Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

Old 23rd Jun 2019, 07:08
  #561 (permalink)  
 
Join Date: Apr 2019
Location: EDSP
Posts: 334
Likes: 0
Received 0 Likes on 0 Posts
Runaway trim

seems to be their major line of defence, passing on the monkey to FAA for the 3s requirement. After all the input gathered here and elswhere in the community it's gonna be a massacre in court.
BDAttitude is offline  
Old 23rd Jun 2019, 07:57
  #562 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes on 0 Posts
I forsee a Pulitzer Prize nomination for Dominic Gates.

Having read all of the MAX/MCAS threads carefully, I have a few quibbles about minor details in the article. However, that does not detract from the overall clarity it brings to a complex subject.
GordonR_Cape is offline  
Old 23rd Jun 2019, 08:31
  #563 (permalink)  
 
Join Date: Feb 2015
Location: The woods
Posts: 5
Likes: 0
Received 3 Likes on 2 Posts
Seattle Times Article

This is probably the most informative and best researched information to appear in this sorry matter.

Apart from one small confusing paragraph about the AoA on the instrument panel it is a valuable contribution - possibly more so than the accident reports will prove to be.

Perhaps the most significant lesson to be taken from the article is the assumption that within three seconds, pilots will recognise and deal with a trim runaway. That may be the case taken as a single failure but in the context of the cockpit environment in this case of MCAS activation, where the crew was already trying to deal with a rogue stall warning, in an after takeoff phase etc., it was just one more item on a loaded list and three seconds was not enough for recognition and action. Meantime the controls get heavier and MCAS repeats...

The cause of all this chaos was the same - the AoA failure. It didn’t just set off MCAS - it set off multiple spurious warnings. It did this on three known occasions and only when a third pilot was available could the situation be partially defused. That took more than three seconds too...

So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.

As for the company culture, others are already commenting on that aspect.
bill fly is offline  
Old 23rd Jun 2019, 09:21
  #564 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
bill fly

The certification reaction times have to consider each element - awareness and action, not necessarily in isolation, but in context.
There is no ‘trim runaway’ alert, thus the failure has to be deduced from other cues.
If autopilot engaged then the focus of attention could be on the unexpected autopilot disconnect, and flight path management.
Thereafter, as for manual flight, the main cue to abnormality might be stick force, inability to trim. This has to be related to the stage of flight, the flight path, and causation. In these context is critical; is the abnormality associated with configuration change, wind gusts, icing, speed, manoeuvre, all of which diverts mental attention from the main problem.

How long to read the above; more time than was assumed in certification?

safetypee is offline  
Old 23rd Jun 2019, 09:27
  #565 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by bill fly
So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.
Bill, there is much suggestion this wasn't a mistaken analysis of the single system failure. On the contrary, it was a deliberate decision, for purely financial motivations to go against all established engineering philosophy and deliberately make it a single sensor system to avoid customer airline training costs. This process was enabled by the system of Authorised Representatives (AR) - Boeing employees who certify on behalf of the FAA that the design complies with the rules. Can you imagine the immense pressure on the Boeing AR to certify the MCAS in this configuration? Upton Sinclair prophetically once wrote "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!".

Nothing in this MCAS certification process was accidental or missed, the only exception was the gross underestimation of the chance of the active AoA vane failure or damage. Boeing senior management appears to have come to believe the MCAS would never be seen in the wild, therefore they could get away with it. A certification hack, for a certification problem. That assumption came with tragic loss of life, and in time, enormous costs.
CurtainTwitcher is offline  
Old 23rd Jun 2019, 09:50
  #566 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by bill fly
So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.
This raises an important question of 'grandfather' certification with a new model variant. When one change is made, does every other system on the aircraft need to be considered from scratch?

In retrospect this should have been done, and the facts are now beyond doubt. The regulatory details may not be clear, or subject to interpretation.
GordonR_Cape is offline  
Old 23rd Jun 2019, 10:04
  #567 (permalink)  
 
Join Date: Nov 2005
Location: Zulu Time Zone
Posts: 730
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by CurtainTwitcher
it was a deliberate decision, for purely financial motivations to go against all established engineering philosophy and deliberately make it a single sensor system to avoid customer airline training costs..
Okay, go ahead and explain how they saved on training costs by desigining the software such that it only used one of two alpha vanes already fitted....

oggers is offline  
Old 23rd Jun 2019, 10:08
  #568 (permalink)  
 
Join Date: Dec 2001
Location: Leeds, UK
Posts: 281
Likes: 0
Received 0 Likes on 0 Posts
lets not forget B filed false paperwork with the FAA when they said trim authority was only 0.5 and thus got MCAS in under the radar as a minor software, then built it with 2.5 units of authority which turns it into a big beast! I would wonder if the 0.5 was a deliberate underestimation just to get it approved, and there was a fair suspicion from the very beginning more than 0.5 would be needed. It's like a child telling a small white lie to a parent to get what they want. Cute in a 5 year old, deadly in an engineering organisation trusted with people's lives. And if they've done it once, there's a high likelyhood imho there's other whoppers out there waiting to be found.

(apologies if the 0.5/2.5 isn't quite accurate, the numbers are buried in this thread someplace..)

G
groundbum is offline  
Old 23rd Jun 2019, 10:15
  #569 (permalink)  
 
Join Date: Oct 2017
Location: Tent
Posts: 916
Received 19 Likes on 12 Posts
Originally Posted by oggers
Okay, go ahead and explain how they saved on training costs by desigining the software such that it only used one of two alpha vanes already fitted....
Using two - was deemed a higher level of certification would be required and more info needed to be given both to FAA and customers and may require more than the training wanted by Boeing.

That is just one leaked report - might be a disgruntled ex employee - seems to be a few of them.
Bend alot is offline  
Old 23rd Jun 2019, 10:20
  #570 (permalink)  
 
Join Date: Oct 2017
Location: Tent
Posts: 916
Received 19 Likes on 12 Posts
Originally Posted by groundbum
lets not forget B filed false paperwork with the FAA when they said trim authority was only 0.5 and thus got MCAS in under the radar as a minor software, then built it with 2.5 units of authority which turns it into a big beast! I would wonder if the 0.5 was a deliberate underestimation just to get it approved, and there was a fair suspicion from the very beginning more than 0.5 would be needed. It's like a child telling a small white lie to a parent to get what they want. Cute in a 5 year old, deadly in an engineering organisation trusted with people's lives. And if they've done it once, there's a high likelyhood imho there's other whoppers out there waiting to be found.

(apologies if the 0.5/2.5 isn't quite accurate, the numbers are buried in this thread someplace..)

G
Think you will find it was 0.6 max at normal speed as "original"

It morphed to 2.5 at a double speed and repetitive.

or close to that still secret stuff.
Bend alot is offline  
Old 23rd Jun 2019, 11:04
  #571 (permalink)  
 
Join Date: Jan 2006
Location: Sydney Australia
Posts: 2,302
Received 9 Likes on 4 Posts
Originally Posted by edmundronald
Who knew all about MCAS?

Boeing's chief test pilot of the time knows all the plane's weaknesses. In the interest of public safety he should be given immunity and extensively debriefed about the plane and the certification process so that both the airframe and the FAA can be fixed.

Edmund
Agree, but how would his legal team choose to spin it?

Our client cannot be held responsible because he could not have predicted the possible outcome. Or...,

Our client cannot be held responsible because his technical and Human Factors expertise had been overwhelmed by corporate expectations.

Mmm? Incompetence, or Ethical blindness. Tough, but obvious choice.

KRUSTY 34 is offline  
Old 23rd Jun 2019, 11:12
  #572 (permalink)  
fdr
 
Join Date: Jun 2001
Location: 3rd Rock, #29B
Posts: 2,944
Received 847 Likes on 251 Posts
Seattle Times

Originally Posted by bill fly
This is probably the most informative and best researched information to appear in this sorry matter.

Apart from one small confusing paragraph about the AoA on the instrument panel it is a valuable contribution - possibly more so than the accident reports will prove to be.

Perhaps the most significant lesson to be taken from the article is the assumption that within three seconds, pilots will recognise and deal with a trim runaway. That may be the case taken as a single failure but in the context of the cockpit environment in this case of MCAS activation, where the crew was already trying to deal with a rogue stall warning, in an after takeoff phase etc., it was just one more item on a loaded list and three seconds was not enough for recognition and action. Meantime the controls get heavier and MCAS repeats...

The cause of all this chaos was the same - the AoA failure. It didn’t just set off MCAS - it set off multiple spurious warnings. It did this on three known occasions and only when a third pilot was available could the situation be partially defused. That took more than three seconds too...

So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.

As for the company culture, others are already commenting on that aspect.
The ST story is a road map to what happened, and is the starting point for the rectification of the system that existed at that time. The 3 seconds is that noted in 25.255(a), irrespective of the opinion of that regulation being directly or indirectly related to the problem, it is the only part of the rules that gives guidance on compliance for an out of trim case, whether taht cause is by the pilots thumb as zzuf has maintained it pertains to.... The further concern on the lack of robustness of the regulatory requirement is that 25.255 requires a demonstration using a mis trim for the time, 3 seconds, at the rate applicable to the airspeed that the aircraft is at, and MCAS drilled a big hole in the middle of that assumption, it had a greater rate and authority than was envisaged with the drafting of 25.255, which did indeed arise from early jet upsets from the pilot incorrect input as much as runaway trim systems. 25.255 needs to be reinforced, and that then raises the matter of all manual trim systems being inherently compromised without special training, the matter recognised in this forum at least from the old timers experience, lost in the march of time.

3 seconds

OK, for a reject we expect the crews to react promptly, however, all up there is considerable delay for recognition, cognition and physical initiation of the response. Crews often do react promptly to the canned, pre-primed decision making and process that is routinely briefed in full before each takeoff, including a run through of the exact actions that the crew will undertake. Even so, as often as not, the crew do not respond as briefed, and the decisions occur over a longer period of time than was envisaged, and, in testament to the ingenuity of humans, the response is quite often not as briefed and trained, it is a solution determined on the day, under the stress of the moment. The DER of runways all around the world are littered with evidence of the occasions where human variability comes into play (as well as how often the performance information and analysis is flawed).

Crew response within 3 seconds for a runaway trim is inadequate. The crews in the cruise are not set up poised to hit the cutouts; crew activity routinely takes half of the crew out of the direct loop dealing with other matters beyond the flying of the aircraft, and the remaining pilot whether 200 hours or 20,000 hours is not sitting on a hair trigger response to intervene on the runaway.

Crew response to a fire warning takes an inordinate amount of time, and oddly, it takes longer in the real world events than it does in the simulator. In the real world, on the number of debriefs post such events, looking at what the crew actually did vs the QRH procedure, the crew often rationalise that the warning is false, and that they have taken a process that is different to the QRH to ensure that they do not respond to an false warning. That is admirable in saving on fire bottle squibs, refills and possible engine shop visits, but it is not what the procedure is designed to be followed. This variation is observed in punitive corporate cultures, where one would expect that compliance with the procedure would be iron clad, yet it is not, the crews act to ensure their heads do not rise above managements parapet. Relevance to runaway trim, MCAS etc?, well, 25.255 intimates a 3 second response time, and the probability is that you will routinely exceed that by a large margin. You will also see crew response by other means, such as elevator input, which is often the immediate response to an autopilot attitude error, contrary to the standard procedure in most systems. Variability of crew response needs to be considered to a greater extent, unless the training is explicit in demonstrating the need for timely response, and that the response is simple, and reliable. At present, the MMEL permits the despatch of a Max with one yoke trim switch inoperative, any operator should consider the impact of the other sides pilot being in the galley or head and what the impact would be to the response time... or simply amend the MEL to preclude despatch with any yoke trim switch inoperative.

The Max can be flown safely today with awareness; the crew training however is necessary to make that reliably the outcome, and the architecture of the system needs to come into compliance with 25.671 and 672 as far as unmistakeable warning of a SAS system failure. Respectfully, all B737 operators should consider reviewing the out of trim case disregarding MCAS, and ascertain whether training to ensure crew can recover manual trim operation can occur in the event of a severe out of trim case. Regulators need to be involved in ascertaining whether the inherent weakness that exists in that area is acceptable or not; personally, I think that it needs to be incorporated into training matrices promptly for the peace of mind of the public, the confidence in the system and in and of the pilots who operate these aircraft every day. The training overhead to accomplish the defence from this issue is not onerous, and it is at least as rational a use of FFS time as flying warm and fuzzy CRM vignettes which can be done as or more effectively in a cardboard bomber, FBS, FTD, or PC with a generic sim program. FFS, notwithstanding the limitations of the slip between QTG accepted aero-model dynamics and the real world, and the issues pertaining to the edge of envelope are worthwhile assets to the industry that are squandered by the lack of common sense in training requirements to achieve the training objectives.

It is quite possible that the industry will be better for the painful experience that it has just gone through. Faith in the OEM however is further eroded by their continued litany of lapses of judgement and questionable ethics that appear to be systemic; every few years a new saga erupts onto the public stage, and the OEM vows to cure their ethical lapses, it is time to get serious about doing so, and perhaps they can start by reflecting on their response to their QA staff that they acted so disgracefully against on the NG ring frame saga. Show some spine, and make your company what it needs to be, not what it has devolved into.








fdr is offline  
Old 23rd Jun 2019, 12:51
  #573 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by KRUSTY 34


Agree, but how would his legal team choose to spin it?

Our client cannot be held responsible because he could not have predicted the possible outcome. Or...,

Our client cannot be held responsible because his technical and Human Factors expertise had been overwhelmed by corporate expectations.

Mmm? Incompetence, or Ethical blindness. Tough, but obvious choice.

























An offer of immunity to the chief test pilot is in the public interest. Nobody asks the lawyers to spin it, he gets immunity so all the weaknesses in the plane get located and fixed.

There are undoubtedly other booby traps hidden in that plane. They need to be found and fixed, this guy knows where they are.

I've sat on standards bodies as an engineer. I believe if something is a real issue, there are always "nudge nudge wink wink" engineer to engineer methods to get tech issues fixed across the industry, one of the nastiest of which is just talking to a friend who works for a competitor, who has a friend in the specialist press. My feelings is that if he wanted to, the Chief Test Pilot at Boeing had discrete ways to get the FAA to have a hard look at MCAS and get Boeing to make it robust or add training materials without making too many waves.

Boeing certainly had the ability, resources and even time to solve a few more "minor bugs" before launching the plane. This is what engineering firms do, they polish the design until it is good. the Chief Test Pilot's job is to tell them if it's good, in this case he can tell us for safety's sake what was left undone. .

Edmund

Last edited by edmundronald; 23rd Jun 2019 at 13:30.
edmundronald is offline  
Old 23rd Jun 2019, 13:12
  #574 (permalink)  
 
Join Date: Jun 2002
Location: Scotland
Posts: 39
Received 0 Likes on 0 Posts
Continuing talk about pilots having to interpret matters within a very short period of time. Is there not a case for an alert in the cockpit that MCAS (MCAS 2.0?) is active?
dufc is offline  
Old 23rd Jun 2019, 13:35
  #575 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 2,451
Likes: 0
Received 9 Likes on 5 Posts
Originally Posted by dufc
Is there not a case for an alert in the cockpit that MCAS (MCAS 2.0?) is active?
Not for MCAS, providing the modifications provide sufficient protection; MCAS becomes a background function similar to STS. No action required no alert required; MCAS ‘off’, pilot awareness.

However, for trim runway there is a strong case for an alert, particularly in the difference between the 737 and the less severe systems, and also those aircraft fully protected. Urgent action required, clear unambiguous alert required, but how.

The difficulty is with how to detect a trim runaway which is essentially a single strand system; the human is a superior detector, but unreliable, requires mental attention and time.
Adding more safe guards must not generate more failure paths.

safetypee is offline  
Old 23rd Jun 2019, 13:46
  #576 (permalink)  
 
Join Date: Jan 2008
Location: USA
Posts: 33
Received 0 Likes on 0 Posts
Originally Posted by Bend alot

* Is there any reason a NG simulator can not be programmed to be a MAX? There is very little cosmetic differences in the cockpit.
I know for the jet I fly that we "fly" it as a P&W powered model. If the maintainers of the plane train on it as a GE powered version, the sim needs a full reboort, which takes at least 20 minutes.

Might be just part of the reasons.

I've had to wait on that
moosepileit is offline  
Old 23rd Jun 2019, 15:15
  #577 (permalink)  
 
Join Date: May 2019
Location: Somewhere over the rainbow...
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
According to a document reviewed by The Seattle Times, Boeing’s safety analysis calculated this hazardous MCAS failure to be almost inconceivable
Inigo Montoya: "You keep using that word. I do not think it means what you think it means."

yoko1 is offline  
Old 23rd Jun 2019, 15:20
  #578 (permalink)  
 
Join Date: Jun 2019
Location: leftcoast
Posts: 18
Likes: 0
Received 0 Likes on 0 Posts
An offer of immunity to the chief test pilot is in the public interest. Nobody asks the lawyers to spin it, he gets immunity so all the weaknesses in the plane get located and fixed.
Just a guess- all those named in the Seattle Times article have already provided testimony to the authorities or their names would not be revealed.
You can be absolutely sure that Boeing is carefully monitoring all employees possibly involved not only on company computers and just barely within legal limits.

Months ago, the Seattle Times revealed a grand jury investigation had started.
billybone is offline  
Old 23rd Jun 2019, 15:57
  #579 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
Nose pitches up....High AoA and High G stall...

"The lack of smooth feel was caused by the jet’s tendency to pitch up, influenced by shock waves that form over the wing at high speeds and the extra lift surface provided by the pods around the MAX’s engines, which are bigger and farther forward on the wing than on previous 737s."

Low speed stall

"The flight-test pilots had found another problem: The same lack of smooth stick forces was also occurring in certain low-speed flight conditions. To cover that issue too, engineers decided to expand the scope and power of MCAS.

Because at low speed a control surface must be deflected more to have the same effect, engineers increased the power of the system at low speed from 0.6 degrees of stabilizer nose-down deflection to 2.5 degrees each time it was activated."

So now, we are getting a clearer picture of how it went from 0.6 to 2.5 degrees. According to the article, they first attempted to fix the problems by adding vortex generators and changing the wing, that did NOT work. They chose software.
Changing the wing design? This does not sound like an aerodynamically stable aircraft to me...

The class action suit by the 400 pilots is from AUS?

Spokespeople for the pilots' legal team — Queensland's International Aerospace Law and Policy Group (IALPG) and Chicago's PMJ PLLC
Smythe is offline  
Old 23rd Jun 2019, 16:50
  #580 (permalink)  
 
Join Date: May 2019
Location: Somewhere over the rainbow...
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Smythe
This does not sound like an aerodynamically stable aircraft to me...
You are conflating the concepts of aerodynamic stability and linear feel response. MCAS was created to address the second, not the first, issue.
yoko1 is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.