Flight enthusiasts/Public had no access to any test results at all.
I invite anyone to dispute any of the above.
———————————————————
Conclusion 1: Only Boeing can claim technically that MAX without MCAS is longitudinally stable because of E.2). No one else can.
Conclusion 2: The Regulators can’t claim neither technically, neither formally that MAX without MCAS is longitudinally stable because of E.3). Not even Boeing because of E.4).
Conclusion 3: Everyone else in E.5) is required to consider MAX as stable as a ballistic rock, because of Conclusion 2. This includes members of any opinion group A.a), A.b), A.c) and A.d): Technically because of E.2) – only Boeing has seen the full batch of tests. And Formally because of D) – demonstration onus on stability claim lies on Boeing.
———————————————————
Nevertheless we see many members of group 5) claiming certainty. Mike, independently of his expertise, on this forum, just put himself on that group claiming A.d), which is a position not authorized if submitting to the convention CFR Part 25. Bjorn also as an expert, despite his assurances I believe, is more on group A.c) along with other participants in this forum, ie. Rob and TW, which have expressed doubt. Several others find themselves in group A.b) expressing several degrees of doubt, ie. Richard Davenport, Pablo, myself. I can’t find examples of group A.a), Philip, does show an increased level of certainty, which I attribute to his expertise, and he claims as deductive ability, but not to an absolute degree, making him member of group A.b)
Do notice we don’t even need to bring MCAS and its complexity to the table to claim with certainty that Boeing 737 MAX IS NOT Longitudinally Stable, in fact that position is required formally by one submitting to CFR Part 25. If this was not materially true, MAX would be enjoying its certification and happily flying.
==================================================
==================================================
If we do touch MCAS, aattempting a view on the technical side…
F) TECHNICAL qualitative/quantitative facts in public domain:
1) Stability must be considered both at an Aerodynamic and Pilot Control level, it is highly influenced by Pitch/AoA and Airspeed – suitable stability and control feel (static stability) (from CFR 25 – §25.171)
1.a) The speed must return to within 10 to 7.5 per cent of trim speed after stick “disturbs” pitch and is slowly relaxed depending on flight regime test conducted. (§25.173)
1.b) A set ratio between stick force versus speed exists amounting to 1 pound for each 6 knots. (§25.173)
(from §§25.671 and 25.672)
2) Stability Augmentation systems:
2.a) Affect Pilot handling Control FEEL (pounds / knots per second) (ie. EFS – Elevator Feel Shift – Elevator)
2.b) Affect Aircraft direct Control SURFACES (deceleration knots per second) (ie. STS – Speed Trim System – Stabiliser)
2.c) Are ultimately invoked at any speed under several flight regimes in corners of the flight envelope before a STALL becomes imminent (identification/prevention systems)
2.d) Must show “by analysis, tests, or both”
2.e) Must consider Gusts and Turbulence Loads
2.f) Upon failure/malfunction of flight control system and surfaces (including trim, lift, drag, and feel systems) allow safe control at any speed and altitude at least within a practical operational flight envelope
2.g) “The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing” (cited in full)
2.h) Provide warning, permit counteraction
3) Manoeuvering Characteristics Augmentation System (MCAS) as an Augmentation system:
3.a) Constitutes a novelty, certified for the first time with MAX (only used elsewhere in one also recent military craft)
3.b) Only weaker authority version was certified compared with the final delivered (0.6deg instead of final full 2.5deg)
3.c) Acts directly on the Stabiliser with higher rate of movement at 0.27deg/sec (compared with STS or Manual Electric Trim at 0.2/sec)
3.d) Is introduced in addition to, not in place of existing system STS (with which it is hardly integrated with, moderated or bounded by)
3.e) FCOM Pilot flight manual contains no mentioned or explanation system function (aside of its acronym)
3.f) Acts when autopilot is OFF, flaps up, depending on STALL limit AoA angles (lacking AoA indicator installed by default)
3.g) Acts on both AoA and Mach data (AoA being retrieved from a single sensor (schedule of which is unknown to pilots)
3.h) Removed two of the fail-safes available to the pilot associated with similar STS (Column Switch CUTOFF, STAB CUTOUT Manual/Auto separation)
I invite anyone to dispute any of the above, keeping in mind that 1) and 2) are mostly paraphrases of CFR Part 25, and 3) are commonly undisputed facts mostly revealed within official reports, Lion Air Accident and JATR.
———————————————————
Observation 1: Attempts at characterizing MCAS as a mere control FEEL system unrelated with eventual/imminent STALL for the effect of diminishing its importance on Static Longitudinal Stability are immediately defeated by 1), 2.a) 2.f). FEEL systems are augmentation systems intimately related with Pitch/AoA and Airspeed and subsequently with STALL antecipation/prevention. Sorry Boeing PR.
Observation 2: MCAS is provided with the highest order authority inherent to the Stabiliser versus Elevator Control Surfaces, invalidating the notion that this choice is made to maintain Pilot’s attributed Elevator authority (to somehow preserve Boeing control philosophy). Elevator which could only be disauthorized by the Stabiliser when working in inverted directions, see 1.b) – Weak Pilot Elevator ANU effect with high forces vs Stronger Stab MCAS AND effect with added speed. Sorry Rob.
Conclusion 4: B737 MAX-8’s MCAS is essential for its static stability. This is undisputable, at least formally, but also technically, given the relative importance of its control authority versus equivalent systems on the model it replaces (B737-800), which should at least be indicative of the magnitude of the issue it is addressing, again: static longitudinal stability. If not, notice the incremental authority with respect to points 1.b), 2.h), 3.b), 3.c), 3.d), 3.e), 3.f), 3.g) and finaly 3.h).
Question 1: If one is not disputing the aplication of CFR part 25, given these Observations and Conclusions, how can anyone aside of Boeing officials, be confident that B737 MAX-8 without MCAS will not lead to other fatal accidents, eventuality now explained not by the malfunction of the cure (MCAS) but by the treated disease (insufficient static stability)?
==================================================
==================================================
Notice also that I haven’t yet touched the ugly stuff:
– Blaming Pilot training, a proper one which Boeing itself denied access
– Nov 2018 AD, calling for runaway trim stabiliser NNC, when Boeing must have known it would hardly provide assurances to prevent a repeat of the tragedy
– Certification process with numerous flaws, concidently overlaping areas with respect to critical information revealing the impact of MCAS
– Misrepresentation in Boeing’s engineering simulator of MCAS effect of Control Feel forces
Question 2: How can anyone trust a single word out of Boeing’s PR?
Requirement 1: The Regulator must act on behalf of the flying public as is its institutional mandate in order to assert the compliance of Boeing’s 737 MAX series as a safe aircraft models.
https://www.ecfr.gov/cgi-bin/text-idx?SID=ecb2e3dad3e9735727894fffc46441fe&mc=true&node=pt14.1.25&rgn=div5
I agree that the MAX must comply with those rules.
It is generally agreed that MCAS is needed to do so. It is an augmentation system not a stall prevention system. Does it break any rules as an augmentation system? MCAS on the KC-46 is not in question, right? As far as removing MCAS as suggested by the Canadian official, the MAX would be out of compliance with the rules. Was he suggesting an exemption for that area from the rules? That seems like a risky precedent to me. The NTSB guys in the podcast said MCAS being developed to counter the larger engines was a myth. I thought that was the conventional wisdom. I’m thinking barring any other theories, it’s the engines.
My personal theory is that possibly the 767-200, 737-600, 737-700 could have been out of compliance in extreme AOA areas, and needed MCAS. Break out the data, and let’s see their performance in that realm of flight.
MCAS will die, other hardware is needed to fix the problems. EASA already mentioned a transitional time till a 3rd AoA sensor is added. Transitional time for the MAX-8 and -9, I think new certifications for MAX-7, -10 and -8200 might ask for it from the start. And then there are other problems, rudder cables, control column forces, stab jackscrew, elevator usage.
It might effect the KC-46 too. Don’t expect it being allowed into EU airspace.
Vasco, this is a very thorough and detailed refutation of the “MAX is stable” view, regarding most aspects of MAX flight characteristics. It basically revolves around your contention that MAX stability has not been proven in terms of the regulations, and that until it is, it must be presumed unstable.
We cannot argue against that because none of us know the details or status of the certification. Therefore we cannot prove the positive that the MAX is stable, by your definition. We are left to prove the negative that the MAX is not unstable, which we cannot do because negatives are difficult or impossible to prove.
Two columns ago, I pointed out how this was a common tactic being used in these forums. If we assert a positive (the MAX is stable), for which we try to offer reasoning & evidence, it’s thrown back at us as a negative (prove the MAX is not unstable), which we cannot do.
The appropriate action for your view, is to prove your own positive (the MAX is unstable). Offer evidence that it is, for us to consider. Here you have only said it must be assumed. I’m not aware of any evidence that it is. All the arguments that have been offered, have been shown to be unsupported or logically inconsistent.
So we are left with an argument that can’t be resolved, and can only be resolved by the regulators, by your definition. We also would accept that resolution coming from the regulators, under the presumption that they are applying similar or higher rational and logical standards to ours.
So in the absence of that resolution, we can only gather a preponderance of the circumstantial evidence available to us, to see if that evidence is consistent with one side or the other. I know you won’t accept this evidence, but it’s all we can do at present.
Here are some examples:
1. If the regulators have suspicions about stability or compliance with regulations, that should become evident in the 1,850 hours of flight testing, the 1,200 hours of sim testing, the 240 hours of regulator testing, that have been completed thus far, with more yet to come.
2. None of the involved agencies would be shy about identifying MAX instability publicly, or outing Boeing if that were the case. There has never been a certified unstable commercial airliner.
3. Thus far no regulator has raised concerns about basic stability, yet we are near the end of the recertification process, after 9 months of review.
4. Nor did any of the investigation groups or reports raise the basic stability of the aircraft as an issue.
5. Nor did any of the pilots on the many thousands of completed MAX commercial flights, raise this as an issue.
6. Nor have any of the testing pilots, who now number from countries around the world, and are not all in Boeing’s employ, but have now flown the MAX either in flights or sims, raised this as an issue.
7. The bulk of reporting indicates that the recertification process is progressing, with a number of delays due to sub-process completion tasks. Both FAA and EASA have signaled they expect recertification but are not yet committed, and will not be hurried along by Boeing.
So if basic stability truly is an issue, it’s extremely well concealed, such that unprecedented and intensive scrutiny have not flushed it out yet. But we remain vigilant for evidence to the contrary.
Bjorn, Mike, myself, and others have tried to put together a reasoned sequence of logic, based on the physics of the aircraft and the information that we know, combined with experience and common sense, to explain what the problem was with the MAX, and to show that MCAS was a reasonable solution.
If people disagree that’s perfectly fine. I think all of us remain open to new facts or arguments. If a regulator tomorrow came out with clear evidence that an instability exists, or a significant flaw in MCAS 2.0, we all might change our positions.
W1th regard to your specific arguments:
Part B Stability Regulations: all circumstantial evidence points to the fact that the MAX is stable in all regimes of flight, as required. For the high AoA condition, that MCAS was meant to address, the aircraft does not have the un-augmented stability margin that is desired, it would not meet the regulations without augmentation, or so we have been told, and other information we have is consistent with that. Also that MCAS is, in the majority view, a viable augmentation method, but one that requires careful testing and scrutiny. But there are also dissenting voices that need to be heard.
Part E.2 and E.3 are unsupported. They are the basis of the notion that EASA will test and find all the problems that Boeing and FAA have concealed. But the reporting is that they have seen that data, have flown some tests, and wish to either verify or establish their own test points. It’s difficult to believe that access to this data could have been withheld for 9 months, or not have been one of the first questions asked. You would, I would, why wouldn’t they?
The MCAS section: all good points with regard to criticism of the design and implementation of MCAS 1.0. But then the observations and conclusions introduce subjective opinions, and also apply them to MCAS 2.0, which is not valid.
Observation 1 – MCAS as Stall Prevention: this is a debatable area with valid viewpoints on both sides. JATR acknowledged this by saying they could not rule out the possibility that MCAS was stall prevention. They did not say that MCAS was stall prevention, because they saw the ambiguity. You have chosen a side, which JATR did not do, and that’s perfectly fine, but please recognize it is a subjective choice on your part.
Observation 2 – Stabilizer has Higher Inherent Authority than Elevator, therefore MCAS has Higher Inherent Authority than Pilot: I would agree this was true for MCAS 1.0, due to programming errors. It should not be true for MCAS 2.0. The stabilizer is a more powerful surface than the elevator, however numerous systems are provided for pilot to override it. Therefore it’s always under the control of the pilot, and the pilot retains full authority. Moreover the authority of MCAS 2.0 is limited so that the elevator will remain the more powerful surface.
Questions 1 & 2 – Confidence in Boeing: (see below)
Requirement 1 – Importance of Regulator in Establishing Compliance: miraculously we are in full agreement on this one, and it also provides the answers to Questions 1 & 2 above. Confidence in Boeing can only be established by the regulators signaling that their work is fully compliant and up to standards. Regulators are the only parties who have access to full information, have full knowledge of the law & regulations, and sufficient expertise to make that determination.
I would like to ad some other kind of logic here.
If indeed EASA had flown the MAX with MCAS switched off with no negative findings – why would Boeing not use such a positive result to restore some public confidence in their product? Maybe they would even have the MAX re-certified without MCAS.
I have not heard or seen anything about such test flights. The last I’ve seen is that EASA has been very public about Boeing not complying with their demands. Here is the press release from September: https://www.easa.europa.eu/newsroom-and-events/press-releases/statement-clarification
It includes this passage:
“Aircraft longitudinal stability is subject to airworthiness requirements. Boeing has to demonstrate compliance of the 737 MAX airframe with these requirements. Consequences of failures of systems affecting potentially the aircraft stability need to be assessed using acceptable safety analysis methodology also subject to airworthiness requirements. Pilot training requirements are not meant to compensate for non-acceptable design on the compliance and safety standpoint.”
Since there is no further press release we must assume that Boeing has A) not fulfilled EASAs demand for this week of test flights or B) the test failed.
Since September ample time has passed to repeat such a test several times. But my conclusion is that Boeing is avoiding this test as it would establish once and for all that the MAX in its current shape is not airworthy.
EASA’s flight testing was scheduled long ago for mid December. In the meantime Boeing failed to provide the software audit. I think EASA is waiting for this audit first. I expect mistakes found in the audit or the audit itself is of poor quality. This delays everything further.
Vasco provided lots of regulations that the MAX needs to follow during flight testing. With Boeing certifying 96% of the work itself I’m very sure that following regulations wasn’t needed. That’s why the MAX won’t be certified in this version.
Leon, some regulations are dependent on assessments and classifications with respect to safety. I suspect Boeing intentionally engaged in “regulation engineering” in order to avoid having to comply with parts of the regulation. Best example of which is the instance mentioned by Peter Lemme but also referred to in the JATR:
Gundolf, Boeing cannot comment on the findings of the regulators, only the regulators can speak to that. Boeing is bound by being subject to the regulator authority.
Boeing has made some very general statements about how much testing has taken place, but nothing specific and nothing about the relative success or failure of those tests.
The regulators have not said very much because they don’t wish to bias or alter or compromise their process. It needs reach completion before results are released.
I think a lot has been read into the lack of information. in terms of what it implies. We only have periodic interviews with regulators and they don’t say that much, except what their future plans are.
In terms of the EASA statement you referenced, that was part of the September presentation of what EASA would require for RTS. Boeing has been responsive to that, they don’t really have any choice.
FAA and EASA have signaled they want to stand together so as to not fragment the world on air transportation. So Boeing cannot cooperate with FAA but ignore or dismiss EASA. At this point they have to satisfy everyone.
Jim Marko’s email suggests that he doesn’t have the majority view, and is wanting to develop support for the minority view. Which is fine, his concerns should be considered by the majority. But we have not heard a rising chorus in response.
In the end, we just don’t know at this time, so will have to wait and see.
Rob, I’m absolutely sure that if EASA had test flown the MAX successfully it would have been leaked.
Besides, I have learned not to believe what people say, but to deduct what’s really going on from all the other indications. Press conferences that don’t take place, statements that are not made, topics that are avoided, questions that are not asked, measures that are not taken, people that are leaving a company,… With many, many years of practice (as a founder, a business consultant and a chess player) I’m mostly right in my conclusions. The people in my company really hate it when I keep telling them “they all lie, always”. But that’s how it is.
So no, the FAA and EASA do not stand together. Boeings test flights have not been quite as positive as some might have hoped. MCAS X.X still has problems running on that ancient, slow computer in unison with all the other trim software etc….
Yes, we have to wait and see, but I’m already quite sure about the outcome, and have been for quite some time: The Boeing battleship with Muilenburg in command is heading straight towards the Chapter 11 reef.
Gundolf,
I wish you were here in my “company” helping me understand the moves of a chess player billionaire who is taking us down Boeing’s road. But I think you are right. I’m not sure it will be Chapter 11, but it will be a restructuring with some sort of US bailout, and some new laws. A lot of people will be hurt by this. But I don’t think you need to own a company or be a chess player to see what is hidden in plain sight: the awkward, mid-century modernist nose of that 737 with its short landing gear decked out with fancy new wing tips and engines that thrust too high off its chest. It has the “stability” of Barbie, with her tiny feet. It will be known to the future as a corporate folly of epic proportions — and people will wonder why everyone didn’t see what Delta clearly saw.
Three points,
What is the definition of stall prevention? If the pilots can run the two required stall tests to stall, with MCAS on, it certainly hasn’t prevented a stall, right?
Elevator authority. The elevator has to overpower the stab at any postition? Clearly this is not required, that was why the Alaska 261 could not recover from a jammed jackscrew.
Augmentation systems. Since MCAS is one, does it pass all the requirements in part 25 listed by Vasco above, 25.671 and 25.672.
Haven’t heard too much about that.
Thank you for taking the time Rob.
para 1: Good summation, but not only a personal contention, it is THE Formal requirement applicable to anyone submitting to CFR Part 25.
para 2-3: I am not asking anyone to prove a negative. If proving a negative is all that is left to those, that is self-imposed. As I have pointed out in D), by submission to Regulation the onus is on the claim of stability, not on the alternative, a claim on non stability. This is what must be and is logical so.
para 4: Now you inverted my view. The appropriate action is still and always to prove the positive. Those insisting on MAX being stable, without regulation required proof, are the ones asking the other side to prove that MAX is unstable. Ie. prove the negative. Your position is the one asking for the proof of a negative.
You have just inverted the logic. Notice and quoting your para 3:
That formulation is your doing, two negatives a positive make. That is EQUIVALENT to saying:
is not unstable vs is stable
YES, to prove that it is stable is what CFR Part 25 requires from your position!
While reasoning could be assimilated, the same can’t be said of evidence you mention, because none consists of evidence which Regulations require, ie Tests in section §25.175. This is how I separated FORMAL from TECHNICAL in my comment. Formally with an Objective character, and Technically at a lack of test results on a Subjective basis, open to discussion.
para 5: Being resolved only by the Regulators is not according to my definition as you put it, it is the Social Contract presumed in a Democracy under State Law or Consitution. Lets keep aside if this is observed in any sample State.
para 6: Agree, those interested in anticipating the results of the Regulator resolution are left shuffling with pieces of circumstantial evidence.
Regarding your examples of circumstantial evidence:
1: Exhaustive testing, if anything proves Boeing is being thorough. Boeing cannot afford any less.
2: There being no precedent is not proof of stability. The remaining part is opinion.
3-4: Not real. JATR raised concerns: [Observation O3.4-A] “An unaugmented design would have been at risk of not meeting 14 CFR part 25 maneuvering characteristics requirements due to aerodynamics” and [Observation O3.4-B] regarding the pitch-up tendency. Given the circumstances, time is not the major concern.
5: Not real. Aviation Safety Reporting System (ASRS):
1, 2, 6 and 7: Are your position attempts which you resorted to nevertheless to convince someone via absence of evidence: There is no proof that MAX is not stable, therefore it is stable. Obviously, as you well suspected, I don’t accept those and I will not be convinced this way.
3, 4 and 5: Do not correspond to reality and are disqualified from the argument.
I know recollecting all the technical arguments in favour of your position, is not an easy task, but I do know you can present better arguments regarding MAX’s static stability. I’ve seen you advance positive arguments. Some posts of yours made me consider additional factors at stake.
——————————————————————————
You appear to suggest that Facts I mentioned in E.2) and E.3) are nothing more than a supposition of mine, but these are supported on JATR report, which is as recent as October 2019, 7 months into Regulator review:
(Observation O3.2-A and O3.3-A) Allowing creative interpretation and non-standard treatment of data supplied to the Regulator, potentially obviating tests that should have been done or access to quantitative data required for compliance.
(Finding F3.5-A and F3.5-C) JATR can at best suspect MCAS is being used in flight tests and is unable to classify the system given supplied data.
(Recommendation R3.6) Mentions “use of non-standard flight test techniques”
I was very careful formulating E.2) and E.3). I specifically distinguished that Boeing had access to flight data WITH and WITHOUT MCAS, and that the Regulator only had access to data WITH MCAS, please reread. Even then supply of data must have been precarious given doubts raised by JATR, ultimately leading them to recommend:
——————————————————————————
I separated Observations/Conclusions/Questions from Facts (which are also pointed out) specifically to reserve space for my opinion also conveniently ruled away with horizontal bars, these were never meant as anything more than opinion. Mission success: I am glad that was your impression 🙂
On the other hand what I did not do, not even once, was applying to MCAS 2.0 my substance of Observations regarding 1.0. Your criticism of Observation 2 appears based on this assumption alone, I can’t see how 1.0 can be said to always be under control of the pilot, it was proven otherwise twice. For that reason I will skip further comment.
Even in Question 1, I am referring to MCAS 1.0, ie. the one that malfunctioned twice. At best in Question 1 what I may be implying is that this watered down MCAS 2.0, severely limited in its authority, as effective as the bare frame, may only reveal the suspected lack of Static Stability disease under the worst conditions possible: a passenger flight instead of a test flight.
Cheers for your patience, Rob! Well… cheers everyone that took the time
Vasco, it all comes down to the same repeated arguments, which we are not likely to resolve here.
We cannot assert the MAX is stable, because the only proof of that you will consider, is regulatory approval in the new process that is currently underway. So we cannot prove the MAX is stable, within your framework.
Alternatively. your assertion that the MAX is unstable cannot be accepted by us because it goes against most of what we know to be true at this stage, as well as our common sense, reason, and experience. So you cannot prove the MAX is unstable, within our framework.
So we have the two arguments being framed in two different ways, that do not share a common basis for understanding, and therefore are not compatible for agreement.
The one basis for understanding that we share, is that we both accept that regulatory approval or disapproval will settle the issue. You have confidence that the regulators will assure detailed compliance, we have confidence that the regulators will use objective, data-driven and experiential methods.
So I guess that’s where we leave it, and look forward to the regulatory response, whatever it will be.
I wouldn’t distance the framework my position stands on from the framework your position stands. The specific difference being that “what we know to be true (…) as well as our common sense, reason, and experience” should be considered as the accumulated whole since aviation took its first steps. The best compendium for that is synthesised in the regulations. I was relatively surprised to discover that regulations were dealing with bounds for safety, not with a predetermined set of aerodynamic solutions. So when for example Stall Speed is mentioned in regulations, it comes accompanied with the very physics formula for stall speed, inherited and taught at aerodynamic courses, but still provides leeway for the manufacturer to define it. The §25.103 Stall speed section reads almost as a wikipedia page.
I think the expression that best describes the subjective part of my position is simply: An abundance of caution is absolutely necessary given the occurrence of two accidents with a newly certified plane, employing a novel system, in a very short time span.
Not helping a relaxed attitude in this case is also the likelihood of regulatory capture, as the, just published, FAA document dated 3rd December last year reinforces mounting on other jedi-mind tricking evidence. If such informed assessment was done so early after the first accident. How… How could they allow such a plane to keep flying?
Fortunately it is now grounded. For as much time as necessary so there remains no doubts regarding safety, something that the flying public took for granted for years and years of aviation.
I’ll be patient, wait for the regulator to reach a conclusion, and WILL VERIFY it to the best of my ability.
Vasco, not to prolong this discussion further, but I think our frameworks are quite different.
Yours is based on regulatory compliance, which renders our physical arguments irrelevant. All that matters is whether compliance exists.
Ours is based on physical reasoning, which ideally also provides the basis for regulation, but may not. The truth or merit of an argument is not determined by regulation, but the regulation should be based on truth or merit.
You see the regulations as an embodiment of truth and knowledge. I see them as the embodiment of minimum standards for safety, that also ensure uniformity of application to all commercial aircraft.
So in my view, if MCAS isn’t compliant with the existing regulations, I would consider whether the regulations can be expanded to cover it. A necessary part of that would be to have all arguments seriously considered and reviewed. That would have been the benefit of an issue paper on MCAS from Boeing.
In your view, you would see non-compliance as a reason to disqualify MCAS, but not a reason to modify the existing regulations.
So our frameworks have different outcomes for the same input. Just wanted to make that point.
Of course if MCAS is compliant, then the two frameworks are in alignment. If not, we don’t know what approach the regulators will take. Possibly they will find middle ground with a transitional or grace period, as EASA has suggested for the 3rd AoA sensor.
It’s interesting also where the KC-46 fits into this, if MCAS is non-compliant. Boeing may argue that it’s an existing compliant system, the regulators may argue that it’s no more compliant than the MAX. That would upset the military operators, but perhaps they have less strict regulations, so it won’t be an issue.
Rob, being a little more conservative describing my position would have had more success when advancing your final points, you leave me no choice but to respond.
Naturally both levels matter. If I wasn’t considering physics in addition to regulation, I wouldn’t have dedicated half of my original comment to it. My post consists of two parts: FORMAL and TECHNICAL.
Regulation embodies that physical reasoning, very technically in fact and it is not based on something else alone as you appear to suggest.
Updating regulations to better accommodate any novelty is integrated in the certification process:
I simply don’t know where did you get that in my view regulations can’t be updated for MCAS. That is false, I never said that or even suggested it. But now that you mention this, what I am not willing to consider is for MCAS be put in service and regulations modified after the fact. First there is an hypothesis, then you devise tests, validate them and take your conclusions, only then the substance of the hypothesis is carried on for the future. Lets not invert this order. Certification process allowed for the former not the latter. Boeing was found wanting in that respect, by not following due process.
Continued process optimization is possible only beyond minimum thresholds. Compromises bellow standard minimums are inadmissible until proven safe. I don’t think EASA is suggesting a 3rd AoA sensor while compromising minimums.
Finally, Regulators are authoritative, Manufacturers are compliant. It is not their place to argue. Their method is scientific not philosophical.
@Vasco
Your diligent work, based on logic only, is a refreshing change to all the unfounded speculation and the opinionated spreading of fake facts. It is VERY much appreciated. Keep it up!
Vasco, I’m sorry but I don’t believe you think both sides matter. You’ve expressly rejected the arguments made by many here that the MAX is stable, without refuting them on the basis of the reasoning or evidence we present.
The reason now given is that the MAX must be presumed unstable until the regulations say otherwise. That precludes any argument we could make, essentially assigning them zero value, in the context of resolving the issue. You would not do that if you felt both sides mattered.
As I mentioned, those of us using physical arguments and reasoning, have not similarly assigned zero value to your arguments. We agree that regulatory approval is important and legally required. We just don’t see it as determining the validity of our arguments, or rendering them invalid.
The regulations are responsive to what can be established to be true. The truth is not responsive to what has been established in the regulations. To say that is putting the cart before the horse. The truth must always be independently established. We do that by means of physically reasoned arguments and observations. That is what we’ve tried to do.
You said this:
“First there is an hypothesis, then you devise tests, validate them and take your conclusions, only then the substance of the hypothesis is carried on for the future.”
Note this works in both directions. You cannot invalidate an argument by presuming it incorrect, any more than you can validate it by presuming it correct. The only way is by reasoned arguments and confirmation by observation. By saying the MAX must be presumed unstable, you’ve skipped over this step.
We believe there is enough observational evidence of stability to put forward a cogent case. There have been only positive comments by the pilots who have flown with the new MCAS. Even Dickson has flown it in the simulator. This is the only positive evidence we have right now. That evidence is consistent with the arguments we have made.
We could also make an argument based on the lack of negative evidence, as I have before, but that is not as strong as positive evidence.
But we should also look for positive observational evidence that the MAX is unstable. For that, at present we have the dissenting views of Marko and a few others. I don’t wish to discount them because to do that is wrong. No one should have their views assigned a zero value.
So then I look to the substance of those arguments. What is the reasoning? What is the evidence? Did they have a bad experience in the simulator? Is there a cause proposed for instability, that can be evaluated or tested? I don’t see those things in their remarks. So I conclude that they have strong, heart-felt opinions, as can be said of many people here.
Issues have been raised about the classification of MCAS within the regulations. Those are rule-related rather than stability-related. Concerns have also been raised about the control column feel. Does either MCAS or EFS restrict the ability of the pilot to pull the nose back up, if he over-corrects after stall recovery and descends too steeply? These are good questions and need to be answered as test points, but they are also secondary effects that depend on a second inappropriate pilot action. They aren’t related to the inherent stability of the MAX. We could go on to tertiary effects as well, or further.
In the end, we always come down to the same difference. Since we have different standards of evidence, we can’t agree. I’m sure this is as frustrating for you as it is for me.
O prazer foi meu Bernardo.
It was my pleasure.
Is the verdict of “guilty” or not “guilty” the same thing as stable or not stable? And is stability even what is at issue? I thought it was all about “authority.” Something about the use of legal discourse in this matter is misleading.
So, if someone commits a crime, the problem is that once something has been done; it’s not possible to go back into the past and actually reconstruct it. So, this must be done narratively. In the US, the prosecution must create a theory of a crime, and build a coherent – yes logical – narrative about the commission of the crime and the guilt of the accused perpetrator. This is touchy. A prosecutor can accuse anyone in the world of committing a crime – anyone. And if their story is coherent – if there is motive and opportunity – and if a jury believes the story; then the defendant is guilty; even if they have done nothing at all.
So, in this case, it’s not up to the defendant to “prove” that they are innocent. As many have been saying here; it’s not possible to prove a negative. The problem is that the sole job of the defendant is to poke holes in the prosecution’s argument – to argue, for example, against what might be false accusations in the case of a political show trial. So, in effect, through the powerful and politically contentious notion of “proving a negative,” Rob, has placed the question of the stability of 737 Max into the discourse of the political show trial. And by implication, all who question its stability are like the Examining Magistrate of a tale by Dostoyevsky or Kafka, or even worse, of Stalinist political trials.
This is a false narrative, and the 737 Max is not an innocent airplane subject to false accusation. Nor is it being asked to prove its innocence – a negative. This is not a left wing, Boeing hating, agenda driven political show trial. All of this is patently absurd and, on some levels, a brilliant, but typical PR smokescreen.
These are basic engineering questions that can be easily answered by the company. In my memory, in all other accidents involving airplanes, they usually are answered by the company. People want to know the “moment curve” at all angles of attack, I think. They want to know why MCAS was designed. They want to know if the Max can fly without MCAS. They want to know if the placement of the engines compromises the authority of the elevators at certain angles of attack. They want to know if MCAS is overworking the stabilizer or using it in novel ways. They want to know if the jack screw of the stabilizer is sufficient for its novel use.
To answer these questions is not attempting to prove a negative. It’s not attempting to establish innocence or guilt. It’s not about events of the past that can’t be reconstructed. It’s about an existing airplane that I may have to get on one day, and that millions of people might get on. It’s about a brand new airplane that has crashed for reasons of poor engineering – twice.
Let lawyers make their arguments in court. Let PR flacks blow their smoke. But the real problem here is that the company is not providing information about a work product that has killed nearly 350 people. And please don’t bring up the idea that the modification of a 50 year old airplane with new technology is a corporate secrete. Nobody wants to steal that one.
I’ll be short Rob, don’t take it as dismissive, because it really is not.
I’ll reiterate what I have said before. You are polite enough to exchange arguments with, you observe intelligently, drawing my attention, you are obviously knowledgeable of the issues at stake, you keep bringing important facts to the table. I would appreciate more sources or links from you, only to shorten my time spent searching, you have proved accurate in any case. You may take for granted that I enriched myself and have learned with you. There are no “buts”.
We haven’t reached the same exact stance, our predispositions may explain it. We are in agreement in the most important issue for me:
You had in your discourse, maybe not in so many words, already revealed this disposition. There are few friends I can share a sober drink with so late into the morning, Cheers again Rob!
RealSteve, just to clarify, many arguments that have been put forth against the MAX, have revolved around variations of it being unstable in some manner.
Therefore Bjorn, Mike, myself, and others have tried to put forth the argument that the MAX is stable, as that is what all the evidence we have indicates, and what we believe to be true.
This debate has raged for a very long time, before I ever joined this forum. It goes on in many other forums than this one, as well. It went on in the Congressional hearings. So I am not the source of it, nor have I dragged it to the forefront.
We don’t see this as being related to the guilt or innocence of Boeing. It’s just a finding of fact and truth. I suspect the reason it’s been rejected so forcefully, is that it’s viewed by others as proof of guilt. So a defense of the truth by us, is viewed as a defense of Boeing by others. And so we go round and round.
We’ve debated the release of information for a long time as well. To some, the lack of information is proof of concealment. To others, it’s the normal progression of investigation and regulation. Boeing cannot refuse requested information to a regulator, without risk of penalty. They were just fined for not reporting substandard parts. But, this discussion will go round and round as well.
I don’t really know where we go from here. Maybe nowhere, maybe no further progress is possible. As Bernardo said, it’s exhausting, but it seems equally wrong to give up. I’m sure people feel that same way on both sides.
The 15 crashes estimate doesn’t apply anymore. MCAS has been fixed, maybe not as exhaustively as some people might want but still it has been fixed very comprehensively.
“On December 9, 2019, in an internal email sent to employees in the FAA’s Aircraft Certification Service (AIR), it was revealed that the agency was moving to create a new safety branch to address shortcomings in its oversight following the two MAX crashes and a controversial reorganization. The email obtained by The Washington Post emphasized the complexities of aviation safety, but did not mention the MAX directly as it was written in bureaucratic language.”
On December 11, 2019, Representative Peter DeFazio, chairman of the House Transportation and Infrastructure Committee, said that the committee’s investigation “has uncovered a broken safety culture within Boeing and an FAA that was unknowing, unable, or unwilling to step up, regulate and provide appropriate oversight of Boeing”
“It’s not common for another accident to occur after pilots have been advised of a possible control issue.”(Rob) That is why I would think it important to know the logic behind the MCAS. For instance, was it adopted with the same intent as in the car industry where collision avoid sensors are a becoming a standard feature? Or was the system deployed because the design bureau knew that a stall scenario was possible, hence developed MCAS in order to claim that flight characteristics comparisons between both planes remained within a measured tolerable envelope. It would be interesting to know or see the reports, that detail the information used by the design bureau that allowed them to conclude that a simple nudge into the air lift pressure variable could prevent an event which they must of known could re occur over a linear distance. Moreover, did they conduct some kind of analysis to understand the effects the nudge might have, such as create wake or turbulence that might effect the forward air pressure structure and compound the probability (risk). Did they calculate how long during the take off profile the airplane was in reach of needing an MCAS correction? But then again when I hear a former FAA or NTSB official say that the manual trim procedure was physically impossible; it can not be pilot error.
Regulators are looking into all of those things. They have access to the data, we do not.
There is no doubt that Boeing’s analysis of MCAS was inadequate. I’m sure the regulators are addressing that and being sure the analysis is being done correctly now. That’s why they are in no hurry.
The rationale for MCAS has been covered by Bjorn, Mike, myself, and others. It did make sense as a solution, it just wasn’t done well or correctly.
The stall prevention debate can go on endlessly, because there are valid points for both sides. The regulators will have to decide. That points up the JATR finding, that Boeing could have had those questions addressed in an issue paper, in advance, and that doing so would have made MCAS a much safer system.
As far as the trim wheels being inoperable, the question becomes what is reasonable. At Vmo of 340 knots, they were not operable without very large forces. At the regulatory limit of 250 knots, they are operable.
Also in the procedure, pilots were to unload the stabilizer with electric trim before cutout. We don’t have the Ethiopian report so we don’t know why they didn’t. The CVR indicates that electric trim didn’t work. We don’t know if that is also related to Vmo, or was for another reason.
I’m sure that trim wheel response is one of the things being considered by the regulators, so we’ll have to see. It has a very long and established safety record in the 737 fleet.
“As far as the trim wheels being inoperable, the question becomes what is reasonable. At Vmo of 340 knots, they were not operable without very large forces. At the regulatory limit of 250 knots, they are operable.”
Is this a fact. Again, I’ve read that the changed sized of the trim wheels on the Max and NG rendered them inoperable. Has anyone successfully used them in a normal flight on the Max and NG? I read that the true operable capacity of the trim wheels was not represented in the simulator. Some say this has been corrected. Has this been corrected for the Max and NG simulators and are they still operable?
Is the information here debunked or incorrect?
https://www.moonofalabama.org/2019/05/boeing-737-max-crash-reveals-a-severe-problem-with-older-boeing-737-ngs.html
RealSteve, my source on this is the video presented by Mentour Pilot (also linked from your article, there are other videos as well that have looked at the high speed trim case). He demonstrates the trim wheels in an uncorrected NG simulator.
He acknowledges that they become progressively more difficult to operate with airspeed, and at Vmo, would be very difficult to move, probably requiring both pilots to crank with all their strength. They could not do that if their strength was also required to hold back the column at the same time. At 250 knots, the wheels are pretty stiff but still operable.
My understanding of the simulator issue was that it was based on the regulation speeds for various altitudes. For 10,000 feet, the flight manual warns against exceeding 250 knots. So the simulator would not yield the correct trim force for higher speeds than that. That was discovered when they tried to play back the crash data.
I read that in a pilot forum, which may not be an authoritative source. They also confirmed that in normal conditions, you can turn the trim wheels without the handle. And you can also grab the wheel in a runaway to stop it, but they said that required courage to try. Cutout switch is preferred.
I did find news reports that the fix was available and was being rolled out to simulators.
The trim wheel is about 10 inches in diameter, and was reduced by about 1 inch in the NG and MAX. So about 10% reduction in capability.
This is an item that EASA clearly questioned. Again, Rob. This is not, along with ALL the other matters, an agree to disagree issue. They either work or they don’t. It’s not a natural phenomenon like global warming. The speculation should be unnecessary. You shouldn’t have to scour the internet looking for videos.
RealSteve, this is again about finding the truth. I wanted to see for myself what it was like to operate the trim wheels. I don’t have access to a simulator so I found a video from an experienced pilot 737 who does, and is an instructor for other pilots.
His view was that the trim wheels are operable in normal conditions. and he demonstrated visually that they were. He also said they become more difficult with airspeed, and in an overspeed condition would be very difficult to operate.
That explanation is consistent with what we know of the long safe history of the 737, as well as the scenario that occurred in the Ethiopian flight. It made logical sense and there was visual proof. Also it’s consistent with the fact that we don’t hear pilots joining a chorus against the trim wheels.
If EASA wants to latch onto the extreme case and claim that the wheels should operate easily at Vmo, then they can, and Boeing will have to respond in some way.
As TW pointed out, an Airbus can have the rudder sheared off by extreme pilot pedal movements, and this caused a fatal crash. But the regulators said the aircraft was within specs and the pilot responded incorrectly. Operating the aircraft at or beyond Vmo is another example of an incorrect pilot response that may result in control loss, in trim or other systems.
Rob,
I’ve seen Mentour Pilot’s videos — and trust them and him. But we know they are unrelated to reality because the simulator for the NG and Max were not programmed with realistic forces on the trim wheels. That’s my understanding. And the long, safe history of the 737 was with larger trim wheels. They reduced the size for the Max and the NG. I’m not an engineer and I haven’t had physics in a long time. But I’m not sure this is the way to calculate force in this type of system — or that a 10% reduction in force required is insignificant at this level. You say: “The trim wheel is about 10 inches in diameter, and was reduced by about 1 inch in the NG and MAX. So about 10% reduction in capability.” Anyway, I have yet to read anything by any pilot who actually said he successfully used the trim wheel of an NG in flight (not to say it has never happened, but I just haven’t read anything). I have only read one thing which presents a pilot struggling to use a trim wheel as part of a Boeing checklist. That was the pilot of ET302.
RealSteve, the force reduction was 10%, that is a well-known relationship for torque (Torque = force x distance). I did not say that was insignificant, I was only quantifying it for you.
In addition, there was a reduction in the area of the MAX stabilizer of about 5%, so this would have offset the trim wheel reduction somewhat.
When you say that the trim wheel simulation was not realistic, that was for airspeeds in excess of 250 knots at 10,000 feet. Up to that speed, they were considered realistic.
You haven’t read anything about using the trim wheels in flight because it’s a non-event. It’s rarely needed but it works as expected when it is. We certainly would have heard about it from pilots if it was non-functional.
The wheels become more difficult to operate as control surface loading increases. For that reason, Boeing used to have the roller-coaster method documented. This was meant for the case where electric trim was not available. But apparently they removed that reference, as it was so rarely needed.
In the case of the accidents, they would not have been able to use it anyway, they didn’t have enough altitude. And their electric trim was still working, as far as we know.
I’ve copied this discussion into my Evernote for a read during a long x-mas day 😉
RE 737 MAX stability, it seems JTAR, EASA and Canadian authorities have taken a simple “physical” approach by requiring high AOA, various speed and positions test flights with MCAS pulled.
Maybe Muilenburg & Hamilton want to be on those flights with average pilots to see MCAS is just to make it fly like an NG?
How is it possible Muilenburg is still employed?
I guess being best buddies with Trump must help him, otherwise, he would have been backing up the Mayflower trucks to his house a long time ago.
If I were a Boeing investor, I wouldn’t pay any attention to the smoke and mirrors of their Return to Service predictions. Instead, I’d be following Southwest as close as is humanly possible. And, I’d be waiting for the inevitable piece of news: Southwest’s decision to diversify it’s fleet. What else can they do? Boeing has nothing to offer them.
https://theaircurrent.com/aviation-safety/pilot-procedure-confusion-adds-new-complication-to-737-max-return/
Pilot sim trials:
More than half of the pilots responded with wrong procedures.
The new software logic can produce new or potentially confusing indications on the flight deck.
The testing and results were in accordance with the concerns raised about human factors and pilot experience, and how pilots respond to unexpected situations. They don’t always immediately jump to the right action, and further this can vary between pilots.
There can be some trial & error involved, as we also saw in the three AoA/MCAS malfunction flights. Even Sully took some time to arrive at his solution. That didn’t prevent him from achieving a successful outcome, nor did that happen here.
Anyone who has ever done training, or taught a lab class with practical exams, will recognize this result. If there are ways to minimize it or make things clearer, then we obviously should. But we shouldn’t blame it on the aircraft.
From Seattle Times reporting:
“Pilots managed to cope with the various emergency flight scenarios they were confronted with, including, for example, a bird strike wiping out an angle of attack sensor at an altitude of 4,000 feet. However, regulators observing the tests were concerned that some of the pilots didn’t follow the expected procedures.”
“They were using the wrong checklists,” said one person with knowledge of the tests, adding that the European Union Aviation Safety Agency (EASA) in particular may now require changes to the procedures and checklists.”
“” Anyone who has ever done training, or taught a lab class with practical exams, will recognize this result. “”
This means more training is needed, especially on simulators.
Barney: I’m still searching the checklist
Fred: no no, I’m flying
Wilma: flying is a memory item, right
Fred: I mean stepping off the Golden …
Anticipating a high demand for training pilots when the MAX resumes flight, CAE Inc., a leading supplier of aircraft simulators and provider of training services, has increased production of simulators for the Boeing 737 MAX series, chief executive Marc Parent said November 13, 2019. “Our assumption is that there’s obviously going to be a lot of pent-up demand when those airplanes start flying”.
Leon, this is a criticism of the pilots, not the aircraft. If you were to take any other aircraft type, and run those same tests, you’d see a similar pattern in those pilots.
We saw that pattern in the training histories of the pilots of Lion Air, from the report. We will likely see it also in the histories of the pilots from Ethiopian, when that report comes out.
If you want to say that pilots could benefit from more/better training, that’s fine. But the MAX is not somehow unique in that regard.
This issue has been raised outside the context of the MAX, dozens of times. It partly reflects the industry shift from military to civilian training, as the demand for pilots has outstripped the supply. Also the reliance on automation, which has steadily increased. So there are a lot of factors in play here.
As far as the MAX simulators, there was already a backlog of demand before the accidents. If you bring 5,000 new aircraft into the fleet for 30 or 40 years, many thousands of new pilots need to be trained, whether or not you choose to train the existing pilots with 737 certification.
Rob said: “If you were to take any other aircraft type, and run those same tests, you’d see a similar pattern in those pilots.”
I’m not sure what you mean by same tests. Do all aircraft types require such tests. Please support this with data.
It’s Boeing’s responsibility to provide the size of training. One hour on an ipad won’t work obviously, especially when Boeing directly blames pilots. Boeing failed again!!!
JATR asked for this pilot pool trial and they were right. Boeing still only care about $$$ (still cheating!!!).
It was posted here that Boeing tested in flight and on the sim (regulatory testing) for many hours and it seems they don’t have a clue because so many pool pilots were confused. Thank God EASA stripped Boeing’s regulatory business. This trial has proven again that Boeing doesn’t know what is needed. It’s another hint that everything Boeing does needs to be checked.
I’m sure every airline and every pilot are watching this.
Boeing a laughing stock.
RealSteve, any aircraft can have instruments taken out by a bird strike, or a malfunction associated with trim or stabilizer.
I’m sure some of the tests were related to MCAS malfunction, since that was a major cause of the crashes. But remember the purpose of these tests were general pilot response, human factors and workload, to see if the industry standards used for the safety analyses are accurate.
As far as pilots not running the right checklists, that is a pilot issue and not an aircraft issue. Some of it would be expected as I explained before, especially in a multi-alarm situation. In an unexpected situation, pilots may go down the wrong path before they find the right path.
If the standards are not accurate for the MAX, chances are they are not for other aircraft either. The MAX is certainly not the only aircraft type to have had accidents due to those causes.
“” As far as pilots not running the right checklists, that is a pilot issue and not an aircraft issue. “”
The new software logic can produce new or potentially confusing indications on the flight deck.
IT IS THE SOFTWARE
The sorry fact is, that after the recertification, the 737 will still run on a batch of serious exemptions from the rules, as there are:
– 16 g compatibility
– EICAS, insufficient man machine interface
– manual hand wheel not working through the flight envelope
– protection of wires moving control surfaces
– and so on
If regulators would get serious most of the exemptions should be cleaned out and should have been cleaned out with the change from classic to NG and than again with the advent of the MAX.
Exemptions are common due to grandfathering. A320 has them as well. They aren’t viewed as being critical to safety.
Any safety-related changes after certification, are implemented through directives, which must be carried out to maintain airworthiness. Regulators can issue those directives if they wish, the manufacturers have no choice but to comply.
So if a safety flaw was found after certification, the regulators have a mechanism to address that. For example that FAA did that with MCAS. Once the directive is in place, all future aircraft must also comply, so the change must be incorporated into manufacturing.
The difference is Boeing abused grandfathering with the power it gained through Comgress. Don’t tell me that the rudder wiring would be difficult to change, they are only lazy and greedy.
In cases when the FAA made safety decisions Boeing didn’t respect it. Now EASA will show them to respect. EASA is already doing it and every airline is watching.
The bottom line is that we now have proof that Boeing and the FAA knew that they were gambling.Even when looking for the best case scenario, they knew that.
The internal FAA review, conducted using the TARAM system, is challenged by MIT professor Barnett, who “is not buying the FAA’s analysis”. He says that the existing evidence supports a far-worse risk estimate.He rather estimates the risk at 24 crashes per year at a fleet size of 4,800. By his account, the FAA underestimated the risk by a factor of 72.
Barnett is using the sample size to inflate the risk estimate. In his reasoning, if the rate is 1 per year for 200 planes, it would be 24 times higher with 4,800 planes, or 24 crashes per year.
The issue would be whether 200 planes are a representative sample size for the eventual 4,800 fleet, so that the rate of risk could be projected from the sample to the full population, as the FAA did (and is an accepted method in statistics).
In this case, there is no reason to believe that increasing the population increases the rate of risk. The rate of A0A sensor failure, expressed in terms of flights or flight hours, does not increase with the size of the population. If that were true, the risk would increase exponentially instead of linearly as you build more aircraft.
That is basically what he is claiming, but it has no basis unless he could show that building another aircraft lowers the reliability of the sensor. But the two are not related.
I don’t think that he said anything such thing, that would be a stupid kindergarten mistake.
Barnett apparently argued – we had an average of 200 planes flying 2 years and 2 accidents, that is 1 accident on 200 planes per year. With 4800 planes in future, that is 24 accidents per year. FAA apparently assumed that after the publication of the EAD after the Lion Air crash pilots would only in 1% of the cases of a misfiring MCAS not be able to regain control. And so came to an estimate of 15 accidents in the next 30 years, if MCAS was not changed. This apparently was the argument to keep the MAX flying while Boeing would improve on MCAS. Barnett seems not to buy the 1%. See: https://www.forbes.com/sites/petercohan/2019/12/13/mit-professor-says-faa-estimate-of-15-catastrophic-boeing-max-crashes-is-way-too-low/#15af75365ce8
I looked at the calculations in the TARAM shown at the bottom of the Leeham post. Chilling stuff. After Lion Air, they simply calculated that 1 crash in just over 372.000 Max flying hours implied a fatal risk of 2,68E-06 per flying hour. Multiply with 250 flying planes at the time. Multiply with an average use of 8.9 hours a day. Multiply with 90 days or so (the time that they probably guessed Boeing would have MCAS 2.0 ready). That is a 54% chance on a next fatal accident in the next 3 months (in practice higher, since more MAXes delivered and flying). Only by assuming that the EAD would improve pilot performance such that there would be a 99% right recovery action if MCAS would misfire again, they could buy the time for Boeing to adjust MCAS rather than ground the MAX then already. I beg to ask: how did they come to this very low 1% failure assumption? Particularly since by now it is clear that the EAD wasn’t a stellar document, to put it mildly.
https://www.documentcloud.org/documents/6573647-TARAM-for-MAX.html
ATFlyer, I suspect the 1% view reflected their initial beliefs about pilot error and the expected level of pilot responsiveness. Remember that most of what we learned about MCAS did not come out until after the Ethiopian crash. And most of the criticism of standards for pilot responsiveness did not come out until the accident reports.
Thus their corresponding view was that if pilots were informed about MCAS and the procedures to use in a malfunction, the risk would be mitigated until Boeing could correct the problems with MCAS. As I’ve said, that did not hold true for the Ethiopian crash.
If 1% means 15.36 crashes, I wonder how they came up with 1536 MCAS misfires.
Rob,
“Did not come out?” You mean did not come out publicly. You say: “Boeing did not have simulator data that gave them a more realistic review of “pilot error and the expected level of pilot responsiveness” to a MCAS misfire? Come on.
“” That is a 54% chance on a next fatal accident in the next 3 months “”
That’s crazy and they did nothing. Estimating some bird poop.
Grubbie, the issue that arises here, is that the observed rate of 737 in-flight AoA sensor failure, is 25 failures over a span of 17 years (through 2019) and a fleet of 5,000 aircraft. This is as given in the Lion Air accident report, and should include the 2 accident events. But if not, then we have 27 or 28 events.
That rate is also consistent with the FAA post-crash estimates, even though as AtFlyer points out, they arrived at it by a different means of calculation.
Barnett’s estimate is 24 failures per year, which is an inflation of the observed rate by a factor of 17.
Initially I thought he had multiplied the rate by the growth in MAX production, but I see now that was an incorrect conclusion. So I apologize for that.
But we are still left with trying to understand the source of the inflation. So I now think it depends on which rate you accept. A sample size of 5,000 aircraft over 17 years wih 25 events, or a subset sample size of 200 aircraft over 2 years with 2 events.
That comes down to which is more representative of the true rate. In statistics, normally the larger sample size is the more accurate, unless a bias can be shown. In this case, I don’t see a bias, or a reason that the MAX would have a higher rate of failure than previous 737 versions using the same AoA sensor.
We know that with random events, we can predict their rate of occurrence over a large population, but not specific events, which can occur at any time. Thus it’s possible that the 2 events within 2 years are just a variation of inherent randomness, since both are small subsets of the larger sample.
Also we know that of the 2 events, 1 was fully random (bird-strike) and 1 had elements of causality (improper maintenance). We cannot easily calculate the effect of causation, but we know causality makes it more likely than a random event.
Lastly when you have a small sample such as 2 events, there is a large sensitivity to small changes. One event more or less radically changes the rate. This is why larger sample sizes are preferred.
So taking these factors together, and recognizing that we cannot test this without returning the MAX to flight, I would favor the large sample and the lower rate as being most representative. I realize others here will disagree.
“Thus their corresponding view was that if pilots were informed about MCAS and the procedures to use in a malfunction, the risk would be mitigated until Boeing could correct the problems with MCAS.”
The scary thing is that Boeing nor FAA apparently had a clue how many shortcomings the EAD had for solving another MCAS misfire. You almost would say – they had no clue what they tried to regulate or solve. The non/hardly working manual trim wheel. A super clear sentence that you must trim electrically against MCAS till stab neutral before you use cutout. Etc. Not good, frightening even.
It seems that earlier in the year, a lot of people were talking about AoA sensor technology and its vulnerability. This becomes a particular problem with automation. Still, because of this, companies build airplanes with automation that relies on them have used at least triple redundancy. This was not the case with the 737 Max and they knew that MCAS was triggered by the failure of just one AoA sensor. Here is a quote from an article from earlier in the year concerning AoA vulnerability. “Angle-of-attack sensors have been flagged as having problems more than 50 times on U.S. commercial airplanes over the past five years, although no accidents have occurred over millions of miles flown, according to reports made to the Federal Aviation Administration’s Service Difficulty Reporting database. That makes it a relatively unusual problem, aviation experts said — but also one with magnified importance because of its prominent role in flight software … The FAA reports include 19 reported cases of sensor trouble on Boeing aircraft.”
Finally, I had asked this before and TW gave a good answer, but I’m now wondering. How are they sure a bird strike and not some mishandling on the ground disabled the sensor on ET302. Without indicator lights, don’t these sensors need air flowing across them to give readings, so if they are damaged on the ground it doesn’t show up?
quote from: https://www.heraldnet.com/nation-world/not-just-the-737-angle-of-attack-sensors-have-had-problems/
Again, Rob, this might mean something if we weren’t talking about a system that at the time had no redundancy. The failure of one AoA sensor brought down the airplane, and was set to bring down another.
As the Lion Air reports makes clear, the 25 event number was take from instances of 737 in-flight AoA failure that resulted in stick-shaker activation. This is the kind of failure that would have triggered MCAS, had it been present.
I too saw the 50 failures in 5 year US figures reported, during my research, but that was failures of all kinds and all aircraft The accident report correctly limited these to those 737 in-flight events that would trigger MCAS.
The FAA knew that in the previous flight JT043, the pilots had recovered. Also they had the flight recorder data for JT610 (but not the cockpit recorder data). To them, these things reinforced the ability to recover, which they had already believed was possible. So in their minds, issuing recovery guidance to the pilots was a prudent risk mitigation action.
The pilot bulletin was sparsely worded and that surprised me as well. I would have expected much better clarification after a fatal crash. But it was consistent with the language and terseness of the QRH.
The FAA also directed Boeing to correct the problems with MCAS, which was seen to have repeatedly triggered in the flight data, and that was another prudent action.
If you want to say that the FAA had no clue, that is a statement made in hindsight, and it more or less proves my point. They didn’t have the information we have now.
As far as the triple AoA redundancy, that is required for full authority FBW systems, this is why Airbus uses it. It’s not required for the Boeing systems that give full authority to the pilot. That may change now, we’ll have to see.
Note that using the second AoA sensor would have prevented these accidents, along with many other changes to MCAS that have been discussed here, that were underway after the FAA directive to Boeing.
Fact is Boeing and the FAA underestimated the risk in record dimensions.
It’s remarkable that of 4800 planes less than 4000 would survive only because of MCAS.
JT610 crashed during cycle #443, ET302 during cycle #382.
The FAA has to show its workings as to how it assessed the risk,there is no excuse for hiding them.
Grubbie, in this thread Javier has reproduced and verified the calculations for the TARAM. They are public record and are not being concealed.