FAA Finds New Risk on 737 Max, Orders Boeing to Make Changes

It wasn't that it wasn't sufficient.

It was that they found similar behavior happening in a low-speed part of the flight envelope. That required increasing the authority and losing the G-load safeguard.

> "turned it up to 11", and didn't re-evaluate the original design.

In other words they thru all engineers principals out the window.

Now there is no doubt this is exactly what happened.

But the bigger question is why did this happen and why was it allowed to happen?

I don't think they "tricked [them] into believing". More like "talked them into accepting".

I wouldn't say the 737 MAX is nothing like the 737 NG, they're quite a lot alike in important ways, but there are clearly significant differences. And there should be an aggressively adversarial system to determine whether the difference is significant enough to warrant a separate type certification for the MAX variant.

I'm not at all amazed by Boeing's blatant deception and blame shifting. They've done this before, and with this same model of aircraft. https://en.wikipedia.org/wiki/Boeing_737_rudder_issues

> What could happen (but still unlikely) is that those within the company who made the decisions that led to the deaths of 300 people could be held to account in a court of law.

Sorry, I laughed. That will never happen. Boeing may go under, but those rich bastards will always be able to stay out of jail. Name me one exec of a plane manufacturing company that has gone to jail over a crash. There aren't any.

>I'm going to assume you're no engineer.

I'm pretty sure what you're trying to get across is that Engineering is the business of enabling the taking of calculated risks, but you're doing it in a needlessly inflammatory way.

And the poster you're responding to isn't necessarily wrong either. Just because engineering allows us to identify, analyze, and calculate the impact of risks does not free us of an obligation to always favor the most conservative approach in living up to the obligation to comport ourselves in a manner consistent with serving the Public interest.

Remember the Iron Ring in all things.

> How fast do you think this stuff can happen?

Above I posted a seven year old documentary about the 787 Dreamliner, and there were the same problems of Boeing doing the FAA's work. So to answer your question: I don't really know, but it seems to be decades at least before anything changes, if at all. And that's really appalling.

>I'm going to assume you're no engineer.

I am, actually.

As an engineer you can calculate a risk like: this part under this type of load will fail at x, and then design so that x is never reached (or in a million years or so) to make a design safe.

A manager can calculate risk like: if we sell 5k planes, and we can make them $1000 cheaper by using a part that will increase the likelihood of a crash by only 2%, since the chance of a crash is already very very low, we might as well use the inferior part and make $5m extra. That way I can buy that third mansion I want.

Both are calculating risk. The engineer calculates for safety, the manager for his stock options. Which do you think is better?

My point is, the goal should always be complete safety. Even though engineers know that that is impossible, and even though lots of managers don't care at all about safety. We should still strive for it. Total flight safety should be the goal, not a byproduct of good engineering.

That's why we have the FAA in the first place, because we don't trust those managers at Boeing to make the right decisions, because experience learned us we shouldn't.

We trusted on the FAA and Boeing to hold that goal of passenger safety to the highest standards, but they betrayed that trust completely by letting Boeing do the FAA's work! Isn't that completely bonkers? Perhaps we just should scrap the FAA as well and let the Europeans certify all planes. I don't know. But right now there's nothing but ass-saving going on, and that doesn't restore trust in either of those organizations.

Lot's of people should be going to jail for this, but they wont, because they're rich and can buy their way out. Everybody knows this. That's the way the United States works. Justice is only for the rich and powerful. That's how Boeing can kill 300+ people and get away with it. As an engineer, this worries me greatly.

While all true, by quitting you escalate the problem.

If upper layers "solve" it by hiring less competent people, then that is something on their conscience.

When the problem is at the top, just bearing with it at the bottom will not help at all. Even if you manage to save lives, you virtually sacrifice your own.

The fact that they disagree is what is notable. The FAA lost credibility by being the last to ground the MAX. You side with the one that has a history of not being wrong.

It is like with two AoA sensors: if they disagree, there is the problem.

You side with the most conservative obviously. Your life is at stake. Only when there is a total consensus of safety you can feel confident.

Depends on where you want to fly.

Not to mention the AoA data was suspect, at least from one of the sensors. That's what caused the chain of errors leading to the MCAS nosediving the plane.

« Let them die, or at least never use them for passenger travel anymore » is what they said for McDonnell Douglas (DC-9, DC-10 and MD-11 must represent half of Air Crash Investigation episodes), the company lost a lot of value.

So Boeing bought it.

Does Sukhoi have a better safety record than Boeing?

The difference is, most products aren't safety critical like aeroplanes.

That is exaggerated. It doesn't pervade everywhere.

Despite the 737 Max fiasco, airplanes today are far safer than ever before. Since 1970, annual deaths have been cut by >80%, while air traffic has increased by a factor of 10.

Cars have seen similar improvements. So have food hygiene, workplace safety, and most any measurable safety record I can think of.

There are still companies that do that; the ones I'm aware off are mostly from Germany and Japan. Like assembly line robots, but also Panasonic (and maybe Fujitsu; haven't tried them for a while, but I used to be a big fan of their 2-in-1's P1510 rang) laptops (especially the Japan-only ones). They would not sell anywhere else because they are crazy priced, but they are virtually indestructible and go on forever.

Thanks for the steer. Wasn’t aware of this. Just read her presentation and loved it.

But it could have been quite easily by simply siting the backup generators above ground. That was a stupid design error. Tsunamis are not unknown in Japan after all.

Though one might argue that the risk of tsunami is not independent of the risk of (certain kinds of) earthquake for pacific rim nations. Failure to take that into account might be considered a design decision.

> Fukushima was designed to survive the earthquake, and it did

untrue

It was designed to survive both a tsunami and an earthquake. Tsunamis often are caused by earthquakes.

That Fukushima survived the Earthquake is a myth. The plants had an emergency shutdown and there was very little time for a damage assessment, which would have taken weeks or months.

Whether the plant would ever have been restarted after the earthquake is unknown. It could have been a full loss, like several reactors in Japan, which will never be restarted.

There were enough reports over the years that were buried which alerted about the earthquake and tsunami risk.

Fukushima survived the earthquake and even survived the tsunami. The generator got wiped out, but even that wasn't what ultimately led to the disaster. It was that the battery backup eventually ran out of power (not unexpected) and the connectors for recharging it were old and of a format that isn't used any more. There was no way of recharging the battery backup and so the pumps eventually failed.

It's one of those problems where there are literally a million things that could go wrong and since the emergency system is not used normally, it's easy to overlook a critical problem.

So I agree with you. Fukushima was not a design error -- or at least not a design error that could have been reasonably fixed at the time that the reactor was originally designed. It was an error in maintenance. Obviously better to have a design where loss of power doesn't cause a melt down, but I don't think that these were available when Fukushima was built. CANDU reactors existed at that time, but I think they were still considered experimental. Pickering came online in 1971, so basically at the same time as Fukushima. I'm not familiar with other passive designs, so possibly someone else can make an observation.

But basically, as far as I can tell, Fukushima was a reasonably normal nuclear power plant for the time it was designed. The Air Max seems to have suffered from problems because of design decisions that are not considered normal.

I wonder if something about this system was changed after that incident - why not keep sounding the stall alarm if the plane ends up outside the flight/sensor envelope? Can’t you assume that it didn’t magically cross the stall zone back into normal flight?

The engines in the MAX are still producing thrust below the centre of mass of the plane...how would this produce a nose down pitch at TOGA thrust?

> That suggest there was only ever one pilot flying

"Pilot flying" is a human-factors title, not a software function-lock. It just indicates who has control responsibility at that moment but it is not enforced by technical means.

It is intended to eliminate ambiguity in crew functions; the PF can be a newbie copilot even if the commander of the aircraft is a 30-year-service Captain who would become the PNF at that point. Its all part of Crew Resource Management theory.

There should only be one PF in a cockpit at any one time, precisely to avoid the situation that arose with the Air France flight where the computer was receiving inputs from two pilots.

You may be right about the averaging. From rereading the accident report, the Pilot Flying took back control of the plane after the Pilot Not Flying engaged his controls and tried to pitch down.

But, it’s the same basic idea. The PNF thought he’d gotten control of the plane, and didn’t understand why his input wasn’t having an effect. He didn’t get feedback from the stick telling him a different input was being honored. And neither pilot appears to have been fully aware that they were in a flight control mode where there was a risk of stalling. The PF especially never seemed to have made that connection, and the PNF took a fairly long time to call it out. As a result, the PF may not have been aware that he needed to actively keep the angle of attack inside the flight envelope.

So, PNF tries to pitch down, but isn’t aware the plane got put back into a mode where he isn’t in control. PF is pitching up, but isn’t aware the plane switched to a mode where this could lead to a stall. That’s the similarity I was getting at.

One of the best explanations I have read on that issue. Short and accurately summing it up.

The indications were different alerts continuously sounding. It’s a complex problem, there’s a lot that can go wrong at once.

This is my number one objection to over-reliance on automation.

Every piece of software is a mechanism. In order to truly be able to safely use something without outside aid, one must have a complete mental map of the mechanics of the system in question. Abstraction helps; but not when you start getting into high-risk contexts.

>The copilot pulling the yoke back continued to do so, long after the other, much more experienced, copilot had formally assumed control and had attempted to bring the nose back down by pushing the yoke forward.

At least according to the official accident report, neither of the pilots at the controls consistently made nose down stick inputs.

I don't know a whole lot about this, but I seem to remember that there was one design decision, that, while not wrong, was different from the generation before, and that is that the airplane yokes were not mechanically coupled to one another. If they were mechanically coupled, the experienced pilot could have felt the other pilot pulling back on the controls, but what was happening was that the two pilots were pulling the controls in different directions AND the plane was averaging the control inputs and giving no feedback to the pilots that what each was doing was wildly inconsistent or contradictory.

You could hardly describe that as a flaw when the alternative was 9/11. It's a trade off on balance of probabilities. A suicidal copilot can still to this day crash any aircraft with only slightly more creativity. For example hitting the fuel cutoffs at 500ft after takeoff.

That doesn't sound right. The 737 went into service in the late 60s. There were two confirmed fatal accidents involving rudder hardover in the 90s.

Hence the reason I said time will tell.

But there are also many examples of aircraft with terrible early safety records that never recovered from their bad start.

And Boeing do have form when it comes to software.

https://www.engadget.com/2015/05/01/boeing-787-dreamliner-so...

The engines on the original 737 design were quite small by modern standards, and the wings were low as well. As such there aren't really a ton of places to put new, larger engines. They basically have to be placed further forward and higher up. This means the pitch moment created by throttling up/down is different on different versions of the 737, which is what required the MCAS device in the first place - they were trying to make sure the 737 MAX flew the same as previous models.

They could, but it would mean that a lot of the supporting infrastructure at airports would have to change, essentially negating much of the advantage from avoiding a new clean-sheet design.

As long as it remains sufficiently 737-shaped airlines can keep flying it to all the place they've been flying 737s for decades.

They could, but my understanding is then it would count as a new airplane, with more training required for pilots to fly it. They were trying to pretend it was not a completely new airplane, so that pilots wouldn't need much new training to be certified to fly it.

It is turning out to have been a pretty bad decision, even from a mercenary point of view.

The constraint is the FAA would see it as a new aircraft and therefore have to certify a new airframe. The very in-depth review the FAA is currently doing on the MAX was the expensive (time and money) Boeing sought to avoid.

A longer landing gear to get the plane higher off the ground doesn't fit into the existing gear well in the wings. So you would have to redesign the wings. This required making sure that the loading on the main body stays the same. By now you are doing more than 50% the design work of a new airplane and you definitely can not keep the type rating. And if you need a new type rating anyway, you would redesign the cockpit, probably to be similar to the glass cockpits in the 777s.

Section 5.3: https://www.atsb.gov.au/media/3532398/ao2008070.pdf#page225

A microprocessor failed and output corrupted data.

Wikipedia says 393 have been produced, so more like 0.25%.

The rate of fatal crashes is more than an order of magnitude higher than anything introduced in the past 30 years.

The Concorde is the only thing that's worse. The A310 is closer than anything else at 1.35 fatal crashes per million miles vs the 737 MAX's 3.08- and that one was also designed to share a common type rating with an existing design.

http://www.airsafe.com/events/models/rate_mod.htm

Hopefully whoever is in the hot seat knows the name of the game. First you ask for 30 days, then you ask for 30 more.

Rather, I have a problem with airplanes falling out of the sky because pilots don't understand what they're flying, and airplane manufacturers trying to obfuscate their machinery. The details of how and why are secondary to that.

>I do not see how software augmentation can be permitted to compensate for a deviation from FAR 26.173. That section is titled: Static longitudinal stability. Software augmentation cannot cause an airplane that lacks positive static stability to have positive static stability.

I absolutely 100% agree. At no point have I intended to imply that any software solution should justify exceptional certification of an unairworthy frame as airworthy; in case that isn't clear.

I've only tried to communicate the fact that the software can physically remedy the behavior enough to apparently bring it within the capability of a human to control (as has been demonstrated by the non-crashed flights, as Boeing will inevitably argue).

I absolutely, unequivocally reject any argument that the software fix is compliant with regulations as written, or should be accepted as an acceptable remedy in it's current form.

I've had my view somewhat shaped by D.P. Davies in regard to the application of "gadgets" for certification. I think that any such system must be essentially bulletproof, and avoided at all costs by engineering the problem out if possible; and if allowed must unquestionably get the point across to the pilot that they are in dangerous waters.

The 727 had it's Stick Pusher in the U.K. This seems to be a modern retreating of the same path, and to be honest, I'm siding more toward the conservative side you hold of not allowing MCAS to remedy these handling faults. It really would be an example of the slippery slope of normalization of deviance in action.

I really hope all pilots, aerodynamicsts, and engineers take notice, and speak up. I can sit in these threads and try to spread understanding to the nine winds; but I'm some dude on the Net, who has no professional affiliation to any of this, but a big fat keg of outrage because this is not Quality damnit.

I don't need an armchair assessment of my worldview, thanks.

It's well known that large US companies offer perverse incentives for their executives. As long as they don't do anything super illegal, there's often no recourse. I mean, recent history is replete with examples of executives optimizing-for-bonus.

>What sort of mindset must one have to assume that once a person becomes a "manager" or "executive" they are suddenly immoral or evil? Such an odd worldview.

Becoming an executive at a publicly traded company is a joyous and public acceptance of capitalism. Capitalism is objectively bad, given the state of the world.

Sociopaths are highly overrepresented among corporate executives. No, people don't suddenly become evil and amoral when they become an executive; evil and amoral people are simply more likely to reach those positions, precisely because they're evil and amoral.

You have the cause and effect backwards.

I have had the opportunity to observe a very wide variety of businesses in several industries and have noticed the same thing as multiple studies - a high degree of sociopathy among execs. My conjecture is that this is both because aggressive sociopathy will help people rise among the ranks, and also because the structure of business will tend to actively select for those traits (unless active counter-selection is implemented).

So, sure, one does not automatically change by becoming a manager (although there are psych studies indicating high income causing reduced compassion for others), but there is good reason to expect higher "immoral or evil" behavior in higher ranks.

In my opinion, one of the important qualities of an organized company is to spread and dilute responsibility. No individual manager or executive needs to be immoral or evil, they need only be short-sighted or a little greedy or willing to keep their head down and toe the company line.

Each person is only responsible for their own bad decisions. It's likely there is no one person who signed the memo that said "casualties totally okay, make more money!" Instead we'll find several people signing off on several bad decisions, each person myopic enough to be able to honestly claim they had no idea something this bad could happen.

It would be nice to see the buck stop at, say, the CEO, but I haven't seen that happen. In many cases the CEO will claim that they gave blanket performance goals and that the execution of those goals was too technical for them to actually understand, or that those technical details were hidden from them by people below them who were trying to hide things (rather than only deliver the type of information the CEO really wanted).

It's not necessarily good engineering, it could also be selection bias. It depends on how much risk is added by cutting corners. If too many corners are cut, but it didn't fail just due to luck, it's still bad engineering.

Not really.

Suppose Bob fires a gun into a crowded area and happens not to hit anyone. I didn't hurt anyone! It's my right as a consequentialist!"

Bob still goes to prison.

Beyond that, engineering is about using a principled approach, by definition. Throwing something together ad-hoc and finding that it happens to work, is not what is meant by 'engineering'.

My guess is that Boeing essentially gave the plane away in order to have one please, just one! success story at the Paris air show.

I can't imagine any airline making a deal at 50% list price with the current perception of that death trap with the public.

50% of list price, btw, is in the ballpark of usual discounts granted to end customers by Boeing and Airbus[1].

While I'm not privvy to any internals (obviously) my take is that IAG essentially gets the plane for free in exchange for a PR win for Boeing.

[1] https://en.wikipedia.org/wiki/Competition_between_Airbus_and...

I may not be interpreting this right, but does that imply they already have the planes, which will now stay in storage until 2025 waiting for all issues to be resolved?

If that's correct, aren't there possible risks for flying a plane that had such a long period of inactivity?

I am far less knowledgeble on the subject than you I think, but the FAA just not having resources should end in them not accepting any new missions and keeping a backlog of pending investigations for the next centuries.

The reason it doesn’t work like that is because of pressure on them to keep up wih the requests, and keep the businesses running. That pressure can’t be just their professional guilt, there is I think enough ways the industry affects them so they can’t just refuse to lower standards or accept to delegate part of their work.

That pressure, is what I call bribes. Be it preferencial treatment, exchange of favors, or straight up money going to decision makers to make sure the FAA doesn’t hurt plane makers.

I don’t think boeing uses Rolls Royce anymore after the Trent 1000 fiasco on the dreamliner. The GE9X is a fantastic engine and far quieter than the Trent engines.

https://m.youtube.com/watch?v=dDU1cvANdDQ

Ok but having to overcome an engine problem isn't boeings problem its the manufacturers.

You are of course, correct. My first engineering job fresh out of university was for GE. I worked at a (big) site in the British countryside in the Midlands.

One of our clients was Boeing, and we made a lot of sensors for them: anything from landing gear stuff, cabin oxygen and pressure sensors... you get the picture. Quite a lot of them were ultimately destined for the 787.

I also remember manufacturing sensors for Hamilton-Sunstrand... who would then fit them in 737 rudder assemblies and then sell them to Boeing. The whole subcontracting business was very byzantine in its complexity!

I also distinctly remember Boeing execs coming over very frequently to give updates, feedback, etc.