The House Transportation Committee has gathered tens of thousands of pages of documents in its investigation into the Boeing 737 MAX, and on Wednesday Chairman Peter DeFazio and other members of the committee presented some of them at a public hearing in an attempt to get answers from Boeing CEO Dennis Muilenburg.
Among the documents: A Boeing engineer expressed concern in a 2015 email that a flight control system that Boeing was developing for the new version of its bestselling plane could be unsafe due to its reliance on a single sensor.
The email from a member of Boeing's aero-stability and control group questioned whether the MAX was "vulnerable to single AoA sensor failures with the MCAS implementation, or is there some checking that occurs?"
MCAS, short for the maneuvering characteristics augmentation system, was created for the MAX to counter the tendency of its nose to rise in certain situations due to the placement of its new larger engines. MCAS pushed the plane's nose down automatically if the system determined, based on input from a single angle-of-attack sensor, that the aircraft was in danger of a stall. Faulty angle-of-attack sensors are believed to have triggered two 737 MAX crashes that killed 346 people.
With the planes grounded since the second crash in March, Boeing has redesigned MCAS to rely on two AoA sensors.
Under questioning, John Hamilton, chief engineer for Boeing's commercial airplane division, who testified alongside Muilenburg, said that single points of failure are allowed in airplane design depending on the hazard assessment. Any dissent the committee could present on the final assessment that a single sensor was merited "highlights that our engineers do raise questions and it's an open culture."
In the event of an incorrect activation of MCAS, Boeing and FAA expected that pilots would be able to respond within four seconds to trim the stabilizer. Boeing's judgment that a failure of MCAS would not be catastrophic allowed MCAS to rely on a single angle-of-attack sensor, which ultimately proved fatal.
However, DeFazio noted that in the Ethiopian crash pilots are believed to have taken eight seconds to respond, and several outside reviews have suggested that Boeing's assumptions of a uniform four-second response was unrealistic. DeFazio shared a Boeing assessment from 2018 that a reaction time of greater than 10 seconds would "be catastrophic due to the inability to arrest the airplane overspeed."
Hamilton acknowledged that engineers considered the impact of slow response times, but that simulator testing with a number of pilots supported its judgement that four seconds was a realistic expectation.
A document Boeing provided to FAA laying out its design requirements for MCAS stated that "MCAS shall not have any objectionable interactions with the piloting of the airplane," and that "MCAS shall not interfere with dive recovery."
Rep. Greg Stanton challenged Muilenburg and Hamilton to admit that MCAS failed to meet those objectives.
Hamilton asserted that pilots had the ability to counteract MCAS, but when challenged for a yes or no answer on whether it impacted dive recovery on the two fatal flights, Hamilton eventually answered "yes."
DeFazio also shared a proposed design memo from 2012 for the pilot's flight control panel display on the 737 MAX that included an indicator for failure of the MCAS flight control system. The indicator was left out of the final version of the display.
Hamilton said it wasn't necessary since an MCAS fault would set off the failure indicator for the overarching speed trim system that MCAS is part of.
An MCAS failure indicator wouldn't have helped pilots in the two crashes since MCAS itself didn't fail; rather in both cases MCAS was triggered by incorrect data from a faulty AoA sensor.
All Rights Reserved © 2024
