New document in 737 Max investigation points to chaos, pressure in MCAS development
November 2016 message exchange between 737 Max technical pilots calls system behavior 'egregious'.
Instant messages exchanged between two Boeing technical pilots on the 737 Max program from November 2016 openly discuss the “egregious” behavior of the aircraft’s Maneuvering Characteristics Augmentation System (MCAS) late in the development of the single-aisle jet and lamented the apparent falsehoods in communication to the Federal Aviation Administration.
The revelation comes 354 days since the crash of Lion Air 610, which triggered the most severe safety and leadership crisis the company has faced in its 103 year history. A second crash in March of Ethiopian Airlines 302 forced the grounding of the 737 Max. The crashes killed a total of 346 people.
Subscribe to TACThe FAA in a statement said it was made aware of the exchange Thursday, October 17, despite Boeing’s awareness of the document for “months”.
The Air Current reviewed the message exchange between the 737 Max Chief Technical Pilot Mark Forkner and then program technical pilot Patrik Gustavsson, who is now Chief Technical Pilot for the program, according to his Linkedin page.
According to the document, the conversation between Forkner and Gustavsson took place on the evening of November 16, 2016. The 737 Max was officially certified by the FAA on March 9, 2017 following its first test flight in January of the previous year.
In a back and forth set of instant messages, Forkner wrote, “Oh shocker alerT! (sic) MCAS is now active down to M .2” a reference to the need to use the flight control system at a significantly lower speed than first anticipated, adding: ”It’s running rampant in the sim on me”
Gustavsson replied “Oh great, that means we have to update the speed trim descritption [sic] in vol 2”
Related: What is the Boeing 737 Max Maneuvering Characteristics Augmentation System?
Forkner, less than a minute later wrote in response, “so I basically lied to the regulators (unknowingly)”. Forkner has been at the epicenter of the 737 Max crisis after asking the FAA on March 30, 2016 to have the description of MCAS removed from documentation for the aircraft.
“it wasn’t a lie,” wrote Gustavsson. “no one told us that was the case”
The pair then describe the “egregious” behavior of the system designed to match the handling characteristics of the 737 Max to the earlier 737 Next Generation close to a stall.
Describing the MCAS, Forkner wrote “I’m leveling off at like 4000 ft, 230 knots and the plane is trimming itself like craxy [sic] I’m like, WHAT?”
Gustavsson replied that he had seen something similar on one of Boeing’s engineering simulators “but on approach” adding “I think that’s wrong”
Forkner, apparently in jest, wrote “granted, I suck at flying, but even this was egregious”
Gustavsson replies “No, i think we need aero to confirm what its supposed to be doing”
Forkner said a colleague named Vince “is going to get me some spreadsheet table that shows when it’s (eds note: presumably MCAS) supposed to kick in. why are we just now hearing about this?”
Gustavsson then says he wasn’t sure but “the test pilots have kept us out of then loop” adding “it’s really only christine that is trying to work worth us, but she has been too busy”
Christine here likely refers to Christine Walsh who was the 737 Max Deputy Chief Pilot.
Forkner replied a moment later “they’re all so damn busy, and getting pressure from the program” Gustavsson responding: “That is true, I wouldn’t want to be them”
The existence of the messages between Forkner and Gustavsson became known to the FAA late Thursday, prompting a terse letter from administrator Steve Dickson to Boeing chief executive Dennis Muilenburg demanding an explanation about the document which the FAA said the company “discovered…in its files months ago.”
“I expect your explanation immediately regarding the content of this document and Boeing’s delay in disclosing the document to its safety regulator,” wrote Dickson.
Muilenburg was stripped of his board chairmanship last week. The documents were first reported on by Reuters.
The FAA in a statement on October 18 said the aviation regulator “finds the substance of the document concerning. The FAA is also disappointed that Boeing did not bring this document to our attention immediately upon its discovery. The FAA is reviewing this information to determine what action is appropriate.”
The exchange was apparently supplied to the Department of Justice in February, according to The Seattle Times, but said Boeing has been trying to get Forkner to explain the exchange “without success.” Forkner asserted his Fifth Amendment right against self-incrimination as part of the probe by federal prosecutors.
Boeing in a statement said as part of its “voluntarily cooperating with the House Transportation & Infrastructure Committee’s investigation into the 737 MAX…today we brought to the Committee’s attention a document containing statements by a former Boeing employee.” The company said it will continue to cooperate with the investigation.
Congressional Action
In an interview with The Air Current on Friday, U.S. Congressman Rick Larsen, who is the chairman of the House Subcommittee on Aviation said, “Even though these are the text messages between two people, I can’t imagine it stopped there. Somebody has to be responsible for this guy’s work and somebody has to be responsible with the person who’s responsible for that person’s work.”
Larsen stopped short of calling for wholesale leadership changes at the top of Boeing, declining to join House Transportation & Infrastructure committee chairman Peter DeFazio’s comments. Larsen, a Washington state Democrat, has Boeing’s Everett factory in it his district.
Related: Searching for 40-year old lessons for Boeing in the grounding of the DC-10
Larsen said that it is his expectation that wholesale changes to the FAA and its certification process are coming through Congressional action and is expected to be an outgrowth of the ongoing investigation by the House T&I Committee’s investigation.
“These text messages and the [Joint Authorities Technical Review) report and the NTSB recommendations from a few weeks ago and I think even the changes that Boeing itself is making and their safety and engineering organizations show that there is something wrong with the current state of the law on the certification and delegation authority that the FAA has.”
Muilenburg is currently scheduled to testify in front of Congress on October 30. Larsen said getting an answer on why the FAA and the committee’s investigation were only made aware of the messages on October 17 — months after the DOJ — is near the top of his planned queries.
Related: Checklists come into focus as pace-setter for 737 Max return
The explosive document adds more doubt to the timeline for the return to service of the 737 Max. Southwest Airlines and Air Canada both extended their cancellations to early February. The Air Current reported last week pilot evaluations of checklists and procedures were among the key pacing items as the aircraft advanced toward final approvals by the FAA.
“Assuming the technical changes are largely complete, the MAX still has to return to service with some confidence among the public that it is safe and that institutional changes mean something like this won’t happen again,” wrote J.P. Morgan aerospace analyst Seth Seifman. “Today’s news is a step backward.”
Larsen echoed the same sentiment: “We say safety is the timeline on [737 Max] return to service and I think the timeline on that just got longer.”
Write to Jon Ostrower at jon@theaircurrent.com
View Comments
Searching for 40-year old lessons for Boeing in the grounding of the DC-10
Instant messages exchanged between two Boeing technical pilots on the 737 Max program...
Pete Pereira
AuthorWelcome to the real world of airplane (or anything) development has to abide by real time schedules and deadlines and “pressure” is natural and routine. Sort of shatters the media-led perception that development operations look like a bunch of well-paid engineers lackadaisically shuffling from eye-glazing meeting to snore-inducing meeting with a tea break in-between. Unlike the FAA’s bizarre declaration that there is no timetable for returning the MAX to service, real businesses follow a process of determining what needs to be done, estimating how many labor-hours it will take, calculating how many days that works out to given the available resources, and declares a finish date. The media’s unquestioning acceptance of a “no date” declaration says a lot about the media.
Also, the number of IMs and emails in identical vein to this one that are generated during the course of any development program run into the thousands. Most of the seminal “issues” behind them are due to misunderstandings, miscommunications and simple errors—engineers and managers ARE human. Many self-resolve without doing anything special, others with better communication, the rest need further analysis, with most proving to be satisfactory as-is and a few resulting in design changes. It’s just the way things go when humans are involved.
Some newbies to the environment might consider all this to be chaos. One would hope the FAA Administrator isn’t one (though asking for an explanation of the contents established that he is) and that he merely knows how to spell “grandstanding” and realizes what would happen if every scrap of inter-employee communications were sent his way. Either way, welcome to the real world Mr. Administrator and note—when grandstanding—how much each day of UNNECESSARY delay or uncertainty is costing the business, suppliers, shareholders, taxpayers and various others, not just in monetary terms but also in mental stress, health and social strain.
Pete Pereira
AuthorContrary to this article’s assertion, the test pilot’s request was to remove the MCAS description only from the pilots operations manuals, not “removed from documentation for the aircraft.” It *WAS* described in the Systems description manuals where it is needed for airline maintenance & engineering reference. A subtle difference to some, but an important one. The media and some pilots and their labor unions have made much of this suppression, claiming it to be an attempt to hide the system’s existence. In fact, the suppression is according to guidelines for designing for Human Factors for the following reasons:
1. MCAS operates as part of the flight control software; it cannot be isolated by the pilots to turn it either on or off.
2. Normal MCAS operation (being a “feel” generating system, not a stall avoidance/recovery system as the media have persisted in deliberately misconstruing it) cannot be detected by the pilots (the airplane feels like the NG and the pilots have no useful reason to know why).
3. Abnormal operation in response to erroneous AoA data is not immediately uniquely recognizable—it appears as a stab trim runaway, for which there are numerous possible causes. The criticality and time-sensitive nature of the condition requires immediate corrective action; troubleshooting or fault isolation to determine the cause (i.e. indicting MCAS) before executing the procedure is neither necessary nor advisable.**
If a function cannot be turned on or off, its normal operation is undetectable and its abnormal operation cannot be uniquely discerned, the function is transparent to the pilot, there’s nothing the pilot can directly do with or to the function. So why mention it in the pilot’s operations manual when there’s nothing to operate? It’s inclusion there would interfere with the retrieval of useful information.
______________
** The philosophy adopted by some airlines to abandon the commitment of time-critical procedures to memory and instead put those procedures in the operations manuals goes against human factors. It may very well be what has led some airlines to ignore the requirement for recurrent mandatory training of those time-critical recovery procedures in a simulator—if they can find the procedure in a manual and execute it, why bother training for it? But that lack of training also results in an inability to recognize the triggering condition, which seems to be the case on all three flights. And if you can’t recognize and label the triggering condition, you don’t know what recovery procedure to extract from the FCOM. The FAA needs to re-examine its recently-adopted philosophy of discouraging memory items as well as the airlines’ apparent non-adherence to the training requirements.
Pete Pereira
AuthorP.S.: If the pilots had realized that they had a stab trim runaway condition and had forgotten the recovery procedure (they’re human too), having the procedure in the FCOM could have saved them. But “forgot” implies that at one time they knew, which is hard to believe, considering that they didn’t know what two switches, placed in convenient reach, did. It’s hard to imagine any competent pilot taking command of any flight while not knowing what ALL the controls at his/her disposal do.
Pete Pereira
AuthorThe fuss over the IM thread is much ado about nothing. The chief test pilot seems to have low self-confidence and a passive-aggressive, self-effacing yet confrontational style that can be misunderstood by those who don’t recognize his mea culpa approach to diffuse what he perceives as imminent conflict. And conflict there will be, given the ease with which he judges and casts blame, both on himself and others, which can make others feel like the big bad wolf—unjustly. Such an approach is not conducive to bringing issues to light or for amicable resolution. Makes me wonder how he does at CRM in the cockpit. It’s too bad his character and intent have to be speculated about in public; a Catch-22 situation given that if he had not pleaded the Fifth the media would have misconstrued his words and disparaged him anyway.
I don’t think he really knew what he was complaining about. Running rampant could mean anything. Could be aberrant sim operation due to wrong software or config files loaded, something that should be prevented by required verification at sim power up. At the time, the sim was likely loaded with a buggy red label issue of the P10.0 version of Collins’ flight control computer software, the final version of which was released in Jan 2017.
Just as likely it was simply a case of misperception, the test pilot being unusually focused on the trim wheel. Noticing just how often a pitch trim is commanded, he used “rampant” to loosely mean “a lot.” That would jive with his “trimming like crazy” comment, though 230 kts at 4000 ft is well above M0.2, so some of his concern wasn’t in the newly discovered speed range. After all, he WAS bringing to the other pilot’s attention his discovery that MCAS operation had been activated in the Mach 0.2 area and his unintentional “lie” seems to be that he had not included the low speed operation range in his paperwork to the FAA. Also, in this context, “on approach” would likely be referring to the Autopilot ENGAGED and in approach mode and the flaps likely would not be UP through an approach. That’s two reasons why MCAS would be inhibited, ergo the discussion was not all about MCAS, but had wandered into general stab trim operation.
In stringent translation “rampant” would mean “unchecked” till it hit the travel limit switches, i.e. an uninterruptible trim runaway. But there’s nothing in the IM thread to suggest he found that to be the case, nor was that operation mode evident in the publicly available data from any of the three flights under investigation. In fact, the data shows MCAS operated as expected and was interrupted each time by the pilot’s trim switches as expected, except for the last two activations on the fatal flights, which was likely due to the pilot’s sole—and unexpected—focus on using elevator to counter the trim. The original voice recorder data of the three flights have not been publicly released. They could help us understand the unique behaviors of the three crew sets.
While MCAS’ repeated activation is a questionable design decision, limiting its operation to just once would have generated more complexity in the form of how to reliably discern when an excessively high AoA is a new event and MCAS operation is warranted and when it is not. More complexity usually doesn’t make an elegant design. Two switches to simply kill the powered trim system was probably the most elegant design possible—it’s worked for decades and still works on airplanes of all kinds—and the pilots apparently didn’t train for it or even know it.
Contrary to the NTSB’s assertion, there is nothing in the data that shows the pilots of any of the three flights were overwhelmed by simultaneous alarms and warnings or that they had insufficient time to execute the recovery procedure. The failure to intervene in the stab trim runaway was the pilot’s (actually, the airline’s), it was not a design failure.