*36C3 preroll music*
Herald: In the following talk Mr. Bernd Sieker will speak about the crashes and
what led to the crashes of the most recent 737 model. He is a flight safety
engineer and he also worked on flight safety and he analyzed the plane
crashes for a lot of time and a long time. And you have to keep in mind that this
737, although multiple models have been built, can be flown. All models can be
flown with the same type rating since 1967, which is one of the many root causes
of the issues that led to the disaster that killed 346 people. Let's listen to a
Bernd and he'll enlighten us, what else went wrong?
*applause*
Bernd Sieker: Yes, thank you very much for the introduction. I see they are not quite
as many people as with the Edward Snowden talk, but I'm not disappointed. Aviation
safety has always been very important to me and I've done a lot of work on it and I
am happy to share my passion with so many of you. Thank you.
*applause* So it's basically the outline of what I'm
going to talk about. It's the Boeing 737 Max or seven thirty seven as some may say.
I will briefly talk about the accidents, what we knew at the beginning, what went
wrong and then what came to light. Later on I will show our causal analysis method
that we use very shortly, very briefly and the analysis and overview of the analysis
that I did of these accidents. Then talk about the infamous MCAS system, the
Maneuvering Characteristics Augmentation System, as it's called, by its full name.
Then I'll talk about certification, how certain aircraft certification works in
the United States. It's very similar in Europe, although there are some
differences. But I'm not going to talk about European details in this talk. So
it's mostly about the FAA and aircraft certification across the pond. Some other
things and an outlook, how it is going to go on with the Boeing 737 Max. We
currently don't know exactly what's going to happen, but we'll see. And if we have
time, they have a few bonus slides later on. So the Boeing 737 Max - the star of
the show, as you may say, it's the fourth iteration, as the Herald already
indicated, of the world's best selling airliner. I think I looked it up just
recently. I think there are almost 15,000 orders that have been for the 737 of all
the series, the original, the classic, the NG and now the Max. And the Max itself is
the fastest selling airliner of all time. So within months, it had literally
thousands of orders. It has now almost 5,000 orders. The 737 Max, and all the
airlines in the world are waiting for the grounding to be lifted so they can receive
and fly the aircraft. So the first accident was last year. It was a Lion Air,
an Indonesian flag carrier. Actually, I think the second or third largest Boeing
737 Max customer in the world with a couple of hundred, 250 or something
aircraft and it crashed relatively shortly after it entered service. And so we've heard
some strange things in the news and on the forums that deal with aviation safety. It
seems that there had been uncommanded nose down trim. So the tail plane is moved by
an electric motor and it forces the nose of the aircraft down. The pilot can
counter that movement with some switches on his control column. And apparently the
stick shaker was active during the flight and there were difficulties in controlling
the aircraft. We didn't know at the time exactly what it was. And then for the
first time, the abbreviation MCAS surfaced and even 737 pilots, even 737 Max pilots,
at least some of them said they'd never heard of it. It was a mystery. We later
found that actually in some documentation, it was very briefly mentioned that such a
system existed, but not exactly why it was there. And I guess Boeing knew and the
certification authorities, as it turned out, sort of knew a bit of the story, but
not the whole story. But especially people in the West, in the US and in other
countries said: Oh, these are just poorly trained Third World pilots. And we expect
that. And they weren't completely wrong. Lion Air has a particularly bad safety
record. And it wasn't unknown to aviation safety investigators. There have been a
number of crashes with Lion Air. So in the beginning, we thought, OK, maybe it's a
fluke, it's a one off or maybe it's caused by poor maintenance or bad pilots or
whatever. So several people, on the other hand, already began worrying because some
flight data recorder traces became public. And there was some very strange things
which we will see shortly. And then only a few months later, the second aircraft of
exactly the same type and the same variant, Boeing 737 Max 8, also crashed.
And you can see maybe on the picture on the left, it left a rather big crater. It
really dove into the earth quite fast. It turned out, I think, about between seven
and eight hundred kilometers per hour. So, so really fast and not much left. Not much
was left. I think the biggest parts were about this size, I guess. So all small
pieces of debris and the engine cores, which are a bit bigger. And from that as
well, flight data recorder traces became public. The recorders had survived at
least the memory in them and were readable. So we finally found out
something and found some similarities, some rather disturbing similarities. We
come to that in a moment, but I'll talk a little bit about the Boeing 737 family in
general. So there were four, as I said, models. That was the original, which had
narrow engines under the wings. Not a lot of room between the ground and the
engines, but it looked quite normal. You could say it was one of the first short-
haul airliners with under slung engines, under the wings and then new high bypassed
turbo fire engines entered the market, which were much more fuel efficient. We're
talking about maybe some 15 to 20 percent lower fuel consumption. So it was a big
deal. And the Boeing 737 was reengined and became known as the classic, bigger
engines, but still mostly analog mechanical instruments. And it was
basically the same as the original, instead that it had some bigger engines
and they had to shape the cowling a little differently to accommodate the bigger
engines. But more or less, it worked for a while. And then as airlines demanded more
modern avionics, so the cockpit electronics in aircraft, the next
generation was conceived. It also got a new wing, new winglets, which again saved
a lot of fuel. It had basically the same engines, except that the engines now were
also computer controlled by what we call FADEC full authority, digital engine
control. And Boeing said, well, that's probably going to be the last one. And in
the next few years, we are going to develop an all new, short and medium haul
single aisle aircraft which will be all new and super efficient and super cheap to
operate - all the promises that manufacturers always make. In the
meantime, Airbus was becoming a major player with the A320. It was overall a
much more modern aircraft. It had digital fly by wire. It always had digitally
controlled engines. It had much higher ground clearance. So it was no problem to
accommodate the larger engines in the A320. And Airbus then announced that it
was going to reengine the A320. And for the A320, that was the first time it got
new engines. It for a long time it had you had the choice of two types of engines for
the A320 And then they said, we're going to install these new super efficient
engines, which brought with it another optimization of fuel consumption. That was
another 15 percent fuel saved per mile traveled something on the order of that.
So it was a huge improvement again. And many Airbus customers immediately ordered
the so-called A320neo and some Boeing customers also thought, well, this one is
going to consume so much less fuel that we might consider switching to Airbus, even
though it's a major hassle if you have fleet entirely consisting of Boeing
aircraft, if you then switch to Airbus, it's a huge hassle and nobody really wants
that unless they're really forced to. But the promised fuel savings were so big that
companies actually considered this and lots of them. And so Boeing said we need
something very quickly, preferably within two years I think. For airline
development, that's very, very, very, very quickly. And they said, well, scrap all
the plans about the new small airliner. We're going to change the 737 again. And
now the new engines, were going to be bigger, again. And so actually, there was
no ground clearance to move them in the same way as on the on the NG. So there to
modify the landing gear, to mount the engines even further forward and higher.
And the engines were bigger. But the engines were, on the whole, they were very
good new development. The same type of engines that you could get for the new
Airbus - CFM international. And so we decided to make the Boeing 737 4th
generation and call it "the Max".So when we analyze accidents, we use a causal
analysis method called Why-Because analysis. And we have some counterfactual
tests which determines if something is a cause of something else. We call it a
necessary causal factor. And it's very simple. A is a causal factor of B, if you
can say had A not happened, then B would not have happened either. So, I mean, you
need to show for everything that there is a causal relationship and that all the
factors that you have found actually sufficient to cause the other event. So
you can probably not read everything of it, but it's not really important. This is
a simplified graph and I will show the relevant details later.And this is the
analysis that I made of these accidents. And you can see it's not a simple tree; as
computer scientists, many of you are familiar with trees and this is just a
directed graph and it can have branches and so on. And so some things are causal
influence, causal effect of several different things. So some of the factors
actually have an influence on multiple levels. For example, the airspeed
influences the control forces and it also influences the time the crew had to
recover the aircraft before impact with the ground. So these are some of the
things that I will look at in a bit more detail. So here is one of them:
Uncommanded nose down trim. So what happened apparently on these accident
flights was that you can see it in the flight data recorder traces. I don't know.
Can you see the mouse pointer? Here, that's the blue line. And that is labeled
trim manual. And there's the orange line that is labeled Trim Automatic. And if
they have, do displacement to the bottom, that means that the aircraft is being
trimmed nose down, which means in order to continue to fly level, you have to pull
the control column with more force towards you. And what you can see is in the
beginning, there are a few trim, trim movements. And on this type, they are
expected it has an automatic trim system for some phases of flight which trims the
aircraft to keep it flying stable. And then after a while, it started doing many
automatic nose down trim movements. Each of these lasts almost 10 seconds and there
is a pause between them. And in every case, the pilots counter the nose down
trim movement with the nose up trim movement on the control yoke. There are
switches that you operate with your thumb and you can trim the aircraft that way and
change the control forces and cause the aircraft nose to go up or down. So for a
very long time, this went on: The computer trimmed the aircraft nose down, the pilots
trimmed the aircraft nose up, and so on. Until at the very end, you can see that
the trim, the nose up trim movements that the pilots made, become shorter and
shorter. And this line here, it says pitch trim position. That is the resulting
position of the trim control surface, which is the entire horizontal stabilizer
on the aircraft. And it moves down and it doesn't really go up anymore because the
pilot inputs become very short. And that means the control forces to keep the
aircraft flying level become extremely high. And in the end, it became
uncontrollable and crashed, as you can see here. So the pilots, for various reasons,
which I will highlight later, the pilots were unable to trim the aircraft manually
and the nose down trim persisted and the aircraft crashed. And this is only the
graph of one of the accidents. But the other one is very similar. And so that's
what we see. There is a known system, which was already known before on the
Boeing 737. I think it's available on all the old versions as well, which is
called the speed trim system, which in some circumstances trims the aircraft
automatically. But the inputs that we see, the automatic trim inputs don't really fit
the so-called speed trim system. And so for the first time, we hear the word MCAS.
And we'll talk a bit more about what made the Boeing 737 different from all the
previous models. And that is the bigger engines. As I said, the engines were much
bigger. And to achieve the necessary ground clearance, they had to be
mounted further forward. And there are also a lot bigger, which means at high
angles of attack, when the aircraft is flying against the stream of the oncoming
air at a higher angle, these engine cells produce additional lift in front of the
center of gravity, which creates a pitch up moment. And the certification criteria
are quite strict in that and say exactly what the forces on the
flight controls must be to be certified. And due to the bigger engines, there was
some phases or some angles of attack at which these certification criteria were no
longer met. And so it was decided to introduce a small piece of software which
would just introduce a small trim movement to bring it in line with certification
criteria again. And one of the reasons this was done was probably so the aircraft
could retain the same type certificate as was mentioned in the introduction. So
pilots can change within one airline, between the aircraft, between the 737 NG
and the 737 Max. They have the same type certificate. There's a very brief
differences training, but they can switch even in line operations between the
aircraft from day to day. And another reason. No other changes were made. Boeing
could, for example, have made a longer main landing gear to create additional
ground clearance to move the engines in a more traditional position, that would have
probably made it more aerodynamically in line with certification criteria. I
hesitate to say the word "to make it more stable" because even as it is, the Boeing
737 Max is not inherently aerodynamically unstable. If all these electronic gimmicks
fail, it will just fly like an airplane and it is probably in the normal flight
envelope easily controllable. But to make big mechanical changes would have delayed
the project a lot and would have required recertification and what instead could be
done with the airframe essentially the same. The certification could be what is
known as grandfathered: so it doesn't need to fulfill all the current criteria of
certification, because the aircraft has been certified and has been proven in
service. And so only some of the modifications need to be recertified,
which is much easier and much cheaper and much quicker. So this is one of the
certification criteria that must be fulfilled. It's even though I have removed
some of the additional stuff that doesn't really add anything useful, it's still
rather complicated. It's a procedure that you have to do where you slow down one
knot per second. And the stick forces need to increase with every knot of speed that
you lose and things like that. And it says it this stick force versus speed curve may
not be less than one pound for each six knots. And it's quite interesting, if you
look at the European certification criteria, is that they took this exact
paragraph and just translated the US units into metric units, but really calculated
the new value. So the European certification have now very strange values
like, I don't know, 11.79 kilometers per hour, per second or something like that.
It's really strange. So you can see where it comes from. But they said we can't have
knots even though the entire world except Russia and China basically flies in knots,
even Western Europe. But the criteria in the certification specification need to be
in kilometers per hour. Well, I would have thought that you would even - if you do
the conversion, you would use meters per second, but it used kilometers per hour
for whatever reason. So due to the aerodynamic changes that were made, the
Max did not quite fulfill the criteria to the letter. So something had to be done.
And as I said, mechanical redesign was out of the question because it would have
taken too long, would have been too expensive, and maybe would have broken the
type certificate commonality. So they introduced just this little additional
software in a computer that also existed already. And so it measures angle of
attack, it measures airspeed and a few other parameters, flap configuration, for
example, and then it applies nose down pitch trim as it sees fit. But it has a
rather interesting design from a software engineering point of view. Can you read
that? Is that... They are flight control computers. And one part of this flight
control computer, one additional piece of software, is called the MCAS, the
Maneuvering Characteristics Augmentation System. And the flight control computer
actually gets input from both angle of attack sensors. It has two, one on each
side for redundancy, but the MCAS algorithm only uses one of them, at least
in the old version. In the new version, it will probably use both if it ever gets
recertificated. And then if that angle of attack sensor senses a value that is too
high, then it introduces nose down trim and it may switch between flights between
the left and the right sensor. But at any given time for any given flight, it only
ever uses one. So what could possibly go wrong here? Here we can see what went
wrong. It's the same graph as before, and I may direct your attention to this red
line that says angle of attack indicated left and the green line which says angle
of attack indicated right. So that is the data that the computer got from the angle
of attack sensors. Both are recorded in the data recorder, but only one is
evaluated by the MCAS. And you can see here's the scale on the right. You can see
that one is indicating relatively normally around zero, a bit above zero, which is to
be expected during takeoff and climb. And the red value is about 20 degrees higher.
And of course, that is above the threshold at which the MCAS activates. So it
activates. Right. And apparently in the old version of the software, there were no
sanity checks, no cross checks with other air data values like airspeed and altitude
or other things. And it would be relatively easy to do. Not quite trivial.
You have to get it right in these kinds of things which influence flight controls,
but nothing too fancy. But apparently that was also not done. So the MCAS became
active. So how could it happen? And it's still to me, a bit of a mystery how it
could actually get so far that it could be certified with this kind of system. And
the severity of each failure, the possible consequences have to be evaluated. And the
certification criteria specify five severities: catastrophic, hazardous,
major, minor and no safety effect, and that doesn't have to be analyzed any
further, but for catastrophic failures, you have to do a very, very complex risk
assessment and see what you can do and what needs to be done to bring it in line,
to make it either mitigate the consequences or make it so extremely
improbable that it is not going to happen. So here are the probabilities with which
the certification criteria deal and its different orders of magnitude. There are
usually two orders of magnitude between them. It's from a probability of 1 times
10 to the minus 5 per hour to 1 times 10 to the minus 9 for operating hour. And
this is the risk matrix. Many of you are probably familiar with those. And it
basically says if something is major, then it may not happen with a probability of
probable. And if its catastrophic the only probability that is allowed for that is
extremely improbable. Which is less than once in a billion flight hours. Right. And
to put that into perspective, the fleets with the most flight hours to date, I
think, are in the low hundreds of millions of flight hours combined. So we're still
even for the 737 or the A320. We're still quite far away from a billion flight
hours. So you might have expected perhaps one of these events because statistical
distribution being what it is, the one event might happen, of course, and but
certainly not two in less than two years. And quite obviously, the severity of these
failures was catastrophic. I think there's no - there's no discussion about that. And
here's the relevant part, actually, about flight controls and the
certification criteria, which was clearly violated. It says the airplane must be
shown to be capable of continued safe flight for any single failure. Without
further qualification, any single system that can break must not make the plane
unflyable or any combination of failures not shown to be extremely improbable - and
extremely improbable is these 10 to the minus 9 per hour. And this hazard
assessment must be performed for all systems, of course, and severity must be
assigned to all these. And the unintended MCAS activation was classified as major.
And let's briefly look at that. What's major? Reduction in capability, maybe some
injuries, major damage. So nothing you can just shrug off, but certainly not an
accident with hundreds of dead. So and therefore, there are some regulations
which say which kinds of specific analysis you have to do for the various categories.
And for major no big failure modes and effects analysis FMEA, was required. And
these are all findings from the Indonesian investigation board. And they're all in
the report that is publicly downloadable. In the final version of the slides, I'll
probably put some of the sources and links in there so you can read it for
yourselves. It's quite eye opening. So only a very small failure in failure
analysis was made, comparatively small. It probably took a few man hours, but not as
extensive as it should have been for the event had it been correctly classified as
catastrophic. And some of these things that could happen were not at all
considered, such as large stabilizer deflection. So continued trim movement in
the same direction or a repeated activation of the MCAS system, because
apparently the only design of the MCAS system that the FAA saw was limited to a
0.6 degree deflection at high speeds and to one single activation only. And that
was changed. And it is still unclear how that could happen. It was changed to
multiple activations, even at high speed. And each activation could move the
stabilizer as much as almost 2.5 degrees. And there was no limit to how often it
could activate. And what was also not considered was the effect of the flight
characteristics caused by large movements of the stabilizer or movement of the
stabilizer to the limit of the MCAS authority. The MCAS doesn't have authority
to move the stabilizer all the way to the mechanical stop, but only a bit short of
that, much more than the manual electric trim is capable of trimming the airplane
on the aircraft. You can always trim back with a manual electric trim switches on
the yoke, but you cannot trim it nose down as far as MCAS can. So that's quite
interesting. That was not considered. What was also not considered, at least it
wasn't in the report apparently that the Indonesian agency had seen, was that
flight crew workload increases dramatically if you have to pull on the
yoke continuously with about, let's say, a force equivalent of 40 kilograms of 50
kilograms continuously, otherwise if you let go, you're going to go into a very
steep nosedive. And at that short, it is at a low altitude that they were they
would not have been able to recover the aircraft. And in fact, they weren't. What
was also not considered was an AOA sensor failure in the way that we have seen it in
these two accidents, although apparently they those had different causes. The
effect for the MCAS was the same, that one of the sensors showed a value that was
about 22 and a half degrees too high. And that was not considered in the analysis of
the MCAS system. So I hope that is readable. That is a simplified state
machine of the MCAS system. And what we can see is that it can indeed activate
repeatedly, but only if the pilot uses the manual electric trim in between. It will
go into a dormant state if the pilot trims manually with the hand wheel or if the
pilot doesn't use the trim at all, it will go dormant after a single activation and
stay that way until electric trim is used. So that's the basic upshot of this state
machine. So when the pilot thinks he's doing something to counter the MCAS and
he's actually making it worse. But this isn't documented in any pilot
documentation anywhere. It will probably be in the next way. If it's still working
like that. But so far it wasn't. So Boeing was under a lot of pressure to try
to sell a new, more fuel efficient version of their 737. And so I can't say for sure
how it was internally between the FAA and Boeing, but it's not unreasonable to
assume that they were under a lot of pressure from management to accelerate
certification and possibly take shortcuts. I can't make any accusations here, but it
looks that not all is well in the certification department between Boeing
and the Federal Aviation Authority. So originally, the idea, of course, is the
manufacture builds the aircraft, analyzes everything, documents everything, and the
FAA checks all the documentation and maybe even looks at original data and maybe
looks at the physical pieces that are being made for the prototype and approves
or rejects the documentation. There is already a potential conflict that is not
there in most other countries because they have separate agencies. But the FAA has a
dual mandate. It is supposed to promote aviation, to make it more efficient, but
also to ensure aviation safety. And there may be conflicts of interests, I think. So
here's what this certification has been up until not quite sure, 10, 15 years ago. So
the FAA, the actual government agency, the Aviation Authority, appoints a designated
engineering representative. The DER is employed and paid by Boeing, but is
accountable only to the FAA. And the DER checks and documents everything that is
being done. There's usually more than one, thatt for simplicity's sake, let's say. And
the DER then reports the findings and all the documentation, all the low level
engineering and analysis documentation that has been done to the FAA, and the FAA
signs off on that or asks questions and visits the company and looks at things and
makes audits and everything like that. And so that usually has been working more or
less and has certainly improved the overall safety of airliners that have been
built in the last decades. And this is the new version. And the person is
now not called DER, but it's called AR, the authorized representative, is still
employed and paid by Boeing. That hasn't changed, but is appointed by Boeing
management and reports to Boeing management. And the Boeing management
compiles a report and sends that to the FAA and the FAA then signs off on the
report. They hopefully at least read it, but they don't have all the low level
engineering details readily available and only rarely speak to the actual engineers.
So anyone seeing a problem here? Well, you have to say that most aircraft that are
being built have been built in the last years aren't really terrible. Right. The
787 is a new aircraft. The 777 has been one of the safest aircraft
around, at least looking at the flight hours that it has accumulated. So it's not
all bad, but there's potential for real, really bad screw ups. I guess. There's
another factor maybe that I've briefly mentioned is that the Boeing 737, even in
its latest version, is not computer controlled. It's not fly by wire, although
it has some computers as we have seen, that can move some control surfaces. But
mostly it's really, it really looks like that. I think that's an actual photo from
a 737 has some corrosion on it. So it's probably not a max an older version, but
it's basically the same, which is also why the grandfathering certification still
works. So it's all cables and pulleys and even if both hydraulic systems fails - so,
yes, it is hydraulically assisted, the flight controls - but if both hydraulic
systems fail with the combined forces of both pilots, you can you can still fly it
and you can still land it. That usually works, except when it doesn't. And the
cases where it doesn't work are when the aircraft is going very fast and has a very
high stabilizer deflection. And this is from a video some of you may have seen
there, it's from Mentour Pilot. And he has actually tested that in a full flight
simulator, which represents realistic forces on all flight controls, including
the trim wheel. You can be in the center console under the thrust levers, there are
these two shiny black wheels and they are the trim wheels. You can move them
manually in all phases of flight to trim the aircraft. If electric trim is not
available. Pilot: in the normal trim system would not
do this. OK. It would require manual trimming to get it away from this. That's
fine, it's fine, trim it backwards. Trim it backwards again
Bernd: So now he is trying to trim it nose up again after he has manually trimmed it
nose down because the normal electric trim system cannot trim it so far nose down.
They have to do it manually. And now he is trying to trim it back nose up from the
position which is known from the flight data recorder that it was in the
accident flight and is trying to trim it manually because some people said: "oh,
turn off the electric trim, the electric trim system and trim it manually. That
will always work." And they're trying to do that. And it has representative forces
to the real aircraft. Copilot: Oh my god.
*heavy breathing* Pilot: Ok, pause the rec...
Bernd: and you can see that the pilot on the left, the captain, can't even help
him. In theory, both could turn the crank at the same time. And they have a handle
on both sides because he has to hold the control column with all his force. So you
can't let go. He must hold it with both arms. Otherwise, it would go into a
nosedive immediately. And this is the physical situation with which the pilots
were confronted in the accident flight. And he now says: "press the red button in
the simulator." So end the simulation because it's clear that they're going to crash.
So there is another thing that came that came up after the accidents and 737
pilot said: "oh, it's just a runaway trim, runaway stabilizer trim, there's a
procedure for that and just do the procedure and you'll be fine." Well,
runaway stabilizer trim is one of the emergency procedures that is trained ad
infinitum. Right. That's something that every 737 pilot is aware of because there
are some conditions under which the trim motor always gets electric current and
doesn't stop running. That just happens occasionally, not very often, but
occasionally. And every pilot is primed to recognize the symptoms. Oh, this is one of
a runaway stabilizer. And you turn off the electric motors for the stabilizer trim
and trim manually and that'll work. But if you look at what are the actual symptoms
of runaway stabilizer, it says uncommanded stabilizer trim movement occurs
continuously. And MCAS movement isn't continuously, MCAS trim movement is more
like the speed trim system, which occurs intermittently and then stops and then
trims again for a bit and then stops again. So most pilots wouldn't recognize
this as a runaway trim, because the symptoms are very different. The
circumstances are different. So I guess some pilots might have recognized that
there's something going on with the trim that is not right and will have turned it
off. But some didn't, even though they know they all know about runaway
stabilizer. And yeah, that's the second file that I have.
*loud rattling noise* So that's the sound. The stick shaker
makes on a Boeing 737. And now imagine flying with that sound all the while
shaking the control column violently, flying with that going on for an hour. And
that's what the crew on the previous flight did. They flew the entire flight of
about an hour with a stick shaker going. I mean, that's quite that's quite
interesting because the stick shaker says your wing is about to stall. Right. But on
the other hand, they knew they were flying level. They were flying fast enough.
Everything was fine. The aircraft wasn't about to stall because it was going fast
and. Right. So from an aerodynamics perspective, of course, they could fly the
airplane because they knew it was nowhere near a stall. But still, I think in most
countries and most airlines, they would have just turned around and landed again
and saying the aircraft is broken, please fix it. Something is wrong. But yeah. So
the stick shaker is activated by the angle of attack reading on each side and it
sticks out mechanically coupled of both of them will shake with activation from
either side. So is it going to fly again? It's still somewhat of an open question,
but I suspect that it will because it's it's hard to imagine that letting these
460 airplanes or some something like that that have been built sometimes sitting
around on an employee parking lots like here, just letting them be scrapped or
whatever. I don't know. Almost 5000 have been ordered. As I said, neither airlines
nor Boeing will be happy. But it's not quite clear. It's not yet being certified
again. So it's still unairworthy. So there's another little thing,
certification issues with new Boeing aircraft. Reminded me of this. Have you
ever seen that? So battery exhaust, which the aircraft has a battery exhaust? I
mean, what did you do with that? Does anybody know? Yeah, of course some know.
Yeah. Boeing 787 Dreamliner. Less than two years after introduction. Now, after
entering the service, actually had two major battery fires. They have two big
lithium ion batteries. Lithium, lithium, cobalt. I think, not sure. The one that
burns the brightest. *laughter*
Bernd: Because they wanted the energy density, really, and that wasn't available
in other packages. If they had used nickel cadmium batteries instead, they would have
been like 40 kilograms heavier for two batteries. That's almost a passenger. So
yeah, they were onboard fires. And if you ask pilots what's your worst fear of
something happening in flight, they'll say: flight control failure and fire. So
you don't want to have a fire in the air, absolutely not. And one of the fires was
actually in-flight with passengers on board. One was on the ground shortly after
disembarking and the lithium ion batteries, because they are unusual and a
novel feature, as it's called, have special certification conditions because
they are not covered by the original certification criteria, and it says here:
Safe cell temperatures and pressures must be maintained during any foreseeable
condition and during any failure of the charging system, not shown to be extremely
improbable... extremely remote, sorry, and extremely remote is actually two orders of
magnitude more frequent than extremely improbable. Extremely remote is only less
than once every 10 million flight hours. But I think the combined flight hours for
the 787 at that time were, not quite sure, maybe a few hundred thousand at most. So
and also happened two times. There was not really not really fun. And then it says no
explosive or toxic gases emitted as the result of any failure may accumulate in
hazardous quantities within the airplane. I think they've neatly solved the third
point by putting the battery in a stainless steel box, really thick walls
maybe, I don't know, eight millimeters or something like that. And piping them to
this hole in the bottom of the aircraft. So the gases cannot accumulate in the
aircraft, obviously. So, yes. And with that, I'm at the end of my talk and
there's now, I think quite some time for questions. Thank you.
*applause*
Herald: Extremely punctual, I have to say. Thank you for this interesting talk. We do
have the opportunity for quite some questions and a healthy discussion. Please
come to the microphones that we have distributed through the hall. And while
you queue up behind them: Do we have a question from the Internet already? Dear
signal Angel. Is your microphone working? Signal Angel: No.
Herald: Yes. Signal Angel: Yes. Do you think extensive
software tests could have solved this situation?
Bernd: Software tests in this case, perhaps? Yes. Although software tests are
really a problematic thing because to test software to these extreme reliability is
required. You really have to test them for a very, very, very, very long time indeed.
So to achieve some confidence, they have 99 percent that a failure will not occur
in, say, 10 million hours, you will have to test it for 45 million hours. Really.
And you have to test it with the exact conditions that will occur in flight. And
apparently nobody's thought of an angle of attack failure, angle of attack sensor
failure. So maybe testing wouldn't have done a lot in this case.
Herald: Thank you. Microphone number four. Mic4: Yes. Thank you for the talk. I've
got a question concerning the grounding. So what is your view that the FAA waited
so long until they finally ground the aircraft a week after the Chinese started
with grounding. Bernd: Yes, that's a good point. And I
think it's an absolute disgrace that they waited so long. Even after the first
crash. They made an internal study and it was reported in the news some some weeks
ago and estimated that during the lifetime of the 737 max, probably around 15
aircraft would crash. So I say every two to three years, one of them would crash
and they still didn't ground it and waited until four days after the second accident.
Yes, it's a shame, really. Herald: Thank you. Microphone number
seven, please. Mic7: Thank you for your talk. I have a
question regarding the design decision to only use one AOA sensor. So I've read that
Boeing used the MCAS system before on a military aircraft and that used both
sensors. So why was that decision made to downgrade?
Bernd: Yeah, that's a good question. I'm not aware of that military system. If that
was really exactly the same. But if that's the case, yes, that makes it even stranger
that they chose to use only one in this case. Yes. Thank you.
Herald: Okay, Microphone number two, please.
Mic2: Yeah. Thank you for your talk. So how do you actually test these
requirements in practice? So how you determine in practice if something is
likely to fail every ten to the minus nine as opposed to every ten to the minus
eight? Bernd: No, that's that's obviously
practically completely impossible. You can't. As I said, if you want to have a
reasonable confidence that it's really the error rate is really so low, you'd have to
test it for four and a half billion hours in operation, which is just impossible.
What instead is done: there are some, industry standards for aviation that is
DEO178 currently in revision C, and that says if you have software that if it
fails, may have consequences of this severity, then you have to use these
very strict, very formal methods for developing the software, like doing very
strict and formal requirements analysis specification in a formal language,
preferably. And um, if possible, and some some companies actually do that, formally
prove your source code correct. And in some languages that can be done. But it's
it's very, it's a lot of effort. And that's how this should be done. And this
software obviously should have been developed to the highest level according
to the DEO178, which is level A and quite obviously it wasn't.
Herald: Thank you. Signal Angel, please. The next question from the Internet.
Signal Angel: The talk focused most on MCAS, but someone noted that the plane was
actually designed for engines below the wings and the NG model, so the one before,
already had problems of the wing mounts and engine mounts. Do you think there will
be mechanical problems with Max, too? Bernd: I'm not sure there were really
mechanical problems. There were aerodynamic problems. And apparently.
Well, I'm sure they have tested the NG to the same standards, to the same
certification standards, because obviously there were aerodynamic changes even with
the NG. And the NG apparently still fulfilled the formal criteria of the
certification. There are some acceptable means of compliance and quite specific
descriptions, how you test these stick forces versus airspeed. And as far as I
know, the NG just fulfilled them. And the Max just didn't. So for the Max, something
was required, although even the classic, which basically at the same
engine as the NG. Even the classic had some problems there. That's where the
speed trim system was introduced. And so it has a similar system and actually the
MCAS is just another little algorithm in the computer that also does the speed trim
system. Herald: Please stay seated and buckled up
until we reach our parking position. No. We are still in the Q&A phase. Please
stay seated and please be quiet so we can enjoy all of this talk. And if you have to
have to leave, then be super quiet right now. It is a way too loud in here, please.
The next question from microphone number one.
Mic1: So considering lessons learned from this accident, has the FAA already changed
the certification process or are they about to change it? Or on what about other
agencies worldwide? Bernd: The FAA is probably going to move
very slow. And I'm not aware of any specific changes yet, but I haven't looked
into too much detail in that. Other certification agencies work somewhat
different. And at least the EASA in Europe and the Chinese authorities have already
indicated that in this case they are not going to follow the FAA certification, but
going to do their own. And until now, it was usually the case that if the FAA
certified the airplane, everybody else in the world just took that certification and
said what the FAA did is probably fine and vise versa. When the EASA certified a
Boeing airplane, then the FAA would also certify it. And that is probably changing
now. Herald: Thank you. Microphone number 3.
Mic3: So, hi. Thank you for this talk. Two questions, please. Were you part of an
official investigation or is this your own analysis of the facts? Here's the other
one. I heard something about this software being outsourced to India. Can you comment
on that, please? Bernd: The first one: no, this is my own
private analysis. I have been doing some accident analysis for a living for a
while, but not for any official agency, but always for private customers.
And about outsourcing to India, I'm not quite sure about that. I've read
something like that. And what I've read is that it was produced by Honeywell. I
think. I may be wrong about that, but I think it was Honeywell. And who the actual
programmers were sitting. If it's done properly, according to the methodologies
prescribed by DO178 and fulfilling all those requirements, then where the
programmer sit is actually not that important. And I don't want to deride
Indian programmers, and I think if it's done according to specification and
analyzed with study code analyses and everything else vis a vis the
specification, then that would also be fine, I guess. But the problem is not so
much really in the implementation, but in the design of the system, in the
architecture. Herald: Thank you. Microphone number 5
please. Mic5: Hello. I may go to your
presentation wrong, but for me, the real root cause of the problem is the
competition and high deadline from the management. So the question for you is: is
there any suggestions from you that process could be, I dunno, maybe changed
in order to avoid the bugs in the software and have the mission
critical systems saved? Bernd: Yeah. So we don't normally just
talk about THE cause or THE root cause, but there are always several causes.
Basically you can say depending on where you stop with the graph - where is it? -
where you stop with the graph all the leaves on the graph are root causes and
but I've stopped relatively early and not not I'm not gone into any more detail on
that, but yeah. The competition between Airbus and Boeing, obviously it was a big
factor in this. And I don't suppose you do suggest that we abolish competition in the
market. But what needs to be changed, I think, is the way certification is done.
And that requires the FAA reasserting its authority much more. And that will
probably require a lot more personnel with good engineering background, and maybe
that would require the FAA paying better wages. So I don't know, because currently
probably all the good engineers will go to Boeing instead of the FAA. But the FAA
dearly needs engineering expertise and lots of it.
Herald: Thank you. The next question we hear from microphone number 4.
Mic4: Hi. Thank you for the talk. I've heard that there is - I've heard - I've
read that there's a version of the 737 Max 8 that did allow for a third airway
sensitivity present that served as a backup for either sensors but that this
was a paid option. And I have not found confirmation of this. Do you know anything
about this? Bernd: No, I'm not aware of that
as a paid option. There was something about an optional feature that was called
a safety feature, but I can't exactly remember what that was. Maybe it was and
angle of attack indicator in the cockpit that is available as an option, I think,
for this 737 for most models, because the sensor is there anyway. As for a third AOA
sensor, I'd be surprised if that was an option because that is a major change and
requires a major change to all the system layout. Then you'd need an additional a
data inertial reference unit, which is a big computer box in the aircraft of which
there are only two. And that would've taken a long, long time in addition to
develop. So I'm skeptical about that third angle of attack sensor. At least I've not
heard of it. Herald: Thank you. Signal angel, do we
have more from the internet? Please one quick one.
Signal angel: If you need a quick one, would you ever fly with a 737 Max again if
it was ever cleared again? *applause*
Bernd: I was expecting that question. And actually I don't have an answer yet for
that. And that maybe would depend on how I see the FAA and the EASA doing the
certification. I've seen some people saying that the 737 Max should never be
recertified. I think that it will be. And I look at it in some detail, seeing how
the FAA develops and how the EASA is handling it. And then maybe. Yes.
Herald: Great. Okay, in that case, we would take one more very short question
from microphone number 5. Mic5: Do you know why the important AOA
sensor failed to give the correct values? Bernd: There are some theories about that, but
I haven't investigated that in any more detail now. There were some stories that
in the case of the Indonesian, the Lion Air, that it was actually mounted or
reassembled incorrectly. That would explain why there was a constant offset.
It may also have been somebody calculated that it was actually, exactly - if you
look at the raw data that is being delivered on the bus -, there was exactly
one flipped bit, which is also a possibility. But I I don't really know.
But there were some implications in the report. Maybe I have to read that section
again from the Indonesian authorities about substandard maintenance, as it is
euphemistically called. Herald: OK. We have two more minutes. So I
will take another question from microphone number 1.
Mic1: Hey, I would have expected that modern aircraft would have some plug,
physical plug, hermetic one that would disconnect any automated system. Isn't
this something that exist in our planes today?
Bernd: Now, and especially modern aircraft can't just disconnect the automatics,
because if you look at modern fly by wire aircraft, there is no connection between
the flight controls and the control surfaces. There's only a computer and the
flight controls that the pilots handle are only inputs to the computer and there's no
direct connection. That is true for every Airbus since the A320, for every Boeing
since the triple 7, so the triple 7 and the 787 are totally 100 percent fly by
wire. Well, I think 95 percent because there's one control service that is
directly connected, one spoiler on each side. But basically, there's there's no
way. And so you have to make sure that flight control software is developed to
the highest possible standards. Because you can't turn it off, because that's
everything. That's, Well, let me put it this way: On the fly by wire aircraft,
only the computer can control the flight, the flight control surfaces know. So I
just hope that it's good. Herald: Think about that when you next
enter a plane. And also, please give a big round of applause for our speaker Bernd.
*applause*
*36c3 postroll music*
Subtitles created by c3subtitles.de in the year 2020. Join, and help us!