MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
Join Date: Jul 2019
Location: FL
Posts: 16
Likes: 0
Received 0 Likes
on
0 Posts
As disappointing as the saga of the MCAS is, the subject of the rudder control runs and the perception of a threat from a liberated fan blade should be considered rationally. A mob lynching doesn't assure the industry achieves what it needs, and would almost certainly lead to unintended consequences in due course.
MCAS's morphing of design wth what appears to be inadequate hazard analysis was disastrous. It is interesting to follow the discussion that arises on the altered relationship of the manufacturer to the regulator due to the ODA approval process. EASA has an equivalent process, DOA, for exactly the same reasons, and dependent on the same safeguards. ODA/DOA depend on a robust QA process, and it is that part that has let loose in the Max case. The regulator change to ODA/DOA is a consequence of rational realisation that the regulators are starved of manpower being unable to compete in most cases with the industry salaries. Adequate oversight requires retaining competency and staffing levels that is not possible in the current minimum funding of regulators. In principal, with good QA oversight, the ODA/DOA system in a substantial improvement over previous processes, but the entity's ethics on QA is central, and TBC's history of abuse of QA engineers places some doubt on that; they need a corporate clean out of ethics for real, not a repeat of the last effort arising from the KC-767 saga, where there was no acknowledgement of their actions on the B737 parts fabrication scandal.
The rudder... For 50+ years the plane in question has flown without an incident of a primary control being severed by an uncontained fan failure. The engine and nacelle design is supposed to protect from a liberated fan as part of the certification requirement. In the case of the 737, the SWA B737 in flight failure passing by Pensacola resulted in a fatality of a passenger, as had the MD82 disk failure years before. The risk to the aircraft that is not able to be mitigated arises from disk failure, not singular fan blades. In general, as seen on UAL232, QFA032, and the AA B767's, a disk failure is potentially a catastrophic event, the defence is not having them, and that comes from having good metallurgical design and processing, good structural design, and as much redundancy as possible in critical systems architecture. QFA032 showed that you can still have a bad day, and not just because the manufacturer is Boeing and the product is called a Max.
I would have more interest in sorting out the manual trim issues by at a minimum providing a training program to remove the cobwebs of time past than to worry over a fan blade issue, where the risk of a disk failure is vastly more problematic and almost impossible to mitigate, it is to be avoided.
MCAS's morphing of design wth what appears to be inadequate hazard analysis was disastrous. It is interesting to follow the discussion that arises on the altered relationship of the manufacturer to the regulator due to the ODA approval process. EASA has an equivalent process, DOA, for exactly the same reasons, and dependent on the same safeguards. ODA/DOA depend on a robust QA process, and it is that part that has let loose in the Max case. The regulator change to ODA/DOA is a consequence of rational realisation that the regulators are starved of manpower being unable to compete in most cases with the industry salaries. Adequate oversight requires retaining competency and staffing levels that is not possible in the current minimum funding of regulators. In principal, with good QA oversight, the ODA/DOA system in a substantial improvement over previous processes, but the entity's ethics on QA is central, and TBC's history of abuse of QA engineers places some doubt on that; they need a corporate clean out of ethics for real, not a repeat of the last effort arising from the KC-767 saga, where there was no acknowledgement of their actions on the B737 parts fabrication scandal.
The rudder... For 50+ years the plane in question has flown without an incident of a primary control being severed by an uncontained fan failure. The engine and nacelle design is supposed to protect from a liberated fan as part of the certification requirement. In the case of the 737, the SWA B737 in flight failure passing by Pensacola resulted in a fatality of a passenger, as had the MD82 disk failure years before. The risk to the aircraft that is not able to be mitigated arises from disk failure, not singular fan blades. In general, as seen on UAL232, QFA032, and the AA B767's, a disk failure is potentially a catastrophic event, the defence is not having them, and that comes from having good metallurgical design and processing, good structural design, and as much redundancy as possible in critical systems architecture. QFA032 showed that you can still have a bad day, and not just because the manufacturer is Boeing and the product is called a Max.
I would have more interest in sorting out the manual trim issues by at a minimum providing a training program to remove the cobwebs of time past than to worry over a fan blade issue, where the risk of a disk failure is vastly more problematic and almost impossible to mitigate, it is to be avoided.
The position of the engine is largely immaterial to the risk to the flight control cables - first, if the uncontained components head inboard towards the fuselage, there simply is not any wing structure in the way on any modern wing mounted engine installation. In fact, that's one reason why the engines get hung so far forward - moving the engine forward relative to the wing lessens the risk of catastrophic damage to the wing.
Burst components are broken down into different energy states - in brief, blades and the like are 'low energy' - you can take credit for shielding - rotors (assumed 1/3 disc) are 'high energy' - no credit for shielding. For purposes of rotor burst failure analysis, the fan hub is assumed to have infinite energy - wing spars or floor spars offer no protection.
The Advisory Circular for rotor burst calls for what's known as a 'one in twenty' analysis - in short, since the trajectories are unpredictable, you're allowed a 5% chance that the debris will take out something flight critical (e.g. a wing spar). Even if you meet 1 in 20, you're supposed to provide the maximum amount of 'practical' protection. However there is a proviso for how 'practical' providing additional protection would be - if it's judged to be impractical then you don't need to provide the additional protection even if it might mean not meeting the 1 in 20. One example I'm familiar with is you could potentially provide additional protection by putting critical engine components (FADEC, oil tank, that sort of thing) always on the outboard side of the engine - if the cross engine debris goes through the engine to take out the component, that engine is dead regardless. But it was judged to be impractical to mandate different engine builds for left and right hand engines relative to the small amount of additional protection in would provide.
In short, they only thing that would make the MAX worse than the NG for rotor burst would be the larger fan disc on the Leap - the wider path of a 1/3rd disc would slightly increase the risk to flight control cables relative to the CFM56-7.
I can see how they might conclude that the considerable effort (and risk - making major changes to a flight critical system has it's own risks) required to mitigate the small increase in risk due to the larger fan disc wasn't justified.
It wasn't a disc failure, and it was aileron, not rudder, but QF30 (the 747 oxy bottle depressurisation) had its starboard aileron cables cut. The effect of that was that there was no roll control from the starboard wing. But, nicely positioned on the other side of the aircraft, there was a second cable run for the port side roll control. From the cockpit perspective, roll control was sluggish, but otherwise pretty normal.
So, cables do get cut, and properly designed backup can neatly resolve it.
So, cables do get cut, and properly designed backup can neatly resolve it.
Join Date: May 2011
Location: Hampshire
Age: 76
Posts: 821
Likes: 0
Received 0 Likes
on
0 Posts
An ex Boeing engineer has spoken out about Boeing's business practices re the Max:
https://www.bbc.co.uk/news/business-49142761
https://www.bbc.co.uk/news/business-49142761
Join Date: Jul 2019
Location: Mass
Posts: 23
Likes: 0
Received 0 Likes
on
0 Posts
Normal takeoff profile would consist of a relatively steep climb followed by a slight power reduction from takeoff thrust to climb thrust with decrease in climb rate to accelerrate and retract the flaps followed by an increase climb once climb speed was achieved. There is a tendency for the 737 to sink during flap retraction which needs to be countered with appropriate control inputs. If the Captain was not used to hand flying through the clean up phase and was distracted by the stick shaker it is entirely possibly that he was tardy with making the appropriate control inputs to keep from sinking. As far as the overweight question Im sure that is one of things that the investigation will look at but it does not appear that the aircraft was underperforming.
Look at the comparisons of radar profiles Reuters published after the ET302 crash (I'm not allowed to post URL's yet so Google "ethiopian airlines reuters graphics"). The accident aircraft climbed at a much shallower rate than three of the four other flights out of Addis Ababa headed for Nairobi on March 7-8 (and also the Lion Air accident flight), and the one that had a similarly shallow climb profile had to delay its southbound turn until after it passed Yerer Mountain (perhaps that flight was overloaded too).
Did you look at the DFDR graphs in the Preliminary Report? You didn't respond to the point about the abrupt pitch up immediately upon take-off. Is it normal to have abrupt back pressure on the yoke, resulting in pitch up to 18-19 degrees followed immediately by abrupt forward pressure on the yoke? Isn't that at least suggestive of an underperforming airplane that barely made it off the ground before the end of the runway?
Nor did you respond to my weight calculations. Do you think 167 lbs./pax (including carry on) is reasonable? That is the Ethiopian AIB's position. What do you expect will change between the Preliminary Report and the Final Report? Would you agree to fly an airplane that is more than 2,000 lbs. over RTOW?
To be clear, I'm not accusing the crew of doing anything wrong during the take off and climb out. I'm suggesting that the airplane was overloaded, was not climbing normally, and that resulted in the captain requesting continued runway heading and announcing flight control problems before MCAS activated (as observed by Bend alot). I'm also asking whether that (rather than task saturation or tunnel vision) might explain the crew maintaining take off power throughout the flight.
Once all this is resolved the Max might be one one of the safest planes on the planet. The amount of detailed investigation and testing it’s gone through whilst being under a spotlight.
It seems to be very secretive except a unified re-certification ambition of regulators. Oh, and a software patch is ready (almost) to submit for testing.
Would anyone volunteer to fly on a 737 Max? Ever?
I most definitely would not. That is Boeing's problem. They can say "Safety is our Number One Priority" all they like but (more fool them) it wasn't and they've been caught cutting very dangerous corners.
I have thousands of hours in 747's - mostly in Command and quite a few as an FO on the 737-200 so I am a "Boeing person" but I would not trust them with whatever "fix" they come up with here.
I most definitely would not. That is Boeing's problem. They can say "Safety is our Number One Priority" all they like but (more fool them) it wasn't and they've been caught cutting very dangerous corners.
I have thousands of hours in 747's - mostly in Command and quite a few as an FO on the 737-200 so I am a "Boeing person" but I would not trust them with whatever "fix" they come up with here.
"Boeing's Killer Planes"
On BBC One's Panorama tonight (29 Jul 2019) at 20:30 BST, in a programme titled "Boeing's KIller Planes", reporter Richard Bilton investigates the fatal flaws of the Boeing 737 Max and asks whether Boeing should have done more to protect passengers.
See: https://www.bbc.co.uk/programmes/m00077cw .
See: https://www.bbc.co.uk/programmes/m00077cw .
I doubt that Panorama will be overly favourable to Boeing's cause, the title's a clue, but it will be interesting to hear how accurate it is and whether anything particularly new comes out. I doubt there will be much, if anything, new personally.
Join Date: Mar 2019
Location: Spokane, WA
Posts: 27
Likes: 0
Received 0 Likes
on
0 Posts
While I didn't work the MAX, I have worked uncontained rotor burst analysis.
The position of the engine is largely immaterial to the risk to the flight control cables - first, if the uncontained components head inboard towards the fuselage, there simply is not any wing structure in the way on any modern wing mounted engine installation. In fact, that's one reason why the engines get hung so far forward - moving the engine forward relative to the wing lessens the risk of catastrophic damage to the wing.
Burst components are broken down into different energy states - in brief, blades and the like are 'low energy' - you can take credit for shielding - rotors (assumed 1/3 disc) are 'high energy' - no credit for shielding. For purposes of rotor burst failure analysis, the fan hub is assumed to have infinite energy - wing spars or floor spars offer no protection.
The Advisory Circular for rotor burst calls for what's known as a 'one in twenty' analysis - in short, since the trajectories are unpredictable, you're allowed a 5% chance that the debris will take out something flight critical (e.g. a wing spar). Even if you meet 1 in 20, you're supposed to provide the maximum amount of 'practical' protection. However there is a proviso for how 'practical' providing additional protection would be - if it's judged to be impractical then you don't need to provide the additional protection even if it might mean not meeting the 1 in 20. One example I'm familiar with is you could potentially provide additional protection by putting critical engine components (FADEC, oil tank, that sort of thing) always on the outboard side of the engine - if the cross engine debris goes through the engine to take out the component, that engine is dead regardless. But it was judged to be impractical to mandate different engine builds for left and right hand engines relative to the small amount of additional protection in would provide.
In short, they only thing that would make the MAX worse than the NG for rotor burst would be the larger fan disc on the Leap - the wider path of a 1/3rd disc would slightly increase the risk to flight control cables relative to the CFM56-7.
I can see how they might conclude that the considerable effort (and risk - making major changes to a flight critical system has it's own risks) required to mitigate the small increase in risk due to the larger fan disc wasn't justified.
The position of the engine is largely immaterial to the risk to the flight control cables - first, if the uncontained components head inboard towards the fuselage, there simply is not any wing structure in the way on any modern wing mounted engine installation. In fact, that's one reason why the engines get hung so far forward - moving the engine forward relative to the wing lessens the risk of catastrophic damage to the wing.
Burst components are broken down into different energy states - in brief, blades and the like are 'low energy' - you can take credit for shielding - rotors (assumed 1/3 disc) are 'high energy' - no credit for shielding. For purposes of rotor burst failure analysis, the fan hub is assumed to have infinite energy - wing spars or floor spars offer no protection.
The Advisory Circular for rotor burst calls for what's known as a 'one in twenty' analysis - in short, since the trajectories are unpredictable, you're allowed a 5% chance that the debris will take out something flight critical (e.g. a wing spar). Even if you meet 1 in 20, you're supposed to provide the maximum amount of 'practical' protection. However there is a proviso for how 'practical' providing additional protection would be - if it's judged to be impractical then you don't need to provide the additional protection even if it might mean not meeting the 1 in 20. One example I'm familiar with is you could potentially provide additional protection by putting critical engine components (FADEC, oil tank, that sort of thing) always on the outboard side of the engine - if the cross engine debris goes through the engine to take out the component, that engine is dead regardless. But it was judged to be impractical to mandate different engine builds for left and right hand engines relative to the small amount of additional protection in would provide.
In short, they only thing that would make the MAX worse than the NG for rotor burst would be the larger fan disc on the Leap - the wider path of a 1/3rd disc would slightly increase the risk to flight control cables relative to the CFM56-7.
I can see how they might conclude that the considerable effort (and risk - making major changes to a flight critical system has it's own risks) required to mitigate the small increase in risk due to the larger fan disc wasn't justified.
"F.A.A. managers conceded that the Max “does not meet” agency guidelines “for protecting flight controls,” according to an agency document. But in another document, they added that they had to consider whether any requested changes would interfere with Boeing’s timeline. The managers wrote that it would be “impractical at this late point in the program,” for the company to resolve the issue. Mr. Duven at the F.A.A. also said the decision was based on the safety record of the plane."
They conceded, not that there was a very minor increase in risk, but that it did not meet FAA guidelines for flight control protection. That's a strong statement, and hard for me to reconcile.
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Mar 2007
Location: Europe
Posts: 256
Likes: 0
Received 0 Likes
on
0 Posts
One example I'm familiar with is you could potentially provide additional protection by putting critical engine components (FADEC, oil tank, that sort of thing) always on the outboard side of the engine - if the cross engine debris goes through the engine to take out the component, that engine is dead regardless.
Is Kevlar plating the fuselage in the plane of rotation practical in any way?
This really isn't a problem between different opinions or knowledge base of "engineers" (Boeing vs FAA engineers)
This is a problem related to a process by which the FAA resolved the differences in opinions without a deeper audit of Boeing's knowledge base.
I accept that the FAA knowledge base is below what the manufactures have. After all the manufacturers have access to tons more experience including development tests and analysis not in view of the FAA. So it was not difficult for FAA management to listen more to the Boeing engineers and how they addressed the means to meet the requirements of the FAA rules..
What we now seem to hear (at least from the press) is that the Boeing engineering community failed to confirm their application of knowledge through the pilots who actually do the test flying. So I have to ask the FAA where is the validation of a process that forces this verification of design intent via the in-house test pilots?
This is a problem related to a process by which the FAA resolved the differences in opinions without a deeper audit of Boeing's knowledge base.
I accept that the FAA knowledge base is below what the manufactures have. After all the manufacturers have access to tons more experience including development tests and analysis not in view of the FAA. So it was not difficult for FAA management to listen more to the Boeing engineers and how they addressed the means to meet the requirements of the FAA rules..
What we now seem to hear (at least from the press) is that the Boeing engineering community failed to confirm their application of knowledge through the pilots who actually do the test flying. So I have to ask the FAA where is the validation of a process that forces this verification of design intent via the in-house test pilots?
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
Maybe I'm just slow today, but I don't get how placing them outboard reduces the risk. If the rotor gives, the engine gives, and it doesn't matter if the FADEC is hit. Putting the FADEC inboard might even reduce the energy of the shrapnel a little bit. Now, the oil tank, I would prefer to put outside the plane of rotation just for the fire hazard it represents.
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
What we now seem to hear (at least from the press) is that the Boeing engineering community failed to confirm their application of knowledge through the pilots who actually do the test flying. So I have to ask the FAA where is the validation of a process that forces this verification of design intent via the in-house test pilots?
With respect, I don't think any test pilots on the MAX program, B or FAA, experienced an uncontained engine failure while test-flying the aircraft. Even if they had, their experiences and observations might be valuable in some ways, but not with regard to the engineering question under discussion in this subthread.
Subthread ????
What subthread ?
Join Date: Mar 2014
Location: Birmingham, UK
Posts: 57
Likes: 0
Received 0 Likes
on
0 Posts
"Ex-Boeing engineer reveals even his own family won't fly on troubled 737 Max plane as he slams 'lack of resources' and 'incredibly pressurised' design process following two crashes
- Adam Dickson led team who worked on plane, which was grounded worldwide
- He said jet designed with 'system that didn't function properly or accurately'
- He said: 'My family won't fly on a 737 Max. The culture was very cost-centred'
- Boeing denied credibility of his account and said: 'We did not cut corners'
- Panorama: ‘Boeing’s Killer Planes' will be broadcast tonight at 8.30pm on BBC1"
Thread Starter
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Sorry if it wasn't clear. It's common usage in online forums to refer to discussions of particular topics within a forum thread as "subthreads." In this case, it was meant to refer to the discussion about the FAA dispute over the risk to the rudder cables from placement of the LEAP engines.
Early on, engineers at the FAA discovered a problem with one of the most important new features of the Max: its engines. The Max, the latest version of the 50-year-old 737, featured more fuel-efficient engines, with a larger fan and a high-pressure turbine. But the bigger, more complex engines could do more damage if they broke apart midair.