Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

Old 22nd Feb 2019, 03:45
  #101 (permalink)  
 
Join Date: Dec 2001
Location: Brisvegas
Posts: 2,721
If the stab trim was off then the likliehood of an accident related to it falls massively. So if an accident occurs as a result of another issue it would be wrong to blame switching off the stab trim.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
Icarus2001 is offline  
Old 22nd Feb 2019, 05:02
  #102 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 574
Play the video below as you read the post.

The biggest issue faced by this and the other crews is trying to figure out what was going on. They had IAS disagree, stickshaker, and intermittent trim runaway only after flap retraction. This was NOT a classic runaway, the runaway did not follow the continuous expectation, it only began after a 5 second period from a manual trim input, then stopped as soon as the trim switch was moved for another 5 seconds. Try workshopping that combination with the published system knowledge that fails to mention that the MCAS even exists, in your second language reading the checklist(s) to figure out your pitch/thrust combination to isolate the failed system, all with this racket in the background.


If you gave this scenario's to 100 crews in the sim, I have no doubt less than 100 would end up turning off the stab trim cutout switches off. Some crews may never have even retracted to flaps to expose the MCAS activation. Unfortunately we won't ever be able to perform the experiment as most 737 MAX pilots are now likely acutely aware of the MCAS and the appropriate deactivation via the stab trim cutout.
CurtainTwitcher is online now  
Old 22nd Feb 2019, 06:44
  #103 (permalink)  
 
Join Date: Dec 2001
Location: Brisvegas
Posts: 2,721
This was NOT a classic runaway, the runaway did not follow the continuous expectation, it only began after a 5 second period from a manual trim input, then stopped as soon as the trim switch was moved for another 5 seconds.
I am sure the shaker and warnings were very distracting. Just as they were for the crew on the previous days flight who landed safely.

The basic point though is surely, the trim is running....I want it to stop.....I will turn it off Bloggs unless you have a better idea....... No it is not a classic sim failure, single problem, linear solution now move on to the next exercise. They had the aircraft more or less levelled off then lost control. Got tired or swapped PF?
Icarus2001 is offline  
Old 22nd Feb 2019, 10:17
  #104 (permalink)  
 
Join Date: Apr 2018
Location: Sudbury, Suffolk
Posts: 105
Originally Posted by Icarus2001 View Post
If the stab trim was off then the likliehood of an accident related to it falls massively. So if an accident occurs as a result of another issue it would be wrong to blame switching off the stab trim.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
Is it possible that this is EXACTLY what they did? I seem to recall that an engineer went up with them......
Maninthebar is offline  
Old 22nd Feb 2019, 11:54
  #105 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 10,653
Originally Posted by Maninthebar View Post
Is it possible that this is EXACTLY what they did? I seem to recall that an engineer went up with them......
The engineer, according to the airline, was simply a flying spanner whose presence was not connected with the problems that had been encountered with the aircraft.
DaveReidUK is offline  
Old 22nd Feb 2019, 15:07
  #106 (permalink)  
 
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,113
With regard to the somewhat semantic debate as to whether "stab runaway" applied or not, it might be good to not just look at the title of the procedure, but also at any additional information or training which helps define the condition.

For example, on a DIFFERENT aircraft the corresponding AFM procedure starts:
Stabilizer Trim Runaway
Indication:
  • Abnormal / uncommanded change in pitch attitude.
  • Stabilizer trim changes without pilot input.
  • Stabilizer trim changes not by system design (Mach trim, flap compensation, etc).
  • Higher or lower than normal and increasing or decreasing pitch control forces.
Thus, while the name of the procedure appears to be narrowly defined, the indications - the conditions under which you are expected to action, or at least consider actioning, the procedure - cover a range of scenarios - and I'll note include the "not by system design" case, so for the B737 STS case, if you know the motion is normal per design, you wouldn't do this procedure. If you don't know that, then it's a contender for "stab runaway"

I don't know if the corresponding B737 materials contain sufficiently similar wording for the comparison to be fully valid ...
Mad (Flt) Scientist is offline  
Old 22nd Feb 2019, 16:03
  #107 (permalink)  
 
Join Date: Jul 2013
Location: In a Pineapple Under the Sea
Age: 57
Posts: 93
Originally Posted by DaveReidUK View Post
The engineer, according to the airline, was simply a flying spanner whose presence was not connected with the problems that had been encountered with the aircraft.
Right now - it’s pure speculation either way. The airline cannot say whether the engineer was or was not on the flight deck when things went bad. The CVR will reveal whether he was there - right now it’s all speculation.
WillFlyForCheese is offline  
Old 22nd Feb 2019, 16:11
  #108 (permalink)  
 
Join Date: Jan 2002
Location: RWB, UK
Age: 72
Posts: 68
I don't have the 737 Max QRH but this is from the 737NG QRH. I'm guessing, since B kept quiet about the MCAS it would be the same!

"RUNAWAY STABILIZER

Condition: Continuing rotation of the stabilizer trim wheel in a manner not appropriate for the flight conditions."


Is 'continuing' the same as continuous which is how it was always presented in the sim? Are there differences in how these words are understood on each side of the Atlantic? I think both crews had previous NG experience, (reversion to past experience under stress?), but also remember English was not their first language.

I suppose the last part, "not appropriate etc", covers the intermittent trim wheel rotation but as suggested probably not all crews would have remembered that part of the conditions for applying the "Runaway Stabilizer" Non-Normal Checklist at the time.

1066
1066 is offline  
Old 22nd Feb 2019, 17:11
  #109 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 10,653
Originally Posted by WillFlyForCheese View Post
Right now - it’s pure speculation either way. The airline cannot say whether the engineer was or was not on the flight deck when things went bad. The CVR will reveal whether he was there - right now it’s all speculation.
Well yes and no. The presence of the engineer on the flight isn't speculation - the airline has confirmed that.

The reason why the engineer was on board isn't really speculation either, unless we're suggesting the airline might be lying about that.

Whether the engineer was on the jump seat and, if so, what part if any they played in the events, are the only unknowns. My money would be on none.

DaveReidUK is offline  
Old 22nd Feb 2019, 17:45
  #110 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 57
Posts: 164
Originally Posted by 1066 View Post
Is 'continuing' the same as continuous which is how it was always presented in the sim?
continuous = without a pause or interruption
continuing = that keeps happening, existing, or doing something
Luc Lion is offline  
Old 22nd Feb 2019, 20:47
  #111 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 76
Posts: 1,081
Salute!
Thank you Curtain..
OTOH some here sound like a defense lawyer being picky about the malfunction definition during the upcoming liability suits.
Sheesh.
Then Mad expresses the thots of many
Thus, while the name of the procedure appears to be narrowly defined, the indications - the conditions under which you are expected to action, or at least consider actioning, the procedure - cover a range of scenarios
So in a galaxy far away I had this malfunction that had no procedure, and only thing we had in our checklist was called "LEF Malfunction" ; So when I called in after getting heart rate below 150 or so, and altitude of 1,000 feet or so, still climbing ( speed may be life, but altitude is life insurance!), my squad "helper" said to "LOCK" flaps after gear down, as that was the only procedure at the time. I explained that I had a diferent problem. Was second guy with this, and first one over in an EPG country died trying to land but we didn't know the details, so for all practical purposes I was the first and I recorded the approach for a potential accident board ( it's in my interview on the public profile heref - crappy video conversion thru three formats )..
So here's what I saw just after raising the gear:

Surprise!
And here's the quote from our checklist and Dash One:
A [symmetric] LEF malfunction may be indicated by the LE FLAPS caution light. This indicates that one or both of the LEF branches have malfunctioned. LEF may stop and remain fixed in position when the malfunction occurs. An LE FLAPS caution light may also indicate that an asymmetry was detected and the asymmetry brakes have locked the LEF's. LEF's
should remain symmetrical (within 10 degrees).
The assymetric flap procedure was added after my episode

The most likely cause of an asymmetric LEF malfunction is a mechanical disconnect in one of the LEF drive trains accompanied by a failure of the asymmetry brake(which is what happened). This failure may not illuminate the LE FLAPS caution light . The first indication of an asymmetry is an uncommanded roll. The failed LEF may be as much as 90 degrees up or down.
Let the picture speak to that.

So the cardinal rule applied, and I followed it. Fly the damned plane, then call for help when you can. Don't change anything if you are not wildly out of control. Do not troubleshoot unless the procedure calls for it AND the original problem is mitigated, otherwise do what the previous 610 crew did and accept the horn/shaker/whatever and fly with manual trim wheel.

I still maintain:
Boeing needed to 1) tell all the users about the MCAS system, 2) change the emergency procedures for ALL perceived trim malfunctions as Mad has shown for brand-x to have the crew simply tiurn off the electric trim and then proceed, maybe with more steps if required, and 3) conduct a better fault tree analysis before fielding this lates kludge

Gums sends...

Last edited by gums; 23rd Feb 2019 at 00:55. Reason: font correction
gums is offline  
Old 22nd Feb 2019, 21:24
  #112 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 57
Posts: 164
What was the first sign of malfunction, Gums ? A brutal right roll? What left roll authority did you still have? What approach speed did you choose?
Luc Lion is offline  
Old 22nd Feb 2019, 22:45
  #113 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 76
Posts: 1,081
Salute Lion!

First clue was roll, but I thot jet wash from preceding Viper. Control pressure on that gal is light, but it was later determined Ihad about 14 or 15 pounds( max control pressure available was about 16 or 17 pounds, so I was close to losing it). Then the vibration/buffet became very obvious and I glanced left, then right.

I kept speed where it was when I realized the flap had folded up, as I was doing O.K. and kept on keeping on.

Now back to undocumented malfunctions, but mine was a first for USAF and second overall. Least we figured out how to land the thing.

Gums sends...

BTW Lion, I think the loss was a fellow countryman of yours, and I got details much later from F-16.net moderators. So the fact that I did not try to "flare" save me and the jet.

.
gums is offline  
Old 23rd Feb 2019, 03:34
  #114 (permalink)  
fdr
 
Join Date: Jun 2001
Location: 3rd Rock, #29B
Posts: 663
Intermittent v Continuous

MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
fdr is offline  
Old 23rd Feb 2019, 05:19
  #115 (permalink)  
 
Join Date: Dec 2018
Location: Dundee
Posts: 125
Originally Posted by fdr View Post
Intermittent v Continuous

MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
Let's just stick to the facts.
weemonkey is offline  
Old 23rd Feb 2019, 15:39
  #116 (permalink)  
 
Join Date: Mar 2006
Location: England
Posts: 835
I had not appreciated the extent of the changes in the MAX Magazine - ALPA

I wonder what other ‘unknown’ system quirks there might be. A ‘fly-by-wire’ spoiler, electrically signalled or computed logic? Landing and emergency descent.

Improved safety appears to be optional; the modifications relate to accidents in each category, but in order to aid the crew you have to pay for the addition. I cannot see that an unstable approach warrants an ‘overrun’ warning; speed / height alert possibly.

Somewhat embarrassing for ALPA in that their pilots apparently did not ‘discover’ MCAS during their lengthy - Boeing paid for, evaluation. This further questions the viability of a computerised differences course and minimum FCOM change.


PEI_3721 is offline  
Old 12th Mar 2019, 11:48
  #117 (permalink)  
 
Join Date: May 2006
Location: Genf
Age: 53
Posts: 13
Voting and triple systems

Originally Posted by RatherBeFlying View Post
The 747 came out with triple INS. In case of disagreement, the odd one was voted out.

With the criticality of MCAS, it seems a strong candidate for triple sensors and a voting algorithm.
Voting is not always the best solution. Try to block 2 pitots tubes on 2 ADMs at FL290 (at night) on the Triple and perform a descend for landing and land.
Houba is offline  
Old 12th Mar 2019, 14:29
  #118 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 10,653
Originally Posted by Houba View Post
Voting is not always the best solution. Try to block 2 pitots tubes on 2 ADMs at FL290 (at night) on the Triple and perform a descend for landing and land.
Triplexed systems have been around for 50+ years. How many times in that period has a good input been outvoted by two bad ones ?
DaveReidUK is offline  
Old 12th Mar 2019, 14:35
  #119 (permalink)  
 
Join Date: Mar 2019
Location: West Wales
Posts: 1
INS versus AoA and software updates

Originally Posted by Houba View Post
Voting is not always the best solution. Try to block 2 pitots tubes on 2 ADMs at FL290 (at night) on the Triple and perform a descend for landing and land.
I am new to PPRuNe forgive me I dont know how to simply add a comment so I've hit reply to yours, here's my pound or kilo of flesh:-

Basically the MCAS trim override system is a partial “FbW” system. We all know why it was implemented, so I don’t need to discuss its merits/functionality here or the unsettling fact that its bad behaviour was actually notified last year after the Lion Air incident. No one outside of Boeing or whoever is in accident investigations has seen the recorder data sets and heard the recently recovered CVR of that accident. That will remain confidential for ever.

I personally doubt (working in military electronics) whether the latest incident’s recorders would have survived a “direct in” at that terminal velocity. However, this seems to me to be a truly software-related problem. Yes, I know that setting various switches, is supposed to reset or kill a “loop” in the “code” however, in the good old days switches used to get connected to servo actuators by things called “wires” using stuff called “current”. Now each switch (however WW2 clunky) is read into a data set packet and sent along the Manchester bus data-highway of the revised and “simplified” cockpit systems into the various CPUs. Frantically pulling fuses out won’t help. So, ignoring the input side of the AoA sensors on the wings, there is a possibility that the software version now being hastily rolled out, (I’m not sure how the FCS/CPUS is updated, could even be over a USB stick) may indeed have the “corporate cover-up code” required to eliminate the “problem”. (i.e, if the loop executes say, more than 5 times, - it’s probably a sensor failure not a “pilot error”).

If any system which is designed to take a manual input before it re-enters its loops, does NOT read or ignores fresh inputs from switches - then there is also a risk that the “naughty” algorithm will continue to re-execute, despite the operators putting their big feet on the glass displays and yanking back with such enormous force as to bend the panel. In any event, there won’t be any real feedback or pitch reaction by the kite, if the control column is only “connected” to the air-surfaces by dumb electronics and computers. I doubt whether anyone has actually tried to see if the system does indeed go into an unrecoverable loop at FL 35 over the pond while delivering a new freshly painted bus to a punter. After these two incidents, I wouldn’t want to try, unless the hatch was open and I had a parachute - as I’m too fat to squeeze thru the DV window.

This brings me onto point 2).- “Sanity” Displays.
Each aircraft has 1-3 INS systems. They look at 6 DOF (six degrees of freedom, P,Y,R, and Surge Heave and Sway as Noah would say) and they are fully capable of measurements to high orders of angular and rate accuracy. They know exactly what the “vectorial” behaviour of the airframe is at any instant. The strapped down INS actually contains low-drift North-seeking Ring [email protected] gyroscopes, and 6 very sensitive accelerometers, probably all Honeywell types same as used in TLAAMs. The basic function of it can act as a really high-accuracy vertical reference unit. (remember those?). It can output the true measured “3D” motions of the a/c its - accelerations, pitch angles, rates and an earth-centred attitude reference. Remember - half the battle of flying is defying gravity. So as an engineer, my question is - why rely wholly on attitude sensors that Noah used to trim his boat in a gale? They are subject to bugs (insects), cleaners, de-icers, icing, birdstrikes, electronic failures, corrosion, static from lightning, poor calibration etc etc. The real method of display of an aircraft’s true attitude should, in my opinion, be derived from the “VRU” aspects of the INS and combined/checked against any external physical sensors. A failure warning “disagree” page should be available on the glass display, warning the pilot (by red/green overlaid lines etc) that what’s being “dealt with” is NOT the true attitude of the a/c in motion or its approach to/from instability. Just a thought. I’ve banned my whole family and staff from ever flying on the MAXes for the foreseeable future and I extend my heartfelt sympathies to those affected by this, IMHO, totally avoidable “modern” tragedy.
PaulWynter is offline  
Old 12th Mar 2019, 15:30
  #120 (permalink)  
 
Join Date: Apr 2014
Location: Korea
Posts: 59
Excepting again tests in which the situation got provoked (XL888).
Euclideanplane is offline  

Thread Tools
Search this Thread

Contact Us Archive Advertising Cookie Policy Privacy Statement Terms of Service

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.