MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

[edmundronald]

As the saying goes you can put lipstick on a pig but it is still a pig.

The 737 Max is a fifty year old design with a few lights bells and whistles.

All we are seeing with Boeing and the FAA is a method of selling this death trap to the worlds airlines.

They laughed at Airbus and their plastic and electric aeroplanes but sadly now discover they have missed the bus. (pun intended)



The 737 is a very safe 50 year old design. The problem lies with the politicians de-fanging the FAA and the defanged agency and Boeing agreeing on a "nudge nudge wink wink" way of certifying its successor without due diligence. The FAA should have the budget to certify properly, as it used to.

If Boeing had known they faced a full check by an independent agency they would have made a good new plane rather than sneak through a pig in a skirt with lipstick.
Edmund

[krismiler]

Basically, the accidents have opened a can of worms with the B737, the deeper they go the more they find wrong. Issues which have sat quietly under the radar because they hadn't yet caused problems are coming out into the open. The aircraft is going to be taken apart to the last rivet and evaluated against modern safety standards, 50 year old bicycle chain and cable technology won't cut it in the era of fly by wire.

Every aspect will be looked into from technical to the certification process and no one is going to put his head on the block by signing off unless numerous experts and committees give it the OK.

Universities will be using Boeing's response to the accidents as a case study in future years.

[billybone]

One wonders what the FDR would record while the pilots were mashing the thumb switches but only getting a "slow response". Short pulses, perhaps?
(I know, pure speculation on my part :rolleyes: )

Seems to me that the ' slow" reaction may be due to either a G limit on rate change on the stabilizer or a speed input limiting the rate of change.
Based on the assumption thst MCAS only needed at cruise altitude and speed parameters. But when they later changed the max nose down to 2.5 degrees, they did NOT follow thru with the effects on all other parameters.

Ethopia was at high speed- low AGL and wound up with the worst of both worlds..

[MathFox]

Basically, the accidents have opened a can of worms with the B737, the deeper they go the more they find wrong. Issues which have sat quietly under the radar because they hadn't yet caused problems are coming out into the open. The aircraft is going to be taken apart to the last rivet and evaluated against modern safety standards, 50 year old bicycle chain and cable technology won't cut it in the era of fly by wire.

Every aspect will be looked into from technical to the certification process and no one is going to put his head on the block by signing off unless numerous experts and committees give it the OK.

Universities will be using Boeing's response to the accidents as a case study in future years.
I see the MAX as a hurried response to the Airbus Neo. Boeing skipped some sanity checks in the MAX "adaptations"; the FAA blessed the design with less oversight than appropriate.
MCAS was the culprit for two fatal crashes... it could have been another system if the dice rolled another way, Anyway both the FAA and Boeing have some trust to regain.

[Loose rivets]

PiggyBack #728

more than a bug fix is neededWe are all speculating based on incomplete information but it has been apparent that current concept is flawed and this could not be resolved by a software fix even if it successfully addressed whatever issues had caused the two crashes. We know that a single fault could cause the stabiliser to be driven to a position where it is hard or impossible to recover. Addressing specific fault scenarios without addressing this wider concern is not a full solution. We have partial information and those involved are competent people so we must assume that this is beng addressed however the timescales for the solution always seemed over optimistic.

A prime example is the jackscrew power, with a lot of logic and hardware upstream. Posters have mentioned, motors, but should it not be motor, singular? One brushless motor with a control and clutches. Okay, so this is probably the finest build quality there is, but there is just one motor and associated systems. This leads me to believe we are absolutely reliant on the steel cable backup - and its ability to be cranked in any scenario.

Like many relays, that INTERLOCK unit has a solid state device crowbaring the back EMF. It's one tiny solid state surface, which if shorted would leave the interlock signal continuous. The point is, the use of good old clonking relays can be rendered worthless with little more than a speck of semiconductor material. One example amidst hundreds, just on the area we're focussing on.


Just as an aside, I recall some 30 - 40 years ago a guy from the British simulator maker saying 'There is no operating system. There's no time.' A different world back then, but I know what he means. HAL mediating every step of the logic can be a terrible burden. Sometimes, knowing what's going to happen when you press a switch is worth its weight in gold.

[billybone]

From SEATTLE TIMES

https://www.seattletimes.com/business/airline-group-advocates-more-training-for-boeing-737-max/

=startBy DAVID KOENIG (https://www.seattletimes.com/author/david-koenig/)The Associated Press=start

Boeing says it expects to finish work on updated flight-control software for the 737 Max in September, a sign that the troubled jet likely won’t be flying until late this year.





The latest delay in fixing the Max came a day after the disclosure that government test pilots found a new technology flaw in the plane during a test on a flight simulator.





The plane has been grounded since mid-March after two crashes that killed 346 people. Preliminary accident reports pointed to software that erroneously pointed the planes’ noses down and overpowered pilots’ efforts to regain control...

Goes on .

IMHO - MAX not RTF until Novemeber at earliest- and maybe NG may need ' updates "

[Smythe]

Has Transport Canada found something else, the wording is a bit vague?

Certification experts with Transport Canada know of an “unacceptable failure” in the updated flight control computer on the Boeing 737 MAX 8 (https://globalnews.ca/tag/boeing-737-max-8/), and they’re looking into how this will affect the ministry’s “ongoing validation efforts,” a statement said Thursday.

The statement came one day after reports emerged that the Federal Aviation Administration (FAA) had found a new risk in the grounded planes (https://globalnews.ca/news/5435154/faa-boeing-737-max-risk/) that has to be addressed before they can fly again.

What happened to the trim wheel issue? (required strength to move, MAX and NG)

[LandIT]

American Airlines CEO Douglas Parker says the Max grounding is now down to politics

https://www.cnbc.com/2019/06/23/american-airlines-ceo-politics-a-factor-in-return-of-boeings-737-max.html

Extraordinary ...

At least finally it looks like the FAA are doing their job instead of rubber stamping and it looks like the MAX won't be flying this Summer. I wonder what Mr Parker's next statement or implied criticism will be.

[FlightCosting]

JSP 553 is not the only definitive statement regarding aeronautical products and reflects the USA Military and CFR14 FAR interpretations. This is a good definition, however Nations signatory to the ICAO Convention and in particular Annex 8 have jurisdiction concerning the interpretation and this is reflected in the National Regulatory Organisational standards. Whilst acceptance of Aeronautical Product certification standards between many but not all nations is to date convention this MAX 8 situation indicates that this may not hold true for the future. EASA have made it quite clear that automatic acceptance of FAA MAX 8 changes will not happen. This may have implications wrt the ICAO Convention not least as it also may affect Annex 13 and its interpretation.
from my experience in obtaining aircraft certification there is a big difference between FAA and EASA attitudes. In the US Boeing and politicians hold much greater influence over the certification process ( Boeing self certification) than in Europe where the authorities always take a much harder stance in front of the manufacturer.

[BDAttitude]

If I am reading this correctly the "Main Trim Arm" relay is activated by one of the pilot yoke switches which, among other things, sends a signal to and opens the interlock relay contained in the trim motor box on the right side:
.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/217x76/interlock_6ee429633932225d8b532f1a1e4e80a5a4983386.jpeg
.

The interlock relay appears to be a basic relay and not a function of any IC processors. This relay appears to be spring-loaded closed allowing automated trim inputs by default (which makes sense because the STS and Mach Trim systems need to be active full time). When a Main Electric Trim switch is actuated, the interlock opens, and this "open" signal goes off the right hand side of the page presumably into the FCC logic which should stop any automated inputs. There is no way to tell from this diagram how the FCC handles that input.

I think not correct.
INTLK coming from the right side is a sensing channel activated upon switching K2 by applying 14V+ to A/P TRIM SPEED HIGH.

You can probably clarify this by posting wiring diagram 22-13-11.


Not sure if it could be extended to the original software

Indeed ... it could explain some weird things however.

On April 5th, I posted below Björn Leehams analysis of the preliminary report a question that still haunts me today:
What electrical signal does the DFDR actually record as manual trim input at which rate. By which device is it digitized? At which rate? And then transferred by which bus at which rate to the DFDR?
Let's not hope there was a trapping FCC in the line of communication. Blip blip.

[SLF3]

https://www.bbc.co.uk/news/business-48752932

Quote:

In a tweet, the FAA said: "On the most recent issue, the FAA's process is designed to discover and highlight potential risks. The FAA recently found a potential risk that Boeing must mitigate."

A source familiar with the situation told the BBC: ""During simulator testing last week at Boeing, FAA test pilots discovered an issue that affected their ability to quickly and easily follow the required recovery procedures for runaway stabiliser trim (ie, to stop stabilisers on the aircraft's tail moving uncontrollably).

"The issue was traced to how data is being processed by the flight computer."

Unquote.

So did Boeing not know, or were they hoping the FAA would not notice, or were they in 'lets run this by the FAA and see how they react' mode? The issues must be fundamental and intractable if after eight months work they are still struggling to find a fix. Or are they in denial, trying to push through a software modification when some more fundamental physical change is required? It won't be easy to compromise with the regulator under scrutiny and other regulators looking over their shoulder.

[averow]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

[Peter H]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time befThe deliberately broken microprocessor had become overwhelmed with data from the flight control systemore this plane flies again in commercial service.

Nice find. I'm still having problems interpreting things though, any ideas on:
The deliberately broken microprocessor had become overwhelmed with data from the flight control system.
- If its "broken", how is it still working.
- If its "crippled" by how much.
- Or is it "restarting" after some sort of interrupt/reboot.
- Finally is the "overload" a transient effect, or the new status quo.

Peter

[GordonR_Cape]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

Thanks for the excellent link!

Testing was part of my former life. Intentionally 'breaking' software is what that should involve, which was obviously was not done properly...

[ARealTimTuffy]

The way I have read most of the reporting is that the processing issue has shown up as a result of the software update for the Mcas. It seems to imply it wasn’t there with the original mcas.

But, maybe my interpretation or the reporting is incorrect.

[Ind]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

Interestingly, it refers to a different scenario, to what has been discussed here before "The deliberately broken microprocessor...". This was to simulate a hardware fault in the microprocessor unit (not specified?), which resulted in a slow system response to the pilot's action during runaway stabiliser recovery checklist. Test pilot had difficulty to correct ND input from stabiliser. This was not related to MCAS and faulty AOA sensor activation per se, but highlights another fault scenario in which 737-MAX aircraft's flight control response is deemed "chatestrophical" by FAA. The solution Boeing wants to implement is to re-route data to different processor units.. The end of summer RTS is indeed doubtful now, as it might promt evaulaution of another possible fault scenarios, which might be either misclassified or not properly assessed.

[Speed of Sound]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com .

The article suggests that Boeing’s software fix for this latest problem will be to share the load over a number of processors rather rewrite the code for the current dedicated microprocessor. This approach will inevitably prolong the certification process as the testing will have to be much more rigorous (and therefore time consuming) to ensure that the problem of processing overload is not pushed down the road into another part of the system.

The risk with that approach is that it may throw up further problems. If trim response is delayed by seconds rather than milli or microseconds, that suggests that there’s not a great deal of headroom in parts of the system.

It may not be just the 737 airframe which has been repeatedly modified beyond its useful life. 😵

[yoko1]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com (https://www.pprune.org/www.theaircurrent.com) . Some good, detailed reporting on how this latest issue was identified.

Good article with the usual caveat that we hope he is getting accurate information from his sources. It is always a bit frustrating to watch the story "evolve" by the day. So accordingly to Ostrower, a test was set up to generate an intentional failure of a microprocessor in the FCC to see what would happen, and this particular failure was not related to MCAS. I would be helpful to know exactly what this microprocessor was supposed to be doing.

Latest update from AW&ST:

​​​​​​MAX Fixes Will Take Until At Least September, Boeing Says

Sean Broderick | Aviation Daily June 27, 2019

WASHINGTON—Boeingwill need at least until September to address a new flight control computer (FCC) issue and wrap up changes needed to get the fleet flying again, Aviation Week has learned.

The issue came to light during engineering simulator tests with FAAtest pilots during the week of June 17. During a runway horizontal stabilizer troubleshooting procedure, FAA determined that line pilots would need more time to correctly diagnose the failure and execute the appropriate checklist. The tests also showed that a computer chip malfunction could lead to uncommanded stabilizer movement during the emergency procedure. FAA told Boeing to address the issues, and the manufacturer is complying.

“We are working through the software update and the potential implications for the timeline for the safe return to service of the 737 MAX fleet and resuming MAX deliveries,” a Boeing executive told Aviation Week. “Our current assessment is we will submit our final certification package to the FAA in the September timeframe.”

Boeing is confident that the latest issues can be addressed with software changes. The alternative—replacing computer chips on more than 500 MAXs—could prolong a worldwide grounding that started in mid-March.

Boeing is modifying specific FCC software linked to two 737 MAX accident sequences within five months. The second accident, the Mar. 10 crash of Ethiopian Airlines Flight 302, triggered the global grounding.

The software changes focus on the MAX’s maneuvering characteristics augmentation system (MCAS), which helps the MAX mimic the flight characteristic of its 737 Next Generation predecessor in certain scenarios. The latest FCC issue is not believed to be linked to the proposed MCAS changes.

[yoko1]

I think not correct.
INTLK coming from the right side is a sensing channel activated upon switching K2 by applying 14V+ to A/P TRIM SPEED HIGH.

You can probably clarify this by posting wiring diagram 22-13-11.

Indeed ... it could explain some weird things however.

.

I wish I had all the wiring diagrams, but unfortunately this was the only other one I could find online. You would think more would be out there with all the interest. Like I said, not an expert reading these things anyway. However, I don't see anything that would block the Main Electric Trim signal from getting all the way to the trim motor controller, so I'm still curious what happens if the controller is getting signals from both the Main Electric side and one of the automatic sources (Speed Trim, MCAS, Mach Trim).

[Alchad]

Nice find. I'm still having problems interpreting things though, any ideas on:
The deliberately broken microprocessor had become overwhelmed with data from the flight control system.
- If its "broken", how is it still working.
- If its "crippled" by how much.
- Or is it "restarting" after some sort of interrupt/reboot.
- Finally is the "overload" a transient effect, or the new status quo.

Peter

I'm with you. I think "breaking" is the wrong word, sounds more likely that it was overloaded (or overwhelmed as you say) and just went on a "go slow" rather than turned up it's toes and failed permanently.

Alchad

[gearlever]

A retired BA pilot analyses the probable causes (https://www.pilotweb.aero/features/737-max-scandal-analysis-1-6127413)

[Standby Scum]

https://www.youtube.com/watch?v=CozYFOCwyK8

[ARealTimTuffy]

A retired BA pilot analyses the probable causes (https://www.pilotweb.aero/features/737-max-scandal-analysis-1-6127413)

There is a lot of misinformation in that article/blog. Some good stuff too.

[gums]

Salute!

The pilot analysis seemed fair to this old greybeard, especially the whine about not letting the pilots know about a new and significant system ( only when it goes rougue),

I cannot help but wonder how many $$$ Boeing saved or the carriers saved by not having some sim time training that demonstrated a rogue MCAS high alt or just after takeoff. They are all surely paying now, ya think?

I also do not unnerstan the bang-bang implementation versus a smooth stab input according to AoA. No need for a new computer, as a 1970's op amp (analog) could easily provide the control signals. Not everything with a "chip" is digital, with clock speeds, mux-bus protocols to deal with other systems, RAM and so forth.

For all who do not realize, but the original Viper quad redundant computers were no-kidding analog doofers with op-amps and both D-to-A and reverse chips and then voltage commands to the servo actuators.We had no internal clock speeds or delays. The chips worked literally at the speed of light thru the wires. We did not go fully digital for about 20 years
.
Gums sends...

[yoko1]

From Bloomberg:

Aircraft Regulators Will Join Forces to Restore Boeing 737 Max to Service (https://www.bloomberg.com/news/articles/2019-06-28/key-regulators-for-boeing-max-s-return-move-toward-cooperation)

[Speed of Sound]

Aircraft Regulators Will Join Forces to Restore Boeing 737 Max to Service (https://www.bloomberg.com/news/articles/2019-06-28/key-regulators-for-boeing-max-s-return-move-toward-cooperation)

The only possible stalling point, according to that article, is that EASA favours a 3-AoA sensor input to the system which would obviously delay things further.

[tdracer]

from my experience in obtaining aircraft certification there is a big difference between FAA and EASA attitudes. In the US Boeing and politicians hold much greater influence over the certification process ( Boeing self certification) than in Europe where the authorities always take a much harder stance in front of the manufacturer.

In short, it depends. Both EASA and the FAA had their strengths and weaknesses. In both cases, there was a tendency to 'miss the forest for the trees' - that is to become obsessed with one small aspect of the system while missing what the total system did and it's relationship to other systems and the aircraft as a whole - although at least in my experience EASA was a little less prone to this than the FAA. EASA obviously would focus on areas where the CS differed from the corresponding FAR (the list of 'significant regulatory differences' was agreed to and documented in a CRI - Certification Review Item). Both the FAA and EASA would identify areas of the design where they wanted to focus and document those - Issue Papers for the FAA, CRI's for EASA. CRI's were often, but not always, associated with the regulatory differences. One rather annoying aspect of EASA is they sometimes tried to dictate design, rather than determine if the existing design complied with the regulations. Sounds like they might be doing that again with the 2 vs. 3 AOA sensors.

I'm not surprised the FAA is working directly with EASA on resolving the grounding and returning the MAX to service - it's what I expected. EASA and the FAA always worked together (although not always real well) - and it was pretty common for an FAA person to attend the meetings we had with EASA.

[Longtimer]

Boeing 737 Max likely grounded until the end of the year after new problem emergesPublished 41 min agoUpdated 34 min agoElijah Shama (https://www.cnbc.com/elijah-shama/)Key Points

Boeing’s 737 Max could be grounded until late this year according to a Boeing official.
U.S. air-safety regulators reportedly flagged a problem with the plane’s in-flight control chip.
Over 500 of the aircraft manufacturer’s 737 Max planes have been grounded since mid-March.

Stephen Brashear Getty ImagesBoeing’s (https://www.cnbc.com/quotes/?symbol=BA) 737 Max could stay on the ground until late this year after a new problem emerged with the plane’s in-flight control chip, according to a Boeing official.

This latest holdup in the plane’s troubled re-certification process has to do with a chip failure that can cause uncommanded movement of a panel on the aircraft’s tail, pointing the plane’s nose downwards, the official said, asking not to be identified because the company hasn’t publicly disclosed it yet. Subsequent emergency tests to fix the issue showed it took pilots longer than expected to solve the problem according to The Wall Street Journal. (https://www.wsj.com/articles/boeing-737-max-likely-grounded-until-late-this-year-11561685894) This marks a new problem with the plane unrelated to the issues Boeing is already facing with the plane’s MCAS automated flight control system. An issue the company maintains can be remedied by a software fix. Boeing hopes to submit all of its fixes to the Federal Aviation Administration (https://www.cnbc.com/faa/) this fall, the Boeing official said.

“We’re expecting a September time frame for a full software package to fix both MCAS and this new issue” the official said. “We believe additional items will be remedied by a software fix.”

Once that software package is submitted, it will likely take at least another two months before the planes are flying again. The FAA will need time to re-certify the planes; Boeing will also need to reach agreement with airlines and pilots unions on how much extra training pilots will need. The airlines will also need some time to complete necessary maintenance checks.

FAA spokesman Lynn Lunsford declined to comment on a specific timeline for the plane’s re-certification, saying “we have steadfastly stayed away from offering any timelines.”

The global Max fleet was grounded in mid-March following two fatal crashes a malfunction of the plane’s automated flight-control system, called MCAS, was implicated. The crashes killed 346 people combined.

[yoko1]

I think not correct.
INTLK coming from the right side is a sensing channel activated upon switching K2 by applying 14V+ to A/P TRIM SPEED HIGH.

You can probably clarify this by posting wiring diagram 22-13-11.



Been digging around and I've had some luck. I've gotten a hold of schematic 22-13-11 to fill in some detail. I tried taking a full size snapshot, but it gets too fuzzy to read when I zoom out. I think I can post the relevant parts though.

First I'll repost the original schematic:
.
.
https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/1968x750/trim_schematic_2_05b703e31623162cc4b1325ecfbcb62712af06b4.jp g
Schematic 27-41-11
.
.

The bold line dark box on the right represents the entire stab trim motor and associated controllers. I'm told this is a one piece unit. Zoomed in:
.

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/401x620/zoom_trim_motor_bda5507e28b8123981eeeb086af462f79ad8448e.jpe g
Trim motor detail
.
.
The "INTLK" in and out in this diagram are actually related to the autopilot speed selection. The MAIN ELECT TRIM INTLK function is a signal from the MAIN TRIM ARM RELAY directly to each of the FCC's. Here is the relevant detail from schematic 22-13-11:
.
.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/1145x540/zoom_fcc_details_ed8cc9b338a6817ea29dba00d8cffc6855970a8f.jp eg
Main Trim Arm Relay to FCC detail
.
.
This diagram has a reference to another schematic 22-11-11 for the FCC, but I've had a peek at that one and it doesn't provide any clarity as to what happens to the MAIN ELEC TRIM INTLK signal.

The other detail from 22-13-11 that corresponds to the lines coming out the right side of 27-41-11 is here:
.
.

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/596x622/zoom_trim_motor_2_1f6d8da9b221b85fbbcd540f90229ffb8a24e74a.j peg
Automatic Trim Input Detail
.
.
Unfortunately, all of this detail still does not tell us what happens if the FCC does not correctly process the MAIN ELEC TRIM INTLK signal.

Both the Main and Automatic trim signals are sent to the stab trim motor Controller. I could find no information regarding this component, which again, I am told is housed within the motor assembly itself. The motor is made by Eaton and is similar to the one on the 737NG. If a malfunction in the FCC allows simultaneous signals from the Automatic and Main Electric trim to arrive at the Controller, then that might explain the reported test results - just speculating here.

Again, this should be caveated that the tests involved the new FCC software and do not necessarily reflect conditions on the accident aircraft.

[billybone]

RE More than one AOA sensor- found and interesting comparison method as used on 787 and ? 777 by using the Inerital system ( GPS etc ) basically igt seems to provide a sensor independent check on several normal flight sensors like pitot tubes etc. Granted 777 and 787 are more closer to FBW, but still retain some backup. 787 calls it the Common Mode

Source can be found by searching on

Introducing the 787
Tom Dodt

Chief Engineer - Air safety Investigation
ISASI september 2011
Pages 39 thru 41

Common Mode Hazards to Pitot-Static sensors
- Mud Daubers
- Icing - Hail - Birds - Taped Static Ports
- Volcanic Ash
- Radome failure
- Pitot covers
- Maintenance errors (pneumatic plumbing)
• 787 new capabilities for protection - Synthetic airspeed
- GPS altitude - Common Mode Monitor

Calculated from angle of attack and inertial data

- AOA – voted dual sensors plus inertial data
- Accurate Coefficient of Lift (CL) - Airplane Mass from FMC - Validated after Takeoff
• Algorithm developed for enhanced stall protection
• Avoid displaying data known to be bad - Loss of valid voted VCAS = Display synthetic airspeed VSYN - Loss of valid voted PSTATIC = Display GPS altitude

So Boeing was well aware of how to compare and how to use a separate ( Inertial-GPS ) system to cross check and eliminate faulty data ...

But it probably cost to much to include on 737MAX to avoid long standing issues-

[Mike Flynn]

tIn simple terms how do you market a product which has a tainted past?

Boeing have very few simulators for the Max and I doubt any airline insurers will be happy with an Ipad conversion.

On top of that we have pilots unions and foreign aviation legislation to deal with. Then we have the public perception of a flying coffin.

They will be very lucky to get these aircraft flying early next year.

This reminds me of the Kodak camera and film story.

A company run by accountants who failed to keep up with technology.

[gums]

Salute!

Yeah.Mike. but more than technology. A few dollars saved there and now a billion to spend here, looks like.

Face it. The Max is a new plane!! It has aero characteristics that are sufficiently different from the earlier versions that it needed kludges and such to meet the cert requirements. The aero changes would have likely taken lots more test flights and maybe even a new type cert. A lot of the old stuff would not have required new tests and such - seat dimensions, hydraulic systems, electric systems, and more. But that aero thing was the biggie.

Gums sends...

[YYZjim]

Re: Regulators joining forces (post #779 c.f.)

Back in the 1930s, when the FAA and the EASA's British and French precursors were in their formative stages, there were lots of airplane manufacturers. And lots of companies exploring ways of commercializing the new technology. There was so much anarchy for the *AAs to tame that they were able to use common sense, without any political interference to speak of, while they set up the rules. The rules were pretty good, and have left aviation with a first century to be proud of.

That's all gone now. The number of airplane manufacturers is not so much a handful as a fingerful. Just in the last year, national champions in Canada and Brazil (were) bowed out. You have your basic A and B, of course, but C (China) is just now taking off. Although J (Japan) is still at the gate, it would be premature to count them out now that Mitsubishi can build on Canadair's RJ program.

The FAA's decision-making is easy. It needs to re-establish its bona fides. Just enough resistance to show independence, I should think, then good-to-go. (God forbid that something really serious comes to light during testing.)

The EASA needs to show a little backbone, too. Not from A in this case, but from the FAA.

Even so, the EASA's decision will be a lot tougher than the FAA's. Long-term versus short-term interests are at stake. Like the FAA, the EASA knows that the ChineseAA's blessing of the MAX-fix is going to be a political decision taken as a minor part of the Xi-Trump tariff tiff. The most likely outcome is that the Max will not return to service in the Eastern hemisphere until a couple of months after it starts flying again in the USA and Europe. (Unless there's a big breakthrough on the tariff front.)

Longer term, say 20 or 30 years, A's primary competitor is going to be C, not B. Access to markets is going to be just as important as good design. (Ask any big tech company how things work in China.) I think the French political elite will guide the EASA through the thought process. Should the EASA/A simply maximize short-term profits from the FAA/B's stumble? Or should the EASA/A softly co-operate with the FAA/B now in order to establish a basis for long-term cooperation against C? Or should the EASA/A maximize medium-term gain by using the MCAS fiasco as a launch pad to force B to make the same transition from pilot-in-control to computer-in-control that A made 30 years ago?

It's inevitable. When each big country has just one airplane maker, the rules for making airplanes, and for using airplanes made by others, become matters of national interest. While the various *AAs may be able to remain independent in certain areas, like engineering analysis, their conclusions will increasingly flow through political channels. Regulation in aviation's second century might be quite different from its first.

It is going to be very interesting to watch how well the EASA co-operates with the FAA in getting the MAX airborne again. In practice, there is lots of room to maneuver while being "co-operative" and nobody knows this better than senior politicians.

YYZjim

[billybone]

https://www.isasi.org/Documents/library/technical-papers/2011/Introducing-787.pdf

Seems that 0n 787 and maybe 777 Boeing decided to make use of Inertial system and GPS as a non external sensor comparison

Go to pages 35 to 43for what they do. Probably too expensive to do for MAX ...

[Mike Flynn]

Thanks for the reply Gums,

Sadly people with your experience no longer have input in to Boeing aircraft development and design.

Accountants now rule the roost.

This issue should have been resolved at the test flight stage.

The feedback from the sim tests are quite revealing.

Boeing have made a fortune over decades from the 737.

Sadly they have milked the old cow until it is dry.

[DaveReidUK]

https://www.isasi.org/Documents/library/technical-papers/2011/Introducing-787.pdf

Seems that on 787 and maybe 777 Boeing decided to make use of Inertial system and GPS as a non external sensor comparison

Go to pages 35 to 43 for what they do. Probably too expensive to do for MAX ...

The 787 generates a synthetic airspeed value by combining inertial data and AoA, to substitute for UAS.

Whether you can do it the other way round, i.e. generate a synthetic AoA from IRS and IAS, isn't immediately obvious.

[billybone]

The 787 generates a synthetic airspeed value by combining inertial data and AoA, to substitute for UAS.

Whether you can do it the other way round, i.e. generate a synthetic AoA from IRS and IAS, isn't immediately obvious.

Given that AOA and pitch angles are slightly different ( within one or two degrees ? ) , and that Inertial data can output/measure pitch along with motion vectors and constantly comparing to two AOA sensors, I would guess that any sudden or major AOA change above a realistic amount would trip appropriate alarms etc.- thus the inertial system would be a basckup. And while a bit off topic- Boeing has been flying an orbital bird ( similar to space shuttle ) for months and then under full autocontrol brings it back for a ' normal' style aircraft landing. Obviously there are NO external AOA probes or probably no external pitot sensors. My guess/speculation is that they do it all with internal- inertial sensors...

[gums]

Salute!

Dave! You can get a fairly accurate AoA by comparing the inertial velocity vector with the chord of the wing.

I use "body" coordinates. So if my flight path vector is "x" degrees below/above the wing/fuselage reference line, then that is my AoA. Might have some very small corrections for yaw, and the Earth ellipsoid and such,, but the basic calculation is where you are pointed and where the wing is pointed, right?

Gums suggests....

[krismiler]

This is early generation video cassette recorder level technology which Boeing are trying to make work in the days of Netflix. Engineers will need to be brought out of retirement to work on it, similar to Y2K where the younger generation of computer programmers didn't know about the old operating systems.

Are Boeing using vacuum tubes on this aircraft or have they moved on to transistors ?

[Speed of Sound]

So Boeing was well aware of how to compare and how to use a separate ( Inertial-GPS ) system to cross check and eliminate faulty data ...

But it probably cost to much to include on 737MAX to avoid long standing issues-

What has always bothered me right from the beginning of this whole thing is that at some point in the design process the one, two, three or synthetic AoA input question must have come up. And when it did, surely someone put their hand up and said “With only one AoA vane feeding the FCC, an early failure of the sensor will only come to light when either the AP is switched off and/or the flaps are retracted. This really is not the time/speed/altitude/phase of flight to have large amounts of AND.”

Given that it is unthinkable that all potential outcomes weren’t modelled, who on earth decided that this was an acceptable risk to take? 😵

[Loose rivets]

It's astonishing how one search leads to another:-

https://www.news.com.au/travel/travel-updates/concerns-raised-over-incorrect-airspeed-data-readings-on-boeing-787-dreamliners/news-story/61af275009c273532dbefd6d0f6ac64a

[brak]

To quote myself from a previous thread:
(https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-85.html#post10421081)
The more I read about it, the more MCAS sounds like something implemented by summer interns over a few weekends.
(https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-85.html#post10421081)
And now this from the news (https://finance.yahoo.com/news/boeings-737-max-software-outsourced-204657048.html):

"Increasingly, the iconic American planemaker and its subcontractors have relied on temporary workers making as little as $9 an hour to develop and test software, often from countries lacking a deep background in aerospace -- notably India.In offices across from Seattle’s Boeing Field, recent college graduates employed by the Indian software developer HCL Technologies Ltd. occupied several rows of desks, said Mark Rabin, a former Boeing software engineer who worked in a flight-test group that supported the Max."

When reality is stranger than an ironic post.

[KRUSTY 34]

What has always bothered me right from the beginning of this whole thing is that at some point in the design process the one, two, three or synthetic AoA input question must have come up. And when it did, surely someone put their hand up and said “With only one AoA vane feeding the FCC, an early failure of the sensor will only come to light when either the AP is switched off and/or the flaps are retracted. This really is not the time/speed/altitude/phase of flight to have large amounts of AND.”

Given that it is unthinkable that all potential outcomes weren’t modelled, who on earth decided that this was an acceptable risk to take? 😵




Seminal question.

[BuzzBox]

The 787 generates a synthetic airspeed value by combining inertial data and AoA, to substitute for UAS.

Whether you can do it the other way round, i.e. generate a synthetic AoA from IRS and IAS, isn't immediately obvious.

The B777 ADIRU generates a 'calculated AOA' based on inertial and air data. The calculated AOA is used as a third AOA value for AOA redundancy management. The AMM states:

The AOA redundancy management logic uses a modified average calculation. The modified average calculation calculates an average of three AOA values, the left corrected AOA, the right corrected AOA, and a calculated AOA. The calculated AOA logic receives inputs from the inertial and air data systems to calculate the calculated AOA.

I assume the B787 does something similar?

[CurtainTwitcher]

What has always bothered me right from the beginning of this whole thing is that at some point in the design process the one, two, three or synthetic AoA input question must have come up. And when it did, surely someone put their hand up and said “With only one AoA vane feeding the FCC, an early failure of the sensor will only come to light when either the AP is switched off and/or the flaps are retracted. This really is not the time/speed/altitude/phase of flight to have large amounts of AND.”

Given that it is unthinkable that all potential outcomes weren’t modelled, who on earth decided that this was an acceptable risk to take? ��









Because Boeing has become a fully financialized company, beholden to Wall Street, profit & greed above all. The lack of sensor testing ensured there was no additional simulator training requirement for crews. It is alleged there was a $1 million penalty for Boeing per airframe with one large customer if simulator training was required.

Minimizing changes

Throughout the MAX’s development, Boeing was intent on minimizing design changes that could require extra pilot training, said Rick Ludtke, a former Boeing engineer who worked on 737 MAX cockpit features but not the MCAS system. Extra training could have added costs for airlines introducing the MAX into service.

The company had promised Southwest Airlines (https://quotes.wsj.com/LUV) Co. , the plane’s biggest customer, to keep pilot training to a minimum so the new jet could seamlessly slot into the carrier’s fleet of older 737s, according to regulators and industry officials.

Mr. Ludtke recalled midlevel managers telling subordinates that Boeing had committed to pay the airline $1 million per plane if its design ended up requiring pilots to spend additional simulator time. “We had never, ever seen commitments like that before,” he said.


WSJ How Boeing’s 737 MAX Failed (https://www.wsj.com/articles/how-boeings-737-max-failed-11553699239) [article non-paywalled]


You are exactly right, internally there would have been good people advising their managers of possibility of accidents. The managers appear to have taken the chance that this would never surface. This is why, in my view, there was not a whisper of the MCAS in the pilot manuals. They wanted this thing hidden should an accident happen, and then attempt to blame the pilots as nobody had knowledge of this new system.

This is the most repugnant, cynical and craven aspect of the whole episode. Their strategy was "we will always blame the crew" should, what they convinced themselves was a remote possibility of an accident. I also believe that the outstanding & expert investigation by PPRuNe contributors was, and continues to be a thorn in their side for this strategy. In the future, they may reconsider how their skimp on the engineering based on the realisation there is a group of anonymous uncorruptables who don't like seeing their dead colleagues carrying the can of responsibility for the profit above all strategy engineering failure.

[edmundronald]

Because Boeing has become a fully financialized company, beholden to Wall Street, profit & greed above all. The lack of sensor testing ensured there was no additional simulator training requirement for crews. It is alleged there was a $1 million penalty for Boeing per airframe with one large customer if simulator training was required.

WSJ How Boeing’s 737 MAX Failed (https://www.wsj.com/articles/how-boeings-737-max-failed-11553699239) [article non-paywalled]


You are exactly right, internally there would have been good people advising their managers of possibility of accidents. The managers appear to have taken the chance that this would never surface. This is why, in my view, there was not a whisper of the MCAS in the pilot manuals. They wanted this thing hidden should an accident happen, and then attempt to blame the pilots as nobody had knowledge of this new system.

This is the most repugnant, cynical and craven aspect of the whole episode. Their strategy was "we will always blame the crew" should, what they convinced themselves was a remote possibility of an accident. I also believe that the outstanding & expert investigation by PPRuNe contributors was, and continues to be a thorn in their side for this strategy. In the future, they may reconsider how their skimp on the engineering based on the realisation there is a group of anonymous uncorruptables who don't like seeing their dead colleagues carrying the can of responsibility for the profit above all strategy engineering failure.

I think management was simply so dumb that they didn't realise a bad design was bound to fail. It's something you don't learn in business school, to think like an engineer.
The FAA was there to keep Boeing honest but got captured.

This is a case which demonstrates how money will circumvent regulation in a democracy until some incident creates an outcry. You can see the same thing happening in construction standards eg. the Greenfell Tower fire in the UK.

Edmund

[Bend alot]

Because Boeing has become a fully financialized company, beholden to Wall Street, profit & greed above all. The lack of sensor testing ensured there was no additional simulator training requirement for crews. It is alleged there was a $1 million penalty for Boeing per airframe with one large customer if simulator training was required.

WSJ How Boeing’s 737 MAX Failed (https://www.wsj.com/articles/how-boeings-737-max-failed-11553699239) [article non-paywalled]


You are exactly right, internally there would have been good people advising their managers of possibility of accidents. The managers appear to have taken the chance that this would never surface. This is why, in my view, there was not a whisper of the MCAS in the pilot manuals. They wanted this thing hidden should an accident happen, and then attempt to blame the pilots as nobody had knowledge of this new system.

This is the most repugnant, cynical and craven aspect of the whole episode. Their strategy was "we will always blame the crew" should, what they convinced themselves was a remote possibility of an accident. I also believe that the outstanding & expert investigation by PPRuNe contributors was, and continues to be a thorn in their side for this strategy. In the future, they may reconsider how their skimp on the engineering based on the realisation there is a group of anonymous uncorruptables who don't like seeing their dead colleagues carrying the can of responsibility for the profit above all strategy engineering failure.

At a guess a few contributors on PPRuNe may have been "contacted" for interviews, several very knowledgeable and sometimes vocal persons are currently absent on this topic now.

Now it is up to Boeing to see who willing pick up the damaged can - last week did not turn out well!

[Weapons Grade]

At a guess a few contributors on PPRuNe may have been "contacted" for interviews, several very knowledgeable and sometimes vocal persons are currently absent on this topic now.

Now it is up to Boeing to see who willing pick up the damaged can - last week did not turn out well!

Not quite on-topic but:

In Australia, quite a few years ago, there were only two major political parties - Labor (a somewhat Australian version of the Democrats) and the Liberals (akin to the Republicans (USA) or Tories (UK). What was needed at the time, and subsequently occurred, was for another party to be formed. This new third party's mantra was "to keep the bastards honest".
Over time, it worked. (Ultimately self-vested interests caused its destruction through implosion).

Now, fast-forward to Boeing's (and FAA's) MCAS (and self-certification) debacle - who is going to "keep the bastards honest"? Perhaps the US Senate or Congress Transportation Committee; or EASA and other *AA's with B737-MAX on, or about to be on their registers, or flying in, out or over their airspace.

I doubt it is a good time to be holding Boeing shares.

[Bend alot]

Not quite on-topic but:

In Australia, quite a few years ago, there were only two major political parties - Labor (a somewhat Australian version of the Democrats) and the Liberals (akin to the Republicans (USA) or Tories (UK). What was needed at the time, and subsequently occurred, was for another party to be formed. This new third party's mantra was "to keep the bastards honest".
Over time, it worked. (Ultimately self-vested interests caused its destruction through implosion).

Now, fast-forward to Boeing's (and FAA's) MCAS (and self-certification) debacle - who is going to "keep the bastards honest"? Perhaps the US Senate or Congress Transportation Committee; or EASA and other *AA's with B737-MAX on, or about to be on their registers, or flying in, out or over their airspace.

I doubt it is a good time to be holding Boeing shares.
Or Boeing management positions - Australia also has the new Industrial Manslaughter laws.

[BDAttitude]

.
Unfortunately, all of this detail still does not tell us what happens if the FCC does not correctly process the MAIN ELEC TRIM INTLK signal.

Both the Main and Automatic trim signals are sent to the stab trim motor Controller. I could find no information regarding this component, which again, I am told is housed within the motor assembly itself. The motor is made by Eaton and is similar to the one on the 737NG. If a malfunction in the FCC allows simultaneous signals from the Automatic and Main Electric trim to arrive at the Controller, then that might explain the reported test results - just speculating here.
.
This is correct. Everything happening within the assembly of the Eaton motor will not be in the wiring diagrams. One would have to look in the technical customer manual of that device.

[PerPurumTonantes]

Their strategy was "we will always blame the crew" should, what they convinced themselves was a remote possibility of an accident. I also believe that the outstanding & expert investigation by PPRuNe contributors was, and continues to be a thorn in their side for this strategy.
A thorn in their side to the point where it was suspected (by user wonkazoo) that Boeing had got someone to flood this forum with posts blaming the pilots ("JUST FLY THE PLANE").

[GordonR_Cape]

What has always bothered me right from the beginning of this whole thing is that at some point in the design process the one, two, three or synthetic AoA input question must have come up. And when it did, surely someone put their hand up and said “With only one AoA vane feeding the FCC, an early failure of the sensor will only come to light when either the AP is switched off and/or the flaps are retracted. This really is not the time/speed/altitude/phase of flight to have large amounts of AND.”
Given that it is unthinkable that all potential outcomes weren’t modelled, who on earth decided that this was an acceptable risk to take? 😵

A profound question, answered almost immediately by the next post:

To quote myself from a previous thread: (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-85.html#post10421081)

And now this from the news (https://finance.yahoo.com/news/boeings-737-max-software-outsourced-204657048.html):

"Increasingly, the iconic American planemaker and its subcontractors have relied on temporary workers making as little as $9 an hour to develop and test software, often from countries lacking a deep background in aerospace -- notably India.In offices across from Seattle’s Boeing Field, recent college graduates employed by the Indian software developer HCL Technologies Ltd. occupied several rows of desks, said Mark Rabin, a former Boeing software engineer who worked in a flight-test group that supported the Max."

When reality is stranger than an ironic post.

Further down in that article:
“Boeing was doing all kinds of things, everything you can imagine, to reduce cost, including moving work from Puget Sound, because we’d become very expensive here,” said Rick Ludtke, a former Boeing flight controls engineer laid off in 2017. “All that’s very understandable if you think of it from a business perspective. Slowly over time it appears that’s eroded the ability for Puget Sound designers to design.”Rabin, the former software engineer, recalled one manager saying at an all-hands meeting that Boeing didn’t need senior engineers because its products were mature. “I was shocked that in a room full of a couple hundred mostly senior engineers we were being told that we weren’t needed,” said Rabin, who was laid off in 2015.

The Max became Boeing’s top seller soon after it was offered in 2011. But for ambitious engineers, it was something of a “backwater,” said Peter Lemme, who designed the 767’s automated flight controls and is now a consultant. The Max was an update of a 50-year-old design, and the changes needed to be limited enough that Boeing could produce the new planes like cookie cutters, with few changes for either the assembly line or airlines. “As an engineer that’s not the greatest job,” he said.Short answer: There was no-one in charge! The hot-potato was passed around in circles, until the design worked (sort-of). No-one thought through all the implications, and tested all of the systems, until it was already airborne.

[CurtainTwitcher]

A profound question, answered almost immediately by the next post:



Further down in that article:


Short answer: There was no-one in charge! The hot-potato was passed around in circles, until the design worked (sort-of). No-one thought through all the implications, and tested all of the systems, until it was already airborne.
If the answer is there weren't any adults in charge, that is an even more terrifying explanation. If what you say is correct, where was the FAA, EASA and the rest of the global regulators in all this? The FAA certified under the guidance of Boeing's own Authorized Representatives and everyone else just accepted at face value? I still contend that ultimately, the finacialization of industry drives this end result.

If this is what we observe in this instance, it opens up a Pandora's box of questions about every aspect of aviation safety, and every future accident will focus much more scrutiny on the manufacturer and the regulators as well. Another obvious problem area is going to be fatigue, where regulators have progressively allowed margins to be eroded to benefit commercial objectives.

[KRUSTY 34]

I think management was simply so dumb that they didn't realise a bad design was bound to fail. It's something you don't learn in business school, to think like an engineer.
The FAA was there to keep Boeing honest but got captured.

This is a case which demonstrates how money will circumvent regulation in a democracy until some incident creates an outcry. You can see the same thing happening in construction standards eg. the Greenfell Tower fire in the UK.

Edmund

Oh they were dumb alright.

Remember, a senior Boeing Engineer was first sidelined and then his employment was terminated, because he questioned the integrity of the program.

I think it’s safe to say this act of Corporate insanity is what led to this collective “Dumbness”.

[fergusd]

To quote myself from a previous thread: (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-85.html#post10421081)

And now this from the news (https://finance.yahoo.com/news/boeings-737-max-software-outsourced-204657048.html):

"Increasingly, the iconic American planemaker and its subcontractors have relied on temporary workers making as little as $9 an hour to develop and test software, often from countries lacking a deep background in aerospace -- notably India.In offices across from Seattle’s Boeing Field, recent college graduates employed by the Indian software developer HCL Technologies Ltd. occupied several rows of desks, said Mark Rabin, a former Boeing software engineer who worked in a flight-test group that supported the Max."

When reality is stranger than an ironic post.

So the software quality will be off the bottom of the scale. Ultra low cost, offshore, software creation almost universally results in junk.

The deeper they dig into this the worse it will become, if anybody with true safety critical software knowledge gets their hands on the code for this the MAX will remain a paperweight for many years.

This is not unique to the aviation industry either . . . how depressing.

[BDAttitude]

So the software quality will be off the bottom of the scale. Ultra low cost, offshore, software creation almost universally results in junk.

The deeper they dig into this the worse it will become, if anybody with true safety critical software knowledge gets their hands on the code for this the MAX will remain a paperweight for many years.

This is not unique to the aviation industry either . . . how depressing.
How true ... although my most recent experience with this matter is that it is no longer a financial thing. They have become expensive there in the recent years as well. IMHO it is more a cultural thing. Management enjoys the servility lack of resistance to bad decision and being pampered and being hommaged when on site there. Ain't no grey bearded pig headed wester engineers over there.

[fergusd]

How true ... although my most recent experience with this matter is that it is no longer a financial thing. They have become expensive there in the recent years as well. IMHO it is more a cultural thing. Management enjoys the servility lack of resistance to bad decision and being pampered and being hommaged when on site there. Ain't no grey bearded pig headed wester engineers over there.

Yup, but you're correct that it's not just financial, a large part of this is lack of availability of suitably qualified software engineers . . . many people 'think' they can 'write code', very, very few can actually do it (in actuality) and even fewer work in environments which can create the required quality repeatably . . . so you cannot just go out and buy a high quality capable team, at all . . . the bean counters 'think' that 'anybody' can do software and so why pay more than 1/10th of that which is actually necessary . . . and boom . . .

If I had $0.01 for every time I've seen junk software, created offshore, which is killing the business that paid for it (and paid plenty for it, the unit cost may be $9/hr, but when you end up needing 10x the staff to meet the deadlines . . . - this is the offshore business model - sell people, not quality) I would be significantly wealthy.

Fundamentally people do not value software, it is very difficult for the largely ignorant layman (anybody outside of the 1% of the software industry that does high quality work) to understand why high quality software costs so much.

If I were the FDA I'd be pulling every single piece of software development evidence and documentation and reviewing it to see if any of it complies with the required processes . . . I'd bet good money that it doesn't . . .

How many times have I seen that ? - more times than I care to think about.

[BDAttitude]

Yup, but you're correct that it's not just financial, a large part of this is lack of availability of suitably qualified software engineers . . . many people 'think' they can 'write code', very, very few can actually do it (in actuality) and even fewer work in environments which can create the required quality repeatably . . . so you cannot just go out and buy a high quality capable team, at all . . . the bean counters 'think' that 'anybody' can do software and so why pay more than 1/10th of that which is actually necessary . . . and boom . . .


And those who do have the ability to code head for other ventures because they are generally intelligent knowledgeable and studious people and can't be bothered with this sort of competition and obnoxious working environment.
Similar things happen with professional airmen I guess.
In fact I was having two Starfighter jockeys as supervisors during my career. I'm sure they would head to different industries and businesses today after leaving the air force.

[Speed of Sound]

Maybe the politicians need to take an interest along the lines of the Rogers Commission into the Challenger disaster. That way they would have the power to seize evidence, subpoena witnesses, provide legal protection for whistleblowers and potentially jail anyone found to have deliberately facilitated the situation.

This could be done once the MAX is back flying.

[Kerosene Kraut]

Could this whole affair end the grandfathering of aircraft certifications?

[73qanda]

Fergusd can you give some brief ( easily understood) examples of how high quality code is different from most code? Or how the process of writing/developing it is different? I have never been involved in computing at all so have little understanding of what the differences might be.
Cheers

[Speed of Sound]

Fergusd can you give some brief ( easily understood) examples of how high quality code is different from most code? Or how the process of writing/developing it is different?

High quality code is code which has been written, tested, tweaked, tested, tweaked again, tested again until all foreseeable outcomes and possible conflicts have been examined and the code is still doing what it was initially designed to do.

This takes time to do properly. The difference between good code and bad code is simply the point at which you stop testing and declare that it is ‘good enough’.

[Mac the Knife]

73qanda, almost impossible to explain to a non-programmer (and some programmers!)

Take a read of some of the things in The Daily WTF - The Daily WTF: Curious Perversions in Information Technology (http://thedailywtf.com/) - and things may get a little clearer for you.

Mac

[BDAttitude]

The amount of iterations you need in that business is strongly dependent on the system knowledge of coders involved. Specs are usually not 100% sound especially regarding unforseen conditions and abnormal conditions. You can have people involved who will do either the right thing by themselves or ask if they don't know. And you can have people involved which will do just something or nothing.

[PaxBritannica]

Doesn't sound to me as if the MAX problem is a coding issue. Coders work to a specification. The specification comes from a design. The design is Boeing's responsibilty. As design parameters changed, it should have been someone's job to take a high-level holistic view of the overall design and spec and identify everything that would be affected. It's not OK to just redesign, write new specifications and give them to the cheap offshore coding subcontractors.

From all accounts, Boeing got rid of the people whose job this would have been. I understand why. Those people are expensive, and by the very nature of their work they slow things down.

Boeing saved money on coders, but also saved money on the experts who were needed to compensate for the cheap coding.

[Pearly White]

Could this whole affair end the grandfathering of aircraft certifications?
You pretty much need a paternity test.
The problem is that what is being grandfathered is starting to look much more like a third cousin twice removed.

[GordonR_Cape]

Fergusd can you give some brief ( easily understood) examples of how high quality code is different from most code? Or how the process of writing/developing it is different? I have never been involved in computing at all so have little understanding of what the differences might be.
Cheers

In my past life I wrote code (albeit in the insurance industry). The differences include that I worked in the business for 20 years, knew what the requirements meant, and was able to relate face-to-face to the actuaries who designed the products. This helped because even if they were badly specified, I was involved in an iterative process of clarifying the specifications.

Such a job is best defined as an 'analyst-programmer', not just a pure coder. It helps the speed and accuracy of the process. And preferably not someone working on contract.

After all of that I was able to do testing (not my own code), because I knew the products, and knew the code. Obviously you need independent testers, but the deepest level of testing must specified in advance by people with knowledge of the systems and the code.

P.S. I came from an engineering background, but many of the principles of clear thinking are the same.

[Speed of Sound]

Doesn't sound to me as if the MAX problem is a coding issue.



You are right.

Ultimately this is a management decision to accept a solution to the changed flight characteristics problem which had little redundancy built in and very serious consequences if it went wrong close to the ground.

It was further aggravated by another management decision to ‘sell’ the aircraft to customers as an ‘iPad only’ conversion which was almost certainly why MCAS was left out of all training and ops literature.

[DaveReidUK]

Could this whole affair end the grandfathering of aircraft certifications?

The scope for grandfathering was beginning to run out, anyway.

Once the 777X is certificated, it's hard to see what other candidates there might be - Airbus have already applied the Neo treatment to all of their legacy narrow- and wide-body family, there clearly aren't going to be any further 747 deelopments, so what does that leave ?

[doxter]

Fergusd can you give some brief ( easily understood) examples of how high quality code is different from most code? Or how the process of writing/developing it is different? I have never been involved in computing at all so have little understanding of what the differences might be.
Cheers

what i would offer here Sir is that in many ways its the same principle all through commerce . how do you get quality when you outsource ? providers will have a contract that defines exactly what there obligations to the client are , and now more . otherwise they would be giving them services for free . yes you can of course get tailored / adhoc services but very often that is where the sting in contracts are , they become expensive and also this translates to delay and further cost on the buyer . the impossible challenge that is outsourcing .

agree with this by @GordonR_Cape- it is the vital everyday approach that can help deliver quality .

"This helped because even if they were badly specified, I was involved in an iterative process of clarifying the specifications."

[Kerosene Kraut]

That only depends on the next available engine generations.

[Bend alot]

The scope for grandfathering was beginning to run out, anyway.

Once the 777X is certificated, it's hard to see what other candidates there might be - Airbus have already applied the Neo treatment to all of their legacy narrow- and wide-body family, there clearly aren't going to be any further 747 deelopments, so what does that leave ?
S269 thru the S269D inc some death.

[yoko1]

A thorn in their side to the point where it was suspected (by user wonkazoo) that Boeing had got someone to flood this forum with posts blaming the pilots.

The intersection of a bad design and a poorly prepared crew are not mutually exclusive concepts. Despite Boeing's obvious series of blunders with the MAX design, some of the posters here, including myself, are rightfully concerned with the decline in crew training and certification standards worldwide. There have been a string of accidents/incidents that have nothing to do with the MAX that provide worrisome indications that airlines, abetted by manufacturers, continue to push for the minimal (and in theory less costly) levels of pilot training and experience. Ironically, one of the recurring complaints about the MAX development was how Boeing and their airline customers intentionally tried to minimize the differences training. Would it be too obvious to point out that insufficient training would show up as an inadequate crew response to a malfunction?

There is strong evidence of issues with crew performance in the Ethiopian accident, and some lessor but still problematic issues at Lion Air, likely a result of the training and operations culture at these airlines. This concern is largely getting a pass because of the overwhelming focus on Boeing. It is not a case of "blaming the pilots" when someone points out that these pilots were set up to fail by airlines that did not give them the training or tools to manage a serious, yet recoverable, malfunction.

So at the end of the day, the MAX will either be fixed or grounded, but the issues with crew training and certification will remain unless they are addressed as well. I don't really see how ignoring the problem makes for safer flight operations.

[Nialler]

Fergusd can you give some brief ( easily understood) examples of how high quality code is different from most code? Or how the process of writing/developing it is different? I have never been involved in computing at all so have little understanding of what the differences might be.
Cheers
There needs to be a very detailed process beginning from the earliest design specs, going through ever more detailed design documents right down to the coding of the separate routines involved. Strict rules must be set regarding the tools and methodologies to be used. The customer must agree and sign off on these. Separately, a test plan must be created. This must involve developers - in their tests, software always works. Testers try to break, rather than fix.

Again, the customer signs off on this. User acceptance testing is best performed by the customer. At all stages, testing must be documented. All flaws must be documented. A tool set for orthogonal defect classification to detect underlying design defects, or even possibly individual programmer defects. The test plan will allow for some functional testing of programme logic at the desktop level, but eventually the code must be tested in an environment which simulates the environment on which it will run. Again, customer sign-off will be needed and that environment must be provided and managed by the customer.

Then testing begins along the lines of the agreed plan. All successes and failures are logged. Remember, the job of the test team is to break it, so the more extreme the conditions under which the software is expected to operate, the better. Invalid inputs, strange dates, the whole lot. If fixes are required, or an invalid assumption had crept into the design then this must be rigorously documented and signed off by the customer.

After testing, then you proceed to user acceptance testing. This is the role of the customer, and the last step before code goes into production. At this stage, there then are the layers of change management and change control.

How do we release our software into the wild? Obviously, in aviation, there are additional considerations.

[DaveReidUK]

That only depends on the next available engine generations.

Does it ?

What existing airframes are you going to hang new-generation engines on ?

[Kerosene Kraut]

Could be anything between A320, 787, A350 and whatever. There might be a lot new engine technology coming. It's not like progress is ending today.

[Redredrobin]

Last chance to see?
Norwegian are having a shot at getting SE-RTC home from Malaga, just coasted out into the Bay of Biscay, 20,000 ft,330kts.

[Grav]

Last chance to see?
Norwegian are having a shot at getting SE-RTC home from Malaga, just coasted out into the Bay of Biscay, 20,000 ft,330kts.

Flying at 20,000 ft which is the maximum altitude for flaps extension, just in case MCAS kicks in?

[FrequentSLF]

This is correct. Everything happening within the assembly of the Eaton motor will not be in the wiring diagrams. One would have to look in the technical customer manual of that device.
this opens another can of worms..
If and I say if, some logic is performed on the controller of the motor it will not comply with certifications. The motor controller should only regulate torque, current, etc... DO NOT have any logic on the input signals should be a must.
said so, it seems that the FCC is in charge of disabling the auto (AP, STS, MCAS), and would explain the problem that has just surfaced... a failure onnthe micro on the FCC could send conflicting signals to the controller...

[DaveReidUK]

Could be anything between A320, 787, A350 and whatever. There might be a lot new engine technology coming. It's not like progress is ending today.

Well yes, granted the last two perhaps, though I don't see the A320 family getting re-engined for a second time.

But putting new powerplants on 5-10 year old designs hardly qualifies as "grandfathering" when compared to certificating 4 distinct generations of an aircraft over a 50-year period on the same TC.

[Kerosene Kraut]

Let's say Boeing comes up with the NMA one day, wouldn't those engines become available to Airbus as well? Like for heavier versions of the A320-family?
Actually Airbus does a lot of neo-detail optimization like adding winglets, cabin redesign, tank redesign, door reconfiguration and such all the time, future proofing their single aisle family for more to come.

[hunbet]

KC135s have been re-powered twice.

[fdr]

The intersection of a bad design and a poorly prepared crew are not mutually exclusive concepts. Despite Boeing's obvious series of blunders with the MAX design, some of the posters here, including myself, are rightfully concerned with the decline in crew training and certification standards worldwide. There have been a string of accidents/incidents that have nothing to do with the MAX that provide worrisome indications that airlines, abetted by manufacturers, continue to push for the minimal (and in theory less costly) levels of pilot training and experience. Ironically, one of the recurring complaints about the MAX development was how Boeing and their airline customers intentionally tried to minimize the differences training. Would it be too obvious to point out that insufficient training would show up as an inadequate crew response to a malfunction?

There is strong evidence of issues with crew performance in the Ethiopian accident, and some lessor but still problematic issues at Lion Air, likely a result of the training and operations culture at these airlines. This concern is largely getting a pass because of the overwhelming focus on Boeing. It is not a case of "blaming the pilots" when someone points out that these pilots were set up to fail by airlines that did not give them the training or tools to manage a serious, yet recoverable, malfunction.

So at the end of the day, the MAX will either be fixed or grounded, but the issues with crew training and certification will remain unless they are addressed as well. I don't really see how ignoring the problem makes for safer flight operations.

Yoko, the matter of flight crew training and standards is a general matter of concern, across nationalities, ™all are punished™, as Escalus said. The fix attempted by the FAA following the embarrassment of Colgan is anaemic at best and detracting resources from.efective training at worst. The industry has issues. Nevertheless, the JT and ET crews were placed in positions that were unreasonable as first disclosed, and each revelation deepens that concern. The crew competency necessary to reliably survive the events with the knowledge the crews had at that time is not that trained by airlines, selected by HR, a standard obliged by the national regulators, ICAO or Iata, nor is it evident that passengers are prepared to pay to assure such standards
The rules require unexceptionalism.... And the planes issues definitely exceeded any reasonable level of that criteria.

Those cockpits were difficult environments in order to cope with what amounts to compound critical failures. It remains unreasonable to blame the messenger of the systemic failings that deregulation naturally result in
​

[DaveReidUK]

KC135s have been re-powered twice.

Unsurprisingly, as they're even older than the 737. :O

[SteinarN]

KC135s have been re-powered twice.

And 747 twice, at least.
And the 777 is getting its second reengine I think it is fair to say

If the frame lives long enough it will be reengined every 15 years or so.

[WHBM]

Boeing did an all-new 787. That didn't work out particularly smoothly either.

Regarding grandfathering of certificates and qualifications, we've discussed the PowerPoint training and penalties for additional training needs, but a comment by a US 737 crew on, having done the computer review, they were unexpectedly presented with a Max for the first time, both of them, due to a rescheduling, was revealing. They said they both felt quite unprepared for all the differences, and although they completed the flight straightforwardly, said it would have been a different matter if anything had gone wrong. THis really comes down to commonsense not just at the manufacturer or the FAA, but the airline as well, with not even thinking of this as an issue. As well as Boeing engineers being sidelined, it's aviation pros in the airline management structure as well. Did nobody think to give their captains a hundred hours or so on the Max before putting them with an FO doing a first run ?

I don't seriously expext the Max back in the air before 2020, at least. I'm wondering when the Boeing stock price "Emperor has no Clothes" situation will finally get recognised. Because only then will some management changes swiftly follow. I think the balloon will burst when the production line has to be stopped.

[krismiler]

It will be much easier to re-engine current types as they were designed for modern high bypass engines, unlike the B737 which was built for low bypass JT8D motors. Installing unducted fan engines could prove problematic given the differing aerodynamics, and would probably be best on a clean sheet design drawn up with UDFs specifically in mind.

The USAF is going to re-engine it’s B52s and was originally going to use 4 high bypass turbofans but decided to continue with the original 8 engine configuration to reduce the amount of structural modifications required.

https://www.ainonline.com/aviation-news/defense/2019-03-02/new-life-b-52

[wonkazoo]

A thorn in their side to the point where it was suspected (by user wonkazoo) that Boeing had got someone to flood this forum with posts blaming the pilots ("JUST FLY THE PLANE").

RIP 737 Driver??

Born (Joined) April 6, 2019
First post April 9, 2019
Died (Disappeared) May 11, 2019
Total Posts: 209
Posts per day: 5.91

To be clear: I'm not suggesting that Mr. Driver was a shill for Boeing or anything else. Purely noting that his/her posts were immensely voluminous in a very short period of time, were very very well informed and were almost exclusively focused on blaming the pilots and exculpating Boeing. For someone who appeared to be somewhat obsessed by the topic (737 MAX incidents) it is odd that he/she lost any interest after May 11.

If Driver was working or advocating on behalf of Boeing either directly or indirectly I would offer that he is probably not the only one.

Warm regards,
dce

[yoko1]

tency necessary to reliably survive the events with the knowledge the crews had at that time is not that trained by airlines, selected by HR, a standard obliged by the national regulators, ICAO or Iata, nor is it evident that passengers are prepared to pay to assure such standards
The rules require unexceptionalism.... And the planes issues definitely exceeded any reasonable level of that criteria.

Those cockpits were difficult environments in order to cope with what amounts to compound critical failures. It remains unreasonable to blame the messenger of the systemic failings that deregulation naturally result in
​

The gods of aviation have never assured pilots fair skies or flawless equipment, yet we are still commanded to keep the blue side up if humanly possible. The penultimate Lion Air crew (both Captain and FO in turn) without even an iota of information about MCAS demonstrated that the tools were available to keep the aircraft under control until the malfunction itself could be contained. The Captain of the Lion Air accident flight performed the same feat, again with no knowledge of MCAS (though the previous day's write-ups provided clues). Apparently the Captain thought his FO would have a similar level of skill at the controls, but sadly he failed to adequately monitor. Thus three out of four Lion Air pilots pretty much lay to rest the contention that this was a malfunction that rendered the aircraft uncontrollable. Challenging maybe, but not impossible.

Ethiopian 302 was another case entirely. By this time, information regarding MCAS had been disseminated. Granted Boeing published this information in a rather lawyerly, mealy-mouthed way that was far from sufficient. However, there was enough there to read between the lines that the pilots at my airline understood a few key pieces of information: if operating a MAX, an erroneous stick shaker should be considered a serious event; the unreliable airspeed and runaway trim NNC were the go-to procedures; if encountered on liftoff, do not under any circumstances retract the flaps. This knowledge was, in theory, available to the Ethiopian pilots as well.

If one were paying attention, there have been a number of troubling reports regarding Ethiopian's pilot training and certification standards and overall operating culture. The Ethiopian 409 crash into the Mediterranean back in 2010 should had been a harbinger. The accident investigation concluded, in part: "the probable causes of the accident were the flight crew's mismanagement of the aircraft's speed, altitude, headings and attitude through inconsistent flight control inputs resulting in a loss of control and their failure to abide by CRM principles of mutual support and calling deviations"

It would be comforting to think that Ethiopian took this report to heart and poured resources into improved crew training. Instead, they blasted the findings and attempted to blame the crash on either sabotage, a shoot-down by unknown party, or a lightening strike. Not surprisingly, then we have this (largely ignored) piece from the Washington Post last April:

Ethiopian pilots raised safety concerns years before fatal crash, records show (https://www.washingtonpost.com/business/2019/03/21/ethiopian-pilots-raised-safety-concerns-years-before-fatal-crash-records-show/?utm_term=.d8716e8c745a)

These reports date back to 2015 (a mere five years after the ET409 accident). Quoting from the article:

One pilot said the airline didn’t “have the infrastructure” to support the fleet of Boeing and Airbus jets it ordered, and alleged the airline had a “fear-based” management culture in which “safety is being sacrificed for expansion and profit margin.” The pilot also accused the airline of failing to update pilot manuals and leaving out certain checklists designed to help pilots respond to “non-normal” situations. Another pilot criticized Ethiopian regulators for maintaining lax standards with respect to crew flight and rest time.

​​​​​​One pilot accused the airline of employing flight simulator trainers that are not knowledgeable about “aircraft systems, Boeing procedures, or company procedures,” and failing to follow a syllabus for a pilot training course.

The pilot also noted that “non-normal checklists in the cockpit are not kept current, including complete omission of certain checklists,” referring to documents that instruct pilots on how to respond to “non-normal” equipment behaviors that can become dangerous.

Fast forward to a time period after Lion Air but prior to the ET302 accident, we have this item published by Bloomberg, also largely ignored:

Long Before Boeing 737 Max Crash, Ethiopian Air Pilot Warned of Dangers (https://www.bloomberg.com/news/articles/2019-05-29/long-before-crash-ethiopian-air-pilot-warned-bosses-of-dangers?utm_campaign=socialflow-organic&utm_source=twitter&utm_content=business&utm_medium=social&cmpid=socialflow-twitter-business)

Quoting from the article:

An Ethiopian Airlines (https://www.bloomberg.com/quote/1646375D:ZC) pilot told senior managers at the carrier months before one of its Boeing Co. (https://www.bloomberg.com/quote/BA:US) 737 Max jets crashed that more training and better communication to crew members was needed to avert a repeat of a similar disaster involving a Lion Air (https://www.bloomberg.com/quote/558867Z:IJ) flight.

According to emails and documents reviewed by Bloomberg News, the pilot in December urged his superiors to bolster training on a 737 Max flight-control feature so crews would be better prepared for what the Lion Air (https://www.bloomberg.com/quote/558867Z:IJ) pilots encountered in October before plunging into the Java Sea, killing all aboard.

“It will be a crash for sure” if pilots struggling with a malfunction of Boeing’s flight-control system on the 737 Max also encountered, for example, a cockpit warning that they were flying too close to the ground, the pilot, Bernd Kai von Hoesslin, wrote in a Dec. 13 email.

​​​​​​In the December email, von Hoesslin reminded managers that flight crews could be overwhelmed by multiple warnings and cockpit alerts that can sound during an errant activation of MCAS.

In a separate email in November, von Hoesslin asked airline managers to provide more detail about MCAS to “those Max pilots who are not fully or even aware of how the Max MCAS” system functions. The request came after a flight operations manager at the airline circulated Boeing’s November 6 service bulletin that described, without naming MCAS, how erroneous sensor data could cause the jet to pitch toward the ground automatically, and how pilots should respond.

In a statement released on Twitter Wednesday, the airline said it “strictly complies with all global safety standards and regulatory requirements.” It also said that allegations it didn’t specify “are false and factually incorrect,” and called the pilot a “disgruntled former employee” who was fired.

Darryl Levitt, an attorney for von Hoesslin, said the pilot was not fired. Rather, he resigned from the airline after he had “previously raised concerns with Ethiopian Airlines that in Capt. von Hoesslin’s opinion were not adequately addressed, and his concerns related to very serious matters of aircraft safety,” Levitt said.

Gotta like that "disgruntled former employee" line. Sounds like something Boeing would have said before their world came crashing down.

Next, we have this from an April 16th update in the Aviation Herald:

On Apr 11th 2019 The Aviation Herald received a full copy of the Flight Operations Manual (FOM), Revision 18B released on Nov 30th 2018, which is currently being used by Ethiopian Airlines (verified in April 2019 to be current). Although Boeing had issued an operator's bulletin on Nov 6th 2018, which was put into Emergency Airworthiness Directive 2018-23-51 (http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgAD.nsf/eff7ed6468ccd134862575e000837739/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf) dated Nov 7th 2018 requiring the stab trim runaway procedure to be incorporated into the FOM ahead of the sign off of this version of the FOM (the entire document is on file but not available for publishing), there is no trace of such an addition in the entire 699 pages of the FOM.

Quite the opposite, in section 2.6 of the FOM "Operational Irregularities" the last revision is provided as Revision 18 dated "Nov 1st 2017".

According to information The Aviation Herald had received in March 2019, the Airline Management needed to be reminded to distribute the Boeing Operator's Bulletin as well as the EAD to their pilots, eventually the documents were distributed to the flight crew. However, it was never verified, whether those documents had arrived, were read or had been understood. No deeper explanation of the MCAS, mentioned but not explained in both documents, was offered.

It turned out, that only very cursory knowledge about the stab trim runaway procedure exists amongst the flight crew of Ethiopian Airlines even 5 months after the EAD was distributed. In particular, none of the conditions suggesting an MCAS related stab trim runaway was known with any degree of certainty. In that context the recommendation by the accident flight's first officer to use the TRIM CUTOUT switches suggests, that he was partially aware of the contents of the EAD and reproduced some but not all of the provisions and not all of the procedure, which may or may not explain some of the obvious omissions in following the procedure in full.​​​​​​

Finally, we have the knowledge that Ethiopian Airlines, backed by the Ethiopian Civil Aviation Authority, thought it was perfectly acceptable to put a pilot into the right seat of a 737 after a mere 160 hours of total flight time. As a point of reference, 160 hours equates to about two months of experience at my airline.

Taken in full, these reports draw a fairly convincing picture that Ethiopian Airlines was an accident waiting to happen.

However, Boeing's cock-up with the MAX has been so huge, so amazingly stupendously perplexingly attention-grabbing, that it has literally sucked all the oxygen away from any discussion other than BOEING BOEING BOEING, with perhaps a smidgen of FAA regulatory capture.

So when I say Ethiopian Airlines is getting a pass, I do mean they are getting a pass.




​​​​​​

​​​​​​

[Pearly White]

The scope for grandfathering was beginning to run out, anyway.

Once the 777X is certificated, it's hard to see what other candidates there might be - Airbus have already applied the Neo treatment to all of their legacy narrow- and wide-body family, there clearly aren't going to be any further 747 deelopments, so what does that leave ?
The venerable stick insect - the 757?

[Smythe]

Well yes, granted the last two perhaps, though I don't see the A320 family getting re-engined for a second time.

But putting new powerplants on 5-10 year old designs hardly qualifies as "grandfathering" when compared to certificating 4 distinct generations of an aircraft over a 50-year period on the same TC.


What I can see though, is putting the wings from the C-Series -500 on the A320, or a further design of that wing. A metal tube, composite wings with new engines, this would be a formidible design for at least 10 years. After all, it would be up against the MAX series, which I think has been flogged enough.

Boeings clean sheet FSA (future small aircraft) single isle was not due until 2030...and the E series, is well, virtually dead.

Boeing brilliant concept to knee jerk the NMA, a 767 fuselage with composite wings....really?

[FrequentSLF]

...and then, right as he disappeared, someone new appeared. Not quite as rabid about the pilots, but still careful to mention them at every opportunity, a fairly strong supporter of Boeing, but keen to mention their mistakes. One who seems to have inside information to make his points.

not only inside information, also time to write long posts with several references to information published long ago... and carefully trying to drive the discussion away from certain issues... like why both crew fdr show just a blip on the manual electrical trim....
i think that understanding that blip will be a key on the investigation, however we (or I) do not even know if the FDR records directly the thumb switch or the signal is processed by the FCC before been transmitted to the FDR. Considering the latest setback due to processing failure, we might assume that the final seconds of the recording might not be accurate due to FCC micro processor failure, latency, delay....or can even speculate that the pilots were trying to manually electricaly trim butthe system was not responding to their commands.
furthermore, Mr. Yoko1 where on the checlk lists is stated not to retract flaps?

[BDAttitude]

Do not forget about the data, nobody else has, that the stability is only relaxed below certification requirenments but definitely never ever unstable :rolleyes:.

[fizz57]

However, Boeing's cock-up with the MAX has been so huge, so amazingly stupendously perplexingly attention-grabbing, that it has literally sucked all the oxygen away from any discussion other than BOEING BOEING BOEING, with perhaps a smidgen of FAA regulatory capture.

So when I say Ethiopian Airlines is getting a pass, I do mean they are getting a pass.​​​​​

​​​​​​


Thanks for your - voluminous - post, which however really adds nothing new. We know the pilots screwed up, pilots tend to at times. Whether Boeing or the airlines were responsible for the 300-odd deaths is of interest only to lawyers and accountants. Things have moved on.

What the accidents - irrespective of cause - have shown is that the MAX has inherent flaws that extend to the certification process and even possibly to earlier types. This, I would suggest, is of greater and longer-lasting interest to most people here than the isolated causes of two fatal accidents. Yes, pilot training is also a concern but that is a general issue not specific to the MAX. I would also suggest that it belongs on another thread not this one.

[DaveReidUK]

I think that understanding that blip will be a key on the investigation, however we (or I) do not even know if the FDR records directly the thumb switch or the signal is processed by the FCC before been transmitted to the FDR.

That particular FDR trace is pretty unambiguous - it's labelled "Manual (Electric) Trim Command" and has three possible states: "Trim Up - Man", "Trim Down - Man" and "No Trim".

If that's not a reference simply to the pickle switch position, one would expect it to be described differently.

There is, of course, a separate FDR trace with the legend "Automatic Trim Command" and states described as "No Trim", "Trim Up - FCC" and "Trim Down - FCC".

[BDAttitude]

That particular FDR trace is pretty unambiguous - it's labelled "Manual (Electric) Trim Command" and has three possible states: "Trim Up - Man", "Trim Down - Man" and "No Trim".

If that's not a reference simply to the pickle switch position, one would expect it to be described differently.

There is, of course, a separate FDR trace with the legend "Automatic Trim Command" and states described as "No Trim", "Trim Up - FCC" and "Trim Down - FCC".
From names of signals you should not deduce how they were captured and processed. I am not saying that they are not analogue signals digitized by FDR directly but I just would like to know fore sure.
How would expect those signals to be called anyhow if they were captured by e.g. the FCC and passed to the FDR by some a digital bus?

[DaveReidUK]

How would expect those signals to be called anyhow if they were captured by e.g. the FCC and passed to the FDR by some a digital bus?

I don't know what I'd call them, but if there was a channel for them on the FDR I would expect there also to be a separate channel for raw pickle switch position, and the logical one to show on the trace readout would be the latter (as appears to be the case).

[rattman]

...and then, right as he disappeared, someone new appeared. Not quite as rabid about the pilots, but still careful to mention them at every opportunity, a fairly strong supporter of Boeing, but keen to mention their mistakes. One who seems to have inside information to make his points.


Glad I am not the only one to notice this

[BDAttitude]

I don't know what I'd call them, but if there was a channel for them on the FDR I would expect there also to be a separate channel for raw pickle switch position, and the logical one to show on the trace readout would be the latter (as appears to be the case).
Therefore I would like to learn more about the FDRs architecture.
I've done a lot of logging data analysis - not in aviation but in automotive though. We would often find data where state information was not consistent and people would say this state vector is not possible. That must be faulty data. In nearly all cases it could be clarified - no faulty data but delays in signal path here or not looking at raw data but somehow processed data there.
So if you could point me to some material where I could learn more about the FDR and what exactly it processes I would be thankful.
I think I recognize the software that printed those plots (NI Diadem) and of course those axis descriptions are assigned by whomever did the analysis on his convenience.

[Alchad]

Glad I am not the only one to notice this

Personally I'm grateful that the Mods have allowed this particular thread to continue and not close it off as has happened to all the others. I think it is abundantly clear that some very interesting information has been shared since the thread was started, but I wish the Mods would use the stick whenever "pilot training" (or lack of it) gets mentioned and cull the post.

Alchad

[SteinarN]

I don't know what I'd call them, but if there was a channel for them on the FDR I would expect there also to be a separate channel for raw pickle switch position, and the logical one to show on the trace readout would be the latter (as appears to be the case).

Well, there is a large number, certainly in excess 100, of true/false datapoints recorded by the FDR, the manual trim up/trim down to be one of them where each (trim up, trim down) have its own true/false state.

If all those datapoints should run one or two wires each directly to the FDR then the connection on the FDR would need to be humongously large. And there would be introduced a not insignificant additional risk for wire shorts due to the added number and lenghts of wire which in its own is a safety risk for the aircraft.

So I am thinking you are jumping to conclusions and is not really considering the different methods of collecting all these data. Letting the FCC and other electronic boxes send data to the FDR via a buss greatly reduces the complexity of collecting all those data. And the buss is there anyway, how else to cellect data about engine conditions, flight parameters like acceleration etc?

So I am in line with the others here questioning exactly how the thumb switch signal is collected. I would hazard a guess it is NOT collected by running one or two discrete wires from the thumb switches all the way to the FDR.

[BDAttitude]

Well, there is a large number, certainly in excess 100, of true/false datapoints recorded by the FDR, the manual trim up/trim down to be one of them where each (trim up, trim down) have its own true/false state.

If all those datapoints should run one or two wires each directly to the FDR then the connection on the FDR would need to be humongously large. And there would be introduced a not insignificant additional risk for wire shorts due to the added number and lenghts of wire which in its own is a safety risk for the aircraft.

So I am thinking you are jumping to conclusions and is not really considering the different methods of collecting all these data. Letting the FCC and other electronic boxes send data to the FDR via a buss greatly reduces the complexity of collecting all those data. And the buss is there anyway, how else to cellect data about engine conditions, flight parameters like acceleration etc?

So I am in line with the others here questioning exactly how the thumb switch signal is collected. I would hazard a guess it is NOT collected by running one or two discrete wires from the thumb switches all the way to the FDR.
You got it :ok:.
It's not to expect someone has manipulated or frauded something.
Interpreting digital data collected from various sources across different datalinks is extremely bitchy and overpapered by printouts like we have seen. It also requires extremely high skilled analysts - to the astonishment of many. What can go wrong with that beautiful continuous lines anyway :O

[DaveReidUK]

Therefore I would like to learn more about the FDRs architecture.
I've done a lot of logging data analysis - not in aviation but in automotive though. We would often find data where state information was not consistent and people would say this state vector is not possible. That must be faulty data. In nearly all cases it could be clarified - no faulty data but delays in signal path here or not looking at raw data but somehow processed data there.
So if you could point me to some material where I could learn more about the FDR and what exactly it processes I would be thankful.
I think I recognize the software that printed those plots (NI Diadem) and of course those axis descriptions are assigned by whomever did the analysis on his convenience.

ICAO Annex 6 lists mandatory FDR parameters, and is well worth a read. One of those parameters is "Cockpit pitch trim control input position" (my emphasis, not ICAO's).

Well, there is a large number, certainly in excess 100, of true/false datapoints recorded by the FDR, the manual trim up/trim down to be one of them where each (trim up, trim down) have its own true/false state.

If all those datapoints should run one or two wires each directly to the FDR then the connection on the FDR would need to be humongously large. And there would be introduced a not insignificant additional risk for wire shorts due to the added number and lenghts of wire which in its own is a safety risk for the aircraft.

So I am thinking you are jumping to conclusions and is not really considering the different methods of collecting all these data. Letting the FCC and other electronic boxes send data to the FDR via a buss greatly reduces the complexity of collecting all those data. And the buss is there anyway, how else to cellect data about engine conditions, flight parameters like acceleration etc?

So I am in line with the others here questioning exactly how the thumb switch signal is collected. I would hazard a guess it is NOT collected by running one or two discrete wires from the thumb switches all the way to the FDR.

Nobody is suggesting that FDRs have a zillion-pin connector carrying individual signals from all the hardware whose configuration need to be recorded - that would be ridiculous.

That's why FDAUs came along in the 1970s.

[BDAttitude]

ICAO Annex 6 lists mandatory FDR parameters, and is well worth a read. One of those parameters is "Cockpit pitch trim control input position" (my emphasis, not ICAO's).

:ok:
If BA chose to implement this by reading in pickle switches in the FCC and transmitting to DFDR by datalink and we do now now that this FCC can have computational issues in "situations" (not satisfied with the news details at all) then we are right at the point why I would like to now exactly: Which box does A/D at which rate and post processing and which uplink to FDR at which rate and possibly via which gateways in between.

[Eesh]

:ok:
If BA chose to implement this by reading in pickle switches in the FCC and transmitting to DFDR by datalink and we do now now that this FCC can have computational issues in "situations" (not satisfied with the news details at all) then we are right at the point why I would like to now exactly: Which box does A/D with wich rate and post processing and which uplink to FDR with which rate and possibly which gateways in bewtween.

I have a stupid question, may be better to get it discounted early.

When MCAS is active, could there be any difference in the control of electric trim from the trim switches at the Captains side and the FO side?
The Lion air Captain was winding back the trim wheel for seconds. The FO who was watching this all the time suddenly decided to use only blips, looks strange.

-Sanish

[BDAttitude]

I have a stupid question, may be better to get it discounted early.

When MCAS is active, could there be any difference in the control of electric trim from the trim switches at the Captains side and the FO side?
The Lion air Captain was winding back the trim wheel for seconds. The FO who was watching this all the time suddenly decided to use only blips, looks strange.

-Sanish
​​​​​​From the wiring diagrams and what ends up at the eaton trim motor assembly it should be no different.
However the digital representation of th FOs trim signal in the captains FCC could be different if e.g. FOs trim signal is digitized by FOs FCC and sent via datalink. And if interlock relies on software not on logic in the motor assembly.
Big IFs that's why more transparency is needed.

[GordonR_Cape]

I have a stupid question, may be better to get it discounted early.

When MCAS is active, could there be any difference in the control of electric trim from the trim switches at the Captains side and the FO side?
The Lion air Captain was winding back the trim wheel for seconds. The FO who was watching this all the time suddenly decided to use only blips, looks strange.

-Sanish

Very good question, though I have no idea of the answer!? We have been told that MCAS operates on alternate AOA sensors, so it might be that the FCC that was running MCAS would have a different workload from the other FCC.

[MemberBerry]

I have a stupid question, may be better to get it discounted early.

When MCAS is active, could there be any difference in the control of electric trim from the trim switches at the Captains side and the FO side?
The Lion air Captain was winding back the trim wheel for seconds. The FO who was watching this all the time suddenly decided to use only blips, looks strange.

-Sanish

Good question.

I have another question: if the FDR trace is for the switches, why are there only two traces (Trim Up-Man and Trim Down-Man), instead of four: one pair for the captain switches and one pair for the FO switches?

In fact, if they wanted to, they could record even the position of the individual halves of each switch, and that would require 8 parameters to be recorded on the FDR (4 up, 4 down).

The fact that there are only two traces for manual electric trim, one for up and one for down, seems to indicate that those commands are recorded "closer" to the motors than the switches, at a point where it is not possible to differentiate between the sources of the commands, the captain's or the FO's switches, let alone their halves.

[fdr]

YOKO SAN; , training at a number of airlines is conducted under contract by the manufacturer. Including ET. Not sure how that relieves the OEM from a lousy bit of head work, nor, once again, do I see that the crew, 160 etc... are the cause of the malaise that has beset the industry. Blaming the messenger is common practice but not morally supportable, and doesn’t fix the problem, which is industry wide, consider AF447, FEDEX MD’s, UPS bus, etc, splashes at KJAX, KSFO, aluminium wrapping in DXB, sundry uglies short, long, off side, end etc of runways, not done by 160 hr pilots, and not done by any particular race, creed, color, accent or religion. The rules do not require more than a specific standard, don’t blame those that are trained by the system, blame the system, as stated enough times that this matter is becoming an infinite loop.

Pilot performance is the result not the cause of the system.

The 160mhrvpilot probably could have done with a little more tech info by the OEM, and that and associated training being denied him is not his fault, irrespective of how much you may be offended by that.

cheers.

[groundbum]

wish we had a white hat hacker that could track down several of the pro-B posters mentioned earlier, tracing IPs and so forth and see what the real story is. It would be explosive if it could be showed that a major company put stooges out there undercover to steer a discussion in a certain direction. What other chatrooms is this going on on? If B are going to join the conversation here, why not do it openly? There's now a poster ryanairrecruiter answering questions in terms and endearment. So much more adult!

G

[fotoguzzi]

Yet, the 160 hour pilot suggested going to "manual" one minute after stab trim cutout while the many-hour pilot was still wondering why the electric trim switches were not working after cutout

As I read it, he gave up after eight seconds of trying "manual." Whether it was too late at this point to hand crank is, of course, the question.

[yoko1]

Pilot performance is the result not the cause of the system.


I don't think I'm saying anything different here. There are many important lessons that have come out of these tragic accidents if we choose to look at the entire confluence of events, yet around these parts there seems to be a myopic focus on just a few areas.

Part and parcel with the development of transport aircraft is the creation of training, certification, and operational guidelines for all the people who touch that airframe. I would submit that just as Boeing cut corners with the physical design of the MAX, they and their willing partners in the form of the airline operators have conspired to cut corners in other areas as well. It would clearly be a crime to let someone to either perform maintenance or operate the flight controls on an aircraft for which they were not qualified. So how should we evaluate a case in which those people were given something short of adequate training to perform their duties? We fix the planes but we don't fix the process surround the operation and maintenance of those aircraft?

I think it would be uncontroversial to say that pilot training and certification standards have been lowered over the past few decades. And yet when there is evidence that an operator such as Ethiopian is not even living up to those lower standards, is there not cause for concern? We know problems like this also occur on the maintenance side as airlines continually seek to lower their labor costs, so when it becomes apparent that someone at Lion Air failed to adequately diagnose and repair a faulty AOA sensor, do we just shrug our collective shoulders? Or do we have a peek under the hood there as well?

As I have stated multiple times before, the MAX will eventually be fixed or grounded permanently (the former more likely than the latter), but if all the other issues that these accidents have brought to the fore are not addressed as well, then we are just setting the stage for the next tragedy. That strike me as both a terrible waste and a great disservice to those who perished.

[yoko1]

Yet, the 160 hour pilot suggested going to "manual" one minute after stab trim cutout while the many-hour pilot was still wondering why the electric trim switches were not working after cutout




As a clarification, the FO actually had around 360 hours of total time and about three months of line experience at the time of the accident. The 160-hour reference is to the amount of time he had when he was handed his pilot certificate to sit in the right seat of a 737.

The actual text from the CVR transcript was something along the lines of "Stab Trim Cutout!" repeated twice, after which someone reflexively cutout the power to the stab trim motor (not following any procedure) while the aircraft was grossly out of trim which then set the stage for the final dive. Now if this young FO had called for the "Airspeed Unreliable" checklist early in the game, or the "Runaway Stabilizer Trim" checklist after MCAS kicked in, or advised the Captain to not retract the flaps in the first place, or any number of other deviation callouts as the Captain was mishandling the ship, then I would have less concern about the FO's level of training or experience. But he did not either because of a lack of awareness of what was happening or a lack of assertiveness to correct the Captain. In the end, the result was the same.

That being said, I can't really blame the FO for pursuing his dream of becoming a pilot. If someone let me get a job flying heavy iron while I was that young and with that little amount of experience, I would have jumped at the chance too. And I'm sure the airline was glad to have access to a young, enthusiastic pool of pilot candidates who quite naturally would not demand nearly as much compensation as pilots who had many years and thousands of hours of time under their belt.

It all worked out very well for all concerned..... until it didn't.

[yoko1]

From names of signals you should not deduce how they were captured and processed. I am not saying that they are not analogue signals digitized by FDR directly but I just would like to know fore sure.
How would expect those signals to be called anyhow if they were captured by e.g. the FCC and passed to the FDR by some a digital bus?

I would be fascinated to know what goes on under the hood as well. As you may have guessed, I like to know how things work. But frankly, right now we are all just bystanders reading tea leaves in an attempt to make educated guesses.

On the other hand, there are people who actually do know, and these folks are advising the various investigative teams that have been looking at these accidents for many months now. These teams are working with information and resources that dwarf anything any of us have to draw on, and we can make the observation that not a single authoritative source has expressed any concern that the Main Electric Trim was not functioning correctly in the accident aircraft. Lots of other problems have come to light, but this is not one of them. While this may not be as definitive as some would like, it is strongly suggestive that this is not an area of concern.

[BDAttitude]

On the other hand, there are people who actually do know, and these folks are advising the various investigative teams that have been looking at these accidents for many months now. These teams are working with information and resources that dwarf anything any of us have to draw on, and we can make the observation that not a single authoritative source has expressed any concern that the Main Electric Trim was not functioning correctly in the accident aircraft. Lots of other problems have come to light, but this is not one of them. While this may not be as definitive as some would like, it is strongly suggestive that this is not an area of concern.
Many of the things that were to concern of the amateurs here, were first brushed aside only to be confirmed later in the investigations.
I am confident that there will be an explanation for the blips and a confirmation of the motor overload and insufficiency of the cable drum reversion and we will finally learn how much stability margin without MCAS remains.
Until it's there I will be happy speculating about the failure modes, making sure ​they are not forgotten despite the efforts to keep low profile.

[Alchad]

I would be fascinated to know what goes on under the hood as well. As you may have guessed, I like to know how things work. But frankly, right now we are all just bystanders reading tea leaves in an attempt to make educated guesses.

…………. and we can make the observation that not a single authoritative source has expressed any concern that the Main Electric Trim was not functioning correctly in the accident aircraft. Lots of other problems have come to light, but this is not one of them. While this may not be as definitive as some would like, it is strongly suggestive that this is not an area of concern.

I thought quite a few fairly authorative sources had conjectured that the forces on the stabiliser in the out of trim situation they found themselves in were such that it couldn't be counter-acted by the electric trim or the manual wheel?

Alchad

[yoko1]

I thought quite a few fairly authorative sources had conjectured that the forces on the stabiliser in the out of trim situation they found themselves in were such that it couldn't be counter-acted by the electric trim or the manual wheel?

Alchad

Correct on the difficulty of using manual trim to alleviate a severe out of trim condition. However, there is nothing in the entire history of the 737 trim system since the introduction of the NG that indicates that the Manual Electric Trim would stall out under a heavy aerodynamic load (well, at least as long as it stays within the certified flight envelope). There have been other various issues over the years as one might expect from any aircraft system, however this is not one of them. If this were the case, it would already be out there by now.

[safetypee]

yoko1,
Apparently you either have not read the EASA query of the NG trim system (previously referenced), or you choose to ignore what was written.
Similarly you overlook that ease of trimming in normal flight conditions might not be the same as in abnormal conditions - extreme tail angles, nor that trimming with an alleviating tail load (nose down) involves different forces against the load in failed conditions (nose up).

Conversely to your previous assertion; there is nothing in the entire history of the 737 trim system since the introduction of the NG (larger tail) that indicates that the Manual Wheel or Electric Trim would be able to recover from high aerodynamic load; excepting what has been deduced from two accidents.

Whereas you fail to qualify your assertion, the opposing argument is that where an aircraft is deliberately mis trimmed and the resultant force held on the control column, it is probable that a limiting force or ability to apply more trim is reached before the physical stops (flight test techniques AC25-7, within the aircraft flight envelope not necessarily at the extremes of physical tail angle).
But if the aircraft is already in a extreme condition, greater that previously identified during flight test to due to a malfunction, then there is nothing to say either way that the aircraft can be recovered - except accidents.

[MemberBerry]

I just noticed one more thing about the FDR traces of the trim commands. MCAS trim commands show up in the trace even when the cutout switches are used. But that command doesn't reach the motor, and the stabilizer angle remains the same. This suggests the automatic trim commands are sent to the FDR to be logged directly by the FCC, and are not measured somewhere between the cutout switches and the motor, because if they did they wouldn't show in the FDR trace.

However this doesn't seem to be the case for the control column trim switches. In the FDR trace from 05:40:40 to 05:43:05 there are no recorded pilot trim commands. However, in this interval there was this discussion between the pilots:

"At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working."

This suggests the pilots tried to use the trim switches, but it didn't work and the command doesn't show in the FDR trace. If that's the case, it means the information about the thumb switch commands is recorded by the FDR from somewhere between the cutout switches and the motor.

Unfortunately I wasn't able a lot of information about that motor, except this document, previously referenced in the initial Ethiopian thread:

http://www.eaton.eu/ecm/idcplg?IdcService=GET_FILE&allowInterrupt=1&RevisionSelectionMethod=LatestReleased&noSaveAs=0&Rendition=Primary&dDocName=PCT_3401314 (http://www.eaton.eu/ecm/idcplg?IdcService=GET_FILE&allowInterrupt=1&RevisionSelectio nMethod=LatestReleased&noSaveAs=0&Rendition=Primary&dDocName =PCT_3401314)

It has information about some circuit board fixes for the two versions of the motor used on the NG. That issue didn't affect the MAX version of the motor according to the document. According to that document the part number for the motor used on the MAX is 6355D0001-01, but unfortunately I haven't been able to find any schematics for it.

In any case, that "motor" is not just some dumb piece of hardware, since the issue fixed for the two NG versions is "Solder joint fatigue of the memory chip". A dumb motor wouldn't have a memory chip. It's quite likely the motor is designed to communicate with the FDR, so it's possible the pilot trim commands are logged to the FDR by the motor.

Later edit: actually I see yoko1 found some schematics two days ago on post number #782: https://www.pprune.org/rumours-news/621879-max-s-return-delayed-faa-reevaluation-737-safety-procedures-40.html#post10504982

Unfortunately, as he concluded, the interesting stuff happens inside the "controller" part of the "motor", for which we don't have a schematic:
https://i.imgur.com/ri6cX5R.png

[SteinarN]

---and we will finally learn how much stability margin without MCAS remains.

This is something I too am VERY curious about.

I have tried to make some thought experiments.
We know MCAS at low speed was supposed to administer up to 2.5 units AND trim.
We dont know from which value of AOA that AND trim was supposed to be started.
We know stall begins at approximately 14 degrees AOA and is well developed at 15 degrees AOA.
We know Boeing have said MCAS was only supposed to be activated at very unusual flight conditions, so therefore one can deduce that MCAS only should become active at high AOA.
We dont know how many units of trim the elevator can fully compensate starting from neutral elevator position, but Mentour Pilot says that the elevator can compensate for full nose down trim in a NG simulator at low to normal speeds.

Now, on to my thought experiment.
Lets say MCAS was supposed to kick in at 10 degrees AOA.
Lets say that the elevator can compensate for 3.5 units of (out of) trim.
Lets say that 70 percent of elevator authority/travel is used to reach the stall AOA on a NG starting at level flight and in trim.
Lets say that the FCC starts MCAS trim input at 10 degrees AOA and have put in full 2.5 units AND trim at 14 degrees AOA.
Lets say the NG have a linear stick force and travel all the way from level and neutral and up to stall at 14 degrees AOA.
Lets say the MAX with active MCAS have the same linear stick force and travel as the NG.
Lets say we start at 3 degrees AOA at level and straigt in this thought experiment

Using these numbers we see the following;
We need to put in 6.4 percent of available elevator travel for each degree increase in AOA. (70/(14-3))
At 10 degrees AOA we have put in 44.8 percent of the available elevator travel (6.4*(10-3)
Each unit of stabilizer trim (out of trim) needs 28.4 percent of available elevator travel (100 percent/3.5 units trim)
From 10 to 14 degrees AOA we need to put in an additional 25.6 percent of available elevator travel (6.4*4)
But at the same time (10 to 14 degrees AOA) MCAS has put in 2.5 units of nose AND trim.
That MCAS AND is worth 71 percent of available elevator travel (28.4*2.5)

So, we see, with these numbers, that we put in a positive 25.6 percent elevator travel going from 10 degrees to 14 degrees AOA, but at the same time MCAS puts in AND negative 71 percent worth of elevator travel.
The sum of these two values is 45.4 percent of nose down elevator travel, in other words, when going from 10 degrees AOA to 14 degrees AOA in a MAX WITHOUT active MCAS we need to relax the stick from a position corresponding to 44.8 percent aft position at 10 degrees AOA and push it forward to a position of 0.6 percent forward position when we reach stall onset at 14 degrees AOA.

I think it is fair to say that an aircraft exhibiting a pitch stability similar to the values in my thought experiment would be a VERY awkward plane to fly manually in a high AOA flight region.

Of cource, theese numbers is more or less pulled out of my ass. And I've made many simplifications. As I said, this is just a thought experiment trying to understand the effect on a MAX with a non-operable MCAS system.

Feel free to correct my thought experiment and/or try to come up with better values.

[DaveReidUK]

However this doesn't seem to be the case for the control column trim switches. In the FDR trace from 05:40:40 to 05:43:05 there are no recorded pilot trim commands. However, in this interval there was this discussion between the pilots:

"At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working."

This suggests the pilots tried to use the trim switches, but it didn't work and the command doesn't show in the FDR trace. If that's the case, it means the information about the thumb switch commands is recorded by the FDR from somewhere between the cutout switches and the motor.

You are assuming that "The First-Officer has replied that the trim was not working" means that he attempted unsuccessfully to use the electric trim switches.

It could equally have been him just confirming that just over a minute previously both pilots had agreed to disable the stab trim (05:40:35). So the electric trim switches obviously weren't going to work, and there wouldn't have been any point in trying them.

[MemberBerry]

I agree that's one way to interpret that conversation. Unfortunately it seems the preliminary report included just some parts of the CVR transcript. In particular I doubt that when they reenabled electric trim towards the end they didn't say anything about that.

[Turb]

...I wish the Mods would use the stick whenever "pilot training" (or lack of it) gets mentioned and cull the post.
Here's the opposing view. The thread title refers to possible reasons why the MAX's return is being delayed. You couldn't rule out that Boeing is being challenged on the core premise of the entire MAX project, that the MAX is "just another 737", and that no special training or simulators are needed. The justification for including thoughts about pilot training is that a requirement for new pilot training may indeed be one of the reasons for delayed return to service.

I think the balloon will burst when the production line has to be stopped.
Agreed. My best guess is that Boeing have been told to fix not just the software but the whole system that compensates for the aerodynamic effects of those big new engines, AND they're a bit short of good grey-haired engineers who might be able to figure out how to do this, AND they've been told that when they've fixed it they've then got to re-certify the thing, AND they've also been told to provide MAX simulators and a training programme for pilots, AND the most senior management are completely and utterly out of their depth because they can't solve this by outsourcing, or re-branding, or tweaking spreadsheets or buying back shares, or whatever the hell it is that non-engineers do when they are running an engineering company.
If they do stop the line it will be hell getting it started again, probably with new people who haven't really got a clue.

[FrequentSLF]

[QUOTE=MemberBerry;10506346]I just noticed one more thing about the FDR traces of the trim commands. MCAS trim commands show up in the trace even when the cutout switches are used. But that command doesn't reach the motor, and the stabilizer angle remains the same. This suggests the automatic trim commands are sent to the FDR to be logged directly by the FCC, and are not measured somewhere between the cutout switches and the motor, because if they did they wouldn't show in the FDR trace.

​[/QUOTE​​​​​​]
This raises another important question...why the MCAS command is active with a cutout? The cutoff signal is transmitted to the FCC (labelled B) on drawing 27-41. The only answer that makes sense is a programming error that does not disable FCC commands when in cutout, it is 101 coding to interlock the code with the cutputs, including disabling interrupts relevant to such function, and we go back to a other question that is still unanswered, why there is the of PRI and B/U cutout? a back of a switch, that is already available as a CB, and if a back up was needed why not on the NG?

[QUOTE=MemberBerry;10506346]I]
Unfortunately I wasn't able a lot of information about that motor, except this document, previously referenced in the initial Ethiopian thread:

http://www.eaton.eu/ecm/idcplg?IdcService=GET_FILE&allowInterrupt=1&RevisionSelectionMethod=LatestReleased&noSaveAs=0&Rendition=Primary&dDocName=PCT_3401314

It has information about some circuit board fixes for the two versions of the motor used on the NG. That issue didn't affect the MAX version of the motor according to the document. According to that document the part number for the motor used on the MAX is 6355D0001-01, but unfortunately I haven't been able to find any schematics for it.

In any case, that "motor" is not just some dumb piece of hardware, since the issue fixed for the two NG versions is "Solder joint fatigue of the memory chip". A dumb motor wouldn't have a memory chip. It's quite likely the motor is designed to communicate with the FDR, so it's possible the pilot trim commands are logged to the FDR by the motor.
/[QUOTE]
The controller drawings are basically useless, is that the quality of documentation provided to maintenace?

BTW does anybody knows what type of signals are transmitted to the controller? My guess that are analogue signals elaborated by the main trim enable speed and direction and AP trim enable speed and direction boxes in 27-41

[n5296s]

I can't help thinking about the 2 vs 3 AoA sensor thing. Strikes me that EASA/ChinaAA could well say, if MCAS is required to make the aircraft certifiable, and AoA sensors (evidently) have a high failure rate, then you need 3 of them, otherwise you have a single point of failure. I guess it's POSSIBLE to retrofit a third sensor, but not something you do in a couple of days per aircraft.

I also suspect that EASA could be persuaded to roll over on this one, but what about China? In the middle of a trade dispute and only too happy to rub egg into Trump/USA's face...? I even wonder whether Trump's sudden reversal on Huawei this week might not be connected.

[DaveReidUK]

I can't help thinking about the 2 vs 3 AoA sensor thing. Strikes me that EASA/ChinaAA could well say, if MCAS is required to make the aircraft certifiable, and AoA sensors (evidently) have a high failure rate, then you need 3 of them, otherwise you have a single point of failure. I guess it's POSSIBLE to retrofit a third sensor, but not something you do in a couple of days per aircraft.

I also suspect that EASA could be persuaded to roll over on this one, but what about China? In the middle of a trade dispute and only too happy to rub egg into Trump/USA's face...? I even wonder whether Trump's sudden reversal on Huawei this week might not be connected.

If and when the FAA and EASA lift the restriction on the Max, China will inevitably follow suit. To do otherwise would be counter-productive. Trump has been hinting for the last month that the Huawei ban could be lifted in return for progress on trade talks, so nothing to do with the 737.

And it's inconceivable that the fix will involve retrofitting a third AoA sensor on 400+ aircraft, particularly when only two are required in order to identify that one is sending bad data and trigger the "AoA Disagree" warning that the Max already has provision for.

[boguing]

I have a stupid question, may be better to get it discounted early.

When MCAS is active, could there be any difference in the control of electric trim from the trim switches at the Captains side and the FO side?
The Lion air Captain was winding back the trim wheel for seconds. The FO who was watching this all the time suddenly decided to use only blips, looks strange.

-Sanish
My guess is that the Captain may have told the FO that he was 'cancelling' the nose down trim inputs with the trim switch. To a low hours FO brought up on playstations and mobile 'phones, the use of a button to cancel is just a simple momentary press. If The Captain had said 'until the ND trim is removed' he might have understood the need to sustain it.

[yoko1]

yoko1,
Apparently you either have not read the EASA query of the NG trim system (previously referenced), or you choose to ignore what was written.

Yes, I'm aware of their comments, but they have nothing to do with the matter at hand. This issue has been addressed numerous times already by others, and repeating the question doesn't change the answer. I suggest you go back and review those responses.


Similarly you overlook that ease of trimming in normal flight conditions might not be the same as in abnormal conditions - extreme tail angles, nor that trimming with an alleviating tail load (nose down) involves different forces against the load in failed conditions (nose up).

Conversely to your previous assertion; there is nothing in the entire history of the 737 trim system since the introduction of the NG (larger tail) that indicates that the Manual Wheel or Electric Trim would be able to recover from high aerodynamic load; excepting what has been deduced from two accidents.

Whereas you fail to qualify your assertion, the opposing argument is that where an aircraft is deliberately mis trimmed and the resultant force held on the control column, it is probable that a limiting force or ability to apply more trim is reached before the physical stops (flight test techniques AC25-7, within the aircraft flight envelope not necessarily at the extremes of physical tail angle).
But if the aircraft is already in a extreme condition, greater that previously identified during flight test to due to a malfunction, then there is nothing to say either way that the aircraft can be recovered - except accidents.


And this is where I need to ask if you understand that there is only one trim motor involved? That motor receives a signal for direction and speed either from an automated source (Speed Trim, Mach Trim, A/P, MCAS) or the pilot yoke switch. In the accident scenario, when MCAS was commanding the stab nose down the forces were increasing on the jackscrew mechanism. When the pilots were commanding nose up, the forces were decreasing. If the stab motor was going to stall under an aerodynamic load, it would have happened in the direction of increasing (MCAS), and not decreasing force (pilot trimming). On the contrary, MCAS had absolutely no problem using that one trim motor to drive against an ever increasing force until it hit the physical stops. There is no evidence that the motor was ever overtasked.

Add to this the fact that all the FDR traces for both accident aircraft which occur within the certified flight envelope show a direct match between each pilot trim input (yoke switch) and an actual stab movement. We also have the experience of the penultimate Lion Air flight in which both pilots successfully used the Main Electric Trim to counter MCAS. During the Lion Air accident flight, the Main Electric Trim was successfully used to counter MCAS up to the point that the Captain handed over control to the First Officer. You can't just ignore this evidence because it doesn't fit your narrative.

Finally, let's put ourselves in the place of the Ethiopian and Indonesian investigating authorities. Given the history and cultural inclinations of these two nations, they have great motivation to unearth any exculpatory evidence that would remove pilot actions as a cause of concern. They are in possession of the full set of CVR and FDR data and any relevant physical evidence. They have access to all the subject matter experts. If there was any legitimate evidence that there was a failure in the Main Electric Trim system or that it was unable to stop and counter the MCAS inputs, they would be shouting it from the rooftops. They are not, nor is anyone else.

It is time to move on from this line of argument. It is a dry hole.

[Australopithecus]

Hey Yoko...ask your boss if the Eaton stab trim motor is a brushless servo motor, and if so is its driver logic self-contained. Then ask him if its required step and direction signals come from a digital source, like an FCC.

Then get him to confirm whether the same system architecture with its apparently undersized computer exists on the NG.

[n5296s]

particularly when only two are required in order to identify that one is sending bad data and trigger the "AoA Disagree" warning that the Max already has provision for.
I don't follow that. Sure, if one sensor goes back, it's detected, and MCAS is disabled. But that's my point. If MCAS is needed for airworthiness, how big a deal is it when it goes inop in flight? If I was an xAA, it's a question I'd be asking.

Some quick mental arithmetic says the MAX fleet had accumulated ~1 million flight hours when grounded (within a factor of 10). So AoA sensor failures are happening every 500K flight hours (actually more since sometimes it's the inactive one and nobody notices). When there are 5000 aircraft out there, that's a failure every 20 days or so. If MCAS is necessary... what happens when an aircraft has a failure and then, say as a result of an RA, enters the condition MCAS is supposed to handle? And it's one of these low-time minimally-trained crews that are the reality of airlines today - maybe the resurrection of the PF on AF447?

As has been said many times, there are going to be a lot of red faces if there is another hull loss because of MCAS, or the underlying aerodynamic problems which prompted it. I would sure want to be careful not to be one of them.

[ARealTimTuffy]

In the accident scenario, when MCAS was commanding the stab nose down the forces were increasing on the jackscrew mechanism. When the pilots were commanding nose up, the forces were decreasing. If the stab motor was going to stall under an aerodynamic load, it would have happened in the direction of increasing (MCAS), and not decreasing force (pilot trimming). On the contrary, MCAS had absolutely no problem using that one trim motor to drive against an ever increasing force until it hit the physical stops. There is no evidence that the motor was ever overtasked.





While I don't dispute your conclusion, I don't think that your description of forces on the horizontal stab are correct. I would agree that under normal circumstances the load would increase as you trim away from the previously trimmed airspeed, but that would assume no deflection of the elevator.


In this circumstance the pilots were applying substantial nose up elevator. This would tend to increase the force upwards on the front of the horizontal stab, and require the jackscrew to apply an opposite downward force to the front of the horizontal stab. If there were no screw and you applied a nose up elevator and the horizontal stab could slide around position at will, and you would likely see the stab go front up and by default AND which is the same direction the MCAS is driving the trim. The Alaskan Airllines MD80 accident even highlights this. Once the jackscrew let go the horizontal stab went full nose up with full after elevator (i recognize the MD80 uses tabs) and went beyond limits up creating a substantial nose down tendency of the aircraft which wasn't recoverable.


At the end of the day maybe it stalled out maybe it didn't, but from the FDR traces it certainly seems it was moving in the commanded direction.


From Alaskan Airlines Report


As the jam was overcome, the acme screw was being pulled upward through the acme nut by aerodynamic loads, causing upward movement of the horizontal stabilizer, resulting in greater airplane-nose-down motion. This upward pulling motion would have continued until the lower mechanical stop on the acme screw contacted the lower surface of the acme nut, preventing further upward motion of the horizontal stabilizer.


Release of the jam allowed the acme screw to pull up through the acme nut, causing the horizontal stabilizer leading edge to move upward, thus causing the airplane to pitch rapidly downward.

[sadtraveller]

If the stab motor was going to stall under an aerodynamic load, it would have happened in the direction of increasing (MCAS), and not decreasing force (pilot trimming)

I believe that you have this backwards. With sufficient positive elevator deflection, there is in fact a net downward force on the stab, resisting a return of the stab to a neutral position (hence the reason for the necessity of the roller coaster maneuvre described in the 737 original manual and taught to at least some pilots back in the day). Under such conditions, MCAS is assisted by aerodynamic forces, while pilot trimming is opposed by the same.

[Speed of Sound]

As an engineer, not a businessman can anyone who knows about the contractual side of aircraft fleet purchases tell us whether the requirement to provide and pay for additional sim training for the ungrounded MAX be enough for existing customers to cancel orders without penalty? After all, one of the big selling points of the MAX was that further training wasn’t required for any current 737 pilot.

If so, could we see Boeing ending up having to foot the bill for that further training?

[gums]

Salute!

Thank you Takwis

Why change from individual cutouts for manual and autoplot trim?

I was wondering the same thing since last November. Ditto for disabling the column switches if I really wanted to pull back hard so I could override HAL. You know, "I flew this thing for 30 years, and pulling back hard tiurned off the trims except the switches on my yoke"

My point is something lurks in the myriad of boxes, add-ons, etc that requires I turn off my manual trim switch power. I unnerstan that a roque "stuck" switch contact could be a problem, but if I have successfully beeped the switch over twenty times to get nose up trim, then I don't think that sucker is the problem.

Gums sends...



.

[YYZjim]

Question about trim motor speed

A couple of posters have mentioned both direction and speed as inputs to the trim motor. Is the motor speed really variable (I doubt it), or does the motor run at constant speed when activated (my bet)? If electric trim in the 737 is a variable speed system, then there must be another microprocessor or software routine somewhere that computes the PWM (pulse width modulation) pulse train.

YYZjim

[ARealTimTuffy]

Salute!

Thank you Takwis



I was wondering the same thing since last November. Ditto for disabling the column switches if I really wanted to pull back hard so I could override HAL. You know, "I flew this thing for 30 years, and pulling back hard tiurned off the trims except the switches on my yoke"

My point is something lurks in the myriad of boxes, add-ons, etc that requires I turn off my manual trim switch power. I unnerstan that a roque "stuck" switch contact could be a problem, but if I have successfully beeped the switch over twenty times to get nose up trim, then I don't think that sucker is the problem.

Gums sends...



.

The disabling of the cutout switches is relatively straight forward to understand. They only don't cutout during MCAS activation. They will cutout during STS. But it makes sense (given what they were trying to accomplish) to not have the MCAS cutout by the internal column switch. If that switch did in fact also cutout the MCAS, the MCAS wouldn't be able to do what it was designed to do. It needs to be able to trim Nose Down despite further back pressure. That is how it works. If it did cutout MCAS wouldn't do anything.

That isn't to say MCAS is a good design, but if the intended goal is what it was, then it has to bypass that cutout switch.

[ARealTimTuffy]

Question about trim motor speed

A couple of posters have mentioned both direction and speed as inputs to the trim motor. Is the motor speed really variable (I doubt it), or does the motor run at constant speed when activated (my bet)? If electric trim in the 737 is a variable speed system, then there must be another microprocessor or software routine somewhere that computes the PWM (pulse width modulation) pulse train.

YYZjim

Not sure how it is accomplished, whether variable voltage via resistors or software processing or something, but the trim does indeed function at 2 different speeds. Flaps up: both manual electric and autopilot trim at a "slow" speed
Flaps down: both manual electric and autopilot trim at a "fast" speed.

By all reports the MCAS trims at the fast speed even when flaps are up (using the autopilot trim function and the STS system) while the pilot trims back to neutral (in a failure mode scenario) at the slow speed.

[YYZjim]

Thanks for the clarification, ARealTimTuffy

Two-speed control is something that can be handled quite nicely using relays and a passive component or two. If the original 737 also trimmed using just two speeds, it was probably done that way, and the original hardware implementation might have survived all the way into the MAX.

YYZjim

[MemberBerry]

The single trim motor was introduced on the NG. Previously the 737 used separate motors for A/P trim and pilot operated trim.

About how exactly speed of the motor is controlled, earlier I guessed it may use different voltages, but I'm probably wrong. I don't have much experience with motors.

I did find a document describing the NG trim motor upgrade between the B version and the C version (the max uses the D version). From that document:


Eaton’s new Model 6355C Stabilizer Trim Motor features: • Brushless three phase motor design • Low loss power bridge with IGBT switches • Processor based motor commutation and velocity control • Dual current limit (torque) control circuits • Power up built-in test • Continuous fault monitoring • Fault storage (non-volatile memory) • RS-232 test/maintenance interface • Investment cast housing • Two stage spur gear train • Modular, bottom up assembly — two electronic sub-assemblies, motor, housing with gear train


The D version on the max is probably an evolution of the C version, so many of those features could apply to it as well.

http://www.eaton.com/ecm/idcplg?IdcService=GET_FILE&allowInterrupt=1&RevisionSelectionMethod=LatestReleased&Rendition=Primary&&dDocName=PCT_201019

[etudiant]

As an engineer, not a businessman can anyone who knows about the contractual side of aircraft fleet purchases tell us whether the requirement to provide and pay for additional sim training for the ungrounded MAX be enough for existing customers to cancel orders without penalty? After all, one of the big selling points of the MAX was that further training wasn’t required for any current 737 pilot.

If so, could we see Boeing ending up having to foot the bill for that further training?

At this point, I think Boeing would be delighted to put this debacle behind it at any price, even if it costs multiple billions.to resolve.
The schedule was to build 60 737 MAXs a month, at near $100mm a copy. Current deliveries are zero and no resumption is as yet scheduled. So the locked in revenue shortfall is already tens of billions, ignoring the reputational impact and the competitive humiliation.
Any pilot training expense incurred will be petty change.
Hopefully this punch in the face from reality will wake up Boeing senior management, which seems to have lost sight of the priority need for quality, even ahead of low cost.

[Just the fax maam]

In the accident scenario, when MCAS was commanding the stab nose down the forces were increasing on the jackscrew mechanism. When the pilots were commanding nose up, the forces were decreasing. If the stab motor was going to stall under an aerodynamic load, it would have happened in the direction of increasing (MCAS), and not decreasing force (pilot trimming). On the contrary, MCAS had absolutely no problem using that one trim motor to drive against an ever increasing force until it hit the physical stops. There is no evidence that the motor was ever overtasked.

I admire your persistency in refusing to even remotely consider it a possibility that the motor could have been overloaded towards the very end of the accident sequences, whilst attempting to move the stab ANU, I am afraid that you have (perhaps inadvertenly) presented an entirely incorrect/reversed description above.

The actual aerodynamic loads on the horizontal stabilizer in the configuration both accident aircraft were in, during the last minutes, would have strongly opposed ANU movements and strongly assisted AND movements. Excerbated further by significant NU elevator deflection.

The 'roller coaster' recovery technique discussed earlier sheds further light on this, as will a quick diagram of forces, if helpful.

KR

[YYZjim]

Oops.

The 737 stabilizer trim motor is much more sophisticated than I had envisioned. I've attached a brochure from Eaton's plant in India. It's a three-phase motor, with an internal processor that monitors commutation and speed. It is a fully digital unit. Fault codes are stored in a non-volatile memory, and can be extracted using RS-232. It lools like there are two 9-pin plugs for signals. There is no way this motor and control system was used on the original 737s.

YYZjim

PS: It look like the manufacturer's testing has identified solder joints on the memory chip as the most likely point of failure, but that does not mean there have been any failures in use.

[Just the fax maam]

The trim rim inputs are recorded separate from the THS movement. In both flights there were longer periods of manual inputs resulting in longer movements of the THS. In both flights towards the end there were short manual inputs followed by small THS movement. In both flights following manual inputs there was MCAS trimming AND. At no point in the FDR readout was there a prolonged manual input followed by no movement of the THS (the real indicator of an overpowered trim motor).

The balance of probability is there is an absence of knowledge on your part, and an overwhelming amount of long words to compensate for that.

With respect, we do not know with any certainty that there was no manual ANU input without corresponding stab movement. I am merely highlighting that known evidence at this time suggests otherwise.

But I do thank you for the ad hominem :-)

[Water pilot]

Yesterday afternoon I was stuck in traffic near Everett so I pulled off to the marina to wait it out. At exactly 4:30 PM, Isaw what I think was a 737 MAX not in livery (green primer or whatever) flying at a much more vertical attitude than I have seen any plane accomplish anywhere other than an airshow. It kept that attitude long enough for me to pull out my phone and get some video, although since it ended up flying over the top of my head the video does not do a good job of representing the angle of the plane relative to the ground.

So the good news to me is that at least Boeing is doing some real world testing. Tragically far too late, but real world and not some jumped up playstation. If there is interest and I can figure out how I will post the video but there is nothing really spectacular in it, perhaps an expert could spot something interesting. Basically the plane was flying level, pulled up in to a very steep (absurdly steep) flight angle, held for awhile, and leveled out. I got some of the steep angle and the overhead flight.

I would almost guess that they had pulled it into a stall (intentionally) but I am in no way qualified to judge that. Shortly after an unmarked white helicopter with video equipment flew past, may have been news for the traffic jam (although that is not news in Everett!) or perhaps Boeing recording the flight.

Shortly after

[Just the fax maam]

Occam's Razor would suggest other, arguably more likely, explanations for all of the above.

You may well be correct, time will tell, however surely the simplest of all explanations is that during the finals stages both crews were unable to trim ANU. It fits all known evidence at this time. And the simplest reason for that is due to overwhelming forces acting in the opposite direction.

Certainly worthy of further consideration IMHO.

[jimjim1]

I admire your persistency in refusing to even remotely consider it a possibility that the motor could have been overloaded towards the very end of the accident sequences,
KR

The Lion Air flight preliminary report clearly shown stabiliser ANU trim movements that appear to correspond to ANU trim switch operations. It seems unlikely that the motor was unable to move the stabiliser. Each ANU pulse results in ANU movement.

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/927x885/lionair_fdr_pprune4_33ff1b4ff12f08a3a2beed9d5eae9f9102c162c4 .png

[wonkazoo]

Returning to the "They are among us" theme...

I was browsing another thread on the 787 and shall we say, ahem, issues with its production when I stumbled across the following.

[Quote]

Ironically, just a couple of days after those claims of "lack of evidence", evidence came out that it may have indeed been possible, since such a condition was discovered in a simulator test performed by FAA pilots.
Let's be fair here. The "evidence" you cite involved upgraded software/firmware that had not yet been certified for flight, much less installed on the accident aircraft, during a test that intentionally created a malfunction that was unrelated to MCAS. Until there are further details to the specifics of the test and the particular failure mode, there still is no evidence that there were any problems with the Main Electric Trim system on the accident aircraft. As you note, after many months of perhaps one of the most intense investigations in modern aviation history, not a single authority has suggested such a problem or called for any redesign work associated with this system.[Quote]

Question 1: The preceding post was written by:

a) Boeing's Lawyer
b) An employee of Boeing with three kids to support
c) A Boeing corporate manager
d) A disinterested third party
e) Brittney Spears

Oh man, just hiccuped with beer- headed to an early demise-
dce

[BDAttitude]

Carefully disclosing what is in the public already, e.g. wiring diagrams on Lemme's site, but not one yota more.

[DaveReidUK]

With respect, we do not know with any certainty that there was no manual ANU input without corresponding stab movement.

True, there is very little that we can be absolutely sure about.

But your proposition requires that
a) the trim motor was stalled due to aerodynamic forces; and
b) simultaneously there was an unrelated software/processor issue that prevented the pilots' trim inputs from being recorded on the FDR

As opposed to the stab not moving simply because the pilots hadn't commanded it to.

Occam again ...

[bill fly]

True, there is very little that we can be absolutely sure about.

But your proposition requires that
a) the trim motor was stalled due to aerodynamic forces; and
b) simultaneously there was an unrelated software/processor issue that prevented the pilots' trim inputs from being recorded on the FDR

As opposed to the stab not moving simply because the pilots hadn't commanded it to.

Occam again ...

Or a trim motor overheat, due to incessant use.

For this reason full stab trim exercising in pre flight checks has in the past on another aircraft type been discontinued. Subsequently only a short stab run in each direction was practised.

[oggers]

Returning to the "They are among us" theme...

I was browsing another thread on the 787 and shall we say, ahem, issues with its production when I stumbled across the following.



Ironically, just a couple of days after those claims of "lack of evidence", evidence came out that it may have indeed been possible, since such a condition was discovered in a simulator test performed by FAA pilots.
Let's be fair here. The "evidence" you cite involved upgraded software/firmware that had not yet been certified for flight, much less installed on the accident aircraft, during a test that intentionally created a malfunction that was unrelated to MCAS. Until there are further details to the specifics of the test and the particular failure mode, there still is no evidence that there were any problems with the Main Electric Trim system on the accident aircraft. As you note, after many months of perhaps one of the most intense investigations in modern aviation history, not a single authority has suggested such a problem or called for any redesign work associated with this system.

Question 1: The preceding post was written by:

a) Boeing's Lawyer
b) An employee of Boeing with three kids to support
c) A Boeing corporate manager
d) A disinterested third party
e) Brittney Spears

Oh man, just hiccuped with beer- headed to an early demise-
dce

And yet the valid point the anonymous poster made remains unanswered by you.

[sadtraveller]

But your proposition requires that
...
b) simultaneously there was an unrelated software/processor issue that prevented the pilots' trim inputs from being recorded on the FDR


I'm short on time to find the post, but there was compelling circumstantial evidence presented in this thread a couple of days ago that pilot trim inputs are sent to the FDR from the stab trim motor (whereas mcas/speed trim inputs are sent from the trim computer). In such a case, it is in fact very probable that failed pilot trim inputs will not be recorded by the FDR.

[yoko1]

Responses to above in no particular order:

1. The stab trim motor has four speeds - Main Electric fast/slow (0.4/0.2 deg/sec) and Automatic fast/slow (0.27/0.09 deg/sec) and two directions. If the previously posted schematics are to be taken at face value, then the commands for speed and direction come from outside the motor unit, but the actual processing of those commands into a specific speed and direction occur within a controller housed within the motor unit. While no documentation regarding this controller and how it operates has been publicly released, it is reasonable to assume that the accident investigating bodies would have access to it if they felt it was needed.

2. Overheating. This was a problem on early Boeing designs, but I am not aware of any such issues since introduction of the NG, and there is nothing is the manuals related to a thermal relief circuit. However, if there was an undocumented thermal relief, then it would temporarily disable the motor completely, and not just in one direction. No signs of this occurring. Again, if there was any history of this being an issue, one of the hundreds (or perhaps thousands?) of interested parties would have pointed to it by now.

3. Trimming forces. Speaking as someone who has actually used the manual trim wheel on the Boeing, I can assure you that the trim resistance increases in both directions. It is not like rolling a boulder uphill where it is very difficult in one direction and easy in the other. The increased resistance is due to binding forces at the jackscrew thread/nut interface. Not sure if it is strictly frictional force or some type of deformation or misalignment. Keep in mind that while the aerodynamic forces are acting roughly parallel to the jackscrew body, those forces are mostly perpendicular at the thread/nut interface. There will be some directional bias, but that is a relatively small component. BTW, this is one of the reasons why a jackscrew mechanism is used in the first place - to minimize those directional forces and make it easier for the motor. However, one point needs to be emphasized again: You completely avoid these issues by not letting the stab get out of trim in the first place. There is no, none, not one iota of evidence that the Main Electric Trim did not move the stab when it was used. And yes, by not being attentive to such matters, it is absolutely possible to place the aircraft in a state where things don't work as they should.

4. There is a lot of reference of what are perceived as anomalies in the trim system in the final moments of both accidents. Personally, that's not what I see, however I'm not going to claim I have a better microscope than anyone else here. That being said, I must again point out that in those final moments, the aircraft had exceeded the certified flight envelope. Engineering safety factors aside, there is not any expressed or implied guarantee that any system will work as it is supposed to once you exceed the limits of that system. The lesson here is that you keep that aircraft within its design envelope - just like the crew of the penultimate Lion Air 610 flight did.

5. There is far too much post hoc reasoning going on here. If your going-in assumption is, "Of course the Main Electric Trim must have malfunctioned," then your mind is going to work very hard to disregard any contrary evidence. As the initial data started coming in, one of the first and most obvious question to arise was whether there was a problem with the pilots' ability to trim the aircraft to oppose the MCAS input. That was certainly a concern of mine. I actually operate a 737 on a regular basis, and I have a keen interest in knowing. However, there is a big difference between asking if there was a malfunction in the pilot's trim system and assuming there was. In the first case, you go where the evidence leads, in the latter, you try to shoehorn the evidence into your assumptions.

6. Corollary to point 5. Whether or not the pilots had the tools to oppose the MCAS input is one of the top issues that the various accident investigators and certificate authorities must have looked at. Consider all the public discussions regarding the issues with the manual trim system. Consider the discussions regarding adequate pilot response time and whether the Runaway Stab Trim system checklist should be re-written. Concerns regarding these two items may, in fact, be some of the issues slowing down the process of getting the MAX back in service. Compare that to the absolute lack of any comments by any authoritative body that there was a problem with the Main Electric Trim system on the accident aircraft. You just can't assume that all of these parties with all of their vast resources are either that incompetent or part of some conspiracy to hide this information. This is the case of the dog that did not bark. It is not barking, because there is nothing there.

[esa-aardvark]

If the trim motor was stalled, could that somehow generate sufficient number of messages
on the 629 databus to overwhelm the computer?
I ask in the context of the FAA being able to overload the computer
in simulator tests (reported elsewhere).

[bill fly]

Great informative post, Thank you Yoko.

The problem mentioned in your final paragraph is that an official inquiry held by experts is one thing - a rumour panel with everybody from experts and concerned daily operators to schoolboys and air fans is another.

You are caught in the frustrating position (as are others) of trying to present reasoned arguments to a mixed bag of folk.

The other problem is that a few pages on, only the concerned operators will recall most of the clarifications and repetition often becomes necessary to “educate” others and late comers.

Thanks for taking the time. Only after the final report will speculation stop.

B

[yoko1]

Thanks for taking the time. Only after the final report will speculation stop.


Don’t really expect that to happen, but thanks for the comments.

[Thrust Augmentation]

2. Overheating. This was a problem on early Boeing designs, but I am not aware of any such issues since introduction of the NG, and there is nothing is the manuals related to a thermal relief circuit. However, if there was an undocumented thermal relief, then it would temporarily disable the motor completely, and not just in one direction. No signs of this occurring. Again, if there was any history of this being an issue, one of the hundreds (or perhaps thousands?) of interested parties would have pointed to it by now.

Does it really seem feasible that there wouldn't be a thermal (or otherwise) protection device? Without thermal overload protection, one of the possible outcomes would be thermal overload & all that goes with it.

Regards the motor being disabled completely, in both directions / not just one, that's also not necessarily true & would depend on how smart the motor logic / protection is & how it's been designed.

[Peter H]

Nice find. I'm still having problems interpreting things though, any ideas on:
The deliberately broken microprocessor had become overwhelmed with data from the flight control system.
- If its "broken", how is it still working.
- If its "crippled" by how much.
- Or is it "restarting" after some sort of interrupt/reboot.
- Finally is the "overload" a transient effect, or the new status quo.

From the comments section of https://leehamnews.com/2019/06/28/bjorns-corner-new-pitch-trim-issue-forces-further-changes-to-737-max-software/
Bjorn FehrmJune 28, 2019
The 737ng and MAX have two FCCs, each with two processors. Depended on the flight mode (autopilot or manual flight) these processors either divide the tasks between them or one is active and the other is standby. If there is a fault in the active microprocessor the inactive one can take over in the FCC. This is as I understand it I should add. There are descriptions of the FCCs and their global functions, but the exact working of the software is not public knowledge. (https://leehamnews.com/2019/06/28/bjorns-corner-new-pitch-trim-issue-forces-further-changes-to-737-max-software/#comment-276043)

Re my question.
I now feel that the new "glitch" occurred when the tester faulted the "active" processor in the FCC, triggering a fail-over to the "standby" processor.
This gives obvious opportunities for disruption of normal service.

[Luc Lion]

I read a description where each of the 2 processors care for a specific subset of the 15 (or so) FCC processes. It is only in case a fault is detected that the valid processor take over all the processes.

I wrote in another thread : I wouldn't be surprised if the overload comes from the additional checks added to the MCAS process. If the MCAS trigger keeps being repeated and keeps being inhibited, if the new checks involve much I/O with wait states...
​​​​​

[yoko1]

Does it really seem feasible that there wouldn't be a thermal (or otherwise) protection device? Without thermal overload protection, one of the possible outcomes would be thermal overload & all that goes with it.

Electric motors are not really my area of expertise, but I’ll throw out a few things and maybe someone who does work with this type of equipment can help.

The stab motor is reported to be a 3-phase DC brushless electric motor. The available circuit diagrams shows circuit protection on the AC side of the AC/DC power converter, but none between the power converter and the motor itself (doesn’t mean there isn’t one, but none are shown). Previous Boeing aircraft had op manual references to a thermal relief circuit. The NG and MAX have none. The non-normal procedures for an inoperative stab trim motor make no reference to any type of circuit breaker or cooling period.

I’ve given some more thought about what would actually happen if the stabilizer was physically prevented from moving. Just speculating here, but there is a clutch system that connects the stab trim motor drive to the jackscrew mechanism. This clutch system favors the manual trim system, which is why you can grab the trim wheel in the cockpit and keep the stab from moving any further. You can demonstrate this on the ground by activating the main electric trim and then stopping the trim wheel with your hand or foot as desired. When you do this, you can hear and feel the clutch slipping/disengaging. The important point here is that the trim motor will continue spinning against the clutch even though the stab is not moving. What I am suggesting is that the motor overload protection may be less electrical and more mechanical. When faced with a jackscrew load that exceeds the motor limit, rather than the motor stalling, perhaps the clutch will slip. If that were to happen, there would be sounds of the clutch slipping on the CVR and the FDR traces would show no stab movement while the yoke switch was engaged (none of which were actually reported). I really don’t know for sure because there is nothing in the available literature that discusses the system in this level of detail.

However, worth repeating, even though none of the participants here know for sure what happens in these circumstances, someone on one of the accident investigation teams certainly does. Again, there’s nothing in the official commentary regarding the stab motor having insufficient power to move the stab, no calls to redesign the motor or anything else in the Main Electric Trim system. No regulators are asking Boeing to do anything different with the Main Electric Trim system before allowing the MAX to fly again. All the concerns that have been raised so far about this aspect of the trim system have been reasonable, but none of them have been sustained after close examination.


Regards the motor being disabled completely, in both directions / not just one, that's also not necessarily true & would depend on how smart the motor logic / protection is & how it's been designed.

Again, not my area of expertise. I only know that on previous Boeing’s, the thermal relief circuit would shut down the motor entirely until it cooled off.

[FrequentSLF]

Electric motors are not really my area of expertise, but I’ll throw out a few things and maybe someone who does work with this type of equipment can help.

The stab motor is reported to be a 3-phase DC brushless electric motor. The available circuit diagrams shows circuit protection on the AC side of the AC/DC power converter, but none between the power converter and the motor itself (doesn’t mean there isn’t one, but none are shown). Previous Boeing aircraft had op manual references to a thermal relief circuit. The NG and MAX have none. The non-normal procedures for an inoperative stab trim motor make no reference to any type of circuit breaker or cooling period.

I’ve given some more thought about what would actually happen if the stabilizer was physically prevented from moving. Just speculating here, but there is a clutch system that connects the stab trim motor drive to the jackscrew mechanism. This clutch system favors the manual trim system, which is why you can grab the trim wheel in the cockpit and keep the stab from moving any further. You can demonstrate this on the ground by activating the main electric trim and then stopping the trim wheel with your hand or foot as desired. When you do this, you can hear and feel the clutch slipping/disengaging. The important point here is that the trim motor will continue spinning against the clutch even though the stab is not moving. What I am suggesting is that the motor overload protection may be less electrical and more mechanical. When faced with a jackscrew load that exceeds the motor limit, rather than the motor stalling, perhaps the clutch will slip. If that were to happen, there would be sounds of the clutch slipping on the CVR and the FDR traces would show no stab movement while the yoke switch was engaged (none of which were actually reported). I really don’t know for sure because there is nothing in the available literature that discusses the system in this level of detail.

However, worth repeating, even though none of the participants here know for sure what happens in these circumstances, someone on one of the accident investigation teams certainly does. Again, there’s nothing in the official commentary regarding the stab motor having insufficient power to move the stab, no calls to redesign the motor or anything else in the Main Electric Trim system. No regulators are asking Boeing to do anything different with the Main Electric Trim system before allowing the MAX to fly again. All the concerns that have been raised so far about this aspect of the trim system have been reasonable, but none of them have been sustained after close examination.




Again, not my area of expertise. I only know that on previous Boeing’s, the thermal relief circuit would shut down the motor entirely until it cooled off.



must be a really noisy clutch to be heard in the cockpit all the way from the tail...and recorded on the CVR, unless there are microphones on the tail.
the motor, according to the manual and info on the net is a DC servo motor, driven by a 3 phase AC/DC converter, with an unknown type of controller.
A decent converter has the capability to limit torque and current in order not to exceed the theoretical thermal limits, there is no need of breakers or clutches, it can be easily software mananged, however i do not know if such will be within the aviation certification requirments.

[yoko1]

must be a really noisy clutch to be heard in the cockpit all the way from the tail...and recorded on the CVR, unless there are microphones on the tail.

Well, it is probably more correct to say that the vibrations from the slipping clutch are transferred through the manual trim linkages to the cockpit where they do create a bit of a racket.

]the motor, according to the manual and info on the net is a DC servo motor, driven by a 3 phase AC/DC converter, with an unknown type of controller. A decent converter has the capability to limit torque and current in order not to exceed the theoretical thermal limits, there is no need of breakers or clutches, it can be easily software mananged, however i do not know if such will be within the aviation certification requirments.

Again, not my area of expertise, but it’s all pretty much a theoretical discussion since there were no signs of the trim motor not working when commanded to do so.

[MemberBerry]

That question is near the top of my list, as well. Why change from individual cutouts for manual and autoplot trim? The higher ups don't seem to be asking it, and Boeing certainly is not giving any meaningful answers. That, and understanding the 'blips' would go a long way to solving some of the mystery.

While looking at the schematics for the electric trim system on the MAX posted by yoko1, and comparing them to the NG schematics, I noticed something interesting:

- on the NG the cutout switches were positioned between the thumb switches and the motor. So the thumb switches were powered directly from the circuit breaker panel.
- on the MAX the cutout switches are positioned between the circuit breaker and the thumb switches, so the cutout switches can disconnect the thumb switches from the circuit breaker.

This has some implications about what is recorded on the FDR when the cutout switches are used and you try to use the thumb switches.

Previously I had questions about how the thumb switch commands are recorded by the FDR, and if for some reason it can fail to record them. Reading the schematics cleared that out somewhat for me:

- on both the NG and the MAX the captain and F/O switches are connected together in parallel, so there is no possibility to distinguish between the captain switches and the F/O switches on the FDR.
- there are 3 outputs from the switches: "up" commands, "down" commands, and an "arm" command. The "up" / "down" commands are controlled by one half of the switch, the "arm" command is controlled by the other.
- to be able to control the motor the switches need to send one of the "up" / "down" commands and the "arm" command as well.
- the "up" and "down" and "arm" commands go through various relays and switches to the motor.
- the "up" and "down" commands go from the switches directly to the Flight Data Acquisition Unit so, as long as the thumb switches are powered, any use of the "up" / "down" half of the switches can be recorded by the FDR.
- I didn't find such a connection to the FDAU for the "arm" command, it seems that it is either not recorded on the FDR or, if it is recorded, it goes through a less direct path, possibly through the FCC, as the "arm" command seems to disable the autopilot interlock signal to the FCC.
- all this means that on NG using the cutout switches and then later trying to use the column trim switches would be communicated to the FDR as "up" / "down" main trim commands, without a corresponding stabilizer movement. However on the MAX any attempted "up" / "down" commands from the switches wouldn't show after the cutout switches are used, since the thumb switches are disconnected from the circuit breaker by the cutout.

I'm short on time to find the post, but there was compelling circumstantial evidence presented in this thread a couple of days ago that pilot trim inputs are sent to the FDR from the stab trim motor (whereas mcas/speed trim inputs are sent from the trim computer). In such a case, it is in fact very probable that failed pilot trim inputs will not be recorded by the FDR.

I was the one that assumed that was the case, but I was wrong, after looking at yoko1's schematics and other schematics in detail they are actually not sent from the trim motor.

For my analysis I used information from these sources:

https://www.pprune.org/rumours-news/621879-max-s-return-delayed-faa-reevaluation-737-safety-procedures-40.html?gid=1&pid=1#post10504982
(Yoko1's post containing schematics of the stabilizer trim control system on the MAX)

https://www.satcom.guru/2018/11/stabilizer-trim.html
(contains a high level schematic for the NG version of the stabilizer trim)

https://aviaforum.ru/threads/katastrofa-boing-737-ethiopian-airlines-addis-abeba-10-03-2019-obsuzhdenie.46342/post-2392734
(contains a more detailed schematic for the NG version).

[yoko1]

That question is near the top of my list, as well. Why change from individual cutouts for manual and autoplot trim? The higher ups don't seem to be asking it, and Boeing certainly is not giving any meaningful answers.

This was actually covered in a news article (Seattle Times, I think) a month or so back.

As background, there was a time when the 737 had a procedure where the two cutout switches could be used separately to isolate the offending trim system. Quite a few years ago (early 2000’s if I recall correctly), Boeing changed the procedure so that both switches would always be used together. At the time I remember being told that this was part of a general trend in eliminating “troubleshooting” type actions plus the desire to shut down any runaway as quickly as possible.

Even today, if I had a runaway stab malfunction on a 737NG which I knew was being caused by the automatic trim system, I would have no legal procedure to use just the automatic trim cutout switch. That doesn’t mean I wouldn’t pull out the “Captain Emergency Authority” card, but I would be going out on a limb to diverge from the published procedure.

Fast forward to the MAX. Boeing wanted to maintain as much commonality with the 737NG as possible. The NG had two cutout switches, so the MAX would have two cutout switches. This would make the Runaway Trim procedure identical in both aircraft. However, Boeing’s philosophy had changed regarding what these switches should do. Since the original intent to isolate malfunctions had been replaced by a desire to shut down the entire trim systems as quickly as possible, they wired these switches to accomplish just that. Even though procedurally both switches were required, selecting just one switch (i.e. fat-fingered fumbling) would accomplish the job.

[FrequentSLF]

This was actually covered in a news article (Seattle Times, I think) a month or so back.

As background, there was a time when the 737 had a procedure where the two cutout switches could be used separately to isolate the offending trim system. Quite a few years ago (early 2000’s if I recall correctly), Boeing changed the procedure so that both switches would always be used together. At the time I remember being told that this was part of a general trend in eliminating “troubleshooting” type actions plus the desire to shut down any runaway as quickly as possible.

Even today, if I had a runaway stab malfunction on a 737NG which I knew was being caused by the automatic trim system, I would have no legal procedure to use just the automatic trim cutout switch. That doesn’t mean I wouldn’t pull out the “Captain Emergency Authority” card, but I would be going out on a limb to diverge from the published procedure.

Fast forward to the MAX. Boeing wanted to maintain as much commonality with the 737NG as possible. The NG had two cutout switches, so the MAX would have two cutout switches. This would make the Runaway Trim procedure identical in both aircraft. However, Boeing’s philosophy had changed regarding what these switches should do. Since the original intent to isolate malfunctions had been replaced by a desire to shut down the entire trim systems as quickly as possible, they wired these switches to accomplish just that. Even though procedurally both switches were required, selecting just one switch (i.e. fat-fingered fumbling) would accomplish the job.


i spent long time wondering why those switches function was changed, and your logic sounds exactly what a lawyer would tell to a court... it does not make any sense other than provide a legal justification for it.
The fix to your change of desire to shut down the enire system quickly would have been a AD with new wiring instructions to be implemented over a long time... oh damn i wonder why i waste my time to argue on this with you

[walkon19]

This was actually covered in a news article (Seattle Times, I think) a month or so back.

As background, there was a time when the 737 had a procedure where the two cutout switches could be used separately to isolate the offending trim system. Quite a few years ago (early 2000’s if I recall correctly), Boeing changed the procedure so that both switches would always be used together. At the time I remember being told that this was part of a general trend in eliminating “troubleshooting” type actions plus the desire to shut down any runaway as quickly as possible.

Even today, if I had a runaway stab malfunction on a 737NG which I knew was being caused by the automatic trim system, I would have no legal procedure to use just the automatic trim cutout switch. That doesn’t mean I wouldn’t pull out the “Captain Emergency Authority” card, but I would be going out on a limb to diverge from the published procedure.

Fast forward to the MAX. Boeing wanted to maintain as much commonality with the 737NG as possible. The NG had two cutout switches, so the MAX would have two cutout switches. This would make the Runaway Trim procedure identical in both aircraft. However, Boeing’s philosophy had changed regarding what these switches should do. Since the original intent to isolate malfunctions had been replaced by a desire to shut down the entire trim systems as quickly as possible, they wired these switches to accomplish just that. Even though procedurally both switches were required, selecting just one switch (i.e. fat-fingered fumbling) would accomplish the job.


And of course you first MUST retrim to near neutral ( level ) trim before cutting all power to trim switches and otto pilot ?

And if your trim switch only moves at 1/2 to 1/4 rate of MCAS down stab, how much altitude do you lose ?

Or even without MCAS eg NG and prior ?

How much force to turn trim wheel how many times to move say .6 degree ? How many turns ? By yourself ?
And do it all within ?? seconds per regs ?

[Bend alot]

Given the latest MAX issue in the non related MCAS system encountered by the FAA and the difference in classifications used by Boeing compared to that of the FAA.

It is reasonable to believe that further changes (fix's) will be required once more testing is carried out by FAA and other regulators.

At what stage would Boeing need to give up on the requirements of Computer Based Training, hardware changes and/or Grandfather rights?

They have delivered a reasonable number of these aircraft to customers that will be wanting compensation, they are still building the aircraft at a reasonable rate and clearly they need to invest and expedite a Clean Sheet replacement - one assumes under closer scrutiny (less short cuts) by the regulator and expanding interest in the 787.

[Luc Lion]

- all this means that on NG using the cutout switches and then later trying to use the column trim switches would be communicated to the FDR as "up" / "down" main trim commands, without a corresponding stabilizer movement. However on the MAX any attempted "up" / "down" commands from the switches wouldn't show after the cutout switches are used, since the thumb switches are disconnected from the circuit breaker by the cutout.
Your assumption is confirmed by the ET302 interim report.
The CVR indicates that the FO tried to action the trim via his trim thumb switches after having flipped the pedestal cutout switches.
None of his attempts appear on the DFDR.

[DaveReidUK]

The CVR indicates that the FO tried to action the trim via his trim thumb switches after having flipped the pedestal cutout switches.

Can you point to the entry on the CVR extract (i.e. the timestamp) where you believe that happened ?

I can't see it.

[pilotmike]

3. Trimming forces. Speaking as someone who has actually used the manual trim wheel on the Boeing, I can assure you that the trim resistance increases in both directions. It is not like rolling a boulder uphill where it is very difficult in one direction and easy in the other. The increased resistance is due to binding forces at the jackscrew thread/nut interface. Not sure if it is strictly frictional force or some type of deformation or misalignment. Keep in mind that while the aerodynamic forces are acting roughly parallel to the jackscrew body, those forces are mostly perpendicular at the thread/nut interface. There will be some directional bias, but that is a relatively small component. BTW, this is one of the reasons why a jackscrew mechanism is used in the first place - to minimize those directional forces and make it easier for the motor. However, one point needs to be emphasized again: You completely avoid these issues by not letting the stab get out of trim in the first place. .... And yes, by not being attentive to such matters, it is absolutely possible to place the aircraft in a state where things don't work as they should.

Yeah! That's right - you should NEVER let anyone(THING) trim the damned aeroplane ever further away from the correctly trimmed position. And you CERTAINLY would NEVER want to have anything SECRET, which pilots MUST NOT know about doing it SECRETLY and QUIETLY in the background whilst a badly designed and badly implemented system shakes the yoke violently whilst giving a number of other distracting URGENT warnings that you're stalling to steal your full attention and consume all you resources, leaving you nothing left to look out for any curved balls that Boeing snuck into the system secretly, which will effectively kill you and all aboard in a meter of a few tens of seconds, now would you?

Avoiding that nasty little killer should be avoided at all costs. What silly pilots, for "not being attentive to such matters". Shame on you Yoyo, shame on you, Boeing.

[FrequentSLF]

ICAO Annex 6 lists mandatory FDR parameters, and is well worth a read. One of those parameters is "Cockpit pitch trim control input position" (my emphasis, not ICAO's).

That's why FDAUs came along in the 1970s.
The FDR trace show only one cockpit pitch trim control input position, it does now show BOTH thumn switches, that might lead to assume is an elaborated signal that is taken at the servo motor controller. Of course the traces might have been elebaorated before been published, however the information published does not validate a theory of the trace representing the thumb switch at the source

[DaveReidUK]

however the information published does not validate a theory of the trace representing the thumb switch at the source

Or, more accurately, it neither validates nor invalidates the theory - we simply don't know.

But the fact remains that if it turns out that the FDR isn't showing the thumb switch position, then it contravenes the Annex 6 requirements.

Boeing have been building aeroplanes for long enough that one would hope they know what an FDR is supposed to record.

[Australopithecus]

Servo motors...

The reason that I askd if the stab motor was a servo is that servos behave differently to the normal motors we are all used to. They were developed for cnc machines...they accurately will move about 1/4000th of a revolution per step signal, and then lock their rotor. So they need a command to move x steps in Y direction at whatever speed. That can be a simple analogue instruction; run clockwise at speed number 3 until the limit stops are reached.

But it would make more sense for the FCC to signal a step + direction command. However many steps to get 2.5 units of nose down trim.

The critical feature is again the locked rotor when not turning. If the clutch doesn’t work, or doesn’t work well, a human will not be able to move the rotor from its last commanded position.

I have had four big servo motors in my garage machine shop so am quite familiar with their characteristics.

I am also a 737 pilot, and have had a failure of the stab trim brakes in flight...a soft runaway requiring cranking the wheel. It wasn’t a big deal, but then again we were smack in the middle of the envelope, and the -400 had a both a shorter moment arm and a 10% bigger trim wheel to crank.

Regarding motor overheating: I really doubt it. I have run servos in 45° heat with a big load running constantly for a couple of hours relying only on their passive air cooling. Never had a thermal shutdown.

[BDAttitude]

https://aviaforum.ru/threads/katastrofa-boing-737-ethiopian-airlines-addis-abeba-10-03-2019-obsuzhdenie.46342/post-2392734
(contains a more detailed schematic for the NG version).

Good find! Thanks!

[bill fly]

Servo motors...

The reason that I askd if the stab motor was a servo is that servos behave differently to the normal motors we are all used to. They were developed for cnc machines...they accurately will move about 1/4000th of a revolution per step signal, and then lock their rotor. So they need a command to move x steps in Y direction at whatever speed. That can be a simple analogue instruction; run clockwise at speed number 3 until the limit stops are reached.

But it would make more sense for the FCC to signal a step + direction command. However many steps to get 2.5 units of nose down trim.

The critical feature is again the locked rotor when not turning. If the clutch doesn’t work, or doesn’t work well, a human will not be able to move the rotor from its last commanded position.

I have had four big servo motors in my garage machine shop so am quite familiar with their characteristics.

I am also a 737 pilot, and have had a failure of the stab trim brakes in flight...a soft runaway requiring cranking the wheel. It wasn’t a big deal, but then again we were smack in the middle of the envelope, and the -400 had a both a shorter moment arm and a 10% bigger trim wheel to crank.

Regarding motor overheating: I really doubt it. I have run servos in 45° heat with a big load running constantly for a couple of hours relying only on their passive air cooling. Never had a thermal shutdown.

Good info OZ,
Dont forget though, that the workshop motors are designed for continuous running with appropriate cooling.
Stab motors are designed for intermittent use with cooling appropriate to that task.
As Yoko says, earlier 737 types (which had a different motor(s)) could suffer from stab motor overheat, so it is not unknown.
Air speed is also possibly relevant depending on cooling air source - and OAT.

[BDAttitude]

Servo motors...

The reason that I askd if the stab motor was a servo is that servos behave differently to the normal motors we are all used to. They were developed for cnc machines...they accurately will move about 1/4000th of a revolution per step signal, and then lock their rotor. So they need a command to move x steps in Y direction at whatever speed. That can be a simple analogue instruction; run clockwise at speed number 3 until the limit stops are reached.

But it would make more sense for the FCC to signal a step + direction command. However many steps to get 2.5 units of nose down trim.

The critical feature is again the locked rotor when not turning. If the clutch doesn’t work, or doesn’t work well, a human will not be able to move the rotor from its last commanded position.

I have had four big servo motors in my garage machine shop so am quite familiar with their characteristics.

I am also a 737 pilot, and have had a failure of the stab trim brakes in flight...a soft runaway requiring cranking the wheel. It wasn’t a big deal, but then again we were smack in the middle of the envelope, and the -400 had a both a shorter moment arm and a 10% bigger trim wheel to crank.

Regarding motor overheating: I really doubt it. I have run servos in 45° heat with a big load running constantly for a couple of hours relying only on their passive air cooling. Never had a thermal shutdown.
From Eaton:
Eaton’s new Model 6355C Stabilizer Trim Motor features: • Brushless three phase motor design • Low loss power bridge with IGBT switches • Processor based motor commutation and velocity control • Dual current limit (torque) control circuits • Power up built-in test • Continuous fault monitoring • Fault storage (non-volatile memory) • RS-232 test/maintenance interface • Investment cast housing • Two stage spur gear train • Modular, bottom up assembly — two electronic sub-assemblies, motor, housing with gear train

[The Bartender]

From Eaton:

Eaton’s new Model 6355C Stabilizer Trim Motor features: • Brushless three phase motor design • Low loss power bridge with IGBT switches • Processor based motor commutation and velocity control • Dual current limit (torque) control circuits • Power up built-in test • Continuous fault monitoring • Fault storage (non-volatile memory) • RS-232 test/maintenance interface • Investment cast housing • Two stage spur gear train • Modular, bottom up assembly — two electronic sub-assemblies, motor, housing with gear train

Current-limiters are great. That will stop the motor from any
overexertion during high loads.
It may of course slow the motor down, or even stop it completly...

[SteinarN]

A brushless three phase motor could be a "normal" induction motor. Or it could be a permanent magnet motor. And it can have some position feedback added to it. And even though it's not specifically mentioned it can very well have termistors or temperature sensors embedded in the windings for overheat protection.

[Luc Lion]

Can you point to the entry on the CVR extract (i.e. the timestamp) where you believe that happened ?
Here it is:
http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-800MAX+,(ET-AVJ).pdf
At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out.
At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position.
...
At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try.
At 05:41:54, the First-Officer replied that it is not working.
So it is a bit more than 1 minute after the cutout switches had been actioned.

Luc

[BDAttitude]

A brushless three phase motor could be a "normal" induction motor. Or it could be a permanent magnet motor. And it can have some position feedback added to it. And even though it's not specifically mentioned it can very well have termistors or temperature sensors embedded in the windings for overheat protection.

It says:
• Low loss power bridge with IGBT switches • Processor based motor commutation and velocity control
And I guess that says it all. Not having thermal sensing on IGBT bridges would be very unusual.

[SteinarN]

It says:

And I guess that says it all. Not having thermal sensing on IGBT bridges would be very unusual.

I didnt say anything about thermal protection of the IGBT, I was only adding that there could well be that there was thermal sensing of the windings in the motor. But ofc, that is pure specualtion and has no significance for the accident under discussion in this thread.

[BluSdUp]

Dear All
Been a busy month June 2019.
Will never forget it, hell!
But enough about my problems.
As some of You have observed I am a simple chap.
And here is a simple observation:
MCAS is the most retarded system I have ever encountered!
It now is clear to me that Boeing has lost the plot , curtsy of FAA.
I am afraid the treason by Boeing can not be forgiven, as it is systemic!
The MCAS should be scraped and a aerodynamic improvement applied.
Or its Coke Cane Time!
Flight safety on a basic aerodynamic level is not a political thing.
Looking forward to fly the MAX 2.0.
Regards
Cpt B

[MemberBerry]

The FDR trace show only one cockpit pitch trim control input position, it does now show BOTH thumn switches, that might lead to assume is an elaborated signal that is taken at the servo motor controller. Of course the traces might have been elebaorated before been published, however the information published does not validate a theory of the trace representing the thumb switch at the source

Well, the trim schematic shows the thumb switch outputs for "up" and "down" connected together, and there are direct connections that go to the DFDAU (Digital Flight Data Acquisition Unit). This strongly suggests that the FDR traces are based on the actual position of the switches. I took a section of the schematic and colored in green and turquoise the paths of the signal from thumb switches to the DFDAU:

https://i.imgur.com/NOQGETw.png

[SamYeager]

3. Trimming forces. Speaking as someone who has actually used the manual trim wheel on the Boeing, I can assure you that the trim resistance increases in both directions. It is not like rolling a boulder uphill where it is very difficult in one direction and easy in the other. The increased resistance is due to binding forces at the jackscrew thread/nut interface. Not sure if it is strictly frictional force or some type of deformation or misalignment. Keep in mind that while the aerodynamic forces are acting roughly parallel to the jackscrew body, those forces are mostly perpendicular at the thread/nut interface. There will be some directional bias, but that is a relatively small component. BTW, this is one of the reasons why a jackscrew mechanism is used in the first place - to minimize those directional forces and make it easier for the motor. However, one point needs to be emphasized again: You completely avoid these issues by not letting the stab get out of trim in the first place. There is no, none, not one iota of evidence that the Main Electric Trim did not move the stab when it was used. And yes, by not being attentive to such matters, it is absolutely possible to place the aircraft in a state where things don't work as they should.

4. There is a lot of reference of what are perceived as anomalies in the trim system in the final moments of both accidents. Personally, that's not what I see, however I'm not going to claim I have a better microscope than anyone else here. That being said, I must again point out that in those final moments, the aircraft had exceeded the certified flight envelope. Engineering safety factors aside, there is not any expressed or implied guarantee that any system will work as it is supposed to once you exceed the limits of that system. The lesson here is that you keep that aircraft within its design envelope - just like the crew of the penultimate Lion Air 610 flight did.
Yet again it must be pointed out the only reason the crew of the penultimate Lion Air 610 managed to keep the aircraft within its design envelope was because they were lucky enough to have a jumpseater who not only observed the operation of the trim wheel but also persuaded the crew to disable automatic trim.

Frankly the lesson here is that Boeing should never, ever, ever again ship an aircraft with functionality that can programmatically take the aircraft out of its design envelope due to an easily foreseeable fault. Boeing made that mistake all by itself and should cease trying to muddy the waters by pointing the finger at overwhelmed crew trying to deal with multiple alarms caused by that fault.

[DaveReidUK]

Here it is:

At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out.
At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position.
...
At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try.
At 05:41:54, the First-Officer replied that it is not working.

So it is a bit more than 1 minute after the cutout switches had been actioned.

Luc

You are assuming that "The First-Officer has replied that the trim was not working" means that he attempted unsuccessfully to use the electric trim switches.

It could equally have been him just confirming that (as you rightly say) just over a minute previously both pilots had agreed to disable the stab trim (05:40:35), given that it was followed immediately by asking "if he could try it manually". In other words, the electric trim switches obviously weren't going to work, and there wouldn't have been any point in trying them.

[Speed of Sound]

You are assuming that "The First-Officer has replied that the trim was not working" means that he attempted unsuccessfully to use the electric trim switches.

Given that the reply came about 8 seconds after asking if he could try, it is highly likely (though not 100% certain) the the FO was attempting to operate the trim switch during those 8 seconds.

[Alchad]

Well, the trim schematic shows the thumb switch outputs for "up" and "down" connected together, and there are direct connections that go to the DFDAU (Digital Flight Data Acquisition Unit). This strongly suggests that the FDR traces are based on the actual position of the switches. I took a section of the schematic and colored in green and turquoise the paths of the signal from thumb switches to the DFDAU:

https://i.imgur.com/NOQGETw.png

Sorry, a dumb question but electric circuits are a black art to me. I've seen this, or a similar diagram before, and am aware of all the comments that the two switches now peform an identical function. If that is the case, what is the function of the circuit 8 - 9 in the S272 Stab Trim Cutout Switch?

Thanks

Alchad

[DaveReidUK]

Given that the reply came about 8 seconds after asking if he could try, it is highly likely (though not 100% certain) the the FO was attempting to operate the trim switch during those 8 seconds.

That's not how it reads.

According to the transcript "The First-Officer has replied that the trim was not working and asked if he could try it manually", followed (8 seconds later) by "the First-Officer replied that it is not working".

That would suggest that what he was doing during those 8 seconds (having already acknowledged that electric trim was inop) was to try to wind the trim wheel (unsuccessfully, for the reasons already discussed in the thread), followed by his statement that it wouldn't move.

[yoko1]

Lot’s of very interesting and detailed discussion here. I’ve learned quite a bit about electric motors and their control circuits, so thanks. I should point out, however, that all this is far, far above the level of detail that would ever be included in the FCOM.

Now back to the elephant in the room. All of us are basically amateurs when it comes to accident investigations. Many of us like to know how things work, or should work, and enjoy puzzling things out from the limited information that is available. Perhaps some of us just like a good mystery. Perhaps some don’t have the patience to wait for the investigative process to run its course or are uncomfortable with what is perceived as an information void. I absolutely get the psychology at work.

While I consider myself fairly knowledgeable about the 737 and it’s operations, I will acknowledge that the information and resources I (or anyone else here) possess is absolutely dwarfed by those available to the collective body of professional accident investigators, multiple certificate authorities representing dozens of nations, subject matter experts, and other interested parties such as the aerospace-centric media (i.e. Aviation Week and the like) and the massive army of tort lawyers lining up to sue Boeing.

Is anyone here seriously suggesting that it has not occurred to any of these parties that they should investigate the Main Electric Trim system to see if there were any issues? Please speak up, because I would really like to hear your thinking here.

In the past couple of months, we have heard a litany of items that various certificate authorities want to see addressed before the MAX is cleared to fly. Conspicuously absent is any mention of the Main Electric Trim system. No suggestion of failures, stalls, overheats, or anything else. No one is asking for any redesign or replacement of switches, relays, wires, or motors. If this was still early in the investigation, sure, absolutely valid questions have been raised. And all those questions have been found wanting of actual hard, verifiable evidence to back them up.

So really, folks, why the continued obsession with this system? No party who actually has all the data, resources, and experts is saying anything about it. Do you really think you are more knowledgeable than the collective body of all these very smart people? There is far too much grasping for straws that simply aren’t there.

Time to move on.

[sooty655]

Lot’s of very interesting and detailed discussion here.
// snip //
So really, folks, why the continued obsession with this system? No party who actually has all the data, resources, and experts is saying anything about it. Do you really think you are more knowledgeable than the collective body of all these very smart people? There is far too much grasping for straws that simply aren’t there.

Time to move on.

No party who actually has all the data, resources, and experts is saying anything about anything. Maybe you could explain why you are so determined to shut this aspect of the discussion down. What harm can it do?

[Luc Lion]

You are assuming that "The First-Officer has replied that the trim was not working" means that he attempted unsuccessfully to use the electric trim switches.
It could equally have been him just confirming that (as you rightly say) just over a minute previously both pilots had agreed to disable the stab trim (05:40:35), given that it was followed immediately by asking "if he could try it manually". In other words, the electric trim switches obviously weren't going to work, and there wouldn't have been any point in trying them.
Dave, I am ready to bet that the captain question came after he unsuccessfully tried to operate his trim thumb switches and that he actually asked the FO to check if the switches on his side were also not working.
Further, I can't imagine that the FO answers "the trim is not working" without giving it a try.

Besides, the electric wiring schematics are plain and clear ; the pedestal cutout switches disconnect the trim thumb switches from the 28V DC coming from the CB panel and the probe line running from the switches to the DFDAU can no longer record a variation of potential.
So, any attempt to operate these trim rockers after switching off the cutout could not have been recorded, as per the schematics.

[yoko1]

No party who actually has all the data, resources, and experts is saying anything about anything.

If you really believe this statement, then you really haven’t been paying attention.

[Smythe]

One thing I would note about the wiring diagram...the stab trim cutout switches...the way this is wired, it will not be a software fix to get back to the NG configuration. Most unfortunate.

[bill fly]

One thing I would note about the wiring diagram...the stab trim cutout switches...he way this is wired, it will not be a software fix to get back to the NG configuration. Most unfortunate.

Who wants to get to the NG configuration?

[Smythe]

In this switch config, it does not allow to separately turn off elec trim and AP trim.

I believe earlier it was discussed that the way MCAS is routed, it could be disabled by turning off the AP trim, but leave elec trim on, as it is more powerful way to move the elevator than manual trim....
Has that been shown to not be valid?

EDIT: corrected ref.

[Smythe]

Cant tell from the wiring diagrams posted if the MCAS ENGAGE is shown. Here it is anyways...the second image is from the iPad training.

https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/959x722/zqqm1vs_b5a8fd56885ecf734d8f6b553a1fe39abd8a9a80.jpg
https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/748x515/0agkjlg_e8857bb06730a710d63abf2cfcbc2c8f365b25ad.jpg

[bill fly]

The name hasn’t done Nike much good either...

[sooty655]

If you really believe this statement, then you really haven’t been paying attention.

Neither of the formal investigations has yet produced a definitive report. Leaks, particularly those either defending or denigrating Boeing, serve only to muddy the waters, and are generally open to belief or ridicule as the reader sees fit. They certainly don't constitute evidence from "a party who actually has all the data, resources, and experts".

You don't seem to want to tell us why you are so keen to shut down this area of discussion.

[david340r]

There seem to be some misunderstandings about types of motors and their control so I think it may be worth providing a little bit of clarification. I'm not going to quote all the relevant comments on this, but I though this was worth repeating:


1. The stab trim motor has four speeds - Main Electric fast/slow (0.4/0.2 deg/sec) and Automatic fast/slow (0.27/0.09 deg/sec) and two directions. If the previously posted schematics are to be taken at face value, then the commands for speed and direction come from outside the motor unit, but the actual processing of those commands into a specific speed and direction occur within a controller housed within the motor unit. While no documentation regarding this controller and how it operates has been publicly released, it is reasonable to assume that the accident investigating bodies would have access to it if they felt it was needed.


It seems pretty clear from the schematics and descriptions from Eaton that the contemporary motor unit works by turning the 400Hz 3 phase supply into DC and then the motor controller turns this back into a 3 phase supply at the frequencies required to achieve the various designed speeds. Control of speed control this way over quite a wide range is fairly easy with modern power electronics. This type of speed control is very similar to that in inverter drives for induction motors, and the motor stator will be pretty similar to that of a three phase induction motor, but the rotor is likely to be permanently magnetized rather than magnetized by induction. The motor may have a sensor that provides feedback to the controller as to current rotor position, but it is also possible for control circuits to deduce this from the current/voltage relationships in the three phases. However this is not the same as a servo motor.

A servo motor implies a system where a position (rather than speed) can be demanded and there is a feedback loop using a position sensor (traditionally an analogue potentiometer) to allow the controller to determine the current distance from the demanded position. Any type of motor could theoretically be used in such a system. Positional control can also be achieved using a stepper motor, which can be rotated in small steps of specific angle and will remain locked in that position unless the holding torque is exceeded. This can be open loop (relative motion from a starting point) or incorporated in a system with feedback.

50 years ago power electronics were much more primitive and it was therefore much more difficult to control motor speed over a wide range. However it has been said that pre NG there were two separate motors and I would guess they were both three phase AC motors which can be speed controlled using relays rather than power electronics, by switching the sequence of connections for the stator poles, but only in quite a limited range of integer ratios typically 2:1 or 3:1 which happen to be the same ratios seen above (0.4:0.2 and 0.27/0.09). Different gear ratios between the two motor rotors and the output shaft would explain the different Main Electric and Automatic speeds. Eventually along come robust power electronics and whatever speeds are required can be provided with just one motor and probably more reliably (less mechanical parts (bearings, gears and relays) to wear out).

[BDAttitude]

to the collective body of professional accident investigators, multiple certificate authorities representing dozens of nations, subject matter experts, and other interested parties such as the aerospace-centric media (i.e. Aviation Week and the like) and the massive army of tort lawyers lining up to sue Boeing.
....
Time to move on.






Oooh au contraire.

To the collective body of professional accident investigators, multiple certificate authorities representing dozens of nations, subject matter experts, and other interested parties such as the aerospace-centric media (i.e. Aviation Week and the like) and the massive army of tort lawyers lining up to sue Boeing:

Now as we know, that a fast speed trim runaway that cannot be stopped by counter trimming is considered a hazardous condition.
And now as we now that this Eaton actuator is a fancy modern microprocessor commutated and speed controlled brushless motor.
Could you please have a look if the actuators electronics - which is hardware and software - have been designed to a suitable design assurance level. Which would be :confused: DAL-B? DAL-A?:eek:
Uncontrolled dive is just a bit-flip away.

Thank you!
(Not suggesting any link to the two accidents though)

[edmundronald]

Oooh au contraire.

To the collective body of professional accident investigators, multiple certificate authorities representing dozens of nations, subject matter experts, and other interested parties such as the aerospace-centric media (i.e. Aviation Week and the like) and the massive army of tort lawyers lining up to sue Boeing:

Now as we know, that a fast speed trim runaway that cannot be stopped by counter trimming is considered a hazardous condition.
And now as we now that this Eaton actuator is a fancy modern microprocessor commutated and speed controlled brushless motor.
Could you please have a look if the actuators electronics - which is hardware and software - have been designed to a suitable design assurance level. Which would be :confused: DAL-B? DAL-A?:eek:
Uncontrolled dive is just a bit-flip away.

Thank you!

If each NG actuator now contains HAL instead of some simple motor then there is a whole can of worms lurking under the surface of the NG grandfathered certificate. It has not escaped the notice of most of us here that the failure modes of HAL and those of mechanical controls are very different.

Edmund

[yoko1]

One thing I would note about the wiring diagram...the stab trim cutout switches...the way this is wired, it will not be a software fix to get back to the NG configuration. Most unfortunate.

It might surprise you, but I really wish Boeing had left both the cutoff switch wiring logic and the Runaway Stab checklist alone. That being said, I want to make sure that you understand the implications that go with changing things back to the way they were.

Commercial airline pilots generally don’t flip switches for the hell of it just to see what will happen or maybe because they thought it was a good idea at the time. Absent a specific procedure, we cannot even pull and/or reset circuit breakers if we think it would help. Case in point - remember that very distracting stick shaker that activated on both accident aircraft? The CB is right behind the Captain’s left shoulder, and pulling it would immediately silence the stick shaker. There is no authorized procedure to do so. Yes, the Captain always has emergency authority to do what he/she thinks is necessary, but the emphasis nowadays on sticking to the written procedures, and only the written procedures, is so prevalent that many Captains would be reluctant to go out on that limb.

It wasn’t always this way. There was a time when there was a much greater emphasis on systems knowledge. Not only were we expected to know a procedure, but we were expected to know why we were doing each step and what the implications were of every switch we threw and every control we actuated. We were give greater latitude to diverge from a procedure if, based on our knowledge of the underlying system, a different course of action was deemed more prudent. Those days are long gone.

Starting around the early 2000’s, if I recall correctly, our airline in concert with the manufacturers, started a process of “simplifying” a lot of our procedures, removing information regarding underling systems from our manuals, and largely discouraging any independent initiative or trouble-shooting that diverged from the written procedure. The rationale expressed at the time was 1) the concern that pilots could potentially create more problems than solve by troubleshooting, and 2) the desire to quickly contain any malfunction and get the aircraft on the ground. The change to how we handled Runaway Stab Trim was just one of the procedures caught up in this sea change. Part and parcel of the change in this procedure was also a change in the underlying level of system knowledge given to and expected from the pilots.

So you and a few other folks thinks the cutout switch logic should be returned to the NG configuration. I agree! However, that change does absolutely no good unless you go back to something like the earlier procedure. By its very nature, that procedure had more steps (and thus was harder to memorize), potentially took longer to execute because of the extra steps, and required a greater degree of knowledge of what was going on with the system.

Now you are entering my wheelhouse. As I’ve said repeatedly, these accidents not only revealed a design problem, they also revealed a training problem. Sure, give the pilots another tool to fight the malfunction, but that tool does absolutely no good if they don’t know how to use it. We have less detail about what went on in the cockpit of JT610, but we have a much better picture of ET302. Those pilots had, in theory, a specific set of tools available to them to help prevent the loss of control and a subsequent crash - foreknowledge (such as it was at the time) of MCAS, a working Main Electric Stab trim system, an Airspeed Unreliable procedure, and a Runaway Stab Trim procedure. None of these tools were used effectively.

Given this, my suggestion would be that rather than working on new tools, it might be more useful to determine why the existing tools were not properly employed.

[yoko1]

Neither of the formal investigations has yet produced a definitive report. Leaks, particularly those either defending or denigrating Boeing, serve only to muddy the waters, and are generally open to belief or ridicule as the reader sees fit. They certainly don't constitute evidence from "a party who actually has all the data, resources, and experts".

You don't seem to want to tell us why you are so keen to shut down this area of discussion.

So you are suggesting no one in a knowledgeable position has said anything about the lack of redundant sensors for MCAS, the inappropriately high MCAS inputs at high speed, the subsequent need to reprogram the FCC, the problems with the manual trim system, the lack of fidelity with the simulators, the lack of proper documentation, the possibility of rewriting the Runaway Stab Trim procedure, whether the implied 3-second pilot reaction time is appropriate, the scope of additional training and whether simulators should be required, etc., etc.? All I can say is that we must be occupying different universes.

I could no more shut down this discussion than I can stop people from comparing notes on chemtrails if that’s what they want to do - but I just don’t see the logic behind it. I do think time and energy would be better spent elsewhere. But again, I do get the psychology of why some people want to hold onto this “hypothetical” as tightly as they do. Once you come to the conclusion that there was nothing amiss with the Main Electric Trim system, then that leads to a difficult conversation that some individuals would rather avoid.

[Europa01]

Sorry, a dumb question but electric circuits are a black art to me. I've seen this, or a similar diagram before, and am aware of all the comments that the two switches now peform an identical function. If that is the case, what is the function of the circuit 8 - 9 in the S272 Stab Trim Cutout Switch?

Thanks

Alchad

If I read 27-41 correctly in Smythe's #951 post, the 8 -9 contacts are the FCC (and hence MCAS) route direct to the Eaton stab motor. As has been discussed this item is clearly more than just a motor and very little information about its architecture seems to be available. Terms such as 'processor based' could mean anything but are probably chosen carefully and probably don't mean microprocessor controlled. In my industry (nuclear) there are rigorous technical protocols for assessing and verifying embedded software on safety critical equipment and I'd be astonished if there is not something very similar in aerospace.

[sadtraveller]

Once you come to the conclusion that there was nothing amiss with the Main Electric Trim system, then that leads to a difficult conversation that some individuals would rather avoid.

Better muddy the waters and blame those incompetent third world pilots again, whose training was so inadequate that they had never even stepped foot in a Max simulator. If only they had Just Flown the Plane™!

(This was sarcasm in case it was not immediately apparent).

[FrequentSLF]

If I read 27-41 correctly in Smythe's #951 post, the 8 -9 contacts are the FCC (and hence MCAS) route direct to the Eaton stab motor. As has been discussed this item is clearly more than just a motor and very little information about its architecture seems to be available. Terms such as 'processor based' could mean anything but are probably chosen carefully and probably don't mean microprocessor controlled. In my industry (nuclear) there are rigorous technical protocols for assessing and verifying embedded software on safety critical equipment and I'd be astonished if there is not something very similar in aerospace.

what I understand from those drawings is that a black box called controller collects both main trim and AP trim, and that drives the motor, what logic is inside that black box, what type of signals are coming from two other black boxes is not known...yet.
note that such controller does not have any input to any interlock...

[MemberBerry]

If I read 27-41 correctly in Smythe's #951 post, the 8 -9 contacts are the FCC (and hence MCAS) route direct to the Eaton stab motor. As has been discussed this item is clearly more than just a motor and very little information about its architecture seems to be available. Terms such as 'processor based' could mean anything but are probably chosen carefully and probably don't mean microprocessor controlled. In my industry (nuclear) there are rigorous technical protocols for assessing and verifying embedded software on safety critical equipment and I'd be astonished if there is not something very similar in aerospace.




Yeah, the fact that the cutout switches are not wired identically in series is a bit strange. It's almost like somebody told the person responsible for the design "you have 5 minute to finish the damn thing, stop messing around with it and let's make it final, we have a deadline.". Anyway, about what the connections through the cutout switches seem to do:

1. connections 2 - 3 are wired in series between the two cutout switches, and are connected to the rest of the circuit in such a way that either of the cutout switches would do two things when used:
- interrupt the power between the circuit breakers and the thumb switches, making the thumb switches inoperable;
- de-energize the relay that connects the 3 phase 115V AC power to the trim motor, basically disconnecting the motor from AC power.

This means just cutting connection 2 - 3 on any of the two switches is enough to disable both manual and automatic electric trim.

2. connections 5 - 6 are wired in series as well between the two switches, and it seems that, if any of the two cutout switches are used, it would interrupt a 28V signal to the FCC, probably indicating to the FCC that the cutout switches have been used. No idea what the FCC will do based on that information.

3. connections 8 - 9 are wired only on the primary cutout switch, and as you said they seem to connect the FCC to the trim motor in some way. No idea why they don't go through the backup cutout switch as well, and exactly what signal they carry between the FCC and the motor. It almost looks like somebody forgot to route that connection through the second cutout switch. I don't see any reason for that.

[Smythe]

So you and a few other folks thinks the cutout switch logic should be returned to the NG configuration. I agree! However, that change does absolutely no good unless you go back to something like the earlier procedure. By its very nature, that procedure had more steps (and thus was harder to memorize), potentially took longer to execute because of the extra steps, and required a greater degree of knowledge of what was going on with the system.

Since it appears that neither procedure has been trained, does it matter? Memorisation techniques?? Stick shaker and aural warnings...okay... why is the stick shaking....the stick is shaking for stall, but the trim wheels are spinning like crazy down?

Does it warn of MCAS ENGAGE? (in the 'software' fix, I see they has AOA DISAGREE, where does it say MCAS ENGAGE as a warn?)

So I hit the cut switches, and have to manual trim..but now, I am too fast to manual trim with the nose pointed down.....before I could flip elec on and try to elec trim....

MCAS is not trim runaway...so what memory procedure is to be used? This is letting the tail wag the dog on fixing the situation.
Would an MCAS ENGAGE warn, with associated procedure, trim the response time?

The logic of the situation, the immediate response, as well as a longer term solution in flight, appears to show that switch configuration of the NG was better, not necessarily the best, but a better solution that the all cutout solution in the MAX, especially with the known manual trim wheel issues.

Looking at the switch config only, the NG config at least allows for elec trim when shutting off the AP...that has more value that trying to turn the manual wheel with its respective limitations.

[FrequentSLF]

Since it appears that neither procedure has been trained, does it matter? Memorisation techniques?? Stick shaker and aural warnings...okay... why is the stick shaking....the stick is shaking for stall, but the trim wheels are spinning down?

Does it warn of MCAS ENGAGE?

MCAS is not trim runaway...so what memory procedure is to be used? This is letting the tail wag the dog on fixing the situation.

The logic of the situation, the immediate response, as well as a longer term solution in flight, appears to show that switch configuration of the NG was better, not necessarily the best, but a better solution that the all cutout solution in the MAX, especially with the known manual trim wheel issues.

Looking at the switch config only, the NG config at least allows for elec trim when shutting off the AP...that has more value that trying to turn the manual wheel with its respective limitations.
since the Captain has overall authority, why depriving him of the possibility to shut off HAL, if he choose so? Actually why that was the path chosen? I speculate that the airframe will have issues with certification if MCAS could be disable flipping a swtich!

[Smythe]

since the Captain has overall authority, why depriving him of the possibility to shut off HAL, if he choose so? Actually why that was the path chosen? I speculate that the airframe will have issues with certification if MCAS could be disable flipping a swtich!

Sorry, I am confused. In helo ops HAL is height above landing, what are you referencing in this regard?

The issue appears to be in the FBW scenario, my reference was being able to turn off AP functions, but maintain electrical control of the elevator, rather than manual control.
As it appears MCAS is an automated function, shut that down, but not elec control, right?

Or hell, call me crazy, fix the ac so it does not need MCAS to fly...oi vey!

[FrequentSLF]

Sorry, I am confused. In helo ops HAL is height above landing, what are you referencing in this regard?

The issue appears to be in the FBW scenario, my reference was being able to turn off AP functions, but maintain electrical control of the elevator, rather than manual control.
As it appears MCAS is an automated function, shut that down, but not elec control, right?

Or hell, call me crazy, fix the ac so it does not need MCAS to fly...oi vey!
maybe my English is so bad that I could not made my point clear.. i am exactly saying be able to turn off AP (HAL) and be able to mantain electrical control

[Smythe]

maybe my English is so bad that I could not made my point clear.. i am exactly saying be able to turn off AP (HAL) and be able to mantain electrical control

Okay, got it! no worries.

[MemberBerry]

Sorry, I am confused. In helo ops HAL is height above landing, what are you referencing in this regard?

A certain poster would have called HAL "the magic" in his famous mantra. From Wikipedia:
HAL 9000 is a fictional character and the main antagonist in Arthur C. Clarke's Space Odyssey series. First appearing in the 1968 film 2001: A Space Odyssey, HAL (Heuristically programmed ALgorithmic computer) is a sentient computer (or artificial general intelligence) that controls the systems of the Discovery One spacecraft and interacts with the ship's astronaut crew.
https://en.wikipedia.org/wiki/HAL_9000

[phylosocopter]

A certain poster would have called HAL "the magic" in his famous mantra. From Wikipedia:

https://en.wikipedia.org/wiki/HAL_9000

The point of the reference to 2001 a space odyssey is that in this film "HAL" decided he knew better than the captain!

[Smythe]

The point of the reference to 2001 a space odyssey is that in this film "HAL" decided he knew better than the captain!

Ahh the HAL reference from Space Odyssey...

If I remember correctly, HAL did not decide he knew better than the Cpt,

HAL decided the Cpt was not necessary to fly the ac.

[OldnGrounded]

The point of the reference to 2001 a space odyssey is that in this film "HAL" decided he knew better than the captain!

"Open the pod bay doors, HAL"

You Tube video: qDrDUmuUBTo

[kiwi grey]

{snip}
They are still building the aircraft at a reasonable rate
{snip}


Build rate is still at 42/month, and since (according to https://simpleflying.com/boeing-last-737-ng/) the last B737NG has been delivered, all 42 of them are being parked. [I guess there's maybe the odd P-8A / E-7 going down the line, but I doubt that's any more than 1/month at most]
Already part of the employee car park at Renton has been turned into a MAX parking lot
Spirit is still building and being paid for 52 fuselages a month IIRC - at any rate the full rate
GE are still building - and I guess being paid for - the LEAP engines at full rate, and will be caught up with their backlog very soon if they haven't already
There hasn't been any notification that I've seen of other suppliers being asked to reduce production rates yet

How long before Boeing has to haul on the assembly line brakes and go down to say 30/month or even take an extended "summer shutdown" with the Renton line stopped?
How long before Boeing has to tell suppliers to slow down production rates, or suppliers - especially Spirit - tell Boeing that they have / are about to run out of space to store finished products?

[Maninthebar]

"Open the pod bay doors, HAL"

You Tube video: qDrDUmuUBTo

DAVE: Open the pod bay doors, Hal.
HAL: I’m sorry, Dave. I’m afraid I can’t do that.
DAVE: What’s the problem?
HAL: l think you know what the problem is just as well as l do.
DAVE: What are you talking about, Hal?
HAL: This mission is too important for me to allow you to jeopardize it.

Just substitute "stop the trim running" for "open the pod bay doors"

[Smythe]

kiwi...they have started flying the MAX to Moses Lake and parking them there.

Interesting to note that by the second week in December, there will be as many parked as have been delivered.

[HighWind]

Now as we know, that a fast speed trim runaway that cannot be stopped by counter trimming is considered a hazardous condition.
And now as we now that this Eaton actuator is a fancy modern microprocessor commutated and speed controlled brushless motor.
Could you please have a look if the actuators electronics - which is hardware and software - have been designed to a suitable design assurance level. Which would be :confused: DAL-B? DAL-A?:eek:
Uncontrolled dive is just a bit-flip away.
I have had the same thoughts
In the area of industrial automation there are plenty of variable speed ac drives with ‘Safe Torque Off’ conforming to SIL3 (Corresponding to DAL B)
Usually the control part deciding what speed to run, is not safety certified, i.e. it can only be guarantied to stop (generating torque like the function of the cut-out switches).
However there is no problem in designing such a system.
The Falcon 7X FBW system clearly has the functionality to monitor runaway, I just failed in the case of HB-JFN loss of control after pitch trim runaway.

Looking at the electrical diagram for the electrical trimming, I’m not sure if I can get this approved for anything but SIL1.
There does not seem to be good diagnostic coverage, for detecting shorts between circuits, or welded contact sets.
The state of the art is to have different diagnostic pulses on each independent channel, and having a monitoring feedback of each relay (forcibly guided NC contact set).
Or to use safe communication channels.

[BDAttitude]

Terms such as 'processor based' could mean anything but are probably chosen carefully and probably don't mean microprocessor controlled. In my industry (nuclear) there are rigorous technical protocols for assessing and verifying embedded software on safety critical equipment and I'd be astonished if there is not something very similar in aerospace.

What do you suggest switches the IGBTs they mention?
Must be microprocessor controlled.
As I understand it, until now everything related to a electric trim runaway was considerd "major fault". The new classification "hazardous" must have effects not only on the FCC. There shall be other components in that HARA that need attention.

[wonkazoo]

kiwi...they have started flying the MAX to Moses Lake and parking them there.

Interesting to note that by the second week in December, there will be as many parked as have been delivered.

Technically there are already as many parked as have been delivered. And a few more!! (Because they are all parked...)

This useless post brought to you by Light Always Airways. (LAA) "We spend lesser so you can go higher!!"

On an unrelated note: Who builds an airplane with two switches ostensibly in series, but in reality not so for one channel, to do the job of just one previously?? Who states that these are both "redundant??" when clearly they do different things?? What does that open channel between the FCC and God knows actually do, and since it didn't exist before can we safely accept that it is an artifact of MCAS??

I could go on for hours. The one thing our favorite expert and everyone else has right is this: We don't know squat. We know a lot, and from that we may draw inferences, but as to actual facts: We got stinko.

Here's the thing I do not understand (This will be the end of this lumbering and highly lubricated post I promise): Boeing creates a **** system that kills north of 300 people. OK,

Because I treasure all my fellow travelers, YokoDriver I'll help you out here: Boeing killed 300+ with the help of some less than stellar piloting.

OK, that's not good by any measure.

But then...

A few months go by...

And, according to YokoDriver Boeing gives the FAA some software to play with. (Now let's be clear here. By play with we mean molest completely and bend any way you can to try to make it break. Because that's what you do when your previous offering killed 300+ right??)

Anyway, and the point of the entire sad story is this: No matter how they got here, when the simulation was run:

THE FAA TEST PILOTS BARELY RECOVERED THE AIRPLANE AFTER IT TRIED TO SCREW ITSELF INTO THE GROUND.

Key phrase there: "THE AIRPLANE TRIED TO SCREW ITSELF INTO THE GROUND."

Only one of two possible things happened here.

a) The software tested was Boeing's original brew. Meaning not only is the now known MCAS AOA failure mode present, there was ANOTHER ONE, a failure mode that would try to screw the airplane into the ground.

or

b) Boeing sent over a "NEW" software package, and it had a failure mode that would try to screw the airplane into the ground.

Previous posters have argued indignantly using some of the points above, but seeing them in full is illuminating to say the least.

Can anyone please tell me why heads didn't explode with the headline last Thursday??

Either Boeing software had TWO flaws that would try to make a smoking hole in the ground, or they sent a new updated version to the FAA for a test-run with a flaw that would try to make a smoking hole in the ground.

Sorry for the lugubrious rant-
dce

[infrequentflyer789]

Or, more accurately, it neither validates nor invalidates the theory - we simply don't know.
But the fact remains that if it turns out that the FDR isn't showing the thumb switch position, then it contravenes the Annex 6 requirements.

Seems pretty clear comparing the NG & MAX wiring diagrams posted on this thread that the actual switch position is not captured by a sensor but rather the switch output is recorded, and on the MAX the stab trim cutouts cut power upstream of the switches (downstream on the NG), thus on a MAX there would be no output to record.

Boeing have been building aeroplanes for long enough that one would hope they know what an FDR is supposed to record.

Indeed, however I suspect they may be relying on the asterisk - "to be recorded if an information source for the parameter is used by aeroplane systems and/or flight crew to operate the aeroplane". If the system has been cut-out then it's not being used to operate the a/c and therefore need not be recorded... Trim cutout switches themselves are not (I don't think?) recorded, therefore they are not themselves being considered a control input, but more as a handily positioned circuit breaker. Start pulling CBs and all sorts of mandatory parameters will cease to be recorded.

Not my logic or interpretation, but what I think Boeing may be relying on. I do think it could be questioned though, and if I was Boeing I would want to have that interpretation of the requirements to have been fully documented and signed off by FAA during the design process - because coming up with it after the fact is a lot less convincing.

[MurphyWasRight]

It might surprise you, but I really wish Boeing had left both the cutoff switch wiring logic and the Runaway Stab checklist alone. That being said, I want to make sure that you understand the implications that go with changing things back to the way they were.
...
...
So you and a few other folks thinks the cutout switch logic should be returned to the NG configuration. I agree! However, that change does absolutely no good unless you go back to something like the earlier procedure. By its very nature, that procedure had more steps (and thus was harder to memorize), potentially took longer to execute because of the extra steps, and required a greater degree of knowledge of what was going on with the system.
...
For the NG (and theoretically reverted MAX) the stab trim runaway procedure memory items could be kept the same, simplistic paraphrase: Trim if possible, both switches to cutout.
The only change would be to add an option to restore manual electric trim once memory items were done, this would not need to be a memory item:

To restore manual electric trim set the [corect switch name] to enabled, be prepared to immediately disable if runaway trim re-occurs. Do not re-enable should this happen.

Second part covers a possible fault in either the pilot switches (highly unlikely) -or- the motor controller since power will be restored.

[yoko1]

For the NG (and theoretically reverted MAX) the stab trim runaway procedure memory items could be kept the same, simplistic paraphrase: Trim if possible, both switches to cutout.
The only change would be to add an option to restore manual electric trim once memory items were done, this would not need to be a memory item:

To restore manual electric trim set the [corect switch name] to enabled, be prepared to immediately disable if runaway trim re-occurs. Do not re-enable should this happen.

Second part covers a possible fault in either the pilot switches (highly unlikely) -or- the motor controller since power will be restored.

While I don't disagree in theory, this approach has two distinct problems.

First, as I have mentioned, there has been a very definite shift in philosophy regarding non-normal (formerly known as emergency) procedures industry wide. I don't know if the change was driven by manufacturers, regulators, operators, or some combination of the three, but it has been in place for awhile and unlikely to change. There is a very great reluctance to conduct any action that may be seen as troubleshooting a malfunction which very much includes restoring power to a system, or part thereof, that has malfunctioned. There is probably some historical safety data to back up this philosophy, but there are times when I believe it is overly constraining. Nevertheless, the intent behind most of the significant non-normals nowadays is to shut down and/or contain the malfunction and land the aircraft with what you have left.

Second, let's just say that the switchology was changed back to the NG configuration and we inserted this new step into the existing Runaway Stab Trim procedure. For the sake of discussion we will call it Step 6 since Step 5 is where the cutout switches are used. In order to get to Step 6, the pilots must first correctly navigate Steps 1 thru 5. Since neither accident crew chose to utilize the existing Runaway Stab procedure, much less work through it step by step (and particularly that very critical Step 2), then a new switch with a new step really would not have solved their problem.

As I mentioned above, new tools don't help much if they are not used or used ineffectively. The accident crews had several tools available to them that they either did not use or did not use effectively. I think a bit more time and energy should be directed to figuring out why that was the case before we go down the path of creating new tools.

[MurphyWasRight]

While I don't disagree in theory, this approach has two distinct problems.
...
...

Second, let's just say that the switchology was changed back to the NG configuration and we inserted this new step into the existing Runaway Stab Trim procedure. For the sake of discussion we will call it Step 6 since Step 5 is where the cutout switches are used. In order to get to Step 6, the pilots must correctly navigate Steps 1 thru 5. Since neither accident crew chose to utilize the existing Runaway Stab procedure, much less work through it step by step (and particularly that very critical Step 2), then a new switch with a new step really would not have solved their problem.

As I mentioned above, new tools don't help much if they are not used or used ineffectively. The accident crews had several tools available to them that they either did not use or did not use effectively. I think a bit more time and energy should be directed to figuring out why that was the case before we go down the path of creating new tools.

Agreed that a big question is why (both) crews did not effectively control trim when they should/could have since manual electric trim inputs did stop MCAS for 5 seconds, as documented and confirmed by fdr traces

I do disagree though that had step6 (re-enable manual electric trim only) been available it would not have helped ET:
Once they realized that manual mechanical trim was not available, due lack of training on use of flip out handles and/or aero loads alone, step 6 would have allowed them to re-trim the aircraft, even though they had not followed the memory items perfectly.

BTW: I totally understand the frustration with those who focus on trim motor overload, in ET case manual electric trim was clearly working until the cutout switches were activated.

Although the 'blips" at the end of each accident trace are puzzling in the Lion air case they coincide with transfer to co-pilot, in ET they are in extreme conditions which could well have had a biomechanical affect on the pilots ability to manipulate the switches.

[Alchad]

......,, I think a bit more time and energy should be directed to figuring out why that was the case before we go down the path of creating new tools.

Yoko, in a nutshell, additional time and energy expenditure is really superfluous. There are two opposite views which are diametrically opposed. Simply put, one view, which I think you subscribe to, is that inadequately trained pilots were to blame for the accidents. The other is that Boeing built a plane with design flaws as a result of a desire to regain a commercial advantage they were in danger of losing.

Alchad

[yoko1]

Yoko, in a nutshell, additional time and energy expenditure is really superfluous. There are two opposite views which are diametrically opposed. Simply put, one view, which I think you subscribe to, is that inadequately trained pilots were to blame for the accidents. The other is that Boeing built a plane with design flaws as a result of a desire to regain a commercial advantage they were in danger of losing.

Alchad

You are falling into the cognitive trap of believing that this must be an either/or proposition. Problems with design and problems with training are not mutually exclusive. In fact, I'm willing to bet that the final reports are going to have a long list of primary and contributory causes. It would be quite a shame to fix just one of them.

[MurphyWasRight]

Yoko, in a nutshell, additional time and energy expenditure is really superfluous. There are two opposite views which are diametrically opposed. Simply put, one view, which I think you subscribe to, is that inadequately trained pilots were to blame for the accidents. The other is that Boeing built a plane with design flaws as a result of a desire to regain a commercial advantage they were in danger of losing.

Alchad
In no way are the above mutually exclusive, as almost always the case in accidents there are multiple factors.
Short view:
Pilots could have prevented the accidents, why did they not succeed ?
Boeing lost track of what it takes to be truly dedicated to safety over profits and pushed things over the limits.

[yoko1]

Can anyone please tell me why heads didn't explode with the headline last Thursday??



If someone's head is exploding, then that person doesn't really understand what was reported. Frankly, I'm a little surprised that you are bringing this up again. You quoted a post of mine a few days back which explained exactly why this is not the smoking gun that everyone wants it to be, but you have apparently chosen to ignore that response and slap this red herring back on the table.

Let's go through it again, with a little more detail. First of all, this is not a smoking gun because it is not even the same gun. The problem was discovered when the new, yet to be flight-certified FCC software was being stress-tested in a Boeing engineering simulator. This simulator can be used to plug in different components of flight control hardware and software during both development and test phases and is part of the certification process of any new aircraft or related subsystems. The tests that were being conducted intentionally introduced faults into the FCC in order to see how it would respond. Normally, a fault on a single FCC should attempt to hand off the process to a different processor on the same FCC, or failing that, to a different FCC (there are two on the 737). The test did not involve the MCAS subroutines of the new FCC software.

This news was reported through several outlets, but Leeham New's seems to have the best detail:

Bjorn’s Corner: New pitch trim issue forces further changes to 737 MAX software (https://leehamnews.com/2019/06/28/bjorns-corner-new-pitch-trim-issue-forces-further-changes-to-737-max-software/)

Quoting the article:
.
The flaw is not related to MCAS but to how the revised software affects the aircraft’s processors in the Flight Control computers when these have simulated fault conditions.

During a check on how different faults (in this case a fault in one of the microprocessors in the Flight Control computer) can cause Trim Runaway conditions the FAA found the 737 MAX Flight Control computer got overwhelmed by the data flows the simulated fault caused and it delayed the actions the FAA pilot could take to stop the trim runaway.

and:

The discovery is not done in the part of the code which handles MCAS. It’s found as a wider verification the software changes haven’t produced any secondary hazards in the 737 MAX flight control system.

Software changes in a flight control system are always verified with an exhaustive FMEA analysis (Failure Mode and Effects Analysis) and it’s during such verifications the new condition was discovered.

As currently understood, the MCAS software on the accident aircraft did not input nose down trim because of a fault, but simply because it performed a task exactly how it was programmed to do so. Yes, it was ill-conceived program, but there is no indication that it created a fault condition.

All the test above tells us is that the new software has either a coding issue (which may involve just reprogramming work) or it is demanding more than the processor can handle (which may involve a change in processors). There was extensive discussion previously in this thread by individuals with background in this kind of work who explained all the ways in which errors could have been introduced into the new software.

Also important to understand is that this type of testing was performed on the original Flight Control components (hardware/firmware/software) that were part of the originally certified aircraft. Certainly one might suggest that this testing missed something. Possible, but this is where the accident investigation process steps in.

In order to determine the cause(s) of an accident, to include an attempt to replicate all the physical and electronic evidence left behind, the accident investigators will run every suspect component through a battery of tests. Since the actual components were destroyed, it is almost certain that the investigation teams pulled similar components from the field and then used the same (or similar) Boeing engineering simulator to test these components for all manner of possible failures, including the exact tests run by the FAA as described above. Ideally, these components would have been produced in the same lots as the those in the accident aircraft. Since there hasn't been much reticence in reporting all the other existing flaws with the MCAS and related software, it doesn't seem likely that an issue that caused a fault like the one reported for the new software would be selectively concealed from the public. Another item for the "Dog that did not bark" file.

Back to the Leeham article which first quotes from a so-called 8-K public filing:

“The Federal Aviation Administration has asked The Boeing Company to address, through the software changes to the 737 MAX that the company has been developing for the past eight months, a specific condition of flight, which the planned software changes do not presently address.”

Here is what Wiki says about an 8K filing: Form 8-K is a very broad form used to notify investors in United States public companies of specified events that may be important to shareholders or the United States Securities and Exchange Commission.

The filing means FAA has found a flaw in the software Boeing has developed to fix to the MCAS problem. The find and its consequences are significant enough so Boeing’s shareholders should be informed about it. It can affect the value of Boeing on the stock market.

That last point is very important. If Boeing was aware of an issue that might further delay the re-certification of the MAX, then it must provide some kind of disclosure since it is material information that would effect the stock price. Any issues with components of the Main Electric Trim system would likely require significant rework (redesign and/or replacement of switches, wires, relays, motors, controller, etc.) and add to the already known delay. By SEC rules, this type of delay would require a similar 8-K report by Boeing. One more dog that isn't barking.

Lots and lots of dogs not barking, and there is a very good reason for it.

[Europa01]

Yeah, the fact that the cutout switches are not wired identically in series is a bit strange. It's almost like somebody told the person responsible for the design "you have 5 minute to finish the damn thing, stop messing around with it and let's make it final, we have a deadline.". Anyway, about what the connections through the cutout switches seem to do:

1. connections 2 - 3 are wired in series between the two cutout switches, and are connected to the rest of the circuit in such a way that either of the cutout switches would do two things when used:
- interrupt the power between the circuit breakers and the thumb switches, making the thumb switches inoperable;
- de-energize the relay that connects the 3 phase 115V AC power to the trim motor, basically disconnecting the motor from AC power.

This means just cutting connection 2 - 3 on any of the two switches is enough to disable both manual and automatic electric trim.

2. connections 5 - 6 are wired in series as well between the two switches, and it seems that, if any of the two cutout switches are used, it would interrupt a 28V signal to the FCC, probably indicating to the FCC that the cutout switches have been used. No idea what the FCC will do based on that information.

3. connections 8 - 9 are wired only on the primary cutout switch, and as you said they seem to connect the FCC to the trim motor in some way. No idea why they don't go through the backup cutout switch as well, and exactly what signal they carry between the FCC and the motor. It almost looks like somebody forgot to route that connection through the second cutout switch. I don't see any reason for that.

Thanks for the succinct description of the cutout switch circuit functions. The design is strange isn't it? Given that previous 737s had two switches with different functions it is a real departure to have two switches in series when system reliability claims for stab runaway wouldn't have demanded it. Clearly the overall function has to be the way it is in order to give MCAS authority over the pilots. A cynic might argue that one switch could achieve that but that Boeing added the Backup switch to make it look like it always used to. If you hadn't been told about this new functionality and your point of reference was the previous design, the Lion Air & Ethiopian cockpits would not have been good places to work it out.

[yoko1]

I do disagree though that had step6 (re-enable manual electric trim only) been available it would not have helped ET:
Once they realized that manual mechanical trim was not available, due lack of training on use of flip out handles and/or aero loads alone, step 6 would have allowed them to re-trim the aircraft, even though they had not followed the memory items perfectly.



Possibly, but let me throw out one more thought that relates to both why the procedure was changed and why the crew might not have made the decision you think they would.

The Boeing trim system found on the 707, 727, and 737 has evolved over time. Initially, there was a fast motor for the pilots use, and a slower motor for the autopilot (back when the autopilot was the only other source of electric stab trim). That logic continued even as systems were added and more things could move the stabilizer (Mach Trim, Speed Trim). The thumb switch moved the trim quickly, the automatics moved it slowly. I don't know about the 737 classics, but on the 737NG the logic also included flap position. Flaps down trim was always faster than flaps up trim, and pilot trim was always faster than automatic trim. However, this logic now created four distinct trim speeds (0.4/0.2/0.27/0.09 deg/sec)

Part of the old procedure in isolating the malfunctioning trim system was a subjective evaluation of whether it was moving fast or slow. If if was moving fast, then the Main Electric Trim was suspect. If it was moving slow, then one of the automatic systems. However, with the existence of four distinct speeds and the fact that the "fast" automatic was now faster than the "slow" Main Electric, there was some concern that pilots might misidentify the malfunctioning system, use the wrong cutout, and aggravate the problem. Keep in mind that a runaway stab is not anything you want to dally with - prompt and correct action are critical. This was one of the drivers for simplifying the procedure in the first place.

One of the issues that has been highlighted with the original MCAS design is that it operated at a higher speed than the Main Electric Trim in the flaps up configuration. Thus, it is entirely possible that this faster movement could have been interpreted as a problem with the Main Electric Trim, and not one of the automatic sources. Logically, then the crew would attempt to restore the automatic trim thus 1) reintroducing the runaway while 2) taking away the most effective tool to stop it - namely the Main Electric Trim.

In fact, this is effectively what happened with ET302. They did not properly run the Runaway Stab procedure, they cutout the trim in a significant out-of-trim conditions, and in an act of desperation they restored the malfunctioning system which promptly drove the stab to the stop. It should be noted this crew also had the opportunity to reactivate the cutout switch, but did not, probably because the MCAS movement at the excessive speed they were flying created such a strong negative g force that they were startled or thrown off balance.

[CurtainTwitcher]

They did not properly run the Runaway Stab procedure, they cutout the trim in a significant out-of-trim conditions, and in an act of desperation they restored the malfunctioning system which promptly drove the stab to the stop.

Because they were running the airspeed unreliable checklist with the stick shaker going off! Any reasonably foreseeable single failure that requires the pilots to two concurrent memory checklists close to the ground is not pilot error. Also remember, that it was not until after the fateful ET flight that information about the inability to use the manual trim above ~230 knots without the historical "roller coaster" procedure. None of the three crews had sufficient information provided by the manufacturer about the operation of the MCAS system or manual trim limitations to effectively manage the situation.

I have posted this ad nauseam and will continue to do so. All three crews were faced with this for the entire duration of their flights causing a significant reduction in cognitive capacity and ability to communicate.
https://youtu.be/TrjTUvhpBlE

I believe a significant number of crews globally, regardless of background, training or experience would have found themselves in very similar circumstances to these two fatal flights because of the interaction between the airspeed unreliable checklist & the inability to manual trim once the MCAS had fired and continued to maintained the stab grossly out of trim. We cannot look at just one of the problems in isolation, what were the crews facing "on the day".

[MemberBerry]

However, with the existence of four distinct speeds and the fact that the "fast" automatic was now faster than the "slow" Main Electric, there was some concern that pilots might misidentify the malfunctioning system, use the wrong cutout, and aggravate the problem.

I agree, they could misidentify the malfunctioning system, but if the F/O kept his hand on the cutout switch after reenabling the wrong system, they could immediately disable trim again at the first sign of a runaway. On the other hand, MCAS running intermittently, and apparently randomly for somebody not knowing how it works, and being reset by the thumb switches, adds even more confusion to the scenario. The pilots might assume the runaway is caused by the thumb switches, not by the automatic systems, since the runaway starts 5 seconds after using the thumb switches. Horrible system. I know it wasn't Boeing's intention, but it's like it was designed to create as much confusion as possible.

Now, about those blips towards the end of the Ethiopian flight, now that we know that using either of the cutout switches disables recording the thumb switch trim commands on the FDR, that could be one possible explanation for the blips. It could be that, while trimming with the thumb switches at the end, they were also playing with the cutout switches and intermittently disabling trim as a result. For example they could have been experimenting with the backup cutout switch, thinking it might be analogous to the autopilot cutout switch on the NG.

[edmundronald]

You are falling into the cognitive trap of believing that this must be an either/or proposition. Problems with design and problems with training are not mutually exclusive. In fact, I'm willing to bet that the final reports are going to have a long list of primary and contributory causes. It would be quite a shame to fix just one of them.

I think with a bit of good will we can agree this just about sums up several months of discussion here.

So according to this proposition Boeing needs to fix BOTH the design failure(s) , and the training failure(s).

And on the one side there seems to be an insistence that the hardware be fixed by software only with one AoA sensor input to MCAS, and on the other side that the training not require Max sim time. Somehow BOTH of these "economic requirements" seem problematic.

So it might be useful -as this is not forbidden by the rules- for people who sit in the front seats to make their desire for BOTH a solid fix for MCAS, AS WELL as for the provision of simulator training for runaway stab trim on the MAX, noisily known to Boeing, the FAA, their unions and their employers, and dare I say it, to the press.

Edmund

[MurphyWasRight]

Possibly, but let me throw out one more thought that relates to both why the procedure was changed and why the crew might not have made the decision you think they would.
...
...
One of the issues that has been highlighted with the original MCAS design is that it operated at a higher speed than the Main Electric Trim in the flaps up configuration. Thus, it is entirely possible that this faster movement could have been interpreted as a problem with the Main Electric Trim, and not one of the automatic sources. Logically, then the crew would attempt to restore the automatic trim thus 1) reintroducing the runaway while 2) taking away the most effective tool to stop it - namely the Main Electric Trim. In fact, this is effectively what happened with ET302. They did not properly run the Runaway Stab procedure, they cutout the trim in a significant out-of-trim conditions, and in an act of desperation they restored the malfunctioning system which promptly drove the stab to the stop.
Note that my proposed 'step 6' (NG or reconfigured MAX switches) is not a memory item, only taken after all electric trim shut down and allows possible restoration of manual electric trim only:

To restore manual electric trim set the [corect switch name] to enabled, be prepared to immediately disable if runaway trim re-occurs. Do not re-enable should this happen.

Could add a "in event mechanical trim is difficult/impossible " prolog to it.
It does not require crew to determine probable fault cause while performing the memory items, since they remain unchanged.

All of this would be a moot point if mechanical trim as a backup was reliable over the certified range, which it strongly appears not to be.

[Alchad]

If someone's head is exploding, then that person doesn't really understand what was reported. Frankly, I'm a little surprised that you are bringing this up again. You quoted a post of mine a few days back which explained exactly why this is not the smoking gun that everyone wants it to be, but you have apparently chosen to ignore that response and slap this red herring back on the table.

Let's go through it again, with a little more detail. First of all, this is not a smoking gun because it is not even the same gun. The problem was discovered when the new, yet to be flight-certified FCC software was being stress-tested in a Boeing engineering simulator. This simulator can be used to plug in different components of flight control hardware and software during both development and test phases and is part of the certification process of any new aircraft or related subsystems. The tests that were being conducted intentionally introduced faults into the FCC in order to see how it would respond. Normally, a fault on a single FCC should attempt to hand off the process to a different processor on the same FCC, or failing that, to a different FCC (there are two on the 737). The test did not involve the MCAS subroutines of the new FCC software.

This news was reported through several outlets, but Leeham New's seems to have the best detail:

Bjorn’s Corner: New pitch trim issue forces further changes to 737 MAX software (https://leehamnews.com/2019/06/28/bjorns-corner-new-pitch-trim-issue-forces-further-changes-to-737-max-software/)

Quoting the article:
.


and:



As currently understood, the MCAS software on the accident aircraft did not input nose down trim because of a fault, but simply because it performed a task exactly how it was programmed to do so. Yes, it was ill-conceived program, but there is no indication that it created a fault condition.

All the test above tells us is that the new software has either a coding issue (which may involve just reprogramming work) or it is demanding more than the processor can handle (which may involve a change in processors). There was extensive discussion previously in this thread by individuals with background in this kind of work who explained all the ways in which errors could have been introduced into the new software.

Also important to understand is that this type of testing was performed on the original Flight Control components (hardware/firmware/software) that were part of the originally certified aircraft. Certainly one might suggest that this testing missed something. Possible, but this is where the accident investigation process steps in.

In order to determine the cause(s) of an accident, to include an attempt to replicate all the physical and electronic evidence left behind, the accident investigators will run every suspect component through a battery of tests. Since the actual components were destroyed, it is almost certain that the investigation teams pulled similar components from the field and then used the same (or similar) Boeing engineering simulator to test these components for all manner of possible failures, including the exact tests run by the FAA as described above. Ideally, these components would have been produced in the same lots as the those in the accident aircraft. Since there hasn't been much reticence in reporting all the other existing flaws with the MCAS and related software, it doesn't seem likely that an issue that caused a fault like the one reported for the new software would be selectively concealed from the public. Another item for the "Dog that did not bark" file.

Back to the Leeham article which first quotes from a so-called 8-K public filing:



That last point is very important. If Boeing was aware of an issue that might further delay the re-certification of the MAX, then it must provide some kind of disclosure since it is material information that would effect the stock price. Any issues with components of the Main Electric Trim system would likely require significant rework (redesign and/or replacement of switches, wires, relays, motors, controller, etc.) and add to the already known delay. By SEC rules, this type of delay would require a similar 8-K report by Boeing. One more dog that isn't barking.

Lots and lots of dogs not barking, and there is a very good reason for it.

Yoko1

Have to give you credit for one thing, your speed of typing and ability to compose an arguement has me very impressed. A mere 8 minutes after replying to my post, your respond to Wonkazoos post in a very well drafted piece including a number of quotes from other articles. For a self confessed 737 pilot you missed an alternative career in journalism.

Alchad

[phylosocopter]

My personal view and this applies to both B and A is that they are remiss in allowing ANY alarms, flight director, stickpusher, or any other flight display other than Gyro , heading, thrust in any case of "does not compute", "input out of range" or any other case where the software self check sanity check throws an error. If the computer is not 100% SURE then turn it all off

what this comes down to is that there needs to be a CLEARLY DEFINED REVERSION STATE that is REGULARLY TRAINED AND FLOWN and that in all case of unreliable input the aircraft should revert to this defined and trained for state (without spurious alarms!)

[Europa01]

Point taken - I was trying to point out that a description that is essentially Eaton advertising blurb may be overplaying the 'microprocessor' aspect of something that isn't quite so spangly. My guess (and that's all it is) is that you are correct and that the IGBTs are processor driven. I'd just suggest that the software is probably embedded and not particularly complex given the nature of that task so it may be doing digitally what was previously done by analogue means.
One of the reasons that seem to me to point away from the stab motor is that as far as I understand it the stab 'motor' did as we think it was told by MCAS (happy to be challenged on that)

[CurtainTwitcher]

Right on cue from the UK CAA: Avoidance of Loss of Control In-Flight – Flight Crew Training Pilot awareness of aircraft trim state, intervention strategies and techniques, during both automated and manual flight (http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf).
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1590x1582/screen_shot_2019_07_04_at_8_14_21_am_38e81c2bf93664f7b4d74e6 b19d9d22a9e37a339.png


Referenced from thread: Loss of Control In-Flight - Flight Crew training (https://www.pprune.org/rumours-news/623171-loss-control-flight-flight-crew-training.html)

[Loose rivets]

re the chip overload.

and it delayed the actions the FAA pilot could take to stop the trim runaway.

I hope that doesn't include the basic use of the thumb switches.

Again I feel my old bones needing there to be reversion to an aircraft with nothing but the electric trim thumb switches. And then, nothing but a crank and cables which won't fight back.

There has to be the potential for this aircraft to become a basic flying machine.

Member Berry #988

For example they could have been experimenting with the backup cutout switch, thinking it might be analogous to the autopilot cutout switch on the NG.

What a good point. A last ditch try of that B/U switch by itself?

[FrequentSLF]

Proposed fix
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/225x225/images_b990b9ad13a6b7c251c8d37d6814ee387911d1b0.png

[yoko1]

My personal view and this applies to both B and A is that they are remiss in allowing ANY alarms, flight director, stickpusher, or any other flight display other than Gyro , heading, thrust in any case of "does not compute", "input out of range" or any other case where the software self check sanity check throws an error. If the computer is not 100% SURE then turn it all off

what this comes down to is that there needs to be a CLEARLY DEFINED REVERSION STATE that is REGULARLY TRAINED AND FLOWN and that in all case of unreliable input the aircraft should revert to this defined and trained for state (without spurious alarms!)

This is one of my biggest pet peeves about the 737 (can't speak for other aircraft, but maybe other operators can chime in). There are quite a few noise-makers that activate when certain parameters are exceeded. Some of them can be silenced, but many cannot. Unfortunately, erroneous alarms can be also triggered by underlying malfunctions (as demonstrated by the stick shaker in the MAX accidents), and pilots are expected to just deal with them.

And yes, these alarms are very, very annoying and very, very much a source of distraction. If someone were to make me King of Boeing, one of my first commands would be to install a master button in the cockpit of every airliner that enabled me to silence any alarm, even if only temporarily, and effectively tell the plane to shut the flock up and let me do my job. I seriously hope that one of the recommendations out of these accidents is to provide some relief and/or mechanisms that will allow pilots to silence these kind of alarms when it is obvious that they are erroneous.

What is particularly troubling is that some alarms can be silenced by the simple act of pulling an associated circuit breaker that is within easy reach (the left stick shaker CB is behind the Captain's left shoulder), but we are procedurally not allowed to do so. Once upon a time, it was allowed at the Captain's discretion, but no longer. A Captain can always take a chance and play the "Captain's Emergency Authority" card and do what he/she thinks is needed to save the ship, but he/she would then be counting on a sympathetic Fed/Supervisor/Chief Pilot to agree with his reasoning at the subsequent hearing. I'm pretty sure the penultimate Lion Air 610 crew flew the aircraft the rest of the way to landing with the stick shaker going off, and I am aware of other similar events in which the crew did not feel justified in pulling the CB because the lack of any procedure or policy authorizing such an action. This is the environment we operate in. This is the job we signed up for.

Back to my wheelhouse - are we looking adequately at the training, certification, and operating environment that these crews were immersed in? If the airlines/regulators/manufacturers expect pilots to aviate, navigate, communicate and work an active malfunction while there is an ongoing, distracting alarm that cannot be silenced, then they can damn well train pilots to that standard. I can assure you that is not how we currently train.

[yoko1]

Have to give you credit for one thing, your speed of typing and ability to compose an arguement has me very impressed. A mere 8 minutes after replying to my post, your respond to Wonkazoos post in a very well drafted piece including a number of quotes from other articles. For a self confessed 737 pilot you missed an alternative career in journalism.


Thanks. In a previous life, I was kind of an all-purpose staff writer/researcher (technical, P.R., editorial, whatever). Some parts of the job were very interesting, but I don't miss the windowless office and continuous (and sometimes unrealistic) deadlines.

[yoko1]

Right on cue from the UK CAA: Avoidance of Loss of Control In-Flight – Flight Crew Training Pilot awareness of aircraft trim state, intervention strategies and techniques, during both automated and manual flight (http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf).


Great find! Thanks for posting.

[GlobalNav]

Proposed fix
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/225x225/images_b990b9ad13a6b7c251c8d37d6814ee387911d1b0.png
Sorry, I don’t do Windows.

[yoko1]

Lifting a comment from the thread Loss of Control In-Flight-Flight Crew Training (https://www.pprune.org/rumours-news/623171-loss-control-flight-flight-crew-training.html) because it so germane:


.
UK CAA Safety Notice 2019/005 (http://publicapps.caa.co.uk/docs/33/SafetyNotice2019005.pdf)landed in my inbox just now.

It is a devastating indictment of regulators and operators who have allowed a situation to develop where this SN is necessary.

Stripped of the dreadful jargon-ridden, ungrammatical verbiage it is telling everyone to get back to teaching and practising basic flying skills.



Could not have said it better myself.

[yoko1]

I agree, they could misidentify the malfunctioning system, but if the F/O kept his hand on the cutout switch after reenabling the wrong system, they could immediately disable trim again at the first sign of a runaway.



I just need to point out that the ET302 FO could have done this when they restored power to the trim system, but he did not. That particular piece is a training issue, not a design issue.

[hans brinker]

This is one of my biggest pet peeves about the 737 (can't speak for other aircraft, but maybe other operators can chime in). There are quite a few noise-makers that activate when certain parameters are exceeded. Some of them can be silenced, but many cannot. Unfortunately, erroneous alarms can be also triggered by underlying malfunctions (as demonstrated by the stick shaker in the MAX accidents), and pilots are expected to just deal with them.

And yes, these alarms are very, very annoying and very, very much a source of distraction. If someone were to make me King of Boeing, one of my first commands would be to install a master button in the cockpit of every airliner that enabled me to silence any alarm, even if only temporarily, and effectively tell the plane to shut the flock up and let me do my job. I seriously hope that one of the recommendations out of these accidents is to provide some relief and/or mechanisms that will allow pilots to silence these kind of alarms when it is obvious that they are erroneous.

What is particularly troubling is that some alarms can be silenced by the simple act of pulling an associated circuit breaker that is within easy reach (the left stick shaker CB is behind the Captain's left shoulder), but we are procedurally not allowed to do so. Once upon a time, it was allowed at the Captain's discretion, but no longer. A Captain can always take a chance and play the "Captain's Emergency Authority" card and do what he/she thinks is needed to save the ship, but he/she would then be counting on a sympathetic Fed/Supervisor/Chief Pilot to agree with his reasoning at the subsequent hearing. I'm pretty sure the penultimate Lion Air 610 crew flew the aircraft the rest of the way to landing with the stick shaker going off, and I am aware of other similar events in which the crew did not feel justified in pulling the CB because the lack of any procedure or policy authorizing such an action. This is the environment we operate in. This is the job we signed up for.

Back to my wheelhouse - are we looking adequately at the training, certification, and operating environment that these crews were immersed in? If the airlines/regulators/manufacturers expect pilots to aviate, navigate, communicate and work an active malfunction while there is an ongoing, distracting alarm that cannot be silenced, then they can damn well train pilots to that standard. I can tell you now that they do not.
flew the Fokker 50 a long time ago, had a dedicated panel with 5(?) guarded switches to silence most if not all aural warnings. Can't believe A&B don't have that. There are several crashes were it is obvious that the disorientation from all the conflicting alerts were a big contribution.

[GlobalNav]

Technically there are already as many parked as have been delivered. And a few more!! (Because they are all parked...)

This useless post brought to you by Light Always Airways. (LAA) "We spend lesser so you can go higher!!"

On an unrelated note: Who builds an airplane with two switches ostensibly in series, but in reality not so for one channel, to do the job of just one previously?? Who states that these are both "redundant??" when clearly they do different things?? What does that open channel between the FCC and God knows actually do, and since it didn't exist before can we safely accept that it is an artifact of MCAS??

I could go on for hours. The one thing our favorite expert and everyone else has right is this: We don't know squat. We know a lot, and from that we may draw inferences, but as to actual facts: We got stinko.

Here's the thing I do not understand (This will be the end of this lumbering and highly lubricated post I promise): Boeing creates a **** system that kills north of 300 people. OK,

Because I treasure all my fellow travelers, YokoDriver I'll help you out here: Boeing killed 300+ with the help of some less than stellar piloting.

OK, that's not good by any measure.

But then...

A few months go by...

And, according to YokoDriver Boeing gives the FAA some software to play with. (Now let's be clear here. By play with we mean molest completely and bend any way you can to try to make it break. Because that's what you do when your previous offering killed 300+ right??)

Anyway, and the point of the entire sad story is this: No matter how they got here, when the simulation was run:

THE FAA TEST PILOTS BARELY RECOVERED THE AIRPLANE AFTER IT TRIED TO SCREW ITSELF INTO THE GROUND.

Key phrase there: "THE AIRPLANE TRIED TO SCREW ITSELF INTO THE GROUND."

Only one of two possible things happened here.

a) The software tested was Boeing's original brew. Meaning not only is the now known MCAS AOA failure mode present, there was ANOTHER ONE, a failure mode that would try to screw the airplane into the ground.

or

b) Boeing sent over a "NEW" software package, and it had a failure mode that would try to screw the airplane into the ground.

Previous posters have argued indignantly using some of the points above, but seeing them in full is illuminating to say the least.

Can anyone please tell me why heads didn't explode with the headline last Thursday??

Either Boeing software had TWO flaws that would try to make a smoking hole in the ground, or they sent a new updated version to the FAA for a test-run with a flaw that would try to make a smoking hole in the ground.

Sorry for the lugubrious rant-
dce
Problem is, you can test that software well under normal conditions and under discrete non-normal conditions, but you cannot possibly test for every potential software error because there are far too many. So the methodology of Design Assurance is used, to the degree determined by the hazard classification.

This system has twice demonstrated that its malfunction (even with software acting as intended) must be classified as Catastrophic. This means that proper compliance requires DAL A. Question is, what is the current DAL of this software? While coding changes might be proposed and completed with relative simplicity, an upgrade of the DAL requires a complete reaccomplishment of the software development.

Not a trivial task at all, and one I fear the FAA would not choose to impose. Hopefully, other CAA, including EASA, will not be so accommodating. We’ll see. Well maybe they won’t let us see.