Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed
RetiredBA/BY
“If we now have to start reemphasising that, we do have a VERY serious problem with pilot training.”
This is not so much to do with training as having to undo all of the previous misleading information and inappropriate procedures forced on the industry by the US / FAA / Boeing.
Fortunately some other parts of the world understood aircraft, aerodynamics, and safety principles.
(Also see recent changes in approach and landing speeds, realigning Boeing with ‘the world’)
“If we now have to start reemphasising that, we do have a VERY serious problem with pilot training.”
This is not so much to do with training as having to undo all of the previous misleading information and inappropriate procedures forced on the industry by the US / FAA / Boeing.
Fortunately some other parts of the world understood aircraft, aerodynamics, and safety principles.
(Also see recent changes in approach and landing speeds, realigning Boeing with ‘the world’)
In my old 737 FCTM, the first action in a stall recovery is to "apply maximum thrust". Really not a great idea at low speed with the pitch/power couple.
In my A320 FCTM, the first action in a stall recovery is to "immediately reduce AoA".
As said above, the training syllabus is to un-train the previous thinking which was all about "minimum height loss".
So we have been busy practising. You might want to direct your outrage at Boeing, and not at those of us still flying who know exactly how to recover a stalling aircraft.
In my A320 FCTM, the first action in a stall recovery is to "immediately reduce AoA".
As said above, the training syllabus is to un-train the previous thinking which was all about "minimum height loss".
So we have been busy practising. You might want to direct your outrage at Boeing, and not at those of us still flying who know exactly how to recover a stalling aircraft.
It seems to me that a better fix would be the following. If the stick shaker activates on either side, then the pilot or F/O should immediately de-activate the ADIRU on the side that the stick shaker is active, causing the ADIRU on the non-activated side to be used for both displays, the Flight Control Computer (FCC), and for the MCAS function
What if the ADIRU providing the stick shaker is correct, and the other is wrong?
If the AoA correctly reads a stall condition, then all is fine. Standard recovery with a dash of ND from the revised software.
But if the AoA (system) gets it wrong, then there needs to be a clear path to allow the pilots to somehow react to the stall warning, but then somehow recognise that it was false, and then somehow make sure that any augmentation nonsense doesn't make it worse.
Join Date: Apr 2014
Location: Minneapolis, MN
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
Please correct me if I am wrong, but if only one stick shaker is activated, then it must have been activated by the ADIRU that processes the AoA signal closest to stall. Each ADIRU only processes the AoA signal originating on the same side of the aircraft. Therefore, what your question asks cannot happen, especially if the single stick shaker remains activated.
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
Please correct me if I am wrong, but if only one stick shaker is activated, then it must have been activated by the ADIRU that processes the AoA signal closest to stall. Each ADIRU only processes the AoA signal originating on the same side of the aircraft. Therefore, what your question asks cannot happen, especially if the single stick shaker remains activated.
Oh, and the ADIRU doesn't activate the stick shaker, period - it's the SMYD.
Please correct me if I am wrong, but if only one stick shaker is activated, then it must have been activated by the ADIRU that processes the AoA signal closest to stall. Each ADIRU only processes the AoA signal originating on the same side of the aircraft. Therefore, what your question asks cannot happen, especially if the single stick shaker remains activated.
There have been a number of accidents and close calls because the pilots decided that what they were seeing on the instruments was wrong when it wasn't.
Join Date: Apr 2014
Location: Minneapolis, MN
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
AOA sensors can freeze (contaminated, iced in cruise) and therefore you can certainly have the bad one reading lower than the good one. Obviously you'd have to be spectacularly unlucky to then go and stall the aircraft on the way down after your AOA vane freezes in cruise - but that kind of spectacularly unlucky does happen, I can think of at least one crash as a result.
Oh, and the ADIRU doesn't activate the stick shaker, period - it's the SMYD.
Oh, and the ADIRU doesn't activate the stick shaker, period - it's the SMYD.
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
None of this is directly related to MCAS or the MAX, but these accidents have highlighted one major point. While AOA is not a primary flight parameter in a passenger aircraft under normal flight conditions, invalid data has a cascading effect on modern flight control systems.
In general there are active faults, which cause an immediate and irreversible reaction. There are also passive faults, whose absence is only noted when subsequent factors trigger failure. A single AOA failure is not immediately classified as active or passive, but depends on the flight regime, and the relative reading of the other AOA vane. Systems have to be designed to cater for both issues, and the fault-tree analysis may be very different for each pathway, and for each system.
Just my 2c.
Join Date: Jul 2009
Location: France
Age: 62
Posts: 98
Likes: 0
Received 0 Likes
on
0 Posts
@ FDR, thanks for a lot of sound information.
Two remarks:
First puzzle, MCAS authority was originally planned for 0.6° and after flight test blown up to a wopping 2.5° per input, which represents a quarter of the full stab range. If the control force isssue was minor, why such a huge authority?
Second puzzle, the original implementation seems to violate several of the regulatory references you provided (e.g. warning must be provided for failure, thing was not even mentioned in the Fcom). What else was ignored here?
Two remarks:
First puzzle, MCAS authority was originally planned for 0.6° and after flight test blown up to a wopping 2.5° per input, which represents a quarter of the full stab range. If the control force isssue was minor, why such a huge authority?
Second puzzle, the original implementation seems to violate several of the regulatory references you provided (e.g. warning must be provided for failure, thing was not even mentioned in the Fcom). What else was ignored here?
In my old 737 FCTM, the first action in a stall recovery is to "apply maximum thrust". Really not a great idea at low speed with the pitch/power couple.
In my A320 FCTM, the first action in a stall recovery is to "immediately reduce AoA".
As said above, the training syllabus is to un-train the previous thinking which was all about "minimum height loss".
So we have been busy practising. You might want to direct your outrage at Boeing, and not at those of us still flying who know exactly how to recover a stalling aircraft.
In my A320 FCTM, the first action in a stall recovery is to "immediately reduce AoA".
As said above, the training syllabus is to un-train the previous thinking which was all about "minimum height loss".
So we have been busy practising. You might want to direct your outrage at Boeing, and not at those of us still flying who know exactly how to recover a stalling aircraft.
So, you can add all the thrust available but if you dont reduce the A of A you will not unstall the wing !
Works every time, incuding on sailplanes which generally dont have thrust available.
Frankly, after a lifetime of flying jets and other aircraft the practice of applying thrust FIRST as a stall recovery technique Is BS. A wing stalls because the stalling A of A has been reached or exceeded., According to my RAF training and CFS experience as a QFI, and Boeing 737 training captain, ( and another 15,000 hours on jets) the essential , primary, technique is to reduce the A of A ( which caused the stall in the first place !,,,) and simultaneously add max power. And yes, the aim is to minimise height loss , obvioulsly. Simples, and yes I am aware of the veritical component of thrust on stall speeds but a wing stalls as function of A of A period. !!!
So, you can add all the thrust available but if you dont reduce the A of A you will not unstall the wing !
Works every time, incuding on sailplanes which generally dont have thrust available.
But on a jet, adding thrust will also change AoA by increasing speed which will change the angle of the airflow over the wings, will it not? I'm not advocating a thrust-only recovery approach, but surely you can do two things at once, lower the nose AND increase thrust? It's not a binary choice.
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
But on a jet, adding thrust will also change AoA by increasing speed which will change the angle of the airflow over the wings, will it not? I'm not advocating a thrust-only recovery approach, but surely you can do two things at once, lower the nose AND increase thrust? It's not a binary choice.
Join Date: May 2017
Location: San Diego
Posts: 66
Likes: 0
Received 0 Likes
on
0 Posts
MCAS is not a stall protection system. It is there to meet the requirements of 14 CFR 25.173 that the pull force on the control column should be linear with speed and AoA. With the Max the pull force gets lighter as the AoA gets close to stall but it is not a stall prevention device. Apparently, Boeing was more concerned about handling problems at high AoA in steep turns somewhere most pilots would not take a 73.
1. MCAS produces a nose-down moment.
2. MCAS is activated close to stalling AoA.
Conclusion: The objective is to improve yoke force gradients to avoid stall. It works with manual flight feel by countering the engine nacelle's pitch up moments at high AoA.
Getting back to Boeing's solution, the software fix proposed, the real subject of this thread: ----> Reports are that Boeing will compare the two AoA's and kill MCAS on a disagree. Also, I hope they kill MCAS when airspeed sensing is not working, since MCAS AoA activation thresholds are a function of airspeed and altitude.
One thing to know about the flight control system safety here is that any logic conditions and sensor dependencies to inhibit (turn off) MCAS doesn't have to worry anybody since flying without MCAS is not big problem, as rare as it is for input sensors to fail feeding the inhibit logic. Note this is not the same concept as feeding bad AoA vanes into the pitch down autotrim, because that is actuation, not inhibition, of the function.
Anybody have a detailed pseudo-code or logic block diagram of the old vs. new MCAS control laws?
Join Date: Nov 2018
Location: madrid
Posts: 47
Likes: 0
Received 0 Likes
on
0 Posts
MCAS will never help any pilot in real life. Too slow.
(For those who would like to see instead of visualize what "too slow" means, I posted a link here, guess it will not work, the youtube thing is called "Boeing 737NG horizontal stabilizer jackscrew cycle").
So as far as I'm conerned, they can include as many conditions as they want, the more the better. They could go ahead and disable it after the certification flight completely. It would be best. Any "help" that helps you "intermittently" is not a real help.
(For those who would like to see instead of visualize what "too slow" means, I posted a link here, guess it will not work, the youtube thing is called "Boeing 737NG horizontal stabilizer jackscrew cycle").
So as far as I'm conerned, they can include as many conditions as they want, the more the better. They could go ahead and disable it after the certification flight completely. It would be best. Any "help" that helps you "intermittently" is not a real help.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
It doesn't matter! Certification problem, certification solution. That is probably why Boeing probably had to change from the initial 0.6 to 2.5 degree pitch down limit. As long as it meets the "test" criteria, that is the certification solution. Would the MCAS reduce the risk of a genuine stall in the real world? Irrelevant, as long as there isn't additional training, it doesn't matter.
VW did EXACTLY the same thing for emissions certification for their diesel engines, again in software. You could almost imaging the code;
if DYNO_Detection=NO---> NonComplianceMode*.
*VW actually named the compliance cheat code "acoustic condition": A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats
VW did EXACTLY the same thing for emissions certification for their diesel engines, again in software. You could almost imaging the code;
if DYNO_Detection=NO---> NonComplianceMode*.
*VW actually named the compliance cheat code "acoustic condition": A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats
Once the researchers were able to study the code running on the faulty diesels, they discovered that Volkswagen’s defeat devices were far more nuanced than anything found previously. Levchenko told Eurekalert that the “Volkswagen defeat device is arguably the most complex in automotive history.”
The researchers found that the cars assumed they were being tested in a lab until a sensor reading ruled out a lab test. At that point, “the vehicle can switch to an operating regime favored by the manufacturer for real driving rather than the clean regime necessary to pass the emission test,” the research paper noted (PDF).
Earlier, more basic versions of the software checked for three conditions to decide whether a lab test was being conducted. But by 2009, some firmware versions included 10 different checks for a lab test. The cars checked for things like how long and how far the car had been driven (in the US, emissions cycle tests last no more than 31 minutes and the car drives exactly 11.04 miles). Some cars also may have conducted steering wheel checks—if the steering wheel deviated more than 20° from neutral position, it was probably not being tested in the lab.
As each check ruled a lab test in or out, a different function of the Engine Control Unit—like fuel injection timing, how exhaust gas is recirculated through the vehicle, and how much urea should be injected into the exhaust—could respond.
The researchers found that the cars assumed they were being tested in a lab until a sensor reading ruled out a lab test. At that point, “the vehicle can switch to an operating regime favored by the manufacturer for real driving rather than the clean regime necessary to pass the emission test,” the research paper noted (PDF).
Earlier, more basic versions of the software checked for three conditions to decide whether a lab test was being conducted. But by 2009, some firmware versions included 10 different checks for a lab test. The cars checked for things like how long and how far the car had been driven (in the US, emissions cycle tests last no more than 31 minutes and the car drives exactly 11.04 miles). Some cars also may have conducted steering wheel checks—if the steering wheel deviated more than 20° from neutral position, it was probably not being tested in the lab.
As each check ruled a lab test in or out, a different function of the Engine Control Unit—like fuel injection timing, how exhaust gas is recirculated through the vehicle, and how much urea should be injected into the exhaust—could respond.
@ FDR, thanks for a lot of sound information.
Two remarks:
First puzzle, MCAS authority was originally planned for 0.6° and after flight test blown up to a w[h]opping 2.5° per input, which represents a quarter of the full stab range. If the control force isssue was minor, why such a huge authority?
Second puzzle, the original implementation seems to violate several of the regulatory references you provided (e.g. warning must be provided for failure, thing was not even mentioned in the Fcom). What else was ignored here?
Two remarks:
First puzzle, MCAS authority was originally planned for 0.6° and after flight test blown up to a w[h]opping 2.5° per input, which represents a quarter of the full stab range. If the control force isssue was minor, why such a huge authority?
Second puzzle, the original implementation seems to violate several of the regulatory references you provided (e.g. warning must be provided for failure, thing was not even mentioned in the Fcom). What else was ignored here?
To your second question, there is going to be a fair bit of hand wringing within the ODA and the NAA on 25.672, that is probably going to be chatted about inside a court at some point.
Join Date: Jun 2006
Location: Brisbane
Posts: 265
Likes: 0
Received 0 Likes
on
0 Posts
The trouble is that the AoA issue presents itself to the aircraft in the form of a stick shaker (that is loud enough, in my experience, to mask the sound of the trim wheel) and indications on the PFD of a stall.
Training is now is emphasising:
Stall indication -> stall recovery.
The stall detection and airspeed/pitch correlation is wrong. Which to believe?
The violent noise of the stick shaker masks the insipid nose down trimming.
Any fix by Boeing needs to be tested so that the average pilot can cope, given the scenario above. Boeing just accounted for "the trim runs away", which is not the same as stall/recovery/speed confusion/stick shaker cacophony. Boeing have been focusing on making the input to MCAS more reliable, but they really need to address what happens when the input is wrong, and the pilots are presented with a false stall indication.
Training is now is emphasising:
- At the first indication of a stall..
- Reduce the AoA
Stall indication -> stall recovery.
The stall detection and airspeed/pitch correlation is wrong. Which to believe?
The violent noise of the stick shaker masks the insipid nose down trimming.
Any fix by Boeing needs to be tested so that the average pilot can cope, given the scenario above. Boeing just accounted for "the trim runs away", which is not the same as stall/recovery/speed confusion/stick shaker cacophony. Boeing have been focusing on making the input to MCAS more reliable, but they really need to address what happens when the input is wrong, and the pilots are presented with a false stall indication.
There has been very little discussion here on the subject of false stick shaker on rotation.
Lion Air had it on two flights. That we know.
Whilst we don’t yet know anything about Ethiopian, the initial flight profile looks to me like a pilot reaction to a false stick shaker - very slow/erratic climb and rapidly increasing airspeed. Assuming they took off with flaps extended, MCAS would not have contributed to the early part of this profile. The rapidly increasing airspeed may have led them to pull flaps up during the confusion, which may have then led to an MCAS activation.
Identifying false stick shaker on rotation has not formed part of any simulator training I have experienced.
No Stall Warning on Take-Off procedure on Boeings, no. On the Airbus it is pitch to 15°, select TOGA thrust. If some moments later you are still climbing then treat it as spurious. That’s the only current stall (indication) procedure that I can think of that involves thrust as a corrective measure.
The failed alpha yields an airspeed disagree as well as all the distractions and complications. The MCAS presents as a third unrelated failure just when you might be confused about elevator feel as a function of alpha, especially with the ELEV FEEL DIFF light illuminated.
The failed alpha yields an airspeed disagree as well as all the distractions and complications. The MCAS presents as a third unrelated failure just when you might be confused about elevator feel as a function of alpha, especially with the ELEV FEEL DIFF light illuminated.
Join Date: Jun 2009
Location: Paris, France
Age: 62
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
So according to the WSJ (paywalled, but regurgitated by Reuters) the pilots of ET302 applied the 2018-23-51 EAD to some degree, flipped the trim switches off, could not correct the nose down condition (or is it move the trim wheel nose up), then flipped the trim switches back on (contrary to the EAD), to no avail.
I ask (because I don't know):
- How hard it is to manually trim nose up, depending on airspeed, current elevator position, AoA..? I have read about an elevator blowback issue, but do not know the details.
- If standard simulator training prepares to that procedure, complete with simulation of how hard it is to turn the wheel. This is critical: If pilots are not well trained to trim up by manual action on the wheel, then mandating them to make it the only way to trim up was nonsense.
I ask (because I don't know):
- How hard it is to manually trim nose up, depending on airspeed, current elevator position, AoA..? I have read about an elevator blowback issue, but do not know the details.
- If standard simulator training prepares to that procedure, complete with simulation of how hard it is to turn the wheel. This is critical: If pilots are not well trained to trim up by manual action on the wheel, then mandating them to make it the only way to trim up was nonsense.
Last edited by fgrieu; 3rd Apr 2019 at 06:56. Reason: polish