The Senate Committee on Commerce, Science, and Transportation grilled Boeing CEO Dennis Muilenburg and Boeing Commercial Airplanes Chief Engineer John Hamilton on “actions taken to improve safety and the company’s interaction with relevant federal regulators” during a Tuesday hearing related to two fatal accidents involving Boeing 737 MAX aircraft. The hearing, titled “Aviation Safety and the Future of Boeing’s 737 MAX,” took place in the wake of last week’s publication of the final report on the Oct. 29, 2018, crash of Lion Air Flight 610. The Boeing 737 MAX has been grounded since March following the crash of Ethiopian Airlines Flight 302.
“While the Ethiopian Airlines accident is still under investigation by authorities in Ethiopia, we know that both accidents involved the repeated activation of a flight control software function called MCAS, which responded to erroneous signals from a sensor that measures the airplane’s angle of attack,” Muilenburg said in his opening statement (PDF) to the committee. “Based on that information, we have developed robust software improvements that will, among other things, ensure MCAS cannot be activated based on signals from a single sensor, and cannot be activated repeatedly. We are also making additional changes to the 737 MAX’s flight control software to eliminate the possibility of even extremely unlikely risks that are unrelated to the accidents.” Muilenburg reported that Boeing has logged more than 100,000 engineering and test hours on “improvements to the 737 MAX,” along with flying at least 814 test flights with the updated software and conducting simulator sessions with 545 participants representing 99 Boeing customers and 41 global regulators.
Senators also questioned Muilenburg on the recent emergence of communications from Boeing staff that suggest the company may have been aware of potential safety issues with the aircraft’s Maneuvering Characteristics Augmentation System (MCAS) and that there might have been some attempt at hiding those issues from regulators during the certification process. Muilenburg told the committee that he had only recently been made aware of the documents in question, including a 2016 instant messenger exchange between Boeing’s 737 MAX chief technical pilot Mark Forkner and a colleague describing the MCAS as “running rampant in the sim” and the aircraft as “trimming itself like crazy.” As previously reported by AVweb, FAA Administrator Steve Dickson sent a letter to Muilenburg on Oct. 18 demanding an immediate explanation for the contents of that document and Boeing’s delay in bringing it to the FAA.
Further inquiries were made by the committee into Boeing’s relationship with the FAA and the Organization Designation Authorization (ODA) program. In addition, the committee heard from NTSB Chairman Robert Sumwalt and Chairman of the Joint Authorities Technical Review (JATR) Christopher Hart on their work surrounding the MAX. Sumwalt spoke on recommendations published by the NTSB in September regarding the effects of multiple cockpit alarms and what can happen when pilots don’t react as expected to emergency situations. The recommendations were the result of investigations into the MAX accidents.
Hart discussed JATR’s final report (PDF), issued in October 2019, which calls for “reviewing whether the ODA process can be made less cumbersome,” ensuring adequate communications in the certification process, and “revisiting the FAA’s standards regarding the time needed by pilots to identify and respond to problems that arise.” JATR was chartered by the FAA in June 2019 to conduct an independent review of the certification of the Boeing 737 MAX.
The complete hearing can be viewed on the Senate Committee on Commerce, Science, and Transportation’s website. According to Committee Chairman Roger Wicker, R-Miss., additional hearings on the 737 MAX will be held.
After all the different committees get done “grilling” the Boeing CEO, they should then “grill” all the different Congresspersons and Senators on their vote to mandate the FAA to expand the engineering designee program that allowed Boeing to take advantage of the system in the first place. Those Senators and Congresspersons are just as much to blame for the 737MAX mess as Boeing!
Yep, watched if from start to finish and walked away with the same thought.
I watched the “grilling” on C-SPAN. I’d report it as a high temp skewering. That said, I think ALL the members were well prepared and asked poignant questions of Muilenburg who spent a lot of time tap dancing, side stepping and double talking if not spewing a copious amount of bravo-sierra. On a couple of the questions, you could see Muilenburg turning red. I’m sure he took a stiff drink after receiving oxygen therapy after the experience?
After watching the dog and pony show, it was obvious to me that Boeing had an internal Corporate process problem. Who’s on first; what’s on second? The most damning evidence was presented confrontation style by Sen. Ted Cruz (R-TX). He produced a blown up copy of internal emails between test pilots who duplicated the anomalous problem in simulator work and conversed about it internally. Muilenburg didn’t have any excuses that I could see and claimed he only saw the memo a couple of weeks ago despite it being written in February. Huh?
Several Senators discussed the obviously flawed ODA process. Matt W is correct … the FAA and Congress has culpability there, as well. The accident chain may have culminated with two less than stellar flight crews, et al, but it surely started with Boeing, the FAA and Congress in a distant third place. Others can say what they will but designing a system that can command a 2.5 degree nose down trim condition beyond the capability of a flight crew to override it manually and NOT clearly telling operators of its existence and assuming flight crews will work it out seems criminal to me.
It sounds as if Boeing has fixed the problem
> designing a system that can command a 2.5 degree nose down trim condition beyond the capability of a flight crew to override it
The crew was able to override MCAS at any time by activating the yoke-mounted trim switches in the nose-up direction and/or moving the STAB TRIM CUTOUT switch to the CUTOUT position. Moving the yoke-mounted switch deactivated MCAS for five seconds (and if held in position long enough would retrim the aircraft), while moving the STAB TRIM CUTOUT switch to the CUTOUT position deactivated MCAS permanently. These two actions are part of the memory item checklist response for runaway stabilizer.
Mark, didn’t they turn off the MCAS a few times long enough to regain control but the system kicked back in?
I see the problem as being much bigger than with these two parties and as was mentioned above involving politicians and many other entities and companies.
The Lion Air crew inadvertently (I say that because they didn’t know about MCAS) deactivated MCAS 20+ by using the yoke-mounted trim switches. Five seconds after every activation of the trim switch MCAS reactivated, which resulted in rapid nose-down trim. Get that? The Lion Air crew experienced uncommanded trim movement 20+ times and never moved the STAB TRIM CUTOUT switch to CUTOUT to prevent further uncommanded trim movement. How many times would it take for you to experience uncommanded trim movement before you pulled the CB powering the system?
The Ethiopian Air crew–who were purportedly aware of the danger via the FAA’s emergency AD–allowed MCAS to run its full nine-second cycle each time it activated (approx 2.5 units of nose-down trim). The FAA emergency AD specifically says to use the trim switches to deactivate MCAS. The Ethiopian Air crew also failed to retrim the aircraft following MCAS activation, even though the aircraft was obviously far out of trim. After the first two MCAS cycles the aircraft was FIVE UNITS out of trim in the nose-down direction. Finally, the Captain activated his yoke-mounted trim switch and trimmed about 2 units nose up, leaving the plane some 3 units out of trim. Five seconds later MCAS activated again, and the crew allowed it to run its full cycle, placing the aircraft so far out of trim the pilot was barely able to hold the 50+ lbs of yoke pressure to keep the nose level (all of this is based on the published fight data and cockpit voice recordings). It was at that point the Captain commanded the First Officer to cutout the stab trim. The flight data recorder shows that MCAS activated again after that, but since the stab trim motor was deactivated MCAS was unable to move the trim.
When the aircraft is that far out of trim there is a great deal of pressure on the jack screw that actuates the stabilizer, so much that it is not possible to turn the trim wheel by hand in the cockpit. And that’s exactly what happened: When the Captain asked the FO to manually trim nose up he reported the wheel was frozen. During training crews learn the only way to retrim the aircraft in such a situation is use the electric trim system, or to release the elevator enough to allow manual trim wheel movement. The emergency AD specifically directs the crew to retrim the aircraft using the electric trim system, then to set the system to CUTOUT. Why didn’t this crew know that?
As it happens, the Captain realized eventually his muscle endurance holding up elevator would give out, so he turned the electric trim system back on, but then he failed to use it to retrim the aircraft. So why did he turn the trim system back on? Because he wanted to engage the autopilot, and he knew he couldn’t with the stab trim cutout. Predictably, MCAS activated again, and because the crew had ALSO failed to control airspeed, the elevator was rendered ineffective against the nearly full nose-down trim. As the aircraft dove toward the ground the Captain attempted to engage the autopilot four times in rapid succession.
I don’t disagree, Mark. But if it were that easy, why did two airplanes and 346 people die? The Indonesian accident was a series of issues. But the second crew knew about the system, knew what was supposed to be done and still managed to crash. A single point failure mode without a warning light does not a safe system make. Poor design.
Elsewhere in Avweb, Larry Anglisano is demo’ing a Garmin system meant to autoland and airplane with an incapacitated pilot. Why doesn’t everyone just install one of those in their B737 Max 8? Problem solved. The only thing that system doesn’t do is open the door for you when it lands the airplane.
Mark S said it ALL!!!
Also – I know ALL U.S. trained Boeing pilots know about the STAB TRIM CUTOUT switches.
Clearly the single source input to MCAS was poor design choice as was believing the runaway trim procedure would mitigate the hazard.
But very little of this hearing was anything but grandstanding. Almost invariably the response to the questions the politicians asked were not fully understood.
Regardless of whether the two crews should have been able to diagnose the problem and work around it to keep the airplanes flying, they obviously did not do so. For better or worse, that is the real world that Boeing must design their airplanes in which to fly. Blaming the crew sidesteps the central issue that Boeing installed a system in their MAX airplanes that was capable of crashing the plane without rapid and correct intervention on the part of the flight crew. Boeing seems to have grown into a company so large that internal communications is marginal at best. Thus far Muilenburg has done little to correct the situation and is basically mouthing vague talking points approved by the legal department. Considering the length of time this has gone on, there seems to be more wrong with the MCAS system than a simple modification of the operating software.
I am tempted to buy a few shares of Boeing stock so I could attend the next stockholders meeting. I would be amazed if there is not a concerted effort from some major share holders to boot Muilenburg out as CEO. Whether he is directly involved in the mess, the buck should stop at the top and he has done little to solve the problem.
Muilenburg is doing exactly what he is told to do. He knows the questions, he knows how he is going to answer. Those congressional leaders know what they are going to ask, and they know how Muilenburg is going to answer. Muilenburg knows he is going to be skewered, and he know who and when he will be skewered. This is what he is getting paid to do. Should he jump ship, act independent, and in any way embarrass Congress, he is history…and he knows it. Legal is handling everything else at this point including all the questions and answers from both sides. Congress, the FAA, and Boeing have a lot of dirt on each other. Everybody will be cooperating with the lawyers and making sure the media brings to the forefront the designated whipping boy in all this…at the right time. Muilenburg is just doing what he is paid to do, and right now, he is the whipping boy.
One could ask how a trim runaway is recognized? To my knowledge and training experience it is a continuous action of the trim motor. It is clearly distinguishable. How does the MCAS work though? It takes action and then stops. That is more of an action like from the autopilot. Now add in the stick shaker and other warning signals both optically and in announcement and you have a perfect scenario for confusion. Flying by the seat of the pants won’t work either, as the trim has disrupted all real feedback and then you question everything. Hindsight is always 20/20…… Then you use trim again and after some time the trim again does its short thing. Add in two people trying to trouble shoot the challenges at the same time and now one does not know what the odther has done and if you do not have good CRM training under the belt, this is in addition the setup for more confusion.