Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Old 30th Mar 2019, 11:02
  #461 (permalink)  
 
Join Date: May 2011
Location: Finland
Age: 60
Posts: 16
Originally Posted by ecto1 View Post
Exactly.

Technically, the most practical solution would be to completely delete mcas and upgrade the stall feel mechanism from on/off to gradual. One little box involved, possibility of mayhem kept the same (very low), feel improved also in real life scenarios, requirement passed.
....

Bureaucratically who knows what makes sense now.
I agree, it will keep the pilot in the loop.
If MCAS authority to “correct” pilot actions/feelings only ones, what appends when he/she is in troubles and prefer some longer term assistance. At first the plane acts differently and the its characteristics suddenly changes. Not an ideal situation when you have hands full on work anyway.
Ad hoc patching should not be the way to resolve this kind of wild fire. Back to drawing board and, in the mean time, very high training standards for the pilots to fly “restricted feature” (without MCAS and the final solution) plane could be shortest creditable way out of this mess.
JPcont is offline  
Old 30th Mar 2019, 11:18
  #462 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 60
Posts: 424
ecto1

Obvious solution: we would need to reduce the feel by a factor of 0.8 across all range and then use the new 20% headroom for MCAS. The rule is concerned about the linearity, I am almost sure that the feel in the 737 has a lot of margin to be softened.
If the feel factor on the MAX was changed, it would not be the same as the NG model, and would need a separate type certificate. That does not help anybody...
GordonR_Cape is offline  
Old 30th Mar 2019, 13:42
  #463 (permalink)  
 
Join Date: Feb 2007
Location: England
Posts: 451
As a mere SEP driver, I tremble to post here.
But after reading this whole thread it seems to me that if an airplane design is modified to the extent that it requires automation to override the pilots' controls without informing them of its actions, that was not a wise modification to make.
As the old saying goes, "Two wrongs don't make a right".
Sallyann1234 is offline  
Old 30th Mar 2019, 14:12
  #464 (permalink)  
 
Join Date: Dec 2001
Location: Brisvegas
Posts: 3,328
Well you are not going to be a fan of FBW then.
Icarus2001 is offline  
Old 30th Mar 2019, 14:25
  #465 (permalink)  
 
Join Date: Sep 2011
Location: Belgium
Age: 63
Posts: 138
FBW or manual control has nothing to do with these incidents.

If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.

The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
Vilters is offline  
Old 30th Mar 2019, 14:38
  #466 (permalink)  
 
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,825
Err, sort of agreed in that MCAS did what it was told. Allowing a single source of data to have such influence could be seen as a design flaw. But let's not ignore the fact that MCAS was necessary because there were two mighty engines slung from a 50 year-old airframe that wasn't designed for such a configuration.

There is another question - if Boeing had to include MCAS to certify the 737MAX, what other enhancements were required and, importantly, was there adequate oversight of their development?
Cows getting bigger is offline  
Old 30th Mar 2019, 14:48
  #467 (permalink)  
 
Join Date: Sep 2011
Location: Belgium
Age: 63
Posts: 138
Tja, certification of newer models of older designs => That is another issue that goes deep, very deep.
Take a new F-16 and compare it to it original design...…
A new C-130, a new F-15, or a new B-747 . . . .
Vilters is offline  
Old 30th Mar 2019, 15:02
  #468 (permalink)  
 
Join Date: Jun 2001
Location: Rockytop, Tennessee, USA
Posts: 5,899
Originally Posted by Vilters View Post
If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Really? Is that how it works?
Airbubba is offline  
Old 30th Mar 2019, 15:15
  #469 (permalink)  
 
Join Date: Aug 2007
Location: Brazil
Age: 69
Posts: 131
Disable MCAS with opposite pilot input

Originally Posted by QuagmireAirlines View Post
They didn't need to turn it off. Not stalling. Pitch was high, yet with an empty aircraft, velocity vector was high too.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
As soon as the pilot input is in the opposite direction (Yoke, trim or both). If the pilot is trying to raise the nose, he is pretty much certain there is not a pre-stall situation.
Rob21 is offline  
Old 30th Mar 2019, 16:12
  #470 (permalink)  
 
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Originally Posted by QuagmireAirlines View Post
They didn't need to turn it off. Not stalling. Pitch was high, yet with an empty aircraft, velocity vector was high too.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
There is confusion on this thread.
MCAS is not to stop the aircraft stalling - it is to ensure that the correct number of pounds of force are required on the control column per knot of airspeed increase/decrease. This may have the effect of preventing a pilot pulling into a stall (particularly a high speed stall) but MCAS was there to meet 14 CFR 25.173 which reads:

§25.173 Static longitudinal stability.

Under the conditions specified in §25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or VFC/MFC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in §25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in §25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.
[Amdt. 25-7, 30 FR 13117, Oct. 15, 1965]
There is nothing in this regulation about Stall. It is expected that one of the effects of the specified pull forces will be pilots less likely to pull into a stall, but the regulation does not mention stalling.
Ian W is offline  
Old 30th Mar 2019, 16:20
  #471 (permalink)  
 
Join Date: Nov 2018
Location: madrid
Posts: 47
Originally Posted by Vilters View Post
FBW or manual control has nothing to do with these incidents.

If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.
I agree, but wise programming in the receiving end will force Murphy to work harder in his sensor breaking job to be able to finally bring the plane down. It shouldn't be like this, but a human pilot software uses much more plausibility checks in his sensor inputs than a computer pilot software. So either we improve digital software or we improve information and skill in the biological software.

Originally Posted by Vilters View Post

The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
I agree also, but MCAS will PROUDLY and exactly "as designed to do" help to bring the aircraft down if, all sensors and systems being 100%, the pilot needs it in a real life situation.

Being it so slow to react, MCAS will leave the "maneuver characteristics" "un-augmented" in the critical first couple of seconds in which the pilot is pulling. And then, if he/she didn't pulled already into a stall because of the unfriendly maneuver characteristics, MCAS will then reduce the loading (when it is already completely unneeded), forcing the pilot to add a steady incremental pull to maintain the g's, an then it will stop doing it suddenly, testing pilot reflexes for the third time.

I wouldn't be such a proud member of the augmentation system's club if i did such a bad job of helping my pilot.
ecto1 is offline  
Old 30th Mar 2019, 17:28
  #472 (permalink)  
 
Join Date: Mar 2015
Location: Washington state
Posts: 209
Originally Posted by hans brinker View Post
No, not a good idea at all. First of all the pilots HAVE a switch that overrides MCAS while it is trimming: the electric trim switch on the control wheel.
This is the crux of the design problem and one of the "holes in the cheese" that led to a fatal engineering decision. Computer programmers love it when they can reuse code for a different purpose; it seems elegant not to require an "off" switch for MCAS because you already have an "off" switch for the electric trim. Smart! In addition, any MCAS failure kind of sort of looks like runaway trim, so you don't have to tell pilots about it because if it misbehaves they will recognize it as a runaway trim and do the right thing automatically. I can see this argument being made in the design room by people who never actually have to deal with humans.

In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.

Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)

So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
Water pilot is offline  
Old 30th Mar 2019, 17:41
  #473 (permalink)  
 
Join Date: Nov 2010
Age: 54
Posts: 687
Originally Posted by Water pilot View Post
This is the crux of the design problem and one of the "holes in the cheese" that led to a fatal engineering decision. Computer programmers love it when they can reuse code for a different purpose; it seems elegant not to require an "off" switch for MCAS because you already have an "off" switch for the electric trim. Smart! In addition, any MCAS failure kind of sort of looks like runaway trim, so you don't have to tell pilots about it because if it misbehaves they will recognize it as a runaway trim and do the right thing automatically. I can see this argument being made in the design room by people who never actually have to deal with humans.

In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.

Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)

So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
I am 100% in agreement with everything you say, MCAS should not use single input, there should have been an AOA disagree light, pilots should have been trained and informed by Boeing about MCAS, and mostly MAX/MCAS is just a bad design in general. I was more replying to the suggestion of having a button that would rapidly reset the THS, which would bring it's own set of issues, I don't have an issue with MCAS disabling itself with AOA disagree plus the pilots having a button to switch it off and keep thumb trim input working for failures MCAS doesn't recognize. I think a lot of us could have gotten into trouble with MCAS before we knew about it, what surprises me a little is the second crash.
hans brinker is offline  
Old 30th Mar 2019, 18:51
  #474 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 60
Posts: 424
Originally Posted by Rob21 View Post
As soon as the pilot input is in the opposite direction (Yoke, trim or both). If the pilot is trying to raise the nose, he is pretty much certain there is not a pre-stall situation.
I think the outcomes of AF447 and TAK363 tell the opposite story! Pilots in day/VMC have a different level of information to those flying at night/IMC, or while experiencing Somatogravic Illusion.

IMO no computer software decisions should be based on assumptions about what the pilots may or may not know. And no single solution works for all eventualities.
GordonR_Cape is offline  
Old 30th Mar 2019, 19:05
  #475 (permalink)  
 
Join Date: Aug 2013
Location: Washington.
Age: 72
Posts: 753
Originally Posted by Vilters View Post
FBW or manual control has nothing to do with these incidents.

If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.

The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
Perhaps so, but if it was designed to keep fighting the pilot who was desperately trying to regain control of the airplane, then it was designed wrong. Certainly the MCAS did not malfunction, it behaved as designed, but when it apparently received the wrong AoA value from the single input and the pilot(s) desperately sought to recover the airplane, the MCAS behaved badly, unsafely and unacceptably. It was designed wrong.
GlobalNav is offline  
Old 30th Mar 2019, 20:46
  #476 (permalink)  
 
Join Date: May 2013
Location: home
Posts: 65
Originally Posted by GlobalNav View Post
Perhaps so, but if it was designed to keep fighting the pilot who was desperately trying to regain control of the airplane, then it was designed wrong. Certainly the MCAS did not malfunction, it behaved as designed, but when it apparently received the wrong AoA value from the single input and the pilot(s) desperately sought to recover the airplane, the MCAS behaved badly, unsafely and unacceptably. It was designed wrong.
Agree with that. The post that you've quoted is referring to faulty sensor input as an unpredictable condition, coming from an extraneous device, which clearly is not the case. The entire airplane control system - the entire cockpit must be designed to maintain safety and facilitate pilot's efforts under any conceivable situation. I think that designing MCAS to trim down so aggressively is wrong on multiple levels, the first of course is that it has proved able to win over the desperate efforts the pilot(s) to keep the plane from falling, and the second is that its continued action created an uninterrupted emergency situation drawing away all attention and cold thinking needed to perform a not-so-obvious action - its disconnection.
Now, how many documented occurrences of MCAS acting for what it has been designed do we have?
lapp is offline  
Old 31st Mar 2019, 03:09
  #477 (permalink)  
 
Join Date: Mar 2015
Location: Washington state
Posts: 209
I agree, the second crash is pretty surprising and might indicate that there is much that is not known about the problem. The pilots reported that they could not trust any instruments, so it was much more complex than the clean MCAS scenario that we have considered so far. Cascades of errors are common in the failure of software systems as the first failure can put the system outside of the testing envelope. From following this thread it looks like the MAX had a glass cockpit (screens instead of analog gauges) that the other models did not have, is that correct? I have actually done almost exactly that sort of programming and it is not as simple as it sounds.

Both planes were (according to media reports) practically brand new which should mean that they were pretty close in the production line. That is kind of a scary fact on its own.
Water pilot is offline  
Old 31st Mar 2019, 04:17
  #478 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Originally Posted by Water pilot View Post
The pilots reported that they could not trust any instruments, so it was much more complex than the clean MCAS scenario that we have considered so far. Cascades of errors are common in the failure of software systems as the first failure can put the system outside of the testing envelope. From following this thread it looks like the MAX had a glass cockpit (screens instead of analog gauges) that the other models did not have, is that correct? I have actually done almost exactly that sort of programming and it is not as simple as it sounds.
This is a very fast moving thread, it is difficult to keep up with this in conjunction with the previous Lion Air one. Lots of good information came out.

It was not a "clean MCAS" scenario [take to mean an approach to aerodynamic stall] as you rightly point out.
We know from the first accident the MCAS nose down trim activation was a ONE consequence of erroneous data from an Angle Of Attack vane. The other consequences of the erroneous data were:
  • IAS Disagree (airspeed is an AoA dependant value, visual warning)
  • Stick shaker activation (tactile and audible warning)
  • Elevator Feel Differential warning (visual)
  • Almost certainly multiple other visual warnings
Note, these warnings were from lift off.

If you want to get a sense of what the crew faced, this is a 5 minute loop of the 737 stick shaker. The Lion Air crew had this for the entire 11 minutes of flight. I've posted this video multiple times to demonstrate just one of the difficulties the crew were faced with.

Particularly in the Lion Air case, when the MCAS was unknown, all the crew would be able to comprehend for the first seconds of flight is the aircraft is that the aircraft was actually still flying, and not in fact stalling. Once they came to terms with a pitch attitude and takeoff thrust set that kept them flying, it was then a case of trying to figure out what is going on. They probably understood they needed to run the airspeed unreliable checklist and felt they had things under enough control to make a safe landing.

The really insidious part is the MCAS was silently sitting there armed due to the AoA erroneous data, but inactive until the flaps were retracted. Once they retracted the flaps, MCAS became active and the fight between it and the crew began, the crew searching the checklist for a solution, not realising what was wrong. They went from being able to fly straight and level to having some weirdly inconsistent pitch issue simply by retracting the flaps. Nothing in the IAS disagree checklist cautions against moving the flap lever. There shouldn't be a connection from their system knowledge. We now know the crew tried to find a checklist to cover this problem until the end of the flight. They probably had the target attitude and thrust for straight and level flight at 5,000' as per inflight performance for unreliable airspeed, but the aircraft just kept fighting them. Remember they still had the stick shaker and all the other associated warning until the end.

Why is the Ethiopian accident different? MCAS appears to have become active very soon after takeoff, as reported by porpoising from the Tower and other aircraft on the ground. The answer as to why MCAS activation happened sooner than for Lion Air has not been publicly revealed.
CurtainTwitcher is offline  
Old 31st Mar 2019, 06:59
  #479 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,248
Most of PPRuNe ‘software’ analysis are based on the values of AoA recorded by the FDR.
Where exactly in the sensing and computational system is the FDR value take from ?

If the FDR records the vane output then this implies that this is the value which the FGC uses; I assume that there are exceptions to this - transmission error, interference. Thus MCAS (and other FGS functions) can malfunction; but not always - not every aircraft / flight - why not.
However, if the FDR samples ‘some universal bus’, then the origin of the corrupt AoA is less clear, as might be the random nature.

Is there a situation where the FGC receives the correct vane value, but subsequent internal computation corrupts the AoA value used by MCAS, which is then widely available; FDR, air-data, stick-shake (most from within the FGC), i.e. the corruption is associated with the ‘new’ software specific to the 737 Max.

Could this add weight to an argument as to why previous variants of 737 apparently do not experience many AoA problems - false stick-shake, but why two 737 Max have (check relative probabilities, failure rates).

What evidence is required to judge this, starting of course with the FDR pickoff.


Curtain Twitcher #484
The reported ‘porpoising’ after takeoff could be consistent with stick-shake and apparent unreliable airspeed, as per Lion and system based theory.








Last edited by safetypee; 31st Mar 2019 at 10:04. Reason: typo
safetypee is offline  
Old 31st Mar 2019, 08:28
  #480 (permalink)  
 
Join Date: Dec 2014
Location: Schiphol
Posts: 387
@Fceng84 and Gums – In his testimony during the US Senate Aviation Safety hearing of the 27th FAA’s Mr Elwell stated that [according to the FAA – and Boeing] MCAS was a subsystem of STS. I would be VERY interested in hearing your respective views on this statement. That from a technical functional point of view, technical implementation point of view, and from a pilot’s perspective.

If you have already answered these questions, I first have to say sorry, but hope you could point me to these answers - in which thread and in what post they were answered.
A0283 is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information -

Copyright © 2021 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.