MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

[fdr]

Originally Posted by PEI_3721

HighWind, # 371,
A clear and balanced summary; I agree, although the future might not be the simple either-or alternatives.
The Max might have the simplest route. If trim does not meet the certification requirements and was a contribution in two accidents, keep the Max grounded until both MCAS and the trim system are improved.
The NG could be a simple logical argument, fails to meet requirements, ground the aircraft until improved. However, an ‘emotional’ but logically inaccurate argument based on ‘no accidents so far’, could allow the aircraft to remain in service, although the risk of failure is the same.
This choice has potential for splitting the regulatory authorities, purist vs practical, but could be managed with compromise. Everyone might wish to avoid using the piloting contribution in recognition and inhibition as a permanent solution.
If the NG is easier to recover than the MAX (effect of aero differences), then it could be argued that alleviation with pilot recognition and action to mitigate risk could keep the aircraft flying until the trim system is modified. There may be similar contributions from restricting wt, cg, and of course lots of training.
If the NG is more difficult, then the industry faces a pivotal point in certification and risk management, where short term compromise could be based on definitions of safety, ‘what we are doing’ vs ‘what we have’, and of course timing of modification.
The critical factor depends on who makes the decision and how is this presented; not Boeing, ideally FAA in conjunction with (all) other authorities; but then few things are ever ideal.
fdr, #373,
But ‘The Max is able to be flown safely without doubt.’
There is always doubt, particularly when considering human performance. This is the judgement which the authorities have to make, and with a background of two recent accidents to bias thoughts

The difficulties that beset the crew of both the accident aircraft were the result of inadequate knowledge and awareness being imparted to the crew. This state of affairs resulted from the OEM complying with the constraints that were imposed by the airline customers, that additional training would come at a cost. Not doing the training or awareness related to the design changes came with its own painful cost to all concerned. The comprehension of the dynamics at play are now known, and that provides the basis of awareness training to mitigate the risks that exist in the aircraft design. The MCAS needs design change, however the risk exposed by the second accident is that the limitation of the manual trim necessitates dedicated awareness training for the crew on that aspect irrespective of the MCAS design change.

[Ian W]

Originally Posted by fdr

The difficulties that beset the crew of both the accident aircraft were the result of inadequate knowledge and awareness being imparted to the crew. This state of affairs resulted from the OEM complying with the constraints that were imposed by the airline customers, that additional training would come at a cost. Not doing the training or awareness related to the design changes came with its own painful cost to all concerned. The comprehension of the dynamics at play are now known, and that provides the basis of awareness training to mitigate the risks that exist in the aircraft design. The MCAS needs design change, however the risk exposed by the second accident is that the limitation of the manual trim necessitates dedicated awareness training for the crew on that aspect irrespective of the MCAS design change.

It is apparent that it was not considered that MCAS would fail in the way it did. Therefore, any simulation training prior to the accidents would not have included an MCAS runaway due to a bad AOA input as it was seen as a benign addition to STS.
The fix will almost certainly remove the single point of failure and prevent repeated large nose down trim events. So simulation training now for an event that is now not possible with MCAS would not provide any training value. What would provide training value is manual flight with electric trim switched off using the manual trim wheel - and that is something that applies to every 737 flying and should have been part of standard training. If that had been the case the 737NG pilots transferring to the Max would have already had the training required and this thread may not have existed..

[PEI_3721]

fdr,
Clarifying my point, scepticism that the Max can be flown safely, has nothing to do with MCAS.
If the trim, for whatever reason, exceeds a particular deviation then the likelihood of being able to recover is low. This is based on the two accidents and questionable, but likely correct simulation of the stick / trim forces in the NG.

The debate about training only arises if the regulatory authorities accept a pilot contribution in recognising a trim runway and disabling the electrics before the critical deviation is reached; either short term dispensation (NG) or as a contribution in a long term modification.
As currently configured, and again based on the accidents, the likelihood of crew correctly assessing a runway situation and switching the system off in time is low.
There is no alert of trim runway, thus the situation has to be deduced from other cues which might themselves be distracting or not appreciated quickly enough to maintain control.
The judgement of the acceptability of the current position depends on regulatory views on achieving consistent human performance, without which an accident might ensue.

[DaveReidUK]

Originally Posted by PEI_3721

If the trim, for whatever reason, exceeds a particular deviation then the likelihood of being able to recover is low.

Are you referring specifically to recovery using the manual trim wheel ?

I don't recall seeing any suggestion that electric trim (assuming enabled) isn't capable of recovering from full AND.

[WHBM]

Originally Posted by yoko1

Despite all the angst relating to the 737NG family, it should be acknowledged that it has amassed one of the best safety records of any commercial aircraft ever built..

It's good, but among it's 21st Century built compatriots it's not especially standout. Others may argue but I just feel the A320 series has a better record. What is not in question, when looking at hull loss rates, is the significant number of NG runway overruns that have occurred, not necessarily off short runways.

[safetypee]

Recent posts have considered pilot performance in recovering the aircraft using the ‘roller coaster’ manoeuvre. The accidents indicated that this was not possible due to high elevator forces and inability to move the trim wheel.
The out of trim condition and forces in the accidents were higher than might be assumed due to feel shift, because of the stall warning from false AoA.
With a trim runaway, independent of stall warning, the crew might be able to overcome the lower forces and use the ‘roller coaster’ manoeuvre.

Dave, the point being considered is an emergency where the trim has been isolated as part of the trim runaway drill.
Also, an EASA certification query implied that electric trim would not be available, and not considering higher non-normal tail angles.
“The main issue being that longitudinal trim cannot be achieved throughout the flight envelope using thumb switch trim only”
“Boeing set the thumb switch limits in order to increase the level of safety for out-of-trim dive characteristics”
https://www.easa.europa.eu/sites/def...20ISS%2010.pdf

[yoko1]

This chart is a tad dated, but still makes the point. Except for aircraft that had not (yet) registered a hull loss, the 737NG family has the lowest hull loss per departure rate of any commercial aircraft covered in this survey. One of the reasons why it may not seem so is that 1) there is likely some confusion with 737 classics and 2) there are numerically more 737's flying than any other type and so the absolute numbers seem higher.

[DaveReidUK]

Originally Posted by safetypee

Also, an EASA certification query implied that electric trim would not be available, and not considering higher non-normal tail angles.

“The main issue being that longitudinal trim cannot be achieved throughout the flight envelope using thumb switch trim only”
“Boeing set the thumb switch limits in order to increase the level of safety for out-of-trim dive characteristics”
https://www.easa.europa.eu/sites/def...20ISS%2010.pdf

My understanding of that ESF is that limit switches restrict trim switch movement of the stab towards the extremes of AND (and ANU), not that they remove the ability to trim from the extremes of the range back towards the green.

I'm pretty sure this was discussed extensively in one of the earlier threads.

[infrequentflyer789]

Originally Posted by yoko1

This chart is a tad dated, but still makes the point. Except for aircraft that had not (yet) registered a hull loss, the 737NG family has the lowest hull loss per departure rate of any commercial aircraft covered in this survey.

Updating the chart to add the MAX (departures count from airsafe.com) gives us:


accident rates chart inc. MAX

MAX is at the bottom because ordering is by year of introduction, order by fatal hull loss rate and MAX is almost at the top, the contrast with the NG line is stark.
Since the pilots are common between the two, there is something very different about the plane - either that or the iPad conversion course is really really damaging...

[yoko1]

Originally Posted by infrequentflyer789

Since the pilots are common between the two, there is something very different about the plane -

And since the two accidents were caused by the same malfunction, I think we know what that difference is. The irony is that once the MAX is relaunched with the updated MCAS, it is likely to go one to be one of the safest airframes flying.

[phylosocopter]

Originally Posted by yoko1

And since the two accidents were caused by the same malfunction, I think we know what that difference is. The irony is that once the MAX is relaunched with the updated MCAS, it is likely to go one to be one of the safest airframes flying.

but i understood that the whole point is that the 737 family is under one certification, does this not mean that the accident stats should be considered for the whole family not for each variant?

[Loose rivets]

I don't recall seeing any suggestion that electric trim (assuming enabled) isn't capable of recovering from full AND.

Dave, there is still that fuzzy patch of ANU electric trim commands that ended abruptly. I've never really seen an answer to why the PF would have simply stopped trimming - well, apart from being totally overwhelmed.

[yoko1]

Originally Posted by phylosocopter

but i understood that the whole point is that the 737 family is under one certification, does this not mean that the accident stats should be considered for the whole family not for each variant?

It depends on what you wish to measure. Each generation of the 737 family had some significant differences. The discussions here initially focused on the MAX and not the other 737's because of one of those important differences. To the degree that people want to imply that the entire line of 737 aircraft are now suspect must reconcile that position with the historical evidence that the 737NG variant has turned out to be an incredibly safe aircraft. To take this argument a bit further, if one Boeing employee at the right place and time had identified and fixed the key weakness in MCAS before launch, then instead of spotlighting all the weakness of the model, we might just be extolling the continued robustness of the design.

[yoko1]

Originally Posted by Loose rivets

Dave, there is still that fuzzy patch of ANU electric trim commands that ended abruptly. I've never really seen an answer to why the PF would have simply stopped trimming - well, apart from being totally overwhelmed.

This has been covered before, but here is a recap from Bjorn's Corner

Key Excerpt:

The insufficient trim mystery after re-activation of Electric Trim

After 7 PF commands Electric Trim Nose Up in two short cycles. I asked my selves (as did others) why these short trims? They are fighting to get the nose up to the extent they risk switching in the Electric Trim again. Then why not trim nose up continuously or for at least long cycles once Electric Trim is there? It took me several hours to find an explanation. Here my take:

To understand the blip trims one must have flown fast jets at low altitude. At the speed ET302 is flying, 360kts, it’s hypersensitive to trim. The least trim action and the aircraft reacts violently. Any trimming is in short blips.

As PF holds the nose up with a very high stick force, now for a long time, he’s sensitivity to release stick with trim is not there (this is what Pilots do when they trim nose up, otherwise the aircraft pitches up fast). He trims therefore in short blips and has difficulty to judge the trim effect he has achieved. His is not flying on feel. He can’t, he is severely out of trim, holding on to the Yoke with a strong pull force.

Anyone who has flown a grossly out of trim aircraft at high speeds knows your feel is compromised. The sensors you have to rely on are your eyes, not your hands.

PF has the horizon glued to read the aircraft. The result is the short nose-up trims we see. The nose goes up and the stick force needed is reduced. His judgment is; this is enough for now, it was a powerful response. Any MCAS attack I now trim against, then I correct my trim if I need to.

But the aggressive MCAS, trimming with a speed 50% higher than the pilot and for a full nine seconds, kicks in at 8 with a force they didn’t expect. Speed is now at 375kts and MCAS was never designed to trim at these Speed/Altitude combinations. Dynamic pressures, which governs how the aircraft reacts to control surface movements, is now almost double it was when last MCAS trimmed (Dynamic pressure increases with Speed squared).

The Pilots are thrown off their seats, hitting the cockpit roof. Look at the Pitch Attitude Disp trace and the Accel Vert trace. These are on the way to Zero G and we can see how PF loses stick pull in the process (Ctrl Column Pos L). He can barely hold on to the Yoke, let alone pull or trim against.

His reduced pull increases the pitch down further, which increases the speed even more. At 05.45.30 the Pilots have hit the seats again (Accel Vert trace and Ctrl Columns force trace) and can start pulling in a desperate last move. But it’s too late. Despite them creating the largest Control Column movement ever, pitch down attitude is only marginally affected.

We have Control Column displacement this time, JT610 was Force. If the elevator reacts to these displacements, at the Dynamic Pressure we have, we should have seen the diving stop. The lack of reaction to the large Control Column displacement of two Pilots pulling makes me think we now have blowback. This is not a design fault, we are well beyond Vmo. But it explains the rapid dive, unhindered by the Pilots’ actions.

It’s easy to say “Why didn’t they trim then?”. Because they are going down at 20 degrees nose down (which is a lot, a normal landing approach is 3°) and at 400kts. Then you just pull for all you have. And the aircraft is not reacting to the largest Control Column displacement since takeoff. This makes them pull even harder, the aircraft is unresponsive and they are fighting for theirs and all the passenger lives.

[krismiler]

So based on the sample given, the MAX is almost as dangerous as the first generation of transport jets and just one more hull loss would give it the record. Time in service needs to be looked at as well, the A320 and B777 have excellent records accumulated over 24 - 30 years which is long enough for a meaningful result. The MAX suffered two disasters from the same cause in under two years which gives a spike.

If the problems are sorted out and it returns to service with no further accidents then the rate would decrease overtime and could be better than average. Had it not been grounded and another accident occurred, that would have been the end.

This could be Boeing’s equivalent of de Havilland’s Comet, whilst the type eventually returned to service, sales never recovered and the company lost its premier position in the market. The British manufacturer wasn’t cranking out 40 - 50 aircraft a month during the grounding either.

[fdr]

Originally Posted by PEI_3721

fdr,
Clarifying my point, scepticism that the Max can be flown safely, has nothing to do with MCAS.
If the trim, for whatever reason, exceeds a particular deviation then the likelihood of being able to recover is low. This is based on the two accidents and questionable, but likely correct simulation of the stick / trim forces in the NG.

PEI, we are close but still off concurrence on this, which may always be the case.

ET302 uncovered glaringly the loss of industry knowledge on the limitations of manual trim. MCAS put the aircraft in a condition that exposed the underlying problem. (JT610 was somewhat different in the consequences of the MCAS issue, highlighting the cognitive issues that can arise). Fixing MCAS is needed and is a straight forward engineering task to undertake, with regulator oversight involved to ensure success. The manual trim issue remains, and is a continued problem that can only be mitigated by redesign or training. The redesign would need to remove the possibility of exceeding the manual trim inout torque loads at all times, and that probably looks like another electric trim jack incorporated in the system. I doubt that is a simple solution. Aerodynamic mods to the elevator may increase the range of off trim that the elevator can directly counter, however that would logically increase the resultant load on the manual trim, and still requires a specific manoeuvre to be undertaken to recover the aircraft to a position where manual trim input can be effective. The operational reliability of the trim system prior to MCAS has been very high, but the out of trim remains as a possibility, but the consequences still need to be viable. Expecting a crew to develop a technique under duress was not viable, however with training the recovery would be achievable. The manual trim issue is a global issue for any type that has a secondary trim system dependent on manual force input, and that can only be reinforced by wholesale design change to a powered secondary system or by training to make manual trim viable.

The two possible mis trim cases are either ANU, or AND. The ANU is the type that the Falcon 7x encountered on descent into KL. The copilot of that aircraft understood the issue and effectively responded to the ANU trim error with bank angle. The AND is the MCAS type of problem, and is harder to cope with for the flight crew at low altitude. At high altitude the margins before encountering some nasty transonic effects are also problematic but the earth is not rushing up in the window complicating things quite so much. Non Max aircraft gain a pitch up moment from the speed brake, which the Max has reduced through its FBW system of the speed brake. The remaining simple pitch authority that remains is from thrust which is considerable at low altitude, and less so at high altitude.The sole remaining trim change arises from load movement inside the cabin, and that is surprisingly effective. On a calibration flight test a single person moving from the front of the pax cabin to the rear of the cabin was detectable as a stabiliser trim change. Getting pax to move would be a whole lot of crowd control, the current SLF generation has little interest in their being a component of their own safety in flight... Those are the tools that exist, and the technique to unload the trim to gain in trim condition again is able to be taught.

Mitigation of the Max MCAS issue starts with the knowledge of the MCAS problem and how it works, and then how to manage the cutouts to permit the return to an in trim case before finally isolating the MCAS. The potential for any manual trim case to end up out of trim to the point of exceeding manual torque input suggests doing mitigation training to give the crews confidence in the aircraft and a fighting chance to survive such events on all variants. We need to make up for the loss on 50 years of awareness

[Loose rivets]

Last first: the sample is too small to draw any conclusions. As I mentioned yesterday, the vane faults were unrelated - probably - so incredible bad luck.

The thing about the Comet is that no one knew what was happening and it led to an horrific string of events. We learned a great deal about the MAX after the first accident, the previous LionAir flight focussing attention on the probable cause. Sadly, the time to the second tragedy was too small to allow crews worldwide to become fully aware of the trimming difficulties. What I'm saying I suppose is there wasn't enough learning time.

For the MAX to become Boeing's Comet will depend more on what finally comes out of the darkest recesses of filing cabinets.

The insufficient trim mystery after re-activation of Electric Trim

That's left me a little confused. Even if the negative g was at the time I eluded to, any positive results of ANU pulses would be a very welcome positive g. Pilots hitting the ceiling? The blog seems a puzzling mixture of knowledge and nonsense.

[MemberBerry]

Originally Posted by Loose rivets

That's left me a little confused. Even if the negative g was at the time I eluded to, any positive results of ANU pulses would be a very welcome positive g. Pilots hitting the ceiling? The blog seems a puzzling mixture of knowledge and nonsense.

Yes, the pilot ANU trim would result in a positive change in g. But that would soon be followed by an even stronger negative g change when MCAS starts reversing the ANU trim again. That's what they were hypothesizing it could cause the pilots to "hit the ceiling", MCAS activating at 375kts.

[yoko1]

Originally Posted by Loose rivets

That's left me a little confused. Even if the negative g was at the time I eluded to, any positive results of ANU pulses would be a very welcome positive g. Pilots hitting the ceiling?

BTW, there if no "if" about the g-forces. They are included in the published FDR data. The aircraft registered nearly negative 2 g's near the end of the flight. If the pilots had not been strapped in, they surely would have hit the ceiling. At a minimum, the Captain lost some leverage against the yoke as he was attempting to pull back.

You have to keep in mind that in this flight region beyond Vmo, the aircraft would be reacting very differently than normal to control inputs. There were already plenty of signs that the ET302 Captain was not particularly comfortable with hand flying, and that was with an aircraft within the flight envelope. If you've ever been an instructor pilot and seen a student pilot make very tentative control inputs because they are nervous about what will happen, then that's the closest example I could give of why the Captain was not more assertive with making the necessary trim adjustments.

[FlightDetent]

That graph is completely insulting to any professional logic. If ever you need an illustration for the old adage about lies and statistic, this is as bad as it gets.

What a strange metrics, hull loss per type. Heck, burned toasts per house windows?

... CFIT, LOC-I, terrorism - including military,.... it must be a quick satisfying job to produce an impressive colourful piece without putting any work into it.