[SystemSafety] US House Transportation Committee Preliminary Report into Boeing 737 MAX

[Kinalzyk, Dietmar AVL/DE]

Dear Peter,

thank you for the interesting update.
The sentence confuses: "Although the AOA Disagree alert was not a safety-critical component, Boeing knowingly delivered 737 MAX aircraft to its customers that did not conform to the airplane’s type certificate, and the FAA has failed to take any measures to hold Boeing accountable for these actions." (p9)

I did not understand, why the AOA Disagree alert is not safety critical. Boeing took a sophisticated solution: combination of airspeed and altitude errors, hiding the real root cause !!!  You can find it in the Report Lion Air:
https://www.flightradar24.com/blog/wp-content/uploads/2019/10/JT610-PK-LQP-Final-Report.pdf

P47: 
The AOA DISAGREE message was first implemented on the Boeing 737 NG fleet in 2006 in response to customer requests. Since 2006, the AOA DISAGREE alert has been installed on all newly manufactured Boeing 737 NG aircraft, and is available as a retrofit for older aircraft.
The AOA DISAGREE alert has not been considered as a safety feature by Boeing (737 MAX), and is not necessary to safely operate the aircraft. Airspeed, attitude, altitude, vertical speed, heading and engine thrust settings are the primary parameters the flight crews use to safely operate the aircraft in normal flight. Stick shaker and the pitch limit indicator are the primary features used for the operation of the aircraft at elevated angles of attack. The AOA DISAGREE alert provides supplemental information only. The AOA DISAGREE non-normal procedure alerts pilots to the possibility of airspeed and altitude errors, and of the IAS DISAGREE and ALT DISAGREE alerts occurring; but the non-normal procedure does not include any flight crew action in response to the AOA DISAGREE alert.


Dietmar KINALZYK
Principal Development Engineer
Product Safety & NON-PT Safety
dietmar.kinalzyk at avl.com
T: +49 941 50272546
M: +49 152 59963271

AVL Software and Functions GmbH
Im Gewerbepark B29, 93059 Regensburg
Germany
www.avl-functions.com


-----Ursprüngliche Nachricht-----
Von: systemsafety <systemsafety-bounces at lists.techfak.uni-bielefeld.de> Im Auftrag von Peter Bernard Ladkin
Gesendet: Samstag, 7. März 2020 11:41
An: The System Safety List <systemsafety at techfak.uni-bielefeld.de>
Betreff: [SystemSafety] US House Transportation Committee Preliminary Report into Boeing 737 MAX

... development, certification and response to the accidents is scathing, both concerning Boeing and concerning the FAA. A short review is at

https://www.theguardian.com/business/2020/mar/06/boeing-culture-concealment-fatal-737-max-crashes-report

The 13pp report is nominally available from
https://transportation.house.gov/news/press-releases/nearly-one-year-after-launching-its-boeing-737-max-investigation-house-transportation-committee-issues-preliminary-investigative-findings-

but I get an Error 404 when trying. Google, however, finds it quickly:

https://transportation.house.gov/imo/media/doc/TI%20Preliminary%20Investigative%20Findings%20Boeing%20737%20MAX%20March%202020.pdf


The committee evaluated some 600,000 pages of documents and of course has seen and read things that have not yet made it into the public domain. There are a number of facts of which I was not yet aware. Here is a selection of what I consider to be system-safety highlights.

MCAS was deliberately described as a "new function" of the STS rather than a new system, with an AR concurring, "to avoid greater FAA certification requirements and pilot training impacts on the 737 MAX program" (Footnote 16).

"Early on" in development (p9, substantiated in Footnote 46), Boeing was aware that if pilots did not respond (appropriately) within 10 seconds to a "runaway stabiliser" condition caused by MCAS activation, the severity is "catastrophic". Multiple Boeing ARs were aware of this, but it was never reported to the FAA. This is for me new.

In 2015, an AR raised the issue of whether the AC was "vulnerable to single AOA sensor failures...."
 The answer is yes (obviously), and the aircraft was delivered with this vulnerability. (p7)

In 2016, redesign of the activation conditions of MCAS did not lead to safety reevaluation (p7).

Concerning the "AOA Disagree" alert, Boeing has apparently publicly blamed its SW supplier. However, the SW was accepted and verified by Boeing in this configuration in May 2015 (p8). Boeing knew the alert was not functioning in August 2017, three months after the aircraft entered revenue service, and complained to the supplier (p8). "The Committee also discovered that one AR who was aware that Boeing knowingly delivered aircraft with inoperable AOA Disagree alerts to its customers took no action to inform the FAA" (p4). "Although the AOA Disagree alert was not a safety-critical component, Boeing knowingly delivered 737 MAX aircraft to its customers that did not conform to the airplane’s type certificate, and the FAA has failed to take any measures to hold Boeing accountable for these actions." (p9)

PBL

Prof. Peter Bernard Ladkin, Bielefeld, Germany MoreInCommon Je suis Charlie
Tel+msg +49 (0)521 880 7319  www.rvs-bi.de