oldJoe wrote:

Pythagoras wrote :
It shows that the 737NG family and A320 family (excluding A320 Neo and 737Max) have the same accident rate per million departures at 0.08 for fatal accidents and 0.18 for hull loss. From a high level view, there is no real reason, safety-wise at least, why the A320's fly-by-wire is any better than the 737's proven cable-driven architecture

Presenting numbers that play in my cards and real reality are not the same! Why are the 737 classics listed separately ? 737 classic first delivery November 1984, A320 April 1987, 737 NG December 1997. So the Classic`s should be on the list together with the NG`s!
Why is the Max being excluded? Correctly, that would offer an absolutely bad picture for the 737 and should therefore be at the top of the list and that is the answer which is the safer system!

It is totally legitimate to compare 737NG and A320 as two families within same generation, especially when generational evolution is analyzed. Worst thing you can say is that B was late in introducing that generation, but someone is always first and someone else is last.
And failure/crash statistics is naturally more than a single number. Bathtub curve for individual items, teething issues for models - those need to be taken into account. Once teething issues of MAX are resolved, it is totally reasonable to consider "post-2020 MAX" statistics without those 2 crashes as well. Hopefully those numbers will be much better in a long run.
This statistics is not for blaming or shaming only. Future projections, improvements and learning use those numbers as well.

kalvado wrote:

oldJoe wrote:

Pythagoras wrote :
It shows that the 737NG family and A320 family (excluding A320 Neo and 737Max) have the same accident rate per million departures at 0.08 for fatal accidents and 0.18 for hull loss. From a high level view, there is no real reason, safety-wise at least, why the A320's fly-by-wire is any better than the 737's proven cable-driven architecture

Presenting numbers that play in my cards and real reality are not the same! Why are the 737 classics listed separately ? 737 classic first delivery November 1984, A320 April 1987, 737 NG December 1997. So the Classic`s should be on the list together with the NG`s!
Why is the Max being excluded? Correctly, that would offer an absolutely bad picture for the 737 and should therefore be at the top of the list and that is the answer which is the safer system!

It is totally legitimate to compare 737NG and A320 as two families within same generation, especially when generational evolution is analyzed. Worst thing you can say is that B was late in introducing that generation, but someone is always first and someone else is last.
And failure/crash statistics is naturally more than a single number. Bathtub curve for individual items, teething issues for models - those need to be taken into account. Once teething issues of MAX are resolved, it is totally reasonable to consider "post-2020 MAX" statistics without those 2 crashes as well. Hopefully those numbers will be much better in a long run.
This statistics is not for blaming or shaming only. Future projections, improvements and learning use those numbers as well.

One could argue that, with a first flight in February 1987, the A320 is closer in date to the 737 Classic (first flight in February 1984) than to the 737NG (first flight February 1997). So, not sure why the need to separate the 737 Classics to the NGs.

usa330300 wrote:

PBS, Frontline and the New York Times are hardly distinguished in any manner.

Only to people who don't like what they're hearing. On the contrary, Frontline is widely known as one of the last sources of news that is not only very well researched, but right down the middle on the bias scale. In the last five years, it seems we have to remind people that just because what a media outlet reports is unflattering to you or you interests, doesn't make what they are reporting untrue.

Cdydatzigs wrote:

usa330300 wrote:

PBS, Frontline and the New York Times are hardly distinguished in any manner.

Only to people who don't like what they're hearing. On the contrary, Frontline is widely known as one of the last sources of news that is not only very well researched, but right down the middle on the bias scale. In the last five years, it seems we have to remind people that just because what a media outlet reports is unflattering to you or you interests, doesn't make what they are reporting untrue.

I heartfully agree with you, someone created a special term for this kind of reaction: fake news... We know when it was used.

WayexTDI wrote:

kalvado wrote:

oldJoe wrote:

Presenting numbers that play in my cards and real reality are not the same! Why are the 737 classics listed separately ? 737 classic first delivery November 1984, A320 April 1987, 737 NG December 1997. So the Classic`s should be on the list together with the NG`s!
Why is the Max being excluded? Correctly, that would offer an absolutely bad picture for the 737 and should therefore be at the top of the list and that is the answer which is the safer system!

It is totally legitimate to compare 737NG and A320 as two families within same generation, especially when generational evolution is analyzed. Worst thing you can say is that B was late in introducing that generation, but someone is always first and someone else is last.
And failure/crash statistics is naturally more than a single number. Bathtub curve for individual items, teething issues for models - those need to be taken into account. Once teething issues of MAX are resolved, it is totally reasonable to consider "post-2020 MAX" statistics without those 2 crashes as well. Hopefully those numbers will be much better in a long run.
This statistics is not for blaming or shaming only. Future projections, improvements and learning use those numbers as well.

One could argue that, with a first flight in February 1987, the A320 is closer in date to the 737 Classic (first flight in February 1984) than to the 737NG (first flight February 1997). So, not sure why the need to separate the 737 Classics to the NGs.

There is a significant design change between 4 generations if 737, so considering them separately is totally reasonable. You can add some narrative about relative timing of different generations vs other manufacturers, but as if 2010 NG and 320 were the current gen slated for refresh, and as of 2020 NG and 320 CEO are previous gen, max and neo being latest one.

kalvado wrote:

WayexTDI wrote:

kalvado wrote:

It is totally legitimate to compare 737NG and A320 as two families within same generation, especially when generational evolution is analyzed. Worst thing you can say is that B was late in introducing that generation, but someone is always first and someone else is last.
And failure/crash statistics is naturally more than a single number. Bathtub curve for individual items, teething issues for models - those need to be taken into account. Once teething issues of MAX are resolved, it is totally reasonable to consider "post-2020 MAX" statistics without those 2 crashes as well. Hopefully those numbers will be much better in a long run.
This statistics is not for blaming or shaming only. Future projections, improvements and learning use those numbers as well.

One could argue that, with a first flight in February 1987, the A320 is closer in date to the 737 Classic (first flight in February 1984) than to the 737NG (first flight February 1997). So, not sure why the need to separate the 737 Classics to the NGs.

There is a significant design change between 4 generations if 737, so considering them separately is totally reasonable. You can add some narrative about relative timing of different generations vs other manufacturers, but as if 2010 NG and 320 were the current gen slated for refresh, and as of 2020 NG and 320 CEO are previous gen, max and neo being latest one.

Then why separate A300-600s & A310s? The A300-600 is basically the A310 system-wise and wing-wise ported over to the A300B4 fuselage.
Similarly, why separate A330s and A340s? They are the same generation, same fuselage and wings (for the A340-200/-300) and same systems.
And why bundle the MD-80 and MD-90 but keep the 717 separate?

I think that graph has some merits, but it has some flaws too.

Cdydatzigs wrote:

Frontline is widely known as one of the last sources of news that is not only very well researched, but right down the middle on the bias scale.

And they try so hard to keep from leaning Left.

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

WayexTDI wrote:

kalvado wrote:

WayexTDI wrote:

One could argue that, with a first flight in February 1987, the A320 is closer in date to the 737 Classic (first flight in February 1984) than to the 737NG (first flight February 1997). So, not sure why the need to separate the 737 Classics to the NGs.

There is a significant design change between 4 generations if 737, so considering them separately is totally reasonable. You can add some narrative about relative timing of different generations vs other manufacturers, but as if 2010 NG and 320 were the current gen slated for refresh, and as of 2020 NG and 320 CEO are previous gen, max and neo being latest one.

Then why separate A300-600s & A310s? The A300-600 is basically the A310 system-wise and wing-wise ported over to the A300B4 fuselage.
Similarly, why separate A330s and A340s? They are the same generation, same fuselage and wings (for the A340-200/-300) and same systems.
And why bundle the MD-80 and MD-90 but keep the 717 separate?

I think that graph has some merits, but it has some flaws too.

The person that I share my house with knows this data like the back of one's hand. In fact better. I've picked up a few things over the years. There are a number of step changes in technology that occur over the years which make grouping the airplanes appropriate. The data for 1st generation airplanes is skewed by training accidents, primarily engine out, which occurred before high-fidelity simulators were adopted. Ground Proximity Warning Systems (GPWS), Traffic Collision Avoidance System (TCAS), and Wind Shear Detection and Avoidance procedures were introduced which greatly reduced accidents. Technology like laser ring gyros were introduced on 757/767. In the current generation of aircraft, GPS supplanted other systems and is used for tailored approaches. Heads up display units permit pilots to keep their eyes outside rather than inside the flight deck. It is usual that widespread adoption of these technologies occurs when a new model or major derivative is introduced.

Elkadad313 wrote:

Cdydatzigs wrote:

Frontline is widely known as one of the last sources of news that is not only very well researched, but right down the middle on the bias scale.

And they try so hard to keep from leaning Left.

Well, media in general will always lean left but not for political reasons. "Liberal" by definition means being willing to respect or accept behavior or opinions different from one's own; and being open to new ideas. i.e. not wanting to offend or exclude any one segment of the population. When you are in a business where ratings and viewership matter, then you want to please as many segments of the population as possible which is why most mainstream media outlets lean left. FoxNews has succeeded because they knew that nearly half of the United States was conservative and they were perfectly fine only speaking to that audience because 40% of 250 million adults is still a good number.

usa330300 wrote:

PBS, Frontline and the New York Times are hardly distinguished in any manner.

Right, newspapers with almost two centuries of existence and tv shows with almost four decades of existence known to millions of people are not distinguished, just because @usa330300 doesn't like them...

Opus99 wrote:

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

Chemist wrote:

Opus99 wrote:

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

As the old saying goes, the first step towards change is admitting you have a problem.

The challenge for Boeing is if they go too far down the path of admitting they have a problem they expose themselves to financial and legal issues, up to and including criminal prosecutions and potential imprisonments not to mention the financial costs, yet if they don't do much on the admitting front, things don't change and future problems are inevitable.

So, we end up in this limbo land where certain individuals are the fall guys taking the heat for the organization as a whole, and a few improvements in things like whistle blower protections are enacted, but we probably won't see the sweeping changes that are needed since that really would mean emphasizing safety over profit, something that is often claimed but never enacted because when push comes to shove this is a capitalistic corporation that is primarily judged on its ability to make profits.

Revelation wrote:

Chemist wrote:

Opus99 wrote:

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

As the old saying goes, the first step towards change is admitting you have a problem.

The challenge for Boeing is if they go too far down the path of admitting they have a problem they expose themselves to financial and legal issues, up to and including criminal prosecutions and potential imprisonments not to mention the financial costs, yet if they don't do much on the admitting front, things don't change and future problems are inevitable.

So, we end up in this limbo land where certain individuals are the fall guys taking the heat for the organization as a whole, and a few improvements in things like whistle blower protections are enacted, but we probably won't see the sweeping changes that are needed since that really would mean emphasizing safety over profit, something that is often claimed but never enacted because when push comes to shove this is a capitalistic corporation that is primarily judged on its ability to make profits.

Not to create any A v B arguments but I wonder if Airbus was scrutinised to the level that Boeing is what we would find. We may very much not find anything at all but I’m curious

Opus99 wrote:

Revelation wrote:

Chemist wrote:

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

As the old saying goes, the first step towards change is admitting you have a problem.

The challenge for Boeing is if they go too far down the path of admitting they have a problem they expose themselves to financial and legal issues, up to and including criminal prosecutions and potential imprisonments not to mention the financial costs, yet if they don't do much on the admitting front, things don't change and future problems are inevitable.

So, we end up in this limbo land where certain individuals are the fall guys taking the heat for the organization as a whole, and a few improvements in things like whistle blower protections are enacted, but we probably won't see the sweeping changes that are needed since that really would mean emphasizing safety over profit, something that is often claimed but never enacted because when push comes to shove this is a capitalistic corporation that is primarily judged on its ability to make profits.

Not to create any A v B arguments but I wonder if Airbus was scrutinised to the level that Boeing is what we would find. We may very much not find anything at all but I’m curious

When Airbus has the issues that Boeing has then I’m sure we would see a deep dive into their internal workings. However it seems Airbus has been able to build and deliver aircraft lately that have not had the amount of flaws, corruption and poor engineering that Boeing has had in the last decade. It’s a shame that Boeing lost its way in building airplanes. They became so focused on cutting corners and usurping the unions they created this mess. Anyone remember the Home Depot fasteners they used for the sham roll out of the 787 when it was pushed out of hangar for show and tell?

mcdu wrote:

Opus99 wrote:

Revelation wrote:

As the old saying goes, the first step towards change is admitting you have a problem.

The challenge for Boeing is if they go too far down the path of admitting they have a problem they expose themselves to financial and legal issues, up to and including criminal prosecutions and potential imprisonments not to mention the financial costs, yet if they don't do much on the admitting front, things don't change and future problems are inevitable.

So, we end up in this limbo land where certain individuals are the fall guys taking the heat for the organization as a whole, and a few improvements in things like whistle blower protections are enacted, but we probably won't see the sweeping changes that are needed since that really would mean emphasizing safety over profit, something that is often claimed but never enacted because when push comes to shove this is a capitalistic corporation that is primarily judged on its ability to make profits.

Not to create any A v B arguments but I wonder if Airbus was scrutinised to the level that Boeing is what we would find. We may very much not find anything at all but I’m curious

When Airbus has the issues that Boeing has then I’m sure we would see a deep dive into their internal workings. However it seems Airbus has been able to build and deliver aircraft lately that have not had the amount of flaws, corruption and poor engineering that Boeing has had in the last decade. It’s a shame that Boeing lost its way in building airplanes. They became so focused on cutting corners and usurping the unions they created this mess. Anyone remember the Home Depot fasteners they used for the sham roll out of the 787 when it was pushed out of hangar for show and tell?

Fair point

Chemist wrote:

Opus99 wrote:

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

I worked in the Company for thirty-five years. Boeing is not immune from the business trends that affect the equity markets. It is a publicly traded company and is subject to the excesses of the market.

In the early 1990s, there was concern that the Company was at risk of a leveraged buyout which precipitated changes to how directors were elected.

The partner model championed by Harry Stonecipher was first used on the MD-95 as McDonnell Douglas did not have the capital available to build that airplane. It was subsequently used on the 787 program after the Dot-com run-up in valuations. It was at that time that we started to see stock prices begin to be elevated due to the expectation of future profits. The partner model was an attempt for Boeing, which is capital intensive and makes real things, to be competitive with companies like Pets.com, which were speculative.

At the same time, Boeing is following the lead of the major automobile manufacturers who are building greenfield manufacturing facilities in the US south, which provide favorable tax breaks, low property costs, low labor costs, and low operation costs.

Throughout the 1990s, Jack Welch at GE made a lot of investors happy by consistently beating Wall Street expectations and taking profits to re-purchase stocks thus elevating prices. CEO Phil Condit idolized GE. And Welch's GE created and mentored business leaders who were subsequently brought over to Boeing under both Condit and Stonecipher.

The Tech industry started to reward executives with stock options, which Boeing subsequently adopted and thus incentivized managers to keep stock prices high at the expense of long term investment. The 737NG had been fully depreciated and every airplane built carried profits. 737NG profits were returned to investors as capital appreciation in stock through stock re-purchase.

Right now, the FAANG stocks are driving the market with P/E multiples lying between 25 to 60. So how does a company with high capital costs and one that builds real goods and services provide the same type of returns as these stocks?

Pythagoras wrote:

Chemist wrote:

Opus99 wrote:

I thought it was really good. Gave a good summary of what happened. And just showed Boeing for what it is. Quite sad but still looking ahead to Boeing recovering

But one question keeps popping up in my mind. Repeated conversations here and elsewhere imply that Boeing HAS NOT CHANGED - they're still run by beancounters, they deny and cover up their problems, they seem to not have learned.
If that is true, I wonder what their next screwup will be, and what damage it will cause? Or can they still break their very bad pattern?

I worked in the Company for thirty-five years. Boeing is not immune from the business trends that affect the equity markets. It is a publicly traded company and is subject to the excesses of the market.

In the early 1990s, there was concern that the Company was at risk of a leveraged buyout which precipitated changes to how directors were elected.

The partner model championed by Harry Stonecipher was first used on the MD-95 as McDonnell Douglas did not have the capital available to build that airplane. It was subsequently used on the 787 program after the Dot-com run-up in valuations. It was at that time that we started to see stock prices begin to be elevated due to the expectation of future profits. The partner model was an attempt for Boeing, which is capital intensive and makes real things, to be competitive with companies like Pets.com, which were speculative.

At the same time, Boeing is following the lead of the major automobile manufacturers who are building greenfield manufacturing facilities in the US south, which provide favorable tax breaks, low property costs, low labor costs, and low operation costs.

Throughout the 1990s, Jack Welch at GE made a lot of investors happy by consistently beating Wall Street expectations and taking profits to re-purchase stocks thus elevating prices. CEO Phil Condit idolized GE. And Welch's GE created and mentored business leaders who were subsequently brought over to Boeing under both Condit and Stonecipher.

The Tech industry started to reward executives with stock options, which Boeing subsequently adopted and thus incentivized managers to keep stock prices high at the expense of long term investment. The 737NG had been fully depreciated and every airplane built carried profits. 737NG profits were returned to investors as capital appreciation in stock through stock re-purchase.

Right now, the FAANG stocks are driving the market with P/E multiples lying between 25 to 60. So how does a company with high capital costs and one that builds real goods and services provide the same type of returns as these stocks?

They can’t and they need to realize. Boeing should accept they are not in the league of the FAANG stocks and should compare themselves more with the likes of Ford, GM etc.

A proper bean counter would readily assure top management that the intangible and reputational assets of the company were at least as valuable to stockholders as the next quarter profits. I just finished the book on GE's collapse. Sad reading, The old GE even with their faults was the sort of US company that made you proud of your country. No more, sad about Boeing too.

frmrCapCadet wrote:

A proper bean counter would readily assure top management that the intangible and reputational assets of the company were at least as valuable to stockholders as the next quarter profits. I just finished the book on GE's collapse. Sad reading, The old GE even with their faults was the sort of US company that made you proud of your country. No more, sad about Boeing too.

I listened to a podcast featuring former GE CEO Jeff Immelt a few months ago. According to Immelt, much of GE's stock premium during the 1990s was not due to fundamentals but due to the charisma of Welch himself, much like Tesla's stock might have a premium due to Elon Musk. What really hurt GE though was that GE Capitol was structured such that when the 2008 Financial crisis occurred it was not eligible for the same type of bailouts as the big banks and financial firms. Some of that is the fault of GE Capitol which was using financial instruments as the basis for its lending. Some of that is the fault of regulators and crony capitalism that we have in Washington DC. There was talk in the early 2000s that GE should be re-categorized as a financial stock rather than manufacturing as its profits predominated from GE Capitol Corporation. Immelt was faced with the difficult prospect of addressing the huge losses from GE Capitol and turning the GE ship back towards its roots as a industrial company.

With that being said, I have my own concerns that Boeing brought over all the accounting chicanery from GE with both Harry Stonecipher and James McNerney. Boeing is a too big to fail company just as the Wall Street banks are too big to fail. Program Accounting just seems like a means to hide the true exposure of the company to excessive debt. Every now and again, David Calhoun says something to the extent that this might be the case.

Sorry that I wasn't able to respond to this till now, as I was attending a technical conference so could not find the time needed to dig into this post.

Pythagoras wrote:

Instead Boeing chose to incrementally improve safety through the Runway Situation Awareness Tool (RSAT)--which was already on the 737NG--and the Roll Command Alerting System (RCAS). These enhancements were not mandated by the FAA. People who haven't read the released record do not know that Mark Forkner's discussion around pilot simulator training with the FAA and other regulators concern these particular new features. It was in the FAA's best interest to accept Boeing's arguments here about not imposing new simulator training because to not do so would create a significant disincentive to make these changes.

Revealing choice of words: "imposing" simulator training. Suggests profits are the primary concern, as opposed to safety.

So let's put the four-second rule into context. It was a criteria that had been imposed at the time of initial design of the 737 and is appropriate for the flight control cable-driven hydraulics system architecture.

Imposed? From what I read it's just an industry "rule of thumb" and exists in none of the federal aviation regulations.

Over the decades of 737 operations, the service record of the 737 would have shown whether this rule should still be relied upon. Without having the database available, I would have to assume that the data available shows no incidents prior to the 737Max.

Remember as well that to the Flight Controls engineers that MCAS is being considered as analogous to a run-away stabilizer trim as the behavior exhibited to the pilot would be similar. Run-away stabilizer trim can be either a continuous activation or an intermittent activation of the trim unit. This failure mode and its corrective action has already accepted by the FAA and the service record shows this to be acceptable.

Specious logic to me. Those previous decades of good safety occurred without MCAS being present. What was good enough for the past was good enough because the plane didn't have MCAS.

I would make the argument though that two factors should have been considered when evaluating incorporating MCAS. One is that how much more likely are you going to be relying upon pilot corrective action. I'd expect that relying upon service record might be a flawed approach as the reliability of the stab trim unit has improved over the years to the point where the fleet just doesn't see this failure mode anymore. In other words, the four-second rule is acceptable because it never had to be used. The second factor is that when Boeing introduced the Speed Stability function that it made pilot recognition of an uncommanded trim more difficult for the pilot to recognize. This appears to be the situation with Lion Air for both the accident and prior day's incident. When the pilot is accustomed to the trim wheels being rotated by the automation, he is not going to realize as quickly that this is failure.

Seems now you are supporting what I said earlier, the earlier baseline was made with simpler airplanes so should not have been given the significance it seems to have been given.

I am not making excuses here for a bad and poorly executed design. All I am saying is that I can envision the process by which the Flight Controls engineers were able to convince themselves that this was an acceptable design.

Which highlights we have no official rendering of exactly how "they" convinced themselves it was an acceptable design, nor even who "they" are.

As far as we know it was ultimately decided by one person within Boeing, and was done without an end-to-end simulation of multiple activations due to erroneous AoA data that would be triggering multiple other alerts. This is based on my recollections from multiple Seattle Times reports, so if my recollection is inaccurate I'd appreciate clarification.

I'm sill curious to see if the move to charge Forkner with criminal acts will motivate him to speak to the prosecutors or not.

Revelation wrote:

Sorry that I wasn't able to respond to this till now, as I was attending a technical conference so could not find the time needed to dig into this post.

Pythagoras wrote:

Instead Boeing chose to incrementally improve safety through the Runway Situation Awareness Tool (RSAT)--which was already on the 737NG--and the Roll Command Alerting System (RCAS). These enhancements were not mandated by the FAA. People who haven't read the released record do not know that Mark Forkner's discussion around pilot simulator training with the FAA and other regulators concern these particular new features. It was in the FAA's best interest to accept Boeing's arguments here about not imposing new simulator training because to not do so would create a significant disincentive to make these changes.

Revealing choice of words: "imposing" simulator training. Suggests profits are the primary concern, as opposed to safety.

So let's put the four-second rule into context. It was a criteria that had been imposed at the time of initial design of the 737 and is appropriate for the flight control cable-driven hydraulics system architecture.

Imposed? From what I read it's just an industry "rule of thumb" and exists in none of the federal aviation regulations.

Over the decades of 737 operations, the service record of the 737 would have shown whether this rule should still be relied upon. Without having the database available, I would have to assume that the data available shows no incidents prior to the 737Max.

Remember as well that to the Flight Controls engineers that MCAS is being considered as analogous to a run-away stabilizer trim as the behavior exhibited to the pilot would be similar. Run-away stabilizer trim can be either a continuous activation or an intermittent activation of the trim unit. This failure mode and its corrective action has already accepted by the FAA and the service record shows this to be acceptable.

Specious logic to me. Those previous decades of good safety occurred without MCAS being present. What was good enough for the past was good enough because the plane didn't have MCAS.

I would make the argument though that two factors should have been considered when evaluating incorporating MCAS. One is that how much more likely are you going to be relying upon pilot corrective action. I'd expect that relying upon service record might be a flawed approach as the reliability of the stab trim unit has improved over the years to the point where the fleet just doesn't see this failure mode anymore. In other words, the four-second rule is acceptable because it never had to be used. The second factor is that when Boeing introduced the Speed Stability function that it made pilot recognition of an uncommanded trim more difficult for the pilot to recognize. This appears to be the situation with Lion Air for both the accident and prior day's incident. When the pilot is accustomed to the trim wheels being rotated by the automation, he is not going to realize as quickly that this is failure.

Seems now you are supporting what I said earlier, the earlier baseline was made with simpler airplanes so should not have been given the significance it seems to have been given.

I am not making excuses here for a bad and poorly executed design. All I am saying is that I can envision the process by which the Flight Controls engineers were able to convince themselves that this was an acceptable design.

Which highlights we have no official rendering of exactly how "they" convinced themselves it was an acceptable design, nor even who "they" are.

As far as we know it was ultimately decided by one person within Boeing, and was done without an end-to-end simulation of multiple activations due to erroneous AoA data that would be triggering multiple other alerts. This is based on my recollections from multiple Seattle Times reports, so if my recollection is inaccurate I'd appreciate clarification.

I'm sill curious to see if the move to charge Forkner with criminal acts will motivate him to speak to the prosecutors or not.

I willing to take time to answer posts to this board, but this response has all the trappings of just trying to make an argument for arguments sake. I'm not going to spend time haggling over word choice.

The only point that I will respond to is that the industry as a whole has problems with addressing incremental changes in safety. Everyone in the industry knows that oftentimes it takes an accident or severe incident to make changes in the regulations. The primary reason is that regulations by their nature are backward looking and reflect the lessons learned in the industry. The industry is evidence and data driven. The FAA cannot impose regulations based upon hypothetical events. That actually is embedded in law. To an outsider that might be viewed as placing "profits over safety" but it is by necessity the way the industry and the laws that govern it operate.

If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.

The investigation of the two 737Max accidents have already identified two shortcomings in the regulations that will be addressed. One is the findings from the JTAR that the regulatory guidance for how to address human factors needs to be updated to reflect the confusing sequence of alarms and warnings like which occurred in the Ethiopian Airlines accident. The second is that the training for runaway stabilizer trim is insufficient for the same reasons, which is why simulator training is being mandated for all 737 models by Airworthiness Directive. It is not a problem unique to the 737Max.

A couple of questions on your comments:
1) Please advise us/me where you have the idea that there is a law that states that the FAA cannot impose regulations based on hypothetical events? I would sure like to know which law that is. For example most of the airworthiness regulations governing aircraft structures are based on hypothetical events that hopefully will not occur very often if ever during the life of the aircraft.
2) You seem to have the idea that the 737 MAX demonstrated that it met all of the required airworthiness regulations. How could it meet the airworthiness regulations with a flawed safety study assuming that the Angle of Attack indicator never failed. Failures of angle of attack indicators have been known since they were first placed on aircraft many years ago. Boeing covered up or hid that by not updating the safety analysis for the MCAS system after it was changed to a single source and the FAA was not very diligent in checking for any changes to the flight controls including the MCAS system when it certified the aircraft. That the 737 MAX did not meet the airworthiness regulations is the reason it was on the ground for almost 2 years and is still not allowed to fly in some countries.
3) Please advise us/me how an Airworthiness Directive can mandate runaway stabilizer trim training on simulators? That is done by revising the Flight Standardization Board Report not by airworthiness directives.

Pythagoras wrote:

Revelation wrote:

Sorry that I wasn't able to respond to this till now, as I was attending a technical conference so could not find the time needed to dig into this post.

Pythagoras wrote:

Instead Boeing chose to incrementally improve safety through the Runway Situation Awareness Tool (RSAT)--which was already on the 737NG--and the Roll Command Alerting System (RCAS). These enhancements were not mandated by the FAA. People who haven't read the released record do not know that Mark Forkner's discussion around pilot simulator training with the FAA and other regulators concern these particular new features. It was in the FAA's best interest to accept Boeing's arguments here about not imposing new simulator training because to not do so would create a significant disincentive to make these changes.

Revealing choice of words: "imposing" simulator training. Suggests profits are the primary concern, as opposed to safety.

So let's put the four-second rule into context. It was a criteria that had been imposed at the time of initial design of the 737 and is appropriate for the flight control cable-driven hydraulics system architecture.

Imposed? From what I read it's just an industry "rule of thumb" and exists in none of the federal aviation regulations.

Over the decades of 737 operations, the service record of the 737 would have shown whether this rule should still be relied upon. Without having the database available, I would have to assume that the data available shows no incidents prior to the 737Max.

Remember as well that to the Flight Controls engineers that MCAS is being considered as analogous to a run-away stabilizer trim as the behavior exhibited to the pilot would be similar. Run-away stabilizer trim can be either a continuous activation or an intermittent activation of the trim unit. This failure mode and its corrective action has already accepted by the FAA and the service record shows this to be acceptable.

Specious logic to me. Those previous decades of good safety occurred without MCAS being present. What was good enough for the past was good enough because the plane didn't have MCAS.

I would make the argument though that two factors should have been considered when evaluating incorporating MCAS. One is that how much more likely are you going to be relying upon pilot corrective action. I'd expect that relying upon service record might be a flawed approach as the reliability of the stab trim unit has improved over the years to the point where the fleet just doesn't see this failure mode anymore. In other words, the four-second rule is acceptable because it never had to be used. The second factor is that when Boeing introduced the Speed Stability function that it made pilot recognition of an uncommanded trim more difficult for the pilot to recognize. This appears to be the situation with Lion Air for both the accident and prior day's incident. When the pilot is accustomed to the trim wheels being rotated by the automation, he is not going to realize as quickly that this is failure.

Seems now you are supporting what I said earlier, the earlier baseline was made with simpler airplanes so should not have been given the significance it seems to have been given.

I am not making excuses here for a bad and poorly executed design. All I am saying is that I can envision the process by which the Flight Controls engineers were able to convince themselves that this was an acceptable design.

Which highlights we have no official rendering of exactly how "they" convinced themselves it was an acceptable design, nor even who "they" are.

As far as we know it was ultimately decided by one person within Boeing, and was done without an end-to-end simulation of multiple activations due to erroneous AoA data that would be triggering multiple other alerts. This is based on my recollections from multiple Seattle Times reports, so if my recollection is inaccurate I'd appreciate clarification.

I'm sill curious to see if the move to charge Forkner with criminal acts will motivate him to speak to the prosecutors or not.

I willing to take time to answer posts to this board, but this response has all the trappings of just trying to make an argument for arguments sake. I'm not going to spend time haggling over word choice.

The only point that I will respond to is that the industry as a whole has problems with addressing incremental changes in safety. Everyone in the industry knows that oftentimes it takes an accident or severe incident to make changes in the regulations. The primary reason is that regulations by their nature are backward looking and reflect the lessons learned in the industry. The industry is evidence and data driven. The FAA cannot impose regulations based upon hypothetical events. That actually is embedded in law. To an outsider that might be viewed as placing "profits over safety" but it is by necessity the way the industry and the laws that govern it operate.

If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.

The investigation of the two 737Max accidents have already identified two shortcomings in the regulations that will be addressed. One is the findings from the JTAR that the regulatory guidance for how to address human factors needs to be updated to reflect the confusing sequence of alarms and warnings like which occurred in the Ethiopian Airlines accident. The second is that the training for runaway stabilizer trim is insufficient for the same reasons, which is why simulator training is being mandated for all 737 models by Airworthiness Directive. It is not a problem unique to the 737Max.

Was the MAX proven to be airworthy first time round?

1. They designed automation that could take control of the plane and crash it.
2. MCAS relied on a single sensor which went against industry norms that require redundancy.
3. The FAA did a calculation and found that more crashes were coming, but bet the farm on the fact that the directive given was good enough and that Boeing would come through with a patch before anything else went wrong.
4. Boeing's assessments on human factors were all wrong. So wrong that when it was put to the test, it failed.

How many times have you seen a committee like JATR formed to try and see what went wrong?

The FAA slept on the job. This is why Boeing was charged with fraud, a fine given. It is why a former employee is most likely going to be charged with misleading regulators.

All these are unique to the MAX. All of these are happening because the manufacturer could not have demonstrated that the aircraft was safe to fly first time round without concealment. It is almost as if the last two and a half years did not happen.

CanukinUSA wrote:

A couple of questions on your comments:
1) Please advise us/me where you have the idea that there is a law that states that the FAA cannot impose regulations based on hypothetical events? I would sure like to know which law that is. For example most of the airworthiness regulations governing aircraft structures are based on hypothetical events that hopefully will not occur very often if ever during the life of the aircraft.
2) You seem to have the idea that the 737 MAX demonstrated that it met all of the required airworthiness regulations. How could it meet the airworthiness regulations with a flawed safety study assuming that the Angle of Attack indicator never failed. Failures of angle of attack indicators have been known since they were first placed on aircraft many years ago. Boeing covered up or hid that by not updating the safety analysis for the MCAS system after it was changed to a single source and the FAA was not very diligent in checking for any changes to the flight controls including the MCAS system when it certified the aircraft. That the 737 MAX did not meet the airworthiness regulations is the reason it was on the ground for almost 2 years and is still not allowed to fly in some countries.
3) Please advise us/me how an Airworthiness Directive can mandate runaway stabilizer trim training on simulators? That is done by revising the Flight Standardization Board Report not by airworthiness directives.

1) The process for releasing an NPRM is provided here: https://www.transportation.gov/regulations/rulemaking-process.

How does an agency identify the need for a rulemaking?
There are many reasons why an agency may decide to initiate the rulemaking process. The major reasons for DOT agencies fit mostly in the following categories:

Statutory mandate. Congress may specifically require a rule or at least the initiation of the rulemaking process – sometimes with a deadline.
Agency identification of a problem. To the extent an agency has discretion to decide whether to issue a rule, it may identify the need to initiate the rulemaking process in a variety of ways, including the following: We may identify a problem as a result of inspectors’ reports or general agency oversight. For example, we review accident reports or data that may show an increasing safety problem with motor vehicle side collisions or leaks of hazardous materials during transportation. Investigations of accidents may indicate a manufacturing problem that needs to be addressed. We may have difficulties enforcing existing rules, and this may provide evidence of a need to modify the rules. Requests for interpretations or exemptions may demonstrate that a rule needs to be clarified or modified. Finally, changes in technology may justify a change to a rule. For example, new technology may warrant modifying existing rules to permit the use of new materials. The accessibility of the Internet may justify changing reporting requirements to permit electronic filing.
Petition for rulemaking. The public has the right to petition an agency to issue, modify, or rescind a rule, and we may agree on the need for action.
NTSB, GAO, IG, or similar recommendations. Recommendations for rules may come from the National Transportation Safety Board (NTSB), the Government Accountability Office (GAO), the DOT Inspector General (IG), or special commissions or other bodies asked by Congress or the President to develop recommendations on particular issues.

2) The 737Max met certification requirements, at least according to the record released to-date. There is no citation that I can find that lays out the FAR chapter where it did not. As I mentioned in other posts, analysis to support certification documents need to be completed prior TIA and flight test only serves to validate the analysis. When Boeing made the change to MCAS to remove the g-sensor, the engineers would have reviewed the already prepared analysis to judge whether the change invalidated the conclusions. MCAS was not judged to warrant inclusion in the certification documents as the erroneous failure was deemed "hazardous" as pilot corrective action was intuitive and did not require special techniques or training. This was consistent with the FAA guidance on how to interpret the regulations. Remember as well that the agreement between the FAA and Boeing was that only catastrophic failure modes need to be reported to the FAA. MCAS is not mentioned because it was not considered a significant change to warrant inclusion.

3) The only method to revise maintenance and operations documents after the airplane is delivered is through an Airworthiness Directive. Reminder that AD was released after the Lion Air accident to revise the Airplane Flight Manual (AFM). See AD 2018–23–51 here:
https://www.federalregister.gov/documents/2018/12/06/2018-26365/airworthiness-directives-the-boeing-company-airplanes.

The 737Max-8 and 737Max-9 AD AD 2020–24–02 for return to service may be found here:
https://www.federalregister.gov/documents/2020/11/20/2020-25844/airworthiness-directives-the-boeing-company-airplanes.

Two items of interest of note in this AD.

The first item of interest addresses whether MCAS is required for safe flight. Note the following:

With MCAS inoperative, the Boeing 737 MAX is capable of continued safe flight and landing and is therefore compliant with 14 CFR 25.671 and 25.1309. If at high AOAs, with MCAS inoperative, MCAS will not move the stabilizer, and the resultant incremental change in column force will not be experienced by the pilot. In this situation, the pilot maintains control and can decrease the airplane's AOA by moving the column forward. Through comprehensive analysis, simulation testing, and flight testing, the FAA determined that the airplane meets applicable 14 CFR part 25 standards, with MCAS operative and with failures, including failures that render MCAS inoperative. With MCAS inoperative after a failure, the 737 MAX is capable of continued safe flight and landing, as required by 14 CFR 25.671 and 25.1309.

This statement affirms why Boeing did not initially configure MCAS as requiring redundancy as failure to function was not catastrophic. It also invalidates the wild claims that the 737Max was inherently unstable.

The second item of interest is the finding that existing non-normal checklists for the 737 NG are inadequate, and the FAA is considering releasing an AD for the 737 NG as well:

The FAA expects Boeing will update the eight non-normal procedures included in this final rule in the Boeing 737 NG AFM. The FAA is considering mandating these 737 NG AFM changes by a separate AD rulemaking action. Additionally, the new special emphasis areas [9] described in section 9.2 of the 737 FSB Report, also apply to the Boeing 737 NG. Therefore, pilots serving in mixed fleet operations of the Boeing 737 MAX and the Boeing 737 NG will have consistent procedures and training in both airplanes. The FAA has not changed this final rule regarding this issue.

Gremlinzzzz wrote:

Pythagoras wrote:

Revelation wrote:

Sorry that I wasn't able to respond to this till now, as I was attending a technical conference so could not find the time needed to dig into this post.


Revealing choice of words: "imposing" simulator training. Suggests profits are the primary concern, as opposed to safety.


Imposed? From what I read it's just an industry "rule of thumb" and exists in none of the federal aviation regulations.


Specious logic to me. Those previous decades of good safety occurred without MCAS being present. What was good enough for the past was good enough because the plane didn't have MCAS.


Seems now you are supporting what I said earlier, the earlier baseline was made with simpler airplanes so should not have been given the significance it seems to have been given.


Which highlights we have no official rendering of exactly how "they" convinced themselves it was an acceptable design, nor even who "they" are.

As far as we know it was ultimately decided by one person within Boeing, and was done without an end-to-end simulation of multiple activations due to erroneous AoA data that would be triggering multiple other alerts. This is based on my recollections from multiple Seattle Times reports, so if my recollection is inaccurate I'd appreciate clarification.

I'm sill curious to see if the move to charge Forkner with criminal acts will motivate him to speak to the prosecutors or not.

I willing to take time to answer posts to this board, but this response has all the trappings of just trying to make an argument for arguments sake. I'm not going to spend time haggling over word choice.

The only point that I will respond to is that the industry as a whole has problems with addressing incremental changes in safety. Everyone in the industry knows that oftentimes it takes an accident or severe incident to make changes in the regulations. The primary reason is that regulations by their nature are backward looking and reflect the lessons learned in the industry. The industry is evidence and data driven. The FAA cannot impose regulations based upon hypothetical events. That actually is embedded in law. To an outsider that might be viewed as placing "profits over safety" but it is by necessity the way the industry and the laws that govern it operate.

If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.

The investigation of the two 737Max accidents have already identified two shortcomings in the regulations that will be addressed. One is the findings from the JTAR that the regulatory guidance for how to address human factors needs to be updated to reflect the confusing sequence of alarms and warnings like which occurred in the Ethiopian Airlines accident. The second is that the training for runaway stabilizer trim is insufficient for the same reasons, which is why simulator training is being mandated for all 737 models by Airworthiness Directive. It is not a problem unique to the 737Max.

Was the MAX proven to be airworthy first time round?

1. They designed automation that could take control of the plane and crash it.
2. MCAS relied on a single sensor which went against industry norms that require redundancy.
3. The FAA did a calculation and found that more crashes were coming, but bet the farm on the fact that the directive given was good enough and that Boeing would come through with a patch before anything else went wrong.
4. Boeing's assessments on human factors were all wrong. So wrong that when it was put to the test, it failed.

How many times have you seen a committee like JATR formed to try and see what went wrong?

The FAA slept on the job. This is why Boeing was charged with fraud, a fine given. It is why a former employee is most likely going to be charged with misleading regulators.

All these are unique to the MAX. All of these are happening because the manufacturer could not have demonstrated that the aircraft was safe to fly first time round without concealment. It is almost as if the last two and a half years did not happen.

I will acknowledge that as the FAA AEG was not informed of the change to MCAS that the airplane was not properly certified. If it was not properly certified, it is an unsafe design.

Please interpret my comments about whether the airplane was "safe" to the process of finding of compliance of the published Part 25 regulations.

sxf24 wrote:

FlapOperator wrote:

sxf24 wrote:

Airbus and Boeing can decide who they deliver airplane to. If an airline’s training or maintenance doesn’t pass muster, they can hold off deliveries until they help them improve.

The OEMs shouldn't be doing the regulators job. Is it really up to Toulouse or Chicago to judge Air Whatever's training program?

No, and expecting them to do so is next to insane.

If the OEMs want to protect their reputation, they won’t deliver new airplanes to airlines that can’t safely fly them. While this is redundant to the role of a regulator, there are plenty of places that expose the OEMs to risk. It’s also a revenue generating opportunity to provide additional training and support.

Revelation wrote:

sxf24 wrote:

I don’t know how an audio clip without context is extrapolated into Boeing’s position. What Calhoun said is not Boeing’s position.

It's a distinction that isn't very significant, IMO. The underlying NYT article with the Calhoun interview makes the context clear, and we didn't see Calhoun ask for a retraction. How can he, they have a recording of his voice! Given all this, the CEO saying what he said carries a lot of weight, IMO. Not an official Boeing statement, but a clear view of the thoughts of a former board member and current CEO, the same guy who will be ultimately responsible for any future calamities and IMO somewhat responsible for the last two. See our thread on how shareholders have filed a law suite on this aspect of the disaster.

I just went and re-read The NY Times article. Calhoun was speaking to the experience of pilots, not necessarily their nationality. I’m not going to argue further: if you want to make Calhoun and Boeing out to be racist, that’s your choice.

Revelation wrote:

sxf24 wrote:

Airbus and Boeing can decide who they deliver airplane to. If an airline’s training or maintenance doesn’t pass muster, they can hold off deliveries until they help them improve.

They can, and probably have at various points in the past, but it really is the local regulator's job to regulate the local aviation system, they are the ones responsible to their citizens. It's not a good plan to rely on corporations to act in anything but their own self interest.

I think it is in the self interest of the OEMs to know that their customers can safely use their products.

And both offer training services its just that the worst offenders from a safety pov tend to be airlines mostly concerned with cost so no budget for it

Pythagoras wrote:

CanukinUSA wrote:

A couple of questions on your comments:
1) Please advise us/me where you have the idea that there is a law that states that the FAA cannot impose regulations based on hypothetical events? I would sure like to know which law that is. For example most of the airworthiness regulations governing aircraft structures are based on hypothetical events that hopefully will not occur very often if ever during the life of the aircraft.
2) You seem to have the idea that the 737 MAX demonstrated that it met all of the required airworthiness regulations. How could it meet the airworthiness regulations with a flawed safety study assuming that the Angle of Attack indicator never failed. Failures of angle of attack indicators have been known since they were first placed on aircraft many years ago. Boeing covered up or hid that by not updating the safety analysis for the MCAS system after it was changed to a single source and the FAA was not very diligent in checking for any changes to the flight controls including the MCAS system when it certified the aircraft. That the 737 MAX did not meet the airworthiness regulations is the reason it was on the ground for almost 2 years and is still not allowed to fly in some countries.
3) Please advise us/me how an Airworthiness Directive can mandate runaway stabilizer trim training on simulators? That is done by revising the Flight Standardization Board Report not by airworthiness directives.

1) The process for releasing an NPRM is provided here: https://www.transportation.gov/regulations/rulemaking-process.

How does an agency identify the need for a rulemaking?
There are many reasons why an agency may decide to initiate the rulemaking process. The major reasons for DOT agencies fit mostly in the following categories:

Statutory mandate. Congress may specifically require a rule or at least the initiation of the rulemaking process – sometimes with a deadline.
Agency identification of a problem. To the extent an agency has discretion to decide whether to issue a rule, it may identify the need to initiate the rulemaking process in a variety of ways, including the following: We may identify a problem as a result of inspectors’ reports or general agency oversight. For example, we review accident reports or data that may show an increasing safety problem with motor vehicle side collisions or leaks of hazardous materials during transportation. Investigations of accidents may indicate a manufacturing problem that needs to be addressed. We may have difficulties enforcing existing rules, and this may provide evidence of a need to modify the rules. Requests for interpretations or exemptions may demonstrate that a rule needs to be clarified or modified. Finally, changes in technology may justify a change to a rule. For example, new technology may warrant modifying existing rules to permit the use of new materials. The accessibility of the Internet may justify changing reporting requirements to permit electronic filing.
Petition for rulemaking. The public has the right to petition an agency to issue, modify, or rescind a rule, and we may agree on the need for action.
NTSB, GAO, IG, or similar recommendations. Recommendations for rules may come from the National Transportation Safety Board (NTSB), the Government Accountability Office (GAO), the DOT Inspector General (IG), or special commissions or other bodies asked by Congress or the President to develop recommendations on particular issues.

2) The 737Max met certification requirements, at least according to the record released to-date. There is no citation that I can find that lays out the FAR chapter where it did not. As I mentioned in other posts, analysis to support certification documents need to be completed prior TIA and flight test only serves to validate the analysis. When Boeing made the change to MCAS to remove the g-sensor, the engineers would have reviewed the already prepared analysis to judge whether the change invalidated the conclusions. MCAS was not judged to warrant inclusion in the certification documents as the erroneous failure was deemed "hazardous" as pilot corrective action was intuitive and did not require special techniques or training. This was consistent with the FAA guidance on how to interpret the regulations. Remember as well that the agreement between the FAA and Boeing was that only catastrophic failure modes need to be reported to the FAA. MCAS is not mentioned because it was not considered a significant change to warrant inclusion.

3) The only method to revise maintenance and operations documents after the airplane is delivered is through an Airworthiness Directive. Reminder that AD was released after the Lion Air accident to revise the Airplane Flight Manual (AFM). See AD 2018–23–51 here:
https://www.federalregister.gov/documents/2018/12/06/2018-26365/airworthiness-directives-the-boeing-company-airplanes.

The 737Max-8 and 737Max-9 AD AD 2020–24–02 for return to service may be found here:
https://www.federalregister.gov/documents/2020/11/20/2020-25844/airworthiness-directives-the-boeing-company-airplanes.

Two items of interest of note in this AD.

The first item of interest addresses whether MCAS is required for safe flight. Note the following:

With MCAS inoperative, the Boeing 737 MAX is capable of continued safe flight and landing and is therefore compliant with 14 CFR 25.671 and 25.1309. If at high AOAs, with MCAS inoperative, MCAS will not move the stabilizer, and the resultant incremental change in column force will not be experienced by the pilot. In this situation, the pilot maintains control and can decrease the airplane's AOA by moving the column forward. Through comprehensive analysis, simulation testing, and flight testing, the FAA determined that the airplane meets applicable 14 CFR part 25 standards, with MCAS operative and with failures, including failures that render MCAS inoperative. With MCAS inoperative after a failure, the 737 MAX is capable of continued safe flight and landing, as required by 14 CFR 25.671 and 25.1309.

This statement affirms why Boeing did not initially configure MCAS as requiring redundancy as failure to function was not catastrophic. It also invalidates the wild claims that the 737Max was inherently unstable.

The second item of interest is the finding that existing non-normal checklists for the 737 NG are inadequate, and the FAA is considering releasing an AD for the 737 NG as well:

The FAA expects Boeing will update the eight non-normal procedures included in this final rule in the Boeing 737 NG AFM. The FAA is considering mandating these 737 NG AFM changes by a separate AD rulemaking action. Additionally, the new special emphasis areas [9] described in section 9.2 of the 737 FSB Report, also apply to the Boeing 737 NG. Therefore, pilots serving in mixed fleet operations of the Boeing 737 MAX and the Boeing 737 NG will have consistent procedures and training in both airplanes. The FAA has not changed this final rule regarding this issue.

I can make a ford pinto pass 2021 crash safety regulations if I'm just allowed to lie on the paperwork...

Revising the documents and/or procedures is not the same as revising the training requirements such as mandating simulator training. The training requirements can be revised at any time by a Flight Standardization Report from the Aircraft Evaluation Group of the FAA. There does not have to be a airworthiness directive to do that. Flight Standards at the FAA works quite independently from the Aircraft Certification Group. Obviously they do communicate but as was demonstrated with the MAX maybe not enough.

Pythagoras wrote:

Gremlinzzzz wrote:

Pythagoras wrote:

I willing to take time to answer posts to this board, but this response has all the trappings of just trying to make an argument for arguments sake. I'm not going to spend time haggling over word choice.

The only point that I will respond to is that the industry as a whole has problems with addressing incremental changes in safety. Everyone in the industry knows that oftentimes it takes an accident or severe incident to make changes in the regulations. The primary reason is that regulations by their nature are backward looking and reflect the lessons learned in the industry. The industry is evidence and data driven. The FAA cannot impose regulations based upon hypothetical events. That actually is embedded in law. To an outsider that might be viewed as placing "profits over safety" but it is by necessity the way the industry and the laws that govern it operate.

If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.

The investigation of the two 737Max accidents have already identified two shortcomings in the regulations that will be addressed. One is the findings from the JTAR that the regulatory guidance for how to address human factors needs to be updated to reflect the confusing sequence of alarms and warnings like which occurred in the Ethiopian Airlines accident. The second is that the training for runaway stabilizer trim is insufficient for the same reasons, which is why simulator training is being mandated for all 737 models by Airworthiness Directive. It is not a problem unique to the 737Max.

Was the MAX proven to be airworthy first time round?

1. They designed automation that could take control of the plane and crash it.
2. MCAS relied on a single sensor which went against industry norms that require redundancy.
3. The FAA did a calculation and found that more crashes were coming, but bet the farm on the fact that the directive given was good enough and that Boeing would come through with a patch before anything else went wrong.
4. Boeing's assessments on human factors were all wrong. So wrong that when it was put to the test, it failed.

How many times have you seen a committee like JATR formed to try and see what went wrong?

The FAA slept on the job. This is why Boeing was charged with fraud, a fine given. It is why a former employee is most likely going to be charged with misleading regulators.

All these are unique to the MAX. All of these are happening because the manufacturer could not have demonstrated that the aircraft was safe to fly first time round without concealment. It is almost as if the last two and a half years did not happen.

I will acknowledge that as the FAA AEG was not informed of the change to MCAS that the airplane was not properly certified. If it was not properly certified, it is an unsafe design.

Please interpret my comments about whether the airplane was "safe" to the process of finding of compliance of the published Part 25 regulations.

You made this statement.

''If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.''

This was the very statement I was challenging. We know that the only way the MAX was able to meet regulation was because Boeing was able to lie first time round and the FAA was so negligent that even after the grounding Boeing thought that they could continue to pressure it into making a decision extremely fast.

We know that the jet could not have passed established criteria because there commercial airliners that rely on angle of attack sensors offer information from more than one sensor, and are supposed to give that information to pilots so that they are better informed when something goes wrong.

Boeing quite simply, designed a plane and did not have a quality fault matrix assessment in place. They were so busy trying to ensure that the plane would have simulator training, thus saving themselves and airlines money that they failed at their primary objective which is making safe airlines.

We do not need fancy words, the plane was not safe. This plane was botched so bad at a fundamental level that politicians investigated, the regulator itself was investigated to see what went wrong and what lessons could be learnt. The jet saw what is a record grounding, and it was not just an issue being fixed, it had to be re-certified; deliveries of the 787 were stopped, entry into service of the 777X delayed and the justice department involved to see whether fraud occurred.

Boeing in this very sense placed profits over safety. If safety was what they cared about, they ought to have grounded the jet the first time there was a crash. Penny wise, pound foolish.

Gremlinzzzz wrote:

You made this statement.

''If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.''

This was the very statement I was challenging. We know that the only way the MAX was able to meet regulation was because Boeing was able to lie first time round and the FAA was so negligent that even after the grounding Boeing thought that they could continue to pressure it into making a decision extremely fast.

Where is your evidence for this statement?

From my recollection, Boeing had a software patch developed to rectify the worst aspects of MCAS in March 2019. After the accident and in the midst of certifying this fix, Boeing uncovered that the flight control computers were susceptible to a flipped-bit from a cosmic ray. The regulations require that when a Service Bulletin is released that it must be fully certifiable. So even though the chips had been in-service and the likelihood of occurrence was very low, Boeing was obligated to rewrite the software. That software was supposedly to be ready by September 2019, which would align with the reports that Muilenburg was giving publicly up to when he was fired.

My perspective is that FAA administrator Steve Dickson, who took the helm at the FAA in August 2019, stepped in and made the decision in December 2019 to go beyond just changing the software and address the human factors issues that were uncovered during the accident investigation, which effectively added another year to the return to service schedule.

Pythagoras wrote:

From my recollection, Boeing had a software patch developed to rectify the worst aspects of MCAS in March 2019.

This was claimed many times, but never substantiated. On the other hand, there were claims that AD reminder is sufficient. We may safely assume that claimed development never happened.

Pythagoras wrote:

After the accident and in the midst of certifying this fix, Boeing uncovered that the flight control computers were susceptible to a flipped-bit from a cosmic ray.

After Boeing submitted a patch for certification, they were shown the corresponding paragraphs in regulations - and everyone suddenly recognized architecture was not certifiable. It didn't occur to Boeing that increased control system authority raises the bar. Another reason to think that claimed "almost ready" patch is a fake.

Pythagoras wrote:

The regulations require that when a Service Bulletin is released that it must be fully certifiable. So even though the chips had been in-service and the likelihood of occurrence was very low, Boeing was obligated to rewrite the software. That software was supposedly to be ready by September 2019, which would align with the reports that Muilenburg was giving publicly up to when he was fired.

Those events are MUCH more frequent at FL300 than 1e-9 reliability would require. Radiation influence on electronics is a huge topic, with a lot of research and engineering invested.

Pythagoras wrote:

My perspective is that FAA administrator Steve Dickson, who took the helm at the FAA in August 2019, stepped in and made the decision in December 2019 to go beyond just changing the software and address the human factors issues that were uncovered during the accident investigation, which effectively added another year to the return to service schedule.

And my perspective is that during between-crashes periods Boeing had no qualified engineering, capable of reading regulations, analyzing fault trees or understanding aerodynamics of stabilizer blow-back in 737.

Pythagoras wrote:

Gremlinzzzz wrote:

You made this statement.

''If an manufacturer can demonstrate the airplane satisfies the regulations and then certify the airplane, it becomes by definition a safe airplane. The manufacturer at that point has met society's established criteria for acceptable level of safety and cannot be admonished for "placing profits over safety". The airplane is safe. Period.''

This was the very statement I was challenging. We know that the only way the MAX was able to meet regulation was because Boeing was able to lie first time round and the FAA was so negligent that even after the grounding Boeing thought that they could continue to pressure it into making a decision extremely fast.

Where is your evidence for this statement?

From my recollection, Boeing had a software patch developed to rectify the worst aspects of MCAS in March 2019. After the accident and in the midst of certifying this fix, Boeing uncovered that the flight control computers were susceptible to a flipped-bit from a cosmic ray. The regulations require that when a Service Bulletin is released that it must be fully certifiable. So even though the chips had been in-service and the likelihood of occurrence was very low, Boeing was obligated to rewrite the software. That software was supposedly to be ready by September 2019, which would align with the reports that Muilenburg was giving publicly up to when he was fired.

My perspective is that FAA administrator Steve Dickson, who took the helm at the FAA in August 2019, stepped in and made the decision in December 2019 to go beyond just changing the software and address the human factors issues that were uncovered during the accident investigation, which effectively added another year to the return to service schedule.

Here are some things that do not sit down well with many.

1. The effect of cosmic rays when it comes to aviation has been known for decades. It is not something new that should have been uncovered after accidents. This is one area that is so well known, so well understood that getting it right first time of asking should be the norm. It was not a priority for Boeing, neither was it for the FAA.

2. Boeing wrote aviation code that relied on one angle of attack sensor; a part that can fail for all manner of reasons and gave that code the ability to crash a plane. When they expanded its mandate, no proper fault matrix was in place to analyze what had been done and how it could play out. When test pilots found out, they chose to keep it in house as opposed to telling the FAA.

This plane would never have been certified first time round, and we know this because all you could hear from Bahrami and Elwell was 'if we knew what we now know' at the hearings.

Boeing did a poor job, and knew they could do a poor job and get away with it. This is how you end up with a Dreamliner that is almost a decade old and Boeing has not mastered the process of building them to their own specification. This is how you end up with shoddy work so bad that one problem cascades into numerous others.

Dickson was wise in delaying the entry into service and demanding that they actually do their job right. Not some of it, all of it; be it rewriting MCAS, be it cosmic ray prevention, be it wiring or how the flight CPU's work.

kalvado wrote:

Pythagoras wrote:

From my recollection, Boeing had a software patch developed to rectify the worst aspects of MCAS in March 2019.

This was claimed many times, but never substantiated. On the other hand, there were claims that AD reminder is sufficient. We may safely assume that claimed development never happened.

From NYT dated March 14, 2019:

Weeks after a deadly crash involving a Boeing plane last October, company officials met separately with the pilot unions at Southwest Airlines and American Airlines. The officials said they planned to update the software for their 737 Max jets, the plane involved in the disaster, by around the end of 2018.

It was the last time the Southwest pilots union heard from Boeing, and months later, the carriers are still waiting for a fix. After a second 737 Max crashed, on Sunday in Ethiopia, United States regulators said the software update would be ready by April.

“Boeing was going to have a software fix in the next five to six weeks,” said Michael Michaelis, the top safety official at the American Airlines pilots union and a Boeing 737 captain. “We told them, ‘Yeah, it can’t drag out.’ And well, here we are.”

Ref: https://www.nytimes.com/2019/03/14/busi ... pdate.html

Fixes definitely were in progress at the time the 2nd crash happened.

kalvado wrote:

Pythagoras wrote:

After the accident and in the midst of certifying this fix, Boeing uncovered that the flight control computers were susceptible to a flipped-bit from a cosmic ray.

After Boeing submitted a patch for certification, they were shown the corresponding paragraphs in regulations - and everyone suddenly recognized architecture was not certifiable. It didn't occur to Boeing that increased control system authority raises the bar.

As Lightsaber just reminded us, if you state something as fact, a link is required.

As far as we know the scenario played out as Pythagoras suggested:

While conducting newly stringent tests on the Boeing 737 MAX flight control system, the Federal Aviation Administration (FAA) in June uncovered a potential flaw that now has spurred Boeing to make a fundamental software-design change.

Boeing is changing the MAX’s automated flight-control system’s software so that it will take input from both flight-control computers at once instead of using only one on each flight. That might seem simple and obvious, but in the architecture that has been in place on the 737 for decades, the automated systems take input from only one computer on a flight, switching to use the other computer on the next flight.

Ref: https://www.seattletimes.com/business/b ... -controls/

It goes on to say that the change to "catastropic" classification only happened when FAA showed one of three pilots could not recover the plane in the presence of three simulated bit flips:

Describing what was tested in June as “a particular failure that was extremely remote,” Bahrami said “several of our pilots were able to recover. But there was one or so that could not recover successfully.”

That outcome changed everything for Boeing.

Prior to that, Boeing had classified this failure mode as a “major fault,” a category that can be mitigated by flight-crew action. The one pilot’s failure to recover immediately changed the classification to “catastrophic,” and FAA regulations require that no single fault can be permitted to lead to a catastrophic outcome. That meant Boeing must fix it and eliminate the possibility.

I don't know of any evidence it happened the way you suggested, someone reading regulations when a patch was submitted, nor do I have any evidence it was due to the amount of control authority. Feel free to contribute links if you have them.

Revelation wrote:

kalvado wrote:

Pythagoras wrote:

From my recollection, Boeing had a software patch developed to rectify the worst aspects of MCAS in March 2019.

This was claimed many times, but never substantiated. On the other hand, there were claims that AD reminder is sufficient. We may safely assume that claimed development never happened.

From NYT dated March 14, 2019:

Weeks after a deadly crash involving a Boeing plane last October, company officials met separately with the pilot unions at Southwest Airlines and American Airlines. The officials said they planned to update the software for their 737 Max jets, the plane involved in the disaster, by around the end of 2018.

It was the last time the Southwest pilots union heard from Boeing, and months later, the carriers are still waiting for a fix. After a second 737 Max crashed, on Sunday in Ethiopia, United States regulators said the software update would be ready by April.

“Boeing was going to have a software fix in the next five to six weeks,” said Michael Michaelis, the top safety official at the American Airlines pilots union and a Boeing 737 captain. “We told them, ‘Yeah, it can’t drag out.’ And well, here we are.”

Ref: https://www.nytimes.com/2019/03/14/busi ... pdate.html

Fixes definitely were in progress at the time the 2nd crash happened.

kalvado wrote:

Pythagoras wrote:

After the accident and in the midst of certifying this fix, Boeing uncovered that the flight control computers were susceptible to a flipped-bit from a cosmic ray.

After Boeing submitted a patch for certification, they were shown the corresponding paragraphs in regulations - and everyone suddenly recognized architecture was not certifiable. It didn't occur to Boeing that increased control system authority raises the bar.

As Lightsaber just reminded us, if you state something as fact, a link is required.

As far as we know the scenario played out as Pythagoras suggested:

While conducting newly stringent tests on the Boeing 737 MAX flight control system, the Federal Aviation Administration (FAA) in June uncovered a potential flaw that now has spurred Boeing to make a fundamental software-design change.

Boeing is changing the MAX’s automated flight-control system’s software so that it will take input from both flight-control computers at once instead of using only one on each flight. That might seem simple and obvious, but in the architecture that has been in place on the 737 for decades, the automated systems take input from only one computer on a flight, switching to use the other computer on the next flight.

Ref: https://www.seattletimes.com/business/b ... -controls/

It goes on to say that the change to "catastropic" classification only happened when FAA showed one of three pilots could not recover the plane in the presence of three simulated bit flips:

Describing what was tested in June as “a particular failure that was extremely remote,” Bahrami said “several of our pilots were able to recover. But there was one or so that could not recover successfully.”

That outcome changed everything for Boeing.

Prior to that, Boeing had classified this failure mode as a “major fault,” a category that can be mitigated by flight-crew action. The one pilot’s failure to recover immediately changed the classification to “catastrophic,” and FAA regulations require that no single fault can be permitted to lead to a catastrophic outcome. That meant Boeing must fix it and eliminate the possibility.

We have no evidence it happened the way you suggested, someone reading regulations when a patch was submitted, nor do we have any evidence it was due to the amount of control authority.

Thanks for finding a proof for me

While conducting newly stringent tests on the Boeing 737 MAX flight control system, the Federal Aviation Administration (FAA) in June uncovered a potential flaw that now has spurred Boeing to make a fundamental software-design change.

And a bit clearer:
https://www.engadget.com/2019-06-26-737 ... oeing.html
FAA discovers another potential risk with the Boeing 737 Max.

Gremlinzzzz wrote:

Here are some things that do not sit down well with many.

1. The effect of cosmic rays when it comes to aviation has been known for decades. It is not something new that should have been uncovered after accidents. This is one area that is so well known, so well understood that getting it right first time of asking should be the norm. It was not a priority for Boeing, neither was it for the FAA.

Their presence is well known, some measures were taken to deal with it such as software scrubbing, but the decision to rely on the pilots to handle MCAS as an instance of runaway stab keeping MCAS out of the catastrophic category is why the ultimate fix, active-active flight control computers, wasn't taken till after the crash.

From the ST article, even as the issue was being unwound it is not being portrayed as being highly significant:

What the FAA was testing when it discovered this new vulnerability was esoteric and remote. According to the person familiar with the details, who asked for anonymity because of the sensitivity of the ongoing investigations, the specific fault that showed up has “never happened in 200 million flight hours on this same flight-control computer in [older model] 737 NGs.”
...
“We were deliberately emulating some aspects of MCAS in a theoretical failure mode,” the person familiar with the tests said.

This person emphasized how extremely improbable it is that five single bits on the microprocessor would flip at once and that the random bits would make these specific critical changes to the aircraft’s systems.

“While it’s a theoretical failure mode that has never been known to occur, we cannot prove it can’t happen,” he said. “So we have to account for it in the design.”

Dwight Schaeffer, a former senior manager at Boeing Commercial Electronics, the company’s one-time in-house avionics division, agreed. “Five independent bit flips is really an extremely improbable event,” he said.
...
“There are active means of protecting against bit flips,” said retired Boeing electronics manager Schaeffer. “We always built it into our own software.”

Ref: https://www.seattletimes.com/business/b ... -controls/

Gremlinzzzz wrote:

2. Boeing wrote aviation code that relied on one angle of attack sensor; a part that can fail for all manner of reasons and gave that code the ability to crash a plane. When they expanded its mandate, no proper fault matrix was in place to analyze what had been done and how it could play out. When test pilots found out, they chose to keep it in house as opposed to telling the FAA.

Again, it goes back to the improper categorization of MCAS, something Boeing has managed to keep a tight lid on. We know next to nothing about the what/when/why of all of that. Crucially for Boeing, it allows them to say it's all simple human error rather than a side effect of a management push for profits over safety. Luckily for them, Congress spent their time throwing Muilenberg under the bus for his pay package and of course Forkner's drunken text messages were easy to lock in on.

Revelation wrote:

As far as we know the scenario played out as Pythagoras suggested:

While conducting newly stringent tests on the Boeing 737 MAX flight control system, the Federal Aviation Administration (FAA) in June uncovered a potential flaw that now has spurred Boeing to make a fundamental software-design change.

Boeing is changing the MAX’s automated flight-control system’s software so that it will take input from both flight-control computers at once instead of using only one on each flight. That might seem simple and obvious, but in the architecture that has been in place on the 737 for decades, the automated systems take input from only one computer on a flight, switching to use the other computer on the next flight.

Ref: https://www.seattletimes.com/business/b ... -controls/

It goes on to say that the change to "catastropic" classification only happened when FAA showed one of three pilots could not recover the plane in the presence of three simulated bit flips:

Describing what was tested in June as “a particular failure that was extremely remote,” Bahrami said “several of our pilots were able to recover. But there was one or so that could not recover successfully.”

That outcome changed everything for Boeing.

Prior to that, Boeing had classified this failure mode as a “major fault,” a category that can be mitigated by flight-crew action. The one pilot’s failure to recover immediately changed the classification to “catastrophic,” and FAA regulations require that no single fault can be permitted to lead to a catastrophic outcome. That meant Boeing must fix it and eliminate the possibility.

I don't know of any evidence it happened the way you suggested, someone reading regulations when a patch was submitted, nor do I have any evidence it was due to the amount of control authority. Feel free to contribute links if you have them.

Expanding a little bit:
Firstly, thank you very much for direct evidence against "US pilots are superior" - apparently, not superior enough to handle MCAS issue even with all the information at hand.
Second, this is exactly about control authority - a proof just flew over my head: a 737NG with same computer controlling STS without parallel operation, and apparently not significantly affected by bit flip issue. More authority of MCAS, such as override of column input, is what causing different designation.
My take is that bit flip tests were not even conducted on NG as the architecture has no chance of passing these tests.

You can built a few different logical paths here, but the bottom line is that new system meant applying extra requirements - which Boeing apparently didn't run in-house.

Revelation wrote:

Gremlinzzzz wrote:

Here are some things that do not sit down well with many.

1. The effect of cosmic rays when it comes to aviation has been known for decades. It is not something new that should have been uncovered after accidents. This is one area that is so well known, so well understood that getting it right first time of asking should be the norm. It was not a priority for Boeing, neither was it for the FAA.

Their presence is well known, some measures were taken to deal with it such as software scrubbing, but the decision to rely on the pilots to handle MCAS as an instance of runaway stab keeping MCAS out of the catastrophic category is why the ultimate fix, active-active flight control computers, wasn't taken till after the crash.

From the ST article, even as the issue was being unwound it is not being portrayed as being highly significant:

What the FAA was testing when it discovered this new vulnerability was esoteric and remote. According to the person familiar with the details, who asked for anonymity because of the sensitivity of the ongoing investigations, the specific fault that showed up has “never happened in 200 million flight hours on this same flight-control computer in [older model] 737 NGs.”
...
“We were deliberately emulating some aspects of MCAS in a theoretical failure mode,” the person familiar with the tests said.

This person emphasized how extremely improbable it is that five single bits on the microprocessor would flip at once and that the random bits would make these specific critical changes to the aircraft’s systems.

“While it’s a theoretical failure mode that has never been known to occur, we cannot prove it can’t happen,” he said. “So we have to account for it in the design.”

Dwight Schaeffer, a former senior manager at Boeing Commercial Electronics, the company’s one-time in-house avionics division, agreed. “Five independent bit flips is really an extremely improbable event,” he said.
...
“There are active means of protecting against bit flips,” said retired Boeing electronics manager Schaeffer. “We always built it into our own software.”

Ref: https://www.seattletimes.com/business/b ... -controls/

Gremlinzzzz wrote:

2. Boeing wrote aviation code that relied on one angle of attack sensor; a part that can fail for all manner of reasons and gave that code the ability to crash a plane. When they expanded its mandate, no proper fault matrix was in place to analyze what had been done and how it could play out. When test pilots found out, they chose to keep it in house as opposed to telling the FAA.

Again, it goes back to the improper categorization of MCAS, something Boeing has managed to keep a tight lid on. We know next to nothing about the what/when/why of all of that. Crucially for Boeing, it allows them to say it's all simple human error rather than a side effect of a management push for profits over safety. Luckily for them, Congress spent their time throwing Muilenberg under the bus for his pay package and of course Forkner's drunken text messages were easy to lock in on.

And I would challenge "never occured" statement. Never documented, maybe. Is there enough logging capability is 737 control system to recognize and record such instant failures after recovery to begin with? I remember there was an issue with lack of processing power for MCAS at some point.
I assume there is some watchdog, which just bites in case things are not going as expected. Again, is there any information about how often that watchdog bite frequency?

kalvado wrote:

My take is that bit flip tests were not even conducted on NG as the architecture has no chance of passing these tests.

You can built a few different logical paths here, but the bottom line is that new system meant applying extra requirements - which Boeing apparently didn't run in-house.

Boeing's answer would be that these bit tests, ones that focus on MCAS being activated by coordinated bit flips, weren't needed for NG because MCAS wasn't present, and NG was certifiable without MCAS. On NG, the entire flight control computer is just a fancy workload reducer from the point of view of certification, if it malfunctions just turn it off and fly it by hand.

MAX needed MCAS to be certifiable, but Boeing decided without much apparent scrutiny relying on a rule that doesn't exist in FARs that pilots would recognize any MCAS malfunction as being a runaway stab in four seconds or less and then would follow the recovery procedures and recover the airplane. Once FAA saw that this wasn't the case when one pilot did not recover the plane (apparently June 2019 after the second crash while testing the first proposed fix), MCAS was reclassified as catastrophic, and then the bit flip testing showed the need for active/active flight control computers.

The bottom line is that this is all a house of cards, with Boeing doubling down at various points on that one decision that pilots would treat any MCAS malfunction as runaway stab and recover the plane. As far as we know, no actual end-to-end test was ever made to validate that decision. For instance, we know of no test where they took off with a jammed AoA on the active flight control computer side to see what would happen. As far as we know, it was all decided by just one person reading through stacks of documents doing mental exercises that convinced them by their own reckoning that pilots would recognize it as runaway stab and be able to recover the plane.

Talking about memory failures.
THere is a pretty interesting paper by Eugene Normand from Boeing Defence(!!) published in 1996. It is about contemporary to NG/MAX computer systems.
Long story short, bit failure rate is on the order of 1e-12 per bit per hour on sea level, likely 300 times higher at 40k feet.
NG originally had 8 mbyte memory, 1e8 bits give or take. So simple bit flip should occur about once in 10k hours on the ground or 30 hours of flight. To make things worse, some batches seem to be more prone than others...

Revelation wrote:

kalvado wrote:

My take is that bit flip tests were not even conducted on NG as the architecture has no chance of passing these tests.

You can built a few different logical paths here, but the bottom line is that new system meant applying extra requirements - which Boeing apparently didn't run in-house.

Boeing's answer would be that these bit tests, ones that focus on MCAS being activated by coordinated bit flips, weren't needed for NG because MCAS wasn't present, and NG was certifiable without MCAS. On NG, the entire flight control computer is just a fancy workload reducer from the point of view of certification, if it malfunctions just turn it off and fly it by hand.

MAX needed MCAS to be certifiable, but Boeing decided without much apparent scrutiny relying on a rule that doesn't exist in FARs that pilots would recognize any MCAS malfunction as being a runaway stab in four seconds or less and then would follow the recovery procedures and recover the airplane. Once FAA saw that this wasn't the case when one pilot did not recover the plane (apparently June 2019 after the second crash while testing the first proposed fix), MCAS was reclassified as catastrophic, and then the bit flip testing showed the need for active/active flight control computers.

The bottom line is that this is all a house of cards, with Boeing doubling down at various points on that one decision that pilots would treat any MCAS malfunction as runaway stab and recover the plane. As far as we know, no actual end-to-end test was ever made to validate that decision. For instance, we know of no test where they took off with a jammed AoA on the active flight control computer side to see what would happen. As far as we know, it was all decided by just one person reading through stacks of documents doing mental exercises that convinced them by their own reckoning that pilots would recognize it as runaway stab and be able to recover the plane.

Looks like we're again discussing if glass is half empty or half full.
We can agree on NG computer didn't need to be as robust. Then some new system raised the bar. So suddenly someone wants a harsh test on that poor thing as higher bar requires passing those tests....

jjbiv wrote:

The fatal mistake on ET302 was the crew not flying the plane.

The fatal mistake was putting profit over safety at Boeing and taking the development of the Boeing 737 one step too far.

If the crew of ET302 was to blame, the aircraft type would not have been grounded for almost two years.

kalvado wrote:

Looks like we're again discussing if glass is half empty or half full.
We can agree on NG computer didn't need to be as robust. Then some new system raised the bar. So suddenly someone wants a harsh test on that poor thing as higher bar requires passing those tests....

I prefer to work within the space of what we know and what we don't know so we can try to understand the flaws in the system that led to the tragic outcomes, rather than making generic statements.

Boeing stuck with the four second rule after both the first and second crashes and it only became untenable when the first proposed fix was being tested.

The four second rule still serves as the basis of the human error defense that is allowing Boeing to avoid even more serious liability claims.

I love Boeing and the products they make but I think it’s very disingenuous to blame anybody else but Boeing for the MAX disaster. They did a horrible job on that aircraft. There are pilots all over the world that fly all types of aircraft that do not face those kind of conditions. Might other pilots have dealt with those conditions better? Maybe, maybe not. But the main question is why did the condition have to exist in the first place? And secondly Boeing told NOBODY about this condition. Like look let’s just be honest with ourselves here

MartijnNL wrote:

The fatal mistake was putting profit over safety at Boeing and taking the development of the Boeing 737 one step too far.

While that's an easy conclusion to reach, there isn't evidence to support that conclusion that would stand up in a court of law.

The "simple human error" rationale still stands in the legal realm, even if the greed rationale resonates more widely.

Revelation wrote:

MartijnNL wrote:

The fatal mistake was putting profit over safety at Boeing and taking the development of the Boeing 737 one step too far.

While that's an easy conclusion to reach, there isn't evidence to support that conclusion that would stand up in a court of law.

The "simple human error" rationale still stands in the legal realm, even if the greed rationale resonates more widely.

We Just look at different parts of the puzzle. Personally I am willing to accept everything before Lion crash as "shit happens". unfortunately for me, most people are focused - justifyably - on that period as a root cause. Events between two crashes are most interesting and most revealing from my perspective, and response - or lack their of - is the part I cannot just brush off.

kalvado wrote:

Events between two crashes are most interesting and most revealing from my perspective, and response - or lack their of - is the part I cannot just brush off.

To me the most interesting aspect of that time period is that some group of people within Boeing was working on the fix, therefore some group of people within Boeing knew MCAS was flawed and needed to be fixed, which is something most of the press reporting seems to have not picked up on.

Clearly just looking at ADS-B data, not to mention having the FDR data, was enough to show engineers that MCAS was deeply flawed. From the press reporting it seems Boeing in general and upper level management in particular could just not accept they screwed things up so badly. I presume this was aided by middle managers not wanting to bring bad news to their bosses.

Revelation wrote:

The bottom line is that this is all a house of cards, with Boeing doubling down at various points on that one decision that pilots would treat any MCAS malfunction as runaway stab and recover the plane. As far as we know, no actual end-to-end test was ever made to validate that decision. For instance, we know of no test where they took off with a jammed AoA on the active flight control computer side to see what would happen. As far as we know, it was all decided by just one person reading through stacks of documents doing mental exercises that convinced them by their own reckoning that pilots would recognize it as runaway stab and be able to recover the plane.

This is why the recommendations from JTAR concerning human factors is so important. If the regulatory guidance from the FAA does not require an "actual end-to-end test" scenario than it is left to prior practice to approve the system as acceptable. The fact that eight non-normal procedures are being revised for the 737NG is evidence that the industry--OEM, regulators, and airlines--did not fully understand the situation that pilots were facing in the flight deck. Ethiopia Airlines' Bernd von Hoesslin understood the issue when he recommended more training for his fellow pilots. But in the absence of supporting data validating those assertions, Ethiopian Airlines management proceeded with business as usual, which included placing a very green first officer in the right seat.

And here is where I would point out an error which no one has touched upon. Everyone in the chain of the decision making, whether that is Boeing, the FAA or the management at Ethiopian Airlines under stated the risk of the pilot "not doing the right thing." It only took one of those players to take a position and the entire chain of events would have been broken. In this regard, it is much like past accidents where assumptions were made rather than proof being provided. It was assumed that the pilots would do the right thing rather than proving that they would. The circumstances of Lion Air LNI610 accident would have supported the mistaken belief in a high confidence in pilot corrective action as the flight before the accident demonstrated the proper use of the procedure. This is the lesson learned that we have to have one more time. The rule in airplane safety is that it is unsafe until it has been proven to be safe.

Revelation wrote:

kalvado wrote:

Events between two crashes are most interesting and most revealing from my perspective, and response - or lack their of - is the part I cannot just brush off.

To me the most interesting aspect of that time period is that some group of people within Boeing was working on the fix, therefore some group of people within Boeing knew MCAS was flawed and needed to be fixed, which is something most of the press reporting seems to have not picked up on.

Clearly just looking at ADS-B data, not to mention having the FDR data, was enough to show engineers that MCAS was deeply flawed. From the press reporting it seems Boeing in general and upper level management in particular could just not accept they screwed things up so badly. I presume this was aided by middle managers not wanting to bring bad news to their bosses.

There was a post in the comments section of a 737Max article in the Seattle Times where the poster, who appears knowledgeable of the inside dynamics of the company, claims that re-writing the software was started the day after the Lion Air accident. It was apparent to everyone after seeing the trace of the Lion Air flight data recorder that the behavior of the system was flawed. I know that I was having discussions with my colleagues after the information was made public to that effect.

Pythagoras wrote:

Revelation wrote:

The bottom line is that this is all a house of cards, with Boeing doubling down at various points on that one decision that pilots would treat any MCAS malfunction as runaway stab and recover the plane. As far as we know, no actual end-to-end test was ever made to validate that decision. For instance, we know of no test where they took off with a jammed AoA on the active flight control computer side to see what would happen. As far as we know, it was all decided by just one person reading through stacks of documents doing mental exercises that convinced them by their own reckoning that pilots would recognize it as runaway stab and be able to recover the plane.

This is why the recommendations from JTAR concerning human factors is so important. If the regulatory guidance from the FAA does not require an "actual end-to-end test" scenario than it is left to prior practice to approve the system as acceptable. The fact that eight non-normal procedures are being revised for the 737NG is evidence that the industry--OEM, regulators, and airlines--did not fully understand the situation that pilots were facing in the flight deck. Ethiopia Airlines' Bernd von Hoesslin understood the issue when he recommended more training for his fellow pilots. But in the absence of supporting data validating those assertions, Ethiopian Airlines management proceeded with business as usual, which included placing a very green first officer in the right seat.

And here is where I would point out an error which no one has touched upon. Everyone in the chain of the decision making, whether that is Boeing, the FAA or the management at Ethiopian Airlines under stated the risk of the pilot "not doing the right thing." It only took one of those players to take a position and the entire chain of events would have been broken. In this regard, it is much like past accidents where assumptions were made rather than proof being provided. It was assumed that the pilots would do the right thing rather than proving that they would. The circumstances of Lion Air LNI610 accident would have supported the mistaken belief in a high confidence in pilot corrective action as the flight before the accident demonstrated the proper use of the procedure. This is the lesson learned that we have to have one more time. The rule in airplane safety is that it is unsafe until it has been proven to be safe.

Not really. It is hard to find lots of proof in piles of messages, but MCAS was questioned.
There was something about EASA trying to say something, but brought into compliance. Some other regulators were more resilient.
Brazil: https://safetymatters.co.in/2019/02/06/ ... ntmindfly/