Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

Old 6th Aug 2019, 19:50
  #1801 (permalink)  
 
Join Date: May 2013
Location: Milan
Age: 36
Posts: 136
Likes: 0
Received 0 Likes on 0 Posts
BOE001 from Seattle https://fr24.com/BOE001/21973bf9

Flying right now
anto125 is offline  
Old 6th Aug 2019, 20:59
  #1802 (permalink)  
 
Join Date: Jun 2019
Location: Tana
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
I haven't been following either the investigation or this thread too closely, so pardon if this has already been discussed. As far as I understand, MCAS only activates if the flaps are 0. If it has already activated, is it disabled if you set FLAPS 1? And if so, is it disabled after you SELECT Flaps 1 or when the actual flaps are in the FLAPS 1 position? Does anyone know?
UltraFan is offline  
Old 6th Aug 2019, 21:21
  #1803 (permalink)  
Thread Starter
 
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 778
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by UltraFan
I haven't been following either the investigation or this thread too closely, so pardon if this has already been discussed. As far as I understand, MCAS only activates if the flaps are 0. If it has already activated, is it disabled if you set FLAPS 1? And if so, is it disabled after you SELECT Flaps 1 or when the actual flaps are in the FLAPS 1 position? Does anyone know?
The only people who could possibly know what actually happens are a very small number of Boeing test pilots. And I doubt if they do.
OldnGrounded is offline  
Old 6th Aug 2019, 22:04
  #1804 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 61
Posts: 262
Likes: 0
Received 3 Likes on 2 Posts
Originally Posted by Notanatp
What is the basis for your statement that flipping five bits "is the standard procedure for this category of tests"?
Originally Posted by Seattle Times
...
This was standard testing that’s typically done in certifying an airplane, but this time it was deliberately set up to produce specific effects similar to what happened on the Lion Air and Ethiopian flights.
...
During the tests, 33 different scenarios were artificially induced by deliberately flipping five bits on the microprocessor, an error rate determined appropriate by prior analysis. For all five bits, each 1 became a 0 and each 0 became a 1. This is considered a single fault, on the assumption that some cause, whether cosmic rays or something else, might flip all five bits at once.
For these simulations, the five bits flipped were chosen in light of the two deadly crashes to create the worst possible combinations of failures to test if the pilots could cope.
(my emphasis)

About the bit selection ; 1 bit for MCAS status "engaged" (disabling the control column switches), 1 bit for nose down pitch trim command, and 3 bits for undetailed "complications" (for instance: airspeed disagree warning).
The later description of how the scenario unrolled clearly shows that it's the first 2 bits plus a 3 seconds startling delay that are critical for dooming the plane in 1 occurrence over 3.
Luc Lion is offline  
Old 6th Aug 2019, 23:44
  #1805 (permalink)  
 
Join Date: Jan 2008
Location: Wintermute
Posts: 76
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Notanatp
Interestingly, none of the reporting has said just how likely the test scenario was to occur in flight, other than to say it was "esoteric," or "theoretical," or "extremely improbable."

The test simulated the effect of 5 bits being simultaneously flipped in the FCC's memory due to cosmic rays or some other unnamed cause. The 5 bits were independent. One bit was flipped to tell the FCC that MCAS was active when it wasn't (this disabled the yoke cut-off switches). Another bit told the FCC to incorrectly issue a nose-down trim command. The other 3 bits weren't described but apparently were necessary to create the runaway trim scenario.

Assuming a 5-bit event, the odds of these 5 specific bits being flipped depends on the size of the memory. If the FCC has 1-megabyte of RAM, then the odds of those particular 5 bits being flipped in a 5-bit event should be on the order 10**-32. I don't know how frequently the FAA estimates a 5-bit event will occur on an aircraft with a 1-meg memory, but even if it approaches 1 (i.e., it can be expected to happen each flight), the likelihood of this particular 5-bit event occurring on any single flight is on the order 10**-32. You could fly all the 737 Max's that will ever be made 3 times a day for a billion years, and you'd still be looking at probabilities on the order of 10**-16.
No competent implementor of high safety software (or hardware) does not use hardware AND software protection against memory corruption (where hardware protection is available - sometimes it is not depending on your hardware limitations), unless the hardware and software on this aircraft are being audited against grandfathered safety standards from the 1960's then the failure you describe must be a failure which would be deemed unacceptable . . .

Bit level corruption in any part of memory would be detected and the corrupt data not acted upon, the action taken when the corruption is detected being defined by the system requirements and the safety rating (largely), e.g. is the system fail safe, fail functional for example. There are many well understood mechanisms which are used to perform this function to varying levels of integrity (because not all safety cases require the most computationally and physically expensive solution).

No competent implementor of high safety software will create the software in which critical data is co-located in the manner described. This kind of design would be explicitly illegal and that set of rules would be strictly enforced, usually both by manual independent review of the software and by automated software analysis. Given that observation the likelyhood of an external stimulus causing this kind of issue must be well outside the statistical risk where it is in any way likely, ever, to happen (not that that would stop the protection being used under ALARP, and bearing in mind memory corruption happens for many reasons which are not as 'sci fi' as high energy particle bit flips (you guys - really - back to reality eh ?))

All of the high safety critical software work I have done assumes data corruption (by whatever means) is possible and must be protected against, in all types of memory, within the processor control registers themselves, within off chip peripheral devices, everything. In the type of software my team creates there is no 'human' to stop the system from killing people. Perhaps my expectations of the quality that the aviation industry claims to enforce is very misplaced . . . from where I'm sitting today it's looking fairly shoddy and second rate at best . . .

The FAA should turn Boeings safety and design records over to a genuinely independent review body who are not part of the aviation cabal to see what they think . . . Clearly the FAA are not capable of this kind of work, and clearly Boeing do not do it (well enough) to be allowed to self certify.

When the Chinook FADEC software was handed over for independent analysis the company doing the analysis thought they had been supplied with the wrong software and stopped analysing it, the quality was unacceptable. The same happened to Toyota, and . . . and . . . and . . .

I'd put a shiny tenner on the table betting that this is exactly what would happen in this case, I might even stretch to a crisp twenty, but that will never happen, Money is more important than peoples lives.

Lastly, the means by which complex software fails are often very, very subtle and complex, and with the greatest respect way, way, way beyond anything the masses on here are even vaguely capable of even conceptualising from what I can see.
fergusd is offline  
Old 7th Aug 2019, 00:48
  #1806 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
No competent implementor of high safety software will create the software in which critical data is co-located in the manner described. This kind of design would be explicitly illegal and that set of rules would be strictly enforced, usually both by manual independent review of the software and by automated software analysis.
FERGUSD...concur 10000% (did not include your entire post in quote,but yes)

Redundancy is there for a reason...the complex algorithm to combine resources...and determine the correct solution....lemming talk. (statically indeterminate)

Hopefully, that Boeing provided that info in a press release, well, perhaps blame the messenger, BUT if this is really the path...damn.
Smythe is offline  
Old 7th Aug 2019, 12:23
  #1807 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by fergusd
No competent implementor of high safety software (or hardware) does not use hardware AND software protection against memory corruption (where hardware protection is available - sometimes it is not depending on your hardware limitations), unless the hardware and software on this aircraft are being audited against grandfathered safety standards from the 1960's then the failure you describe must be a failure which would be deemed unacceptable . . .

Bit level corruption in any part of memory would be detected and the corrupt data not acted upon, the action taken when the corruption is detected being defined by the system requirements and the safety rating (largely), e.g. is the system fail safe, fail functional for example. There are many well understood mechanisms which are used to perform this function to varying levels of integrity (because not all safety cases require the most computationally and physically expensive solution).

---snip------
Lastly, the means by which complex software fails are often very, very subtle and complex, and with the greatest respect way, way, way beyond anything the masses on here are even vaguely capable of even conceptualising from what I can see.
70% of the people here seem to be engineers watching in bemusement, at how the FAA pretends to check designs which are pretend-safe, and journalists who have seen it all and expect worse to come, knowing as you say that money is more important than people.

For me, who have been both, the interesting part in this has been realising that the pilots have been conditioned to ignore the faults of their systems, which as you state they mostly don't comprehend intuitively, just as most engineers cannot fly a plane.

The interesting part of AF447 was watching the industry realize that perfectly ordinary first world pilots cannot competently hand-fly a plane, and then as an industry do ... nothing. I expect that after the MCAS fix, the US airframe industry aka. Boeing will similarly revert to business as usual.

Edmund
edmundronald is offline  
Old 7th Aug 2019, 13:46
  #1808 (permalink)  
 
Join Date: Jan 2008
Location: Wintermute
Posts: 76
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by edmundronald
For me, who have been both, the interesting part in this has been realising that the pilots have been conditioned to ignore the faults of their systems, which as you state they mostly don't comprehend intuitively, just as most engineers cannot fly a plane.
It is very rare that complex software exhibits faults which are intuitively comprehensible, even if you wrote the software ;-)

fergusd is offline  
Old 7th Aug 2019, 21:33
  #1809 (permalink)  
Thread Starter
 
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 778
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Fly Aiprt
We understand that the MCAS and associated software are in the process of being fixed, or scrutinized, or...
Has any info leaked as to the status of the other issues, especially the manual trim wheels ?
In a Reuters story from a couple of weeks ago, it was reported that the trim wheels are on the list of things EASA wants resolved before return to service:

As Boeing targets October, FAA official says no timeline for 737 MAX

[. . .]
The European Aviation Safety Agency has handed the FAA and Boeing a list of its own concerns that it wants addressed before the MAX re-enters service, people familiar with the matter said.

It includes the behavior of the autopilot - which EASA believes may take the aircraft too close to a stall before automatically cutting out - as well as the physical force needed by pilots to move a backup wheel that is part of the trim system and extra training to help crew cope with simultaneous alarms.
OldnGrounded is offline  
Old 7th Aug 2019, 21:52
  #1810 (permalink)  
 
Join Date: Mar 2015
Location: antipodies
Posts: 75
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by OldnGrounded
In a Reuters story from a couple of weeks ago, it was reported that the trim wheels are on the list of things EASA wants resolved before return to service:
Spurious alarms should be always treated as a serious event that could be catastrophic !
If the manufacturer cannot resolve then the craft should be grounded!
phylosocopter is offline  
Old 8th Aug 2019, 08:05
  #1811 (permalink)  
 
Join Date: Mar 2015
Location: antipodies
Posts: 75
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Maninthebar
I fear that taking this course might result in the grounding of a significant proportion of current models.
yes that would ground a significant proportion and properly so
automatics MUST fail cleanly to a defined and trained for state ! in many cases they don't and aircraft and people are lost because of this.
its just not good enough to dump the mess onto the pilot with incorrect information and alarms active. Now is the time for the regulators to say enough is enough , define a manual reversion state and displays and mandate training for that state.
phylosocopter is offline  
Old 8th Aug 2019, 16:00
  #1812 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 45
Received 0 Likes on 0 Posts
Originally Posted by Ian W
This is true, But that doesn't excuse avoiding regression testing. The new use might just have some operational assumptions such as parameters that the designer of the legacy system believed 'would never be exceeded' - and all the people who knew of those parameters and the operational assumptions that drove them are long retired.
But what gets tested in regression testing? Regression testing isn't usually a full formal qualification test, it's a subset of the most important functions. If you get that list wrong, or don't exercise it fully you can miss things.

A full qualification test on one box/software item could take months. That's why they only do regression tests along with testing the new functions.

Say the issue was an assumption that some parameter wouldn't be exceeded. The regression test suite developed isn't going to exceed that either. They are just going to run the same suite as the last time, and the time before that. Only if new functionality is considered important enough will it be added to the regression test. The code could go through a dozen updates without the regression suite being changed.
ST Dog is offline  
Old 8th Aug 2019, 16:55
  #1813 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 45
Received 0 Likes on 0 Posts
Originally Posted by HighWind
It seems like FAA/Boeing have delivered evidence to EASA to confirm that the manual trim wheel is usable in ‘certain corners of the envelope’, in situations where the trim forces are too high for the electrical trim.
The question is if Boeing knew that the manual trim forces were too high for an average pilot..
EASA wasn't talking about going ANU when at the AND limit, and vice versa. Electric works for those cases
It's about going AND past the AND limit switch or ANU past the ANU limit switch.
The manual wheel gives access to the range that the thumb switch can't reach.

I've seen nothing to suggest that you can't add AND with the wheel past the limit switch (or further ANU past the upper limit).
ST Dog is offline  
Old 9th Aug 2019, 01:44
  #1814 (permalink)  
 
Join Date: Mar 2019
Location: On the Ground
Posts: 155
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by ST Dog

I've seen nothing to suggest that you can't add AND with the wheel past the limit switch (or further ANU past the upper limit).
But why would you want to? You want to get the airplane back IN trim, not further OUT of trim. A functional trim system needs to make it possible for the pilots to get the plane back in trim.
Takwis is offline  
Old 9th Aug 2019, 05:30
  #1815 (permalink)  
 
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes on 0 Posts
The MAX grounding is really hitting home around here. I needed to get a speciality marine part and was informed by the manufacturer that they were out of stock so I would normally be SOL for about three months -- but the good news (for us) is that because of the Boeing slowdown the fabricators are looking for work and the marine orders which are usually way back in the queue are getting done -- the upshot is my part will be available next week! So if you are a manufacturer who needs high quality work done in stainless or aluminum, call around in the Seattle area and stock up with good old American machine know-how while you have a chance. Lots of good shops are apparently looking for business and these guys know about quality.
Water pilot is offline  
Old 9th Aug 2019, 06:38
  #1816 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 15,784
Received 196 Likes on 90 Posts
Originally Posted by Takwis
But why would you want to?
You wouldn't.

The poster was simply correcting a misunderstanding about that EASA document (which doesn't specifically mention trim forces at all).
DaveReidUK is online now  
Old 9th Aug 2019, 12:37
  #1817 (permalink)  
 
Join Date: Aug 2017
Location: London
Posts: 94
Likes: 0
Received 0 Likes on 0 Posts
If you've got friends asking what MCAS is all about, this BBC article is a pretty good explanantion for non-technical people:

What went wrong inside Boeing's cockpit?
https://www.bbc.co.uk/news/resources...deadly_crashes

It's a bit out of date now - doesn't contain all the detailed discussion on software, trim wheels, other problems, that we've had in this thread, but it's a good starting point with pics and animations.
PerPurumTonantes is offline  
Old 9th Aug 2019, 19:43
  #1818 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 45
Received 0 Likes on 0 Posts
Originally Posted by Takwis
But why would you want to? You want to get the airplane back IN trim, not further OUT of trim. A functional trim system needs to make it possible for the pilots to get the plane back in trim.
Because the full range, isn't available with electric. To get the rest of the way you use the wheel.
That was the whole point of the EASA note.

IE. full range is +/- 10 but electric only goes +/-8. the limit switches stop electric trim so you can't accidentally get too far with the switch. If you really need the rest of the range the wheel give it to you.
ST Dog is offline  
Old 13th Aug 2019, 17:24
  #1819 (permalink)  
 
Join Date: Mar 2019
Location: Farnborough Hants
Posts: 141
Received 0 Likes on 0 Posts
I've just come across an article in the July 2018 edition of the the Professional Body's magazine of my "chosen" profession.
I quote:
" Defence News reported earlier this year (2018) that the US Army had stopped taking deliveries of the AH-64E Apache attach helicopters from Boeing in February. The US Army explained that 'the service is not confident in the durability of what it deems a "critical safety item" - a strap pack nut that holds very large bolts, that subsequently hold the rotor blades on the helicopter'
(snip)
'Clearly these items are safety critical components and for Boeing (the manufacturers) not to have extended its investigation of the testing of other safety critical components, particularly the whole rotor assembly is concerning' "

So is Boeing really placing safety at the top of its agenda on both (or either) military and commercial products?
Paul Lupp is offline  
Old 14th Aug 2019, 01:06
  #1820 (permalink)  
 
Join Date: Feb 2006
Location: USA
Posts: 487
Likes: 0
Received 0 Likes on 0 Posts
Posturing? -- Seattle Times

https://www.seattletimes.com/busines...es-other-jets/

Southwest, a stalwart Boeing 737 MAX customer, eyes other jets
Aug. 13, 2019 at 2:12 pm Updated Aug. 13, 2019 at 3:46 pm

By Dominic Gates
Seattle Times aerospace reporter

Southwest Airlines, the largest customer of the 737 MAX and long an all-Boeing airline, insists it has “no current plans” to fly any jets other than the 737. But it’s at least eyeing the possibility.

The airline’s management has proposed new language in the contract with its flight-attendants union that would grant it the flexibility “to fly more narrowbody aircraft types.”

Southwest management told the union, TWU Local 556, in a proposal this month that the ability to operate aircraft other than the 737 “would give us the flexibility … to better compete and grow.”

“We are flying to more destinations that vary in distance, size and seasonality,” the company’s proposal states. “This change would allow us to fly aircraft types that are better suited for some of the markets we serve.”

The grounding of Boeing’s 737 MAX has hit Southwest hard. The airline has 280 of the jets on order, of which 34 were delivered and in passenger service before the grounding.

Jon Weaks, president of the Southwest Airlines Pilots Association, said in an interview that the carrier’s chief executive, Gary Kelly, “has bet the company on the MAX.”

The airline has parked its current fleet of MAXs at an airfield in Victorville, California. And it has another 41 contracted MAX deliveries for the remainder of this year that Boeing will hold until it gets clearance for the jet to fly passengers again. At this point, those aircraft won’t be in service until next year.

The 75 jets parked or awaiting delivery represent 10 percent of Southwest’s active fleet of 750 aircraft, putting the low-cost-carrier at a competitive disadvantage against other airlines with fewer MAXs or, as is the case with rival Delta, none.

In April, as anger against Boeing built among U.S. airline pilots after the second MAX crash in Ethiopia, Weaks wrote a memo to SWAPA pilots noting that some were questioning the wisdom of an all-737 fleet.

Weaks wrote that his pilots as well as Wall Street analysts have discussed “the advantages and disadvantages of an airline having a single fleet and having aircraft from only one manufacturer.”

He also referred to Boeing’s size and enormous influence in the aerospace world “and the antitrust issues that accompany this long-overlooked issue.”

This year, there was speculation that Southwest might buy the new Airbus A220, an all-new jet formerly known as the CSeries that the European jet maker acquired from Bombardier of Canada. Delta is now using that very fuel-efficient plane, which is small but offers the cabin comfort of bigger jets, to connect city pairs with high business demand, including Seattle-San Jose.

At a conference in March, five days before the second MAX crash, CEO Kelly admitted that Southwest has looked at the A220 but said that was just normal due diligence to assess all options.

“As new technology comes onto the market, I think we’re compelled to look at that,” Kelly said. But he added that it would take “a really compelling business case for us to deviate from” the current all-737 fleet.

That was before the MAX was grounded. Asked again on an earnings call last month about whether he might look at buying different jets, Kelly said it’s a longer-term strategic decision that wouldn’t solve the immediate problem.

“I think it’s something that needs to be fully explored and debated, and that’s not something we’re going to do in 90 days,” he said. “As a practical matter, if we want to diversify the fleet, it would take us years.”

Asked if Airbus is “circling you more aggressively” during the MAX crisis, Kelly said, “Yes, that’s always the case.” But he again insisted that “right now, we don’t see that we need a change in strategy.”

Responding via email to an inquiry Tuesday, Southwest spokeswoman Beth Harbin said, “Southwest has no current plans to pursue or introduce a new fleet type.”

The negative impact of the MAX grounding has led Wall Street analysts to wonder if Southwest may even consider acquiring another airline and bringing in different jets that way. Kelly pointed out in July that Securities and Exchange Commission (SEC) rules mean “we can’t comment on anything like that in substance” beyond saying that such a step would be “a huge strategic question.”

So does the proposed new language in the flight-attendant union contract indicate a shift in thinking?

TWU Local 556 President Lyn Montgomery said that when union negotiators asked management if they intended to bring in a new aircraft type in the future, “they said they had no plans.”

Pilot union president Weaks said that no new aircraft could be introduced without negotiating with SWAPA the pay rates for flying it. “There’s been no communication to us at all” on the issue, he said.

Harbin said the proposed clause in the flight-attendant contract is simply intended to provide the option to diversify in future.

“It is somewhat common at the negotiating table to discuss items that give you flexibility upfront for things you don’t currently have or even have a plan for,” she said.

Still, in the corporate world, “no current plan” is a response that can change with a simple announcement. That the 737’s largest customer, after what Boeing notes is a “48-year partnership,” is even contemplating the idea — one that its CEO says “needs to be fully explored” — may be unnerving enough for Boeing.

Dominic Gates: 206-464-2963 or [email protected]; on Twitter: @dominicgates.
Zeffy is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.