Tuesday, December 1, 2020

737 MAX Ungrounding

My post 737 MAX: The Case Against Boeing is a year old and has accumulated 58 updates in comments. Now the aircraft is returning to service, it is time for a new post. Below the fold, Bjorn Fehrm has two interesting posts about the ungrounding.

In the first, Boeing 737 MAX changes beyond MCAS, Fehrm lays out the cascade of warnings that resulted from a single angle-of-attack sensor failure:
As FAA and Boeing played through what happened in the MAX crashes in Boeing’s engineering simulators, the cascading alerts triggered by a faulty single Angle of Attack (AoA) sensor stood out:
  • Stick shaker went on on the affected side from rotation and stayed on all the time, despite the aircraft flying with the correct speed and not being close to stall.
  • IAS (airspeed) UNRELIABLE alert triggered
  • ALT (altitude) UNRELIABLE alert triggered
  • AOA (Angle of Attack) UNRELIABLE should have shown but didn’t because of a bug in MAX’s software that tied it to the optional display of AoA on the Pilot’s Primary Flight Display (PFD, the Pilot’s electronic horizon display).
  • The speed tapes on the Pilot’s Primary Flight Display behaved strangely, showing too low speed and high speed concurrently in the ET302 case.
Several trim related failures in such an environment relied on the Pilots identifying the trim misbehavior within four seconds. When flight crews from different airlines were flying these scenarios, it became clear such assumptions were unrealistic.
This is an example of the hand-off problem that is inherent in sophisticated automation (see First We Change How People Behave and the numerous comments). Clearly, giving even expert pilots only 4 seconds to comprehend and react to this confusing rush of warnings would have been unrealistic, even if the pilots had been informed about and trained on the MCAS system that was causing them, which they weren't.

In the second, Fehrm points out an interesting difference between the FAA's and the EASA's requirements for re-certifying the 737 MAX in 737 MAX ungrounding, ANAC’s and EASA’s decisions:
The other condition has its root in the disconnection of Speed Trim, MCAS, Autopilot, and Flight Directors should the two Angle of Attack systems disagree. EASA will temporarily revoke the 737 MAX certification for Required Navigation Performance – Authorization Required (RNP AR) approaches.
...
Should the AoA monitor trip, Speed Trim, MCAS, and more importantly, Autopilot and Flight Directors disconnect, it puts a crew in a very tight spot as the difficulty of such approaches are high (they require special crew training and certification). You need all the tools you have in such approaches and don’t want a sudden disconnect of the Autopilot and Flight Directors combined with Speed Trim warning, followed by AOA, IAS and ALT DISAGREE.

The revoke of the RPN AR approach certification is temporary. One can guess it will be allowed again once a synthetic third AoA sensor is introduced to the MAX. It creates a voting “two versus one” situation when one of the sensors presents suspicious values. It would then result in an AOA DISAGREE warning, but the Autopilot and Flight directors would stay on and IAS and ALT would still get the required AoA corrections. The AOA DISAGREE is then an indication for required maintenance rather than a major system hiccup.
Duplicating systems is never a good approach to fault tolerance, they must be triplicated. In the 70s BA used Tridents on the Edinburgh to London shuttle. Their autoland systems were triplcated, and certified for zero-visibility landing. I experienced my first go-round when, on my way from Edinburgh to Miami for a conference, the approach to LHR in heavy cloud was interrupted by the engines spooling up and an abrupt climb. The captain calmly announced that one of the autopilots disagreed with the other two and, as a precaution, we were going around for another try. On the second approach there was no disagreement. We eventually landed in fog so thick I couldn't see the wingtips. Only the Tridents were landing, nothing was taking off. My Miami flight was delayed and after about 10 hours I was re-routed via LGA.

4 comments:

David. said...

Lori Aratani and Ian Duncan report that Boeing ‘inappropriately coached’ FAA test pilots during review of 737 MAX after deadly crashes, Senate investigators say:

"Senate investigators concluded that Boeing “inappropriately coached” Federal Aviation Administration’s (FAA) pilots for a simulator test last year conducted during the effort to test and recertify the company’s 737 MAX as safe to fly again after two deadly crashes.

The conclusion is contained in a report issued Friday by the Republican majority in the Senate Commerce Committee on an investigation that was launched after the two MAX crashes but that ultimately broadened to unearth numerous safety problems across the FAA.
...
The FAA inspector alleged the Boeing official told the pilots, “Remember, get right on that pickle switch” — meaning an electrical thumb switch on the control column used to pitch up the jet’s nose."

David. said...

Bryan Corliss' Boeing should build 757 replacement in Washington looks ahead to the next big mistake Boeing is going to make:

"Washington, by every relevant objective measure The Teal Group could think of, is categorically the best place for Boeing to keep its commercial operations. And Washington, by every subjective measure that Boeing uses, is absolutely a terrible place for Chicago to run its business the way it wants.

Since the 1997 McDonnell Douglas merger, Boeing adopted the Jack Welch/GE management model. Former CEO Harry Stonecipher was a Welch acolyte. So was his successor, Jim McNerney. Current CEO David Calhoun spent 26 years at GE, sitting on that company’s board of directors for eight years and rising to the rank of vice chairman.

The GE model is based on a foundation of ruthless competition, among suppliers, among employees and among communities where a company bases its business units. Welch famously once said his dream would be to put factories “on a barge” where he could move them – or threaten to move them – to lower cost sites that are “more competitive.”

That business culture clashes severely with the traditional Seattle culture, which is heavily, maybe obsessively, based on consensus building and “win-win” solutions. It also views unions favorably."

Boeing is very late responding to the A321 Neo. Moving the headquarters to Chicago and the 787 to Charleston have proven to be disasters:

"With the benefit of 20/20 hindsight, we can see that the road to where we are today was paved the day in June 2005 when the Boeing board chose McNerney to be CEO, thus embracing the ethos of ruthless competition and rejecting Alan Mulally’s brand of “Working Together” leadership. Mulally went on to guide Ford through one of the greatest crises of its history; McNerney’s tenure led Boeing to … this, a situation so bad they’ve sold off the corporate yacht."

David. said...

Dominic Rushe reports that US fines Boeing $2.5bn following fraud charges tied to 737 Max crashes:

"Boeing has been fined $2.5bn by the US justice department after being charged with fraud and conspiracy in connection with the fatal crashes of its 737 Max airliner.

The Max was grounded worldwide in March 2019 after crashes in Indonesia and Ethiopia that killed 346 people. A March 2020 congressional concluded that Boeing promoted a “culture of concealment” and was “grossly inefficient” in its oversight of the Max’s development.

“The tragic crashes of Lion Air Flight 610 and Ethiopian Airlines Flight 302 exposed fraudulent and deceptive conduct by employees of one of the world’s leading commercial airplane manufacturers,” acting assistant attorney general David Burns of the justice department’s criminal division wrote in a release."

David. said...

It turns out that the headline Boeing to pay $2.5 billion to settle fraud charges tied to 737 MAX crashes
is misleading, and this is actually the usual "cost-of-doing-business" settlement:

"Boeing has agreed to pay just over $2.5 billion to resolve a federal charge of “criminal misconduct” for how its employees misled regulatory officials during certification of the 737 MAX, the Department of Justice announced Thursday.

Of that amount, only $243.6 million, less than 10%, is a fine paid to the U.S. government for the criminal conduct, “which reflects a fine at the low end” of the sentencing guidelines, the court agreement states.

The rest includes an additional $500 million Boeing commits to pay in compensation to the families of the 346 people who died in two crashes of the MAX.

However, 70% of the $2.5 billion cited in the settlement, or $1.77 billion, is compensation to Boeing’s airline customers that the company has already agreed to pay. (Indeed, that’s just a fraction of what it has agreed to pay them.)"