Don Hudson

Donating Member
  • Content Count

    5,405
  • Joined

  • Last visited

  • Days Won

    135

Don Hudson last won the day on September 16

Don Hudson had the most liked content!

Community Reputation

734 Excellent

6 Followers

About Don Hudson

  • Rank
    7

Profile Information

  • Gender
    Male

Recent Profile Visitors

4,523 profile views
  1. The loss of trust, prestige, status, reputation and 'face' are already incalculable by comparison to the dollar figure which could exceed US$100b. Trust and integrity are necessary qualities for aviation to sustain itself - that is its only "stock-and-trade"; the rest is mere technology which is worth nothing against "character".
  2. International regulator report slams Boeing, FAA over 737 MAX design and approval Oct. 11, 2019 at 9:31 am Updated Oct. 11, 2019 at 8:51 pm By Dominic Gates Seattle Times aerospace reporter An international panel of air-safety regulators convened by the Federal Aviation Administration (FAA) released a damning report Friday that criticizes both Boeing and the FAA for how they assessed and approved the design of the 737 MAX automated flight-control system implicated in two fatal airliner crashes. More broadly, the panel also questioned how systems on the the MAX were certified as derivative of a now-50-year-old aircraft design. And it further recommended that airplane-safety systems address the new reality of increased cockpit automation by reducing the reliance on pilots to respond to emergencies, and instead designing protections as part of the systems. The report from officials representing 10 different regulatory bodies carries the weight of the world’s aviation experts. Its findings point to glaring shortcomings in how Boeing’s 737 MAX was certified as safe, with the company effectively auditing its own design and and the FAA unable to fulfill its oversight role. That’s a blow to Boeing’s reputation but also to the long-established primacy of the FAA among global aviation bodies. And the report raises serious questions as to how the regulatory system can be fixed to prevent similar accidents in the future. The Joint Authorities Technical Review (JATR) panel found that the MAX’s new flight-control system, which played a central role in the accidents in Indonesia and Ethiopia that killed 346 people, was not properly evaluated in the certification documents that Boeing submitted to the FAA. 737 MAX CRISIS COMPLETE COVERAGE » Dennis Muilenburg out as Boeing chairman but keeps CEO position Boeing rejected 737 MAX safety upgrades before fatal crashes, whistleblower says Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts Echoing a Seattle Times report on March 17, less than a week after the second crash, the panel found that Boeing submitted to the FAA an inadequate technical description of the airplane’s new Maneuvering Characteristics Augmentation System (MCAS), lacking full details of when the system activated and the extent of its power to push an airplane nose down. Boeing’s documentation of MCAS was fragmented and incomplete, the report said. When Boeing changed the design to make it more powerful and to reduce the trigger mechanism to a single sensor, that wasn’t fully communicated to the FAA. Undue pressure The report also found that the FAA had “limited involvement” in the evaluation of MCAS and left most of the work of assessing the system to Boeing itself. “MCAS should have been considered a novelty (and therefore clearly highlighted to the FAA technical staff) owing to the important differences in function and implementation it has on the B737 MAX,” the report declares. In practice, FAA personnel had “inadequate awareness” of how MCAS worked, which “resulted in an inability of the FAA to provide an independent assessment.” The report, confirming a Seattle Times report on May 5, also cites indications that Boeing employees working on the certification of the airplane on behalf of the FAA faced “undue pressure” from managers who prioritized cost and schedule. The report recommends revision of the system whereby the FAA delegates much of the oversight of airplane certification to Boeing, a system known as Organization Designation Authorization. Under ODA, Boeing engineers who do the certification analysis and testing report to managers within the Boeing organization who relay the results to the FAA. The JATR recommends adjusting this structure so that authorized engineers at Boeing have direct, “open lines of communication to FAA certification engineers without fear of punitive action or process violation” to ensure they “are working without any undue pressure when they are making decisions on behalf of the FAA.” This recommendation mirrors the advice of experts cited in the May 5 Seattle Times story who advised the FAA to revert to elements of an earlier oversight structure — called Designated Engineering Representatives or DERs — in which the Boeing engineers who act on behalf of the FAA report to their technical counterparts at the FAA. Pilots unable to cope The panel also questions the assumption in FAA regulations that pilots will recognize something wrong within 1 second when flying the plane manually and will take corrective action within 3 seconds. The report indicates that the 737’s crew-alerting systems that tell pilots when something goes wrong may not be adequate for such an assumption. The JATR noted that a system fault can result in cascading failures, and asked the FAA to assess the adequacy of both the certification process and of pilot training to address “the impact of multiple alarms, along with possible startle effect, on the ability of pilots to respond appropriately.” Regulators need to ensure there’s adequate training so pilots can “respond effectively to failures that they may never have encountered before,” the report states. Last week, the Seattle Times reported that Boeing pushed the FAA to relax certification requirements for crew alerts on the 737 MAX. As a result, the JATR team determined, the certification process did not adequately address this issue of multiple clamoring alarms and the expected pilot response. JATR therefore recommends a top-down reassessment of how airplanes like the MAX that are derivatives of earlier models are certified, to determine when an aging aircraft design is “incapable of supporting the safety advancements introduced by the latest regulations.” The report states that the FAA raised concerns to Boeing about the cumulative effect of cockpit system changes from the previous 737 model to the MAX and suggested that might create a need for simulator level pilot training. Boeing’s response to this concern, which the FAA accepted, was that there was “no precedent” for a demand for enhanced training in previous certifications of derivative models. In a teleconference call Friday, JATR chairman Christopher Hart, former chair of the National Transportation Safety Board (NTSB), said that the increasing prevalence of automation on aircraft means that the problems with the MAX are “not just an airplane problem, but an airplane/pilot problem,” which he said complicates decisions about grounding and ungrounding an aircraft and is likely to become a major issue in the future. “As automation becomes more and more complex, pilots are less likely to fully understand it and more likely to have problems and more likely to encounter scenarios in real operations that they haven’t seen even in a simulator,” he said. Hart called on the FAA and regulators worldwide to recognize and address “this new reality of super-complex automation and pilots not necessarily understanding how to operate it.” The JATR report says that as systems become more complex, the certification process should ensure that aircraft incorporate “fail-safe” designs, meaning that any system failure triggers an automatic default into a safe mode. The goal is to eliminate or mitigate hazards “through design, minimizing reliance on pilot action as primary means of risk mitigation,” the report goes on. The panel separately recommends that “the FAA should review the natural (bare airframe) stalling characteristics of the B737 MAX to determine if unsafe characteristics exist.” This implies JATR wants the FAA to assess the safety of the plane without MCAS in operation. Boeing has said that the purpose of MCAS is not to prevent a stall but simply to make sure it handles exactly like the earlier model 737 when going through certain stall testing. Some criticism of the company on social media has been skeptical of this, proclaiming the MAX “inherently unstable” because it needs software to fly safely. To demonstrate otherwise, Boeing test pilots this summer repeatedly flew that required stall test on the MAX — an extreme maneuver called a “wind-up turn” — both with and without the revamped MCAS operating. Boeing says it is satisfied with the results. The FAA and overseas regulators will conduct their own flight tests, likely next month. MCAS upgraded JATR was convened in April by the FAA to independently evaluate all aspects of the design and certification of MCAS. The panel is made up of technical safety experts from the FAA and NASA along with the civil aviation authorities of Australia, Brazil, Canada, China, the European Union, Japan, Indonesia, Singapore and the United Arab Emirates. Boeing did not directly address the report’s findings Friday but said in a statement that it “is committed to working with the FAA.” FAA Administrator Steve Dickson issued a statement thanking JATR for its “unvarnished and independent” report. “I will review every recommendation and take appropriate action,” Dickson said. “We welcome this scrutiny.” MCAS consists of new flight-control software added to the MAX. If a sensor that measures the jet’s angle of attack, the angle between the wing and the oncoming air flow, indicates that the nose of the aircraft is pitching up, MCAS is designed to swivel the jet’s horizontal tail — called the horizontal stabilizer — so as to push the nose of the aircraft back down. The JATR report notes the failure in communication between Boeing and the FAA during the certification process as MCAS evolved “from a relatively benign system to a much more aggressive system.” The result was a failure to address the potential unintended consequences that resulted from “designing software for one scenario — in this case, high-speed windup turns — and then modifying the software for a different scenario — in this case reducing the pitch-up tendency at higher angles of attack at low speeds.” Boeing has prepared a redesign of MCAS that addresses the inadequacies of the original design, which was activated by a single angle-of-attack sensor. On both crash flights, the accidents were initiated by a false signal from that one sensor. The updated MCAS software will be activated only if both such sensors on the aircraft show the same high angle of attack. In addition, the system is now redesigned so that it can activate only once. And Boeing has changed the overall software system architecture to compare readings from both flight control computers, instead of using only one, and to shut down MCAS in less than a second if the computers disagree. But as regulators evaluate those improvements and the pilot training that will be required, the 737 MAX remains grounded worldwide seven months after the second crash. On Friday’s teleconference, FAA spokesman Lynn Lunsford said that because the FAA is doing an entirely new safety analysis of all the changes to the MAX before giving the plane clearance to return to service, “the majority of the return to flight issues that have been raised by JATR are being addressed.” “We are going through the recommendations one more time to make sure that any of them that aren’t being addressed will be as part of the current review,” Lunsford added. Page 1 of Final JATR Submittal to FAA Oct 2019 DocumentCloud Contributed to DocumentCloud by Judy Averill of The Seattle Times • View document Dominic Gates: 206-464-2963 or dgates@seattletimes.com; on Twitter: @dominicgates.
  3. When is a "whistleblower" not a whistleblower? What is the need for such a role in an organization and what processes, if any, make such a role redundant or at least unnecessary?
  4. Boeing whistleblower’s complaint says 737 MAX safety upgrades were rejected over cost Oct. 2, 2019 at 6:00 am 1 of 2 | (Gabriel Campanario / The Seattle Times) By Dominic Gates , Steve Miletich and Lewis Kamb Seattle Times staff reporters Seven weeks after the second fatal crash of a 737 MAX in March, a Boeing engineer submitted a scathing internal ethics complaint alleging that management — determined to keep down costs for airline customers — had blocked significant safety improvements during the jet’s development. The ethics charge, filed by 33-year-old engineer Curtis Ewbank, whose job involved studying past crashes and using that information to make new planes safer, describes how around 2014 his group presented to managers and senior executives a proposal to add various safety upgrades to the MAX. The complaint, a copy of which was reviewed by The Seattle Times, suggests that one of the proposed systems could have potentially prevented the crashes in Indonesia and Ethiopia that killed 346 people. Three of Ewbank’s former colleagues interviewed for this story concurred. The details revealed in the ethics complaint raise new questions about the culture at Boeing and whether the long-held imperative that safety must be the overarching priority was compromised on the MAX by business considerations and management’s focus on schedule and cost. Managers twice rejected adding the new system on the basis of “cost and potential (pilot) training impact,” the complaint states. It was then raised a third time in a meeting with 737 MAX chief project engineer, Michael Teal, who cited the same objections as he killed the proposal. 737 MAX crisis | Complete coverage » · Boeing made erroneous assumptions on pilots’ response to alerts in 737 MAX, NTSB says · Boeing’s board calls for better internal safety oversight in wake of 737 MAX crashes · Boeing CEO sees ‘endgame’ in effort to lift grounding of 737 MAX A version of the proposed system, called synthetic airspeed, was already installed on the 787 Dreamliner. It was not directly related to the flight-control system — the Maneuvering Characteristics Augmentation System (MCAS) — that contributed to both crashes. But it would have detected the false angle of attack signal that initiated events in both accidents, and so potentially could have stopped MCAS from activating and repeatedly pushing down the nose of each jet. But installing it in the MAX would likely have meant 737 pilots needed extra training in flight simulators. Running thousands of pilots through simulator sessions would have delayed the jet’s entry into service and added substantial costs for Boeing’s airline customers, damaging the MAX’s competitive edge against the rival Airbus A320neo. Ewbank’s complaint goes further than the decision not to install this one new system. He describes management as “more concerned with cost and schedule than safety and quality.” And he alleges that in one instance Boeing hid inflight safety incident data from the European Union Aviation Safety Agency (EASA). As first reported in The Seattle Times, Boeing did an inadequate system safety assessment that missed flaws in the design of MCAS that were central to the two MAX disasters. And Boeing engineers were under pressure to limit safety testing to certify the MAX. These fresh allegations from inside Boeing indicate that the problems with jetmaker’s safety culture may go deeper than MCAS. Submitted via Boeing’s internal whistleblower system, Ewbank’s complaint alleges that MAX program managers, concerned with avoiding higher costs and more pilot training, were intent on “shutting down trade studies that attempted to modernize the airplane and avoiding awareness of known issues encountered in historical 737 operation.” Federal investigators The FBI has interviewed at least two Boeing employees about the complaint. It’s unclear how the Boeing document reached the agency, but federal investigators are known to have issued subpoenas to the company. Department of Justice prosecutors, Department of Transportation inspectors and Securities and Exchange Commission (SEC) officials are all involved in a wide-ranging federal investigation into possible wrongdoing at Boeing during certification of the MAX that was already under way before the engineer filed his internal complaint in April. Boeing declined to comment on the details of the ethics complaint. Teal, 737 MAX chief project engineer, could not be reached for comment. The Department of Justice also declined to comment. The Seattle Times is not naming the employees who have been questioned by the FBI to protect the identity of the source of that information. Ewbanks declined to be interviewed. The Seattle Times is naming him because he identified himself in his complaint to Boeing. The MAX has been grounded worldwide for almost seven months as Boeing works on a comprehensive fix to its flight-control systems that will satisfy air safety regulators around the globe. The final updates to the systems are expected to be submitted to the Federal Aviation Administration (FAA) this month, and Boeing anticipates clearance to return the jet to the sky in November. Meanwhile, multiple investigations and reviews, internal and external, are examining what caused the deadly crashes. Last week, Boeing’s board announced a revamp of the company’s reporting structures aimed at producing better internal safety oversight. On Monday, Boeing chairman and chief executive Dennis Muilenburg said he’s “taking immediate steps” to implement those recommendations. The engineer Ewbank’s ethics complaint expressed concern about the possible personal consequences of stepping forward inside the company. “Given the nature of this complaint, the fear of retaliation is high, despite all official assurances that this should not be the case,” he wrote. “There is a suppressive cultural attitude towards criticism of corporate policy — especially if that criticism comes as a result of fatal accidents.” Ewbank wrote that co-workers told him in private they are afraid to speak up about similar safety concerns out of “fear for their jobs.” In a statement responding to requests for comment this week, Boeing said it “has rigorous processes in place, both to ensure that such complaints receive thorough consideration and to protect the confidentiality of employees who make them.” Most Read Business Stories · Buying a home in Seattle area may get thousands of dollars cheaper, after rule change by agents this week · Boeing whistleblower’s complaint says 737 MAX safety upgrades were rejected over cost | Times Watchdog · Seattle company is using artificial intelligence to make pizza; check out the assembly line VIEW · New partnership involving T-Mobile, UW, Bellevue and others could turn region into a 5G hub · Two thirds of Forever 21 stores in Washington could close by end of year “Accordingly, Boeing does not comment on the substance or existence of such internal complaints,” the statement added. Ewbank’s LinkedIn profile shows he graduated from Embry-Riddle Aeronautical University in 2008 with a degree in aeronautical engineering, then got a master’s at Purdue. After college, he took a job as rocket scientist, doing launch site design engineering at the Kennedy Space Center in Florida with United Space Alliance, the joint venture between Boeing and Lockheed Martin. He was hired by Boeing in 2010 to work on designing commercial airplane flight deck systems, including the MAX. He now works on airplane systems integration for the 777X program. However, dissatisfied with his experience on the MAX program, he took a break from Boeing. LinkedIn shows he left the company in April 2015 and returned to work on the 777X only last November. The reason for the career break is cited in the ethics complaint: his feeling that Boeing management was “squeezing the engineering budget for new programs … more concerned with cost and schedule than safety and quality.” In his first stint at Boeing, he worked on the safety of flight deck systems across multiple jet programs. It put him at the center of what has become one focus of the investigations into the crashes: The systems that tell pilots how their plane is performing in flight and alert them to anything going wrong. Ewbank’s complaint says his job included “designing appropriate crew alerting and crew procedures based on expected (system) failures.” Last week, a National Transportation Safety Board (NTSB) report called for improvements to such systems and criticized Boeing’s testing of the MAX for failing to simulate the possible barrage of system failures and warnings the pilots on the crashed flights faced. The memo The proposal for system upgrades that Ewbank discusses in his complaint emerged from work he did alongside several veteran employees in Boeing’s Aviation Safety department “to analyze Loss of Control inflight accidents and design flight deck features that would work to break the accident chain of events.” One was Associate Technical Fellow Randy Mumaw, a cognitive psychologist and “human factors” expert in how pilots react to an airplane’s instruments. Mumaw, who left Boeing in 2015, said that as a non-engineer he can’t assess the technicalities of the synthetic airspeed system. But he said he knew Ewbank as “highly respected and bright.” The Seattle Times interviewed four former Boeing employees who were involved in the work of assessing the proposed safety upgrades. Rick Ludtke, a former flight deck integration engineer, worked alongside Ewbank and was a key participant in the proposal, which was presented in an engineering memo titled “Boeing Commercial Airplanes Strategy for Reducing the Risk of Loss of Control Events.” Ludtke said the purpose of the memo, which Ewbank cites in his complaint, was to “capture the approval” of executives and to try to get a list of six system improvements accepted across Boeing’s airplane programs, including the MAX, which was then in early development. The memo, which was signed off by Todd Zarfos, the Boeing vice president who heads the company’s engineering design centers, recommended that synthetic airspeed be installed on the MAX “with the next appropriate software update.” Another veteran Boeing engineer and associate technical fellow, Carlo Ruelos, was the early champion of synthetic airspeed at Boeing. A pilot flying any airplane needs to know the current airspeed — the plane’s speed relative to the air. Depending on the direction of the wind, that can be faster or slower than the groundspeed, the plane’s speed relative to the earth. Too high an airspeed could stress the airframe. Too low an airspeed could stall the plane. This key piece of data is measured by pitot-static air pressure sensors, little tubes that stick out of the fuselage on both sides under the cockpit. It’s entered into multiple calculations performed by the flight control computer, so an accurate value is important. Synthetic airspeed is a new system that provides an additional, indirect calculation of airspeed using different sensors, including the plane’s angle-of-attack sensors. The system enters the airplane’s angle of attack, its weight, the position of its control surfaces and other parameters into a proprietary Boeing algorithm to come up with an independently measured airspeed reading. The independence of the synthetic reading means that if it matches the direct airspeed readings, it verifies the data as highly reliable. If there’s a discrepancy, the air data is rejected and the plane’s automated systems won’t use it. Ewbank’s complaint cites a study that found air data reliability, and airspeed awareness in particular, as a “dominant theme” in airplane accidents where the pilots lost control. The only Boeing airplane using synthetic airspeed today is its latest all-new jet, the 787 Dreamliner. On the MAX, Ruelos saw an opportunity because the jet had a new integrated air data system box installed that had more computational power than that on the previous 737 NG model. That extra capability, Ruelos decided, would make it possible to add a variant of the 787 synthetic airspeed system to the MAX. And if it could be added, he felt it should be — because it would broadly enhance the reliability of the 737’s air data systems. Ruelos, now 75 and retired, said in an interview that the pitot and static probes used for standard airspeed measurement“stick out of the airplane and can be damaged by a bird strike. Or something can plug the very small hole.” So, he said, “I firmly believe that as another means of verifying the air data, (synthetic airspeed) is a key element in maintaining the safety of the airplane.” “We pushed very hard for it, because safety is always the No.1 priority,” he added. With the new air data avionics box on the MAX, he believed the system was “ready to go” on the new jet. The crashes At the time of this proposal, no one had identified MCAS as a concern. Back then, the original design of MCAS was more benign than the final version that went haywire on the two crash flights. It required two sensors to activate — a high angle of attack and and a high G-force —and was less extensive in its ability to push the nose down. It wasn’t until March 2016 that the MCAS design was changed to depend solely on a single angle-of-attack sensor. Synthetic airspeed gains significance in the aftermath of the accidents because the system’s cross-check of the independent airspeed readings would raise a red flag if there’s any angle-of-attack sensor fault. If the readings disagree, Ewbank wrote in his complaint, the system as implemented on the 787 is designed to “monitor and detect erroneous angle-of-attack data, and then work to prevent the use of erroneous data by downstream systems.” While Ewbank prefaces this statement with a careful qualifier — “It is not possible to say for certain that any actual implementation of synthetic airspeed on the 737 MAX would have prevented the accidents” — his implication is clear: Synthetic airspeed might have stopped MCAS from activating in the circumstances of the two crashed flights. Ludtke and Ruelos agreed. There’s “a very good chance” that if Boeing had implemented synthetic airspeed on the MAX, it would have prevented the crashes, Ludtke said. “In our department, we never designed anything without comparators,” meaning monitors that compare independent sensor readings and de-activate the system if they disagree, he said. “Curtis, I know, had several types of comparators in that synthetic airspeed system.” Asked separately if synthetic airspeed might have prevented the crashes, Ruelos responded: “I think so. The left and right systems do cross checks, and if there is a discrepancy, it won’t let the automatic system take control of the airplane. … It would disengage and the downstream systems wouldn’t use the data.” The cost concerns Of course, Boeing could have achieved the same result in simpler ways, for example if MCAS had been designed from the start to compare readings from the two angle-of-attack sensors instead of only one. Still, in hindsight the rejection of synthetic airspeed seems fateful. In his complaint, Ewbank puts it down to “a corporate culture … of expediency of design-to-market and cost-cutting.” “The 737 MAX was designed via piecemeal updates to prevent triggering expensive certification and (pilot) training,” his complaint states. Ludtke agreed. Synthetic airspeed was rejected “probably because of cost,” he said. He said Boeing had promised the airlines that the MAX would be so minimally different from the prior 737 model that no additional pilot certification or flight simulator training would be necessary. He said his manager told him Boeing promised MAX launch customer Southwest “$1 million per tail” if the FAA were to require expensive simulator training. “The MAX program leaders had always mandated that, if it’s not required for function or certification, it’s not going on the airplane,” Ludtke said. They looked upon synthetic airspeed as “a good improvement, but just an improvement,” not a necessity. “We still tried. Because we believed these aircraft need improving for the quality of pilots we are experiencing,” Ludtke added. “In the old days, before the MAX, that’s how we did business. At the launch of a new program, its leaders would be very interested in including all the latest ideas and safety improvements. “The MAX was different from the very beginning,” he said. “We’re just going to put these new engines on and the minimum change to make that happen. That’s it. We’re not spending money.” “That concept broke the company,” Ludtke concluded. Another former Boeing employee, a veteran test pilot also involved in the assessment of the proposed system changes, wasn’t close enough to the technical details of synthetic airspeed to be sure it would have prevented the accidents, yet agreed that any similar system based on angle of attack likely would have cut out MCAS. “That’s how you would hope the system would work,” said the pilot, who asked for anonymity to preserve relationships at Boeing. And the pilot agreed with Ludtke that preserving the MAX’s common type rating — certifying it as just a variant of the prior 737 NG model, rather than a new airplane — and ensuring that airline pilots wouldn’t be required to train for the MAX on flight simulators was “such a huge deal” that it blocked potential updates to the avionics systems. “I couldn’t believe they kept stretching the 737, both literally (with a longer fuselage) and also in terms of cockpit design,” the pilot said. The culture Ray Craig, former chief pilot on the 737 MAX until he retired in 2015, had a very different take. He said he worked with Ewbank and knew him as a “very sharp, very dedicated” engineer. Yet he defended the safety culture atBoeing and around the MAX program. “Safety was paramount. If there was something we thought was a safety issue, there was no question, it was taken care of,” Craig said. “But it’s not always a black-and-white decision.” Lacking full technical details, he wouldn’t venture an opinion about whether synthetic airspeed could have prevented the crashes. “I don’t remember it as ready to go. It wasn’t just a simple plug-and-play,” Craig said. “It wasn’t as program-ready as perhaps some of the folks were thinking. But I don’t remember the exact reason it was shot down.” Talk to us We continue to seek information on the design, training and certification of the Boeing 737 MAX. If you have insights, please get in touch with aerospace reporter Dominic Gates at 206-464-2963 or dgates@seattletimes.com. To communicate on a confidential and encrypted channel, follow the options available at https://st.news/newstips. Ewbank’s ethics complaint is much broader than the failure to install synthetic airspeed. He attacks the company’s culture around aviation safety and questions Craig’s and Boeing’s assertion that safety is always paramount. He recounts an episode in his department when he says Boeing hid in-flight safety incidents from Europe’s aviation regulator. This occurred when EASA found five events where 737s experienced a problem with the autothrottle disconnecting on approach and a confusing alert led to an inappropriate pilot response. EASA asked if Boeing was aware of any other such events and Ewbank was assigned to search the in-service databases. But when he identified five further similar incidents on 737s, his ethics complaint says his manager decided “to not tell EASA about these events” and that instead “we would fix the issue ourselves.” Ewbank, a relatively young engineer at the start of his career and with less than six years at Boeing over his two employment stints, even goes so far in the complaint as to directly attack CEO Muilenburg. He cites Muilenburg’s statement on a quarterly earnings teleconference, just four days before Ewbank filed the ethics complaint, denying that the two recent MAX crashes were due to any “technical slip” by Boeing during the jet’s design or certification. Ewbank calls this “a false statement.” “When CEO Muilenburg and others state that the Max was a safe airplane as designed, they seriously misrepresent what Boeing Engineering has learned about how data and control functions should be treated,” Ewbank wrote. Seattle Times researcher Miyoko Wolf contributed to this report. Dominic Gates: 206-464-2963 or dgates@seattletimes.com; on Twitter: @dominicgates. Steve Miletich: 206-464-3302 or smiletich@seattletimes.com; on Twitter: @stevemiletich. Lewis Kamb: 206-464-2932 or lkamb@seattletimes.com; on Twitter: @lewiskamb. View 67 Comments The opinions expressed in reader comments are those of the author only, and do not reflect the opinions of The Seattle Times.
  5. Hi Greg; Re the New Republic article being "of interest", yes it is. There are themes that are familiar, certainly! But I have stopped writing about such matters. It's very difficult to marshall it all and still sustain attention/focus and to invite "care-full" thought without turning the discussion into a political tribal rally these days. I'm not a fan of OpEd explanations by non-experts, of aircraft accident. But you are right - there are some ideas in Tkacik's article, (The New Republic) that I found relevant to views I have held for a very long time and expressed here and elsewhere. In thinking about the points made in the article, it is obvious that we cannot point directly to this or that "cause" - one certainly cannot say, "capitalism caused these B737 accidents" without serious, and deserved, challenges to one's thought processes! However, the notions of a "propensity-for", or perhaps, if one imagines, "the garden in which certain ideas and ways flourished while others withered" we can say that there are certain possibilities for examination of how a post-war social/political/moral/cultural/business milieu provided fertile ground for the kinds of organizational behaviours and results which are now familiar. I posted links to two books which were largely cohort studies, (2010 & 2015 respectively), describing in detail the results of corporate and organizational behaviours for employees at Boeing, particularly after 1997. Interestingly, these theories (about Boeing's problems but also the American workers'), are now achieving mainstream and perhaps even investigatory status as Boeing and the FAA are examined under numerous microscopes, as they ought to be. But the American political economy, particularly after 2008, though under constant challenge, retains those characteristics which institutionally carve massive sectors of "ordinary people" out of the benefits of multi-trillion-dollar economies. Anyway, I will leave it there as this is a tech forum, but thank you for mentioning it.
  6. From the September 26 2019 release: NTSB - Safety Recommendations Report and links to ongoing work: https://www.ntsb.gov/investigations/AccidentReports/Pages/ASR1901.aspx Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance: https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf
  7. Good morning, boestar; A logical and reasonable question. From my limited awareness regarding the history of the MCAS design and implementation, and a very tiny smattering of U. S. certification standards, (CFR-25), and reading the many speculative statements on the matter, MCAS is not a "stall prevention" system, whereas stick pushers and stick shakers are. Boeing's approach to stall prevention for the B737 type certificate is set and not subject to change, (a separate, complex topic now under proper examination) without changes to the type certificate. MCAS is a response to slight changes in stick force in lower speed regimes as the AoA increases to a threshold. A lighter stick force than was required by certification appeared to be demonstrated in test flights, (wind-up turns, etc. and other flight test stuff I don't know about). Part of the initial stall prevention system is the increase in stick forces as AoA increases with a reduction in CAS, "forcing" the pilots to respond to the increase. In a way, it is an extension of how trim works in the first place...the B737-type STS trims "against" the pilot to force a response when such response is necessary. It works, (as does/did MCAS) and has since the type was certified in the mid-60's. The MCAS was not, itself, "certified", nor was it formally tested using Failure and Error Mode Analysis, (FMEA) processes, nor was the system examined for potential single-point-of-failure outcomes. Boeing rested upon past certifications of the stabilizer system and, perhaps because the "runaway stabilizer" drill was in place, (this is speculation only; I have seen opinions that Boeing didn't consider this far into the change), any untoward behaviour of the stabilizer would be handled by the crew. But five-second ND blips of the trim-wheel, a UAS indication, a stick-shaker and several other warnings immediately after takeoff were results of the loss of AoA signal from one sensor. I think most here who fly these types can attest to the confusion regarding which drill/checklist one would call for first, particular if the stick was getting heavier and heavier by the second. This scenario was not imagined and considered by Boeing nor was the change in the flight control system conveyed to users and was not in the FCOM or FCTM. I am certain there are bits left out and perhaps others can fill in blanks...;-) Don
  8. https://www.wsj.com/articles/indonesia-to-fault-737-max-design-u-s-oversight-in-lion-air-crash-report-11569185664 Indonesia to Fault 737 MAX Design, U.S. Oversight in Lion Air Crash Report First formal government finding on crash also likely to detail pilot and maintenance missteps; NTSB preparing separate safety recommendations Indonesian officials have found design and oversight lapses played a central role in October’s Lion Air crash. Above, wreckage from Lion Air flight JT610, Karawang, Nov. 3, 2018. Photo: antara foto/Jaya Kusuma/Reuters By Andy Pasztor and Andrew Tangel Sept. 22, 2019 4:54 pm ET Indonesian investigators have determined that design and oversight lapses played a central role in the fatal crash of a Boeing 737 MAX jet in October, according to people familiar with the matter, in what is expected to be the first formal government finding of fault. The draft conclusions, these people said, also identify a string of pilot errors and maintenance mistakes as causal factors in the fatal plunge of the Boeing Co. plane into the Java Sea, echoing a preliminary report from Indonesia last year. Related Coverage International Panel Set to Criticize FAA’s Approval Process for Boeing 737 MAX Jets (Sept. 16) New Delays Could Keep Boeing 737 MAX Grounded Into Holiday Travel Season (Sept. 1) The Four-Second Catastrophe: How Boeing Doomed the 737 MAX (Aug. 16) Misfires of an automated flight-control feature called MCAS on the MAX fleet led to the nosedive of the Lion Air jet and a similar crash of an Ethiopian Airlines MAX shortly after takeoff from Addis Ababa in March. The two crashes took 346 lives, prompted the grounding of all 737 MAX planes and disrupted the global aviation industry. Details of the Indonesian report, which haven’t been reported previously, are subject to change and further analysis. Indonesian investigators declined to comment, except to say the final document is likely to come out in early November. A Boeing spokesman said the plane maker continues to work with Indonesian authorities as they complete the report. U.S. air-crash investigators are preparing to make public a handful of separate safety recommendations, ranging from bolstering the manual flying skills of pilots to enhancing FAA vetting of new aircraft designs. The U.S. National Transportation Safety Board is expected around the end of the month to call for improvements to cockpit training and crew decision making, according to industry and government officials. The goal is to ensure pilot proficiency when automated systems are malfunctioning or turned off, to help ensure appropriate responses to contradictory cockpit warnings such as those that occurred prior to the MAX crashes, the officials said. The board also is expected to emphasize the importance of setting priorities when executing emergency checklists. Is the Federal Aviation Administration too close to the industry it regulates? In the wake of the Boeing 737 MAX 8 crashes in Indonesia and Ethiopia, The Wall Street Journal examines why the FAA is facing renewed scrutiny into its aircraft certification process. In addition, the NTSB is expected to focus on potential changes to the certification of new airliners. The board is poised to recommend re-evaluation of FAA procedures that give the industry authority to sign off on certain safety matters, the officials said. The aim is to make such approvals more transparent, with the goal of greater predictability and more-consistent federal oversight across various types of onboard systems. Neither the U.S. nor Indonesian recommendations will be binding on the FAA, though the agency already faces escalating congressional and public pressure to change certification procedures. More than half a dozen outside inquiries, including a Justice Department criminal probe and various blue-ribbon advisory panels, are delving into the FAA’s 2017 approval of MCAS. Earlier this month, a Senate appropriations subcommittee backed legislation that would require FAA officials to address recommendations from ongoing investigations and audits. The FAA has said it welcomes the independent reviews, will carefully consider their results and doesn’t have a firm timetable for allowing MAX jets back in the air. Boeing has said it is collaborating with U.S. and foreign officials to safely return the MAX to service. Steve Dickson, the FAA’s new head, and top lieutenants are scheduled to meet Monday in Montreal with some four dozen foreign regulators to provide a closed-door update on anticipated fixes to the MAX’s flight-control software and computers. The crashes prompted the grounding of all 737 MAX planes and disrupted the global aviation industry. The FAA is urging a core group of regulators—from Canada, Australia, Brazil and New Zealand—to approve the fixes around November, which would be roughly in tandem with informal U.S. timelines. FAA leaders also are trying to persuade aviation authorities in Europe and other regions to follow by lifting their grounding orders shortly afterward, according to U.S. government and industry officials familiar with the deliberations.But such coordination efforts are running into significant hurdles. Canadian aviation regulators have signaled to the FAA that they expect to require pilots to undergo simulator training before they can start flying the MAX, something the FAA is unlikely to mandate. It could take until March for Air Canada to phase the bulk of its MAX aircraft into regular schedules, according to a person briefed on the details, months later than projected for U.S. operators.In Europe, regulators previously said they won’t accept the FAA’s technical verifications of fixes and intend to perform their own certification analyses, possibly adding weeks or months to the timetable. Meanwhile, FAA officials said in recent weeks that Boeing hasn’t provided all of the requested details laying out the description and safety assessments of the MAX’s redesigned flight-control system. The latest version of Indonesia’s accident report has been shared with the FAA and NTSB for comment. U.S. officials are expected to visit Indonesia around the end of this month to finalize the document. People familiar with the process said NTSB experts don’t appear to have major disagreements with the draft. Boeing and the FAA, on the other hand, are concerned the final report will unduly emphasize design and FAA certification missteps, some of these people said. Unlike NTSB reports that identify the primary cause of accidents and then list contributing issues determined to be less significant, Indonesia is following a convention used by many foreign regulators of listing causal factors without ranking them. Instead, the report is expected to list more than 100 elements of the crash chronology, according to a person briefed on the details. Many of those points are likely to refer to missteps by pilots and mechanics initially revealed last year in Indonesia’s preliminary report. Indonesian authorities now are asking for comments on the draft conclusions dealing with those missteps, as well as findings that investigators have determined constitute engineering shortcomings, including reliance on a sole sensor in the original design of MCAS, according to people familiar with the matter. —Kim Mackrael and Ben Otto contributed to this article. Write to Andy Pasztor at andy.pasztor@wsj.com and Andrew Tangel at Andrew.Tangel@wsj.com
  9. I dismissed Langewiesche on AF447, haven't read anything by him since so not sure he pronounces on MH370 and dismiss him once again, here. It is difficult to jam evidence into a narrative in support of an opinion but this is what Langewiesche does. Boeing designed into the flight-control system a single point of failure which could potentially result in loss of the aircraft. They did not run a FEMA, (fault & error mode analysis) because the HS/trim system had previously "passed" such examination. Boeing jammed the aircraft into the same "type" box for customers, primarily Southwest. While other designers advanced with technology, Boeing was held back in the sixties, and not just with their narrow-body thinking. Two good books on culture at Boeing pre- & post- 1997: Turbulence: Boeing and the State of American Workers and Managers, Greenberg, Brunberg, Moore, Silora, 2010, Yale, and Emerging From Turbulence, Boeing and Stories of the American Workplace Today, Grunberg, Moore, 2015, Rowan and Littlefield. Both are available as Kindle books as well as hardbacks. The post-1997 culture at Boeing is now under close scrutiny.
  10. 14,000 Words Of "Blame The Pilots" That Whitewash Boeing Of 737 MAX Failure The New York Times Magazine just published a 14,000 words piece about the Boeing 737 MAX accidents. It is headlined: What Really Brought Down the Boeing 737 Max? But the piece does not really say what brought the Boeing 737 MAX down. It does not explain the basic engineering errors Boeing made. It does not explain its lack of safety analysis. It does not mention the irresponsible delegation of certification authority from the Federal Aviation Administration to Boeing. There is no mention of the corporate greed that is the root cause of those failures. Instead the piece is full of slandering accusations against the foreign pilots of the two 737 MAX planes that crashed. It bashes the airlines and the safety authorities of Indonesia and Ethiopia. It only mildly criticizes Boeing for designing the MCAS system that brought the planes down. The author of the piece, William Langewiesche, was a professional pilot before he turned to journalism. But there is so much slander in the text that it might as well have been written by Boeing's public relations department. The piece is also riddled with technical mistakes. We will pick on the most obvious ones below. The following is thus a bit technical and maybe too boring for our regular readers. Langewiesche describes the 737 MAX trim system and its failure mode: That’s a runaway trim. Such failures are easily countered by the pilot — first by using the control column to give opposing elevator, then by flipping a couple of switches to shut off the electrics before reverting to a perfectly capable parallel system of manual trim. But it seemed that for some reason, the Lion Air crew might not have resorted to the simple solution. Wrong: The manual trim system does not work at all when the stabilizer is widely out of trim (i.e. after MCAS intervened) and/or if the plane is flying faster than usual. That is why the European regulator EASA sees it as a major concern and wants it fixed. Langewiesche knows this. He later writes of one of the accidents: The speed, meanwhile, was producing such large aerodynamic forces on the tail that the manual trim wheel lacked the mechanical power to overcome them, and the trim was essentially locked into the position where the MCAS had left it Is that a 'perfectly capable system'? Of the crashed Lion Air flight 610 Langewiesche writes: At 6:31 a.m., 11 minutes into the flight, Suneja got on the radio for the first time. He did not know their altitude, he told the controller, because all their altitude indicators were showing different values. This is unlikely and has never been explained. Wrong. The value given by an Angle of Attack sensor is also used in calculating the speed and attitude of a plane. If one of the two AoA sensors fails the instruments on the side that with the failed AoA sensor will show different values than those on the other side of the cockpit. Langewiesche knows this. Further down in his piece he writes: That story actually starts three days before the accident, when the same airplane — under different flight numbers and Lion Air crews — experienced errors in airspeed and altitude indications on the captain’s (left side) flight display that weren’t properly addressed. Those indications are driven by a combination of sensors on the surface of the airplane. Is that 'unlikely' and unexplained? This is an unfounded claim: Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane’s flight manuals. Wrong. Boeing sold the new plane with the dubious claim that it handled no differently than its predecessor. It left MCAS out of the manual because it did not want to add to training requirements for the pilots which would have contradicted its marketing claim. Furthermore Boeing did not do any additional safety evaluation when it later increased the effect of the system. Another wrong part: A set of independent duplicate sensors drive the co-pilot’s (right side) display. A third standby system provides additional independent backup and allows for intuitive troubleshooting when any one of the three systems fails: If two indications agree and the third one does not, the odd one out is obviously the one to ignore. This sort of arrangement helps to explain why flying a Boeing is not normally an intellectual challenge. Furthermore, the airplane provides an alert when airspeed or altitude indications disagree. There is no general third standby system on a Boeing 737. There is a set of standby instruments for altitude and airspeed. But these give uncorrected values that differ from the ones shown on the two flight control displays. Those values are calculated by two flight computers and each takes the value of only one pitot (speed) tube and one AoA sensor into account. If an AoA sensor fails the instruments on one side show wrong values. The instruments on the other side will show different but hopefully correct values. The standby instruments will show different, uncorrected values than both of the calculated ones. Langewiesche describes an earlier Lion Air flight that also experienced an MCAS failure but was by chance saved: Immediately after liftoff, the captain’s airspeed indication failed, airspeed-disagreement and altitude-disagreement warnings appeared on his flight display and his stick shaker began to rattle the controls in warning of an imminent stall. The Bali captain was enough of an airman to realize that he was dealing with an information failure only — not an actual stall. No direct mention has been made of this, but he must have immediately identified the replacement angle-of-attack vane on his side as the likely culprit. Wrong. How would the pilot know that? The pilot noticed intermittet automatic down trim. That failure mode was not in the flight manuals and pilot had no way to attribute it to an AoA sensor. The claim is also contradicted by the pilot's maintenance log entry of which Langewiesche writes: After pulling up to the gate in Jakarta, the Bali captain informed a company mechanic about “the aircraft problem” and in the maintenance log noted only three anomalies — the captain’s airspeed and altitude indication errors and the illumination of a warning light related to a system known as Feel Differential Pressure. That was it. Apparently the captain noted nothing about the failure of the newly installed angle-of-attack sensor, or the activation of the stick shaker, or the runaway trim, or the current position of the trim cutout switches. If true, it was hard to conclude anything other than that this was severe and grotesque negligence. The captain noted nothing about the AoA sensor because he did not know that it failed. The captain did mention a trim problem but he had not experienced a runaway trim. A classic runaway trim is continuous. An MCAS intervention like the one the captain experienced stops after 9 seconds. But the pilots on that flight did not even know that MCAS existed. The captain reported all the basic symptoms he experienced during that flight. A runaway was not one of them. Langewiesche fails to mention, probably intentionally, the captain's additional entry in the maintenance log. The captain wrote: "Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the wrong direction ...". STS, the Speed Trim System, moves the stabilizer trim. It does that all the time but discontinuously during every normal flight. The pilot correctly described the symptoms of the incident as he perceived them. Those were not the symptoms of a continuously runaway stabilizer. But the pilot knew, and documented, that he experienced an intermittet trim problem. It was the mechanic's responsibility to analyze the underlying error and to correct the system which is exactly what he did. The author's "blame the pilots" attitude is well expressed in this paragraph: Critics have since loudly blamed it for the difficulty in countering the MCAS when the system receives false indications of a stall. But the truth is that the MCAS is easy to counter — just flip the famous switches to kill it. Furthermore, when you have a maintenance log that shows the replacement of an angle-of-attack sensor two days before and then you have an associated stick shaker rattling away while the other stick shaker remains quiet, you do not need an idiot light to tell you what is going on. At any rate, the recognition of an angle-of-attack disagreement — however pilots do or do not come to it — has no bearing on this accident, so we will move on. An AoA sensor failure and a following MCAS incident will cause all of the following: an unexpected autopilot shutdown, an airspeed warning, an altitude disagree warning, a stall warning and, after MCAS intervenes, also an over-speed warning. The control column rattles, a loud clacker goes off, several lights blink or go red, several flight instruments suddenly show crazy values. All this in a critical flight phase immediately after the start when the workload is already high. It is this multitude of warnings, which each can have multiple causes, that startle a pilot and make it impossible to diagnose and correct within the 10 seconds that MCAS runs. To claim that "MCAS is easy to counter" is a gross misjudgment of a pilot's workload in such a critical situation. After blaming the pilots Langewiesche bashes the foreign air safety regulators which are now investigating the MAX accidents: According to sources familiar with both investigations, Boeing and the N.T.S.B. have been largely excluded and denied access to such basic evidence as the complete flight-data recordings and the audio from the cockpit. ... It is a forlorn hope, but you might wish that investigators like those in Indonesia and Ethiopia would someday have the self-confidence to pursue full and transparent investigations and release all the raw data associated with the accidents. I am not aware of an accident in the U.S. where the FAA investigators released "complete flight-data recordings and the audio from the cockpit" to foreign entities that were suspected to have caused the incident. Nor will the FAA "release all the raw data" associated with an accident. Certainly not before an investigation is finished. Boeing screwed up by designing and installing a faulty system that was unsafe. It did not even tell the pilots that MCAS existed. It still insists that the system's failure should not be trained in simulator type training. Boeing's failure and the FAA's negligence, not the pilots, caused two major accidents. Nearly a year after the first incident Boeing has still not presented a solution that the FAA would accept. Meanwhile more safety critical issues on the 737 MAX were found for which Boeing has still not provided any acceptable solution. But to Langewiesche this is anyway all irrelevant. He closes his piece out with more "blame the pilots" whitewash of "poor Boeing": The 737 Max remains grounded under impossibly close scrutiny, and any suggestion that this might be an overreaction, or that ulterior motives might be at play, or that the Indonesian and Ethiopian investigations might be inadequate, is dismissed summarily. To top it off, while the technical fixes to the MCAS have been accomplished, other barely related imperfections have been discovered and added to the airplane’s woes. All signs are that the reintroduction of the 737 Max will be exceedingly difficult because of political and bureaucratic obstacles that are formidable and widespread. Who in a position of authority will say to the public that the airplane is safe? I would if I were in such a position. What we had in the two downed airplanes was a textbook failure of airmanship. In broad daylight, these pilots couldn’t decipher a variant of a simple runaway trim, and they ended up flying too fast at low altitude, neglecting to throttle back and leading their passengers over an aerodynamic edge into oblivion. They were the deciding factor here — not the MCAS, not the Max. One wonders how much Boeing paid the author to assemble his screed. --- Previous Moon of Alabama posts on Boeing 737 MAX issues: Boeing, The FAA, And Why Two 737 MAX Planes Crashed - March 12 2019 Flawed Safety Analysis, Failed Oversight - Why Two 737 MAX Planes Crashed - March 17 2019 Regulators Knew Of 737 MAX Trim Problems - Certification Demanded Training That Boeing Failed To Deliver - March 29 2019 Ethiopian Airline Crash - Boeing Advice To 737 MAX Pilots Was Flawed - April 9 2019 Boeing 737 MAX Crash Reveals Severe Problem With Older Boeing 737 NGs - May 25 2019 Boeing's Software Fix For The 737 MAX Problem Overwhelms The Plane's Computer - June 27 2019 EASA Tells Boeing To Fix 5 Major 737 MAX Issues - July 7 2019 The New Delay Of Boeing's 737 MAX Return Will Not Be The Last One - July 15 2019 737 MAX Rudder Control Does Not Meet Safety Guidelines - It Was Still Certified - July 28 2019 737 MAX - Boeing Insults International Safety Regulators As New Problems Cause Longer Grounding - September 3 2019 Boeing Foresees Return Of The 737 MAX In November - But Not Everywhere - September 12 2019 Posted by b on September 18, 2019 at 16:41 UTC | Permalink
  11. "Single-point-of-failure", (or more simplistically, "all eggs in one basket"), is a decision which carries potential risk at all levels and not merely in aircraft design. A single, fleet-type is such a decision, the essential motivation by one customer being the elimination of "expensive" training. Ultimately, the decisions between Boeing and SW and the FAA were probablistic, economic and political, not engineering and technical. EASA presentation to the European Parliament, September 03, 2019: https://www.europarl.europa.eu/cmsdata/186500/20190903_EASA_Ky-original.pdf
  12. Boeing Board to Call for Safety Changes After 737 Max Crashes By David Gelles and Natalie Kitroeff Sept. 15, 2019 For the past five months, a small committee of Boeing’s board has been interviewing company employees, safety experts and executives at other industrial organizations in an attempt to understand how the aerospace giant could design and build safer airplanes. The committee is expected to deliver its findings to the full Boeing board this week, and call for several meaningful changes to the way the company is structured, according to three people briefed on the matter who spoke on the condition of anonymity because the report has not yet been submitted. The recommendations will include that Boeing change aspects of its organizational structure, calling for the creation of new groups focused on safety and encouraging the company to consider making changes to the cockpits of future airplanes to accommodate a new generation of pilots, some of whom may have less training. Though the committee did not investigate the two crashes of Boeing’s 737 Max jet, their findings represent the company’s most direct effort yet to reform its internal processes after the accidents, which killed 346 people. One of the report’s most significant findings concerns the reporting structure for engineers at the company. At Boeing, top engineers report primarily to the business leaders for each airplane model, and secondarily to the company’s chief engineer. Under this model, engineers who identify problems that might slow a jet’s development could face resistance from executives whose jobs revolve around meeting production deadlines. The committee recommends flipping the reporting lines, so that top engineers report primarily to Boeing’s chief engineer, and secondarily to business unit leaders. The two Boeing crashes killed 346 people. Another key recommendation calls for establishing a new safety group that will work across the company. The committee examined the process by which Boeing employees conduct certification work on behalf of the Federal Aviation Administration, known as Organization Designation Authorization, as well as an internal company framework known as the Boeing Safety Management System. Boeing has more than 100,000 employees and, like many large companies, at times struggles with information flow. In particular, there has been inadequate communication within the engineering department, and from Boeing’s commercial airplanes division, based in the Seattle area, to Boeing corporate offices in Chicago. The new safety group will work to ensure that the company’s various efforts have adequate independence and are working together and sharing information effectively. The new group will report to senior Boeing leadership, as well as to a new permanent committee on the board focused on aerospace safety. A third major recommendation involves how Boeing approaches the design of future airplanes. Though the Max crashes were triggered by the malfunction of a new system on the planes, there is a simmering debate concerning whether the pilots responded appropriately, and whether the Lion Air plane that crashed off Indonesia last October should have been flying at all because of maintenance problems. Training levels can vary by country. The first officer of Ethiopian Airlines Flight 302, which crashed in March, was relatively inexperienced, with just over 200 hours flying 737s. The board committee is expected to recommend that Boeing re-examine cockpit design and operation to ensure that new Boeing planes are accessible for the next generation of pilots, including those with less training. Boeing’s chief executive, Dennis A. Muilenburg, established the committee in April, calling on it to review “companywide policies and processes for the design and development of the airplanes we build.” The group included four Boeing directors familiar with complex industrial systems, as well as highly regulated industries. Top Boeing engineers report to both the company’s chief engineer and to the business side, something an internal review is expected to recommend be changed. Credit Ruth Fremson The New York Times Admiral Edmund Giambastiani Jr., a former nuclear submarine officer and the former vice chairman of the Joint Chiefs of Staff, was the committee chairman. The other members were Lynn Good, the chief executive of Duke Energy and a board member of the Institute for Nuclear Power Operations; Edward Liddy, the former chief executive of the insurance company Allstate; and Robert Bradway, the chief executive of Amgen, a pharmaceuticals company. To conduct its review, the committee interviewed dozens of Boeing employees about their work. The committee also hired independent safety experts who had experience with industrial accidents including the Deepwater Horizon explosion, the Columbia space shuttle disaster and the Fukushima nuclear power plant accident. Among the experts was Sean O’Keefe, the former NASA administrator. Additionally, the committee consulted with officials from NASA, General Electric, Duke Energy and military leaders who had experience dealing with accidents and their aftermaths. The Max remains grounded six months after the second crash, though the F.A.A. may allow the planes to fly again by the end of the year, according to several people familiar with the process. Some international regulators are likely to take longer, however, signaling a rift in the global aviation community. This month, Patrick Ky, the head of the European Aviation Safety Agency, suggested that when the F.A.A. deemed the Max safe to fly again, his agency was unlikely to do so at the same time. “The F.A.A. is in a very difficult situation,” Mr. Ky said during an appearance at European Parliament. “When they say this is good to go, it’s very likely that international authorities will want a second opinion.” Even as the F.A.A. is working with Boeing to return the Max to service, the regulator itself is facing scrutiny. A multiagency task force reviewing the certification of the Max is also expected to submit its report this month, and is likely to recommend changes to the way the F.A.A. oversees airplane manufacturers like Boeing, according to people briefed on the effort who spoke on the condition of anonymity because the review is incomplete. Chris Hart, the former chairman of the National Transportation Safety Board, is leading a task force reviewing how the Max was certified. Credit Cliff Owen/Associated Press The group, known as the Joint Authorities Technical Review, is led by Chris Hart, the former chairman of the National Transportation Safety Board, and includes representatives from NASA, the F.A.A. and international regulators. The report is expected to include about a dozen recommendations, with a focus on improving transparency in the certification process. Frustration with Boeing is mounting on Capitol Hill. Representative Peter DeFazio, a Democrat from Oregon, said in an interview that he invited Boeing to testify at a House hearing, but the company declined. “Next time, it won’t just be an invitation, if necessary,” Mr. DeFazio said. Congressional investigators are combing through tens of thousands of internal Boeing documents, looking for potential flaws in the Max’s development and certification. “We’ve got massive amounts of documents from Boeing,” Mr. DeFazio said. “But they have otherwise been not particularly cooperative.” The F.A.A. and international regulators are similarly frustrated with Boeing, a sentiment that became apparent at a meeting last month. In August, Boeing met with officials from the F.A.A. and other global aviation agencies to brief them on its efforts to complete fixes on the Max. Regulators asked detailed questions about adjustments to the Max’s flight control computers, which the Boeing representatives there were not prepared to answer. Instead, the company representatives began to display a PowerPoint presentation on their efforts, according to people briefed on the meeting who spoke on the condition of anonymity because it was not public. At that point, the regulators ended the meeting. Weeks later, Boeing has still not answered all their questions. A version of this article appears in print on Sept. 15, 2019, Section B, Page 1 of the New York edition with the headline: Boeing Panel Is Set to Call For Reforms In Procedure. Order Reprints | Today’s Paper | Subscribe
  13. JD, congratulations on retirement and thanks for posting that - enjoyable reading, brings many memories - twelve years now. Lots of ways of expressing the career & profession - words, images . . . I hope these bring some memories for others:
  14. http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf
  15. Boeing Suspends 777X Loads Tests After Pressure Failure Sep 7, 2019 Guy Norris | Aviation Daily Final loads testing on Boeing’s delayed 777-9 has been suspended while investigations continue into the failure of a cargo door during pressurization evaluations on the static test airframe at Everett, Wash. on Sept 5. The incident occurred during the final phases of the 777X major structural test campaign, which is being conducted in a specially built 1.6 million lb. steel rig in Building 45-12 at the company’s production site. At the time of the failure, the “testing conditions were well beyond any load expected in commercial service,” says Boeing. The company adds the event, first reported by Seattle’s KOMO News radio station, is “under review and the team is working to understand the root cause.” The ongoing delay to the 777-9 flight test program due to issues with the aircraft’s General Electric GE9X engines means that Boeing will likely have ample margin to modify the failed part and re-run the test. The 777-9 had been scheduled to begin flight tests in late June, but these have been pushed back until early 2020 while GE validates redesigned stator vanes to improve durability. However, the failure, which occurred during static test condition 12, or the ‘high-blow’ pressure test, holds potentially greater significance depending on the outcome of the investigation. Although the 777X fuselage is constructed of standard aluminum rather than the stiffer composite material used in the 787, the aircraft has been designed to operate at a higher internal pressure than the current model. The change will allow the 777X to cruise with at the lower 6,000 ft. equivalent cabin altitude of the 787 rather than the 8,000 ft. industry standard altitude of the present version. Boeing also increased the size of the 777X windows by 22 sq. in. as part of the redesign, locally stiffened ribs and made other slight redesigns to counter potential fatigue life concerns and increase static strength to accommodate the 0.6/0.7 lbs. per sq. in. (psi) increase in cabin pressure. The current 777 operates with a normal cabin pressure in the range of 8.4 to 8.7 psi. The cabin pressure in the 787 is usually set between 9 and 9.4 psi, to reflect the lower equivalent altitude of 6,000 ft. The manufacturer, which has not provided details of the failed part or the test condition at the time of the incident, is thought to have been pressurizing the 777-9 fuselage towards similar levels reached during structural tests of the 787 in 2008. These saw the fuselage pressurized to 14.9 psi, or 150% of the maximum level expected in service. Positive pressure relief valves, which in operational aircraft are set to open at prescribed levels (up to around 9.78 to 10.23 psi in the case of the 787) to avoid over-pressuring the aircraft, are adjusted accordingly for such tests. The 777-9 is configured with up to 13 significant fuselage openings, with 10 passenger doors on the main deck, two of which are optional emergency exit/service doors, as well as three lower lobe cargo doors. The cargo doors, all located on the right side, consist of doors to access the forward and aft cargo holds as well as a smaller bulk cargo door.