Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed

[AAKEE]

Originally Posted by 737 Driver

The flap position monitoring is a function of the Flap Slate Electronic Unit, so my guess is that the FSEU would send a signal to MCAS (which is a subroutine of the FCC) regarding flap position. There are one or more digital data busses which allow the various electronic components to exchange information, so I figure this would be the easier option than running a dedicated sensor to the flap handle. Reference the DFDR data from ET302 mentioned in the post immediately prior, there could be some threshold value beyond which the flaps are presumed up (i.e. < 0.2 degrees, slats retracted, etc.).

But FDR data is quite clear that it starts automatic long trim down after flap handle is up but before the flap is seated. This is also clear from the ET302 description in the history of flight:

At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.
At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested and the aircraft descended slightly.
At 05:40:06, left and right flap position reached a recorded value of 0.019 degrees which remained until the end of the recording.

[737 Driver]

I would advise some caution about putting the initial DFDR traces under too much magnification. There has been some previous discussion about exactly how the data is recorded, where it is picked up, and how it is filtered. This might effect some of the timing issues if you are trying to parse cause and effect down to the seconds. I'm not saying you're wrong, but the investigation team will have the experts on hand to answer those kind of questions definitively.

One more thought..... The lowest flap setting on the 737 is Flaps 1. The significant configuration change going from Flaps 1 to Flaps Up is not the Trailing Edge (TE) Flaps going from 1 to 0. The significant change is the Leading Edge (LE) Flaps and the Slats retracting. The DFDR data released to date provides no information on the position of the leading edge devices. It is entirely possible that the signal for retracted flaps is tied to the LE devices, and not the TE Flaps. Again, don't know personally, but someone on the investigation team does.

[megan]

The link makes the statement,

the system (MCAS) is only needed to enhance stability with slats and flaps retracted at very light weights and full aft center of gravity (CG). The aircraft exhibits sufficient natural longitudinal stability in all other parts of the flight envelope without the MCAS to meet the rules

One wonders if there are other inputs other than AoA, weight and CoG from the FMS, if that's possible.

How often would a crew see full aft CoG and be very light weight?

https://aviationweek.com/commercial-...432ab9ddf59858

[737 Driver]

Originally Posted by megan

How often would a crew see full aft CoG and be very light weight?

A lightly-loaded aircraft or reposition ferry. Just did one the other day, and the c.g. was significantly more aft.

Also, in some cases the forward cargo bin cannot be used because of some MEL restriction, so all the bags and cargo go aft.

[Bend alot]

"the system (MCAS) is only needed to enhance stability with slats and flaps retracted at very light weights and full aft center of gravity (CG). The aircraft exhibits sufficient natural longitudinal stability in all other parts of the flight envelope without the MCAS to meet the rules"

My understanding was it also was only "needed" at low speeds and a high AoA!

Interesting that the statement says "and full aft C of G" and not just an aft C of G.

The new "fix" seems to be anything happens and MCAS will shut down, even an accidental blip of the trim switch.

So therefore after any, of the many possible events MCAS will not work and the aircraft will not have sufficient natural longitudinal stability.

So now in the cheese mix, we are slow (without lift devices of slats and flaps), a high AoA, light (move manoeuvrable) and an aft C of G. MCAS kicks in, as the nacelles are about to supply more pitch up effect - a fraction of a second later the pilot knocks the trim switch and MCAS disengages - a slight extra back pressure now and the holes are all there as we have "insufficient longitudinal stability".

I think that due to the heat in the kitchen caused by the crashes and the stubbornness to exclude the fact training both on (system and flight characteristics) is required this "safety back up system" will basically be removed by being shut down when you actually need it. MCAS should be there to help when there are all ready a few pieces of cheese on the plate such as a high AoA with a aft C of G - not the time for the control column to become a feather.

[Loose rivets]

737 Driver and others

The problem with that line of reasoning is that MCAS doesn’t activate with flaps extended. If the Capt was that concerned about MCAS, all he needed to do was leave any amount of flaps out and deal with the AOA failure/Airspeed Unreliable NNC.

When I tried to get into the psychology of those fearful moments, I postulated imagery flashing into the mind of the ET PF of this new system he'd learned about. Yes, the flaps would have been a godsend. He could even have subconsciously sought the comfort of automatic flight while he tried to get those chaotic thoughts into some sort of order, so I wouldn't be surprised if a major aid was simply a blanc.

The main point of my comment was the shock factor being made worse by knowing about the first crash - the sheer sense of unreality could well cause gaps in an almost nightmarish recollection of the news.

[Smythe]

Rather that software algorithms, has AB gone the route of additional sensors? Dynamic Pitot, sideslip, 4 AoA...

[GordonR_Cape]

Originally Posted by Smythe

Rather that software algorithms, has AB gone the route of additional sensors? Dynamic Pitot, sideslip, 4 AoA...

Thanks for re-posting the image (I saw it somewhere way back in a thread), which makes a lot more sense in the light of recent discussions. Clearly the A350 sensors are very different from the B737, but they probably require even more software algorithms to benefit from all the information!

A simple (2 out of 3) voting system can eliminate a single point failure, but detecting dual sensor failure (airspeed on AF447) would require computed values from the ADIRU (based on all the other types of sensors). A complex cross check against pitch from internal gyro sensors, would allow the complete state of the aircraft to be determined, and the faulty AOA data to be isolated.

Some "simplistic" calls on social media asked why the B737 AOA data can't just be compared against internal pitch information? The answer is that you need a whole A350 suite of sensors, plus a suite of redundant flight data computers, in order to make a valid comparison at all stages of the flight envelope.

[infrequentflyer789]

Originally Posted by megan

The link makes the statement,

the system (MCAS) is only needed to enhance stability with slats and flaps retracted at very light weights

One wonders if there are other inputs other than AoA, weight and CoG from the FMS, if that's possible.

Either the link doesn't know what it's talking about or MCAS is even more broken than we think. There is no way I can see that ET302 could be meet a trigger condition of "very light weights", yet MCAS kicked in.

[Loose rivets]

Following Bend alot's post I said, his "naked statement says so much."

The Quote was:

Keeping in mind, no other breed of the 737 would have put a nose down input to the stabiliser.

B1lanc #718

So, has there ever been a documented case of runaway stab on any vintage of 737?

I don't think it matters. The issue is, the need to train for the possibility because the MAX is utterly different in this respect. A piece of software has control of the most powerful flying control surface and no one was told.

[b1lanc]

Originally Posted by Loose rivets

B1lanc #718


I don't think it matters. The issue is, the need to train for the possibility because the MAX is utterly different in this respect. A piece of software has control of the most powerful flying control surface and no one was told.

No disagreeing with you at all - major and multiple screw-ups by Boeing. But the memory items for runaway stab have existed for a long time and I'm curious why.

[MurphyWasRight]

Originally Posted by RickNRoll

Boeing would have been better off telling pilots to implement UAS procedure rather than runaway trim. If the flaps never go all the way up then MCAS can never be activated and the plane is kept below MCAS activation height. Boeing would have known all this after the first crash.

That assumes that an AoA failure occurs before flap retraction, a latent fault could show itself at any point although takeoff (ET) is the most likely.
Bird strike also a possibility for a significant window after takeoff.

Intermittent wiring or other faults can also happen at any point, some possibility this was a factor in Lion Air, mysterious 20 degree offset after replacing suspect AoA sensor but no proof at this point.

[hans brinker]

Originally Posted by infrequentflyer789

Either the link doesn't know what it's talking about or MCAS is even more broken than we think. There is no way I can see that ET302 could be meet a trigger condition of "very light weights", yet MCAS kicked in.

That is because MCAS kicked in because of incorrect AOA information. AFAIK there is no mechanism that disables MCAS if the aircraft isn't light & aft CG, so MCAS is "armed" whenever the flaps are up and the AP is off, and will rely on one AOA to get up and running.

[Smythe]

Gordon,

Concur. Yes, you will still need algorthims, if nothing else, for all of the latencies in the system. Looking at the multitude of sensors, they do provide the actual data that is provided solely by algorithms on other aircraft. Dynamic pitot tubes to get accurate windspeed with pitch and turns or vertical winds. Sideslip indicators rather than algortithms for crosswinds.

A complex cross check against pitch from internal gyro sensors, would allow the complete state of the aircraft to be determined, and the faulty AOA data to be isolated.

From what I read, the MCAS on the 767 tanker does have the option to compare AoA sensors and the internal gyros.

[Dee Vee]

Originally Posted by Smythe

From what I read, the MCAS on the 767 tanker does have the option to compare AoA sensors and the internal gyros.

I've been wondering about that for a while, Is there any benefit of the AoA sensors over gyros anyway, surely the latter would be more accurate and foolproof??

[aterpster]

Originally Posted by Dee Vee

I've been wondering about that for a while, Is there any benefit of the AoA sensors over gyros anyway, surely the latter would be more accurate and foolproof??

What would gyros do in this sense?

[safetypee]

Why AoA

The chosen activating parameter for MCAS is AoA.
This probably makes good aerodynamic sense, but if the stability deficiency relates to airspeed - trim speed stability, stick force, then there should have been the alternative of using (dual cross-monitored) airspeed. Similar, but not the same issue, as STS.

Does the use of AoA ‘hide’ some other aspect; or is the range of trigger speeds / Mach, and combination with wt/cg best managed with AoA?

[ReturningVector]

Originally Posted by Dee Vee

I've been wondering about that for a while, Is there any benefit of the AoA sensors over gyros anyway, surely the latter would be more accurate and foolproof??

AoA is relative to the airflow, you cannot measure that with gyros.

[slacktide]

Originally Posted by Loose rivets

I don't think it matters. The issue is, the need to train for the possibility because the MAX is utterly different in this respect. A piece of software has control of the most powerful flying control surface and no one was told.

Utterly different? Disagree. On the 737 NG, there is also a piece of software also has control of the most powerful flying control surface. That piece of software is called STS. In fact based on statements in the most recent draft FAA FSB report on the MAX, MCAS is a sub-functionalty of STS. (Bottom of page 8) https://www.faa.gov/aircraft/draft_d...ev17_draft.pdf

On the NG, it is possible for the STS to fail in a way that causes undesired intermittent runaway trim, just like it is possible for MCAS to fail in a way that causes undesired intermittent runaway trim. Clearly, due to the reliance on a single unchecked AOA value, the demonstrated failure rate has been orders of magnitude greater on the MAX. But the scenario of intermittent runaway trim is still possible on NG.

[Smythe]

AoA is relative to the airflow, you cannot measure that with gyros.

Actually, yes, you can, and the 767 tanker does compare the AoA vane with the gyros. Most unmanned ac do not have AoA vanes, and rely on the inertial system.

Interesting paper showing the results of using different algorithms to estimate AoA

http://www.tc.faa.gov/its/worldpac/techrpt/tc16-52.pdf

Always amused by the CAT designations...from the draft FSB
Aircraft Category
B-737 C
B-737-CL C
B-737-600/700 C (even a 700 at CAT C is a struggle)
B-737-800/900/900ER C or D (CAT C?)
B-737-MAX C or D (CAT C?)