Revelation wrote:

Pythagoras wrote:

But the change appears to have been inadvertently hidden from the FAA human factors regulators and hidden from the technical pilots who would have been the ones to challenge the hazardous classification.

Or maybe it was not inadvertent, but we'll never know because Boeing has managed to keep the key decision makers in that loop under wraps, and Congress never followed the paper trail from 737 Chief Engineer Teal (who says he only heard about multiple activation via the media and just trusted his underlings on the flight control team without any due diligence) down to whomever made the actual decisions.

The key decision makers were the Flight Controls and Stability & Control engineers that brought the MCAS change forward to Change Board for approval. It would have been Flight Controls and S&C responsibility to have coordinated the change with affected functions and organizations, which would have included the technical pilots by the way. The CPE needs to see the big picture but cannot be expected to know the fine details of every system. You are expecting too much of one individual here.

News Flash!!! Nothing was hidden from the FAA. The FAA knows this. Boeing handed over all documents, the FAA did not. The FAA has also refused to make certain employees açaí me for questioning and those that were some refused to talk. It is all in the a congressional report

It is the FAA that needs to be held accountable.

kalvado wrote:

And what would that change, after all? It is possibly possible to put someone (two, ten ones) behind the bars.
Would it resurrect those who died? Would it help MAX to be a better plane? Would it make future planes safer?
Any follow up is only as good as it would make for some better future. Putting blame on someone personally would hardly change problematic workflows, and not necessarily make people more willing to share concerns.
So maybe there is a better option than pinpointing guilty?

I'm not looking to blame a given person.

The central theme of much of the reporting has been the MCAS tragedy is all due to Boeing's "Walmart" managers looking to shave cost at any/every opportunity. This seems to be even more clearly stated in the new "Flying Blind" book.

What I want to know if the MCAS tragedy is due to (a) an individual engineer making a bad decision without undo external influences (as Boeing claims), or (b) the end result of lots of management pressure on that one person and perhaps others to avoid the "catastrophic" categorization that would have delayed MAX EIS and raised development costs tremendously by requiring the kind of redundancy that the MAX flight control computer now has.

We really don't know if it is (a) or (b). If it was well understood that it was (b), hopefully we'd see Boeing have to really change its approach to product development. So far it seems they really haven't, according to those surveys the FAA took of Boeing's workers.

Pythagoras wrote:

The key decision makers were the Flight Controls and Stability & Control engineers that brought the MCAS change forward to Change Board for approval. It would have been Flight Controls and S&C responsibility to have coordinated the change with affected functions and organizations, which would have included the technical pilots by the way. The CPE needs to see the big picture but cannot be expected to know the fine details of every system. You are expecting too much of one individual here.

My point was that Congress stopped their interviews at the CPE and did not follow the paper trail down any further to see if those individuals further down the chain felt undo pressure to accept changes based on cost considerations more so than safety or even sound engineering judgment. So far we don't know the answer, all we have is the corporate party line that they'd never compromise on safety, yet we have FAA surveys of Boeing employees indicating they feel pressured to cut corners etc.

It'd be interesting to know if or how "Flying Blind" addresses this aspect of the tragedy. I suspect not.

The bottom line to me is it seems a needle was threaded when MCAS was classified as not being new due to the KC-46 implementation on a totally different airplane and was not put in the catastrophic category. These decisions also provided the cheapest and fastest path to EIS for the MAX program. It's more than I think can be explained by sheer coincidence.

StTim wrote:

kalvado wrote:

Revelation wrote:

Or maybe it was not inadvertent, but we'll never know because Boeing has managed to keep the key decision makers in that loop under wraps, and Congress never followed the paper trail from 737 Chief Engineer Teal (who says he only heard about multiple activation via the media and just trusted his underlings on the flight control team without any due diligence) down to whomever made the key decisions.

And what would that change, after all? It is possibly possible to put someone (two, ten ones) behind the bars.
Would it resurrect those who died? Would it help MAX to be a better plane? Would it make future planes safer?
Any follow up is only as good as it would make for some better future. Putting blame on someone personally would hardly change problematic workflows, and not necessarily make people more willing to share concerns.
So maybe there is a better option than pinpointing guilty?

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

kalvado wrote:

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Right, I mean follow the paper trail down from CPE to lower levels of engineering to try to understand what kinds of pressures were on them when they made various decisions. There should be a clear paper trail, after all people do sign these documents.

Revelation wrote:

kalvado wrote:

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Right, I mean follow the paper trail down from CPE to lower levels of engineering to try to understand what kinds of pressures were on them when they made various decisions. There should be a clear paper trail, after all people do sign these documents.

I think I drop out right here as we went through this in different forms.
Thing is, you believe there were good engineers who bent under management pressure. I doubt engineering qualifications - in terms of ability to communicate within the team and see broader picture beyond immediate set of tasks. We'll have very hard time finding common ground without hard facts...

FLYBY72 wrote:

News Flash!!! Nothing was hidden from the FAA. The FAA knows this. Boeing handed over all documents, the FAA did not. The FAA has also refused to make certain employees açaí me for questioning and those that were some refused to talk. It is all in the a congressional report

It is the FAA that needs to be held accountable.

Are you thus saying Boeing does not, and is entirely innocent?

kalvado wrote:

StTim wrote:

kalvado wrote:

And what would that change, after all? It is possibly possible to put someone (two, ten ones) behind the bars.
Would it resurrect those who died? Would it help MAX to be a better plane? Would it make future planes safer?
Any follow up is only as good as it would make for some better future. Putting blame on someone personally would hardly change problematic workflows, and not necessarily make people more willing to share concerns.
So maybe there is a better option than pinpointing guilty?

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

LDRA wrote:

kalvado wrote:

StTim wrote:

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

One may ask who signed (or put a PE stamp) certain documents submitted to the FAA. In general failure to read a document before signing it is not a legal excuse once there are issues with the document.

LDRA wrote:

kalvado wrote:

StTim wrote:

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

I've been a project manager. You should get used to hearing bad news - it is a key part of your role. I your project staff do not feel they can report bad news to you then it is a project going off the rails.

If I was a project manager and I wasn't hearing regular bad news I would very much worry what is being kept from me. Projects have problems. That is a fact of life. The role of a project manager is to resolve those issues - including escalating those beyond your purview/payscale.

The same goes for those above. They should be reviewing the risk register etc or how are they supposed to correctly report upwards.

kalvado wrote:

LDRA wrote:

kalvado wrote:

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

One may ask who signed (or put a PE stamp) certain documents submitted to the FAA. In general failure to read a document before signing it is not a legal excuse once there are issues with the document.

PE stamp means nothing. In complex system, it takes multiple disciplines, multiple companies through layers of supply chain to provide end product assurance. There are complex interactions involved among parties. The process ensures integrity, not some single person signing for it.

I'm not up for a witch hunt for prosecution, and I'm not sure Forkner did anything wrong except trash talk. Did people need to be prosecuted for the Challenger disaster? I think the main point is to find the institutional, organizational, and culture problems and try to correct those.
I'm not familiar with the program. Boeing makes it sound like once they turn all of their information over to the FAA, it is 100% the responsibility of the FAA for the integrity of the design. Well, if that's the case, if I were the FAA looking at the 777x, I'd tell them it will be five years and we'll have to ask the taxpayers for 2 to 5 billion dollars to review your design to that standard.

Revelation wrote:

Pythagoras wrote:

The key decision makers were the Flight Controls and Stability & Control engineers that brought the MCAS change forward to Change Board for approval. It would have been Flight Controls and S&C responsibility to have coordinated the change with affected functions and organizations, which would have included the technical pilots by the way. The CPE needs to see the big picture but cannot be expected to know the fine details of every system. You are expecting too much of one individual here.

My point was that Congress stopped their interviews at the CPE and did not follow the paper trail down any further to see if those individuals further down the chain felt undo pressure to accept changes based on cost considerations more so than safety or even sound engineering judgment. So far we don't know the answer, all we have is the corporate party line that they'd never compromise on safety, yet we have FAA surveys of Boeing employees indicating they feel pressured to cut corners etc.

It'd be interesting to know if or how "Flying Blind" addresses this aspect of the tragedy. I suspect not.

The bottom line to me is it seems a needle was threaded when MCAS was classified as not being new due to the KC-46 implementation on a totally different airplane and was not put in the catastrophic category. These decisions also provided the cheapest and fastest path to EIS for the MAX program. It's more than I think can be explained by sheer coincidence.

From the questioning that I read, the Congressional investigation was primarily looking for overt examples of Boeing trying to influence the regulators, or Boeing Chicago creating perverse incentives to trade cost for safety.

You aren't going to see a paper trail for the question that you are asking.

What would happen when the MCAS system was changed in March 2016 during flight test was that the question would have been raised as to what does the proposed change have on our certification plans and how do we minimize the cost to show compliance for the change. It doesn't matter what business one is in, one is always going to ask what the minimal cost approach is.

The E-UM(s) responsible for finding compliance, as MCAS had been delegated to Boeing, would have evaluated each of the certification documents, of which there were many that were touched by MCAS, to see whether any of them would have required revision. The E-UM(s) would have considered what the appropriate means-of-compliance would be for the change whether that is similarity to existing systems, analysis, test, or analysis supported by test. Should a test been required, the E-UM(s) would have considered what level of testing is appropriate and under what flight scenarios taking into account FAA guidance as to how to interpret the regulations. As acknowledged in the JTAR report, the FAA guidance for how to address human factors was not sufficient. Thus, it is easy to fall into the erroneous conclusion that the only test required was to show that an MCAS failure mode was equivalency in its manifestation to an existing failure mode of a runaway stabilizer trim. The only place that cost or schedule would come into play here is what type of test would be required--bench test, full motion simulator, or flight test--and what scenarios to consider. With insufficient guidance from the regulators, one is then relying upon institutional knowledge and engineering judgment for safety. And this is where the error occurs in excluding the regulators and the technical pilots which otherwise should have been involved to validate that judgment decision. The rules in-place for how the MCAS system was delegated and how only catastrophic failures were to be documented kept the FAA from providing oversight.

My guess is that Congress did not want to follow the paper trail on down from the CPE as it would clearly illustrate how the E-UMs/ARs were not doing their job for the FAA that they are supposed to be when they are acting in their AR or now E-UM role on the ODA system, probably under pressure from Boeing management. Congress were the ones responsible for allowing the changes to the laws that allowed Boeing to give the impression that they control their E-UMs and let them believe that their loyalty to Boeing was more important then their duties to the US taxpayer (i.e. the FAA). A few of the E-UMs/ARs involved should have their E-UMs privileges revoked at a minimum if they have not retired already and they should be investigated by the DOJ and if they were under pressure let them defend themselves in court by identifying their superiors for futher action. If for no other reason then to set the example for anyone who accepts that role in the future that when they are acting in their FAA designation (Which is the aviation equivelent of the PE status for Civil Engineers) they have a lot of responsibility to the flying public (i.e. the passengers and flight crews who are travelling on their aircraft). If they do not perform their duties properly they should be subject to criminal charges just like any other profession would be.
By the way the Technical Pilots do not Certify the aircraft and it's systems that is the role of the Flight Test Pilot E-UMs or in the past ARs, DERs, etc. The Technical Pilots are involved with developing the Training Requirements and Operational Procedures used by the airlines after. They are not E-UMs and/or ARs as far as I know unless they happened to be in a Flight Test Pilot position in a previous position before.
Unfortunately the DOJ, FBI and the FAA were in over their heads in this Max investigation and in addition for political reasons let Boeing sign a very easy agreement to avoid criminal charges and further investigation.

CanukinUSA wrote:

My guess is that Congress did not want to follow the paper trail on down from the CPE as it would clearly illustrate how the E-UMs/ARs were not doing their job for the FAA that they are supposed to be when they are acting in their AR or now E-UM role on the ODA system, probably under pressure from Boeing management. Congress were the ones responsible for allowing the changes to the laws that allowed Boeing to give the impression that they control their E-UMs and let them believe that their loyalty to Boeing was more important then their duties to the US taxpayer (i.e. the FAA). A few of the E-UMs/ARs involved should have their E-UMs privileges revoked at a minimum if they have not retired already and they should be investigated by the DOJ and if they were under pressure let them defend themselves in court by identifying their superiors for futher action. If for no other reason then to set the example for anyone who accepts that role in the future that when they are acting in their FAA designation (Which is the aviation equivelent of the PE status for Civil Engineers) they have a lot of responsibility to the flying public (i.e. the passengers and flight crews who are travelling on their aircraft). If they do not perform their duties properly they should be subject to criminal charges just like any other profession would be.
By the way the Technical Pilots do not Certify the aircraft and it's systems that is the role of the Flight Test Pilot E-UMs or in the past ARs, DERs, etc. The Technical Pilots are involved with developing the Training Requirements and Operational Procedures used by the airlines after. They are not E-UMs and/or ARs as far as I know unless they happened to be in a Flight Test Pilot position in a previous position before.
Unfortunately the DOJ, FBI and the FAA were in over their heads in this Max investigation and in addition for political reasons let Boeing sign a very easy agreement to avoid criminal charges and further investigation.

If you make the argument that a criminal act occurred you need to have the argument as to what criminal act occurred. It is not a criminal act to make an error in engineering design or analysis. It is however a criminal act to not follow FAA prescribed processes, which is why the only documented criminal act is failure to inform the AEG of the change in MCAS functionality.

LDRA wrote:

kalvado wrote:

LDRA wrote:

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

One may ask who signed (or put a PE stamp) certain documents submitted to the FAA. In general failure to read a document before signing it is not a legal excuse once there are issues with the document.

PE stamp means nothing. In complex system, it takes multiple disciplines, multiple companies through layers of supply chain to provide end product assurance. There are complex interactions involved among parties. The process ensures integrity, not some single person signing for it.

After all Boeing name doesn't mean much as well. Hopefully Comac will be a bit more serious with it when they buy leftovers of that b-word.

Pythagoras wrote:

It is not a criminal act to make an error in engineering design or analysis.

It depends on what a person with the same general knowledge and abilities as the accused would have done in the same situation. If a FAA employee with the same general knowledge and abilities were to say they would have different analysis in the same situation, it would open the door for criminal negligence.

Pythagoras wrote:

You aren't going to see a paper trail for the question that you are asking.

I was suggesting that Congress use the paper trail to find the individuals to interview, something they apparently did not do.

Pythagoras wrote:

The E-UM(s) responsible for finding compliance, as MCAS had been delegated to Boeing, would have evaluated each of the certification documents, of which there were many that were touched by MCAS, to see whether any of them would have required revision. The E-UM(s) would have considered what the appropriate means-of-compliance would be for the change whether that is similarity to existing systems, analysis, test, or analysis supported by test. Should a test been required, the E-UM(s) would have considered what level of testing is appropriate and under what flight scenarios taking into account FAA guidance as to how to interpret the regulations. As acknowledged in the JTAR report, the FAA guidance for how to address human factors was not sufficient. Thus, it is easy to fall into the erroneous conclusion that the only test required was to show that an MCAS failure mode was equivalency in its manifestation to an existing failure mode of a runaway stabilizer trim. The only place that cost or schedule would come into play here is what type of test would be required--bench test, full motion simulator, or flight test--and what scenarios to consider. With insufficient guidance from the regulators, one is then relying upon institutional knowledge and engineering judgment for safety. And this is where the error occurs in excluding the regulators and the technical pilots which otherwise should have been involved to validate that judgment decision. The rules in-place for how the MCAS system was delegated and how only catastrophic failures were to be documented kept the FAA from providing oversight.

One interpretation of what you wrote could be: In the presence of insufficient guidance from FAA on a particular set human factors, Boeing made choices that maximized its profit rather than safety, and the result is tragedy.

With the insufficient guidance, some person or persons within Boeing chose to rely on the four second rule that is not in any FAA document, instead of asking for more clarity from FAA, or conducting any tests to see if a typical pilot would recognize MCAS as a form of runaway trim and counteract it in four seconds. Complicating factors of course were Boeing's decisions to not tell the pilots about MCAS, MCAS's repeated activations that make it unlike runaway trim, and all the ancillary warnings that would be firing off due to the single failed AoA sensor that was causing MCAS to trigger.

The main reason to just go with the four second rule would be to save time and money.

We have the statements of the FAA employee on the Frontline program that is the subject of this thread saying after the first crash he raised the "human factors" issue with three different Boeing employees and still found no questioning of the idea that pilots would recognize MCAS as runaway trim.

It's hard for me to avoid the thought that there was a tacit agreement within Boeing to do everything possible to keep MCAS out of the catastrophic category to avoid all the costs that would entail.

In the end, Boeing did pay those costs, and far more. Victims families still suffer. Many Boeing employees lost their job as a result, starting with the CEO, and others left the company, and now one still faces criminal charges.

CanukinUSA wrote:

Unfortunately the DOJ, FBI and the FAA were in over their heads in this Max investigation and in addition for political reasons let Boeing sign a very easy agreement to avoid criminal charges and further investigation.

Thanks for the post. I agree with it all, and this part in general. I had hopes for a better investigation, but it seems that ship has sailed.

Revelation wrote:

Pythagoras wrote:

You aren't going to see a paper trail for the question that you are asking.

I was suggesting that Congress use the paper trail to find the individuals to interview, something they apparently did not do.

Pythagoras wrote:

The E-UM(s) responsible for finding compliance, as MCAS had been delegated to Boeing, would have evaluated each of the certification documents, of which there were many that were touched by MCAS, to see whether any of them would have required revision. The E-UM(s) would have considered what the appropriate means-of-compliance would be for the change whether that is similarity to existing systems, analysis, test, or analysis supported by test. Should a test been required, the E-UM(s) would have considered what level of testing is appropriate and under what flight scenarios taking into account FAA guidance as to how to interpret the regulations. As acknowledged in the JTAR report, the FAA guidance for how to address human factors was not sufficient. Thus, it is easy to fall into the erroneous conclusion that the only test required was to show that an MCAS failure mode was equivalency in its manifestation to an existing failure mode of a runaway stabilizer trim. The only place that cost or schedule would come into play here is what type of test would be required--bench test, full motion simulator, or flight test--and what scenarios to consider. With insufficient guidance from the regulators, one is then relying upon institutional knowledge and engineering judgment for safety. And this is where the error occurs in excluding the regulators and the technical pilots which otherwise should have been involved to validate that judgment decision. The rules in-place for how the MCAS system was delegated and how only catastrophic failures were to be documented kept the FAA from providing oversight.

One interpretation of what you wrote could be: In the presence of insufficient guidance from FAA on a particular set human factors, Boeing made choices that maximized its profit rather than safety, and the result is tragedy.

With the insufficient guidance, some person or persons within Boeing chose to rely on the four second rule that is not in any FAA document, instead of asking for more clarity from FAA, or conducting any tests to see if a typical pilot would recognize MCAS as a form of runaway trim and counteract it in four seconds. Complicating factors of course were Boeing's decisions to not tell the pilots about MCAS, MCAS's repeated activations that make it unlike runaway trim, and all the ancillary warnings that would be firing off due to the single failed AoA sensor that was causing MCAS to trigger.

The main reason to just go with the four second rule would be to save time and money.

We have the statements of the FAA employee on the Frontline program that is the subject of this thread saying after the first crash he raised the "human factors" issue with three different Boeing employees and still found no questioning of the idea that pilots would recognize MCAS as runaway trim.

It's hard for me to avoid the thought that there was a tacit agreement within Boeing to do everything possible to keep MCAS out of the catastrophic category to avoid all the costs that would entail.

.

I still doubt there was much argument. That would bring in aoa failure showing up as a multiple failures.
IMHO things were kept very quiet to avoid that very issue - it is ok as is, so it will still be ok with tweaks, nothing to see here, move along.
And I wonder if there are more such Easter eggs to find.

kalvado wrote:

I still doubt there was much argument. That would bring in aoa failure showing up as a multiple failures.
IMHO things were kept very quiet to avoid that very issue - it is ok as is, so it will still be ok with tweaks, nothing to see here, move along.

I've sen similar things in my engineering career. A certain set of plausible constructs are carefully stitched together. A certain kind of groupthink takes over to close the circle. Pushing back on such things is not good for one's career. If things go wrong, scapegoats are found.

And I wonder if there are more such Easter eggs to find.

For what it's worth EASA says they dedicated a lot of manpower to do a full independent review of the 737 flight controls and instrumentation, and found no issues other than the one that resulted in the "augmented AoA" solution to debut on the MAX10.

Revelation wrote:

kalvado wrote:

I still doubt there was much argument. That would bring in aoa failure showing up as a multiple failures.
IMHO things were kept very quiet to avoid that very issue - it is ok as is, so it will still be ok with tweaks, nothing to see here, move along.

I've sen similar things in my engineering career. A certain set of plausible constructs are carefully stitched together. A certain kind of groupthink takes over to close the circle. Pushing back on such things is not good for one's career. If things go wrong, scapegoats are found.

Been there. Just this summer I was told by ehs vp to shut up with my talk, otherwise the issue I am interested in is off the agenda, and I am not getting invite for the next discussion.

Pythagoras wrote:

Revelation wrote:

Pythagoras wrote:

The E-UM(s) responsible for finding compliance, as MCAS had been delegated to Boeing, would have evaluated each of the certification documents, of which there were many that were touched by MCAS, to see whether any of them would have required revision. The E-UM(s) would have considered what the appropriate means-of-compliance would be for the change whether that is similarity to existing systems, analysis, test, or analysis supported by test. Should a test been required, the E-UM(s) would have considered what level of testing is appropriate and under what flight scenarios taking into account FAA guidance as to how to interpret the regulations. As acknowledged in the JTAR report, the FAA guidance for how to address human factors was not sufficient. Thus, it is easy to fall into the erroneous conclusion that the only test required was to show that an MCAS failure mode was equivalency in its manifestation to an existing failure mode of a runaway stabilizer trim. The only place that cost or schedule would come into play here is what type of test would be required--bench test, full motion simulator, or flight test--and what scenarios to consider. With insufficient guidance from the regulators, one is then relying upon institutional knowledge and engineering judgment for safety. And this is where the error occurs in excluding the regulators and the technical pilots which otherwise should have been involved to validate that judgment decision. The rules in-place for how the MCAS system was delegated and how only catastrophic failures were to be documented kept the FAA from providing oversight.

For the 30th time. MCAS was NOT delegated. The FAA retained certification for MCAS. If the FAA would release all the documents they have been asked to you would know that.

FLYBY72 wrote:

Pythagoras wrote:

Revelation wrote:

For the 30th time. MCAS was NOT delegated. The FAA retained certification for MCAS. If the FAA would release all the documents they have been asked to you would know that.

I must have missed the other 29 times where you brought this up.

Delegated simply means that Boeing's E-UMs are reviewing the system architecture and finding compliance as to how the system meets the regulations. If it was not delegated to Boeing for finding compliance, Boeing would have been obligated to review with the FAA the change in functionality which happened during flight test in March 2016.

From the Joint Authorities Technical Review report Boeing 737 MAX Flight Control System Observations, Findings, and Recommendations

Finding F4.1-A: The JATR team finds it unclear how items to be presented to the
FAA BASOO staff are selected. Other authorities have published guidelines in the
matter, which typically require items to be presented to the authority based upon
critically, novelty, or past experience. [Note: In the context of the B737 MAX, the
JATR team’s assessment is that MCAS should have been considered a novelty
(and therefore clearly highlighted to the FAA technical staff) owing to the
important differences in function and implementation it has on the B737 MAX
compared with the previous MCAS installed on the B767-C2 (tanker).]

Finding F5.1-A: The FAA extensively delegated compliance findings on the
B737-8 MAX project to the Boeing ODA. Safety critical areas, including system
safety documents related to MCAS, were initially retained by the FAA and then
delegated to the Boeing ODA. (See also Findings F4.1-A, F4.1-B, and F4.1-C.)

The change in MCAS functionality which occurred during flight test in March 2016 should have been reviewed with the FAA. See Finding F4.1-A. At that time though, the FAA had delegated compliance finding to the Boeing ODA. See Finding F5.1-A.

Revelation wrote:

One interpretation of what you wrote could be: In the presence of insufficient guidance from FAA on a particular set human factors, Boeing made choices that maximized its profit rather than safety, and the result is tragedy.

That would be Ralph Nader's position.

One standard that we should agree upon is that if an airplane is found in compliance to the FAA regulations than the manufacture can state that the airplane is a "safe airplane". Boeing's assertion is it followed all regulatory guidance and thus it believed the airplane to have been properly certified and thus "safe". It is only when in-service events occur and new information is brought to bear that the airplane becomes "unsafe".

The certification process which proved insufficient to address MCAS were as follows according the Joint Technical Authorities Report:
- Airplane level assessment

"...the team determined that the process did not adequately address cumulative effects, system integration, and human factors issues."

- Insufficient guidance for human factors

"The JATR team determined that some regulations, policies, and compliance methods that address safety issues related to system integration and human factors and that were available at the time of the B737 MAX certification process were not applied to the B737 MAX or were only partially applied in a way that failed to achieve the full safety benefit. In some cases, this failure to achieve the full safety benefit associated with the application of the latest compliance methods was because the FAA regulations and guidance were out of date. Another area the JATR team determined is in need of an update is the guidance concerning pilot recognition time and pilot reaction time to failures. Additionally, the JATR team determined that new and novel application of specific design features was not adequately considered."

I get it. People want to have an easy to explain narrative as to why the accident happened. It is easier to point the finger at Forkner or some faceless mid-level manager. Families don't want to hear that the process failed them.

Revelation wrote:

The main reason to just go with the four second rule would be to save time and money.

The main reason was that this was the standard by which the airplane had been previously certified. If it is certifiable it is a safe airplane.

Revelation wrote:

We have the statements of the FAA employee on the Frontline program that is the subject of this thread saying after the first crash he raised the "human factors" issue with three different Boeing employees and still found no questioning of the idea that pilots would recognize MCAS as runaway trim.

I'm not sure how this comment is relevant as Boeing initiated development of a software fix the day after the Lion Air crash. I would point back to the previous point that the concerns of these employees raised is validation that FAA regulatory guidance on human factors was insufficient. If it was sufficient, these employees would not have been raising the issue.

Revelation wrote:

It's hard for me to avoid the thought that there was a tacit agreement within Boeing to do everything possible to keep MCAS out of the catastrophic category to avoid all the costs that would entail.

Or was it just that the engineers were doing what they were thinking was the right thing but made a mistake because the process allowed them to not include everyone that should have had a say in the discussion? In the absence of guidance from the FAA on how to address human factors, one can see how MCAS could have been considered "hazardous".

I am going to add some new information here based upon my experience with the 737 airplane that is germane to the discussion. The design philosophy of the 737 airplane, designed in the 1960s, is different than more modern aircraft. It relies much more on pilot corrective action to maintain adequate level of safety. Specifically, the 737 is a two-hydraulic system with manual reversion back-up. The primary flight control surfaces are all therefore physically connected to the control wheel and column. What this means is that the flight controls need to be jam tolerant. If any cable gets hung up on a pulley, the pilot or system needs to break that jam. There are design features which allow a pilot's control column to break free from the first officer's. There are shear pins which will decouple left and right ailerons should one jam.

With this philosophy used through out the 737 certification documents, it is understandable how an assessment would follow other analyses which had been put forward and for which service experience had indicated provided an acceptable level of safety.

Revelation wrote:

CanukinUSA wrote:

Unfortunately the DOJ, FBI and the FAA were in over their heads in this Max investigation and in addition for political reasons let Boeing sign a very easy agreement to avoid criminal charges and further investigation.

Thanks for the post. I agree with it all, and this part in general. I had hopes for a better investigation, but it seems that ship has sailed.

If we agree that Boeing followed the certification process and guidelines, which the JTAR report indicates that they did. Then the only criminal charges would be related to the failure to inform the AEG of the change of MCAS functionality which occurred in March 2016. This is the change the Mark Forkner was never told of. He had to find out by himself.

I reiterate my point here. The 737Max Program lost configuration control in March 2016 and the regulatory system in-place was not robust enough to catch it.

Pythagoras wrote:

Revelation wrote:

The main reason to just go with the four second rule would be to save time and money.

The main reason was that this was the standard by which the airplane had been previously certified. If it is certifiable it is a safe airplane.

Those previous airplanes didn't have MCAS, Their failure modes were far simpler. They didn't have to deal with algorithms that could do repeated activation that fatigued the crew. It's the flimsiest of excuses, yet the one that happens to save Boeing the most time and money.

You seem to be addressing the question "how can Boeing excuse itself for doing what benefited Boeing the most" rather than "why did Boeing do what benefited Boeing the most".

The answer to the first lies in Boeing gaming the system and threading the needle so the least possible work could be done, mainly by applying old regulations and practices to new technology. The answer to the second is to maximize profit.

Why was MCAS considered part of the speed trim system? Just because it was a computer that took an input to control the stab? That seems rather broad. I thought speed trim took in the input of speed to adjust the stab, while MCAS took in the input of AOA. That seems like a bad assumption that would not fall under following a rule. That's where it all fell apart in the process.

Noshow wrote:

Not making Mulally CEO was a huge mistake Boeing made. Up to that time the setup for the follow on programs was timed right.

Except Mullaly designed the 787 production system that has caused so many problems.

StTim wrote:

kalvado wrote:

Revelation wrote:

Or maybe it was not inadvertent, but we'll never know because Boeing has managed to keep the key decision makers in that loop under wraps, and Congress never followed the paper trail from 737 Chief Engineer Teal (who says he only heard about multiple activation via the media and just trusted his underlings on the flight control team without any due diligence) down to whomever made the key decisions.

And what would that change, after all? It is possibly possible to put someone (two, ten ones) behind the bars.
Would it resurrect those who died? Would it help MAX to be a better plane? Would it make future planes safer?
Any follow up is only as good as it would make for some better future. Putting blame on someone personally would hardly change problematic workflows, and not necessarily make people more willing to share concerns.
So maybe there is a better option than pinpointing guilty?

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

The fact that the CEOs of Boeing and BCA were terminated shows that leadership is being held responsible.

Mullaly, who had done a great job on the 777, only got a very limited budget on a tight schedule by the "new owners" for the Dreamliner leading to that overly complex global production setup. So he decided to leave and did another great job elsewhere.
Things got messed up between the smart Yellowstone concepts and the 787. This is when Boeing went off course from my view. Then they tuned the stock price instead of properly budgeting development costs. Add MAX troubles, production hiccups, the unneeded fight between BCA sites and too much early retired core staff and you see where this took us.

Revelation wrote:

Pythagoras wrote:

Revelation wrote:

The main reason to just go with the four second rule would be to save time and money.

The main reason was that this was the standard by which the airplane had been previously certified. If it is certifiable it is a safe airplane.

Those previous airplanes didn't have MCAS, Their failure modes were far simpler. They didn't have to deal with algorithms that could do repeated activation that fatigued the crew. It's the flimsiest of excuses, yet the one that happens to save Boeing the most time and money.

You seem to be addressing the question "how can Boeing excuse itself for doing what benefited Boeing the most" rather than "why did Boeing do what benefited Boeing the most".

The answer to the first lies in Boeing gaming the system and threading the needle so the least possible work could be done, mainly by applying old regulations and practices to new technology. The answer to the second is to maximize profit.

Boeing has always "threaded the needle" so the least possible work could be done to minimize the certification costs. For example, both the 737NG and the 747-8 were permitted to re-wing the airplanes without major structural test. There is always a balancing act as to how much testing is required to show compliance to the regulations. This is why having clear guidance from the FAA is important, which was lacking here with regards to human factors.

I would remind you that it is not the 4 second rule that caused both accidents. What caused both accidents was the failure to bring back the stabilizer into trim before the repeat firing of MCAS. In the case of Ethiopia ET302, a contributing factor likely was that the pilots were not fully aware of how aerodynamic forces would affect their ability to re-trim the airplane.

Pythagoras wrote:

Revelation wrote:

Pythagoras wrote:

The main reason was that this was the standard by which the airplane had been previously certified. If it is certifiable it is a safe airplane.

Those previous airplanes didn't have MCAS, Their failure modes were far simpler. They didn't have to deal with algorithms that could do repeated activation that fatigued the crew. It's the flimsiest of excuses, yet the one that happens to save Boeing the most time and money.

You seem to be addressing the question "how can Boeing excuse itself for doing what benefited Boeing the most" rather than "why did Boeing do what benefited Boeing the most".

The answer to the first lies in Boeing gaming the system and threading the needle so the least possible work could be done, mainly by applying old regulations and practices to new technology. The answer to the second is to maximize profit.

Boeing has always "threaded the needle" so the least possible work could be done to minimize the certification costs. For example, both the 737NG and the 747-8 were permitted to re-wing the airplanes without major structural test. There is always a balancing act as to how much testing is required to show compliance to the regulations. This is why having clear guidance from the FAA is important, which was lacking here with regards to human factors.

I would remind you that it is not the 4 second rule that caused both accidents. What caused both accidents was the failure to bring back the stabilizer into trim before the repeat firing of MCAS. In the case of Ethiopia ET302, a contributing factor likely was that the pilots were not fully aware of how aerodynamic forces would affect their ability to re-trim the airplane.

Frankly speaking, it seems that stabilizer aerodynamic force was forgotten across the board, including Boeing itself. Talk about the loss of design control...

Noshow wrote:

Mullaly, who had done a great job on the 777, only got a very limited budget on a tight schedule by the "new owners" for the Dreamliner leading to that overly complex global production setup. So he decided to leave and did another great job elsewhere.
Things got messed up between the smart Yellowstone concepts and the 787. This is when Boeing went off course from my view. Then they tuned the stock price instead of properly budgeting development costs. Add MAX troubles, production hiccups, the unneeded fight between BCA sites and too much early retired core staff and you see where this took us.

Boeing started off course before the merger in 1997. Inept fiascos like DCAC/MRM and selling off a World Class flight training organization to a bottom feeder of training - and violating multiple labor laws in the process - occurred before the 787 and merger.

You have executives making decisions for their own personal gain and face savings, rather than what was best for the company.

I don’t necessarily share the same enthusiasm for Alan Mullaly as others do, although he would have been a lot better than the likes of Jim McNerney. Boeing Commercial’s market share went from about 60% to 40% while Alan was head of BCA. I’ve heard others say he was very unpredictable at times.

I’m not confident in today’s leadership either. Dave Calhoun just seems like more if the same - a lot of lip service about getting back to engineering greatness while he brings in yet another GE crony as CFO.

There are some glimmers of hope. For example, the 787 engineering is well run. The 787 Chief Project Engineer is an impressive well respected and well intended individual. He wants to put out a quality airplane.

However, I’ve never met in person the 777X CPE (of 737 MAX CPE notoriety) but from what I can tell, he seems like kind of idiot. 777X leadership seems to blame others for their own poor management.

It’s pretty sad. Some of us lived through the mismanagement of Boeing for close to 30 years and seen up close how a once great company has been ruined. For what? Individuals’ greed and egos.

Chemist wrote:

Pythagoras wrote:

Revelation wrote:

Those previous airplanes didn't have MCAS, Their failure modes were far simpler. They didn't have to deal with algorithms that could do repeated activation that fatigued the crew. It's the flimsiest of excuses, yet the one that happens to save Boeing the most time and money.

You seem to be addressing the question "how can Boeing excuse itself for doing what benefited Boeing the most" rather than "why did Boeing do what benefited Boeing the most".

The answer to the first lies in Boeing gaming the system and threading the needle so the least possible work could be done, mainly by applying old regulations and practices to new technology. The answer to the second is to maximize profit.

Boeing has always "threaded the needle" so the least possible work could be done to minimize the certification costs. For example, both the 737NG and the 747-8 were permitted to re-wing the airplanes without major structural test. There is always a balancing act as to how much testing is required to show compliance to the regulations. This is why having clear guidance from the FAA is important, which was lacking here with regards to human factors.

I would remind you that it is not the 4 second rule that caused both accidents. What caused both accidents was the failure to bring back the stabilizer into trim before the repeat firing of MCAS. In the case of Ethiopia ET302, a contributing factor likely was that the pilots were not fully aware of how aerodynamic forces would affect their ability to re-trim the airplane.

The repeated pattern of disagreement I see here is that you feel the FAA should not allow Boeing to design an unsafe aircraft. Whereas many of us believe that Boeing is responsible for designing a safe aircraft, and the FAA is there to monitor compliance to regulations. But the FAA regulations are minimum standards and do not remove the requirement of the vendor to make a safe aircraft. No set of regulations can cover all bases, and the FAA cannot be expected to have the expertise to essentially fully understand every detail of an aircraft to ensure that it is safe.

You appear to be saying that if any aircraft isn't safe, but somehow gets certified because it meets the FAA regulations, the aircraft's safety flaws are the FAA's fault.

I appreciate your comment here because it identifies the crucial issue in the discussion. In effect we are talking past each other when we discuss what is "safe".

In my view, safety is binary. An airplane can either be "safe" or "unsafe". There is no such thing as "more safe".

The FAA regulations prescribe are not the minimum level of safety but are instead the acceptable level of safety which balances cost and risk.

It doesn't matter what business that one is in, it is the responsibility of the engineers to minimize cost while meeting requirements. I always told younger engineers on my team that there job was to get a zero margin-of-safety in their analysis. If they weren't getting a zero margin then they weren't doing their job. Is that attitude trading cost for safety? Those on this thread might argue that this would be the case.

And yes it is the responsibility of the regulators to monitor the regulations and ensure that they are adequate to ensure safety. This is what the NTSB does after every accident where causes are identified and changes to regulations recommended to the FAA. This is what the reporting under the Continued Operational Safety program is meant to address as well.

I'd challenge you to come up with a requirement for safety which is not embodied in the regulations.

DenverTed wrote:

Why was MCAS considered part of the speed trim system? Just because it was a computer that took an input to control the stab? That seems rather broad. I thought speed trim took in the input of speed to adjust the stab, while MCAS took in the input of AOA. That seems like a bad assumption that would not fall under following a rule. That's where it all fell apart in the process.

The STS and MCAS functions are performed by the same computer. STS was introduced on the NG, however after FAA certification. When they tried to get EASA certification for the NG they would not certify the aircraft unless STS was installed, subsequently it became standard for ail aircraft.

Pythagoras wrote:

Chemist wrote:

Pythagoras wrote:

Boeing has always "threaded the needle" so the least possible work could be done to minimize the certification costs. For example, both the 737NG and the 747-8 were permitted to re-wing the airplanes without major structural test. There is always a balancing act as to how much testing is required to show compliance to the regulations. This is why having clear guidance from the FAA is important, which was lacking here with regards to human factors.

I would remind you that it is not the 4 second rule that caused both accidents. What caused both accidents was the failure to bring back the stabilizer into trim before the repeat firing of MCAS. In the case of Ethiopia ET302, a contributing factor likely was that the pilots were not fully aware of how aerodynamic forces would affect their ability to re-trim the airplane.

The repeated pattern of disagreement I see here is that you feel the FAA should not allow Boeing to design an unsafe aircraft. Whereas many of us believe that Boeing is responsible for designing a safe aircraft, and the FAA is there to monitor compliance to regulations. But the FAA regulations are minimum standards and do not remove the requirement of the vendor to make a safe aircraft. No set of regulations can cover all bases, and the FAA cannot be expected to have the expertise to essentially fully understand every detail of an aircraft to ensure that it is safe.

You appear to be saying that if any aircraft isn't safe, but somehow gets certified because it meets the FAA regulations, the aircraft's safety flaws are the FAA's fault.

I appreciate your comment here because it get identifies the crucial issue in the discussion.

In my view, safety is binary. An airplane can either be "safe" or "unsafe". There is no such thing as "more safe".

The FAA regulations prescribe are not the minimum level of safety but are instead the acceptable level of safety which balances cost and risk.

It doesn't matter what business that one is in, it is the responsibility of the engineers to minimize cost while meeting requirements. I always told younger engineers on my team that there job was to get a zero margin-of-safety in their analysis. If they weren't getting a zero margin then they weren't doing their job. Is that attitude trading cost for safety? Those on this thread might argue that this would be the case.

And yes it is the responsibility of the regulators to monitor the regulations and ensure that they are adequate to ensure safety. This is what the NTSB does after every accident where causes are identified and changes to regulations recommended to the FAA. This is what the reporting under the Continued Operational Safety program is meant to address as well.

I'd challenge you to come up with a requirement for safety which is not embodied in the regulations.

That's exactly what corporate lawyers and Boeing management would like to hear: FAA approval = safe. Management can barrier themselves from that pesky topic of safety, and concentrate on the important task of elevating Boeing stock price

The problem with regulation driven safety is regulations are generalized, thus requires interpretation for individual application. So it's not black and white.
Looking at MCAS as example. Boeing was able to decompose MCAS and hide in multiple systems under certification. It's basically an attempt at organization level to deceit. Regulation can do nothing to ill intended applications

LDRA wrote:

The problem with regulation driven safety is regulations are generalized, thus requires interpretation for individual application. So it's not black and white.

Correct, which is why Boeing has extensive discussions with the FAA as to means-of-compliance where there is not precedence for how to certify. With regards to MCAS, the JTAR report identifies that the process was not adequate for the FAA to be adequately engaged in the discussion as to how to certify MCAS. As I have stated before, the change of functionality from high speed only to low speed which happened in March 2016 should have prompted a reassessment of agreements for certification basis, means of compliance, and degree of delegation. That did not happen which points to a failure of process.

LDRA wrote:

Looking at MCAS as example. Boeing was able to decompose MCAS and hide in multiple systems under certification. It's basically an attempt at organization level to deceit. Regulation can do nothing to ill intended applications.

If MCAS was hid, it was inadvertent. Anyone who has worked on a derivative airplane program knows that one provides documentation in support of certification that the existing certification documents are revised with an appendix that identifies how the derivative changes what analysis was previously submitted. The effect here was that the cumulative effect of MCAS was spread among different documents. At the time of the change of MCAS function to the low-speed flight envelope, all of these documents would have been essentially completed where MCAS was functioning only under a high-speed and high-g maneuver. Even this would not have been a problem if the FAA and Technical Pilots had been fully informed of the magnitude of the changes to MCAS.

Pythagoras wrote:

LDRA wrote:

The problem with regulation driven safety is regulations are generalized, thus requires interpretation for individual application. So it's not black and white.

Correct, which is why Boeing has extensive discussions with the FAA as to means-of-compliance where there is not precedence for how to certify. With regards to MCAS, the JTAR report identifies that the process was not adequate for the FAA to be adequately engaged in the discussion as to how to certify MCAS. As I have stated before, the change of functionality from high speed only to low speed which happened in March 2016 should have prompted a reassessment of agreements for certification basis, means of compliance, and degree of delegation. That did not happen which points to a failure of process.

LDRA wrote:

Looking at MCAS as example. Boeing was able to decompose MCAS and hide in multiple systems under certification. It's basically an attempt at organization level to deceit. Regulation can do nothing to ill intended applications.

If MCAS was hid, it was inadvertent. Anyone who has worked on a derivative airplane program knows that one provides documentation in support of certification that the existing certification documents are revised with an appendix that identifies how the derivative changes what analysis was previously submitted. The effect here was that the cumulative effect of MCAS was spread among different documents. At the time of the change of MCAS function to the low-speed flight envelope, all of these documents would have been essentially completed where MCAS was functioning only under a high-speed and high-g maneuver. Even this would not have been a problem if the FAA and Technical Pilots had been fully informed of the magnitude of the changes to MCAS.

I disagree that it was inadvertent that MCAS was hidden. But I do subscribe to the view that those who pushed that did not understand the danger that MCAS especially when changed to the low speed envelope really created.

This is more an overall failure of process and weak controls that malice to introduce a dangerous plane into service.

The direct cause of MCAS failure is the absence of 2.5deg limiter to MCAS output command in final implementation. Whether that's due to deficiency in Boeing low level function requirements, or FCC box supplier issue is not clear. Either way, it shows Boeing system engineering/product integrity process is broken. FAA or FAA delegates can only determine safety based on artifacts the process produces.

LDRA wrote:

The direct cause of MCAS failure is the absence of 2.5deg limiter to MCAS output command in final implementation. Whether that's due to deficiency in Boeing low level function requirements, or FCC box supplier issue is not clear. Either way, it shows Boeing system engineering/product integrity process is broken. FAA or FAA delegates can only determine safety based on artifacts the process produces.

One does get the impression that this is the case. The length of time that is required for the 777X to become certified has characteristics of issues with software development. As mentioned previously, if the criticality of software needs to be elevated to a higher level one cannot do that after the fact. All the Personal Mobility start-ups are in for a rude-awakening on this....

LDRA wrote:

kalvado wrote:

StTim wrote:

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

It depends who is the chief engineer. The chief engineers of all dynamic and innovative engineering companies are often best technical engineers. The typical career path of these people is doing hardcore technical work until mid 30s, gaining respect and recognitions by solving many hard problems. Then they move on to be project management, and finally to the top engineering officer of the program.

However, many aging and decay companies often promote incompetent engineers from project management or operation background to important program leadership.

The program lead from hardcore engineer has uncanny abilities to sense problem even this is not his main domain.

https://www.discovermagazine.com/the-sc ... ce-shuttle

This is a somewhat similar sort of disaster. There may be a better NYT article but it is behind a more formidable paywall. You likely could get it through any major library system.

I as disturbed by a statement that a plane is safe/not safe and that it is binary. Much prefer a statistical/probability although that can be compatible with 'binary'.

I would categorize MCAS as an Angle of attack trim system. Why was that combined with or called a speed trim system? Is 737 speed measured by one sensor, like AOA was based on one sensor? What was the history and nature of the failure of the STS system like? Was it reasonable for MCAS to be deemed analogous to that system?

DenverTed wrote:

Why was MCAS considered part of the speed trim system? Just because it was a computer that took an input to control the stab? That seems rather broad. I thought speed trim took in the input of speed to adjust the stab, while MCAS took in the input of AOA. That seems like a bad assumption that would not fall under following a rule. That's where it all fell apart in the process.

MCAS was a part of the speed trim system because that's what saved Boeing the most time and money. They leveraged the KC-46 MCAS to avoid the scrutiny of a new system, they just said they were moving it into the 737 FCC. They avoided mentioning the fact that 767 has a totally different AoA system than 737 does.

Before MCAS, STS was just a pilot aid, something to reduce workload.

After MCAS, STS was now required to meet the stick force FARs, but Boeing threaded the needle carefully by using the four second "rule of thumb" to avoid implementing the kind of redundancy MAX now has after the two crashes.

Noshow wrote:

Things got messed up between the smart Yellowstone concepts and the 787. This is when Boeing went off course from my view. Then they tuned the stock price instead of properly budgeting development costs. Add MAX troubles, production hiccups, the unneeded fight between BCA sites and too much early retired core staff and you see where this took us.

It was by intent. Harry Stonecipher showed up and said he found a fine engineering firm and intentionally changed it into a dollars and cents business.

Pythagoras wrote:

I would remind you that it is not the 4 second rule that caused both accidents. What caused both accidents was the failure to bring back the stabilizer into trim before the repeat firing of MCAS. In the case of Ethiopia ET302, a contributing factor likely was that the pilots were not fully aware of how aerodynamic forces would affect their ability to re-trim the airplane.

The four second rule was the reason Boeing gave for MCAS not being in the catastrophic safety category, which would have brought with it more analysis and testing requirements that very well could have found flaws such as reliance on a single AoA, multiple activation and excess authority.

Boeing has now admitted the MCAS v1 put too much workload on the pilots and that is the root cause of the accidents, not the inability of the pilots to cope with the MCAS system they didn't even know was on the airplane.

Chemist wrote:

The repeated pattern of disagreement I see here is that you feel the FAA should not allow Boeing to design an unsafe aircraft. Whereas many of us believe that Boeing is responsible for designing a safe aircraft, and the FAA is there to monitor compliance to regulations. But the FAA regulations are minimum standards and do not remove the requirement of the vendor to make a safe aircraft. No set of regulations can cover all bases, and the FAA cannot be expected to have the expertise to essentially fully understand every detail of an aircraft to ensure that it is safe.

You appear to be saying that if any aircraft isn't safe, but somehow gets certified because it meets the FAA regulations, the aircraft's safety flaws are the FAA's fault.

Not only that, but it's OK to game the system and treat rules of thumb that aren't even in the regulations as acceptable till proven otherwise.

They should be viewing FAA as their partners in creating a safe airplane, instead they position themselves as poachers and FAA as gamekeepers.

It's funny to read people saying how important FAA's role is without them acknowledging that it was Boeing that lobbied Congress to weaken FAA oversight of Boeing.

In the end, it was Boeing that brought all this upon itself: two crashes with major loss of life, record long groundings still in effect in some of the biggest aviation markets in the world, production stopped and only now resuming at a much reduced pace, loss of confidence in its future products by customers and regulators, billions of dollars of debt load to carry into the future, huge delays in ongoing projects, aging narrow body product losing market share with no new clean sheet program anywhere in sight.

LDRA wrote:

kalvado wrote:

StTim wrote:

I agree but what is happening at the moment is those in leadership positions are not being held responsible for their actions. What chance they, and Boeing, have really learnt their lesson?

There is something about Chief Engineer mentioned just above, and basically he knew nothing about the situation. While his actions are (criminally?) negligent, I don't see anyone above him to be really in the know of technical details. So it would fall on lower level engineering...

Just FYI, chief engineer daily job is more like a project manager. Chief engineer is not going to review and approve detailed design changes. Aircraft is a complex system

If you want to say engineering management failed to install proper change management process, that would probably stick

For what its worth, that argument doesn't sit comfortably with me.
Accepting that a Programme Chief Engineer sits in a Programme team, the role by definition has to be Engineering compliance Governance, surely.
In my company, the Chief Engineer is the guy that goes to prison if the product kills someone (that it's not supposed to ......)
The entirety of the role is to resist programme pressure to compromise product safety IMO

Rgds

LDRA wrote:

The direct cause of MCAS failure is the absence of 2.5deg limiter to MCAS output command in final implementation. Whether that's due to deficiency in Boeing low level function requirements, or FCC box supplier issue is not clear. Either way, it shows Boeing system engineering/product integrity process is broken. FAA or FAA delegates can only determine safety based on artifacts the process produces.

For what its worth, that's my take on it too. My fear is that hiding behind Forkner provides an opportunity to keep these flaws in the system....

Rgds

Revelation wrote:

Before MCAS, STS was just a pilot aid, something to reduce workload.

This is not true. JAA (now EASA) required Boeing to install STS on a new derivative model of 737 (737 classic) it sought to certify in Europe. It was the JAAs view that the 737 did not meet certification requirements, the FAA had already certified the derivative then. STS was installed and became a standard feature on all 737s.

STS was not a pilots aid, it was a certification requirement.

I see that people are forgetting about Forkner's “Jedi mind tricks” that he performed with the airlines which were requesting retraining.

His chat messages about the MCAS changes and lies to the FAA can be interpreted in many ways, as he was not the only one responsible for the certification. However, these Jedi mind tricks reveal an alleged willingness to cheat on anything, on his own responsability.

zeke wrote:

Revelation wrote:

Before MCAS, STS was just a pilot aid, something to reduce workload.

This is not true. JAA (now EASA) required Boeing to install STS on a new derivative model of 737 (737 classic) it sought to certify in Europe. It was the JAAs view that the 737 did not meet certification requirements, the FAA had already certified the derivative then. STS was installed and became a standard feature on all 737s.

STS was not a pilots aid, it was a certification requirement.

Certification requirements are ultimately aimed at being safety requirements - possibly via reducing workload, ensuring integrity of the airframe, or making operation more intuitive.
There are situation where certification process is a nuisance by itself, but the underlying requirements appear generally sound. And as many safety requirements, they are not written in ink, but in blood.