4 ms·

In fairness to the guy, he came from the Military side of the house, the program was basically ready for flight by the time he took over the CEO slot. Basically

by Aloha 7y ago

In fairness to the guy, he came from the Military side of the house, the program was basically ready for flight by the time he took over the CEO slot. Basically all of the fatal design decisions were made before he became CEO. The 737 MAX was a failure of process, not by specific choices made by a leader - he was fired however for his poor response to the crashes, he committed many tactical and PR errors, which made the restoration process longer than it should have been. If still you want to lay blame at any single persons feet, lay the blame at the feet of James McNerney, the CEO who ran Boeing while the bulk of the development of the MAX was done, he's the one who kicked the MAX program off.

stefan_ 7y ago
What do you mean? The policy set here was literally set at the highest level, a specific choice - "no training, no certification" was the precise goal for the 737 MAX. How can you claim that is a failure of process.
- Aloha 7y ago
  I'll argue that making the MAX behave the same as a non MAX 737 is a reachable and reasonable engineering goal, the process failed because it didnt do it safely. Airbus absolutely uses its fly-by-wire system to change the handling characteristics of its airplanes, to make them fly the same - I see no reason why Boeing couldn't do the same thing.
  - acqq 7y ago
    > I'll argue that making the MAX behave the same as a non MAX 737 is a reachable and reasonable engineering goal And I argue the opposite: it can‘t be made to behave exactly the same as soon as the failure scenarios are considered. In computer speak, you just look from the point of view of a “most common” run, not all the special cases, exceptions etc. There are other impossibilities too, directly related to the certification requirements, already documented in the news articles before.
    - YawningAngel 7y ago
      The normal failure scenario for safety critical electronics on an aircraft is that you have an entirely redundant system that takes over. I don't see why that approach wouldn't have been sufficient here.
      - acqq 7y ago
        It is documented in the articles: failure modes have to be trained if they aren’t the same, and with MCAS as it should be (not as if was and failed catastrophically twice) they can’t be the same. New devices have to be recertified. Two sensors can’t be redundant, three would be again not the same plane. Newer computers won’t be the same plane etc. Wait to see what the final opinion of European agencies are once the latest changes are evaluated and you’ll see that it’s not the same plane, even if Boeing all the time bent over backwards over the dead bodies of others.
  - gsnedders 7y ago
    > Airbus absolutely uses its fly-by-wire system to change the handling characteristics of its airplanes, to make them fly the same - I see no reason why Boeing couldn't do the same thing. AFAIK, being on the same type rating means the A320neo has the same behaviour as the A320ceo _even when in direct law_, where there's a 1:1 mapping between input and behaviour. (Yet alone the very limited mechanical fallback!)
  - dTal 7y ago
    >making the MAX behave the same as a non MAX 737 The purpose of the MCAS is to make the aircraft certifiable - full stop. The MAX is dynamically unstable, in the sense that at high angles of attack it will tend to continue increasing AOA into a stall - a terrible airframe sin which they tried to fix in software. This is the real story, not this type rating stuff. HN discussion: https://news.ycombinator.com/item?id=19695757 https://news.ycombinator.com/item?id=19695757
  - cmurf 7y ago
    Of course the difference is, pilots have mandatory knowledge and training for all of an Airbus's "laws" including the direct mode that has no abstraction, i.e. joystick inputs directly translate to control surface deflections. Whereas with MCAS, pilots were not told about it, the operating manual has no mention of it, there was no training in sim based on it being upset due to a faulty angle of attack senstor, and most remarkably? No training with it disable via stabilizer trim set to cutoff. Appalling. As a pilot and former CFI, without any question whatsoever, a pilot must know how the airplane behaves near stall. Student pilots have demonstrated certified pilot level competency of their particular make/model aircraft stall behavior, before any CFI feels comfortable doing a student pilot sign off for solo flight. It's that goddamn basic. And 737 MAX airplanes have two such stall behaviors, with MCAS and without (via stabilizer trim cutoff). I'd like to see every Boeing pilot involved in these decisions put on a hot seat and asked if they really think it's appropriate to sign off a pilot, as competent to fly, when they aren't completely aware of two different stall behaviors for this aircraft. In my opinion it's unconscionable to have deprived pilots of this knowledge. I am aware of the make/model type certificate arguments. As yet no authority has said for sure whether MCAS knowledge requirements would have then required a new type certificate, or if in fact MCAS is improperly papering over an airworthiness deficiency. What we do know is, it's damn suspicious that this make/model has been grounded this long, with multiple supposedly official statements that software fixes are done and tested and should be ready for FAA approval and deployment any day now, and yet that's been postponed at least 3 times that I'm aware of. If this is strictly a software fix, and a mere tweak back to the original basis of certification, why all the delays?
- everybodyknows 7y ago
  Try reading "failure of process" as "bad decisions made earlier, and enforced now by persons too powerful to challenge."
slumdev 7y ago
> The 737 MAX was a failure of process So they use SAFe Agile at Boeing, too?
cameldrv 7y ago
This is excessively kind to Muilenberg. Arguably the biggest screw-up was promising the airlines too much with regards to delivery date and training requirements. That created too much of an incentive to ship an unsafe product. The truly fatal decision though was made in 2016 when Muilenberg was CEO. That decision was to make MCAS a single sensor system vs. a two sensor system. Originally, MCAS would activate based on a combination of a G sensor and the AoA sensor. Sometime in the middle of 2016, when they did flight testing, they found that the undesirable handling characteristics could manifest without high G, so they took the G sensor out of the mix. In order to account for the low-speed, low-g handling problem, they also had to make the MCAS corrections be much more powerful, which made it much more dangerous. The FAA apparently wasn't informed of this. This key moment was approximately one year into Muilenberg's tenure, and so the buck has to stop with him. Muilenberg was also CEO after the Lion Air crash, and he's responsible for the decision not to ground the fleet at that time. He's also responsible for not wanting to ground the fleet after the second crash, and pressuring the FAA to quickly certify a fix.
- el_nino 7y ago
  "promising the airlines too much with regards to delivery date and training requirements. That created too much of an incentive to ship an unsafe product." I think this is the real failure of a CEO. They can't be constantly on the watch for engineering mistakes but they are the ones who set the tone for the company culture. Setting unachievable deadlines, pressure to deliver to the point where it can only be done by cutting corners, choosing strategies that are unsustainable long run in the chase for short term profits. These are the real failures and if they lead to loss of life they should be treated accordingly. We keep waiting for the market to punish them but the market punishes companies not people. We don't need to just apply punishments, we need deterrents. We need a bonus-malus system where they don't just jump off with a golden parachute. If there is indeed no legal recourse to prevent such matters (ridiculous as it may sound), they should at least be subjected to penalties as a standard practice.
notatoad 7y ago
>the program was basically ready for flight by the time he took over the CEO slot isn't the whole problem here that the program wasn't ready for flight?

by Aloha 7y ago

stefan_ 7y ago

What do you mean? The policy set here was literally set at the highest level, a specific choice - "no training, no certification" was the precise goal for the 737 MAX. How can you claim that is a failure of process.

Aloha 7y ago
I'll argue that making the MAX behave the same as a non MAX 737 is a reachable and reasonable engineering goal, the process failed because it didnt do it safely. Airbus absolutely uses its fly-by-wire system to change the handling characteristics of its airplanes, to make them fly the same - I see no reason why Boeing couldn't do the same thing.
- acqq 7y ago
  > I'll argue that making the MAX behave the same as a non MAX 737 is a reachable and reasonable engineering goal And I argue the opposite: it can‘t be made to behave exactly the same as soon as the failure scenarios are considered. In computer speak, you just look from the point of view of a “most common” run, not all the special cases, exceptions etc. There are other impossibilities too, directly related to the certification requirements, already documented in the news articles before.
  - YawningAngel 7y ago
    The normal failure scenario for safety critical electronics on an aircraft is that you have an entirely redundant system that takes over. I don't see why that approach wouldn't have been sufficient here.
    - acqq 7y ago
      It is documented in the articles: failure modes have to be trained if they aren’t the same, and with MCAS as it should be (not as if was and failed catastrophically twice) they can’t be the same. New devices have to be recertified. Two sensors can’t be redundant, three would be again not the same plane. Newer computers won’t be the same plane etc. Wait to see what the final opinion of European agencies are once the latest changes are evaluated and you’ll see that it’s not the same plane, even if Boeing all the time bent over backwards over the dead bodies of others.
- gsnedders 7y ago
  > Airbus absolutely uses its fly-by-wire system to change the handling characteristics of its airplanes, to make them fly the same - I see no reason why Boeing couldn't do the same thing. AFAIK, being on the same type rating means the A320neo has the same behaviour as the A320ceo _even when in direct law_, where there's a 1:1 mapping between input and behaviour. (Yet alone the very limited mechanical fallback!)
- dTal 7y ago
  >making the MAX behave the same as a non MAX 737 The purpose of the MCAS is to make the aircraft certifiable - full stop. The MAX is dynamically unstable, in the sense that at high angles of attack it will tend to continue increasing AOA into a stall - a terrible airframe sin which they tried to fix in software. This is the real story, not this type rating stuff. HN discussion: https://news.ycombinator.com/item?id=19695757 https://news.ycombinator.com/item?id=19695757
- cmurf 7y ago
  Of course the difference is, pilots have mandatory knowledge and training for all of an Airbus's "laws" including the direct mode that has no abstraction, i.e. joystick inputs directly translate to control surface deflections. Whereas with MCAS, pilots were not told about it, the operating manual has no mention of it, there was no training in sim based on it being upset due to a faulty angle of attack senstor, and most remarkably? No training with it disable via stabilizer trim set to cutoff. Appalling. As a pilot and former CFI, without any question whatsoever, a pilot must know how the airplane behaves near stall. Student pilots have demonstrated certified pilot level competency of their particular make/model aircraft stall behavior, before any CFI feels comfortable doing a student pilot sign off for solo flight. It's that goddamn basic. And 737 MAX airplanes have two such stall behaviors, with MCAS and without (via stabilizer trim cutoff). I'd like to see every Boeing pilot involved in these decisions put on a hot seat and asked if they really think it's appropriate to sign off a pilot, as competent to fly, when they aren't completely aware of two different stall behaviors for this aircraft. In my opinion it's unconscionable to have deprived pilots of this knowledge. I am aware of the make/model type certificate arguments. As yet no authority has said for sure whether MCAS knowledge requirements would have then required a new type certificate, or if in fact MCAS is improperly papering over an airworthiness deficiency. What we do know is, it's damn suspicious that this make/model has been grounded this long, with multiple supposedly official statements that software fixes are done and tested and should be ready for FAA approval and deployment any day now, and yet that's been postponed at least 3 times that I'm aware of. If this is strictly a software fix, and a mere tweak back to the original basis of certification, why all the delays?
everybodyknows 7y ago
Try reading "failure of process" as "bad decisions made earlier, and enforced now by persons too powerful to challenge."

slumdev 7y ago

> The 737 MAX was a failure of process So they use SAFe Agile at Boeing, too?

cameldrv 7y ago

This is excessively kind to Muilenberg. Arguably the biggest screw-up was promising the airlines too much with regards to delivery date and training requirements. That created too much of an incentive to ship an unsafe product. The truly fatal decision though was made in 2016 when Muilenberg was CEO. That decision was to make MCAS a single sensor system vs. a two sensor system. Originally, MCAS would activate based on a combination of a G sensor and the AoA sensor. Sometime in the middle of 2016, when they did flight testing, they found that the undesirable handling characteristics could manifest without high G, so they took the G sensor out of the mix. In order to account for the low-speed, low-g handling problem, they also had to make the MCAS corrections be much more powerful, which made it much more dangerous. The FAA apparently wasn't informed of this. This key moment was approximately one year into Muilenberg's tenure, and so the buck has to stop with him. Muilenberg was also CEO after the Lion Air crash, and he's responsible for the decision not to ground the fleet at that time. He's also responsible for not wanting to ground the fleet after the second crash, and pressuring the FAA to quickly certify a fix.

el_nino 7y ago
"promising the airlines too much with regards to delivery date and training requirements. That created too much of an incentive to ship an unsafe product." I think this is the real failure of a CEO. They can't be constantly on the watch for engineering mistakes but they are the ones who set the tone for the company culture. Setting unachievable deadlines, pressure to deliver to the point where it can only be done by cutting corners, choosing strategies that are unsustainable long run in the chase for short term profits. These are the real failures and if they lead to loss of life they should be treated accordingly. We keep waiting for the market to punish them but the market punishes companies not people. We don't need to just apply punishments, we need deterrents. We need a bonus-malus system where they don't just jump off with a golden parachute. If there is indeed no legal recourse to prevent such matters (ridiculous as it may sound), they should at least be subjected to penalties as a standard practice.

notatoad 7y ago

>the program was basically ready for flight by the time he took over the CEO slot isn't the whole problem here that the program wasn't ready for flight?