MAX oppdatering med fokus på Lion air rapporten - Curt Lewis

Boeing wrongly assumed pilots would quickly trim out MCAS Boeing incorrectly predicted the manner in which 737 Max pilots would respond to the activation of the Manoeuvring Characteristics Augmentation System, by assuming they would initially pull back on the control column and then trim out the force to maintain level flight. But the investigation into the Lion Air 737 Max accident last October has revealed that assumption that crews would immediately trim the aircraft were wrong. MCAS was designed to reduce nose-up attitude by automatically adjusting the horizontal stabiliser to reduce pitch. Activation of MCAS on the Lion Air jet - a result of the inaccurate angle-of-attack sensor readings - did lead the crews to respond initially by pulling on the control column, says Indonesian investigation authority KNKT. "However, they did not consistently trim out the resulting column forces as had been assumed," it states. "The Boeing assumption was different from the flight crew behaviour in responding to MCAS activation." Failure to re-trim the aircraft during a series of repeated MCAS activations would result in the stabiliser gradually shifting to its maximum deflection, with the crew attempting to keep the nose up with increasing force on the control column. When the 737 Max was being developed, simulator testing during functional hazard assessment "never considered" the scenario of repetitive MCAS activation incrementally driving the stabiliser to its maximum limit. Boeing had believed repetitive MCAS activations to be "no worse" than a single activation, because of its assumption that the pilots would trim out the forces each time, says the inquiry. It had also assumed that the crew would respond correctly, and within 3s. But an absence of this trimming would "escalate the flight crew workload", the inquiry states, and the effects of this failure to trim after each MCAS activation "should have been reconsidered". Boeing had reasoned that unintended stabiliser deflection, triggered by MCAS, could be addressed by the use of elevator alone - through the crew's pulling on the control column. But the Lion Air accident showed that, in an extreme case, repeated MCAS deflections without sufficient trim would result in a cumulative out-of-trim situation which "could not be countered" just with the elevator, says the inquiry. This scenario was "contrary to the Boeing assumption" during the airframer's functional hazard assessment process, it adds. "Any out-of-trim condition which is not properly corrected would lead the flight crew into a situation that makes it more difficult for them to maintain desired attitude of the aircraft," says the inquiry. "The flight crews in both the accident flight and the previous flight had difficulty maintaining flightpath during multiple MCAS activations." Boeing's functional hazard assessment played down the potential impact of unintended MCAS stabiliser deflection, classifying it as a 'major' failure condition rather than 'hazardous' or 'catastrophic' - which meant the company was not required to analyse this scenario more rigorously.

Design flaws, pilots faulted in fatal jet crash JAKARTA, Indonesia - Design flaws in Boeing's 737 Max jet, regulatory lapses, and false assumptions about pilots' responses to new systems combined to cause last year's fatal Lion Air crash, Indonesian investigators said Friday as their final report. The crash prompted Boeing to make changes to the 737 Max, the company said. Lion Air Flight 610 crashed into the Java Sea on Oct. 29 after taking off from Jakarta. All eight crew members and 181 passengers were killed. The crash was soon tied to a new automated feature that Boeing had included on the 737 Max, a new version of its popular jet with larger, more fuel-efficient engines. Investigators said the feature was mistakenly triggered by faulty information from an external sensor. Similar problems were blamed for the crash of an Ethiopian Airlines flight in March that killed 157 people. The Max has been grounded worldwide since that crash. Officials from Indonesia's transportation safety regulator said Friday that several factors worked together to doom the Lion Air jet. "These items were connected to each other. If one of them was not occurring on that day, the accident may not have happened," said Nurcahyo Utomo, an investigator at the National Transportation Safety Committee. Those factors included incorrect assumptions by Boeing about how pilots would respond to the new flight-control system, the Maneuvering Characteristics Augmentation System, or MCAS. Investigators said the MCAS design relied on a single sensor and was therefore vulnerable to errors. "One [angle of attack] affected the whole system," Mr. Nurcahyo said. A false reading on that sensor redirected the plane's nose down, leaving the crew unable to override autopilot commands. Other fatal mistakes included a lack of training for pilots in the new system, a lack of documentation about problems in previous Lion Air flights involving the same jet, and ineffective coordination between flight crews. Investigators said the plane should have been grounded after an earlier fault. The report offered stark new details about an external sensor involved in the crash, pointing at the role of a maintenance firm in Florida and oversight by U.S. regulators. A dirty angle-of-attack sensor was sent to a Miramar-based company, Xtra Aerospace, for maintenance in 2017. It was then sent back and installed on the left side of the Lion Air flight the day before it plunged into the Java Sea, the report said. Angle-of-attack sensors are supposed to give pilots, and airplane systems, reliable data to help understand how the aircraft's nose is pointed in relation to oncoming wind. But shortly after takeoff, the newly installed left sensor showed a reading that was different, by 21 degrees, from the one on the right. Investigators say that inaccurate reading caused Boeing's automated feature to mistakenly fire, again and again, before the plane crashed. The "sensor was most likely improperly calibrated at Xtra Aerospace," the Indonesian crash report said. The FAA said it issued an order revoking Xtra Aerospace's repair station certificate Friday, saying the firm had "failed to comply with requirements to repair only aircraft parts on its list of parts acceptable to the FAA that it was capable of repairing."

Safety Chain Failed Lion Air Flight, But Boeing MCAS Was Weakest Link Most aircraft accidents can be traced to a series of failures, small or large, which on their own might have amounted to nothing but combined result in disaster. While providing full details of the chain of events which led to the Lion Air JT610 tragedy, the report points to the weakest link being the Boeing 737 MAX MCAS. Indonesia's National Transportation Safety Committee (KNKT) investigator Nurcahyo Utomo If only The detailed final report published today by Indonesia's National Transportation Safety Committee (KNKT) reads like heartache. Investigators detail the last exchange between the captain reassuring the first officer, "it's ok," and the first officer repeating his warning that the plane was flying down, "fly up," while they continue to struggle against the MCAS system, having repeatedly failed to regain control of their aircraft without ever knowing their true position. Then the sound of a single chime of the interfone which flight attendants use to communicate with the flight deck and each other, before the final terrain and sink rate warnings. And then silence. Though the KNKT cautions that the report is merely a safety assessment and not intended to attribute blame, the details provided by investigators paint a picture of the tragedy of Lion Air Flight 610 as a chain of "if only" events. If only the Angle of Attack (AOA) sensor hadn't failed. If only the replacement sensor hadn't been erroneously calibrated with up to a 25º bias. If only Lion Air maintenance had properly documented the repeated failures reported by previous crew as a major fault with the aircraft, worthy of investigation, rather than returning the aircraft to service. If only the crew that successfully handled similar problems on the same aircraft just a day before had provided a more detailed incident report. If only the crew knew about MCAS. If only none of this had mattered because the MCAS worked as Boeing had assumed it would. MCAS and the Changed Product Rule Boeing wanted the 737 MAX to handle and operate similarly to previous generation 737s, to speed certification and avoid airlines having to put pilots through expensive simulator training, and that led it to create MCAS. As the accident report details, the Boeing 737-8 (MAX), was certified under the FAA's Changed Product Rule as a derivative of the 737-800, while introducing the CFM LEAP-1B engine with a larger fan diameter and redesigned engine nacelle compared to engines installed on the 737 Next Generation (NG) family. But the larger engines changed how the plane handled at elevated angles of attack. Boeing implemented aerodynamic changes as well as a stability augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an extension of the existing Speed Trim System (STS). Findings by the Joint Aviation (JATR) have previously suggested that this aircraft may have warranted an independent type certification process. The Lion Air crash report also points in this direction. MCAS caused pilot confusion The design of the MCAS was based on a series assumptions that did not prove to be complete or accurate. Crew were not initially made aware of its function and repeated activations of the MCAS made the aircraft's control column too heavy for pilots to handle. Boeing didn't test for the effect on pilots of repeated activations of MCAS. "During [functional hazard assessment], the simulator test had never considered a scenario in which the MCAS activation allowed the stabilizer movement to reach the maximum MCAS command limit of 2.5° of stabilizer movement. Therefore, their combined flight deck effects were not evaluated," the report states. Boeing's assumptions underestimated the time it took pilots to respond to system messages, and engaging with the results of MCAS actions directly affected pilots response time and made the aircraft increasingly more difficult to handle. At its normal rate, after 3 seconds, the MCAS would move the stabilizer 0.81 degrees in the aircraft nose down direction, a large degree of movement. To counter, the flight crew had two options: continually pulling back forcefully on the control column, or using a switch on the control column that electrically moves the stabilizer. However doing the latter will also reset the MCAS function which can be activated again in 5 seconds. In the event of repetitive MCAS activation without sufficient flight crew response to return the aircraft to a trimmed state, it could reach a point where the forces on the control column mount to a level where the pilots can no longer exert enough counter-force to maintain control. "During the accident flight, the DFDR recorded a control force of 103 lbs., after repetitive MCAS activation was responded with the FO had responded with inadequate trim to counter MCAS. At this point, the flight crew was unable to maintain altitude," the report says. And it's important to remember that MCAS was invisible to these Lion Air pilots. They were simply not aware that it was working against them. "Without prior knowledge of MCAS functions, the flight crew would depend on the visual and motion cues, prior training for runaway stabilizer, and general training on pitch control to be able to analyze the situation and recognize the non-normal condition. Review of the DFDR data showed that during both the accident and the previous LNI043 flights, the flight crew responded within 2-3 seconds using control column to control the flight path and subsequently trimmed out column forces using electric trim. In the previous LNI043 flight, the flight crew required 3 minutes and 40 seconds rather than seconds to recognize and understand the problem, during which repetitive uncommanded MCAS activations occurred. During the accident flight, recognition of the uncommanded stabilizer movement as a runaway stabilizer condition did not occur thereby, the execution of the non-normal procedure did not occur." AOA and the single point of failure To avoid a single point of failure leading to an accident, many aviation safety standards rely on redundant systems. However, Boeing has no redundancy built-in. The MCAS function used input from a single AOA sensor. Though competitors like Airbus base their systems on reconciling input from multiple sensors, Boeing decided that a single input was sufficient because AOA sensor failures are rare. According to Boeing only 25 activations of stick shaker alerts were due to AOA failures in 737 aircraft over the last 17 years, in more than 240 million flight hours. But, investigators note, this rarity was still too high a risk especially with lack of training provided to pilots to interpret the effects on MCAS of erroneous sensor data. "To comply with the safety requirement of a 'hazardous failure condition,' the aircraft is supposed to rely on sensors that have less than a one-in-10-million (1E-7) chance of failing. Generally, that means taking measurements from two sensors. A hazardous failure condition depending on a single sensor should have been avoided in the certification process." In the end, investigators found that, "The MCAS function was not a fail-safe design and did not include redundancy. A single failure to the AOA sensor corresponding with the FCC commanding STS resulted in erroneous activation of MCAS. During the accident, flight crew reactions were different from and did not match the guidance for assumptions of flight crew behavior that were used when classifying the hazard severity of this failure mode in the functional hazard assessment."

Boeing considered system redesign before accidents: NTSB report SINGAPORE (Reuters) - Boeing (BA.N) engineers and test pilots considered before two fatal 737 MAX crashes whether an anti-stall system should be redesigned after discussing how flawed data from a single sensor could trigger it repeatedly, U.S. investigators have found. FILE PHOTO: Aerial photos showing Boeing 737 Max airplanes parked at Boeing Field in Seattle, Washington, U.S. October 20, 2019. REUTERS/Gary He/File Photo The so-called MCAS system, which relied on one sensor, has been linked in part to crashes of 737 MAX jets flown by Lion Air and Ethiopian Airlines, which triggered a worldwide grounding and a corporate crisis at the world's largest planemaker. The potential redesign discussed during 737 MAX development was ultimately ruled out, based in part on the assumption pilots would react in time to any malfunction, according to a National Transportation Safety Board report to Indonesian investigators. Although not formally part of the required analysis, the Boeing staff discussed the scenario of repeated activation of MCAS due to erroneously high Angle-of-Attack data and considered whether a redesign was necessary, the NTSB report said, citing a 2019 presentation by Boeing to the agency. "As part of this discussion they discussed the combined flight deck effects ... but determined that no redesign was necessary," the NTSB said of the Boeing discussion, referring to alerts that could be potentially distracting to pilots. Later, in a review after the Lion Air 737 MAX crash last October which killed all 189 people on board, Boeing also found that presenting the scenario to regulators would not have led it to classify the anti-stall system as a bigger hazard at the time. Boeing has redesigned the system to rely on more than one sensor and help reduce pilot workload as it strives to return the model to the air. The fresh details of the design of the MCAS system from the NTSB are included in a final report by Indonesian officials into the Lion Air crash. The NTSB has been supporting the Indonesian-led probe. Reuters obtained a copy of the overall report, due to be released publicly later on Friday or on Saturday. In a statement on Friday, Boeing said it had redesigned the system so MCAS would in future compare information from both Angle-of-Attack sensors before activating and would be easier for pilots to over-ride. "These software changes will prevent the flight control conditions that occurred in this accident from ever happening again," it said, declining further comment. RELATIVELY SIMPLE Boeing had assumed pilots would recognize the plane's uncommanded nose-down movement within the three seconds required by regulators, making it relatively simple to restore the aircraft to a normal position, according to the final report. The manufacturer did not consider what would happen if a pilot reacted more slowly, leaving MCAS able to move the nose down by the system's maximum allowable amount. In the Lion Air crash, it took the pilot 11 seconds to respond to the first movement, during which the system reached the maximum authority. Indonesian authorities recommended Boeing make more allowance in the design of its jets for the reactions of normal pilots, rather than its exceptionally skilled test pilots. Boeing, which did not describe the MCAS system in pilot manuals, thought pilots would quickly perform a checklist to deal with a problem called "runaway stabilizer", for which they were already trained and which resembled the impact of MCAS. However, the report found that MCAS did not behave in the same manner as a typical runaway, as the movement was not continuous and pilots were able to counter it multiple times by pulling back on their control columns. At the same time as the aircraft was moving nose-down, making it difficult to control, the pilots were faced with a cascade of alerts as they tried to diagnose the situation. "The flight crew were running out of time to find a solution before the repetitive MCAS activations placed the aircraft in an extreme nose-down attitude that they were unable to recover from," the report said. FAA shuts down Florida repair firm that supplied faulty Lion Air sensor The angle of attack (AOA) vane just below the cockpit windshield on a Boeing 737 MAX 8. (Mike Siegel / The Seattle Times) The Federal Aviation Administration (FAA) has shut down Xtra Aerospace of Miramar, Fla., the company that supplied a faulty sensor to Lion Air that triggered the deadly 2018 crash of a 737 MAX, killing 189 people. The regulator's revocation of Xtra's aviation repair station certificate, announced Friday, means Xtra is out of business. Late Friday, Xtra issued a statement saying that "we respectfully disagree with the agency's findings." It added that the revocation of its certificate "is not an indication that Xtra was responsible for the accident." The news came the same day that the final investigation report into the Lion Air accident was released Friday by the National Transportation Safety Committee of Indonesia, known by its Indonesian acronym KNKT. 737 MAX CRISIS A Boeing 737 Max 8 sits behind the Boeing 737 Renton factory waiting for engines. The Angle of attack (AOA) instrument of the 737 MAX, is the bottom piece of equipment below just below the cockpit windshield. In other responses to that report, Boeing said it is "addressing the KNKT's safety recommendations," and in Congress members of both House and Senate vowed to push through legislation to improve regulation of air safety. Xtra repaired and approved for service a secondhand angle of attack sensor that was installed on the Lion Air jet to replace a faulty one. But according to the final KNKT investigation report, the replacement sensor was mis-calibrated so that the angle it registered was 21 degrees too high. The FAA revocation order said Xtra "recklessly and systemically" failed to comply with federal safety requirements. The order was issued on the day that the KNKT report observed that the FAA's oversight of Xtra before the crash had been inadequate. Asked why the FAA had waited until the final investigation report was published to stop the Florida operation, a spokesman for the safety agency said "it typically takes several months to conduct a thorough investigation, review the findings and determine whether an operator or repair station complied with Federal Aviation Regulations." Secondhand part The component that triggered the sequence that led to the Lion Air MAX crash had originally been installed on an older Boeing 737-900ER aircraft in Malaysia and was sent for repair a year earlier to Xtra, where the unit was disassembled and an eroded vane replaced. Xtra calibrated and tested the component and approved it for return to service in November 2017. It was installed on the Lion Air jet on Oct. 28, the day before the fatal flight. On Flight 610, the next day, the replacement sensor was off by 21 degrees from the one on the other side of the plane. After the pilot retracted the flaps, Boeing's new flight control system - MCAS (Maneuvering Characteristics Augmentation System) - assumed the angle of attack was too high because of the input from that one bad sensor, and began to push the nose of the aircraft down, leading to the crash. The KNKT report states that the sensor "was most likely improperly calibrated at Xtra Aerospace." The company's procedures did not include an extra check required to validate the calibration. The report notes that the FAA missed this, though it is responsible for overseeing quality control at aircraft component suppliers. On Friday, the FAA said an investigation begun after the Lion Air accident "determined that from November 2009 until May 2019, Xtra failed to complete and retain records in accordance with procedures in its repair station manual." It also itemized other failures and said Xtra "did not substantiate that it had adequate facilities, tools, test equipment, technical publications, and trained and qualified employees." Boeing and Congress respond After the official release of the KNKT report, Boeing issued a statement commending the Indonesian safety committee for "its extensive efforts to determine the facts." The statement outlined the upgrade of MCAS that Boeing has completed to address the design flaws identified in the report. "Going forward, MCAS will compare information from both AOA sensors before activating," Boeing said. "In addition, MCAS will now only turn on if both AOA sensors agree, will only activate once in response to erroneous AOA, and will always be subject to a maximum limit that can be overridden with the control column." Finally, Boeing said it "is updating crew manuals and pilot training, designed to ensure every pilot has all of the information they need to fly the 737 MAX safely." In Congress, U.S. Senate Commerce Committee ranking member Maria Cantwell (D-WA) Thursday introduced legislation to implement recent National Transportation Safety Board (NTSB) recommendations related to how pilots respond to flight deck alerts and increased automation in aircraft cockpits. Cantwell pledged to review the recommendations from the investigations into both 737 MAX tragedies and to "consider additional legislation to help maintain the industry's strongest safety standards." And in the House, Peter DeFazio (D-OR), Chair of the House Committee on Transportation and Infrastructure, and Rick Larsen (D-WA), Chair of the Subcommittee on Aviation, issued statements on the Lion Air final report. "I will be introducing legislation at the appropriate time to ensure that unairworthy commercial airliners no longer slip through our regulatory system," said DeFazio. "One thing is abundantly clear: the method by which the FAA certifies aircraft is itself in need of repair," said Larsen. Bonuses for Boeing workers eliminated for 2019 Boeing continues to build 737 Max jets at its factory in Renton, but cannot deliver them or collect airlines' final payments for the aircraft due to the global grounding, hurting its finances. Boeing has told its engineers and other office workers that its dismal financial results so far in 2019 mean they won't receive any bonuses this year. In a message to employees, Boeing said the company's financial performance has been hurt by the global grounding of the 737 Max and that its inability to deliver airplanes has dramatically reduced revenue. "We know this is disappointing and encourage the team to come together and support each other during this challenging time," senior vice president of human resources Heidi Capozzi said in the message. Boeing said salary increases for employees will not be affected by the troubles of the Renton-made Max - typically the company's top cash-generating machine. The company also has pledged $100 million to the families of the 346 people killed in the two crashes. The loss of the payouts, usually made in February, could ripple through the local economy with curtailed bonus-driven spending of all kinds. Boeing employs 69,830 people in Washington state and employee bonuses have pumped $10.2 billion into the economy over the last two years. Boeing's formula for calculating bonuses emphasizes its "One Boeing" theme across several incentive systems, including one for executives, a second for managers, as well as a third for its union-represented engineers and technical workers. The system is weighted: Revenue and profits per share are weighted 25 percent each and free cash flow is worth 50 percent. Boeing's unionized machinists have their own bonus plan, too, with metrics that include safety, quality and productivity. Boeing urged those workers - which includes thousands at the 737 Renton factory - to watch for "for updates on progress through established communication channels." Lawmakers in Washington, D.C., will question Boeing CEO Dennis Muilenburg next week about the two deadly Max crashes that led to the plane's grounding, safety practices and senior management's role in rushing the airplane through certification. Boeing has also seen the Air Force withhold tens of millions of dollars in payments for KC-46 refueling tankers that have been delivered but have unresolved technical glitches, and the debut of the 777X has been delayed this year.