Actuarial Outpost
Go Back   Actuarial Outpost > Actuarial Discussion Forum > Risk Management
FlashChat Actuarial Discussion Preliminary Exams CAS/SOA Exams Cyberchat Around the World Suggestions

DW Simpson International Actuarial Jobs
Canada  Asia  Australia  Bermuda  Latin America  Europe

Thread Tools Search this Thread Display Modes
Old 03-26-2019, 07:29 AM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6
Default Bad Organizational Decision-Making

(no, this isn't about either the SOA or CAS)

(this time)

THREAD: If people learn anything useful from the 737MAX tragedy, it should be this: Organizations can make decisions (to ship an unsafe product) that no one inside wants.

The organization is an organism. It has motivations that none of its members do. One cell of this organism may cut a small corner but is assured that due to the safety culture, it will be compensated for in another way.

That works, mostly, until the pressure to deliver and to cut corners pervades the organization on a critical project, and everyone is expecting everyone else to be their backstop. If you understand:

1: The commercial imperative Boeing was under. They had to deliver the MAX on time and without significant changes to the flight manual. Changes to the flight manual would have meant extra pilot training, which they promised the airlines there wouldn't be.

2: The “brick wall” sensor/computer system in the 737. Each of the two redundant computers has its own, completely isolated set of sensors. If there is any failure on one "side", the other side will still work.

If both sides are even looking at both AoA sensors as a cross-check, you don't have that isolation. This creates pressure to show that MCAS is safe with just one sensor, otherwise, a redesign would be required.

3: The last minute surprise in flight testing. After they built the plane, Boeing was ready to start production after flight testing. Flight testing found unfortunately that MCAS needed to be 4x more powerful to maintain stability.

Engineers probably assumed that although MCAS wasn't redundant, the pilots could simply overpower it in a mistaken activation. At the higher setting though, they couldn't, but the train was already leaving the station with no time left for a redesign.

4: The fact that much of the regulatory verification was performed by Boeing employees subject to the same pressures (fast schedule, no flight manual/training changes) as the rest of engineering.

It’s really not a big surprise that it turned out the way it did. It’s not that the engineers or anyone else at Boeing didn’t want to build a safe aircraft. For the organization itself though, perhaps without anyone inside realizing it, safety became a lower priority.

LinkedIn Profile
Reply With Quote
Old 03-26-2019, 09:33 AM
nonlnear nonlnear is offline
Join Date: May 2010
Favorite beer: Civil Society Fresh IPA
Posts: 31,592

Will "building a 737MAX" take over as the management term of art from "driving to Abilene"?
Reply With Quote
Old 03-26-2019, 09:47 AM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

At least nobody died because they went to Abilene.

I hope.

LinkedIn Profile
Reply With Quote
Old 03-26-2019, 11:10 AM
IANAE IANAE is offline
Join Date: Oct 2017
Posts: 246

Timeline: A History of GM's Ignition Switch Defect
Reply With Quote
Old 03-31-2019, 05:28 PM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

The emerging 737 MAX scandal, explained
It’s more than bad software.

Boeing executives are offering a simple explanation for why the company’s best-selling plane in the world, the 737 MAX 8, crashed twice in the past several months, leaving Jakarta, Indonesia, in October and then Addis Ababa, Ethiopia, in March. Executives claimed Wednesday, March 27, that the cause was a software problem — and that a new software upgrade fixes it.

But this open-and-shut version of events conflicts with what diligent reporters in the aviation press have uncovered in the weeks since Asia, Europe, Canada, and then the United States grounded the planes.

The story begins nine years ago when Boeing was faced with a major threat to its bottom line, spurring the airline to rush a series of kludges through the certification process — with an under-resourced Federal Aviation Administration (FAA) seemingly all too eager to help an American company threatened by a foreign competitor, rather than to ask tough questions about the project.

The specifics of what happened in the regulatory system are still emerging (and despite executives’ assurances we don’t even really know what happened on the flights yet). But the big picture is coming into view: A major employer faced a major financial threat, and short-term politics and greed won out over the integrity of the regulatory system. It’s a scandal.

The 737 versus 320 rivalry, explained
There are lots of different passenger airplanes on the market, but just two very similar narrow-body planes dominate domestic (or intra-European) travel. One is the European company Airbus’s 320 family, with models called A318, A319, A320, or A321 depending on how long the plane is. These four variants, by design, have identical flight decks so pilots can be trained to fly them interchangeably.

The 320 family competes with a group of planes that Boeing calls the 737 — there’s a 737-600, a 737-700, a 737-800, and a 737-900 — with higher numbers indicating larger planes. Some of them are also extended-range models that have an ER appended to the name and, as you would probably guess, they have longer ranges.

Importantly, even though there are many different flavors of 737, they are all in some sense the same plane, just as all the different 320 family planes are the same plane. Southwest Airlines, for example, simplifies its overall operations by exclusively flying different 737 variants.

Both the 737 and the 320 come in lots of different flavors, so airlines have plenty of options in terms of what kind of aircraft should fly exactly which route. But because there are only two players in this market, and because their offerings are so fundamentally similar, the competition for this slice of the plane market is both intense and weirdly limited. If one company were to gain a clear technical advantage over the other, it would be a minor catastrophe for the losing company.

And that’s what Boeing thought it was facing.

The A320neo was trouble for Boeing
Jet fuel is a major cost for airlines. With labor costs largely driven by collective bargaining agreements and regulations that require minimum ratios of flight attendants per passenger, fuel is the cost center airlines have the most capacity to do something about. Consequently, improving fuel efficiency has emerged as one of the major bases of competition between airline manufacturers.

If you roll back to 2010, it began to look like Boeing had a real problem in this regard.

Airbus was coming out with an updated version of the A320 family that it called the A320neo, with “neo” meaning “new engine option.” The new engines were going to be a more fuel-efficient design, with a larger diameter than previous A320 engines, that could nonetheless be mounted on what was basically the same airframe. This was a nontrivial engineering undertaking both in designing the new engines and in figuring out how to make them work with the old airframe, but even though it cost a bunch of money, it basically worked. And it raised the question of whether Boeing would respond.

Initial word was that it wouldn’t. As CBS Moneywatch’s Brett Snyder wrote back in December 2010, the basic problem was that you couldn’t slap the new generation of more efficient, larger-diameter engines onto the 737:

One of the issues for Boeing is that it takes more work to put new engines on the 737 than on the A320. The 737 is lower to the ground than the A320, and the new engines have a larger diameter. So while both manufacturers would have to do work, the Boeing guys would have more work to do to jack the airplane up. That will cost more while reducing commonality with the current fleet. As we know from last week, reduced commonality means higher costs for the airlines as well.

Under the circumstances, Boeing’s best option was to just take the hit for a few years and accept that it was going to have to start selling 737s at a discount price while it took the time to design a whole new airplane. That would, of course, be time-consuming and expensive, and during the interim they’d probably lose a bunch of narrow-body sales to Airbus.

The original version of the 737 first flew in 1967, and a decades-old decision about how much height to leave between the wing and the runway left them boxed-out of 21st century engine technology — and there was simply nothing to be done about it.

Unless there was.

Boeing decided to put the too-big engines on anyway
As late as February 2011, Boeing chair and CEO James McNerney was sticking to the plan to design a totally new aircraft.

“We’re not done evaluating this whole situation yet,” he said on an analyst call, “but our current bias is to move to a newer airplane, an all-new airplane, at the end of the decade, beginning of the next decade. It’s our judgment that our customers will wait for us.”

But then in August 2011, Boeing announced that it had lined up orders for 496 re-engined Boeing 737 aircraft from five different airlines.

It’s not entirely clear what happened, but, reading between the lines, it seems that in talking to its customers Boeing reached the conclusion that airlines would not wait for them. Some critical mass of carriers (American Airlines seems to have been particularly influential) was credible enough in its threat to switch to Airbus equipment that Boeing decided it needed to offer 737 buyers a Boeing solution sooner rather than later.

Committing to putting a new engine that didn’t fit on the plane was the corporate version of the Fyre Festival’s “let’s just do it and be legends, man” moment, and it not surprisingly wound up leading to a slew of engineering and regulatory problems.

New engines on an old plane
As the industry trade publication Leeham News and Analysis explained earlier in March, Boeing engineers had been working on the concept that became their 737 MAX even back when the company’s plan was still not to build it.

In a March 2011 interview with Aircraft Technology, Mike Bair, then the head of 737 product development, said that reengineeing was possible.

“There’s been fairly extensive engineering work on it,” he said. “We figured out a way to get a big enough engine under the wing.”

The problem is that an airplane is a big, complicated network of interconnected parts. To get the engine under the 737 wing, engineers had to mount the engine nacelle higher and more forward on the plane. But moving the engine nacelle (and a related change to the nose of the plane) changed the aerodynamics of the plane, such that the plane did not handle properly at a high angle of attack.* That, in turn, led to the creation of the Maneuvering Characteristics Augmentation System (MCAS). It fixed the angle-of-attack problem in most situations, but it created new problems in other situations when it made it difficult for pilots to directly control the plane without being overridden by the MCAS.

On Wednesday, Boeing rolled out a software patch that it says corrects the problem, and it hopes to persuade the FAA to agree.

But note that the underlying problem isn’t really software, it’s with the effort to use software to get around a whole host of other problems.

Trevor Sumner
1of x: BEST analysis of what really is happening on the #Boeing737Max issue from my brother in law @davekammeyer, who’s a pilot, software engineer & deep thinker. Bottom line don’t blame software that’s the band aid for many other engineering and economic forces in effect.������

11:04 AM - Mar 16, 2019 Brooklyn, NY
Twitter Ads info and privacy
6,102 people are talking about this
Recall, after all, that the whole point of the 737 MAX project was to be able to say that the new plane was the same as the old plane. From an engineering perspective, the preferred solution was to actually build a new plane. But for business reasons, Boeing didn’t want a “new plane” that would require a lengthy certification process and extensive (and expensive) new pilot training for its customers. The demand was for a plane that was simultaneously new and not new.

But because the new engines wouldn’t fit under the old wings, the new plane wound up having different aerodynamic properties than the old plane. And because the aerodynamics were different, the flight control systems were also different. But treating the whole thing as a fundamentally different plane would have undermined the whole point. So the FAA and Boeing agreed to sort of fudge it.

The new planes are pretty different
As far as we can tell, the 737 MAX is a perfectly airworthy plane in the sense that error-free piloting allows it to be operated safely.

But pilots of planes that didn’t crash kept noticing the same basic pattern of behavior that is suspected to have been behind the two crashes, according to a Dallas Morning News review of voluntary aircraft incident reports to a NASA database.

The disclosures found by the News reference problems with an autopilot system, and they all occurred during the ascent after takeoff. Many mentioned the plane suddenly nosing down. While records show these flights occurred in October and November, the airlines the pilots were flying for is redacted from the database.

These pilots all safely disabled the MCAS and kept their planes in the air. But one of the pilots reported to the database that it was “unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models.”

The training piece is important because a key selling feature of the 737 MAX was the idea that since it wasn’t really a new plane, pilots didn’t really need to be retrained for the new equipment. As the New York Times reported, “For many new airplane models, pilots train for hours on giant, multimillion-dollar machines, on-the-ground versions of cockpits that mimic the flying experience and teach them new features” while the experienced 737 MAX pilots were allowed light refresher courses that you could do on an iPad.

That let Boeing get the planes into customers’ hands quickly and cheaply, but evidently at the cost of increasing the possibility of pilots not really knowing how to handle the planes, with dire consequences for everyone involved.

The FAA put a lot of faith in Boeing
In a blockbuster March 17 report for the Seattle Times, the newspaper’s aerospace reporter Dominic Gates details the extent to which the FAA delegated crucial evaluations of the 737’s safety to Boeing itself. The delegation, Gates explains, is in part a story of a years-long process during which the FAA “citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.”

But there are indications of failures that were specific to the 737 MAX timeline. In particular, Gates reports that “as certification proceeded, managers prodded them to speed the process” and that “when time was too short for FAA technical staff to complete a review, sometimes managers either signed off on the documents themselves or delegated their review back to Boeing.”

Most of all, decisions about what could and could not be delegated were being made by managers concerned about the timeline, rather than by the agency’s technical experts.

It’s not entirely clear at this point why the FAA was so determined to get the 737 cleared quickly (there will be more investigations), but if you recall the political circumstances of this period in Barack Obama’s presidency, you can quickly get a general sense of the issue.

Boeing is not just a big company with a significant lobbying presence in Washington, it’s a major manufacturing company with a strong global export presence and a source of many good-paying union jobs. In short, it was exactly the kind of company that the powers that be were eager to promote — with the Obama White House, for example, proudly going to bat for the Export-Import Bank as a key way to sustain America’s aerospace industry.

A story about overweening regulators delaying an iconic American company’s product launch and costing us good jobs compared to the European competition would have looked very bad. And the fact that the whole purpose of the plane was to be more fuel-efficient only made getting it off the ground a bigger priority. But the incentives really were reasonably aligned, and Boeing has only caused problems for itself by cutting corners.

Boeing is now in a bad situation
One emblem of the whole situation is that as the 737 MAX engineering team piled kludge on top of kludge, one thing they came up with was a cockpit warning light that would alert the pilots if the plane’s two angle-of-attack sensors disagreed.

But then, as Jon Ostrower reported for the Air Current, Boeing’s team decided to make the warning light an optional add-on, like how car companies will upcharge you for a moon roof.

The light cost $80,000 extra per plane and neither Lion Air nor Ethiopian chose to buy it, perhaps figuring that Boeing would not sell a plane (nor would the FAA allow it to) that was not basically safe to fly. In the wake of the crashes, Boeing has decided to revisit this decision and make the light standard on all aircraft.

Now to be clear, Boeing has lost about $40 billion in stock market valuation since the crash, so it’s not like cheating out on the warning light turned out to have been a brilliant business decision or anything.

This, fundamentally, is one reason the FAA has become comfortable working so closely with Boeing on safety regulations: The nature of the airline industry is such that there’s no real money to be made selling airplanes that have a poor safety track record. One could even imagine sketching out a utopian libertarian argument to the effect that there’s no real need for a government role in certifying new airplanes at all, precisely because there’s no reason to think it’s profitable to make unsafe ones.

The real world, of course, is quite a bit different from that, and different individuals and institutions face particular pressures that can lead them to take actions that don’t collectively make sense. Looking back, Boeing probably wishes it had just stuck with the “build a new plane” plan and stuck it out for a few years of rough sales, rather than ending up in the current situation. Right now they are, in effect, trying to patch things up piecemeal — a software update here, a new warning light there, etc. — in hopes of persuading global regulatory agencies to let their planes fly again.

But even once that’s done, they face the task of convincing airlines to actually go buy their planes. An informative David Ljunggren article for Reuters reminds us that a somewhat comparable situation arose in 1965 when three then-new Boeing 727 jetliners crashed.

There wasn’t really anything unsound about the 727 planes, but many pilots didn’t fully understand how to operate the new flaps — arguably a parallel to the MCAS situation with the 737 MAX — which spurred some additional training and changes to the operation manual. Passengers avoided the planes for months, but eventually came back as there were no more crashes, and the 727 went on to fly safely for decades. Boeing hopes to have a similar happy ending to this saga, but so far they seem to be a long way from that point. And their immediate future likely involves more tough questions.

A political scandal on slow-burn
The 737 MAX was briefly a topic of political controversy in the United States as foreign regulators grounded the planes, but President Donald Trump — after speaking personally to Boeing’s CEO — declined to follow. Many members of Congress (from both parties) called on him to reconsider, which he rather quickly did, pushing the whole topic off Washington’s front burner.

But Trump is generally friendly to Boeing (he even has a Boeing executive serving as acting defense secretary, despite an ongoing ethics inquiry into charges that he unfairly favors his former employer) and Republicans are generally averse to harsh regulatory crackdowns. The most important decisions in the mix appear to have been made back during the Obama administration, so it’s also difficult for Democrats to go after this issue. Meanwhile, Washington has been embroiled in wrangling over special counsel Robert Mueller’s investigation, and a new health care battlefield opened up as well.

That said, on March 27, FAA officials faced the Senate Commerce Committee’s Subcommittee on Aviation and Space at a hearing called by subcommittee Chair Ted Cruz (R-TX). Cruz says he expects to call a second hearing featuring Boeing executives, as well as pilots and other industry players. Cruz was a leader on the anti-Boeing side of the Export-Import Bank fight years ago, so perhaps is more comfortable than others in Congress to take this on.

When the political system does begin to engage on the issue, however, it’s unlikely to stop with just one congressional subcommittee. Billions of dollars are at stake for Boeing, the airlines who fly 737s, and the workers who build the planes. And since a central element of this story is the credibility of the FAA’s own process — both in the eyes of the American people and also in the eyes of foreign regulatory agencies — it almost certainly isn’t going to get sorted out without more involvement from the actual decision-makers in the US government.

* Correction: An earlier version of this article misstated that it was the landing gear, rather than the engine, that had been relocated.


LinkedIn Profile
Reply With Quote
Old 05-31-2019, 10:20 AM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

Different bad decision-making:
A Vale Employee Predicted the Dam Would Fail. He Died When It Collapsed.
Several mine workers warned managers the structure was about to collapse; at least one of them was on the site when it did

Olavo Coelho was unusually subdued in late January and talked to family members about God and the afterlife.

For years, he had worried about the safety of a dam holding waste at the Corrego do Feijao mine, owned by Brazilian iron-ore giant Vale SA. Its longest-serving worker, Mr. Coelho, 63 years old, had recently pointed out cracks, leaks and dark stains in the structure to the company's engineers. After his bosses asked him to examine mud spouting from the dam's face last year, he urged them to evacuate the site, according to his daughter, co-workers and testimony given by his son to prosecutors.

"He was ignored," said his daughter, Flavia Coelho. "He said he was tired of trying to warn them."

Mr. Coelho was having lunch at the mine's busy canteen when the dam collapsed on Friday, Jan. 25. He enjoyed the camaraderie at the mine and often regaled co-workers with stories about his granddaughters. He likely didn't see the mud as it rushed down the valley at 50 miles an hour. It took firefighters nine days to recover his corpse from the putrid, dark orange mud.

Several of the mine's workers warned their bosses the dam was about to collapse, an investigation by The Wall Street Journal has found. The disaster killed 270 people, mostly Vale employees or contractors. Mr. Coelho was among them.

Supervisors brushed aside concerns, in some cases citing fears about extra expenditures that could have cost little more than $1,000, according to Vale employees, contractors at the mine, relatives of employees who died, and prosecutors preparing criminal charges over the tragedy.

Mr. Coelho was one of the first to predict the dam's collapse. Orphaned at the age of 7, he wasn't an engineer; he hadn't even gone to middle school. However, he had worked at the mine since construction on the dam began in the late 1970s.

In the months before the dam's collapse, Mr. Coelho and several of his colleagues had shored up parts of the 280-foot-high dam with sandbags, either on their own or under the direction of engineers, according to Mr. Coelho's daughter, his former colleague and relatives of deceased mine workers.

Vale denied that it ignored warning signs or that it was aware the dam was at risk of imminent collapse. Vale said it increased investments in dam management in Brazil to $70 million this year, up from about $30 million in 2015, when another mine-waste dam it jointly owned 80 miles away in the town of Mariana collapsed, killing 19. The company consulted the world's top engineering experts about the safety of its dams, it said, and trusted an outside audit of the collapsed structure in Brumadinho that had declared it to be stable in September.

When the dam burst, the tsunami of mud was so powerful it overturned houses, mangled trucks and ripped hair off the scalps of women who were among those buried to death.

Eustaquio Antonio de Sousa, 56, said his friend Gilmar Silva, a worker at the mine who died that day, told him he was concerned about the dam's drainage while the pair watched a soccer game days before its collapse. "He said it was dangerous, that it would burst at one moment or another."

Wilson Jose Ferreira, 55, a machine operator, said he tried to warn his bosses about the growing number of leaks. "They paid little attention to us, they didn't believe what we were saying."

Mothers and wives of victims have given similar accounts since the tragedy, explaining how their spouses and children witnessed leaks or helped carry sandbags to the foot of the dam. Several Vale workers said they didn't raise concerns with their bosses for fear of losing their jobs.

A Vale spokeswoman said the company allows employees to file anonymous complaints, and didn't receive messages from staff warning about the dam.

Like many small towns across the region, Brumadinho relies heavily on mining, with limited other job opportunities, family members say, one possible reason workers stayed on the site despite their concerns.

"We talked about the problems at the dam a lot among ourselves, but people were afraid of raising the issues with the bosses," said Helio Goncalves, a retired worker at the mine, who said several of his now-deceased friends had also predicted the dam's collapse in private.

Investigators have struggled to collect enough evidence to charge those at Vale they believe ignored warnings. Many workers are dead. Incident reports filed at the mine's offices were destroyed by the mud.

Now, two whistleblowers who survived the dam's collapse have come forward, according to a person involved in the investigation who didn't name them. These individuals worked at the mine and had technical knowledge of the dam, the person said. They told investigators they had warned Vale managers toward the end of 2018 that the structure presented a "serious risk," said the person.

"There is no way what happened in Brumadinho can be treated as an accident," said Marcelo Kokke, a prosecutor at the Office of the Federal Attorney General who is investigating the tragedy. "If preventive measures had been taken in a consistent way, the disaster could have been avoided, or at least it wouldn't have taken on the proportions that it did."

Prosecutors have told the Journal they expect to file criminal charges in the next few months against individuals and both Vale and its German auditor TUV SUD, which conducted an audit of the dam last year.

Vale said it is cooperating with investigators while carrying out its own probe.

After the 2015 dam disaster in Mariana, which killed far fewer people but devastated the local environment, Vale vowed to shore up its dams.

Edison Albanez, a geologist who worked for Vale until 2011, spent 15 years at the Corrego do Feijao mine. His wife, Sirlei Ribeiro, a lawyer, was one of the few people who fought on behalf of the people living next to the mine, securing funds from Vale to pave local dirt roads. She worried about the stability of the dam after the 2015 disaster in Mariana, although she didn't have any specific evidence.

On the day of the tragedy, Mr. Albanez was out of town at a business meeting, while Ms. Ribeiro stayed at their home at the foot of the mine.

Mr. Albanez rushed home to Brumadinho that Friday afternoon, hoping to find his wife alive. With the main roads to the mine cut off by the mud, he didn't arrive to the spot where his house should have been until nightfall.

"Under the light of the moon, the whole valley was glistening with mud," he said. "The entire topography had changed. It was no longer the same place."

When rescue workers uncovered his wife's body five days after the dam's collapse, her arms were still wrapped around the couple's dead dog.

Mr. Albanez stayed in touch with geologists who continued to work at the Corrego do Feijao mine after he left the company. They told him they had alerted their bosses to cracks on the dam face that concerned them during the three months before its collapse, he said.

"Cracks appear because it's opening, because there is movement," said Mr. Albanez.

Some managers in Vale's regional office and in the Rio de Janeiro headquarters rarely listened to their underlings, he said. "When there's a problem, it's the workers on the ground who know what's going on," he said, fighting back tears during an interview.

Prosecutors believe the company's profit-sharing system may have encouraged some managers to keep down costs, according to one person involved in the investigation by federal and state authorities. Under the arrangement, employees receive an annual bonus of several times their monthly salary, depending on the company's results and their own performance. Prosecutors believe that system and the frequent rotation of staff are partly to blame for the sequence of events that led to the disaster, according to the person involved.

Vale denies that the profit-sharing system gave staff an incentive to reduce dam management costs, saying that the pay is dependent, among other things, on health and safety standards.

One contractor at the Corrego do Feijao mine in Brumadinho recalled how he asked a manager last year for equipment to improve drainage at the dam that would have cost about $1,200. The manager denied the request, the contractor said, joking that they'd be fired if they approved it.

A lawyer representing Vale said he doesn't believe the contractor's statements to be accurate.

Ms. Coelho said her father, who died in the canteen, had told the family that managers had shown concern over costs when he suggested evacuating the mine's roughly 600 workers. "They said that it would cost too much to keep everyone at home."

Lawyers defending Vale and its employees denied the allegation that the dam's managers and engineers cut back on safety measures or knew the dam could collapse, noting they would have been risking their own lives.

The Corrego do Feijao mine accounted for only 2% of Vale's iron ore production. The company said it had stopped dumping mining waste in the fateful dam in 2016 and had been in the process of decommissioning it, with plans to dig out some of the discarded iron deposits before reintegrating the structure into the surroundings.

Vale has pointed to the assurances offered by its safety inspector TUV SUD. The company received about $6,000 to carry out the September audit, as part of a contract worth $620,000 to inspect a series of Vale's dams, according to someone with knowledge of the deal. Inspectors certified the dam as safe despite concerns about its safety, the Journal found in February.

TUV SUD, which said it is cooperating with the authorities and conducting its own probe into the tragedy, declined to comment on the value of its contracts.

Relatives of workers buried to death by the mud said those who expressed fears about the dam overlooked one vital detail. They presumed a warning siren would go off, giving them time to escape.

In the months before the collapse, Vale held a practice evacuation for mine workers and residents. Participants were told where to run should the siren go off and how many minutes they would have to get to a safety point if the dam ruptured.

"My friend's daughter was distraught. They told her she had two minutes but she couldn't run it in less than five," said Anastacia do Carmo Silva, whose son Cleiton was working in the mine's vehicle workshop when the mud hit. An athletic 29-year-old, he easily reached the safety point in the training session.

Not one siren went off on Jan. 25.

"His body was churned up as if he'd been put in a food processor," Ms. Silva said during a small outdoor memorial service to mark the three-month anniversary of the tragedy. "He could only be identified by his DNA."

Organizers have struggled to draw more locals to memorial services, after many believed false rumors that Vale would withdraw financial compensation from those who turned up. Vale agreed in February to pay all of Brumadinho's 40,000 residents as much as $250 each month for the next year.

"There was just that deathly silence and nobody understood what was happening," said Ms. Coelho, who was at home that Friday, cooking lunch for her two daughters when her cousin called her with the news.

It took just 30 seconds for the mud to destroy the buildings closest to the dam, videos of the collapse show. Prosecutors suspect the dam caved in so quickly and abruptly due to a process called liquefaction, whereby its seemingly solid contents suddenly behaved like a liquid and rushed out. That may have buried the main warning siren, they say.

Ms. Coelho moved to a different house after her father died. The memories were too difficult to bear, she said. Her father had knocked down part of the wall of his home that faced theirs and installed a window so he could wave to his granddaughters.

"Every day I would find my youngest daughter hanging out of the window of her bedroom, asking when grandpa was coming back," she said.

In these cases, the ultimate decision-makers are not the ones who die when a bad decision is made.

And they're not out of any of their own money.

They may be out of a job, but that's not quite the same as being dead or out of a lot of their own money.

Here is a key item re: incentives to prevent disaster:
Prosecutors believe the company's profit-sharing system may have encouraged some managers to keep down costs, according to one person involved in the investigation by federal and state authorities. Under the arrangement, employees receive an annual bonus of several times their monthly salary, depending on the company's results and their own performance. Prosecutors believe that system and the frequent rotation of staff are partly to blame for the sequence of events that led to the disaster, according to the person involved.
Oh, and perhaps they'll have serious repercussions:
Prosecutors have told the Journal they expect to file criminal charges in the next few months against individuals and both Vale and its German auditor TUV SUD, which conducted an audit of the dam last year.

LinkedIn Profile
Reply With Quote
Old 06-02-2019, 02:29 PM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

more 737 Max

Boeing Built Deadly Assumptions Into 737 Max, Blind to a Late Design Change

SEATTLE — The fatal flaws with Boeing’s 737 Max can be traced to a breakdown late in the plane’s development, when test pilots, engineers and regulators were left in the dark about a fundamental overhaul to an automated system that would ultimately play a role in two crashes.

A year before the plane was finished, Boeing made the system more aggressive and riskier. While the original version relied on data from at least two types of sensors, the final version used just one, leaving the system without a critical safeguard. In both doomed flights, pilots struggled as a single damaged sensor sent the planes into irrecoverable nose-dives within minutes, killing 346 people and prompting regulators around the world to ground the Max.

But many people involved in building, testing and approving the system, known as MCAS, said they hadn’t fully understood the changes. Current and former employees at Boeing and the Federal Aviation Administration who spoke with The New York Times said they had assumed the system relied on more sensors and would rarely, if ever, activate. Based on those misguided assumptions, many made critical decisions, affecting design, certification and training.

“It doesn’t make any sense,” said a former test pilot who worked on the Max. “I wish I had the full story.”


While prosecutors and lawmakers try to piece together what went wrong, the current and former employees point to the single, fateful decision to change the system, which led to a series of design mistakes and regulatory oversights. As Boeing rushed to get the plane done, many of the employees say, they didn’t recognize the importance of the decision. They described a compartmentalized approach, each of them focusing on a small part of the plane. The process left them without a complete view of a critical and ultimately dangerous system.

The company also played down the scope of the system to regulators. Boeing never disclosed the revamp of MCAS to Federal Aviation Administration officials involved in determining pilot training needs, according to three agency officials. When Boeing asked to remove the description of the system from the pilot’s manual, the F.A.A. agreed. As a result, most Max pilots did not know about the software until after the first crash, in October.

You have 2 free articles remaining.
Subscribe to The Times
“Boeing has no higher priority than the safety of the flying public,” a company spokesman, Gordon Johndroe, said in a statement.

He added that Boeing and regulators had followed standard procedures. “The F.A.A. considered the final configuration and operating parameters of MCAS during Max certification, and concluded that it met all certification and regulatory requirements,” Mr. Johndroe said.

At first, MCAS — Maneuvering Characteristics Augmentation System — wasn’t a very risky piece of software. The system would trigger only in rare conditions, nudging down the nose of the plane to make the Max handle more smoothly during high-speed moves. And it relied on data from multiple sensors measuring the plane’s acceleration and its angle to the wind, helping to ensure that the software didn’t activate erroneously.

Editors’ Picks

36 Hours in Bend, Ore. (and Environs)

My Husband Wore Really Tight Shorts to the Eclipse Party

Why 1999 Was Hollywood’s Greatest Year


Then Boeing engineers reconceived the system, expanding its role to avoid stalls in all types of situations. They allowed the software to operate throughout much more of the flight. They enabled it to aggressively push down the nose of the plane. And they used only data about the plane’s angle, removing some of the safeguards.

Ray Craig, shown in a 2003 Boeing magazine, was the chief test pilot when he put the Max through maneuvers in a flight simulator in 2012.
via Boeing's Aero Magazine

Ray Craig, shown in a 2003 Boeing magazine, was the chief test pilot when he put the Max through maneuvers in a flight simulator in 2012.Creditvia Boeing's Aero Magazine
The disasters might have been avoided, if employees and regulators had a better understanding of MCAS.

A test pilot who originally advocated for the expansion of the system didn’t understand how the changes affected its safety. Safety analysts said they would have acted differently if they had known it used just one sensor. Regulators didn’t conduct a formal safety assessment of the new version of MCAS.

The current and former employees, many of whom spoke on the condition of anonymity because of the continuing investigations, said that after the first crash, they were stunned to discover MCAS relied on a single sensor.

“That’s nuts,” said an engineer who helped design MCAS.

“I’m shocked,” said a safety analyst who scrutinized it.

“To me, it seems like somebody didn’t understand what they were doing,” said an engineer who assessed the system’s sensors.

Subscribe to With Interest
Catch up and prep for the week ahead with this newsletter of the most important business insights, delivered Sundays.


MCAS Is Born
In 2012, the chief test pilot for the Max had a problem.

During the early development of the 737 Max, the pilot, Ray Craig, a silver-haired retired Navy airman, was trying out high-speed situations on a flight simulator, like maneuvers to avoid an obstacle or to escape a powerful vortex from another plane. While such moves might never be necessary for the pilot of a passenger plane, the F.A.A. requires that a jet handle well in those situations.

But the plane wasn’t flying smoothly, partly because of the Max’s bigger engines. To fix the issue, Boeing decided to use a piece of software. The system was meant to work in the background, so pilots effectively wouldn’t know it was there.

Mr. Craig, who had been with Boeing since 1988, didn’t like it, according to one person involved in the testing. An old-school pilot, he eschewed systems that take control from pilots and would have preferred an aerodynamic fix such as vortex generators, thin fins on the wings. But engineers who tested the Max design in a wind tunnel weren’t convinced they would work, the person said.

Mr. Craig relented. Such high-speed situations were so rare that he figured the software would never actually kick in.

To ensure it didn’t misfire, engineers initially designed MCAS to trigger when the plane exceeded at least two separate thresholds, according to three people who worked on the 737 Max. One involved the plane’s angle to the wind, and the other involved so-called G-force, or the force on the plane that typically comes from accelerating.

A Boeing 737-800 flight simulator. When Mr. Craig simulated high-speed maneuvers for the Max, it didn’t fly smoothly, so Boeing settled on MCAS for a fix.
Credit, via Getty Images


A Boeing 737-800 flight simulator. When Mr. Craig simulated high-speed maneuvers for the Max, it didn’t fly smoothly, so Boeing settled on MCAS for a, via Getty Images
The Max would need to hit an exceedingly high G-force that passenger planes would probably never experience. For the jet’s angle, the system took data from the angle-of-attack sensor. The sensor, several inches long, is essentially a small wind vane affixed to the jet’s fuselage.


Adding More Power
On a rainy day in late January 2016, thousands of Boeing employees gathered at a runway next to the 737 factory in Renton, Wash. They cheered as the first Max, nicknamed the Spirit of Renton, lifted off for its maiden test flight.

“The flight was a success,” Ed Wilson, the new chief test pilot for the Max, said in a news release at the time. Mr. Wilson, who had tested Boeing fighter jets, had replaced Mr. Craig the previous year.

“The 737 Max just felt right in flight, giving us complete confidence that this airplane will meet our customers’ expectations,” he said.

But a few weeks later, Mr. Wilson and his co-pilot began noticing that something was off, according to a person with direct knowledge of the flights. The Max wasn’t handling well when nearing stalls at low speeds.

In a meeting at Boeing Field in Seattle, Mr. Wilson told engineers that the issue would need to be fixed. He and his co-pilot proposed MCAS, the person said.

The change didn’t elicit much debate in the group, which included just a handful of people. It was considered “a run-of-the-mill adjustment,” according to the person. Instead, the group mostly discussed the logistics of how MCAS would be used in the new scenarios.

“I don’t recall ever having any real debates over whether it was a good idea or not,” the person said.


The change proved pivotal. Expanding the use of MCAS to lower-speed situations required removing the G-force threshold. MCAS now needed to work at low speeds so G-force didn’t apply.

The change meant that a single angle-of-attack sensor was the lone guard against a misfire. Although modern 737 jets have two angle-of-attack sensors, the final version of MCAS took data from just one.

Ed Wilson, right, with his co-pilot, Craig Bomben, after the first Max test flight in 2016.
Elaine Thompson/Associated Press


Ed Wilson, right, with his co-pilot, Craig Bomben, after the first Max test flight in 2016.CreditElaine Thompson/Associated Press
Using MCAS at lower speeds also required increasing the power of the system. When a plane is flying slowly, flight controls are less sensitive, and far more movement is needed to steer. Think of turning a car’s steering wheel at 20 miles an hour versus 70.

The original version of MCAS could move the stabilizer — the part of the tail that controls the vertical direction of the jet — a maximum of about 0.6 degrees in about 10 seconds. The new version could move the stabilizer up to 2.5 degrees in 10 seconds.

Test pilots aren’t responsible for dealing with the ramifications of such changes. Their job is to ensure the plane handles smoothly. Other colleagues are responsible for making the changes, and still others for assessing their impact on safety.

Boeing declined to say whether the changes had prompted a new internal safety analysis.

While the F.A.A. officials in charge of training didn’t know about the changes, another arm of the agency involved in certification did. But it did not conduct a safety analysis on the changes.


The F.A.A. had already approved the previous version of MCAS. And the agency’s rules didn’t require it to take a second look because the changes didn’t affect how the plane operated in extreme situations.

“The F.A.A. was aware of Boeing’s MCAS design during the certification of the 737 Max,” the agency said in a statement. “Consistent with regulatory requirements, the agency evaluated data and conducted flight tests within the normal flight envelope that included MCAS activation in low-speed stall and other flight conditions.”

‘External Events’
After engineers installed the second version of MCAS, Mr. Wilson and his co-pilot took the 737 Max for a spin.

The flights were uneventful. They tested two potential failures of MCAS: a high-speed maneuver in which the system doesn’t trigger, and a low-speed stall when it activates but then freezes. In both cases, the pilots were able to easily fly the jet, according to a person with knowledge of the flights.

In those flights, they did not test what would happen if MCAS activated as a result of a faulty angle-of-attack sensor — a problem in the two crashes.

Boeing engineers did consider such a possibility in their safety analysis of the original MCAS. They classified the event as “hazardous,” one rung below the most serious designation of catastrophic, according to two people. In regulatory-speak, it meant that MCAS could trigger erroneously less often than once in 10 million flight hours.

Boeing Max fuselages on their way to an assembly plant. The company declined to say whether it had conducted a new safety analysis of the revised MCAS.
William Campbell/Corbis, via Getty Images


Boeing Max fuselages on their way to an assembly plant. The company declined to say whether it had conducted a new safety analysis of the revised MCAS.CreditWilliam Campbell/Corbis, via Getty Images
That probability may have underestimated the risk of so-called external events that have damaged sensors in the past, such as collisions with birds, bumps from ramp stairs or mechanics’ stepping on them. While part of the assessment considers such incidents, they are not included in the probability. Investigators suspect the angle-of-attack sensor was hit on the doomed Ethiopian Airlines flight in March.


Bird strikes on angle-of-attack sensors are relatively common.

A Times review of two F.A.A. databases found hundreds of reports of bent, cracked, sheared-off, poorly installed or otherwise malfunctioning angle-of-attack sensors on commercial aircraft over three decades.

Since 1990, one database has recorded 1,172 instances when birds — meadowlarks, geese, sandpipers, pelicans and turkey vultures, among others — damaged sensors of various kinds, with 122 strikes on angle-of-attack vanes. The other database showed 85 problems with angle-of-attack sensors on Boeing aircraft, including 38 on 737s since 1995.

And the public databases don’t necessarily capture the extent of incidents involving angle-of-attack sensors, since the F.A.A. has additional information. “I feel confidence in saying that there’s a lot more that were struck,” said Richard Dolbeer, a wildlife specialist who has spent over 20 years studying the issue at the United States Department of Agriculture, which tracks the issue for the F.A.A.

A Simple Request
On March 30, 2016, Mark Forkner, the Max’s chief technical pilot, sent an email to senior F.A.A. officials with a seemingly innocuous request: Would it be O.K. to remove MCAS from the pilot’s manual?

The officials, who helped determine pilot training needs, had been briefed on the original version of MCAS months earlier. Mr. Forkner and Boeing never mentioned to them that MCAS was in the midst of an overhaul, according to the three F.A.A. officials.

Under the impression that the system was relatively benign and rarely used, the F.A.A. eventually approved Mr. Forkner’s request, the three officials said.


Boeing wanted to limit changes to the Max, from previous versions of the 737. Anything major could have required airlines to spend millions of dollars on additional training. Boeing, facing competitive pressure from Airbus, tried to avoid that.

Mr. Forkner, a former F.A.A. employee, was at the front lines of this effort. As the chief technical pilot, he was the primary liaison with the F.A.A. on training and worked on the pilot’s manual.

“The pressure on us,” said Rick Ludtke, a cockpit designer on the Max, “was huge.”

“And that all got funneled through Mark,” Mr. Ludtke added. “And the pushback and resistance from the F.A.A. got funneled through Mark.”

Federal Aviation Administration officials said Boeing’s request to remove MCAS from the pilot’s manual didn’t mention that the system was being overhauled.
Jason Redmond/Agence France-Presse — Getty Images


Federal Aviation Administration officials said Boeing’s request to remove MCAS from the pilot’s manual didn’t mention that the system was being overhauled.CreditJason Redmond/Agence France-Presse — Getty Images
Like others, Mr. Forkner may have had an imperfect understanding of MCAS.

Technical pilots at Boeing like him previously flew planes regularly, two former employees said. “Then the company made a strategic change where they decided tech pilots would no longer be active pilots,” Mr. Ludtke said.

Mr. Forkner largely worked on flight simulators, which didn’t fully mimic MCAS.

It is unclear whether Mr. Forkner, now a pilot for Southwest Airlines, was aware of the changes to the system.

Mr. Forkner’s attorney, David Gerger, said his client did not mislead the F.A.A. “Mark is an Air Force veteran who put safety first and was transparent in his work,” Mr. Gerger said.


“In thousands of tests, nothing like this had ever happened,” he said. “Based on what he was told and what he knew, he never dreamed that it could.”

The F.A.A. group that worked with Mr. Forkner made some decisions based on an incomplete view of the system. It never tested a malfunctioning sensor, according to the three officials. It didn’t require additional training.

William Schubbe, a senior F.A.A. official who worked with the training group, told pilots and airlines in an April meeting in Washington, D.C., that Boeing had underplayed MCAS, according to a recording reviewed by The Times.

“The way the system was presented to the F.A.A.,” Mr. Schubbe said, “the Boeing Corporation said this thing is so transparent to the pilot that there’s no need to demonstrate any kind of failing.”

The F.A.A. officials involved in training weren’t the only ones operating with outdated information.

An April 2017 maintenance manual that Boeing provided to airlines refers to the original version of MCAS. By that point, Boeing had started delivering the planes. The current manual is updated.

Boeing continued to defend MCAS and its reliance on a single sensor after the first crash, involving Indonesia’s Lion Air.


At a tense meeting with the pilots’ union at American Airlines in November, Boeing executives dismissed concerns. “It’s been reported that it’s a single point failure, but it is not considered by design or certification a single point,” said Mike Sinnett, a Boeing vice president, according to a recording of the meeting.

His reasoning? The pilots were the backup.

“Because the function and the trained pilot work side by side and are part of the system,” he said.

Four months later, a second 737 Max crashed in Ethiopia. Within days, the Max was grounded around the world.

As part of the fix, Boeing has reworked MCAS to more closely resemble the first version. It will be less aggressive, and it will rely on two sensors.


LinkedIn Profile
Reply With Quote
Old 06-16-2019, 10:28 PM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

Boeing CEO Admits Mistake In 737 MAX Communication

Boeing Chief Executive Officer Dennis Muilenburg says the company should have been more transparent with regulators and the public when Boeing discovered a safety light was not operating as designed.

Muilenburg made the comments to reporters ahead of the Paris Air Show, Boeing spokesman Gordon Johndroe told NPR.

"We clearly fell short in the implementation of the AOA disagree alert and we clearly should have communicated better with our regulators and the airlines," Johndroe said in an interview by phone from Paris.

Boeing's 737 MAX plane has been grounded worldwide since the second of two crashes that together killed 346 people. In both the Lion Air flight in October 2018 and the Ethiopian Airlines flight in March 2019, pilots struggled to overcome a software program known as MCAS that drove the noses of the planes down. Now Boeing is working on a software update that will enable pilots to more easily control their aircraft.

Article continues after sponsor message

Aircraft Orders Jump, But Boeing 737 Max Grounding Could Trim U.S. Growth
Aircraft Orders Jump, But Boeing 737 Max Grounding Could Trim U.S. Growth
The fatal crashes and the ongoing grounding of its fastest-selling plane have cast a shadow over Boeing's appearance at the Paris Air Show, which runs June 17-23.

"The company's presence and activities at the show will demonstrate its commitment to innovation, industry partnerships and safety," Boeing announced.

Both American Airlines and Southwest Airlines have extended 737 MAX flight cancellations through early September. Previously, both airlines had planned to resume flights in August. American says about 115 flights will be canceled daily, and Southwest says about 100 flights will be removed from its daily schedule.

In his comments, Muilenburg referred to a safety feature connected to the sensors that feed into the MCAS software. The software would trigger when the plane was flying at an angle that might make a stall likely. Boeing designed a warning light to alert pilots when the two "angle of attack" sensors disagreed, which could mean MCAS would be triggered incorrectly.

The light was supposed to be standard on all versions of the MAX; however, in practice, it only worked on planes with other safety features that airlines bought for extra cost.

Boeing Knew About 737 Max Sensor Problem Before Plane Crash In Indonesia
Boeing Knew About 737 Max Sensor Problem Before Plane Crash In Indonesia
NPR's Laurel Wamsley has reported that Boeing knew the AOA disagree alert malfunctioned before the Lion Air crash.

Muilenburg conceded that engineers learned in 2017 that the alert light did not work as intended, and he said he was "disappointed" Boeing did not work to make the information more public, The Wall Street Journal reports.

Federal Aviation Administration spokesman Lynn Lunsford told NPR his office is working with Boeing throughout the testing of the software enhancement.

"We have not set a date for the certification flight," Lunsford wrote in an email.

Aviation expert Richard Aboulafia of the Teal Group said Muilenburg's comments appeared to reflect a change in tone.

"It's been a tradeoff. Do you limit the short-term damage from liability cases, or do you focus instead on protecting the long-term brand equity of product and company, and they've been favoring the first option," he said. "That to me is a big mistake which seems to be changing."

Speaking from Paris, Aboulafia told NPR Muilenburg's comments had captured attention of the air show attendees.

"Standing around in cocktail parties, I think that is something people are remarking on."


LinkedIn Profile
Reply With Quote
Old 06-29-2019, 11:40 AM
campbell's Avatar
campbell campbell is offline
Mary Pat Campbell
Join Date: Nov 2003
Location: NY
Studying for duolingo and coursera
Favorite beer: Murphy's Irish Stout
Posts: 90,920
Blog Entries: 6

More 737 Max
Boeing increasingly relied on outsourced $9-an-hour engineers to test software

It remains the mystery at the heart of Boeing Co.'s 737 Max crisis: how a company renowned for meticulous design made seemingly basic software mistakes leading to a pair of deadly crashes. Longtime Boeing engineers say the effort was complicated by a push to outsource work to lower-paid contractors.

The Max software -- plagued by issues that could keep the planes grounded months longer after U.S. regulators this week revealed a new flaw -- was developed at a time Boeing was laying off experienced engineers and pressing suppliers to cut costs.

Increasingly, the iconic American planemaker and its subcontractors have relied on temporary workers making as little as $9 an hour to develop and test software, often from countries lacking a deep background in aerospace -- notably India.

In offices across from Seattle's Boeing Field, recent college graduates employed by the Indian software developer HCL Technologies Ltd. occupied several rows of desks, said Mark Rabin, a former Boeing software engineer who worked in a flight-test group that supported the Max.

The coders from HCL were typically designing to specifications set by Boeing. Still, "it was controversial because it was far less efficient than Boeing engineers just writing the code," Rabin said. Frequently, he recalled, "it took many rounds going back and forth because the code was not done correctly."

Boeing's cultivation of Indian companies appeared to pay other dividends. In recent years, it has won several orders for Indian military and commercial aircraft, such as a $22 billion one in January 2017 to supply SpiceJet Ltd. That order included 100 737-Max 8 jets and represented Boeing's largest order ever from an Indian airline, a coup in a country dominated by Airbus.

Based on resumes posted on social media, HCL engineers helped develop and test the Max's flight-display software, while employees from another Indian company, Cyient Ltd., handled software for flight-test equipment.

HPE announces the world’s most intelligent storage for mission-critical apps
HPE announces the world’s most intelligent storage for mission-critical apps
By Hewlett Packard Enterprise

Costly Delay
In one post, an HCL employee summarized his duties with a reference to the now-infamous model, which started flight tests in January 2016: "Provided quick workaround to resolve production issue which resulted in not delaying flight test of 737-Max (delay in each flight test will cost very big amount for Boeing)."

Boeing said the company did not rely on engineers from HCL and Cyient for the Maneuvering Characteristics Augmentation System, which has been linked to the Lion Air crash last October and the Ethiopian Airlines disaster in March. The Chicago-based planemaker also said it didn't rely on either firm for another software issue disclosed after the crashes: a cockpit warning light that wasn't working for most buyers.

"Boeing has many decades of experience working with supplier/partners around the world," a company spokesman said. "Our primary focus is on always ensuring that our products and services are safe, of the highest quality and comply with all applicable regulations."


In a statement, HCL said it "has a strong and long-standing business relationship with The Boeing Company, and we take pride in the work we do for all our customers. However, HCL does not comment on specific work we do for our customers. HCL is not associated with any ongoing issues with 737 Max."

Recent simulator tests by the Federal Aviation Administration suggest the software issues on Boeing's best-selling model run deeper. The company's shares fell this week after the regulator found a further problem with a computer chip that experienced a lag in emergency response when it was overwhelmed with data.

Engineers who worked on the Max, which Boeing began developing eight years ago to match a rival Airbus SE plane, have complained of pressure from managers to limit changes that might introduce extra time or cost.

"Boeing was doing all kinds of things, everything you can imagine, to reduce cost, including moving work from Puget Sound, because we'd become very expensive here," said Rick Ludtke, a former Boeing flight controls engineer laid off in 2017. "All that's very understandable if you think of it from a business perspective. Slowly over time it appears that's eroded the ability for Puget Sound designers to design."

Rabin, the former software engineer, recalled one manager saying at an all-hands meeting that Boeing didn't need senior engineers because its products were mature. "I was shocked that in a room full of a couple hundred mostly senior engineers we were being told that we weren't needed," said Rabin, who was laid off in 2015.

The typical jetliner has millions of parts -- and millions of lines of code -- and Boeing has long turned over large portions of the work to suppliers who follow its detailed design blueprints.

Starting with the 787 Dreamliner, launched in 2004, it sought to increase profits by instead providing high-level specifications and then asking suppliers to design more parts themselves. The thinking was "they're the experts, you see, and they will take care of all of this stuff for us," said Frank McCormick, a former Boeing flight-controls software engineer who later worked as a consultant to regulators and manufacturers. "This was just nonsense."

Sales are another reason to send the work overseas. In exchange for an $11 billion order in 2005 from Air India, Boeing promised to invest $1.7 billion in Indian companies. That was a boon for HCL and other software developers from India, such as Cyient, whose engineers were widely used in computer-services industries but not yet prominent in aerospace.

Rockwell Collins, which makes cockpit electronics, had been among the first aerospace companies to source significant work in India in 2000, when HCL began testing software there for the Cedar Rapids, Iowa-based company. By 2010, HCL employed more than 400 people at design, development and verification centers for Rockwell Collins in Chennai and Bangalore.

That same year, Boeing opened what it called a "center of excellence" with HCL in Chennai, saying the companies would partner "to create software critical for flight test." In 2011, Boeing named Cyient, then known as Infotech, to a list of its "suppliers of the year" for design, stress analysis and software engineering on the 787 and the 747-8 at another center in Hyderabad.

The Boeing rival also relies in part on offshore engineers. In addition to supporting sales, the planemakers say global design teams add efficiency as they work around the clock. But outsourcing has long been a sore point for some Boeing engineers, who, in addition to fearing job losses say it has led to communications issues and mistakes.

SEATTLE, WA - JUNE 27: Boeing 737 MAX airplanes are stored on employee parking lots near Boeing Field, on June 27, 2019 in Seattle, Washington. After a pair of crashes, the 737 MAX has been grounded by the FAA and other aviation agencies since March, 13, 2019. (Photo by Stephen Brashear/Getty Images)(Stephen Brashear/Getty Images)
SEATTLE, WA - JUNE 27: Boeing 737 MAX airplanes are stored on employee parking lots near Boeing Field, on June 27, 2019 in Seattle, Washington. After a pair of crashes, the 737 MAX has been grounded by the FAA and other aviation agencies since March, 13, 2019. (Photo by Stephen Brashear/Getty Images) (Stephen Brashear/Getty Images)
Moscow Mistakes
Boeing has also expanded a design center in Moscow. At a meeting with a chief 787 engineer in 2008, one staffer complained about sending drawings back to a team in Russia 18 times before they understood that the smoke detectors needed to be connected to the electrical system, said Cynthia Cole, a former Boeing engineer who headed the engineers' union from 2006 to 2010.

"Engineering started becoming a commodity," said Vance Hilderman, who co-founded a company called TekSci that supplied aerospace contract engineers and began losing work to overseas competitors in the early 2000s.

U.S.-based avionics companies in particular moved aggressively, shifting more than 30% of their software engineering offshore versus 10% for European-based firms in recent years, said Hilderman, an avionics safety consultant with three decades of experience whose recent clients include most of the major Boeing suppliers.

With a strong dollar, a big part of the attraction was price. Engineers in India made around $5 an hour; it's now $9 or $10, compared with $35 to $40 for those in the U.S. on an H1B visa, he said. But he'd tell clients the cheaper hourly wage equated to more like $80 because of the need for supervision, and he said his firm won back some business to fix mistakes.

HCL, once known as Hindustan Computers, was founded in 1976 by billionaire Shiv Nadar and now has more than $8.6 billion in annual sales. With 18,000 employees in the U.S. and 15,000 in Europe, HCL is a global company and has deep expertise in computing, said Sukamal Banerjee, a vice president. It has won business from Boeing on that basis, not on price, he said: "We came from a strong R&D background."

Still, for the 787, HCL gave Boeing a remarkable price - free, according to Sam Swaro, an associate vice president who pitched HCL's services at a San Diego conference sponsored by Avionics International magazine in June. He said the company took no up-front payments on the 787 and only started collecting payments based on sales years later, an "innovative business model" he offered to extend to others in the industry.

The 787 entered service three years late and billions of dollars over budget in 2011, in part because of confusion introduced by the outsourcing strategy. Under Dennis Muilenburg, a longtime Boeing engineer who became chief executive in 2015, the company has said that it planned to bring more work back in-house for its newest planes.

Engineer Backwater

The Max became Boeing's top seller soon after it was offered in 2011. But for ambitious engineers, it was something of a "backwater," said Peter Lemme, who designed the 767's automated flight controls and is now a consultant. The Max was an update of a 50-year-old design, and the changes needed to be limited enough that Boeing could produce the new planes like cookie cutters, with few changes for either the assembly line or airlines. "As an engineer that's not the greatest job," he said.

Rockwell Collins, now a unit of United Technologies Corp., won the Max contract for cockpit displays, and it has relied in part on HCL engineers in India, Iowa and the Seattle area. A United Technologies spokeswoman didn't respond to a request for comment.

Contract engineers from Cyient helped test flight test equipment. Charles LoveJoy, a former flight-test instrumentation design engineer at the company, said engineers in the U.S. would review drawings done overnight in India every morning at 7:30 a.m. "We did have our challenges with the India team," he said. "They met the requirements, per se, but you could do it better."

Multiple investigations - including a Justice Department criminal probe - are trying to unravel how and when critical decisions were made about the Max's software. During the crashes of Lion Air and Ethiopian Airlines planes that killed 346 people, investigators suspect, the MCAS system pushed the planes into uncontrollable dives because of bad data from a single sensor.

That design violated basic principles of redundancy for generations of Boeing engineers, and the company apparently never tested to see how the software would respond, Lemme said. "It was a stunning fail," he said. "A lot of people should have thought of this problem - not one person - and asked about it."

Boeing also has disclosed that it learned soon after Max deliveries began in 2017 that a warning light that might have alerted crews to the issue with the sensor wasn't installed correctly in the flight-display software. A Boeing statement in May, explaining why the company didn't inform regulators at the time, said engineers had determined it wasn't a safety issue.

"Senior company leadership," the statement added, "was not involved in the review."


LinkedIn Profile
Reply With Quote
Old 07-23-2019, 04:22 PM
Mud Mud is offline
Join Date: Jan 2018
Location: At home. Occasionally in the basement.
Studying for Nothing
Favorite beer: Not beer
Posts: 913

Designing proper flight systems isn't rocket science, so obviously anyone with a keyboard can do it.
Reply With Quote

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

All times are GMT -4. The time now is 10:27 AM.

Powered by vBulletin®
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.
*PLEASE NOTE: Posts are not checked for accuracy, and do not
represent the views of the Actuarial Outpost or its sponsors.
Page generated in 0.80182 seconds with 11 queries