MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

[SLF3]

https://www.bbc.co.uk/news/business-48752932

Quote:

In a tweet, the FAA said: "On the most recent issue, the FAA's process is designed to discover and highlight potential risks. The FAA recently found a potential risk that Boeing must mitigate."

A source familiar with the situation told the BBC: ""During simulator testing last week at Boeing, FAA test pilots discovered an issue that affected their ability to quickly and easily follow the required recovery procedures for runaway stabiliser trim (ie, to stop stabilisers on the aircraft's tail moving uncontrollably).

"The issue was traced to how data is being processed by the flight computer."

Unquote.

So did Boeing not know, or were they hoping the FAA would not notice, or were they in 'lets run this by the FAA and see how they react' mode? The issues must be fundamental and intractable if after eight months work they are still struggling to find a fix. Or are they in denial, trying to push through a software modification when some more fundamental physical change is required? It won't be easy to compromise with the regulator under scrutiny and other regulators looking over their shoulder.

[averow]

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

[Peter H]

Originally Posted by averow

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time befThe deliberately broken microprocessor had become overwhelmed with data from the flight control systemore this plane flies again in commercial service.

Nice find. I'm still having problems interpreting things though, any ideas on:
The deliberately broken microprocessor had become overwhelmed with data from the flight control system.
- If its "broken", how is it still working.
- If its "crippled" by how much.
- Or is it "restarting" after some sort of interrupt/reboot.
- Finally is the "overload" a transient effect, or the new status quo.

Peter

[GordonR_Cape]

Originally Posted by averow

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

Thanks for the excellent link!

Testing was part of my former life. Intentionally 'breaking' software is what that should involve, which was obviously was not done properly...

[ARealTimTuffy]

The way I have read most of the reporting is that the processing issue has shown up as a result of the software update for the Mcas. It seems to imply it wasn’t there with the original mcas.

But, maybe my interpretation or the reporting is incorrect.

[Ind]

Originally Posted by averow

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified. IMHO it may be a long time before this plane flies again in commercial service.

Interestingly, it refers to a different scenario, to what has been discussed here before "The deliberately broken microprocessor...". This was to simulate a hardware fault in the microprocessor unit (not specified?), which resulted in a slow system response to the pilot's action during runaway stabiliser recovery checklist. Test pilot had difficulty to correct ND input from stabiliser. This was not related to MCAS and faulty AOA sensor activation per se, but highlights another fault scenario in which 737-MAX aircraft's flight control response is deemed "chatestrophical" by FAA. The solution Boeing wants to implement is to re-route data to different processor units.. The end of summer RTS is indeed doubtful now, as it might promt evaulaution of another possible fault scenarios, which might be either misclassified or not properly assessed.

[Speed of Sound]

Originally Posted by averow

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com .

The article suggests that Boeing’s software fix for this latest problem will be to share the load over a number of processors rather rewrite the code for the current dedicated microprocessor. This approach will inevitably prolong the certification process as the testing will have to be much more rigorous (and therefore time consuming) to ensure that the problem of processing overload is not pushed down the road into another part of the system.

The risk with that approach is that it may throw up further problems. If trim response is delayed by seconds rather than milli or microseconds, that suggests that there’s not a great deal of headroom in parts of the system.

It may not be just the 737 airframe which has been repeatedly modified beyond its useful life. 😵

[yoko1]

Originally Posted by averow

Journalist Jon Ostrower ( @jonostrower) on Twitter has discussed this issue in an article on his website www.theaircurrent.com . Some good, detailed reporting on how this latest issue was identified.

Good article with the usual caveat that we hope he is getting accurate information from his sources. It is always a bit frustrating to watch the story "evolve" by the day. So accordingly to Ostrower, a test was set up to generate an intentional failure of a microprocessor in the FCC to see what would happen, and this particular failure was not related to MCAS. I would be helpful to know exactly what this microprocessor was supposed to be doing.

Latest update from AW&ST:

​​​​​​

MAX Fixes Will Take Until At Least September, Boeing Says

Sean Broderick | Aviation Daily June 27, 2019

WASHINGTON—Boeingwill need at least until September to address a new flight control computer (FCC) issue and wrap up changes needed to get the fleet flying again, Aviation Week has learned.

The issue came to light during engineering simulator tests with FAAtest pilots during the week of June 17. During a runway horizontal stabilizer troubleshooting procedure, FAA determined that line pilots would need more time to correctly diagnose the failure and execute the appropriate checklist. The tests also showed that a computer chip malfunction could lead to uncommanded stabilizer movement during the emergency procedure. FAA told Boeing to address the issues, and the manufacturer is complying.

“We are working through the software update and the potential implications for the timeline for the safe return to service of the 737 MAX fleet and resuming MAX deliveries,” a Boeing executive told Aviation Week. “Our current assessment is we will submit our final certification package to the FAA in the September timeframe.”

Boeing is confident that the latest issues can be addressed with software changes. The alternative—replacing computer chips on more than 500 MAXs—could prolong a worldwide grounding that started in mid-March.

Boeing is modifying specific FCC software linked to two 737 MAX accident sequences within five months. The second accident, the Mar. 10 crash of Ethiopian Airlines Flight 302, triggered the global grounding.

The software changes focus on the MAX’s maneuvering characteristics augmentation system (MCAS), which helps the MAX mimic the flight characteristic of its 737 Next Generation predecessor in certain scenarios. The latest FCC issue is not believed to be linked to the proposed MCAS changes.

[yoko1]

Originally Posted by BDAttitude

I think not correct.
INTLK coming from the right side is a sensing channel activated upon switching K2 by applying 14V+ to A/P TRIM SPEED HIGH.

You can probably clarify this by posting wiring diagram 22-13-11.

Indeed ... it could explain some weird things however.

.

I wish I had all the wiring diagrams, but unfortunately this was the only other one I could find online. You would think more would be out there with all the interest. Like I said, not an expert reading these things anyway. However, I don't see anything that would block the Main Electric Trim signal from getting all the way to the trim motor controller, so I'm still curious what happens if the controller is getting signals from both the Main Electric side and one of the automatic sources (Speed Trim, MCAS, Mach Trim).

[Alchad]

Originally Posted by Peter H

Nice find. I'm still having problems interpreting things though, any ideas on:
The deliberately broken microprocessor had become overwhelmed with data from the flight control system.
- If its "broken", how is it still working.
- If its "crippled" by how much.
- Or is it "restarting" after some sort of interrupt/reboot.
- Finally is the "overload" a transient effect, or the new status quo.

Peter

I'm with you. I think "breaking" is the wrong word, sounds more likely that it was overloaded (or overwhelmed as you say) and just went on a "go slow" rather than turned up it's toes and failed permanently.

Alchad

[gearlever]

A retired BA pilot analyses the probable causes

[Standby Scum]

You Tube

[ARealTimTuffy]

Originally Posted by gearlever

A retired BA pilot analyses the probable causes

There is a lot of misinformation in that article/blog. Some good stuff too.

[gums]

Salute!

The pilot analysis seemed fair to this old greybeard, especially the whine about not letting the pilots know about a new and significant system ( only when it goes rougue),

I cannot help but wonder how many $$$ Boeing saved or the carriers saved by not having some sim time training that demonstrated a rogue MCAS high alt or just after takeoff. They are all surely paying now, ya think?

I also do not unnerstan the bang-bang implementation versus a smooth stab input according to AoA. No need for a new computer, as a 1970's op amp (analog) could easily provide the control signals. Not everything with a "chip" is digital, with clock speeds, mux-bus protocols to deal with other systems, RAM and so forth.

For all who do not realize, but the original Viper quad redundant computers were no-kidding analog doofers with op-amps and both D-to-A and reverse chips and then voltage commands to the servo actuators.We had no internal clock speeds or delays. The chips worked literally at the speed of light thru the wires. We did not go fully digital for about 20 years
.
Gums sends...

[yoko1]

From Bloomberg:

Aircraft Regulators Will Join Forces to Restore Boeing 737 Max to Service

[Speed of Sound]

Originally Posted by yoko1

Aircraft Regulators Will Join Forces to Restore Boeing 737 Max to Service

The only possible stalling point, according to that article, is that EASA favours a 3-AoA sensor input to the system which would obviously delay things further.

[tdracer]

Originally Posted by FlightCosting

from my experience in obtaining aircraft certification there is a big difference between FAA and EASA attitudes. In the US Boeing and politicians hold much greater influence over the certification process ( Boeing self certification) than in Europe where the authorities always take a much harder stance in front of the manufacturer.

In short, it depends. Both EASA and the FAA had their strengths and weaknesses. In both cases, there was a tendency to 'miss the forest for the trees' - that is to become obsessed with one small aspect of the system while missing what the total system did and it's relationship to other systems and the aircraft as a whole - although at least in my experience EASA was a little less prone to this than the FAA. EASA obviously would focus on areas where the CS differed from the corresponding FAR (the list of 'significant regulatory differences' was agreed to and documented in a CRI - Certification Review Item). Both the FAA and EASA would identify areas of the design where they wanted to focus and document those - Issue Papers for the FAA, CRI's for EASA. CRI's were often, but not always, associated with the regulatory differences. One rather annoying aspect of EASA is they sometimes tried to dictate design, rather than determine if the existing design complied with the regulations. Sounds like they might be doing that again with the 2 vs. 3 AOA sensors.

I'm not surprised the FAA is working directly with EASA on resolving the grounding and returning the MAX to service - it's what I expected. EASA and the FAA always worked together (although not always real well) - and it was pretty common for an FAA person to attend the meetings we had with EASA.

[Longtimer]

Boeing 737 Max likely grounded until the end of the year after new problem emerges

Published 41 min agoUpdated 34 min ago

Elijah Shama

Key Points

• Boeing’s 737 Max could be grounded until late this year according to a Boeing official.
• U.S. air-safety regulators reportedly flagged a problem with the plane’s in-flight control chip.
• Over 500 of the aircraft manufacturer’s 737 Max planes have been grounded since mid-March.

Stephen Brashear Getty Images

Boeing’s 737 Max could stay on the ground until late this year after a new problem emerged with the plane’s in-flight control chip, according to a Boeing official.

This latest holdup in the plane’s troubled re-certification process has to do with a chip failure that can cause uncommanded movement of a panel on the aircraft’s tail, pointing the plane’s nose downwards, the official said, asking not to be identified because the company hasn’t publicly disclosed it yet. Subsequent emergency tests to fix the issue showed it took pilots longer than expected to solve the problem according to The Wall Street Journal. This marks a new problem with the plane unrelated to the issues Boeing is already facing with the plane’s MCAS automated flight control system. An issue the company maintains can be remedied by a software fix. Boeing hopes to submit all of its fixes to the Federal Aviation Administration this fall, the Boeing official said.

“We’re expecting a September time frame for a full software package to fix both MCAS and this new issue” the official said. “We believe additional items will be remedied by a software fix.”

Once that software package is submitted, it will likely take at least another two months before the planes are flying again. The FAA will need time to re-certify the planes; Boeing will also need to reach agreement with airlines and pilots unions on how much extra training pilots will need. The airlines will also need some time to complete necessary maintenance checks.

FAA spokesman Lynn Lunsford declined to comment on a specific timeline for the plane’s re-certification, saying “we have steadfastly stayed away from offering any timelines.”

The global Max fleet was grounded in mid-March following two fatal crashes a malfunction of the plane’s automated flight-control system, called MCAS, was implicated. The crashes killed 346 people combined.

[yoko1]

Originally Posted by BDAttitude

I think not correct.
INTLK coming from the right side is a sensing channel activated upon switching K2 by applying 14V+ to A/P TRIM SPEED HIGH.

You can probably clarify this by posting wiring diagram 22-13-11.

Been digging around and I've had some luck. I've gotten a hold of schematic 22-13-11 to fill in some detail. I tried taking a full size snapshot, but it gets too fuzzy to read when I zoom out. I think I can post the relevant parts though.

First I'll repost the original schematic:
.
.

Schematic 27-41-11
.
.

The bold line dark box on the right represents the entire stab trim motor and associated controllers. I'm told this is a one piece unit. Zoomed in:
.


Trim motor detail
.
.
The "INTLK" in and out in this diagram are actually related to the autopilot speed selection. The MAIN ELECT TRIM INTLK function is a signal from the MAIN TRIM ARM RELAY directly to each of the FCC's. Here is the relevant detail from schematic 22-13-11:
.
.


Main Trim Arm Relay to FCC detail
.
.
This diagram has a reference to another schematic 22-11-11 for the FCC, but I've had a peek at that one and it doesn't provide any clarity as to what happens to the MAIN ELEC TRIM INTLK signal.

The other detail from 22-13-11 that corresponds to the lines coming out the right side of 27-41-11 is here:
.
.


Automatic Trim Input Detail
.
.
Unfortunately, all of this detail still does not tell us what happens if the FCC does not correctly process the MAIN ELEC TRIM INTLK signal.

Both the Main and Automatic trim signals are sent to the stab trim motor Controller. I could find no information regarding this component, which again, I am told is housed within the motor assembly itself. The motor is made by Eaton and is similar to the one on the 737NG. If a malfunction in the FCC allows simultaneous signals from the Automatic and Main Electric trim to arrive at the Controller, then that might explain the reported test results - just speculating here.

Again, this should be caveated that the tests involved the new FCC software and do not necessarily reflect conditions on the accident aircraft.

[billybone]

RE More than one AOA sensor- found and interesting comparison method as used on 787 and ? 777 by using the Inerital system ( GPS etc ) basically igt seems to provide a sensor independent check on several normal flight sensors like pitot tubes etc. Granted 777 and 787 are more closer to FBW, but still retain some backup. 787 calls it the Common Mode

Source can be found by searching on

Introducing the 787
Tom Dodt

Chief Engineer - Air safety Investigation
ISASI september 2011
Pages 39 thru 41

Common Mode Hazards to Pitot-Static sensors
- Mud Daubers
- Icing - Hail - Birds - Taped Static Ports
- Volcanic Ash
- Radome failure
- Pitot covers
- Maintenance errors (pneumatic plumbing)
• 787 new capabilities for protection - Synthetic airspeed
- GPS altitude - Common Mode Monitor

Calculated from angle of attack and inertial data

- AOA – voted dual sensors plus inertial data
- Accurate Coefficient of Lift (CL) - Airplane Mass from FMC - Validated after Takeoff
• Algorithm developed for enhanced stall protection
• Avoid displaying data known to be bad - Loss of valid voted VCAS = Display synthetic airspeed VSYN - Loss of valid voted PSTATIC = Display GPS altitude

So Boeing was well aware of how to compare and how to use a separate ( Inertial-GPS ) system to cross check and eliminate faulty data ...

But it probably cost to much to include on 737MAX to avoid long standing issues-