Sertifiseringsprosessen hadde grunnleggende svakheter - AVweb

MCAS Certification Flawed: Report   Russ Niles     The Maneuvering Characteristics Augmentation (MCAS) system at the center of investigations into two fatal crashes of the Boeing 737 MAX 8 was misunderstood and mischaracterized in a flawed certification process as Boeing and the FAA rushed to bring the new jet to market, a Seattle Times investigation published Sunday alleges. Citing named and unnamed sources, the Times’ Dominic Gates says the final certification of the system, which was intended to give pilots a control feel on the aerodynamically different MAX similar to that of previous iterations of the 737, not only gave “unlimited authority” to the stabilizer for nose-down trim, it literally fought the pilots’ attempts to correct the condition possibly to the point where they were physically unable to fight the stabilizer down force any longer. “It had full authority to move the stabilizer the full amount,” Peter Lemme, former Boeing flight controls engineer, told the Times. “There was no need for that. Nobody should have agreed to giving it unlimited authority.” The Times story said the profound ability of the system to take over a key flight control action should have resulted in close scrutiny in the certification process. But the original specifications of the system called for MCAS to limit its ability to move the horizontal stabilizer .6 degrees at a time. By the time deliveries began, it could pitch the stabilizer 2.5 degrees, about half its total travel, in one movement, the result of flight testing tweaks aimed at finessing the flight control feel. The system would also pivot the stabilizer that much repeatedly as long as data inputs indicated the aircraft was about to stall, regardless of the pilots’ strenuous efforts to overpower the system. In the October Lion Air crash, which killed 189 people, the flight data recorder counted the captain countering the system 21 times with the first officer taking over for few tries before the captain’s final futile efforts to arrest a 500-MPH dive. The data indicated the nose-down yoke forces peaked at a little more than 100 pounds. The newspaper’s investigation said that engineers involved in the safety assessment of MCAS were not aware the system could move the tail five times more than the original specs called for. The certification documents should have been amended to reflect the final configuration but they apparently were not, according to the Times report. If they had been, the seriousness of a potential failure of the system would have required it to receive data from at least two sources. MCAS gets data from only one of two angle of attack indicators on the MAX and the flight data recorder on the Lion Air airplane showed the AOA feeding MCAS was malfunctioning. “A hazardous failure mode depending on a single sensor, I don’t think passes muster,” said Lemme. The newspaper is reporting that Boeing’s software fix will wire MCAS to both AOAs and only allow the system to move the tail feathers once, instead of repeatedly battling manual control inputs. It will also require additional pilot training and operating manual changes, both of which were called for by pilots unions following the Lion Air crash. Boeing’s position, endorsed by the FAA, has been that because MCAS is only supposed to trigger in extreme circumstances—high angles of attack and accelerated stalls—that additional pilot training was not necessary. The company has also said that it assumed that based on their existing training on earlier models pilots would recognize the erroneous nose-down commands and hit cutoff switches that would disable the system. This is a standard runaway trim scenario for all aircraft. “The assumptions in here are incorrect. The human factors were not properly evaluated,” the Times quoted an unnamed FAA safety engineer as saying. The story also suggests that due to budget cuts the FAA’s certification managers were under increasing pressure to delegate more and more of the safety assessments to Boeing itself. The unprecedented levels of self-certification in the MAX were compounded by the urgency to get the airplane into service because of competitive pressure from Airbus’s new A320neo series. “There wasn’t a complete and proper review of the documents,” the former FAA engineer is quoted as saying. “Review was rushed to reach certain certification dates.”