Boeing whistle-blower says proposed 737 Max fixes aren't enough
bloomberg.com
bloomberg.com
While I'm not a 737 expert, I have evaluated flight software (FSW) and vehicle management systems (VMS) on Gov't programs. Mr. Ewbank points out systemic deficiencies in the 737 VMS and controls.
It would seem the question to be answered by the FAA is whether they intend to address these systemic deficiencies or just the proximate causes of the crashes. It would be a valid, and more rigorous view that since these aircraft are already out of service in an unprecedented way, these systemic issues should be addressed as well. To be clear, it will involve significant engineering work to do so.
There will be immense pressure on the FAA, especially since the aircraft has been out of service and damaged Boeing economically so much already, to just deal with the proximate cause (i.e., stay the course they're on now). That will come from Boeing of course, but also internal management and their perceptions, as well the implicit or explicit pressure from the political class.
Speaking purely for myself, I hope the FAA does force the root causes to be dealt with as Mr. Ewbank advocates (I don't know him, but have immense respect for his coming forward like this - you have to know and understand the systems to be able to provide this kind of critical review).
However, I wouldn't at all be surprised if the fact they have already started down the path they're on causes them to retrench and leave these root causes unaddressed.
> The FAA allowed the regulations to be modified to fit the 737’s preexisting design
Terrible.
I wonder, if the FAA gives the 737 MAX the all clear, but no one else does, what does that mean for the aircraft? Would a US-only certification still be an effective grounding in all but name? I guess there are a bunch of routes within the US, but there must be crap-tons elsewhere too (and presumably international from US<->* that formerly used 737 MAX)?
If it goes ahead and gives the green light when the rest of the world isn't sold on it, then we can unambiguously say the entire regulatory institution is irredeemably defective.
At that point the only real fix is an absolutely amazing change in the Executive branch, or a Legislative solution; and I have doubts on the efficacy of the latter, since a regulator is only as good as the people staffing it at the best of times.
I agree and I'd like to add that in my opinion the airplane now needs to actually be better than its competitors.
If it isn't and there is another accident (big or small, that might or might not involve deaths but which might even slightly be related to MCAS or other systems having similar design flaws) then I think that there would be again another (bigger?) round of repercussions: for the plane itself, for Boeing and for the FAA.
Saying this because I imagine that a negative event might become a final public and/or political confirmation that 1) the FAA & Boing cannot be trusted and that 2) the airplane has just too many flaws that need to be addressed.
Therefore, to avoid this, the plane must be absolutely rock-solid otherwise if anything happens people will immediately ask Boeing and especially FAA "why did you create/approve this thing - are you incompetent and/or stupid and/or unscrupulous?".
A very interesting topic, in my opinion :)
Turns out competent safety regulation matters, who knew?
Ignoring the training issue (which is already long gone), the inability to take the Max abroad would be a serious hindrance for sales. It means that it would require that airlines track them separately for routes, making sure to never take the Max 8 outside of America, which is exactly what Boeing was hoping not to do with the Max 8.
There are really two separate questions: first, should the FAA address other deficiencies particular to the 737 MAX, and second, should the FAA go beyond that to require Boeing to fix issues that are common to all 737 models?
I agree with Mr. Ewbank that the answer to the first question is yes; but he also argues that the answer to the second question should be yes, since the issues he points out in the latter part of the paper are not specific to the 737 MAX, as far as I can tell, but affect all 737 models. I don't agree that Boeing should be forced to address those issues, since that would amount to decertifying all 737s, which is not justified by the safety data; no other 737 model has an accident record that justifies any such decertification.
It bothers me that when lives are lost, our first response as a greedy capitalistic society is to cut funding, considering there aren't really many competitors, and the switch-over costs for airlines would be prohibitive.
We should be funding efforts to investigate the heck out of this and make sure it doesn't happen again. I'm not sure how one would structure such funds to make sure they aren't abused, but I certainly don't want Boeing cutting more corners and hiring less-competent lower-salary aircraft engineers because they are now low on funding and need to get the plane out before some damn quarterly earnings report.
Boeing paid $11.7 Billion dollars in stock buybacks in the two years preceding this fiasco. All the money they ever needed was already there.
Instead, they spent the money inflating executives portfolios. And now you want more money going to them? If they want to privatize the gains, they can privatize the losses. Your sympathy is very misplaced, IMHO.
No, I clearly said "I'm not sure how one would structure such funds to make sure they aren't abused". I want more money going to engineers, not the executives. But I do like to think with a forward-thinking mindset about how to make that possible instead of dismissing the problem and saying cutting funds in the right answer, because that definitely doesn't get more money in the hands of engineers to debug problems.
Perhaps more money to engineers + a third party audit company appointed by the court + fire the executives that did wrong, I don't know, but I'd like to be optimistic about it. Taking away funds is only going to strip engineers even further of funds for fixes, make unsafer planes, that's for sure.
The executives that inflated their portfolios while knowing there was going to be safety issues -- I support punishing those individuals. Not Boeing as a company though, since we pretty much depend on them.
I didn't know that. What kind of development budget did the Max have? If they'd taken 10% of that to do $1B more safety related engineering during the project, might that have helped?
That, except for money.
It contained vague statements like 'rare set of circumstances' with ZERO data on the expected probability. As we know in the software world, a 1 in a billion chance could happen many times per interval given the scale of any particular problem.
I'm never stepping foot on a MAX.
I will never fly on that plane
What is the downside for Boeing to just say "let's put the plane back in the sky"?
I think you scrap the plane, then start over with a wholly compliant design. This whole ordeal is a great example of regulatory capture. You have a plane with a ton of new flaws, and all the flaws of the old design, and business decided it was cheaper to pressure the regulator to be okay with these flaws and to kill a few hundred people than to build a proper plane, but let's give them one more chance to kill a few hundred more people, so they're not financially inconvenienced over a problem of their own making.
"Got to hit those quarterly sales figures." An aircraft that crashes is pretty detrimental to achieving this goal. Achieving sales figures doesn't preclude safety
Eventually, the company pays for it, but it can take a while.
The culture at Boeing has changed, and it seems to me that the quarterly numbers are more important now than previously.
No, obviously it didn't, since the redesign changed the fundamental flight dynamics of the plane. It was not improving the design, it was piggybacking off the good record and past training of the old design to push out a fundamentally different product as quickly and cheaply as possible.
>Achieving sales figures doesn't preclude safety.
Then how did these fatal 737 MAXs ever get released in the first place?
However, some of them seem completely over the top. A complete review of the 737 control system for example, given its operating record across the fleet, would as likely result in introducing new failures as eliminate some as yet unknown failure mode.
Practically speaking this might require that I start buying more tickets with airlines that prefer Airbus aircraft.
> [Chesley] Sullenberger says he recently experienced scenarios similar to those facing the pilots of the doomed Ethiopian and Lion Air jetliners in a simulator and says he understands the difficulties they had trying to maintain control of the planes. "Even knowing what was going to happen, I could see how crews could have run out of time and altitude before they could have solved the problems," he said.
https://qz.com/1576597/off-duty-pilot-saved-lion-airs-737-ma...
The fact that the same plane kept repeatedly trying to plow itself into the ground after takeoff really underscores the basic premise that the 737 Max is a bad aircraft, and should have never been certified.
American Exceptionalism is a dangerous myth. They didn't crash because they were Indian/Indonesian. What happened to these guys is that they faced a situation that tested the limits of human abilities, and it's the reason a whole domain of engineering called Human Factors exists.
I am saying, in general, if you are going to get on a plane today, you are much more likely to be killed because of human error than any other reason. Humans are good at fixing, mitigating, and recognizing mechanical issues. Other planes in the past have had mechanical issues and later returned to service with a good safety record. Human error is really what you should be worried about, both statistically, and in terms of mitigation difficulty.
Sure, but the issue with the 737 MAX in particular is that the aircraft is unsafe from a design perspective, so I find your arguments that US aircrews are less likely to make a mistake to be both nonsensical and irrelevant (from a 737 MAX perspective).
The 737 MAX is flawed in a way that was not only concealed from the operators, but in a way that causes a failure mode that is not easily avoided or averted because of Human Factors, even by an aircrew that "knows their shit".
Your faith in the MAX 8 flown by US operators is unfounded.
They don't need to be American, I merely listed it as an example of a place where people who fly planes can be reasonably expected to have a high level of competency. (In contrast to situations like PIA 8303)
Most engineering problems also include elements of human interaction -- once again, the DC10 cargo door issue is a good example. One would expect that even if MCAS is re-engineered to work correctly, a pilot would still need to understand the operation of the system. Part of the problem is that Boeing tried to sell it as if it was of little to no importance to understand.
This is negated by the fact that the pilots on the flight before the Indonesian crash were able to save their aircraft because they recognized the symptoms of runaway trim quickly.
https://qz.com/1576597/off-duty-pilot-saved-lion-airs-737-ma...
Yes, pilot error is the most common cause of aircraft incidents. But poor aircraft design is additive to that risk. If you genuinely believe that the Max 8 is a bad airplane, as I do, then you're accepting the risk of the pilots making a mistake plus the risk of bad aircraft design killing you.
With that in mind, I would still choose to fly a regular 737, even if I already trust the pilots to "know their shit", since adding risk for no gain is a silly thing to do.
I wouldn't get off a MAX8 operated by Quantas and instead board an A320 operated by PIA
(1) Existing 737 pilots would not need to be recertified for the MAX. They would just need to read a short document that updated the procedure for handling runaway trim.
This would make the plane more attractive to airlines because it meant not having to pay for expensive recertification of pilots, and
(2) The plane itself would not need to be certified as a new aircraft type. The requirements for certifying new tapes change over the years, and older planes like the 737 would not meet today's requirements. By making it fly similar enough to the existing 737s, it could be classified as a variant on the existing model and be grandfathered in on the old certification.
Certifying a new type is very expensive and takes a long time.
My question is this: how long does the MAX have to be grounded before the costs of it not being service end up more than (1) the costs of recertifying pilots, and (2) the costs of making the other design changes that would be needed to certifying as a new type under current rules and then getting it certified?
I don't know that Boeing has computed likely values of such costs, and that if they did, that they would allow them to be publicly known. Moreover, Boeing would probably focus on their worst-case numbers to justify to everyone why the only viable path is to minimally modify the design.
It activated in the two crashed flights (and the earlier flight by one of those same planes) because of bad data from an AOA sensor leading the flight control systems to think the plane was about to stall.
You don't have that data, and the FAA did not release the data. I looked for this information specifically in their report, they did not report this data whatsoever.
So, making ANY statement about the rate of activation is pure speculation, and it's merely a Boeing talking-point.
The FAA can and should have obtained data on the activations of MCAS from the world wide fleet, and also compare on other similar aircraft (other 737s) how often MCAS activation conditions would have been met.
Keep in mind that without that data we are all focused on the two times MCAS led to crashes, we are all in the dark how widespread the problem really was and once that data is out in the open the FAA's reputation (or what is left of it) will be further down the drain.
Unless we are talking about the number of times MCAS activated outside of its design criteria but didn't result in a crash. For example, as is presumed to have happened on the flight before the Lion air accident.
Yes, that was what I had in mind. You can bet that on every plane that did not have the secondary input to the MCAS system this happened. Two crashes are the very ugly tip of a much larger iceberg and the FAA has a vested interest in keeping that iceberg submerged.
You assume. If we had the data, we'd know how often the 737 MAX, which has different flight characteristics than other aircraft, was actually in those conditions.
I'm expecting evidence to confirm the assumptions of the system. I'm assuming any and all available data would be gathered and analyzed. I assume the MCAS system from top to bottom is riddled with bugs and flaws, designed by committee rather than engineers. There's no reason to trust any line of reasoning from Boeing on this matter, they've already demonstrated their incompetence and are not trustworthy.
You seem to not want the FAA to verify the claims of the system with data. I don't know why that would be undesirable. Even if they only confirm what is being stated about MCAS activation, that data would be valuable and demonstrate that the FAA has at least the competence to gather the data. Publishing the raw data along with their conclusions would allow the public to verify their competence at drawing conclusions.
This is because if the sensor fails on the ground, MCAS will always activate a few minutes into the flight, when the flaps are retracted, because the rule that activates it is disabled when the flaps are down.
Not sure how long, but they passed that point a long time ago. From what I've read, one of the goals was to not require pilot training on the new plane, and that is already going to be required now.
This was the gamble that management took. Hopefully, they still get their bonuses. (/s)
The bad decisions that led to this are well known. Southwest Air has a business model based on having only one type of aircraft, the Boeing 737. They insisted that the 737 Max behave exactly like the other 737 models, and not require that pilots be trained and rated for two different aircraft. So Boeing tried to make Southwest happy.
A deeper bad decision is that Boeing doesn't have a 737 replacement. The original 737 is from the 1970s. By now, Boeing should have had a new plane out in that size range. Airbus does. COMAC is coming out with one, if it works well. But Boeing guessed wrong on the sizes of aircraft airlines would want. They thought the future was widebody, not mailing tubes full of seats. The 767, 777, and 787 are all widebodies. So, of course, was the 747. The 757 was a great airplane for passengers and pilots that airlines didn't want because it cost more and used more fuel. So Boeing had a huge lineup of widebodies, and no good competitor for the Airbus narrow-body options.
Hence the 737 MAX, a 737 with engines too big for the airframe and a software kludge to compensate for that.
The cause of this though is as you say, the desire to make the 737MAX be on the same type certificate as the NG rather than do a clean sheet design.
Obviously in hindsight, Boeing would have been better off with the clean sheet design. At this point though, I think either they have to get the MAX recertified or they go bankrupt. They could potentially be bailed out by the government and a clean sheet design started, but even the bailed out company would be a shell of its former self with no narrowbody aircraft to sell.
I think you'll see Boeing get the MAX recertified or die trying.
"Pulling a circuit breaker is not generally an appropriate or intuitive crew action."
https://en.wikipedia.org/wiki/Organization_Designation_Autho...
The FAA relies on certification paperwork, which was falsified for the 737 MAX.
So the FAA was completely cut out of the certification process.
I still upvoted your comment even though I disagree with the sentiment because I see this a lot when risk management is considered by many. Unless risk management is your domain expertise, or you've been to lots and lots of different organizations to observe what works and what didn't, it is a very human perspective.
Risk management is not performed by saying, "Nothing bad has happened even less, therefore let's keep with the status quo or make it more lax to save money." Reactive risk management based upon the rear-view mirror is a great way to invite extinction-level tail risk into the organization's house.
We could play an exciting game of Cognitive Bias Bingo [1] with such a perspective, though.
As best as Wikipedia can tell me, Boeing has delivered 130 Max's which flew ~120,000 flight hours. Even if we completely disregard all MCAS failures that the pilots were able to mitigate, two 737 Max 8's were destroyed within the first two years of operation, representing ~1.5% of the aircraft actually in operation in two years. That is a pretty alarming statistic, and points to the Max 8 genuinely being an unsafe aircraft.
“The roots of this crisis can be found in a major change that the FAA instituted in its regulatory responsibility in 2005. Rather than naming and supervising its own ‘designated airworthiness representatives,’ the agency decided to allow Boeing and other manufacturers who qualified under the revised procedures to select their own employees to certify the safety of their aircraft. In justifying this change, the agency said at the time that it would save the aviation industry about $25 billion from 2006 to 2015. Therefore, the manufacturer is providing safety oversight of itself. This is a worrying move toward industry self-certification.” -- https://www.dcreport.org/2019/03/18/how-deregulation-made-fl...
Obama should be faulted for oversight perhaps, but the ball was rolling long before.
Trump _has_ made broad efforts to force _further_ FAA dereg. -- https://www.forbes.com/sites/marisagarcia/2019/03/18/did-tru...
The people previously running the FAA should go to prison.
Maybe the outdated aircraft can be converted to house some of the growing homeless population.