Due to time constraints, I’m going to deal with the current state of Boeing’s woes in broader strokes than usual, and I hope readers will chime in with details, calibration, and any quibbles or corrections.
The latest stories are not pretty:
Boeing new sales have collapsed. However, no one has cancelled orders but new orders have stalled. From CNN:
Boeing had no new orders for planes in April.
Not only did the troubled 737 Max receive zero new orders since it was grounded March 13. Boeing’s other jets, such as the 787 Dreamliner or the 777, also did not get any new orders last month, according to a company report released Tuesday….
None of Boeing’s other jet models have crashed, and airlines have not reported any safety problems other than the 737 Max. But the 737 Max’s problems could be the reason airlines put orders for the other jets on hold, said Philip Baggaley, the lead credit analyst for the transportation sector for Standard & Poor’s.
Airlines are holding out to determine whether Boeing will lower its prices in light of the Max issues, Baggaley believes.
“If it turns out that Boeing makes some accommodations with customers over the grounding of the 737 Max, it probably won’t be a straight cash compensation,” said Bagggaley. “It might be a lower price on future orders, or some other change in those orders. There could be things going on behind the scenes that could essentially turn into orders.”
Pilots pressed Boeing unsuccessfully for safety fixes right after the Lion Air crash and were rebuffed. The New York Times and CBS News obtained a copy of a recording of a November 22 meeting between representatives of the American Airlines pilots’ union and Boeing. From CBS:
Frustration boiled over during the tense meeting in November 2018, less than a month after the first Max crashed, and four months before the second crash.
“We flat out deserve to know what is on our airplanes,” one pilot is heard saying.
“I don’t disagree,” the official said…
The pilots at the meeting were angry that system was not disclosed to them until after the first crash.
“These guys didn’t even know the damn system was on the airplane — nor did anybody else,” one pilot said.
Boeing vice president Mike Sinnett, who does not appear to know he was being recorded, claimed what happened to Lion Air was once-in-a-lifetime type scenario….
The pilots in the room were not satisfied with that answer. “We’re the last line of defense to being in that smoking hole. And we need the knowledge,” one pilot said.
FAA didn’t question Boeing misrepresentation of not identifying MCAS as capable of producing a catastrophic failure. We’ll say more about this issue later in the post. The Wall Street Journal may be correctly anticipating the spin that Boeing may be able to pass off, that the FAA failed to have senior officials review MCAS, as opposed to (as the article clearly states, but further down) that Boeing didn’t identify MCAS as a critical system. Remember, as we described in an earlier post, how the FAA had changed in 2004 changed its review system . Before, the agency representatives at manufacturers were manufacturer employees but reported to the FAA. After 2004, the FAA designees reported to the aircraft makers, and for the most part, only more senior managers dealt with the regulator. This was a system rife for abuse, yet it appears that the safety culture in the industry is so strong that only Boeing abused it.
The [internal investigation] results, these officials said, also indicate that during the FAA certification process for the 737 MAX, Boeing didn’t flag the automated stall-prevention feature as a system whose malfunction or failure could cause a catastrophic event. Such a designation would have led to more intense scrutiny.
FAA engineers and midlevel managers deferred to Boeing’s early safety classification, the inquiry determined, allowing company experts to conduct subsequent analyses of potential hazards with limited agency oversight. Boeing employees who served as designated agency representatives signed off on the final design…
Was MCAS sure to crash planes when triggered by false readings? A self-proclaimed “737 Pilot” in comments as well as a known commercial pilot, Jeremy Grimm, have both contended that the Lion Air and Ethiopian Air crashes were due to the pilots being insufficiently experienced. “737 Pilot” argued that if the pilots had followed standard procedures, they would have used “trim stab” and been able to regain control of the plane. An Australian 60 Minutes show, prominently features an actual 737 pilot in flight simulator who contends the reverse. Moreover, if I interpret it correctly, a new story in the Seattle Times further calls into question whether the pilots could have regained control.
Australia’s 60 Minutes documentary did a better job of identifying and presenting a key MCAS flaw than the rest of the press. See the segments starting at the very beginning and at 21:35, of a 737 pilot replicating the Lion Air and Ethiopian Air crashes. Please do watch these two short segments. There’s no substitute:
The critical part, which I haven’t seen in any of the 737 Max stories I have read (but Lambert says has been in some of the ones he has seen, but the implications appear not to have been understood by the reporters) is that MCAS would turn on for ten seconds to push the nose of the plane down, which in the Lion Air crashes, put the nose at 40 degrees, and do this repeatedly. This is the key bit:
The Ethiopian pilots would have been trying to follow Boeing’s checklist. But what the pilots didn’t know was that the MCAS system will repeatedly turn on and off. It means they have only five seconds of control before MCAS overrides the plane, forcing it to nosedive.
So work that out. MCAS goes on for ten seconds. The pilots have only five seconds to try to pull the plane back up. Then MCAS kicks in for ten seconds again, shoving the nose into a steep dive again. This is guaranteed to eventually run the plane into the ground (or ocean). It is impossible in five seconds for the pilots to recover the loss of elevation that MCAS creates in ten second of initiating and keeping the plane in a dive.
Moreover, the press reported that the black box of the Ethiopian Air jet showed the pilots consulted the MCA manual, followed its instructions, yet even though they succeed in turning off MCAS, they were also unable to make the trim controls respond. Reader “737 Pilot” argues that all the pilots needed to do was rely on their training or a Quick Reference Card on the glasshield. The 737 pilot who simulated the crashes disagreed, showing where the relevant instructions were (in a paper manual).
The critics of the Ethiopian Air pilots argued that the plane was flying too fast; that’s why they couldn’t make the trim controls behave when they did turn off MCAS. The Seattle Times article is not crisply written but it indicates that Boeing had made yet another change to the 737 Max that it kept to itself: that it changed how a key “auto-diable” switch worked. If the Seattle Times has interpreted the manuals it received correctly, turning off MCAS didn’t just turn off the auto trim systems (for the aircraft tail); it also turned off the normal manual control for the trim, a thumb button. If this reading is correct, no wonder the Ethiopian Air pilots couldn’t control the trim. Their normal way for doing so had also been turned off.
In the middle of Boeing 737 cockpits, sitting between the pilot seats, are two toggle switches that can immediately shut off power to the systems that control the angle of the plane’s horizontal tail.
Those switches are critical in the event a malfunction causes movements that the pilots don’t want. And Boeing sees the toggles as a vital backstop to a new safety system on the 737 MAX – the Maneuvering Characteristics Augmentation System (MCAS) – which is suspected of repeatedly moving the horizontal tails on the Lion Air and Ethiopian Airlines flights that crashed and killed a total of 346 people.
But as Boeing was transitioning from its 737 NG model to the 737 MAX, the company altered the labeling and the purpose of those two switches. The functionality of the switches became more restrictive on the MAX than on previous models, closing out an option that could conceivably have helped the pilots in the Ethiopian Airlines flight regain control.
Boeing declined to detail the specific functionality of the two switches. But after obtaining and reviewing flight manual documents, The Seattle Times found that the left switch on the 737 NG model is capable of deactivating the buttons on the yoke that pilots regularly press with their thumb to control the horizontal stabilizer. The right switch on the 737 NG was labeled “AUTO PILOT” and is capable of deactivating just the automated controls of the stabilizer.
On the newer 737 MAX, according to documents reviewed by The Times, those two switches were changed to perform the same function – flipping either one of them would turn off all electric controls of the stabilizer. That means there is no longer an option to turn off automated functions – such as MCAS – without also turning off the thumb buttons the pilots would normally use to control the stabilizer.
Peter Lemme, a former Boeing flight-controls engineer who has been closely scrutinizing the MAX design and first raised questions about the switches on his blog, said he doesn’t understand why Boeing abandoned the old setup. He said if the company had maintained the switch design from the 737 NG, Boeing could have instructed pilots after the Lion Air crash last year to simply flip the “AUTO PILOT” switch to deactivate MCAS and continue flying with the normal trim buttons on the control wheel. He said that would have saved the Ethiopian Airlines plane and the 157 people on board.
Let’s take what we know already and what we think we know from the 60 Minutes and the Seattle Times story above:
Boeing used only one sensor rather than two to provide input into what was designed as a critical safety feature. That alone is a departure from long-standing industry practice
MCAS, rather than making a minimal or mild change, which would seem more appropriate given that the angle of attack sensor input was at much greater risk than usual of being wrong due to having only one reading, instead made an extremely aggressive correction
MCAS was insistent and allowed pilots only a short window in which to attempt to regain control before it would kick in again. The duration of the “on” versus “off” time would assure a crash unless the pilots could figure out how to disable MCAS and regain control of flight altitude
Boeing changed how the 737 Max switch that turned off automated functions worked. Not only would it kill MCAS, but it would also disable the thumb buttons that pilots used to control the “stabilizer” which they’d need to engage to pull out of an MCAS-induced dive
Boeing hid the above information from airlines, pilots, and regulators, and then tried to downplay its importance when it came out in bits and pieces
If these are all correct, Boeing should burn to the ground. Next best would be for its CEO Dennis Muilenburg to get the Jeff Skilling treatment.
But Boeing is a national champion, part of a duopoly, and otherwise too big to fail. However, if the outline above is more or less accurate, foreign regulators may feel they have no choice but to refuse to certify the 737 Max unless more than just the software is fixed, and that could keep the plane grounded for a very long time. I am not holding my breath that that will happen, but they appear to be the only channel for forcing real change on Boeing. Airlines face too many costs in “divorcing” Boeing, and there are very few passengers who even if they have resolved not to fly on a Max, could afford time and money-wise to refuse to fly if one were swapped in at the last minute. However, if you are really worried, you can fly Delta or other airlines that haven’t bought the Max.
The only upside to this sordid affair is that it shows why deregulation and self regulation are fatally bad ideas. But what a horrific way to do that.