MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
Join Date: Nov 2000
Location: Canada
Posts: 603
Likes: 0
Received 0 Likes
on
0 Posts
An update:
[QUOTE][[h1]FAA says Boeing needs to mitigate a ‘potential risk’ in 737 Max before grounding order can be lifted
[QUOTE][[h1]FAA says Boeing needs to mitigate a ‘potential risk’ in 737 Max before grounding order can be lifted
Published 20 min agoUpdated 10 min ago
“The FAA is following a thorough process, not a prescribed timeline, for returning the Boeing 737 Max to passenger service. The FAA will lift the aircraft’s prohibition order when we deem it is safe to do so,” the agency said in a statement. “The FAA’s process is designed to discover and highlight potential risks. The FAA recently found a potential risk that Boeing must mitigate.”The issue was discovered during a simulator test last week, Reuters reported. The 737 Max has been grounded since March after two deadly crashes involving the plane. Regulators around the world have pointed to a software issue as a potential cause of the accidents.
Shares of the aerospace company dropped more than 1% following the news, but closed the day up.
“The safety of our airplanes is Boeing’s highest priority. We are working closely with the FAA to safely return the Max to service,” a company spokesperson said in a statement to CNBC.
—Reuters contributed to this report.
Two people briefed on the matter told Reuters that an FAA test pilot during a simulator test last week was running scenarios seeking to intentionally activate the MCAS stall-prevention system. During one activation it took an extended period to recover the stabilizer trim system that is used to control the aircraft, the people said.
It was not clear if the situation can be addressed with a software update or if it is a microprocessor issue, but Boeing has told the FAA it believes the issue can be addressed with a software upgrade.
A hardware fix could add new delays to the plane’s return to service.
/QUOTE]
Key Points
The Federal Aviation Administration said on Wednesday that is has found an issue with the Boeing 737 Max that the manufacturer must address before it lifts the national grounding order.- The issue was discovered during a simulator test last week, Reuters reported.
- Shares of the aerospace company dropped more than 1% following the news, but closed the day up.
“The FAA is following a thorough process, not a prescribed timeline, for returning the Boeing 737 Max to passenger service. The FAA will lift the aircraft’s prohibition order when we deem it is safe to do so,” the agency said in a statement. “The FAA’s process is designed to discover and highlight potential risks. The FAA recently found a potential risk that Boeing must mitigate.”The issue was discovered during a simulator test last week, Reuters reported. The 737 Max has been grounded since March after two deadly crashes involving the plane. Regulators around the world have pointed to a software issue as a potential cause of the accidents.
Shares of the aerospace company dropped more than 1% following the news, but closed the day up.
“The safety of our airplanes is Boeing’s highest priority. We are working closely with the FAA to safely return the Max to service,” a company spokesperson said in a statement to CNBC.
—Reuters contributed to this report.
Two people briefed on the matter told Reuters that an FAA test pilot during a simulator test last week was running scenarios seeking to intentionally activate the MCAS stall-prevention system. During one activation it took an extended period to recover the stabilizer trim system that is used to control the aircraft, the people said.
It was not clear if the situation can be addressed with a software update or if it is a microprocessor issue, but Boeing has told the FAA it believes the issue can be addressed with a software upgrade.
A hardware fix could add new delays to the plane’s return to service.
1> It is not very plausible that two separate crews comprised four trained, experienced, pilots all elected not to attempt to trim ANU (more than a sub-second blip) when presented with life-threatening ongoing opposing trim in clear conditions in sight of the ground, whilst simultaneously commanding nose up at forces likely not previously experienced.
2> The "blips" are present in the last seconds of both fatal accidents.
3> The "blips" are consistent with an initial ANU trim command, but each has no resulting actual ANU trim of any significance whatsoever, certainly nothing like that required to improve the situation they were presented with. See 1> above.
4> The "blips" are entirely consistent with a shorted and/or overpowered motor.
5> The "blips" look exactly as we would expect a command to an overpowered motor to record; a power spike then null.
2> The "blips" are present in the last seconds of both fatal accidents.
3> The "blips" are consistent with an initial ANU trim command, but each has no resulting actual ANU trim of any significance whatsoever, certainly nothing like that required to improve the situation they were presented with. See 1> above.
4> The "blips" are entirely consistent with a shorted and/or overpowered motor.
5> The "blips" look exactly as we would expect a command to an overpowered motor to record; a power spike then null.
Join Date: May 2019
Location: Somewhere over the rainbow...
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
In the absence of conclusive evidence that demonstrates with absolute certainty that the main electric trim system was 100% operative throughout all phases of both fatal accidents [for the record, there is none], investigators are left drawing probable conclusions based on the available evidence:
1> It is not very plausible that two separate crews comprised four trained, experienced, pilots all elected not to attempt to trim ANU (more than a sub-second blip) when presented with life-threatening ongoing opposing trim in clear conditions in sight of the ground, whilst simultaneously commanding nose up at forces likely not previously experienced.
2> The "blips" are present in the last seconds of both fatal accidents.
3> The "blips" are consistent with an initial ANU trim command, but each has no resulting actual ANU trim of any significance whatsoever, certainly nothing like that required to improve the situation they were presented with. See 1> above.
4> The "blips" are entirely consistent with a shorted and/or overpowered motor.
5> The "blips" look exactly as we would expect a command to an overpowered motor to record; a power spike then null.
6> The manual trim was also overpowered under the aerodynamic loads experienced at that time.
7> "Trim with me" is not the announcement one would expect to be made by a PF who's trim is functioning correctly.
8> The actions of the MS crew, including attempting to briefly trim AND in such a situation, are consistent with a crew dealing with an inoperable main electric trim in the ANU moment.
9> Both crews were aware that an 'auto' trim was trimming against them but were ultimately unable to prevent their aircraft from trimming them into the ground to their certain death and the demise of all onboard.
10> XAA's all around the world have grounded all aircraft of this type until further notice.
First, as to the anomalies you point to, we could get out our magnifying glasses and try to discern what was happening in the final moments of these flight, but that really isn't necessary. We can dispense with all the "blip" data you point to because they all occurred at speeds in excess of Vmo. From a certification standpoint, nothing is guaranteed outside the certification envelope, so no corrective action is warranted. Within the flight envelope, on the other hand, ever time we see evidence that the yoke trim switch was depressed, the stab moved as expected. Every time the yoke trim switch was used while MCAS was attempting to trim, the MCAS input stopped - just as designed.
Second, it seems that you are trying very hard to read into the data something that isn't there. I know it is hard to contemplate that the flying pilots (Lion Air First Officer, Ethiopian Captain) were not effectively use the main electric trim, but that really is the most straightforward answer to the data. That is a training issue, not a design issue.
Finally, and probably most significantly, it is important to note that the 737MAX and its related systems have been under a great deal of scrutiny for many months now. People and organizations with significantly greater knowledge and resources than us have been pouring over everything about the design, certification, training, and operations of this aircraft. There are two investigative bodies (Ethiopian and Indonesian) who are very motivated to find any exculpatory evidence that removes the crew as a factor in these accidents. There have been numerous informative investigative reports by outlets such as the Seattle Times, Wall Street Journal, Washington Times, and Aviation Week & Space Technology to name just a few. Every major certificating authority in the world is looking at this aircraft. Through all this, we have learned many, many things that shed light on problems with the MCAS design, the certification process, the simulators, and crew training. These authorities have publicly laid out their concerns about the type of things they would like to see addressed before the MAX is allowed to fly again.
Conspicuously absent from any of these discussions is any call by any authority for a redesign of the main electric trim system. I have heard of no one in a position of authority suggesting a problem with or a need to redesign any switches, relays, linkages, or motors related to the main electric trim system. If I missed something along these lines, please point me to the reference. If this were a Sherlock Holmes mystery, we could call this a case of the dog that did not bark. The dog isn't barking because there is nothing there.
There certainly are issues with the MAX that need to be dealt with. The main electric trim does not appear to be one of them.
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
June 26, 2019: FAA identifies new potential risk on Boeing 737 MAX.
The risk was discovered during a simulator test last week, which likely will prevent BA from running a certification test flight until at least July 8, according to the report.
The risk was discovered during a simulator test last week, which likely will prevent BA from running a certification test flight until at least July 8, according to the report.
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
Salute!
My point is that a failed flaps switch could allow MCAS operation at an AoA below the stick shaker. And our design data presented here indicates that MCAS activates a few degrees below the shaker, or am I way off about this? A/P status also in the same bin- does AP tell the MCAS that it is offline using morethan one signal?
All three episodes had the shaker from the get go due to a bad sensor. But knowledge of the MCAS was absent on the first three.
Gums.....
My point is that a failed flaps switch could allow MCAS operation at an AoA below the stick shaker. And our design data presented here indicates that MCAS activates a few degrees below the shaker, or am I way off about this? A/P status also in the same bin- does AP tell the MCAS that it is offline using morethan one signal?
All three episodes had the shaker from the get go due to a bad sensor. But knowledge of the MCAS was absent on the first three.
Gums.....
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
From the previously-linked Reuters story:
[. . .] Two people briefed on the matter told Reuters that an FAA test pilot during a simulator test last week was running scenarios seeking to intentionally activate the MCAS stall-prevention system. During one activation it took an extended period to recover the stabilizer trim system that is used to control the aircraft, the people said.
It was not clear if the situation that resulted in an uncommanded dive can be addressed with a software update or if it is a microprocessor issue that will require a hardware replacement.
In a separate statement, Boeing said addressing the new problem would remove a potential source of uncommanded movement by the plane’s stabilizer.
It was not clear if the situation that resulted in an uncommanded dive can be addressed with a software update or if it is a microprocessor issue that will require a hardware replacement.
In a separate statement, Boeing said addressing the new problem would remove a potential source of uncommanded movement by the plane’s stabilizer.
Join Date: Jun 2019
Location: leftcoast
Posts: 18
Likes: 0
Received 0 Likes
on
0 Posts
Yoko 1 post 669 26th jun 05 35 said "..
or 3000 feet. Normally cutting thrust will increase pitch DOWN. And MCAS apparently trimmed down much faster than yoke trim up.
Cutting all power ( both AP and Trim ) left only the awkward trim wheel- which at almost any speed above maybe 200 kts is very awkward and difficult at best. And making 10 to 30 turns or more to get to NEAR trim takes time.
And about the so called 3 second rule to discover and suitably correct all bells and whistles and flashing lights and nose down and pull up seems appropriate for which superhero ? Did somehow a zero get dropped over the years ?
So the FAA now discovers re simulator another problem- taking too long to correct ??
"In the case of any hand-flown maneuver the pilot should use the primary flight controls to set the aircraft " attitude, set the thrust to the desired power setting (full thrust in case of windshear or GPWS warning) and then trim accordingly "
Cutting all power ( both AP and Trim ) left only the awkward trim wheel- which at almost any speed above maybe 200 kts is very awkward and difficult at best. And making 10 to 30 turns or more to get to NEAR trim takes time.
And about the so called 3 second rule to discover and suitably correct all bells and whistles and flashing lights and nose down and pull up seems appropriate for which superhero ? Did somehow a zero get dropped over the years ?
So the FAA now discovers re simulator another problem- taking too long to correct ??
Join Date: Mar 2014
Location: Toronto
Age: 69
Posts: 41
Likes: 0
Received 0 Likes
on
0 Posts
Re: Hardware capacity
IIRC, the 737 computers use the old 80286 Intel processor. (Ah, those were the days; you could still access the I/O ports directly.) It is easy to see how adding extra tasks for each new 737 variant could lead to situation where interrupt requests (sensor failure, for example) are coming in more quickly than the processor can execute the Interrupt Service Routines. The growing stack will eventually overwrite the code. This could easily lead to "blips" like those observed in the FDR traces, where the pilot presses the yoke trim switch but nothing happens. Not enough harware capacity.
YYZjim
IIRC, the 737 computers use the old 80286 Intel processor. (Ah, those were the days; you could still access the I/O ports directly.) It is easy to see how adding extra tasks for each new 737 variant could lead to situation where interrupt requests (sensor failure, for example) are coming in more quickly than the processor can execute the Interrupt Service Routines. The growing stack will eventually overwrite the code. This could easily lead to "blips" like those observed in the FDR traces, where the pilot presses the yoke trim switch but nothing happens. Not enough harware capacity.
YYZjim
And the saga goes on. It remains inconceivable to me how they are able to certify a system that may, under the right circumstances, be flight critical and a single point of failure, and not be equipped with the required redundancy for that case. If a sensor disagree occurs and that takes the system offline, then it's not a viable safety critical system, that's an unnecessary add-on. So get that third vane in there and wired up and try again.
Re: Hardware capacity
IIRC, the 737 computers use the old 80286 Intel processor. (Ah, those were the days; you could still access the I/O ports directly.) It is easy to see how adding extra tasks for each new 737 variant could lead to situation where interrupt requests (sensor failure, for example) are coming in more quickly than the processor can execute the Interrupt Service Routines. The growing stack will eventually overwrite the code. This could easily lead to "blips" like those observed in the FDR traces, where the pilot presses the yoke trim switch but nothing happens. Not enough harware capacity.
YYZjim
IIRC, the 737 computers use the old 80286 Intel processor. (Ah, those were the days; you could still access the I/O ports directly.) It is easy to see how adding extra tasks for each new 737 variant could lead to situation where interrupt requests (sensor failure, for example) are coming in more quickly than the processor can execute the Interrupt Service Routines. The growing stack will eventually overwrite the code. This could easily lead to "blips" like those observed in the FDR traces, where the pilot presses the yoke trim switch but nothing happens. Not enough harware capacity.
YYZjim
I am sure nobody in the aviation world uses MS Windows on control computers - typically fail-safe control strategies involve three computers, all voting for control (to avoid byzantine failures) , and each of different binary compatibility and O/S origins, all running the same well -tested algorithm using different languages.
Join Date: May 2019
Location: Somewhere over the rainbow...
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Mar 2014
Location: Toronto
Age: 69
Posts: 41
Likes: 0
Received 0 Likes
on
0 Posts
Hello ve3id:
You are right about one thing -- nobody in the aviation world uses Microsoft Windows, or any other widely-used operating system, in airborne components. They write their programs directly in "machine code", or perhaps an assembler that is the humanized version of machine code. Nevertheless, the software designers have no choice but to use the "instruction set" that their chosen processor is based on. The 80286 has 200 or so basic codes in its instruction set. That's all she's got. Furthermore, the designer is constrained to use the "architecture" of that processor. The 80286, and its successors, have one kind of architecture (Von Neumann), in which the program, data and stack all occupy the same addressable memory. Not at all like the Harvard architecture found in many microprocessors. This has nothing to do with Windows.
Remember the descent of the Eagle to Tranquility? The 1201 and 1202 codes that scared Armstrong and Aldrin denoted exactly the kind of hardware limit I described. Luckily for them, whatever Interrupt Service Routines were being skipped because of the overload were low priority, so the landing continued.
(Incidentally, I'm va3aol.)
YYZjim
You are right about one thing -- nobody in the aviation world uses Microsoft Windows, or any other widely-used operating system, in airborne components. They write their programs directly in "machine code", or perhaps an assembler that is the humanized version of machine code. Nevertheless, the software designers have no choice but to use the "instruction set" that their chosen processor is based on. The 80286 has 200 or so basic codes in its instruction set. That's all she's got. Furthermore, the designer is constrained to use the "architecture" of that processor. The 80286, and its successors, have one kind of architecture (Von Neumann), in which the program, data and stack all occupy the same addressable memory. Not at all like the Harvard architecture found in many microprocessors. This has nothing to do with Windows.
Remember the descent of the Eagle to Tranquility? The 1201 and 1202 codes that scared Armstrong and Aldrin denoted exactly the kind of hardware limit I described. Luckily for them, whatever Interrupt Service Routines were being skipped because of the overload were low priority, so the landing continued.
(Incidentally, I'm va3aol.)
YYZjim
Join Date: Dec 2018
Location: 8th floor
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
'access the I/O ports directly': this needs a bit of explanation! If you are in kernel mode on any fit-for-use operating system, you can always access the I/O ports directly - how else do you do I/O at all? Or are you confusing the inadequacies of MS Windows of the 20286 era with the hardware itself?
I am sure nobody in the aviation world uses MS Windows on control computers - typically fail-safe control strategies involve three computers, all voting for control (to avoid byzantine failures) , and each of different binary compatibility and O/S origins, all running the same well -tested algorithm using different languages.
I am sure nobody in the aviation world uses MS Windows on control computers - typically fail-safe control strategies involve three computers, all voting for control (to avoid byzantine failures) , and each of different binary compatibility and O/S origins, all running the same well -tested algorithm using different languages.
With modern CPUs the I/O ports are on the same bus as the memory. The instruction set is backwards compatible so old software can still work the same way as before. However the modern architecture supports a new feature: I/O devices can read and write directly from/to memory, bypassing the CPU, which can be a huge benefit reducing CPU load during large I/O operations.
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Mar 2014
Location: Toronto
Age: 69
Posts: 41
Likes: 0
Received 0 Likes
on
0 Posts
Hello yoko1:
Re: No computers in that circuit
My only knowledge about 737 electrical systems comes from PPRUNE. (So I'm a fully-informed expert, right?) In the early days of this thread, back before Ethiopia, there was some discussion about the encoding of angular data produced by AOA sensors. The topic came up as one way to explain a constant difference between values reported by the port and starboard vanes, which is to say, a stuck bit.
Digitization of the AOA reading(s) is, presumably, a first step toward further computer processing. A number of schematics have appeared here on PPRUNE, but they seem to have focussed on the switching logic only, with little detail about where the airplane's own decision-making about MCAS takes place.
I have a very hard time believing that there is no digital computing anywhere in the trim circuit. I am mindful that the military versions of 737 MCAS do have the supplementary g-input that was originally proposed for the civilian MAX. That would have required a whole new layer of analysis and decision-making, and I would be surprised to find that task being by an analogue device. No, there have to be digital computers somewhere in the trim system, as the mechanism by which the airplane controls the trim when it is supposed to.
Perhaps the better question is this: When a pilot presses his yoke trim switch, does that action immediately energize the trim motor with current? Or, instead, is the pilot's action routed as an input to the trim computer, which actually controls the voltage applied to the trim motor? The difference could be fatal if the computer is too busy with other things to process the pilot's command first.
YYZjim
Re: No computers in that circuit
My only knowledge about 737 electrical systems comes from PPRUNE. (So I'm a fully-informed expert, right?) In the early days of this thread, back before Ethiopia, there was some discussion about the encoding of angular data produced by AOA sensors. The topic came up as one way to explain a constant difference between values reported by the port and starboard vanes, which is to say, a stuck bit.
Digitization of the AOA reading(s) is, presumably, a first step toward further computer processing. A number of schematics have appeared here on PPRUNE, but they seem to have focussed on the switching logic only, with little detail about where the airplane's own decision-making about MCAS takes place.
I have a very hard time believing that there is no digital computing anywhere in the trim circuit. I am mindful that the military versions of 737 MCAS do have the supplementary g-input that was originally proposed for the civilian MAX. That would have required a whole new layer of analysis and decision-making, and I would be surprised to find that task being by an analogue device. No, there have to be digital computers somewhere in the trim system, as the mechanism by which the airplane controls the trim when it is supposed to.
Perhaps the better question is this: When a pilot presses his yoke trim switch, does that action immediately energize the trim motor with current? Or, instead, is the pilot's action routed as an input to the trim computer, which actually controls the voltage applied to the trim motor? The difference could be fatal if the computer is too busy with other things to process the pilot's command first.
YYZjim
Join Date: Dec 2018
Location: 8th floor
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
There are a lot of variations on this theme, the most recent being I/O devices that can write directly to the CPU cache memory to improve performance even further. Anyway got too carried away, sorry for going off topic.
Join Date: Jul 2002
Location: Ireland
Posts: 596
Likes: 0
Received 0 Likes
on
0 Posts
The MAX will only fly again when all parties, including Boeing, are convinced that it is completely safe to do so.