MAX - FAA og Boeing får så hatten passer - Curt Lewis

Changes to Flight Software on 737 Max Escaped F.A.A. Scrutiny Boeing, which produces its 737 Max in Renton, Wash., decided to quadruple the degree to which an automated system would push down the nose of the plane. While it was designing its newest jet, Boeing decided to quadruple the power of an automated system that could push down the plane's nose - a movement that made it difficult for the pilots on two doomed flights to regain control. The company also expanded the use of the software to activate in more situations, as it did erroneously in the two deadly crashes involving the plane, the 737 Max, in recent months. None of those changes to the anti-stall system, known as MCAS, were fully examined by the Federal Aviation Administration. Although officials were aware of the changes, the modifications didn't require a new safety review, according to three people with knowledge of the process. It wasn't necessary under F.A.A. rules since the changes didn't affect what the agency considers an especially critical or risky phase of flight. A new review would have required F.A.A. officials to take a closer look at the system's effect on the overall safety of the plane, as well as to consider the potential consequences of a malfunction. Instead, the agency relied on an earlier assessment of the system, which was less powerful and activated in more limited circumstances. Ever since the crashes - in Indonesia last October and Ethiopia last month - investigators, prosecutors and lawmakers have scrutinized what went wrong, from the design and certification to the training and response. In both crashes, the authorities suspect that faulty sensor data triggered the anti-stall system, revealing a single point of failure on the plane. Pilots weren't informed about the system until after the Lion Air crash in Indonesia, and even then, Boeing didn't fully explain or understand the risks. The F.A.A. outsourced much of the certification to Boeing employees, creating a cozy relationship between the company and its regulator. But the omission by the F.A.A. exposes an embedded weakness in the approval process, providing new information about the failings that most likely contributed to the crashes in Indonesia and Ethiopia. The F.A.A. is supposed to be the gold standard in global aviation regulation, with the toughest and most stringent rules for certifying planes. But the miscalculation over MCAS undermines the government's oversight, raising further concerns about its ability to push back against the industry or root out design flaws. While it is unclear which officials were involved in the review of the anti-stall system, they followed a set of bureaucratic procedures, rather than taking a proactive approach. The result is that officials didn't fully understand the risks of the more robust anti-stall system, which could cause a crash in less than a minute. "The more we know, the more we realize what we don't know," said John Cox, an aviation safety consultant and former 737 pilot. The F.A.A. defended its certification process, saying it has consistently produced safe aircraft. An F.A.A. spokesman said agency employees collectively spent more than 110,000 hours reviewing the Max, including 297 test flights. The spokesman said F.A.A. employees were following agency rules when they didn't review the change. "The change to MCAS didn't trigger an additional safety assessment because it did not affect the most critical phase of flight, considered to be higher cruise speeds," an agency spokesman said. "At lower speeds, greater control movements are often necessary." A spokesman for Boeing said, "The F.A.A. considered the final configuration and operating parameters of MCAS during Max certification, and concluded that it met all certification and regulatory requirements." Some of the details of the evolving design of MCAS were earlier reported by The Seattle Times. MCAS was created to help make the 737 Max handle like its predecessors, part of Boeing's strategy to get the plane done more quickly and cheaply. The system was initially designed to engage only in rare circumstances, namely high-speed maneuvers, in order to make the plane handle more smoothly and predictably for pilots used to flying older 737s, according to two former Boeing employees who spoke on the condition of anonymity because of the open investigations. The Dangerous Flaws in Boeing's Automated System Here's why a system designed to stabilize the 737 Max may have caused two deadly crashes in five months. For those situations, MCAS was limited to moving the stabilizer - the part of the plane that changes the vertical direction of the jet - about 0.6 degrees in about 10 seconds. It was around that design stage that the F.A.A. reviewed the initial MCAS design. The planes hadn't yet gone through their first test flights. After the test flights began in early 2016, Boeing pilots found that just before a stall at various speeds, the Max handled less predictably than they wanted. So they suggested using MCAS for those scenarios, too, according to one former employee with direct knowledge of the conversations. But the system needed more power to work in a broader range of situations. At higher speeds, flight controls are more sensitive and less movement is needed to steer the plane. Consider the effect of turning a car's steering wheel at 70 miles an hour versus 30 miles an hour. To prevent stalls at lower speeds, Boeing engineers decided that MCAS needed to move the stabilizer faster and by a larger amount. So Boeing engineers quadrupled the amount it could move the stabilizer in one cycle, to 2.5 degrees in less than 10 seconds. "That's a huge difference," said Dennis Tajer, a spokesman for the American Airlines pilots' union who has flown 737s for a decade. "That's the difference between controlled flight or not." Speed was a defining characteristic for the F.A.A. The agency's rules require an additional review only if the changes affect how the plane operates in riskier phases of flight: at high speeds and altitudes. Because the changes to the anti-stall system affected how it operated at lower speeds and altitudes, F.A.A. employees didn't need to take a closer look at them. The overall system represented a major departure from Boeing's design philosophy. Boeing has traditionally favored giving pilots control over their planes, rather than automated flight systems. "In creating MCAS, they violated a longstanding principle at Boeing to always have pilots ultimately in control of the aircraft," said Chesley B. Sullenberger III, the retired pilot who landed a jet in the Hudson River. "In mitigating one risk, they created another, greater risk." The missed risks, by the F.A.A. and Boeing, flowed to other decisions. A deep explanation of the system wasn't included in the plane manual. The F.A.A. didn't require training on it. Even Boeing test pilots weren't fully briefed on MCAS. "Therein lies the issue with the design change: Those pitch rates were never articulated to us," said one test pilot, Matthew Menza. Mr. Menza said he looked at documentation he still had and did not see mention of the rate of movement on MCAS. "So they certainly didn't mention anything about pitch rates to us," he said, "and I certainly would've loved to have known." The system's increased power was also compounded by its design: The software engaged repeatedly if the sensor suggested it was necessary to avoid a stall. In the Lion Air crash, data showed that the pilots, who weren't aware of MCAS, fought for control of the plane, as it pushed the nose back down each time they pulled it up. Few truly understood just how powerful the system would prove. It wasn't fully disclosed until after the Lion Air disaster, killing all 189 people on board. On the Ethiopian Airlines flight, the pilots struggled to regain control after MCAS engaged at least three times. Last month, during flight simulations recreating the problems with the Lion Air flight, American pilots were surprised at how strong MCAS was. They essentially had less than 40 seconds to manually override a system malfunction before a crash. Updates to the software by Boeing, which the F.A.A. will have to approve, will address some of the concerns with the anti-stall system. The changes will limit the system to engaging just once in most cases. And they will prevent MCAS from pushing the plane's nose down more than a pilot could counteract by pulling up on the controls. Boeing had hoped to deliver the software fix to the F.A.A. by now but it was delayed by several weeks. As a result, the grounding of the jet is expected to drag on. Southwest Airlines and American Airlines have already canceled some flights through May.

Secretary Chao grilled on aviation safety oversight following Boeing 737 Max crashes "I'm not here to defend anybody," Chao said during a Capitol Hill hearing where concerns about jet certification and proposed FAA budget cuts were raised. Southwest Airlines Boeing 737 Max aircraft are parked at the Southern California Logistics Airport in Victorville, Calif., on March 28. (Mark Ralston/AFP/Getty Images) Transportation Secretary Elaine Chao was grilled at a budget hearing Wednesday on her oversight of aviation safety, as multiple inquiries continue into two crashes of Boeing 737 Max planes. Citing a Trump administration proposal last month to cut $9 million from the Federal Aviation Administration's aviation safety office and other reductions, Rep. David E. Price (D-N.C.) said the Transportation Department's budget request "doesn't reflect the rhetoric we hear from the department about taking a safety-first approach." Price, chairman of the Appropriations Subcommittee on Transportation, and Housing and Urban Development, and Related Agencies, also raised questions about the federal government's certification process for the 737 Max, which was involved in two crashes within five months - one in Indonesia and a second in Ethiopia - killing a total of 346 people. Those questions rest both with acting FAA administrator Daniel K. Elwell, and at Chao's level, Price said. After years of advocacy by Boeing and actions by Congress, the FAA has given the company a far-reaching role in overseeing its own compliance with federal safety standards. The certification system is known as the Organization Designation Authorization program, or ODA. Proponents of the system said that the FAA was understaffed and too slow to issue approvals, and argued that the ODA system tapped industry expertise in the highly technical realm. Critics inside and outside the FAA raised concerns about the dangers of eroding independent oversight. Chao said she had been anticipating questions on the delegation program and emphasized that "it's not a self-certification process." "This form of delegation has been part of the FAA since it was formed in 1958 and allows the FAA to focus on safety-critical issues," Chao told the panel. She noted that the FAA sets safety standards and "is involved when new, novel and high-risk design features are contemplated." "Having said all of that, we always need to improve," Chao added. "The FAA itself acknowledges that they need to improve. And we all have to learn." Chao said a special committee she set up to examine certification issues, and an audit by the Transportation Department's Office of Inspector General "will also address these questions." Price raised a broad range of questions about the program, saying, "No it's not self-certification.  It requires vigorous oversight. It requires discerning judgment about what's delegated and what isn't, what is done in house. "And it requires critical judgment about how this is working right now - and the extent to which aircraft are not being subject to the most thoroughgoing kind of examination, even when there are major new components in the planes," Price said. And beneath all of that, Price asked, "Are there potentials for conflicts of interest, with respect to industry's role here? Are there possibilities that employees will be subject to pressures in carrying out this role? Many, many questions, which are, I would suggest, at the administrator's level and at the secretary's level." Chao responded, "These questions have been discussed, and we obviously don't have answers. I think we need to see what exactly - and I'm not here to defend anybody, no - I'm concerned about safety. That is the number one concern that I have. We want to get to the - we want to get answers. We want to understand fully what happened, and how do we prevent it from happening again." In addition to investigators and auditors from the Office of Inspector General, the Justice Department's criminal division is looking into the Boeing 737 Max. The House Transportation Committee has launched an investigation, as has the Senate Committee on Commerce, Science and Transportation. The Commerce Committee said it has received information from whistleblowers raising questions about whether a "potential lack of training and certification" among inspectors "may have led to an improper evaluation" of an automated feature that investigators say was a factor in last month's crash in Ethiopia and the Oct. 29 crash in Indonesia. Among the issues is whether those inspectors participated in an FAA Flight Standardization Board that was set up "to develop minimum training recommendations" for the plane and whether a lack of training would have affected their analysis. "This raises the question of whether a specific reference to the MCAS system should have been included" in the board's report. MCAS is the acronym for an anti-stall feature known as the Maneuvering Characteristics Augmentation System. The multiple inquiries are seeking to determine how Boeing and the FAA came to certify the Max planes were safe, despite problems that have now been acknowledged about the aggressiveness of the MCAS system, which repeatedly pointed the nose of the planes down in the two crashes. Also at issue is whether Boeing and the FAA allowed training for pilots to fall short on 737 Max planes with the automated feature. Boeing is working on software fixes, and Rep. Peter A. DeFazio (D-Ore.), chairman of the House Transportation and Infrastructure Committee, has called on the FAA to bring in third-party experts to examine the changes and help provide confidence they will be good enough. To address such concerns, the FAA created an international technical review team chaired by former National Transportation Safety Board chairman Christopher Hart. NASA will take part. Representatives from civil aviation authorities in Ethiopia, Indonesia, the European Union, Brazil, Canada, China and Singapore have also been invited to participate. Chao said Elwell was in Singapore on Wednesday explaining the FAA's approach. He is at the World Civil Aviation Chief Executives Forum at the Singapore Aviation Academy. "We both invite and welcome scrutiny as a necessary element of continuous improvement. Our recent and planned outreach efforts are a demonstration of this commitment to enhance the safety of the flying public," an FAA spokesman said. Price also pushed Chao on why the FAA had been the last major civil aviation safety agency to ground the 737 Max aircraft. Chao noted that the FAA "is independent. It is a very technical organization. It's data-driven." Officials there did not believe they had the needed evidence until they saw new satellite data and learned of physical evidence found at the Ethiopian crash site, she said. "The more basic issue is, if we cannot specify how these planes were grounded - what were the reasons for grounding these 737 Max [planes]? - what would be the reason for un-grounding them?" Chao said. Chao's "special committee" looking into the certification of the 737 Max will be led, on an interim basis, by retired Air Force Gen. Darren W. McDew, former head of the U.S. Transportation Command, and Capt. Lee Moak, former president of the Air Line Pilots Association, according to the Department of Transportation. Chao did not address questions Wednesday from Price and Appropriations Committee Chairwoman Nita M. Lowey (D-N.Y.) about the proposed budget cuts to the FAA's Aviation Safety organization, which is responsible for the certification of aircraft and pilots and developing regulations, among other duties. A Transportation Department spokesman said that the 2020 budget proposal was drafted before the fiscal 2019 appropriations bill was enacted in February. The spokesman said the fiscal 2020 proposal represented an increase of more than $17 million from what was enacted for fiscal 2018. The budget for Aviation Safety, or AVS, was $1.310 billion in 2018; $1.337 billion in 2019; and $1.328 billion in the Trump administration's proposal for 2020. The office has responsibility over eight broad areas: flight safety standards and inspections; aircraft certification; accident investigation and prevention; air traffic safety oversight; rulemaking; aerospace medicine; unmanned aircraft systems integration; and a division that includes management support, planning and other services. Its approximately 7,200 employees certify planes, pilots, mechanics and others, conduct oversight over the aviation industry broadly, and set safety standards "for every product, person, and organization that manufactures and operates aircraft" in the United States, according to an administration budget document.