Internal FAA Review Saw High Risk of 737 Max Crashes
wsj.com
wsj.com
Put another way, the 737 Max has a statistic of 1 catastrophe per 500k flights, whilst the 737 was 1 per 10 million, basically 20 times as much.
This is criminal behaviour, and people need to go to jail. The MAX should never be allowed to fly again.
Hey mods, is it possible to attach it to that one? Or if not, just kill this one and let me know so I can repost it there...
https://www.theguardian.com/business/2019/jul/15/boeing-737-...
Which sadly means all my future flights will probably be on Spirit, but I'm willing to take the hit for my safety.
Yes, this is negligent behavior, yes, Boeing and the FAA should have their come-to-Jesus moment. But the odds of a crash on a MAX for you are one in five hundred thousand. Put another way you have a 0.0002% chance of being involved in a crash.
You have an 0.01% chance of dying each year being involved in a car accident in the United States. That's 50X higher risk. [1] On a per-trip basis it's pretty much the same.
Normally, of course, driving is much more dangerous than flying. On a MAX8 it's ball-park (based on an incredibly limited sample size).
[1] https://www.iii.org/fact-statistic/facts-statistics-mortalit...
Your approach also fails to take into account the non-uniform distribution of accidents at take off and landing vs at cruise, so if you take a 3 stop itinerary on an Airbus-only airline with a worse safety track record, you may be at more risk than a nonstop on an even unpatched MAX.
[1] https://www.google.com/amp/s/www.mcall.com/business/transpor...
0.0002% X 172 passengers -> 0.0334
You can divide that way to yield the risk per passenger, but multiply back out to obtain the per flight amount which is what’s relevant given the group impact.
Put people in jail for negligence, sure. But we should be criminalizing based on that negligence and not on its results.
[1]: https://en.wikipedia.org/wiki/List_of_accidents_and_incident...
Let's not split the wrong hairs.
The fault doesn't lie with the engineers who built the system...not to mention I would be very surprised if they were professionally certified.
It lies with the managers who wrote the specification that said that for business reasons the new plane must not require any additional training or type certifications, and cut costs by implementing the required systems with a non-redundant sensor.
(I agree.)
> Put people in jail for negligence
The higher ups new this was a tragedy waiting to happened they just hope its going to be their successors that will have to pay. Negligence is definitely too light or a term for this. This is knowingly putting people lives in jeopardy in the name of extra % in profits.
The FAA's report, which predicted an elevated crash rate for the 737 MAX, was written in December 2018. Three months before the second crash.
They would have looked at the failure rate of the AoA sensor and the failure rate of the recovery procedure and the fact that there had been one fatal crash. That gave them a reasonable estimate of the risk. Based on that analysis they should have grounded the plane, but Boeing apparently convinced them that with pilot awareness of the problem that the recovery procedure would be more effective. Unfortunately that was overly optimistic.
https://twitter.com/davidshepardson/status/12047953204058316...
No, it was fraudulent. Boeing didn't make even the slightest attempt to identify all the potential failure modes, and it's still unclear if the plane is even safe to fly with MCAS disabled.
In other words, if all new plane models were as safe as the 737 (1 catastrophe per 10 million flights), about 5% of those new plane models would have at least one catastrophe within the first 500k flights.
Yes.
> The MAX should never be allowed to fly again.
No. Even at 20x the failure rate, flying in a Max -- even with an unmodified MCAS -- is still vastly safer than driving on a per-distance-travelled basis. Part of the problem is that commercial aviation has gotten so ridiculously safe that we've lost all perspective on risk assessment. The Max is actually fundamentally a safe plane. What made it unsafe was the totally fucked up attempt to make its flight characteristic the same as the old 737 so it and its pilots would not have to be re-certified. The right answer is to re-certify. That's expensive, but a lot cheaper than scrapping an entire fleet of brand new planes. Grounding the entire fleet forever is throwing out the baby with the bathwater.
So, the correct comparison would not be to driving, but to flying in other planes with similar range that are already available. I am no expert, but I do not get the impression that it is looking good in this respect.
No doubt.
> the correct comparison would not be to driving, but to flying in other planes with similar range that are already available
Yes, but the correct comparison is the recertified Max, without MCAS, and with re-trained pilots. That is the alternative to scrapping the fleet.
I did the math one time with very conservative numbers (thinking it'd be an easy win) and got shockingly close:
https://news.ycombinator.com/item?id=19983686
If you have an alternative reference or more exact numbers I'd love to see them!
I don't think people are making the comparison of Max vs driving. They are making the comparison of Max vs other air planes.
By "re-certify", do you just mean the pilots? Or do you include the plane itself?
The original problem was that the FAA requirement for how the stick force has to vary with angle of attack could not be met, because of the new engines having to be so far forward: instead of the stick force continuing to increase with higher AoA, it started to decrease at some point because of the pitch up moment due to the engines.
The simplest way to fix that would have been to increase the ground clearance so the engines could be moved back to where they were on previous 737s. That, of course, would have had to be done in the design stage, before planes started being built. I'm not sure if it would be possible to retrofit existing 737 MAX planes to do this.
If the physical airframe stays the same, then there has to be something in the flight controls that compensates for the pitch up moment of the engines at higher AoA in order to meet the stick force requirement. MCAS was an attempt to do that while keeping everything "close enough" to previous 737s. If that constraint is dropped, there might be a way to keep within the FAA stick force requirement without having the same failure modes as the MAX does, but that would still require a new type certification for the plane.
Both.
> the FAA requirement for how the stick force has to vary with angle of attack could not be met
No, that's a myth. There is no such requirement for aircraft in general. Many aircraft do not have this characteristic. But it happened to be true for the old 737, and so it had to be true for the Max in order for it to operate under the old 737's type certificate.
The Max could easily be certified as-is without MCAS as a new aircraft type (assuming no further nasty surprises turn up of course). That will be neither cheap nor easy. If it were, Boeing would have just done that in the first place. But it will be a hell of a lot cheaper than scrapping the fleet.
14 CFR Part 25 Subpart B contains a number of requirements for stick force and gradient of stick force. In particular, section 25.255(b) says the stick force vs. g curve must have a positive slope and that the direction of the primary longitudinal control force must not reverse. IIRC that's the one that bit the MAX, but, as below, I'll have to go dig up references to see.
It's true that this is not the same as stick force vs. AoA, but under the conditions for which MCAS was intended, stick force vs. g works out to be basically the same thing.
It's been a while since I looked up references for all this, so I'll have to go back and see if I can dig up where I got the info that because of the pitch up moment of the engine the MAX could not meet one of the stick force gradient requirements without some kind of modification.
If it's true that the Max can't be certified at all without MCAS that would be a whole nuther kettle of fish.
https://www.law.cornell.edu/cfr/text/14/25.203
The specific issue seems to be the sentence: "No abnormal nose-up pitching may occur." The 737 MAX engines cause abnormal nose-up pitching at high enough AoA, if their pitch up moment is not compensated somehow.
Here is the page that first led me to that section:
http://www.b737.org.uk/mcas.htm
Still digging for more info.
I haven't read that there is an abnormal pitch up, which would directly contradict (a).
Nevertheless, I have a very serious problem about any kind of computer compensating for the lack of either static or dynamic stability as required in FAR 25. Those stability requirements are there to ensure an intrinsic aerodynamic behavior of the airplane. The instant your augmentation fails for any reason, including electrical failure, now your airplane is legally not airworthy and your pilots are legally not certified to fly it, because their training is predicated on that augmentation always being available.
That is why I think the central issue is not a violation of airworthiness standards regulations. If that were true, it seems like that would be known already, and there'd be hell to pay. Clear cut and dried.
Whereas it's a more complicated matter when it comes to type certifications. There are many nuances including the little detail that the FAA gets to decide the conditions under which a (new) aircraft type certificate is required (or not), and what kind of mitigations are required (or not). Only if the aircraft gets a new type certificate, is a pilot required to have a type rating and the commensurate training and currency requirements that go with it. I still think that's what all of this (being the problem with the airplane and the on-going delays) is about, and negotiating this with all the other civil air authorities.
I bet Brazil and EU regulators have resisted a sweep it under the carpet approach. And I also bet that somewhat recently the regulators, even at FAA, got to a point where they decided they needed to see the NTSB report. Otherwise, they could plausibly roll out a "fix" that doesn't adequately fix the problem per NTSB. And if that happened, while I could see FAA paper over it these days, I'd expect other civil aircraft authorities say no. And plausibly reground the airplane until it does get a proper fix.
Including possibly a new type certification.
The airworthiness regulations are tested in flight, so if Boeing flight tested a 737 MAX with MCAS active and it passed, there would be no violation. The regulations do not say the airplane has to pass the flight test with no automated compensation systems active.
> it's a more complicated matter when it comes to type certifications
Yes, the judgment of when a new variant is different enough that it requires a new type certification is not cut and dried. That might come into play if the FAA's judgment of whether the 737 MAX with MCAS should have required a new type certification were the question; but it isn't. The question is what it would take to make the 737 MAX without MCAS qualify to fly. At this point I don't think anyone believes that will happen without a new type certification for the 737 MAX; the question is whether even with a new type certification it will be possible to convince the FAA that the plane qualifies to fly.
There are four main changes to the B737 MAX flight control system software that have been developed to prevent future accidents like the ones that happened with the Lion Air and Ethiopian Air flights. They include the following:
1. Angle of Attack (AoA) comparison – an addition to MCAS that will now compare readings from both angle of attack sensors on the aircraft. If there is a difference of more than 5.5 degrees the speed trim system will be disabled. Also included in this change is something known as a “midvalue select” which uses data from both sensors together to create a third input that will help to filter out any AOA signal oscillatory failures or spurious sensor failures. This modification will prevent MCAS from commanding nose down trim when a single AoA sensor reports a false AoA as it happened in the two accident flights.
2. MCAS resynchronization – this change will account for manual electric trim inputs made by the pilot while MCAS is activating. It will track whatever input the pilot makes and return the pitch trim to that setting when MCAS retrims back to normal.
3. Stab trim command limit – is an addition that will limit the maximum nose down trim that the automatic flight control system can command to prevent the pitch trim from reaching an uncontrollable situation.
4. FCC monitors – software monitors have been added to the flight control computers that will cross check pitch trim commands against each other. If a difference is detected by these monitors the automatic trim functions are disabled. This protection helps prevent erroneous trim commands from a myriad of causes that could occur in the automatic flight control system.
These design changes in the software that controls the automatic pitch trim features including MCAS should prevent angle of attack sensor failures from causing the pitch trim to operate when it should not. Further, they should prevent the trim from activating erroneously for other reasons as well.
* https://transportation.house.gov/download/kiefer-testimony
There is nothing magical about this linear relationship; it is an intuitive configuration for pilots, but many other aircraft do not follow it. The requirement makes sense for single-certification, but we must be clear in understanding what is actually happening with this system.
The system counters the hazard of pilots experienced in 'regular' 737s getting close to stalling without realizing, due to lighter stick inputs not having the intended effect. Any MCAS malfunction would direct their attention to this issue.
Actual anti-stall systems (MCAS is not anti-stall, nevermind some shoddy reporting) would still function if a pilot were to approach this flight envelope. This includes cabin alerts, stick shakers, etc.
The scenario where MCAS cuts out, and it's in the envelope of conditions where it actually functions, and the pilots fail to notice this, and the MCAS inputs were needed to avoid approaching a stall, and the pilots fail to correct and avoid the stall .. it's a contrived hypothetical.
MCAS is not a system that activates on a normal flight. Only in relatively extreme circumstances does it even function, and then it only seeks to make intuitive pilot behavior less likely to approach stall conditions. A good pilot monitoring airspeed, trim angle, AoA, etc. will be able to avoid a stall just as well without the system.
>The scenario where MCAS cuts out, and it's in the envelope of conditions where it actually functions, and the pilots fail to notice this, and the MCAS inputs were needed to avoid approaching a stall, and the pilots fail to correct and avoid the stall .. it's a contrived hypothetical.
This is completely unrelated to MCAS, though? Since the goal of MCAS wasn't "bring the nose down" but instead "increase the pressure on the stick required to maintain a certain nose-up attitude", I'd be really flabbergasted if it was supposed to operate in a normal takeoff environment.
Flying has become so safe that the public no longer considers it risky, but the FAA never updated its targets. So when Boeing wanted to trade safety for market share there was no basis to stop them.
To illustrate the change in attitude it used to be common for airports to sell life insurance for the flight directly at the gate. This continued as late as the 1980s.
https://www.insurancebusinessmag.com/us/news/breaking-news/a...
The FAA set a standard that makes flying way safer than driving, a risk people happily undertake all the time, but people still overestimate the risk of flying and demand more safety improvements.
The fact that life insurance was being sold, meant the flying public _thought_ they were taking significant risks (even if they weren't).
Now, such life insurance would be laughable, which means the public _does not_ think it's taking any risks. The general public's risk tolerance for flying has dropped dramatically.
So, based on that, it seems the example perfectly demonstrates the point. The public thinks flying is much less of a risk now than it used to.
Though, presumably the FAA's tolerance for risk has also dropped tremendously over the past several decades, so I feel like the more relevant comparison is the perceived risk to the actual risk.
Although the public thinks the risk it's taking is much smaller, it still vastly overestimates the danger of flying.
I agree completely that the public thinks flying is a lot safer than they used to, which is a change, but I think they also still really overestimate the danger, which is not a change, and which I believe is borne out by the same evidence provided by the parent, people buying life insurance when it was a bad deal and people continuing to demand that the FAA make flying so much safer than activities like driving that they engage in without a second thought.
I'm also not so sure that a lot of people wouldn't still buy life insurance at the gate if it was available.
This apparently was still within FAA guidelines. I gurantee the flying public’s risk tolerance is lower than that. I know mine is.
FAA's credibility is in the dumps, along with the Boeing's.
edit: I found more. In particular Pierson's attachment included emails and ends with a listing of 15 emergencies over 13 months and the Summary of Subject Matter includes a quick run-down of various Boeing happening beyond the MCAS.
https://docs.house.gov/Committee/Calendar/ByEvent.aspx?Event...
How about telling me what you're linking to, not just giving me a raw, opaque link?
Is this document publicly available now? Did anyone find it?
>787 Lithium-Ion Battery Containment:
>Before the AIR Safety Review Process was implemented in mid-2015, there were other examples of FAA management accepting applicant’s positions over the concerns of FAA technical specialists, the FAA’s aerospace safety engineers. For example, during initial certification review of the new technology 787 lithium battery system design the certification of the 787, an FAA technical specialist determined the lack of a fireproof enclosure could result in catastrophic failure due to uncontrolled fire from the battery. He proposed to FAA management that the special conditions design of for the airplane system lithium-ion battery should include a requirement for a steel containment structure that would be vented overboard. FAA management overruled the specialist. The specialist worked to modify a new special condition that was applied to the battery installation so a containment system would be required. Unfortunately, FAA managers pushed to delegate 95 percent of the certification to the applicant, including the high risk, new technology, battery installation. Without FAA safety engineer oversight, the ODA found the design without an enclosure to be compliant. Sadly, after certification, the airplane system lithium-ion battery experienced two extremely dangerous fire events and the FAA mandated the 787 fleet to be grounded. The design changes the FAA mandated to allow the 787 to fly again included a steel battery containment box that was vented overboard; as originally proposed by the FAA aerospace engineer.
* https://transportation.house.gov/committee-activity/hearings...
edit: better link https://docs.house.gov/Committee/Calendar/ByEvent.aspx?Event...
The only initial San Jose Terminal 3 ($1.2+ billion) international airline was JAL, and they had to stop flying for about a year. This was a terrible blow to the airport.
The engineer who advocated a battery box was not just correct, but following basic principles - even the Cessna 172 has a metal battery box:
https://www.knots2u.net/battery-box-cessna-172-stainless-ste...
Heck, I even tell IT departments to use a stainless-steel "bathtub" under water-cooled computer systems. Each time I'm called a Cassandra, until it starts leaking, then it's like, "Well of course. Anybody would do it that way."
Source: commercially-licensed airplane pilot.