Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Old 19th Mar 2019, 06:28
  #261 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by LEOCh
What information is available points to a MCAS software update that increases the robustness of the AoA input but restricts stab trim output to one cycle only.

However, I don't understand how a single trim cycle could really create a particularly effective augmented stability. The trouble is, we really don't know much about the characteristics of MAX stability, and only part of the MCAS algorithm parameters. But it is likely that the Cm versus alpha curves for the unaugmented MAX tend to show a pre-stall region of decreased stability (not instability) due to Nacelle lift as below. This makes it easier to pull through the pre-stall region than at lower AoAs, and breaks certification.

A control loop more robust and sophisticated than MCAS that senses AoA and actuates stab trim to make the desired Cm vs. alpha plot might be possible (although not necessarily a good idea). However, an MCAS2 that outputs only one trim event should produce something more like the plot below. Apologies for the large amount of assumptions and simplifications for this plot, but for want of more accurate values, the nacelle lift region stretches from AoA 8' to 14' (where the wing stalls). The MCAS-like system is putting in a single trim event (triggered at 10' AoA) that is effectively trimming the aircraft from AoA 5' to 2' (if the column was returned to neutral).

The single trim event augmented performance is a very ragged approximation of the desired behaviour, in fact if you resisted the trim message from this MCAS2 by pulling through it, you would be back in the lower stability regime again until stall. If the lower stability region breaks certification it seems rather an ineffective fix.

LEOCh,

Very good questions and excellent example diagram. Most of the focus in this and other threads related to how MCAS behaves with an AOA sensor that is failed to a very high value (or with a large positive bias) describes MCAS activating for its full increment in one shot. MCAS actually schedules its airplane nose down stabilizer motion over a range of AOA starting at the activation value and extending as AOA goes higher. If you transition through this AOA range quickly (faster than the stab can run to keep up with the schedule) the whole MCAS increment goes in as one continuous trim event. If AOA increases slowly, however, MCAS will put in a little stabilizer at a time to keep up with the MCAS stab vs. AOA schedule. The MCAS trim will go in at the same 0.27 deg/sec rate but the trim will start and stop as needed depending on AOA time history.

FCeng84

Last edited by FCeng84; 19th Mar 2019 at 06:30. Reason: typo
FCeng84 is offline  
Old 19th Mar 2019, 07:20
  #262 (permalink)  
 
Join Date: Nov 2018
Location: madrid
Posts: 47
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by FCeng84
LEOCh,

Very good questions and excellent example diagram. Most of the focus in this and other threads related to how MCAS behaves with an AOA sensor that is failed to a very high value (or with a large positive bias) describes MCAS activating for its full increment in one shot. MCAS actually schedules its airplane nose down stabilizer motion over a range of AOA starting at the activation value and extending as AOA goes higher. If you transition through this AOA range quickly (faster than the stab can run to keep up with the schedule) the whole MCAS increment goes in as one continuous trim event. If AOA increases slowly, however, MCAS will put in a little stabilizer at a time to keep up with the MCAS stab vs. AOA schedule. The MCAS trim will go in at the same 0.27 deg/sec rate but the trim will start and stop as needed depending on AOA time history.

FCeng84
Exactly, MCAS will help with certification, but will NOT help at all in real life scenarios (considering flawless operation). It will make the task of setting a high angle of attack without stalling (say, recover from a dive with not much altitude to work with) a lot harder than without MCAS. That itself is a huge problem that did not surface yet fully (outside these forums). It's simply too slow to do something in the background that helps the pilot (and will make instead a very annoying extra oddity to deal with).

That's crime nº1.

Crime nº2 is to ignore 100% of software tools available to perform the most basic sanity checks on input data or output results.

Crime nº3 is not to install a "MCAS active" light or message or aural warning (blinking when actually trimming and steady over the pauses).

2 and 3 could be fixed by software, but MCAS is doomed because of 1.
ecto1 is offline  
Old 19th Mar 2019, 07:31
  #263 (permalink)  
 
Join Date: Nov 2018
Location: Brisbane
Posts: 20
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by FCeng84
LEOCh,

Very good questions and excellent example diagram. Most of the focus in this and other threads related to how MCAS behaves with an AOA sensor that is failed to a very high value (or with a large positive bias) describes MCAS activating for its full increment in one shot. MCAS actually schedules its airplane nose down stabilizer motion over a range of AOA starting at the activation value and extending as AOA goes higher. If you transition through this AOA range quickly (faster than the stab can run to keep up with the schedule) the whole MCAS increment goes in as one continuous trim event. If AOA increases slowly, however, MCAS will put in a little stabilizer at a time to keep up with the MCAS stab vs. AOA schedule. The MCAS trim will go in at the same 0.27 deg/sec rate but the trim will start and stop as needed depending on AOA time history.

FCeng84
Thanks, that makes a good deal of sense. I think if MCAS is updated with improved robustness of AoA sensing, and some sort of total stab authority limitation, it should be comparable to STS in risk. Besides the oddities of the system trimming against you to provide stable aircraft behaviour, STS is not controversial from a safety viewpoint. I guess the politics of sensor/algorithm/software fixes to aerodynamics will be very toxic for the near future though.
LEOCh is offline  
Old 19th Mar 2019, 14:03
  #264 (permalink)  
 
Join Date: Mar 2006
Location: England
Posts: 980
Likes: 0
Received 3 Likes on 1 Post
infrequent flyer #258,
Thanks, this information generates other lines of thought.
PEI_3721 is online now  
Old 19th Mar 2019, 14:04
  #265 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by LEOCh
Thanks, that makes a good deal of sense. I think if MCAS is updated with improved robustness of AoA sensing, and some sort of total stab authority limitation, it should be comparable to STS in risk. Besides the oddities of the system trimming against you to provide stable aircraft behaviour, STS is not controversial from a safety viewpoint. I guess the politics of sensor/algorithm/software fixes to aerodynamics will be very toxic for the near future though.
Thanks for the very interesting input! I'm not a pilot but a programmer. From a Control System perspective it seems very difficult to define a single 'event'. Does it last for 30 seconds or 5 minutes? If an aircraft approaches stall twice, does the behaviour of the first MCAS event inhibit the second one?

The more constraints are put into a system, the more possibilities there are for ending up in a logical conundrum. What may be obvious to a human is not so clear to a computer. IMO fixing MCAS may mitigate the potential for disaster, while still leaving unanticipated outcomes in the system.

Just my 2c.
GordonR_Cape is offline  
Old 19th Mar 2019, 14:08
  #266 (permalink)  
 
Join Date: Oct 2017
Location: Vienna
Posts: 143
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by ecto1
Exactly, MCAS will help with certification, but will NOT help at all in real life scenarios (considering flawless operation). It will make the task of setting a high angle of attack without stalling (say, recover from a dive with not much altitude to work with) a lot harder than without MCAS. .
Good point. In the situtation like the recent Atlas crash where pilots tried to pull up last second, it would probably trim agains them, right?
derjodel is offline  
Old 19th Mar 2019, 15:07
  #267 (permalink)  
 
Join Date: Nov 2018
Location: Canada
Posts: 15
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by LEOCh
What information is available points to a MCAS software update that increases the robustness of the AoA input but restricts stab trim output to one cycle only.

However, I don't understand how a single trim cycle could really create a particularly effective augmented stability. The trouble is, we really don't know much about the characteristics of MAX stability, and only part of the MCAS algorithm parameters. But it is likely that the Cm versus alpha curves for the unaugmented MAX tend to show a pre-stall region of decreased stability (not instability) due to Nacelle lift as below. This makes it easier to pull through the pre-stall region than at lower AoAs, and breaks certification.

A control loop more robust and sophisticated than MCAS that senses AoA and actuates stab trim to make the desired Cm vs. alpha plot might be possible (although not necessarily a good idea). However, an MCAS2 that outputs only one trim event should produce something more like the plot below. Apologies for the large amount of assumptions and simplifications for this plot, but for want of more accurate values, the nacelle lift region stretches from AoA 8' to 14' (where the wing stalls). The MCAS-like system is putting in a single trim event (triggered at 10' AoA) that is effectively trimming the aircraft from AoA 5' to 2' (if the column was returned to neutral).

The single trim event augmented performance is a very ragged approximation of the desired behaviour, in fact if you resisted the trim message from this MCAS2 by pulling through it, you would be back in the lower stability regime again until stall. If the lower stability region breaks certification it seems rather an ineffective fix.

Excellent diagram!

I am curious what is the current AOA DISAGREE warning threshold.? I read online it is set to10degrees difference between two AoA vanes? If that is the case, and if MCAS onset requirement is 8 degrees AoA, the current AOA crosscheck logic would not garrantee capture of false MCAS activation event, especially at low speed high gross weight where actual AoA is high

Last edited by LDRA; 19th Mar 2019 at 15:42.
LDRA is offline  
Old 19th Mar 2019, 15:30
  #268 (permalink)  
 
Join Date: Nov 2018
Location: madrid
Posts: 47
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by derjodel
Good point. In the situtation like the recent Atlas crash where pilots tried to pull up last second, it would probably trim agains them, right?
Yes, but all things perfect (in the MAX, sensor and computer OK) that is a "good" idea (all it does is precisely cancel the effect of the nacelles "trimming" "for" them).

My point is, the tendency is "good", but MCAS reaction time is so slow that, for any real life maneuver in which you could get in trouble (say a sharp turn or recovery from a dive):

- First, it doesn't help you to control near a stall (it is still easier to pull the more AOA you get, as with no MCAS at all) and
- Second, once you managed to set a high AOA without stalling, it will ruin it and force you to progressively pull a bit more each second of the maneuver to keep the same AOA and then
- Third, just as you just managed to compute and compensate for that strange behaviour in your brain (you pull a bit more each second), it will suddenly stop and you better detect it quick or you will stall this time for sure.

The speed of something that adds to human commands to help with linearity must be 10 times faster than the human commands themselves. Otherwise it will get in opposite phase and it will make finesse impossible, much worse than doing nothing.

I bet they knew it, they didn't care. But let's not make the same mistake twice and let's not accept a software revision that keeps one of the main problems unaddressed.

(or we can also train to blip the trim switch briefly every 3 seconds when in trouble to make sure MCAS doesn't add to your problems). Not a joke.
ecto1 is offline  
Old 19th Mar 2019, 15:40
  #269 (permalink)  
 
Join Date: Feb 2013
Location: 60 north
Age: 59
Posts: 17
Likes: 0
Received 0 Likes on 0 Posts
Not Airworthy!

Canada is now going to look into what deal FAA and Boeing made to rush the Max onto the market.

I was asked by some Pax " When can company X start planing use of the MAX they have? "
The answer is simple , I would plan its use from the winter Schedule since company X has 10 to 15 % less production and can have them grounded to next April!

No software is a safe patch , the way I see it and as fare as I am concerned the whole certification process needs reevaluation, at best !

The fact is the MAX is unstable and the MCAS is not fit for purpose. Even when working.
End off.

Regards
Cpt B
738
BluSdUp is offline  
Old 19th Mar 2019, 17:48
  #270 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by GordonR_Cape
Thanks for the very interesting input! I'm not a pilot but a programmer. From a Control System perspective it seems very difficult to define a single 'event'. Does it last for 30 seconds or 5 minutes? If an aircraft approaches stall twice, does the behaviour of the first MCAS event inhibit the second one?

The more constraints are put into a system, the more possibilities there are for ending up in a logical conundrum. What may be obvious to a human is not so clear to a computer. IMO fixing MCAS may mitigate the potential for disaster, while still leaving unanticipated outcomes in the system.

Just my 2c.
Another part of MCAS functionality that has not gotten much coverage is how it recovers and moves the stabilizer back in the airplane nose up direction once the high AOA event that triggered MCAS in the first place no longer exists. MCAS keeps track of how much stabilizer motion in the airplane nose down direction it has commanded (either all at once for a rapid AOA increase of as a number of shorter trim inputs for a slower AOA increase - see my entries above in this thread). Once AOA has dropped back below the MCAS activation point it will begin running the stabilizer in the airplane nose up direction to take out what it has put in. This will proceed until the stabilizer is back where it started from before MCAS activation provided the flight crew does not make a trim input. Any trim input causes MCAS to stop its command and reset, ready to go again when it next sees the activation criteria of Flaps Up, Autopilot Disconnected, and AOA above MCAS activation threshold.

FCeng84 is offline  
Old 19th Mar 2019, 20:42
  #271 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 81
Posts: 1,609
Received 52 Likes on 15 Posts
Salute!

Outstanding, these last few posts. Warms the cold, crusted heart of this old engineer and government paid triggerman.

Of note, and I hinted at this over on the main thread...... FC did it, the swine! PEI has also hinted at it as have others. It’s the other things behind the curtain. And the revelation that MCAS remembers where it started is good and bad news. The bad is we are just finding out.

Imagine an an intermittent connection/bad connector from the AoA probe. MCAS activates at 35,000 feet and 0.7 M. Or so. Whoops! Uncommanded nose down trim, a/p disconnect, unreliable ias, feel difference light, alt disagree, stick shaker, Oh baby oh baby. I trim up and tricky Mach effects take hold. Oh man, oh man....... The progression is left to the experienced pilot reader here.

“lemme” has postulated the bad connection possibilities, and if I was on the Board I would be looking at all possibilities of bad connectors and wire bundles, as well as if certain shifts/crews performed either maintenance or the original assembly of the various components.... In short, it may not have been a bent probe as Saili claimed to have had one day.
===============
I did O.K. In my aero classes and in maintaining control of several fast movers at AoA’s you can not imagine. So youse folks with current education and design experience can explain why we can’t reconfigure the engine nacelles on the Max to help with the reduced pitch moment problem. Hell, slots, vortex generators, a few degrees here and there, something!

Gums wonders....

gums is offline  
Old 19th Mar 2019, 21:09
  #272 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by gums
Salute!

Outstanding, these last few posts. Warms the cold, crusted heart of this old engineer and government paid triggerman.

Of note, and I hinted at this over on the main thread...... FC did it, the swine! PEI has also hinted at it as have others. It’s the other things behind the curtain. And the revelation that MCAS remembers where it started is good and bad news. The bad is we are just finding out.

Imagine an an intermittent connection/bad connector from the AoA probe. MCAS activates at 35,000 feet and 0.7 M. Or so. Whoops! Uncommanded nose down trim, a/p disconnect, unreliable ias, feel difference light, alt disagree, stick shaker, Oh baby oh baby. I trim up and tricky Mach effects take hold. Oh man, oh man....... The progression is left to the experienced pilot reader here.

“lemme” has postulated the bad connection possibilities, and if I was on the Board I would be looking at all possibilities of bad connectors and wire bundles, as well as if certain shifts/crews performed either maintenance or the original assembly of the various components.... In short, it may not have been a bent probe as Saili claimed to have had one day.
===============
I did O.K. In my aero classes and in maintaining control of several fast movers at AoA’s you can not imagine. So youse folks with current education and design experience can explain why we can’t reconfigure the engine nacelles on the Max to help with the reduced pitch moment problem. Hell, slots, vortex generators, a few degrees here and there, something!

Gums wonders....

Gums - the sequence above in your "Imagine ..." paragraph seems to have MCAS acting before A/P disconnect. MCAS can come active following A/P disconnect if indicated AOA is high enough, but not while A/P is engaged. As for your last thoughts on aerodynamic fixes vs. MCAS, the message that always comes down with a request to the Flight Controls team is that control law change (if a viable, safe option) is the least impact means of addressing the issue of the day.
FCeng84 is offline  
Old 19th Mar 2019, 23:16
  #273 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 81
Posts: 1,609
Received 52 Likes on 15 Posts
Salute FCeng !!

Sorry, but my understanding of bad AoA inputs or a combination of sensor inputs to the ADRIU's is that would trigger the a/p disconnect. Would you trust mach to govern elevator trim if it showed 0.3M when at 35,000 feet?
I understand that the MCAS is not supposed to work if A/P engaged. Or is it only that I cannot connect A/P if MCAS trying to kill me?? I also got from the FCOM stuff that A/P would disconnect if we had unreliable/disagree IAS/alt/etcetera. SHeesh. The fault tree I have to run thru when I have all the warnings and bells and whistles and stick shaker in the cockpit is beginning to bug me.

My scenario is based upon the FCC and other boxes disconnecting a/p. Not MCAS, which ain't supposed to work unless flying pseudo-manual with flaps up.

later,

Gums sends...

Last edited by gums; 19th Mar 2019 at 23:27.
gums is offline  
Old 19th Mar 2019, 23:24
  #274 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by gums
Salute FCeng !!

Sorry, but my understanding of bad AoA inputs or a combination of sensor inputs to the ADRIU's is that would trigger the a/p disconnect. Would you trust mach to govern elevator trim if it showed 0.3M when at 35,000 feet?
I understand that the MCAS is not supposed to work if A/P engaged. Or is it only that I cannot connect A/P if MCAS trying to kill me?? I also got from the FCOM stuff that A/P would disconnect if we had unreliable/disagree IAS/alt/etcetera. SHeesh. The fault tree I have to run thru when I have all the warnings and bells and whistles and stick shaker in the cockpit is beginning to bug me.

later,

Gums sends...
You have a point there that I need to look into. Namely, will the AOA error that would drive MCAS to erroneously activate if A/P disconnected actually cause A/P to disconnect thus dropping into the situation where MCAS will erroneously activate? If so, single failure during flight with A/P engaged could cause both disengage and MCAS activation. I'll have to do some digging and report back. Maybe others on here know the A/P disconnect answer and can offer their wisdom.

FCeng84
FCeng84 is offline  
Old 19th Mar 2019, 23:44
  #275 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes on 0 Posts
So Southwest and other domestic carriers have an "option" that diagnoses AoA disagree. What does it do then? Disconnect MCAS and revert to manual trim?

But then why was this software already adopted by all domestic carriers, if it is a safety option why is it not factory installed?

Edmund
edmundronald is offline  
Old 20th Mar 2019, 00:09
  #276 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 81
Posts: 1,609
Received 52 Likes on 15 Posts
Salute FC !

My response has been "mod'ed" out, but I repeat part for brevity and more later.

I KNOW!!! I have seen many references that A/P is disconnected upon various air data problems, so my scenario begins with the same sensor data that could trigger McAS - primarily bad AoA and its children/associated data entities. In other words, excessive AoA dat or maybe failed data to the ADRIU and FCC. And BTW? How does the MCAS sfwe module handle loss of AoA data and mach data?

Gums sends...
gums is offline  
Old 20th Mar 2019, 01:17
  #277 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by gums
Salute FC !

My response has been "mod'ed" out, but I repeat part for brevity and more later.

I KNOW!!! I have seen many references that A/P is disconnected upon various air data problems, so my scenario begins with the same sensor data that could trigger McAS - primarily bad AoA and its children/associated data entities. In other words, excessive AoA dat or maybe failed data to the ADRIU and FCC. And BTW? How does the MCAS sfwe module handle loss of AoA data and mach data?

Gums sends...
MCAS checks AOA validity. If it is declared invalid via in-line monitors (such as an error with the heater circuit or detected problem with wiring) MCAS from that FCC is shut down. I think it switches to the other FCC in that event. Will check.
FCeng84 is offline  
Old 20th Mar 2019, 01:20
  #278 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by edmundronald
So Southwest and other domestic carriers have an "option" that diagnoses AoA disagree. What does it do then? Disconnect MCAS and revert to manual trim?

But then why was this software already adopted by all domestic carriers, if it is a safety option why is it not factory installed?

Edmund
Option provides display only. MCAS function is identical with or without the option. With the option the crew has more tools to identify an AOA signal error if one is present and to isolate as to which one seems more reasonable.
FCeng84 is offline  
Old 20th Mar 2019, 06:51
  #279 (permalink)  
 
Join Date: Nov 2018
Location: Brisbane
Posts: 20
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by gums
Sorry, but my understanding of bad AoA inputs or a combination of sensor inputs to the ADRIU's is that would trigger the a/p disconnect. Would you trust mach to govern elevator trim if it showed 0.3M when at 35,000 feet?
I understand that the MCAS is not supposed to work if A/P engaged. Or is it only that I cannot connect A/P if MCAS trying to kill me?? I also got from the FCOM stuff that A/P would disconnect if we had unreliable/disagree IAS/alt/etcetera. SHeesh. The fault tree I have to run thru when I have all the warnings and bells and whistles and stick shaker in the cockpit is beginning to bug me.

My scenario is based upon the FCC and other boxes disconnecting a/p. Not MCAS, which ain't supposed to work unless flying pseudo-manual with flaps up.
Thanks gums

The idea of "pseudo-manual" mode raises an interesting point about how airliner automation has evolved somewhat ahead of certification philosophy. Besides the particular nacelle issue with the MAX addressed by MCAS, it makes sense to relax pitch stability (in all airliners) by pushing the rear CG limit further back, thus reducing tail download, and reaping the fuel efficiency benefit from the reduced drag. A system like STS can then supply certification-required speed stability (for example) that has been somewhat degraded. The aircraft is still stable and flyable minus augmentation but not to certification standards.

But in the situation that sensor failures lead to the autopilot deactivating, it likely drops you into a pseudo-manual flying mode probably dependent on the same suite of sensors. My understanding is that certification dictates that the system cannot automatically deactivate the manual flying aids (e.g. STS, EFS, MCAS) and annunciate that it has done so, even if based on known sensor input failures they likely will be degraded.
LEOCh is offline  
Old 20th Mar 2019, 07:01
  #280 (permalink)  
 
Join Date: Apr 2014
Location: Melbourne
Posts: 302
Received 13 Likes on 6 Posts

Pilot who hitched a ride saved Boeing 737 Max a day before it crashed

https://www.theage.com.au/business/c...20-p515sq.html
Pearly White is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.