MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures

[DaveReidUK]

Originally Posted by MurphyWasRight

(From memory)
From discussion on older threads I don't believe we know for sure if the FDR trace reflects the stick tracer request/condition -or- the motor actually running, in other words not 100% clear what FDR would show if CB pulled.

I'd have thought that "remained active throughout the flight" meant exactly that.

[walkon19]

A Few Facts and Data re CFR re aeroplanes

https://www.law.cornell.edu/cfr/text/14/23.672

14 CFR 23.672 - Stability augmentation and automatic and power-operated systems

§ 23.672 Stability augmentation and automatic and power-operated systems.

If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with § 23.671 and the following:

(a) A warning, which is clearly distinguishable to the pilot under expected flight conditions without requiring the pilot's attention, must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system that could result in an unsafe condition if the pilot was not aware of the failure. Warning systems must not activate the control system.

(b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures without requiring exceptional pilot skill or strength, by either the deactivation of the system or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.

(c) It must be shown that, after any single failure of the stability augmentation system or any other automatic or power-operated system -

(1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;

(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configuration) that is described in the Airplane Flight Manual (AFM); and

(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.

[Doc. No. 26269, [url=[url]https://www.law.cornell.edu/rio/citation/58_FR_42164]58 FR 42164, Aug. 6, 1993]

http://www.law.cornell.edu/rio/citation/58_FR_42164




§ 23.672 Stability augmentation and automatic and power-operated systems.

If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with § 23.671 and the following:

(a) A warning, which is clearly distinguishable to the pilot under expected flight conditions without requiring the pilot's attention, must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system that could result in an unsafe condition if the pilot was not aware of the failure. Warning systems must not activate the control system.

(b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures without requiring exceptional pilot skill or strength, by either the deactivation of the system or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.

(c) It must be shown that, after any single failure of the stability augmentation system or any other automatic or power-operated system -

(1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;

(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configuration) that is described in the Airplane Flight Manual (AFM); and

(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.

[Doc. No. 26269, [url=https://www.law.cornell.edu/rio/citation/58_FR_42164]58 FR 42164, Aug. 6, 1993]

=====

Lionair prelim report

https://reports.aviation-safety.net/...RELIMINARY.pdf

and going to page 14 we find

[walkon19]

Originally Posted by Tomaski

Bill, not try to fence here. The preliminary has a figure showind FDR tracks for this flight and you can see where left stick shaker was on until landing. I'd post the page but havent figured out how to do that yet. Maybe someone else could.

Ok here is the previous flight from the prelim report

[Smythe]

it was this theory of commercial trumps engineering nerds that created the reliance on the single AoA, poor training, poor certification docs etc etc in the first place, and killed 300+ people. The re-learnt lesson at B should be "listen to the engineering nerds and if they say no it means no".

"no means no" = $ vs $$$$$$

who won?

As rick stated, Boeing, has for years, treated the engineers as flotsam and jetsam...look at the results, the latest aircraft are crap...the existing 773 is a passenger nightmare, center overheads, tail wagging like a dog in turbulence...absolutely worst handling in turbulence I have flown
in reality, another over extended pax nightmare..cant wait for the even longer MAX and 777X...

flew the 321neo 2 days ago, sooo quiet, big seats, and lots of space....

Boeing is out of hand with extending old variants. Especially knee jerk variants.

[RickNRoll]

Originally Posted by groundbum

it was this theory of commercial trumps engineering nerds that created the reliance on the single AoA, poor training, poor certification docs etc etc in the first place, and killed 300+ people. The re-learnt lesson at B should be "listen to the engineering nerds and if they say no it means no".

G

And respect the need for experience. Don't treat them like a commodity you can buy like candy.

[bill fly]

Originally Posted by Tomaski

Bill, not try to fence here. The preliminary has a figure showind FDR tracks for this flight and you can see where left stick shaker was on until landing. I'd post the page but havent figured out how to do that yet. Maybe someone else could.

Fence? In the first post on this I asked if we were sure about the shaker.
Got the first answer that crews wouldn’t want to disable because it might look bad afterwards and on that basis said he may as well have done it - because not reporting looks bad afterwards too.
Anyway the first question has now been answered. Thanks for the links.
B

[Mac the Knife]

Do my eyes deceive me?

"14 CFR 23.672 - Stability augmentation and automatic and power-operated systems
a) [snip][/snip] Warning systems must not activate the control system."

I'll go and get my specs. Maybe I've got the wrong end of the stick.

Mac

[HighWind]

Originally Posted by Mac the Knife

Do my eyes deceive me?
"14 CFR 23.672 - Stability augmentation and automatic and power-operated systems
a) [snip][/snip] Warning systems must not activate the control system."

I'll go and get my specs. Maybe I've got the wrong end of the stick.
Mac

What is meant by ’Activate the control system’?
Are the system not allowed to perform control based on erroneous sensor data, i.e. have to perform fault insulation? (Logical)
Are the system not allowed to ‘Activate’ another control strategy, i.e. perform fault insulation by ‘failing silent’, and perform gracefully degradation like transitioning from Normal to Alternate mode? (Illogical)
Or are the system not allowed to ‘Activate’ another sensor channel, i.e. perform fault insulation by voting in another sensor, and thereby ‘Failing active’? (Illogical)

[Tomaski]

Originally Posted by Mac the Knife

Do my eyes deceive me?

"14 CFR 23.672 - Stability augmentation and automatic and power-operated systems
a) [snip][/snip] Warning systems must not activate the control system."

I'll go and get my specs. Maybe I've got the wrong end of the stick.

Mac

Im not exactly sure if this is what the wording means but the stick shaker and MCAS have different logic circuits to activate. Stick shaker does not activate MCAS directly however both rely on AOA input so as we learned a single bad input can activate both.

[infrequentflyer789]

Originally Posted by HighWind

What is meant by ’Activate the control system’?

My reading: if the system is known to have failed, it must warn of failure and fail inactive, and not activate just-in-case it might have been needed.

Are the system not allowed to perform control based on erroneous sensor data, i.e. have to perform fault insulation? (Logical)

If the system detects erroneous sensor data and issues a warning of this, then it shouldn't activate based on that known erroneous data. If the data isn't known to be bad, say if it runs off one AOA sensor, then no warning and it can activate away...

Are the system not allowed to ‘Activate’ another control strategy, i.e. perform fault insulation by ‘failing silent’, and perform gracefully degradation like transitioning from Normal to Alternate mode? (Illogical)

My guess is that this is allowed provided the degradation is notified (which effectively is the "warning"), and the backup/reversion system is then assessed separately (with that assessment tempered by the likelihood of ending up in that mode - it may not need to comply to the same extent provided there is a low likelihood reversion in the first place).

Or are the system not allowed to ‘Activate’ another sensor channel, i.e. perform fault insulation by voting in another sensor, and thereby ‘Failing active’? (Illogical)

Based on what existing systems do, voting out an anomalous sensor may not require a warning - that is the point of redundant systems. There may be a maintenance warning of some sort so that it is known that redundancy has been lost and something needs fixing to restore it... and not leaving unfixed until the next one fails (see e.g. Australian report on 9M-MRG). Of course when you get common-mode or byzantine failure and multiple sensors are voted out or the voting system decides it doesn't know what to trust, then you should be right back to giving a failure warning and failing inactive (in the case of a stability augmentation system).

[NWA SLF]

So much is written about the stupidity of a single sensor vs multiples. I have been a participants of many FMEAs where participants have gone through different scenarios ending up with the more inputs, the more possibility of failure. That was followed with brainstorming how to detect a failure with the possibility of adding an additional sensor (the 3 sensor deal) tripling the possibility of failure with developing a method to determine which was the bad sensor. Easy, right, the 2 that match must be right. But if its a critical item the analysis must then go on to 2 bad inputs and 1 good, how to determine that?

AOA sensors - where to place? Two on one side, one on the other? AOA sensors are often clipped by birds and the possibility of birds taking out 2 on one side while flying through a flock of birds is significant. Suddenly 2 sensors are bad, still keep those bad signals and ignore the one on the side that didn't take the hit?

Solution could be a sensor that is not affected by FOD. When performing a systems analysis FMEA and determine an item is critical, the people analyzing can drive themselves crazy trying to find the perfect solution.

I've been retired for 10 years so processes like the FMEA may now be obsolete. However the MAX was in development for 7+ years (everyone says rushed into production but at my company there would be 2 generations in that time or we would be out of business) so its possible that is how the system was analyzed.

I am amazed how quickly the people here can quickly call decisions made stupid without having gone through an analysis like I described. Its so easy to armchair quarterback.

How times have changed. 15 years ago the A330 had multiple unintended pitch down events. That was before I retired and was frequently flying trans-Atlantic flights on A330s. There was talk at the time about grounding the fleet but think of what it would do to the industry so they kept flying. Watching the Canadian series "Mayday" is scary learning that at that time, Airbus had no idea, never could identify the root cause, and kept the fleet flying while they redid the software. Knowing the unit was actually produced by Lockheed-Northrup - were they the software developers? What is the difference between actually crashing and avoiding the crash because of altitude? Same thing with the AF447 incident. Continued flying - why? I ask because I continued to fly A330 flights with some unusual flight events, learning later that NWA, my home town airline I was mostly forced to use, had experienced similar events but the crews reacted appropriately.

Monday I fly out on a Delta 767-400 and 2 weeks later return on an A-330. Wish instead I could travel on something truly safe like the Titanic!

[walkon19]

Solution could be a sensor that is not affected by FOD. When performing a systems analysis FMEA and determine an item is critical, the people analyzing can drive themselves crazy trying to find the perfect solution.

Such as an Inertial unit similar to that used on 777-787 ?

Introducing the 787 Tom Dodt

http://www.ata-divisions.org/S_TD/pd...ngtheB-787.pdf



Chief Engineer - Air safety Investigation

ISASI september 2011

Pages 39 thru 41




Common Mode Hazards to Pitot-Static sensors

- Mud Daubers

- Icing
- Hail
- Birds
- Taped Static Ports

- Volcanic Ash

- Radome failure

- Pitot covers

- Maintenance errors (pneumatic plumbing)

• 787 new capabilities for protection - Synthetic airspeed

- GPS altitude
- Common Mode Monitor




Calculated from angle of attack and inertial data




- AOA – voted dual sensors plus inertial data

- Accurate Coefficient of Lift (CL)
- Airplane Mass from FMC - Validated after Takeoff

• Algorithm developed for enhanced stall protection

• Avoid displaying data known to be bad
- Loss of valid voted VCAS = Display synthetic airspeed VSYN - Loss of valid voted PSTATIC = Display GPS altitude

[tdracer]

Originally Posted by Fly Aiprt

Precisely.
...People who do not retire, resign, get fired, admit any wrong doing...

Perhaps, but I know for a fact that at least one has attempted suicide in the aftermath, and others are receiving psychiatric care.
It might surprise you, but the people involved were not unfeeling robots.

[walkon19]

Originally Posted by tdracer

Perhaps, but I know for a fact that at least one has attempted suicide in the aftermath, and others are receiving psychiatric care.
It might surprise you, but the people involved were not unfeeling robots.

I would sincerely hope that Boeing is upfront about helping those who feel a sense of guilt despite being ignored or overruled, and had to choose between career and family and thier own personal sense of responsibility. Unfortunately - the real people responsible for the culture which was enforced ' or else ' probably dont care except for their golf game score.

[MemberBerry]

Originally Posted by tdracer

Perhaps, but I know for a fact that at least one has attempted suicide in the aftermath, and others are receiving psychiatric care.
It might surprise you, but the people involved were not unfeeling robots.

That's very sad. Unfortunately I suspect the people bearing the most responsibility are the ones showing the least remorse.

[groundbum]

Originally Posted by HighWind

What is meant by ’Activate the control system’?

I think a stabilizer could count as a control surface and therefore part of a control system...

I think the writers of the rule were trying to rightfully avoid having the tail wag the dog.

G

[tdracer]

Originally Posted by walkon19

Unfortunately - the real people responsible for the culture which was enforced ' or else ' probably dont care except for their golf game score.

I know a few of the senior people on the MAX program. I can pretty categorically state that is NOT the case.

[walkon19]

Originally Posted by tdracer

I know a few of the senior people on the MAX program. I can pretty categorically state that is NOT the case.

Please dont get me wrong - most of the "senior' management responsible for the "culture of profit above all " at the inception of MAX are gone- Can U spell McNearney, et al ?

And that includes those who worked hard to get rid of the DER types who could and did report to FAA and NOT thru ' management"

The article - opinion piece by stan Sorcher in the seattle times was on point - BTW I know Stan

[tdracer]

Originally Posted by walkon19

Please dont get me wrong - most of the "senior' management responsible for the "culture of profit above all " at the inception of MAX are gone- Can U spell McNearney, et al ?

And that includes those who worked hard to get rid of the DER types who could and did report to FAA and NOT thru ' management"

The article - opinion piece by stan Sorcher in the seattle times was on point - BTW I know Stan

I read Stan Sorscher's opinion piece as well - and think it was spot on (by the way, if you know him, I suspect he'd appreciate spelling his name correctly). But that change to a profit driven company that did engineering (instead of the other way around) wasn't McNearney's fault - it predated him quite a bit - falling directly at the feet of Phil Condit. Condit not only started the rot, he greatly accelerated the rot with the MacDac merger. Under McNearney, things actually got better compared to the train wreck of Condit and Stonecipher who not only caused the 787 fiasco but clearly implemented a 'shoot the messenger' approach to problem reporting.

I lived through the transition from FAA to delegated authority (morphing from a DER to an Authorized Representative - AR - in the process - all of which predated McNearney by a few years). It wasn't Boeing's idea - it was dictated by the FAA leaders in the other Washington (and was being pushed down to other airframers and engine manufactures as well). Most of the people who had to deal with the delegated authority (especially the ARs) hated it (me included).

[walkon19]

Originally Posted by tdracer

I read Stan Sorscher's opinion piece as well - and think it was spot on (by the way, if you know him, I suspect he'd appreciate spelling his name correctly). But that change to a profit driven company that did engineering (instead of the other way around) wasn't McNearney's fault - it predated him quite a bit - falling directly at the feet of Phil Condit. Condit not only started the rot, he greatly accelerated the rot with the MacDac merger. Under McNearney, things actually got better compared to the train wreck of Condit and Stonecipher who not only caused the 787 fiasco but clearly implemented a 'shoot the messenger' approach to problem reporting.

I lived through the transition from FAA to delegated authority (morphing from a DER to an Authorized Representative - AR - in the process - all of which predated McNearney by a few years). It wasn't Boeing's idea - it was dictated by the FAA leaders in the other Washington (and was being pushed down to other airframers and engine manufactures as well). Most of the people who had to deal with the delegated authority (especially the ARs) hated it (me included).

Re stan- yep my fat finger issue again.
BTW I was at the BA meeeting held in Huntsville in 2000 because of the strike ( hopefully to avoid protests as I recall ) and at which Phil extolled the virtues of Jack welch and the GE " way " - Travelled on the redeye with several of the SPEEA Staff and a then well known local reporter named Genna Had some interesting deaings with the Boeing brass ( after I retired of course ) re a saterical post in yahoo about Boeing laying off 110 percent of the workforce-. As to shoot the messenger- they also bayonet the stretcher bearers. And I'v gone toe to toe with Boeing law firm ( and won 3 of 4 times ) re pensions and benefits and shareholder proposals And in 2004, I was probably one of maybe one hundred to be hugged by Alan M ... story-reason not on topic here.

And also a moving issue re the DER-AR thing was the SPEEA strike.

My point is still the same - a few of the senior level grunts in the trenches most likely had to choose between certanity ( being sent to alaska to count snowflakes for two years temp duty ) by speaking up to power or the probablitly that maybe- just maybe based on past " history " of the NG, all would be OK.