Don Hudson

The loss of trust, prestige, status, reputation and 'face' are already incalculable by comparison to the dollar figure which could exceed US$100b. Trust and integrity are necessary qualities for aviation to sustain itself - that is its only "stock-and-trade"; the rest is mere technology which is worth nothing against "character".

International regulator report slams Boeing, FAA over 737 MAX design and approval Oct. 11, 2019 at 9:31 am Updated Oct. 11, 2019 at 8:51 pm By Dominic Gates Seattle Times aerospace reporter An international panel of air-safety regulators convened by the Federal Aviation Administration (FAA) released a damning report Friday that criticizes both Boeing and the FAA for how they assessed and approved the design of the 737 MAX automated flight-control system implicated in two fatal airliner crashes. More broadly, the panel also questioned how systems on the the MAX were certified as derivative of a now-50-year-old aircraft design. And it further recommended that airplane-safety systems address the new reality of increased cockpit automation by reducing the reliance on pilots to respond to emergencies, and instead designing protections as part of the systems. The report from officials representing 10 different regulatory bodies carries the weight of the world’s aviation experts. Its findings point to glaring shortcomings in how Boeing’s 737 MAX was certified as safe, with the company effectively auditing its own design and and the FAA unable to fulfill its oversight role. That’s a blow to Boeing’s reputation but also to the long-established primacy of the FAA among global aviation bodies. And the report raises serious questions as to how the regulatory system can be fixed to prevent similar accidents in the future. The Joint Authorities Technical Review (JATR) panel found that the MAX’s new flight-control system, which played a central role in the accidents in Indonesia and Ethiopia that killed 346 people, was not properly evaluated in the certification documents that Boeing submitted to the FAA. 737 MAX CRISIS COMPLETE COVERAGE » Dennis Muilenburg out as Boeing chairman but keeps CEO position Boeing rejected 737 MAX safety upgrades before fatal crashes, whistleblower says Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts Echoing a Seattle Times report on March 17, less than a week after the second crash, the panel found that Boeing submitted to the FAA an inadequate technical description of the airplane’s new Maneuvering Characteristics Augmentation System (MCAS), lacking full details of when the system activated and the extent of its power to push an airplane nose down. Boeing’s documentation of MCAS was fragmented and incomplete, the report said. When Boeing changed the design to make it more powerful and to reduce the trigger mechanism to a single sensor, that wasn’t fully communicated to the FAA. Undue pressure The report also found that the FAA had “limited involvement” in the evaluation of MCAS and left most of the work of assessing the system to Boeing itself. “MCAS should have been considered a novelty (and therefore clearly highlighted to the FAA technical staff) owing to the important differences in function and implementation it has on the B737 MAX,” the report declares. In practice, FAA personnel had “inadequate awareness” of how MCAS worked, which “resulted in an inability of the FAA to provide an independent assessment.” The report, confirming a Seattle Times report on May 5, also cites indications that Boeing employees working on the certification of the airplane on behalf of the FAA faced “undue pressure” from managers who prioritized cost and schedule. The report recommends revision of the system whereby the FAA delegates much of the oversight of airplane certification to Boeing, a system known as Organization Designation Authorization. Under ODA, Boeing engineers who do the certification analysis and testing report to managers within the Boeing organization who relay the results to the FAA. The JATR recommends adjusting this structure so that authorized engineers at Boeing have direct, “open lines of communication to FAA certification engineers without fear of punitive action or process violation” to ensure they “are working without any undue pressure when they are making decisions on behalf of the FAA.” This recommendation mirrors the advice of experts cited in the May 5 Seattle Times story who advised the FAA to revert to elements of an earlier oversight structure — called Designated Engineering Representatives or DERs — in which the Boeing engineers who act on behalf of the FAA report to their technical counterparts at the FAA. Pilots unable to cope The panel also questions the assumption in FAA regulations that pilots will recognize something wrong within 1 second when flying the plane manually and will take corrective action within 3 seconds. The report indicates that the 737’s crew-alerting systems that tell pilots when something goes wrong may not be adequate for such an assumption. The JATR noted that a system fault can result in cascading failures, and asked the FAA to assess the adequacy of both the certification process and of pilot training to address “the impact of multiple alarms, along with possible startle effect, on the ability of pilots to respond appropriately.” Regulators need to ensure there’s adequate training so pilots can “respond effectively to failures that they may never have encountered before,” the report states. Last week, the Seattle Times reported that Boeing pushed the FAA to relax certification requirements for crew alerts on the 737 MAX. As a result, the JATR team determined, the certification process did not adequately address this issue of multiple clamoring alarms and the expected pilot response. JATR therefore recommends a top-down reassessment of how airplanes like the MAX that are derivatives of earlier models are certified, to determine when an aging aircraft design is “incapable of supporting the safety advancements introduced by the latest regulations.” The report states that the FAA raised concerns to Boeing about the cumulative effect of cockpit system changes from the previous 737 model to the MAX and suggested that might create a need for simulator level pilot training. Boeing’s response to this concern, which the FAA accepted, was that there was “no precedent” for a demand for enhanced training in previous certifications of derivative models. In a teleconference call Friday, JATR chairman Christopher Hart, former chair of the National Transportation Safety Board (NTSB), said that the increasing prevalence of automation on aircraft means that the problems with the MAX are “not just an airplane problem, but an airplane/pilot problem,” which he said complicates decisions about grounding and ungrounding an aircraft and is likely to become a major issue in the future. “As automation becomes more and more complex, pilots are less likely to fully understand it and more likely to have problems and more likely to encounter scenarios in real operations that they haven’t seen even in a simulator,” he said. Hart called on the FAA and regulators worldwide to recognize and address “this new reality of super-complex automation and pilots not necessarily understanding how to operate it.” The JATR report says that as systems become more complex, the certification process should ensure that aircraft incorporate “fail-safe” designs, meaning that any system failure triggers an automatic default into a safe mode. The goal is to eliminate or mitigate hazards “through design, minimizing reliance on pilot action as primary means of risk mitigation,” the report goes on. The panel separately recommends that “the FAA should review the natural (bare airframe) stalling characteristics of the B737 MAX to determine if unsafe characteristics exist.” This implies JATR wants the FAA to assess the safety of the plane without MCAS in operation. Boeing has said that the purpose of MCAS is not to prevent a stall but simply to make sure it handles exactly like the earlier model 737 when going through certain stall testing. Some criticism of the company on social media has been skeptical of this, proclaiming the MAX “inherently unstable” because it needs software to fly safely. To demonstrate otherwise, Boeing test pilots this summer repeatedly flew that required stall test on the MAX — an extreme maneuver called a “wind-up turn” — both with and without the revamped MCAS operating. Boeing says it is satisfied with the results. The FAA and overseas regulators will conduct their own flight tests, likely next month. MCAS upgraded JATR was convened in April by the FAA to independently evaluate all aspects of the design and certification of MCAS. The panel is made up of technical safety experts from the FAA and NASA along with the civil aviation authorities of Australia, Brazil, Canada, China, the European Union, Japan, Indonesia, Singapore and the United Arab Emirates. Boeing did not directly address the report’s findings Friday but said in a statement that it “is committed to working with the FAA.” FAA Administrator Steve Dickson issued a statement thanking JATR for its “unvarnished and independent” report. “I will review every recommendation and take appropriate action,” Dickson said. “We welcome this scrutiny.” MCAS consists of new flight-control software added to the MAX. If a sensor that measures the jet’s angle of attack, the angle between the wing and the oncoming air flow, indicates that the nose of the aircraft is pitching up, MCAS is designed to swivel the jet’s horizontal tail — called the horizontal stabilizer — so as to push the nose of the aircraft back down. The JATR report notes the failure in communication between Boeing and the FAA during the certification process as MCAS evolved “from a relatively benign system to a much more aggressive system.” The result was a failure to address the potential unintended consequences that resulted from “designing software for one scenario — in this case, high-speed windup turns — and then modifying the software for a different scenario — in this case reducing the pitch-up tendency at higher angles of attack at low speeds.” Boeing has prepared a redesign of MCAS that addresses the inadequacies of the original design, which was activated by a single angle-of-attack sensor. On both crash flights, the accidents were initiated by a false signal from that one sensor. The updated MCAS software will be activated only if both such sensors on the aircraft show the same high angle of attack. In addition, the system is now redesigned so that it can activate only once. And Boeing has changed the overall software system architecture to compare readings from both flight control computers, instead of using only one, and to shut down MCAS in less than a second if the computers disagree. But as regulators evaluate those improvements and the pilot training that will be required, the 737 MAX remains grounded worldwide seven months after the second crash. On Friday’s teleconference, FAA spokesman Lynn Lunsford said that because the FAA is doing an entirely new safety analysis of all the changes to the MAX before giving the plane clearance to return to service, “the majority of the return to flight issues that have been raised by JATR are being addressed.” “We are going through the recommendations one more time to make sure that any of them that aren’t being addressed will be as part of the current review,” Lunsford added. Page 1 of Final JATR Submittal to FAA Oct 2019 DocumentCloud Contributed to DocumentCloud by Judy Averill of The Seattle Times • View document Dominic Gates: 206-464-2963 or dgates@seattletimes.com; on Twitter: @dominicgates.

When is a "whistleblower" not a whistleblower? What is the need for such a role in an organization and what processes, if any, make such a role redundant or at least unnecessary?

Boeing whistleblower’s complaint says 737 MAX safety upgrades were rejected over cost Oct. 2, 2019 at 6:00 am 1 of 2 | (Gabriel Campanario / The Seattle Times) By Dominic Gates , Steve Miletich and Lewis Kamb Seattle Times staff reporters Seven weeks after the second fatal crash of a 737 MAX in March, a Boeing engineer submitted a scathing internal ethics complaint alleging that management — determined to keep down costs for airline customers — had blocked significant safety improvements during the jet’s development. The ethics charge, filed by 33-year-old engineer Curtis Ewbank, whose job involved studying past crashes and using that information to make new planes safer, describes how around 2014 his group presented to managers and senior executives a proposal to add various safety upgrades to the MAX. The complaint, a copy of which was reviewed by The Seattle Times, suggests that one of the proposed systems could have potentially prevented the crashes in Indonesia and Ethiopia that killed 346 people. Three of Ewbank’s former colleagues interviewed for this story concurred. The details revealed in the ethics complaint raise new questions about the culture at Boeing and whether the long-held imperative that safety must be the overarching priority was compromised on the MAX by business considerations and management’s focus on schedule and cost. Managers twice rejected adding the new system on the basis of “cost and potential (pilot) training impact,” the complaint states. It was then raised a third time in a meeting with 737 MAX chief project engineer, Michael Teal, who cited the same objections as he killed the proposal. 737 MAX crisis | Complete coverage » · Boeing made erroneous assumptions on pilots’ response to alerts in 737 MAX, NTSB says · Boeing’s board calls for better internal safety oversight in wake of 737 MAX crashes · Boeing CEO sees ‘endgame’ in effort to lift grounding of 737 MAX A version of the proposed system, called synthetic airspeed, was already installed on the 787 Dreamliner. It was not directly related to the flight-control system — the Maneuvering Characteristics Augmentation System (MCAS) — that contributed to both crashes. But it would have detected the false angle of attack signal that initiated events in both accidents, and so potentially could have stopped MCAS from activating and repeatedly pushing down the nose of each jet. But installing it in the MAX would likely have meant 737 pilots needed extra training in flight simulators. Running thousands of pilots through simulator sessions would have delayed the jet’s entry into service and added substantial costs for Boeing’s airline customers, damaging the MAX’s competitive edge against the rival Airbus A320neo. Ewbank’s complaint goes further than the decision not to install this one new system. He describes management as “more concerned with cost and schedule than safety and quality.” And he alleges that in one instance Boeing hid inflight safety incident data from the European Union Aviation Safety Agency (EASA). As first reported in The Seattle Times, Boeing did an inadequate system safety assessment that missed flaws in the design of MCAS that were central to the two MAX disasters. And Boeing engineers were under pressure to limit safety testing to certify the MAX. These fresh allegations from inside Boeing indicate that the problems with jetmaker’s safety culture may go deeper than MCAS. Submitted via Boeing’s internal whistleblower system, Ewbank’s complaint alleges that MAX program managers, concerned with avoiding higher costs and more pilot training, were intent on “shutting down trade studies that attempted to modernize the airplane and avoiding awareness of known issues encountered in historical 737 operation.” Federal investigators The FBI has interviewed at least two Boeing employees about the complaint. It’s unclear how the Boeing document reached the agency, but federal investigators are known to have issued subpoenas to the company. Department of Justice prosecutors, Department of Transportation inspectors and Securities and Exchange Commission (SEC) officials are all involved in a wide-ranging federal investigation into possible wrongdoing at Boeing during certification of the MAX that was already under way before the engineer filed his internal complaint in April. Boeing declined to comment on the details of the ethics complaint. Teal, 737 MAX chief project engineer, could not be reached for comment. The Department of Justice also declined to comment. The Seattle Times is not naming the employees who have been questioned by the FBI to protect the identity of the source of that information. Ewbanks declined to be interviewed. The Seattle Times is naming him because he identified himself in his complaint to Boeing. The MAX has been grounded worldwide for almost seven months as Boeing works on a comprehensive fix to its flight-control systems that will satisfy air safety regulators around the globe. The final updates to the systems are expected to be submitted to the Federal Aviation Administration (FAA) this month, and Boeing anticipates clearance to return the jet to the sky in November. Meanwhile, multiple investigations and reviews, internal and external, are examining what caused the deadly crashes. Last week, Boeing’s board announced a revamp of the company’s reporting structures aimed at producing better internal safety oversight. On Monday, Boeing chairman and chief executive Dennis Muilenburg said he’s “taking immediate steps” to implement those recommendations. The engineer Ewbank’s ethics complaint expressed concern about the possible personal consequences of stepping forward inside the company. “Given the nature of this complaint, the fear of retaliation is high, despite all official assurances that this should not be the case,” he wrote. “There is a suppressive cultural attitude towards criticism of corporate policy — especially if that criticism comes as a result of fatal accidents.” Ewbank wrote that co-workers told him in private they are afraid to speak up about similar safety concerns out of “fear for their jobs.” In a statement responding to requests for comment this week, Boeing said it “has rigorous processes in place, both to ensure that such complaints receive thorough consideration and to protect the confidentiality of employees who make them.” Most Read Business Stories · Buying a home in Seattle area may get thousands of dollars cheaper, after rule change by agents this week · Boeing whistleblower’s complaint says 737 MAX safety upgrades were rejected over cost | Times Watchdog · Seattle company is using artificial intelligence to make pizza; check out the assembly line VIEW · New partnership involving T-Mobile, UW, Bellevue and others could turn region into a 5G hub · Two thirds of Forever 21 stores in Washington could close by end of year “Accordingly, Boeing does not comment on the substance or existence of such internal complaints,” the statement added. Ewbank’s LinkedIn profile shows he graduated from Embry-Riddle Aeronautical University in 2008 with a degree in aeronautical engineering, then got a master’s at Purdue. After college, he took a job as rocket scientist, doing launch site design engineering at the Kennedy Space Center in Florida with United Space Alliance, the joint venture between Boeing and Lockheed Martin. He was hired by Boeing in 2010 to work on designing commercial airplane flight deck systems, including the MAX. He now works on airplane systems integration for the 777X program. However, dissatisfied with his experience on the MAX program, he took a break from Boeing. LinkedIn shows he left the company in April 2015 and returned to work on the 777X only last November. The reason for the career break is cited in the ethics complaint: his feeling that Boeing management was “squeezing the engineering budget for new programs … more concerned with cost and schedule than safety and quality.” In his first stint at Boeing, he worked on the safety of flight deck systems across multiple jet programs. It put him at the center of what has become one focus of the investigations into the crashes: The systems that tell pilots how their plane is performing in flight and alert them to anything going wrong. Ewbank’s complaint says his job included “designing appropriate crew alerting and crew procedures based on expected (system) failures.” Last week, a National Transportation Safety Board (NTSB) report called for improvements to such systems and criticized Boeing’s testing of the MAX for failing to simulate the possible barrage of system failures and warnings the pilots on the crashed flights faced. The memo The proposal for system upgrades that Ewbank discusses in his complaint emerged from work he did alongside several veteran employees in Boeing’s Aviation Safety department “to analyze Loss of Control inflight accidents and design flight deck features that would work to break the accident chain of events.” One was Associate Technical Fellow Randy Mumaw, a cognitive psychologist and “human factors” expert in how pilots react to an airplane’s instruments. Mumaw, who left Boeing in 2015, said that as a non-engineer he can’t assess the technicalities of the synthetic airspeed system. But he said he knew Ewbank as “highly respected and bright.” The Seattle Times interviewed four former Boeing employees who were involved in the work of assessing the proposed safety upgrades. Rick Ludtke, a former flight deck integration engineer, worked alongside Ewbank and was a key participant in the proposal, which was presented in an engineering memo titled “Boeing Commercial Airplanes Strategy for Reducing the Risk of Loss of Control Events.” Ludtke said the purpose of the memo, which Ewbank cites in his complaint, was to “capture the approval” of executives and to try to get a list of six system improvements accepted across Boeing’s airplane programs, including the MAX, which was then in early development. The memo, which was signed off by Todd Zarfos, the Boeing vice president who heads the company’s engineering design centers, recommended that synthetic airspeed be installed on the MAX “with the next appropriate software update.” Another veteran Boeing engineer and associate technical fellow, Carlo Ruelos, was the early champion of synthetic airspeed at Boeing. A pilot flying any airplane needs to know the current airspeed — the plane’s speed relative to the air. Depending on the direction of the wind, that can be faster or slower than the groundspeed, the plane’s speed relative to the earth. Too high an airspeed could stress the airframe. Too low an airspeed could stall the plane. This key piece of data is measured by pitot-static air pressure sensors, little tubes that stick out of the fuselage on both sides under the cockpit. It’s entered into multiple calculations performed by the flight control computer, so an accurate value is important. Synthetic airspeed is a new system that provides an additional, indirect calculation of airspeed using different sensors, including the plane’s angle-of-attack sensors. The system enters the airplane’s angle of attack, its weight, the position of its control surfaces and other parameters into a proprietary Boeing algorithm to come up with an independently measured airspeed reading. The independence of the synthetic reading means that if it matches the direct airspeed readings, it verifies the data as highly reliable. If there’s a discrepancy, the air data is rejected and the plane’s automated systems won’t use it. Ewbank’s complaint cites a study that found air data reliability, and airspeed awareness in particular, as a “dominant theme” in airplane accidents where the pilots lost control. The only Boeing airplane using synthetic airspeed today is its latest all-new jet, the 787 Dreamliner. On the MAX, Ruelos saw an opportunity because the jet had a new integrated air data system box installed that had more computational power than that on the previous 737 NG model. That extra capability, Ruelos decided, would make it possible to add a variant of the 787 synthetic airspeed system to the MAX. And if it could be added, he felt it should be — because it would broadly enhance the reliability of the 737’s air data systems. Ruelos, now 75 and retired, said in an interview that the pitot and static probes used for standard airspeed measurement“stick out of the airplane and can be damaged by a bird strike. Or something can plug the very small hole.” So, he said, “I firmly believe that as another means of verifying the air data, (synthetic airspeed) is a key element in maintaining the safety of the airplane.” “We pushed very hard for it, because safety is always the No.1 priority,” he added. With the new air data avionics box on the MAX, he believed the system was “ready to go” on the new jet. The crashes At the time of this proposal, no one had identified MCAS as a concern. Back then, the original design of MCAS was more benign than the final version that went haywire on the two crash flights. It required two sensors to activate — a high angle of attack and and a high G-force —and was less extensive in its ability to push the nose down. It wasn’t until March 2016 that the MCAS design was changed to depend solely on a single angle-of-attack sensor. Synthetic airspeed gains significance in the aftermath of the accidents because the system’s cross-check of the independent airspeed readings would raise a red flag if there’s any angle-of-attack sensor fault. If the readings disagree, Ewbank wrote in his complaint, the system as implemented on the 787 is designed to “monitor and detect erroneous angle-of-attack data, and then work to prevent the use of erroneous data by downstream systems.” While Ewbank prefaces this statement with a careful qualifier — “It is not possible to say for certain that any actual implementation of synthetic airspeed on the 737 MAX would have prevented the accidents” — his implication is clear: Synthetic airspeed might have stopped MCAS from activating in the circumstances of the two crashed flights. Ludtke and Ruelos agreed. There’s “a very good chance” that if Boeing had implemented synthetic airspeed on the MAX, it would have prevented the crashes, Ludtke said. “In our department, we never designed anything without comparators,” meaning monitors that compare independent sensor readings and de-activate the system if they disagree, he said. “Curtis, I know, had several types of comparators in that synthetic airspeed system.” Asked separately if synthetic airspeed might have prevented the crashes, Ruelos responded: “I think so. The left and right systems do cross checks, and if there is a discrepancy, it won’t let the automatic system take control of the airplane. … It would disengage and the downstream systems wouldn’t use the data.” The cost concerns Of course, Boeing could have achieved the same result in simpler ways, for example if MCAS had been designed from the start to compare readings from the two angle-of-attack sensors instead of only one. Still, in hindsight the rejection of synthetic airspeed seems fateful. In his complaint, Ewbank puts it down to “a corporate culture … of expediency of design-to-market and cost-cutting.” “The 737 MAX was designed via piecemeal updates to prevent triggering expensive certification and (pilot) training,” his complaint states. Ludtke agreed. Synthetic airspeed was rejected “probably because of cost,” he said. He said Boeing had promised the airlines that the MAX would be so minimally different from the prior 737 model that no additional pilot certification or flight simulator training would be necessary. He said his manager told him Boeing promised MAX launch customer Southwest “$1 million per tail” if the FAA were to require expensive simulator training. “The MAX program leaders had always mandated that, if it’s not required for function or certification, it’s not going on the airplane,” Ludtke said. They looked upon synthetic airspeed as “a good improvement, but just an improvement,” not a necessity. “We still tried. Because we believed these aircraft need improving for the quality of pilots we are experiencing,” Ludtke added. “In the old days, before the MAX, that’s how we did business. At the launch of a new program, its leaders would be very interested in including all the latest ideas and safety improvements. “The MAX was different from the very beginning,” he said. “We’re just going to put these new engines on and the minimum change to make that happen. That’s it. We’re not spending money.” “That concept broke the company,” Ludtke concluded. Another former Boeing employee, a veteran test pilot also involved in the assessment of the proposed system changes, wasn’t close enough to the technical details of synthetic airspeed to be sure it would have prevented the accidents, yet agreed that any similar system based on angle of attack likely would have cut out MCAS. “That’s how you would hope the system would work,” said the pilot, who asked for anonymity to preserve relationships at Boeing. And the pilot agreed with Ludtke that preserving the MAX’s common type rating — certifying it as just a variant of the prior 737 NG model, rather than a new airplane — and ensuring that airline pilots wouldn’t be required to train for the MAX on flight simulators was “such a huge deal” that it blocked potential updates to the avionics systems. “I couldn’t believe they kept stretching the 737, both literally (with a longer fuselage) and also in terms of cockpit design,” the pilot said. The culture Ray Craig, former chief pilot on the 737 MAX until he retired in 2015, had a very different take. He said he worked with Ewbank and knew him as a “very sharp, very dedicated” engineer. Yet he defended the safety culture atBoeing and around the MAX program. “Safety was paramount. If there was something we thought was a safety issue, there was no question, it was taken care of,” Craig said. “But it’s not always a black-and-white decision.” Lacking full technical details, he wouldn’t venture an opinion about whether synthetic airspeed could have prevented the crashes. “I don’t remember it as ready to go. It wasn’t just a simple plug-and-play,” Craig said. “It wasn’t as program-ready as perhaps some of the folks were thinking. But I don’t remember the exact reason it was shot down.” Talk to us We continue to seek information on the design, training and certification of the Boeing 737 MAX. If you have insights, please get in touch with aerospace reporter Dominic Gates at 206-464-2963 or dgates@seattletimes.com. To communicate on a confidential and encrypted channel, follow the options available at https://st.news/newstips. Ewbank’s ethics complaint is much broader than the failure to install synthetic airspeed. He attacks the company’s culture around aviation safety and questions Craig’s and Boeing’s assertion that safety is always paramount. He recounts an episode in his department when he says Boeing hid in-flight safety incidents from Europe’s aviation regulator. This occurred when EASA found five events where 737s experienced a problem with the autothrottle disconnecting on approach and a confusing alert led to an inappropriate pilot response. EASA asked if Boeing was aware of any other such events and Ewbank was assigned to search the in-service databases. But when he identified five further similar incidents on 737s, his ethics complaint says his manager decided “to not tell EASA about these events” and that instead “we would fix the issue ourselves.” Ewbank, a relatively young engineer at the start of his career and with less than six years at Boeing over his two employment stints, even goes so far in the complaint as to directly attack CEO Muilenburg. He cites Muilenburg’s statement on a quarterly earnings teleconference, just four days before Ewbank filed the ethics complaint, denying that the two recent MAX crashes were due to any “technical slip” by Boeing during the jet’s design or certification. Ewbank calls this “a false statement.” “When CEO Muilenburg and others state that the Max was a safe airplane as designed, they seriously misrepresent what Boeing Engineering has learned about how data and control functions should be treated,” Ewbank wrote. Seattle Times researcher Miyoko Wolf contributed to this report. Dominic Gates: 206-464-2963 or dgates@seattletimes.com; on Twitter: @dominicgates. Steve Miletich: 206-464-3302 or smiletich@seattletimes.com; on Twitter: @stevemiletich. Lewis Kamb: 206-464-2932 or lkamb@seattletimes.com; on Twitter: @lewiskamb. View 67 Comments The opinions expressed in reader comments are those of the author only, and do not reflect the opinions of The Seattle Times.

Hi Greg; Re the New Republic article being "of interest", yes it is. There are themes that are familiar, certainly! But I have stopped writing about such matters. It's very difficult to marshall it all and still sustain attention/focus and to invite "care-full" thought without turning the discussion into a political tribal rally these days. I'm not a fan of OpEd explanations by non-experts, of aircraft accident. But you are right - there are some ideas in Tkacik's article, (The New Republic) that I found relevant to views I have held for a very long time and expressed here and elsewhere. In thinking about the points made in the article, it is obvious that we cannot point directly to this or that "cause" - one certainly cannot say, "capitalism caused these B737 accidents" without serious, and deserved, challenges to one's thought processes! However, the notions of a "propensity-for", or perhaps, if one imagines, "the garden in which certain ideas and ways flourished while others withered" we can say that there are certain possibilities for examination of how a post-war social/political/moral/cultural/business milieu provided fertile ground for the kinds of organizational behaviours and results which are now familiar. I posted links to two books which were largely cohort studies, (2010 & 2015 respectively), describing in detail the results of corporate and organizational behaviours for employees at Boeing, particularly after 1997. Interestingly, these theories (about Boeing's problems but also the American workers'), are now achieving mainstream and perhaps even investigatory status as Boeing and the FAA are examined under numerous microscopes, as they ought to be. But the American political economy, particularly after 2008, though under constant challenge, retains those characteristics which institutionally carve massive sectors of "ordinary people" out of the benefits of multi-trillion-dollar economies. Anyway, I will leave it there as this is a tech forum, but thank you for mentioning it.

From the September 26 2019 release: NTSB - Safety Recommendations Report and links to ongoing work: https://www.ntsb.gov/investigations/AccidentReports/Pages/ASR1901.aspx Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance: https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf

Good morning, boestar; A logical and reasonable question. From my limited awareness regarding the history of the MCAS design and implementation, and a very tiny smattering of U. S. certification standards, (CFR-25), and reading the many speculative statements on the matter, MCAS is not a "stall prevention" system, whereas stick pushers and stick shakers are. Boeing's approach to stall prevention for the B737 type certificate is set and not subject to change, (a separate, complex topic now under proper examination) without changes to the type certificate. MCAS is a response to slight changes in stick force in lower speed regimes as the AoA increases to a threshold. A lighter stick force than was required by certification appeared to be demonstrated in test flights, (wind-up turns, etc. and other flight test stuff I don't know about). Part of the initial stall prevention system is the increase in stick forces as AoA increases with a reduction in CAS, "forcing" the pilots to respond to the increase. In a way, it is an extension of how trim works in the first place...the B737-type STS trims "against" the pilot to force a response when such response is necessary. It works, (as does/did MCAS) and has since the type was certified in the mid-60's. The MCAS was not, itself, "certified", nor was it formally tested using Failure and Error Mode Analysis, (FMEA) processes, nor was the system examined for potential single-point-of-failure outcomes. Boeing rested upon past certifications of the stabilizer system and, perhaps because the "runaway stabilizer" drill was in place, (this is speculation only; I have seen opinions that Boeing didn't consider this far into the change), any untoward behaviour of the stabilizer would be handled by the crew. But five-second ND blips of the trim-wheel, a UAS indication, a stick-shaker and several other warnings immediately after takeoff were results of the loss of AoA signal from one sensor. I think most here who fly these types can attest to the confusion regarding which drill/checklist one would call for first, particular if the stick was getting heavier and heavier by the second. This scenario was not imagined and considered by Boeing nor was the change in the flight control system conveyed to users and was not in the FCOM or FCTM. I am certain there are bits left out and perhaps others can fill in blanks...;-) Don

https://www.wsj.com/articles/indonesia-to-fault-737-max-design-u-s-oversight-in-lion-air-crash-report-11569185664 Indonesia to Fault 737 MAX Design, U.S. Oversight in Lion Air Crash Report First formal government finding on crash also likely to detail pilot and maintenance missteps; NTSB preparing separate safety recommendations Indonesian officials have found design and oversight lapses played a central role in October’s Lion Air crash. Above, wreckage from Lion Air flight JT610, Karawang, Nov. 3, 2018. Photo: antara foto/Jaya Kusuma/Reuters By Andy Pasztor and Andrew Tangel Sept. 22, 2019 4:54 pm ET Indonesian investigators have determined that design and oversight lapses played a central role in the fatal crash of a Boeing 737 MAX jet in October, according to people familiar with the matter, in what is expected to be the first formal government finding of fault. The draft conclusions, these people said, also identify a string of pilot errors and maintenance mistakes as causal factors in the fatal plunge of the Boeing Co. plane into the Java Sea, echoing a preliminary report from Indonesia last year. Related Coverage International Panel Set to Criticize FAA’s Approval Process for Boeing 737 MAX Jets (Sept. 16) New Delays Could Keep Boeing 737 MAX Grounded Into Holiday Travel Season (Sept. 1) The Four-Second Catastrophe: How Boeing Doomed the 737 MAX (Aug. 16) Misfires of an automated flight-control feature called MCAS on the MAX fleet led to the nosedive of the Lion Air jet and a similar crash of an Ethiopian Airlines MAX shortly after takeoff from Addis Ababa in March. The two crashes took 346 lives, prompted the grounding of all 737 MAX planes and disrupted the global aviation industry. Details of the Indonesian report, which haven’t been reported previously, are subject to change and further analysis. Indonesian investigators declined to comment, except to say the final document is likely to come out in early November. A Boeing spokesman said the plane maker continues to work with Indonesian authorities as they complete the report. U.S. air-crash investigators are preparing to make public a handful of separate safety recommendations, ranging from bolstering the manual flying skills of pilots to enhancing FAA vetting of new aircraft designs. The U.S. National Transportation Safety Board is expected around the end of the month to call for improvements to cockpit training and crew decision making, according to industry and government officials. The goal is to ensure pilot proficiency when automated systems are malfunctioning or turned off, to help ensure appropriate responses to contradictory cockpit warnings such as those that occurred prior to the MAX crashes, the officials said. The board also is expected to emphasize the importance of setting priorities when executing emergency checklists. Is the Federal Aviation Administration too close to the industry it regulates? In the wake of the Boeing 737 MAX 8 crashes in Indonesia and Ethiopia, The Wall Street Journal examines why the FAA is facing renewed scrutiny into its aircraft certification process. In addition, the NTSB is expected to focus on potential changes to the certification of new airliners. The board is poised to recommend re-evaluation of FAA procedures that give the industry authority to sign off on certain safety matters, the officials said. The aim is to make such approvals more transparent, with the goal of greater predictability and more-consistent federal oversight across various types of onboard systems. Neither the U.S. nor Indonesian recommendations will be binding on the FAA, though the agency already faces escalating congressional and public pressure to change certification procedures. More than half a dozen outside inquiries, including a Justice Department criminal probe and various blue-ribbon advisory panels, are delving into the FAA’s 2017 approval of MCAS. Earlier this month, a Senate appropriations subcommittee backed legislation that would require FAA officials to address recommendations from ongoing investigations and audits. The FAA has said it welcomes the independent reviews, will carefully consider their results and doesn’t have a firm timetable for allowing MAX jets back in the air. Boeing has said it is collaborating with U.S. and foreign officials to safely return the MAX to service. Steve Dickson, the FAA’s new head, and top lieutenants are scheduled to meet Monday in Montreal with some four dozen foreign regulators to provide a closed-door update on anticipated fixes to the MAX’s flight-control software and computers. The crashes prompted the grounding of all 737 MAX planes and disrupted the global aviation industry. The FAA is urging a core group of regulators—from Canada, Australia, Brazil and New Zealand—to approve the fixes around November, which would be roughly in tandem with informal U.S. timelines. FAA leaders also are trying to persuade aviation authorities in Europe and other regions to follow by lifting their grounding orders shortly afterward, according to U.S. government and industry officials familiar with the deliberations.But such coordination efforts are running into significant hurdles. Canadian aviation regulators have signaled to the FAA that they expect to require pilots to undergo simulator training before they can start flying the MAX, something the FAA is unlikely to mandate. It could take until March for Air Canada to phase the bulk of its MAX aircraft into regular schedules, according to a person briefed on the details, months later than projected for U.S. operators.In Europe, regulators previously said they won’t accept the FAA’s technical verifications of fixes and intend to perform their own certification analyses, possibly adding weeks or months to the timetable. Meanwhile, FAA officials said in recent weeks that Boeing hasn’t provided all of the requested details laying out the description and safety assessments of the MAX’s redesigned flight-control system. The latest version of Indonesia’s accident report has been shared with the FAA and NTSB for comment. U.S. officials are expected to visit Indonesia around the end of this month to finalize the document. People familiar with the process said NTSB experts don’t appear to have major disagreements with the draft. Boeing and the FAA, on the other hand, are concerned the final report will unduly emphasize design and FAA certification missteps, some of these people said. Unlike NTSB reports that identify the primary cause of accidents and then list contributing issues determined to be less significant, Indonesia is following a convention used by many foreign regulators of listing causal factors without ranking them. Instead, the report is expected to list more than 100 elements of the crash chronology, according to a person briefed on the details. Many of those points are likely to refer to missteps by pilots and mechanics initially revealed last year in Indonesia’s preliminary report. Indonesian authorities now are asking for comments on the draft conclusions dealing with those missteps, as well as findings that investigators have determined constitute engineering shortcomings, including reliance on a sole sensor in the original design of MCAS, according to people familiar with the matter. —Kim Mackrael and Ben Otto contributed to this article. Write to Andy Pasztor at andy.pasztor@wsj.com and Andrew Tangel at Andrew.Tangel@wsj.com

I dismissed Langewiesche on AF447, haven't read anything by him since so not sure he pronounces on MH370 and dismiss him once again, here. It is difficult to jam evidence into a narrative in support of an opinion but this is what Langewiesche does. Boeing designed into the flight-control system a single point of failure which could potentially result in loss of the aircraft. They did not run a FEMA, (fault & error mode analysis) because the HS/trim system had previously "passed" such examination. Boeing jammed the aircraft into the same "type" box for customers, primarily Southwest. While other designers advanced with technology, Boeing was held back in the sixties, and not just with their narrow-body thinking. Two good books on culture at Boeing pre- & post- 1997: Turbulence: Boeing and the State of American Workers and Managers, Greenberg, Brunberg, Moore, Silora, 2010, Yale, and Emerging From Turbulence, Boeing and Stories of the American Workplace Today, Grunberg, Moore, 2015, Rowan and Littlefield. Both are available as Kindle books as well as hardbacks. The post-1997 culture at Boeing is now under close scrutiny.

14,000 Words Of "Blame The Pilots" That Whitewash Boeing Of 737 MAX Failure The New York Times Magazine just published a 14,000 words piece about the Boeing 737 MAX accidents. It is headlined: What Really Brought Down the Boeing 737 Max? But the piece does not really say what brought the Boeing 737 MAX down. It does not explain the basic engineering errors Boeing made. It does not explain its lack of safety analysis. It does not mention the irresponsible delegation of certification authority from the Federal Aviation Administration to Boeing. There is no mention of the corporate greed that is the root cause of those failures. Instead the piece is full of slandering accusations against the foreign pilots of the two 737 MAX planes that crashed. It bashes the airlines and the safety authorities of Indonesia and Ethiopia. It only mildly criticizes Boeing for designing the MCAS system that brought the planes down. The author of the piece, William Langewiesche, was a professional pilot before he turned to journalism. But there is so much slander in the text that it might as well have been written by Boeing's public relations department. The piece is also riddled with technical mistakes. We will pick on the most obvious ones below. The following is thus a bit technical and maybe too boring for our regular readers. Langewiesche describes the 737 MAX trim system and its failure mode: That’s a runaway trim. Such failures are easily countered by the pilot — first by using the control column to give opposing elevator, then by flipping a couple of switches to shut off the electrics before reverting to a perfectly capable parallel system of manual trim. But it seemed that for some reason, the Lion Air crew might not have resorted to the simple solution. Wrong: The manual trim system does not work at all when the stabilizer is widely out of trim (i.e. after MCAS intervened) and/or if the plane is flying faster than usual. That is why the European regulator EASA sees it as a major concern and wants it fixed. Langewiesche knows this. He later writes of one of the accidents: The speed, meanwhile, was producing such large aerodynamic forces on the tail that the manual trim wheel lacked the mechanical power to overcome them, and the trim was essentially locked into the position where the MCAS had left it Is that a 'perfectly capable system'? Of the crashed Lion Air flight 610 Langewiesche writes: At 6:31 a.m., 11 minutes into the flight, Suneja got on the radio for the first time. He did not know their altitude, he told the controller, because all their altitude indicators were showing different values. This is unlikely and has never been explained. Wrong. The value given by an Angle of Attack sensor is also used in calculating the speed and attitude of a plane. If one of the two AoA sensors fails the instruments on the side that with the failed AoA sensor will show different values than those on the other side of the cockpit. Langewiesche knows this. Further down in his piece he writes: That story actually starts three days before the accident, when the same airplane — under different flight numbers and Lion Air crews — experienced errors in airspeed and altitude indications on the captain’s (left side) flight display that weren’t properly addressed. Those indications are driven by a combination of sensors on the surface of the airplane. Is that 'unlikely' and unexplained? This is an unfounded claim: Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane’s flight manuals. Wrong. Boeing sold the new plane with the dubious claim that it handled no differently than its predecessor. It left MCAS out of the manual because it did not want to add to training requirements for the pilots which would have contradicted its marketing claim. Furthermore Boeing did not do any additional safety evaluation when it later increased the effect of the system. Another wrong part: A set of independent duplicate sensors drive the co-pilot’s (right side) display. A third standby system provides additional independent backup and allows for intuitive troubleshooting when any one of the three systems fails: If two indications agree and the third one does not, the odd one out is obviously the one to ignore. This sort of arrangement helps to explain why flying a Boeing is not normally an intellectual challenge. Furthermore, the airplane provides an alert when airspeed or altitude indications disagree. There is no general third standby system on a Boeing 737. There is a set of standby instruments for altitude and airspeed. But these give uncorrected values that differ from the ones shown on the two flight control displays. Those values are calculated by two flight computers and each takes the value of only one pitot (speed) tube and one AoA sensor into account. If an AoA sensor fails the instruments on one side show wrong values. The instruments on the other side will show different but hopefully correct values. The standby instruments will show different, uncorrected values than both of the calculated ones. Langewiesche describes an earlier Lion Air flight that also experienced an MCAS failure but was by chance saved: Immediately after liftoff, the captain’s airspeed indication failed, airspeed-disagreement and altitude-disagreement warnings appeared on his flight display and his stick shaker began to rattle the controls in warning of an imminent stall. The Bali captain was enough of an airman to realize that he was dealing with an information failure only — not an actual stall. No direct mention has been made of this, but he must have immediately identified the replacement angle-of-attack vane on his side as the likely culprit. Wrong. How would the pilot know that? The pilot noticed intermittet automatic down trim. That failure mode was not in the flight manuals and pilot had no way to attribute it to an AoA sensor. The claim is also contradicted by the pilot's maintenance log entry of which Langewiesche writes: After pulling up to the gate in Jakarta, the Bali captain informed a company mechanic about “the aircraft problem” and in the maintenance log noted only three anomalies — the captain’s airspeed and altitude indication errors and the illumination of a warning light related to a system known as Feel Differential Pressure. That was it. Apparently the captain noted nothing about the failure of the newly installed angle-of-attack sensor, or the activation of the stick shaker, or the runaway trim, or the current position of the trim cutout switches. If true, it was hard to conclude anything other than that this was severe and grotesque negligence. The captain noted nothing about the AoA sensor because he did not know that it failed. The captain did mention a trim problem but he had not experienced a runaway trim. A classic runaway trim is continuous. An MCAS intervention like the one the captain experienced stops after 9 seconds. But the pilots on that flight did not even know that MCAS existed. The captain reported all the basic symptoms he experienced during that flight. A runaway was not one of them. Langewiesche fails to mention, probably intentionally, the captain's additional entry in the maintenance log. The captain wrote: "Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the wrong direction ...". STS, the Speed Trim System, moves the stabilizer trim. It does that all the time but discontinuously during every normal flight. The pilot correctly described the symptoms of the incident as he perceived them. Those were not the symptoms of a continuously runaway stabilizer. But the pilot knew, and documented, that he experienced an intermittet trim problem. It was the mechanic's responsibility to analyze the underlying error and to correct the system which is exactly what he did. The author's "blame the pilots" attitude is well expressed in this paragraph: Critics have since loudly blamed it for the difficulty in countering the MCAS when the system receives false indications of a stall. But the truth is that the MCAS is easy to counter — just flip the famous switches to kill it. Furthermore, when you have a maintenance log that shows the replacement of an angle-of-attack sensor two days before and then you have an associated stick shaker rattling away while the other stick shaker remains quiet, you do not need an idiot light to tell you what is going on. At any rate, the recognition of an angle-of-attack disagreement — however pilots do or do not come to it — has no bearing on this accident, so we will move on. An AoA sensor failure and a following MCAS incident will cause all of the following: an unexpected autopilot shutdown, an airspeed warning, an altitude disagree warning, a stall warning and, after MCAS intervenes, also an over-speed warning. The control column rattles, a loud clacker goes off, several lights blink or go red, several flight instruments suddenly show crazy values. All this in a critical flight phase immediately after the start when the workload is already high. It is this multitude of warnings, which each can have multiple causes, that startle a pilot and make it impossible to diagnose and correct within the 10 seconds that MCAS runs. To claim that "MCAS is easy to counter" is a gross misjudgment of a pilot's workload in such a critical situation. After blaming the pilots Langewiesche bashes the foreign air safety regulators which are now investigating the MAX accidents: According to sources familiar with both investigations, Boeing and the N.T.S.B. have been largely excluded and denied access to such basic evidence as the complete flight-data recordings and the audio from the cockpit. ... It is a forlorn hope, but you might wish that investigators like those in Indonesia and Ethiopia would someday have the self-confidence to pursue full and transparent investigations and release all the raw data associated with the accidents. I am not aware of an accident in the U.S. where the FAA investigators released "complete flight-data recordings and the audio from the cockpit" to foreign entities that were suspected to have caused the incident. Nor will the FAA "release all the raw data" associated with an accident. Certainly not before an investigation is finished. Boeing screwed up by designing and installing a faulty system that was unsafe. It did not even tell the pilots that MCAS existed. It still insists that the system's failure should not be trained in simulator type training. Boeing's failure and the FAA's negligence, not the pilots, caused two major accidents. Nearly a year after the first incident Boeing has still not presented a solution that the FAA would accept. Meanwhile more safety critical issues on the 737 MAX were found for which Boeing has still not provided any acceptable solution. But to Langewiesche this is anyway all irrelevant. He closes his piece out with more "blame the pilots" whitewash of "poor Boeing": The 737 Max remains grounded under impossibly close scrutiny, and any suggestion that this might be an overreaction, or that ulterior motives might be at play, or that the Indonesian and Ethiopian investigations might be inadequate, is dismissed summarily. To top it off, while the technical fixes to the MCAS have been accomplished, other barely related imperfections have been discovered and added to the airplane’s woes. All signs are that the reintroduction of the 737 Max will be exceedingly difficult because of political and bureaucratic obstacles that are formidable and widespread. Who in a position of authority will say to the public that the airplane is safe? I would if I were in such a position. What we had in the two downed airplanes was a textbook failure of airmanship. In broad daylight, these pilots couldn’t decipher a variant of a simple runaway trim, and they ended up flying too fast at low altitude, neglecting to throttle back and leading their passengers over an aerodynamic edge into oblivion. They were the deciding factor here — not the MCAS, not the Max. One wonders how much Boeing paid the author to assemble his screed. --- Previous Moon of Alabama posts on Boeing 737 MAX issues: Boeing, The FAA, And Why Two 737 MAX Planes Crashed - March 12 2019 Flawed Safety Analysis, Failed Oversight - Why Two 737 MAX Planes Crashed - March 17 2019 Regulators Knew Of 737 MAX Trim Problems - Certification Demanded Training That Boeing Failed To Deliver - March 29 2019 Ethiopian Airline Crash - Boeing Advice To 737 MAX Pilots Was Flawed - April 9 2019 Boeing 737 MAX Crash Reveals Severe Problem With Older Boeing 737 NGs - May 25 2019 Boeing's Software Fix For The 737 MAX Problem Overwhelms The Plane's Computer - June 27 2019 EASA Tells Boeing To Fix 5 Major 737 MAX Issues - July 7 2019 The New Delay Of Boeing's 737 MAX Return Will Not Be The Last One - July 15 2019 737 MAX Rudder Control Does Not Meet Safety Guidelines - It Was Still Certified - July 28 2019 737 MAX - Boeing Insults International Safety Regulators As New Problems Cause Longer Grounding - September 3 2019 Boeing Foresees Return Of The 737 MAX In November - But Not Everywhere - September 12 2019 Posted by b on September 18, 2019 at 16:41 UTC | Permalink

"Single-point-of-failure", (or more simplistically, "all eggs in one basket"), is a decision which carries potential risk at all levels and not merely in aircraft design. A single, fleet-type is such a decision, the essential motivation by one customer being the elimination of "expensive" training. Ultimately, the decisions between Boeing and SW and the FAA were probablistic, economic and political, not engineering and technical. EASA presentation to the European Parliament, September 03, 2019: https://www.europarl.europa.eu/cmsdata/186500/20190903_EASA_Ky-original.pdf

Boeing Board to Call for Safety Changes After 737 Max Crashes By David Gelles and Natalie Kitroeff Sept. 15, 2019 For the past five months, a small committee of Boeing’s board has been interviewing company employees, safety experts and executives at other industrial organizations in an attempt to understand how the aerospace giant could design and build safer airplanes. The committee is expected to deliver its findings to the full Boeing board this week, and call for several meaningful changes to the way the company is structured, according to three people briefed on the matter who spoke on the condition of anonymity because the report has not yet been submitted. The recommendations will include that Boeing change aspects of its organizational structure, calling for the creation of new groups focused on safety and encouraging the company to consider making changes to the cockpits of future airplanes to accommodate a new generation of pilots, some of whom may have less training. Though the committee did not investigate the two crashes of Boeing’s 737 Max jet, their findings represent the company’s most direct effort yet to reform its internal processes after the accidents, which killed 346 people. One of the report’s most significant findings concerns the reporting structure for engineers at the company. At Boeing, top engineers report primarily to the business leaders for each airplane model, and secondarily to the company’s chief engineer. Under this model, engineers who identify problems that might slow a jet’s development could face resistance from executives whose jobs revolve around meeting production deadlines. The committee recommends flipping the reporting lines, so that top engineers report primarily to Boeing’s chief engineer, and secondarily to business unit leaders. The two Boeing crashes killed 346 people. Another key recommendation calls for establishing a new safety group that will work across the company. The committee examined the process by which Boeing employees conduct certification work on behalf of the Federal Aviation Administration, known as Organization Designation Authorization, as well as an internal company framework known as the Boeing Safety Management System. Boeing has more than 100,000 employees and, like many large companies, at times struggles with information flow. In particular, there has been inadequate communication within the engineering department, and from Boeing’s commercial airplanes division, based in the Seattle area, to Boeing corporate offices in Chicago. The new safety group will work to ensure that the company’s various efforts have adequate independence and are working together and sharing information effectively. The new group will report to senior Boeing leadership, as well as to a new permanent committee on the board focused on aerospace safety. A third major recommendation involves how Boeing approaches the design of future airplanes. Though the Max crashes were triggered by the malfunction of a new system on the planes, there is a simmering debate concerning whether the pilots responded appropriately, and whether the Lion Air plane that crashed off Indonesia last October should have been flying at all because of maintenance problems. Training levels can vary by country. The first officer of Ethiopian Airlines Flight 302, which crashed in March, was relatively inexperienced, with just over 200 hours flying 737s. The board committee is expected to recommend that Boeing re-examine cockpit design and operation to ensure that new Boeing planes are accessible for the next generation of pilots, including those with less training. Boeing’s chief executive, Dennis A. Muilenburg, established the committee in April, calling on it to review “companywide policies and processes for the design and development of the airplanes we build.” The group included four Boeing directors familiar with complex industrial systems, as well as highly regulated industries. Top Boeing engineers report to both the company’s chief engineer and to the business side, something an internal review is expected to recommend be changed. Credit Ruth Fremson The New York Times Admiral Edmund Giambastiani Jr., a former nuclear submarine officer and the former vice chairman of the Joint Chiefs of Staff, was the committee chairman. The other members were Lynn Good, the chief executive of Duke Energy and a board member of the Institute for Nuclear Power Operations; Edward Liddy, the former chief executive of the insurance company Allstate; and Robert Bradway, the chief executive of Amgen, a pharmaceuticals company. To conduct its review, the committee interviewed dozens of Boeing employees about their work. The committee also hired independent safety experts who had experience with industrial accidents including the Deepwater Horizon explosion, the Columbia space shuttle disaster and the Fukushima nuclear power plant accident. Among the experts was Sean O’Keefe, the former NASA administrator. Additionally, the committee consulted with officials from NASA, General Electric, Duke Energy and military leaders who had experience dealing with accidents and their aftermaths. The Max remains grounded six months after the second crash, though the F.A.A. may allow the planes to fly again by the end of the year, according to several people familiar with the process. Some international regulators are likely to take longer, however, signaling a rift in the global aviation community. This month, Patrick Ky, the head of the European Aviation Safety Agency, suggested that when the F.A.A. deemed the Max safe to fly again, his agency was unlikely to do so at the same time. “The F.A.A. is in a very difficult situation,” Mr. Ky said during an appearance at European Parliament. “When they say this is good to go, it’s very likely that international authorities will want a second opinion.” Even as the F.A.A. is working with Boeing to return the Max to service, the regulator itself is facing scrutiny. A multiagency task force reviewing the certification of the Max is also expected to submit its report this month, and is likely to recommend changes to the way the F.A.A. oversees airplane manufacturers like Boeing, according to people briefed on the effort who spoke on the condition of anonymity because the review is incomplete. Chris Hart, the former chairman of the National Transportation Safety Board, is leading a task force reviewing how the Max was certified. Credit Cliff Owen/Associated Press The group, known as the Joint Authorities Technical Review, is led by Chris Hart, the former chairman of the National Transportation Safety Board, and includes representatives from NASA, the F.A.A. and international regulators. The report is expected to include about a dozen recommendations, with a focus on improving transparency in the certification process. Frustration with Boeing is mounting on Capitol Hill. Representative Peter DeFazio, a Democrat from Oregon, said in an interview that he invited Boeing to testify at a House hearing, but the company declined. “Next time, it won’t just be an invitation, if necessary,” Mr. DeFazio said. Congressional investigators are combing through tens of thousands of internal Boeing documents, looking for potential flaws in the Max’s development and certification. “We’ve got massive amounts of documents from Boeing,” Mr. DeFazio said. “But they have otherwise been not particularly cooperative.” The F.A.A. and international regulators are similarly frustrated with Boeing, a sentiment that became apparent at a meeting last month. In August, Boeing met with officials from the F.A.A. and other global aviation agencies to brief them on its efforts to complete fixes on the Max. Regulators asked detailed questions about adjustments to the Max’s flight control computers, which the Boeing representatives there were not prepared to answer. Instead, the company representatives began to display a PowerPoint presentation on their efforts, according to people briefed on the meeting who spoke on the condition of anonymity because it was not public. At that point, the regulators ended the meeting. Weeks later, Boeing has still not answered all their questions. A version of this article appears in print on Sept. 15, 2019, Section B, Page 1 of the New York edition with the headline: Boeing Panel Is Set to Call For Reforms In Procedure. Order Reprints | Today’s Paper | Subscribe

http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf

Former Boeing official subpoenaed in 737 MAX probe won’t turn over documents, citing Fifth Amendment protection Sep. 6, 2019 at 7:01 pm Updated Sep. 7, 2019 at 8:37 am By Steve Miletich Seattle Times staff reporter A former Boeing official who played a key role in the development of the 737 MAX has refused to provide documents sought by federal prosecutors investigating two fatal crashes of the jetliner, citing his Fifth Amendment right against self-incrimination, according to a person familiar with the matter. Mark Forkner, Boeing’s chief technical pilot on the MAX project, invoked the privilege in response to a grand jury subpoena issued by U.S. Justice Department prosecutors looking into the design and certification of the plane, the person said. Invoking the Fifth to avoid testifying, while a legal right, is sometimes interpreted as an admission of guilt. Its use to resist a subpoena for documents is less common and may only imply a dance between prosecutors and defense attorneys, legal experts say. Forkner, now a first officer for Southwest Airlines, referred questions to his attorney when reached by phone. His attorney, David Gerger, of Houston, did not respond to inquiries. Justice Department spokesman Peter Carr declined to comment. Boeing also declined to comment. Prosecutors in the Justice Department’s Washington, D.C., fraud section are conducting a wide-ranging investigation into the crashes that occurred Oct. 29 off Indonesia, and March 10 in Ethiopia, killing 346 people and leading to worldwide grounding of the plane. Their investigation includes the role of a new flight-safety control system called the Maneuvering Characteristics Augmentation System (MCAS), which has been implicated in the crashes. Forkner, who worked at Boeing from 2011 to 2018, according to his LinkedIn profile, was frequently anxious about the deadlines and pressures faced in the MAX program, going to some of his peers in the piloting world for help, a person who worked on the project previously told The Seattle Times, speaking on condition of anonymity. The MCAS system, designed to move a powerful control surface at the tail to push the airplane’s nose down in certain rare situations, played a critical role in the crashes when the planes nose-dived out of the sky. During the certification process, Forkner suggested to the Federal Aviation Administration (FAA) that MCAS not be included in the pilot manual, according to previous Seattle Times reporting. The FAA, after internal deliberations, agreed to keep MCAS out of the manual, reasoning that MCAS was software that operates in the background as part of the flight-control system, according to an official familiar with the discussions. In addition, Boeing won the FAA’s approval to give pilots just an hour of training through an iPad about the differences between the MAX and the previous 737 generation. MCAS was not mentioned. Boeing has said MCAS was only one link in a chain of events, and that MCAS was designed according to the standard procedures it has used for years. “The 737 MAX was certified in accordance with the identical FAA requirements and processes that have governed certification of previous new airplanes and derivatives,” the company said in a previous statement. Gerger, in an earlier interview, said, “Mark never dreamed anything like this could happen. He put safety first.” It isn’t clear when Forkner received the subpoena or if the Justice Department, as part of the secret grand jury proceedings, has asked a judge to compel disclosure of the documents. Also unknown is whether Forkner and the Justice Department have discussed terms under which he might surrender the documents, and whether subpoenas have been issued to other individuals for records. While the Fifth Amendment protects people from testifying against themselves, it “usually does not apply to being required to produce documents because producing a document is not the same as being required to testify,” said University of Washington law professor Jeffrey Feldman. But there are exceptions that allow the privilege to be asserted where “the mere act of producing the document” may be seen as an incriminating act, Feldman said. Paul Rothstein, a Georgetown University law professor, said documents may show a person “has them, knows about them or admits they exist.” “This information can often be somewhat incriminating of that person and thus covered by his Fifth Amendment privilege against self-incrimination,” Rothstein said. Some courts have held that broad document requests require the person to “use his or her mental processes to interpret and respond to the subpoena, and the production itself could be viewed as testimonial,” said Peter Joy, a Washington University law professor. In Forkner’s case, Feldman said, it could turn on the type of documents. “Are these the employee’s personal documents? His diary or personal emails? Or are they Boeing’s documents?” Forkner could ask for immunity from use of the information in the documents, or prosecutors could offer it, the experts said. “Such immunity means the revealed information cannot be used in any way in any investigation of him or any criminal prosecution of him,” Rothstein said, noting that it is not a blanket immunity from investigation or prosecution based on evidence obtained elsewhere. It is “just an immunity from use of this particular evidence or information,” he said. But prosecutors can independently seek other evidence, Feldman said. He said if there is a plausible assertion of the privilege, it would “not be unusual to see the government offer” of immunity. “It could just be the kind of waltz you often see in cases like this, by which individuals who are concerned that they may get swept up in a criminal matter try and obtain some protection and assurances to lower their risk,” Feldman said. “Or it could be much more significant both for the individual or the company.”

EASA: FAA ‘Methodologies Need To Be Changed’ Sep 3, 2019 Jens Flottau | Aviation Daily EASA executive director Patrick Ky FRANKFURT—EASA executive director Patrick Ky said there is “still a lot of work to be performed” before Europe’s aviation safety authority will allow the Boeing 737 MAX to return to flight and criticized the way the FAA has allowed Boeing to “auto-certify” the aircraft. Ky told the European Parliament’s transport committee Sept. 3 that EASA has decided to recertify parts of the MAX’s flight control systems itself, oversight of which had been transferred to the FAA previously. “A lot of work is being done,” Ky said. EASA has been in close coordination with Boeing and the FAA for months. At this point the European agency is “happy” with some aspects of Boeing’s answers to its requests while there are others that “we need to discuss some more” and some issues still require more work. In particular, EASA wants to perform an in-depth human factor evaluation of the MAX systems, the updated maneuvering characteristics augmentation system (MCAS), cockpit alarms and functionality before it allows to the aircraft to fly in European airspace again. Once those checks are completed, EASA pilots will also test-fly the MAX to validate the MCAS changes. EASA pilots have participated in simulator sessions but the flight tests still need to me made. Ky said it was “impossible” to give a time line for the return to service. “In theory, we could have different training requirements [than the FAA], although that “would not make sense” from a global point of view. He stressed that Europe needs to have “a coordinated approach” to recertifying the MAX. In March, several EU member states proactively grounded the MAX individually before EASA followed. To Ky, the FAA “is in a very difficult situation” as a result of the MAX crisis and allegations that its oversight of Boeing was insufficient. “Authorities will want a second opinion. That is a strong change to just one year ago.” The EASA executive director made clear that he shares the criticism of FAA, at least in parts. “Authorities are critical of delegation [of certification] from FAA to Boeing,” he said. This was the case particularly with MCAS, which “has been auto-certified by Boeing,” Ky said. “I have a lot of respect for my counterparts in the FAA, they have strong ethics, but their methodologies need to be changed,” he added. In Ky’s view, the kind of outsourcing to industry seen in the MCAS case “would not happen in our system. We have a very structured way of delegating. We can’t check every line of computer software, that is simply impossible. But everything that is safety critical has to be seen by us.” He believes that “our approach works quite well.” EASA has delegated a team of 20 experts including engineers, flight test engineers and flight test pilots to deal with MAX. The agency has come up with four conditions that have to be met before the MAX can fly again in Europe. Primarily, all modifications must be approved by EASA itself. Additionally, EASA demanded a “broader review of the design of safety critical systems” of the MAX which had previously been performed by the FAA. “That was not very popular with our American colleagues,” Ky hinted. EASA also wants a “complete understanding” of the Lion Air and Ethiopian Airlines accidents both from a technical and operational point-of-view. Finally, the agency wants to ensure that flight crews are adequately trained.

hi moeman; Boeing is between a big rock and a very hard place. May as well return to the -800 and give up the fuel savings which was the MAX's largest selling point. Technically, the wing design & structure & pylon structure as well as ancilliary systems (controls/indicators) and documentation plus a new certification would likely present severe impediments to any such change. The problem now is, under microscopic scrutiny, the close examination of the B737 is showing that things that were accepted as 'done to standard' by Boeing and the FAA previously, are now found wanting. Problems are being discovered which were initially passed by Boeing which itself was appointed by the FAA to act as its own "safety auditor". A couple of examples: we haven't seen anything further on whether the trim wheel can be operated manually at high speed - that could possibly affect the certification of the single type, (all B737s). I've also read that the FAA is now examining the MAX's raised engine position with a view to disc-failure damaging the opposite engine while possibly taking out the rudder control cables if the disc-shraphnel passed through the lower fuselage. Such design is reminiscient of the DC10 center-engine disc-failure taking out all four hydraulic systems in the United 232 Sioux City crash, so the concern is real, (if unexamined, that is until now). A more complete story from the NYTimes is on the other thread.

Boeing reports its worst ever financial losses as 737 Max crisis continues Add to list The fuselage of a Boeing 737 Max aircraft is seen parked at the Boeing facility in Renton, Wash., on July 1. (Lindsey Wasson/Reuters) By Aaron Gregg July 24 at 2:59 PM Software problems that played a role in two deadly plane crashes involving Boeing’s new 737 Max commercial jetliners are proving to be financially calamitous for the Chicago-based aerospace giant, which reported its largest-ever quarterly loss Wednesday. Boeing lost $3.38 billion for the quarter on $15.7 billion revenue, sending its stock down close to 3 percent by early afternoon. Executives said the company may have to temporarily shut down its 737 Max production, an extraordinary step that would send ripple effects throughout the global aerospace industry. The company already slowed the production rate. Boeing faces a crisis with no end in sight, as its once-promising 737 Max commercial jetliner has been grounded for well over four months. “This is a defining moment for Boeing, and we’re committed to coming through this challenging time better and stronger as a company,” Chief Executive Dennis Muilenburg said in a call with investors. [Boeing 737 crash families make emotional plea to lawmakers: Hold Boeing accountable] The company is working to fix a host of technical problems related to the plane’s flight control systems, and executives have estimated the planes will be deemed flight worthy early in the fourth quarter of 2019, noting regulators control the timing. But regulators have provided no firm timeline for when they will allow the planes to fly again, and Boeing executives emphasized the timeline could slip further depending on regulators’ decisions. Airlines are assuming the crisis will continue late into the fall, canceling hundreds of flights every day. The 737 Max is the newest version of Boeing’s best-selling commercial jet. It was pitched as an even more reliable version of a long-trusted plane, complete with engine updates that made the plane more fuel efficient. However, the company added a new flight control system called the Maneuvering Characteristics Augmentation System, or MCAS. That system was designed to make the plane behave as similarly as possible to past models, with minimal new training for pilots. It was later discovered that the system can override pilots’ manual controls in certain rare but dangerous situations, pushing the plane into a nosedive. These problems played a role in the October 2018 crash of a 737 Max 8 that killed 189 people in Indonesia, according to investigation reports and Boeing executives. Then, in early March, another Max 8 crashed under similar circumstances, killing 157 people. The Federal Aviation Administration ordered that the planes be grounded soon after the second crash. It initially mandated a set of fixes “no later than April,” but the timeline slipped as Boeing and the FAA discovered more problems with the plane’s flight control software. [Long before the Max disasters. Boeing had a history of failing to fix safety problems] In the meantime, the financial impacts are mounting for Boeing and its airline customers. Executives said Wednesday they could not estimate how much the crisis would affect the company’s earnings for the year. Last week the company reported a $5.6 billion charge needed to compensate 737 Max customers. It faces lawsuits from family members of the 346 people who died in Indonesia and Ethiopia aboard the doomed flights, as well as continued scrutiny from Congress. Teal Group aerospace analyst Richard Aboulafia said Boeing is doing “a decent job” managing the financial fallout of the Max crisis given the tremendous uncertainties at play. “It’s unclear how much guidance they can offer given how much is out of their control,” Aboulafia said. “[Boeing’s] track record has been that they will say one thing, and then news is broken elsewhere ... from an airline or the FAA." Issues with the 737 Max overshadowed what was an otherwise successful quarter for Boeing’s other business units. The company’s defense, space and security division saw a 159 percent percent jump in quarterly earnings over the previous year, and the company’s new global services unit continued to grow.

https://www.theguardian.com/us-news/video/2019/apr/14/worlds-largest-aircraft-takes-off-and-successfully-lands-video A manned giant six-engine aircraft with the world’s longest wingspan – surpassing Howard Hughes’s infamous Spruce Goose – took off from California on its first flight on Saturday. The twin-fuselage Stratolaunch jet lifted off from Mojave air and space port and climbed into the desert sky 70 miles north of Los Angeles. It successfully landed two hours later. The aircraft is designed to carry as many as three satellite-laden rockets under the centre of its enormous wing, which stretches 385ft, or 117 metres.

...Oh yes, I know...that last foot and the sudden stop after the last foot. DC9-15 onto YSB30...I recall the captain saying it was the first time he'd seen the dust rise at the other end of the runway...

On the FAA's minimum time, I always thought that that was using a sledge hammer to kill a gnat. There's much more to "pilot" than what "1500hrs" can do. I know guys who started flying transports at ~300hrs. They had the ability to think, take constructive criticism from experts, (now called "mentors" or "coaches" for heavens sake), and a solid understanding that aviation is dangerous because it involves high speed and being very high off the ground!

From AW&ST, (where it occurs in the article itself, any bolding is mine, for emphasis)

Hi longtimer; I agree with you - the industry will deal with such shortages as they deal with weather - triage the problems and target the resources to profitable routes; use de-regulation for what it was intended. Aviation is an odd duck - people tolerate a $5 coffee and waiting interminably at Tim's but find an air carrier's $20 price gap and a mechanical or weather delay less acceptable. Odd. One effect of being solidly "bricks-and-mortar" so to speak, is not being light on one's feet. The industry by nature is physical, technical, political, financial and economic "inertia" defined. It just takes a long time to do anything, whether it is getting to the gate in bad weather, planning for seat capacity for 2025 or attracting and then keeping suitable candidates to fly their aircraft. Target has recently discovered that P.O.'d customers make an immediate difference in both public perception and the bottom line by just walking "next door". One can't necessarily do that with air carriers, partly because of the inertia described above and partly because with airlines, I think there is more latitude built into the system and customers have, very grudgingly over the years of getting accustomed to thin staffing and thinner resources, given large benefit of the doubt that other businesses might envy.

My impression is yes, it is more likely that there is some correlation.

Wow, thanks very much longtimer! I'll give it a similar read this week.

Hi Longtimer - good question and one well worth investigating on a number of levels. I wonder if there are formal studies around and if so, by whom? These days universities are rarely as academically independent as they may claim and we're not going to find unadorned answers from either the Cato Institute, the Fraser Institute or the Canadian Centre for Policy Alternatives. Is the word, "shortage" a negotiating word or an assessment or a bit of both? We could say, as has a recently-pointed-out article, that "miserly" airlines have done this to themselves. They have, but that's not a complete answer from which effective responses could be made. As we have heard, is the "shortage" possibly the result of the levels of retiring pilots in an industry that is otherwise matched more or less to demand? Not so in China I realize, given the stories of growth there, but I'm thinking mainly of the US and far less so, Canada. On the other hand we could indeed wonder about reducing the supply of scheduled flights but in a de-regulated industry how would that be done and by whom or what agency? Isn't de-regulatiion supposed to look after supply according to "invisible hand" of the free market? In a free market, an airline is supposedly free to give up unprofitable routes yet as those changes do occur, here we are. Another word for "shortage" is "market demand". Such familiar forces can either emerge or be manufactured as anyone who deals in the stock market will understand. In any system in which there are forces and reactions, is demand for services sufficient to sustain actual service levels or increase growth from which the forces of demand emerge to grow say, pilot supply? I think the industry could shrink-fit itself to match anticipated pilot supply without material effects to service levels, and I only say that because both "convenience" and "inconvenience" are always and already present in our system and the public mentality quite readily accepts "the trade". If the shortage is real, as a result of current and predicted demand as well as retirements, reducing schedule would not solve the problem as demand would theoretically grow the industry past current excess.