Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed
Join Date: May 2011
Location: Finland
Age: 62
Posts: 16
Likes: 0
Received 0 Likes
on
0 Posts
Exactly.
Technically, the most practical solution would be to completely delete mcas and upgrade the stall feel mechanism from on/off to gradual. One little box involved, possibility of mayhem kept the same (very low), feel improved also in real life scenarios, requirement passed.
....
Bureaucratically who knows what makes sense now.
Technically, the most practical solution would be to completely delete mcas and upgrade the stall feel mechanism from on/off to gradual. One little box involved, possibility of mayhem kept the same (very low), feel improved also in real life scenarios, requirement passed.
....
Bureaucratically who knows what makes sense now.
I agree, it will keep the pilot in the loop.
If MCAS authority to “correct” pilot actions/feelings only ones, what appends when he/she is in troubles and prefer some longer term assistance. At first the plane acts differently and the its characteristics suddenly changes. Not an ideal situation when you have hands full on work anyway.
Ad hoc patching should not be the way to resolve this kind of wild fire. Back to drawing board and, in the mean time, very high training standards for the pilots to fly “restricted feature” (without MCAS and the final solution) plane could be shortest creditable way out of this mess.
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
ecto1
If the feel factor on the MAX was changed, it would not be the same as the NG model, and would need a separate type certificate. That does not help anybody...
Obvious solution: we would need to reduce the feel by a factor of 0.8 across all range and then use the new 20% headroom for MCAS. The rule is concerned about the linearity, I am almost sure that the feel in the 737 has a lot of margin to be softened.
As a mere SEP driver, I tremble to post here.
But after reading this whole thread it seems to me that if an airplane design is modified to the extent that it requires automation to override the pilots' controls without informing them of its actions, that was not a wise modification to make.
As the old saying goes, "Two wrongs don't make a right".
But after reading this whole thread it seems to me that if an airplane design is modified to the extent that it requires automation to override the pilots' controls without informing them of its actions, that was not a wise modification to make.
As the old saying goes, "Two wrongs don't make a right".
Join Date: Sep 2011
Location: Belgium
Age: 64
Posts: 138
Likes: 0
Received 0 Likes
on
0 Posts
FBW or manual control has nothing to do with these incidents.
If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.
The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.
The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,821
Likes: 0
Received 0 Likes
on
0 Posts
Err, sort of agreed in that MCAS did what it was told. Allowing a single source of data to have such influence could be seen as a design flaw. But let's not ignore the fact that MCAS was necessary because there were two mighty engines slung from a 50 year-old airframe that wasn't designed for such a configuration.
There is another question - if Boeing had to include MCAS to certify the 737MAX, what other enhancements were required and, importantly, was there adequate oversight of their development?
There is another question - if Boeing had to include MCAS to certify the 737MAX, what other enhancements were required and, importantly, was there adequate oversight of their development?
Join Date: Sep 2011
Location: Belgium
Age: 64
Posts: 138
Likes: 0
Received 0 Likes
on
0 Posts
Tja, certification of newer models of older designs => That is another issue that goes deep, very deep.
Take a new F-16 and compare it to it original design...…
A new C-130, a new F-15, or a new B-747 . . . .
Take a new F-16 and compare it to it original design...…
A new C-130, a new F-15, or a new B-747 . . . .
Join Date: Jun 2001
Location: Rockytop, Tennessee, USA
Posts: 5,898
Likes: 0
Received 1 Like
on
1 Post
Join Date: Aug 2007
Location: Brazil
Age: 71
Posts: 131
Likes: 0
Received 0 Likes
on
0 Posts
Disable MCAS with opposite pilot input
They didn't need to turn it off. Not stalling. Pitch was high, yet with an empty aircraft, velocity vector was high too.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
They didn't need to turn it off. Not stalling. Pitch was high, yet with an empty aircraft, velocity vector was high too.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
It does raise a related issue: What pitch angle and/or vertical speed should MCAS be safely disabled?
I might have implemented a disable for pitch angle < 6 degrees, and possibly add an AND condtion with vertical speed < 0 which would keep the nose from auto-trimming down when descending at a low or negative pitch angle.
What condition would you disable MCAS down-trim on? Boeing isn't buying any of that of course, yet doesn't keep us from suggesting something else.
MCAS is not to stop the aircraft stalling - it is to ensure that the correct number of pounds of force are required on the control column per knot of airspeed increase/decrease. This may have the effect of preventing a pilot pulling into a stall (particularly a high speed stall) but MCAS was there to meet 14 CFR 25.173 which reads:
§25.173 Static longitudinal stability.
Under the conditions specified in §25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or VFC/MFC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in §25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in §25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.
[Amdt. 25-7, 30 FR 13117, Oct. 15, 1965]
Under the conditions specified in §25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or VFC/MFC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in §25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in §25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.
[Amdt. 25-7, 30 FR 13117, Oct. 15, 1965]
Join Date: Nov 2018
Location: madrid
Posts: 47
Likes: 0
Received 0 Likes
on
0 Posts
Being it so slow to react, MCAS will leave the "maneuver characteristics" "un-augmented" in the critical first couple of seconds in which the pilot is pulling. And then, if he/she didn't pulled already into a stall because of the unfriendly maneuver characteristics, MCAS will then reduce the loading (when it is already completely unneeded), forcing the pilot to add a steady incremental pull to maintain the g's, an then it will stop doing it suddenly, testing pilot reflexes for the third time.
I wouldn't be such a proud member of the augmentation system's club if i did such a bad job of helping my pilot.
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes
on
0 Posts
In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.
Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)
So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
This is the crux of the design problem and one of the "holes in the cheese" that led to a fatal engineering decision. Computer programmers love it when they can reuse code for a different purpose; it seems elegant not to require an "off" switch for MCAS because you already have an "off" switch for the electric trim. Smart! In addition, any MCAS failure kind of sort of looks like runaway trim, so you don't have to tell pilots about it because if it misbehaves they will recognize it as a runaway trim and do the right thing automatically. I can see this argument being made in the design room by people who never actually have to deal with humans.
In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.
Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)
So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.
Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)
So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
IMO no computer software decisions should be based on assumptions about what the pilots may or may not know. And no single solution works for all eventualities.
FBW or manual control has nothing to do with these incidents.
If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.
The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
If sensors/systems feed wrong information, to a pilot, an autopilot, an ADC, an MCAS, or whatever system, the aircraft is going down.
Some still don't get it.
The MCAS system was working PERFECTLY and did its JOB very PROUDLY and exactly "as designed to do so". .
But it got "WRONG INFORMATION" from the AOA sensors/system, and it was only fed by a single probe => That can be seen as a AOA signal concept error..
Join Date: May 2013
Location: home
Posts: 66
Likes: 0
Received 0 Likes
on
0 Posts
Perhaps so, but if it was designed to keep fighting the pilot who was desperately trying to regain control of the airplane, then it was designed wrong. Certainly the MCAS did not malfunction, it behaved as designed, but when it apparently received the wrong AoA value from the single input and the pilot(s) desperately sought to recover the airplane, the MCAS behaved badly, unsafely and unacceptably. It was designed wrong.
Now, how many documented occurrences of MCAS acting for what it has been designed do we have?
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes
on
0 Posts
I agree, the second crash is pretty surprising and might indicate that there is much that is not known about the problem. The pilots reported that they could not trust any instruments, so it was much more complex than the clean MCAS scenario that we have considered so far. Cascades of errors are common in the failure of software systems as the first failure can put the system outside of the testing envelope. From following this thread it looks like the MAX had a glass cockpit (screens instead of analog gauges) that the other models did not have, is that correct? I have actually done almost exactly that sort of programming and it is not as simple as it sounds.
Both planes were (according to media reports) practically brand new which should mean that they were pretty close in the production line. That is kind of a scary fact on its own.
Both planes were (according to media reports) practically brand new which should mean that they were pretty close in the production line. That is kind of a scary fact on its own.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
The pilots reported that they could not trust any instruments, so it was much more complex than the clean MCAS scenario that we have considered so far. Cascades of errors are common in the failure of software systems as the first failure can put the system outside of the testing envelope. From following this thread it looks like the MAX had a glass cockpit (screens instead of analog gauges) that the other models did not have, is that correct? I have actually done almost exactly that sort of programming and it is not as simple as it sounds.
It was not a "clean MCAS" scenario [take to mean an approach to aerodynamic stall] as you rightly point out.
We know from the first accident the MCAS nose down trim activation was a ONE consequence of erroneous data from an Angle Of Attack vane. The other consequences of the erroneous data were:
- IAS Disagree (airspeed is an AoA dependant value, visual warning)
- Stick shaker activation (tactile and audible warning)
- Elevator Feel Differential warning (visual)
- Almost certainly multiple other visual warnings
If you want to get a sense of what the crew faced, this is a 5 minute loop of the 737 stick shaker. The Lion Air crew had this for the entire 11 minutes of flight. I've posted this video multiple times to demonstrate just one of the difficulties the crew were faced with.
Particularly in the Lion Air case, when the MCAS was unknown, all the crew would be able to comprehend for the first seconds of flight is the aircraft is that the aircraft was actually still flying, and not in fact stalling. Once they came to terms with a pitch attitude and takeoff thrust set that kept them flying, it was then a case of trying to figure out what is going on. They probably understood they needed to run the airspeed unreliable checklist and felt they had things under enough control to make a safe landing.
The really insidious part is the MCAS was silently sitting there armed due to the AoA erroneous data, but inactive until the flaps were retracted. Once they retracted the flaps, MCAS became active and the fight between it and the crew began, the crew searching the checklist for a solution, not realising what was wrong. They went from being able to fly straight and level to having some weirdly inconsistent pitch issue simply by retracting the flaps. Nothing in the IAS disagree checklist cautions against moving the flap lever. There shouldn't be a connection from their system knowledge. We now know the crew tried to find a checklist to cover this problem until the end of the flight. They probably had the target attitude and thrust for straight and level flight at 5,000' as per inflight performance for unreliable airspeed, but the aircraft just kept fighting them. Remember they still had the stick shaker and all the other associated warning until the end.
Why is the Ethiopian accident different? MCAS appears to have become active very soon after takeoff, as reported by porpoising from the Tower and other aircraft on the ground. The answer as to why MCAS activation happened sooner than for Lion Air has not been publicly revealed.
Most of Pprune ‘software’ analysis are based on the values of AoA recorded by the FDR.
Where exactly in the sensing and computational system is the FDR value take from ?
If the FDR records the vane output then this implies that this is the value which the FGC uses; I assume that there are exceptions to this - transmission error, interference. Thus MCAS (and other FGS functions) can malfunction; but not always - not every aircraft / flight - why not.
However, if the FDR samples ‘some universal bus’, then the origin of the corrupt AoA is less clear, as might be the random nature.
Is there a situation where the FGC receives the correct vane value, but subsequent internal computation corrupts the AoA value used by MCAS, which is then widely available; FDR, air-data, stick-shake (most from within the FGC), i.e. the corruption is associated with the ‘new’ software specific to the 737 Max.
Could this add weight to an argument as to why previous variants of 737 apparently do not experience many AoA problems - false stick-shake, but why two 737 Max have (check relative probabilities, failure rates).
What evidence is required to judge this, starting of course with the FDR pickoff.
Curtain Twitcher #484
The reported ‘porpoising’ after takeoff could be consistent with stick-shake and apparent unreliable airspeed, as per Lion and system based theory.
Where exactly in the sensing and computational system is the FDR value take from ?
If the FDR records the vane output then this implies that this is the value which the FGC uses; I assume that there are exceptions to this - transmission error, interference. Thus MCAS (and other FGS functions) can malfunction; but not always - not every aircraft / flight - why not.
However, if the FDR samples ‘some universal bus’, then the origin of the corrupt AoA is less clear, as might be the random nature.
Is there a situation where the FGC receives the correct vane value, but subsequent internal computation corrupts the AoA value used by MCAS, which is then widely available; FDR, air-data, stick-shake (most from within the FGC), i.e. the corruption is associated with the ‘new’ software specific to the 737 Max.
Could this add weight to an argument as to why previous variants of 737 apparently do not experience many AoA problems - false stick-shake, but why two 737 Max have (check relative probabilities, failure rates).
What evidence is required to judge this, starting of course with the FDR pickoff.
Curtain Twitcher #484
The reported ‘porpoising’ after takeoff could be consistent with stick-shake and apparent unreliable airspeed, as per Lion and system based theory.
Last edited by safetypee; 31st Mar 2019 at 10:04. Reason: typo
Join Date: Dec 2014
Location: Schiphol
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
@Fceng84 and Gums – In his testimony during the US Senate Aviation Safety hearing of the 27th FAA’s Mr Elwell stated that [according to the FAA – and Boeing] MCAS was a subsystem of STS. I would be VERY interested in hearing your respective views on this statement. That from a technical functional point of view, technical implementation point of view, and from a pilot’s perspective.
If you have already answered these questions, I first have to say sorry, but hope you could point me to these answers - in which thread and in what post they were answered.
If you have already answered these questions, I first have to say sorry, but hope you could point me to these answers - in which thread and in what post they were answered.