MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
The Comet was grounded in April 1954 and resumed commercial service in late 1958 after extensive modifications and testing, so Boeing still have a long way to go. It's worth noting that during the grounding the British aircraft industry lost the lead to the Americans and never recovered.
As opposed to regulators banning their flight.
Join Date: Jan 2013
Location: Seattle Area
Posts: 263
Likes: 0
Received 0 Likes
on
0 Posts
BOAC voluntarily grounded their fleet after the first inflight breakup accident in January 1954. Operation resumed in March. The second accident happened on April 8, 1954, and the type was grounded by the British authorities immediately after that.
Join Date: Oct 1999
Location: UK
Age: 70
Posts: 288
Likes: 0
Received 0 Likes
on
0 Posts
I've stayed silent, and like many, simply followed this shambles aghast over the past year. I understand what happened and the holes in the cheese both technical, managerial and political that got us to this point. I accept that it may- may - just be statistics (rather than competency or training) that the two 737 max fatalities occurred outside the US. What i dont understand though is why, given the 737 max user base in the US, there wasnt a significant stream of precursor/near miss reports prior to the incidents or commentary after the incidents "oh, yeah that happened to us but we managed the situation". I may have missed that but it just seems.. odd. If the situation was so common that it lead to two very similar crashes within months, would you not have expected that the common mode causative factors, presumably present in the entire fleet, would have generated substantial numbers of near misses... and pre / post comment..?
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
I've stayed silent, and like many, simply followed this shambles aghast over the past year. I understand what happened and the holes in the cheese both technical, managerial and political that got us to this point. I accept that it may- may - just be statistics (rather than competency or training) that the two 737 max fatalities occurred outside the US. What i dont understand though is why, given the 737 max user base in the US, there wasnt a significant stream of precursor/near miss reports prior to the incidents or commentary after the incidents "oh, yeah that happened to us but we managed the situation". I may have missed that but it just seems.. odd. If the situation was so common that it lead to two very similar crashes within months, would you not have expected that the common mode causative factors, presumably present in the entire fleet, would have generated substantial numbers of near misses... and pre / post comment..?
1. AOA sensor failure are relatively rare, but do occasionally occur.
2. A number of AOA failures have been recorded on other aircraft, but mostly with benign outcomes.
3. On the new B737 MAX an AOA failure triggers MCAS, with every case producing a very serious outcome.
IMO this explains the lack of prior feedback as to the magnitude of the risk.
There are probably many other ways of explaining the story:
1. In Russian Roulette firing an empty chamber produces no result, so the incident is not reported.
2. In the Sherlock Holmes story of the dog who didn't bark in the night, you have to infer evidence from a negative result.
3. Draw up a fault tree, and analyse the prior probabilities with Bayesian Statistics.
4. The Swiss Cheese model requires all the factors to line up, for an accident to occur.
Edit: PEI_3721 In the absence of an accident investigation, there is no download from the FDR, so we have limited historical AOA data for reference.
Last edited by GordonR_Cape; 22nd Sep 2019 at 07:27.
Takwis, no disagreement with #2472, except that the issues are identified with hindsight. For real learning we need to understand the processes which enabled them; look from the other end of the tube. What was the situation at that time, as understood by those in the process.
The situation for most people in the process, as far as is known, all was well.
The design theory, engineering, safety assessment, and certification were all adequate, yet each had existing weakness and flawed reasoning. Most of these have been discussed add nauseam in various threads, except that we don’t yet know why latent factors were not seen or how all of the issues came together in such a critical way; there opens as ever, the human factor and speculation.
Safety should not be based on speculation.
TimTuffy, #2475
You provide a plausible, knowledgable view that opposed to trim speed stability, the dominant problem was manoeuvre stability.
Whilst a conventional approach might consider stick force / g, the Boeing solution was to substitute AoA for g, possibly with other non linear aerodynamic considerations. Thus in software terms instead of having a ‘g’ function (or ‘g’ plus AoA or bank angle) where a malfunction might be detected with multiple inputs, the lesser integrity of dual AoA was ‘overlooked’.
Some malfunction ‘protection’ was provided by the flap selection - when MCAS was required, opposed to higher integrity defences when MCAS (trim operation) was not required preventing operation with sensor failure. A side thought: what would have been the effect of a flap position sensor failure - false open at low speed - MCAS not required, or false closed, inhibited MCAS when required.
Bend alot, #2477, link
Pinkman / Gordon.
AoA failure, excepting that we don’t yet know the precise nature of the erroneous AoA input. Hardware, electrics / software - in which part of the system, the extent of any previous failures, critical or not so.
The situation for most people in the process, as far as is known, all was well.
The design theory, engineering, safety assessment, and certification were all adequate, yet each had existing weakness and flawed reasoning. Most of these have been discussed add nauseam in various threads, except that we don’t yet know why latent factors were not seen or how all of the issues came together in such a critical way; there opens as ever, the human factor and speculation.
Safety should not be based on speculation.
TimTuffy, #2475
You provide a plausible, knowledgable view that opposed to trim speed stability, the dominant problem was manoeuvre stability.
Whilst a conventional approach might consider stick force / g, the Boeing solution was to substitute AoA for g, possibly with other non linear aerodynamic considerations. Thus in software terms instead of having a ‘g’ function (or ‘g’ plus AoA or bank angle) where a malfunction might be detected with multiple inputs, the lesser integrity of dual AoA was ‘overlooked’.
Some malfunction ‘protection’ was provided by the flap selection - when MCAS was required, opposed to higher integrity defences when MCAS (trim operation) was not required preventing operation with sensor failure. A side thought: what would have been the effect of a flap position sensor failure - false open at low speed - MCAS not required, or false closed, inhibited MCAS when required.
Bend alot, #2477, link
Pinkman / Gordon.
AoA failure, excepting that we don’t yet know the precise nature of the erroneous AoA input. Hardware, electrics / software - in which part of the system, the extent of any previous failures, critical or not so.
Yes that link shows the BIG can of worms the FAA opened all by themselves - no assistance from Boeing.
I am not sure who has lost the way the most Boeing or the FAA, but both still seem far from understanding they have a problem - a very big problem.
That is the problem!
I am not sure who has lost the way the most Boeing or the FAA, but both still seem far from understanding they have a problem - a very big problem.
That is the problem!
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result ?
Bearing in mind that neither of the reports have been published yet, it would be safer to say that on the 737 MAX an AoA indication failure (not necessarily involving a defective vane/transmitter) may (depending on the magnitude and sense of the resulting error) trigger MCAS.
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result ?
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result ?
But no parts found on/near runway.
So how about a possible internal of aircraft AOA failure - Probe? Computer? Connector? Code?
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
Bearing in mind that neither of the reports have been published yet, it would be safer to say that on the 737 MAX an AoA indication failure (not necessarily involving a defective vane/transmitter) may (depending on the magnitude and sense of the resulting error) trigger MCAS.
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result ?
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result ?
Edit: As to why the known AOA failures only occurred on the captain's side of the aircraft, that may be a combination of bad luck, and the use of air-stairs on that side. There are no known cases where the AOA failed on the side that was not being used by MCAS.
Despite repeated requests, nobody on this forum has produced hard evidence, so we must assume that such data does not exist (partly for the reasons I mention above). Perhaps some events were noted anecdotally, but a full FDR download was not warranted, and the data was overwritten.
Edit: In theory there could have been a safety case for monitoring AOA data more closely, but given the other failures and delays in grounding the MAX, this is 20/20 hindsight.
Last edited by GordonR_Cape; 22nd Sep 2019 at 08:51.
Bend alot, #2489,
There have been extensive and knowledgable discussions on a range of possibilities for AoA malfunction in the technical forum.
Without supportive evidence from the investigations, supported by FAA, Boeing, etc, it might not be possible to form a public conclusion about the initiating factor.
There were hints in the proposed modifications, but since the first Boeing submission and FAA rejection, there is an ominous lack of official information.
A possible and highly speculative outcome is that the source or exact nature of the erroneous AoA input is not known, or insufficiently explainable for specific modification; or even unknowable, hidden in the depths of the system interaction.
Thus any solution likened to a ‘wet blanket’ pose considerable problems for certification (not entirely unknown), but also public, world-wide acceptably, led by the FAA with a tarnished credibility.
Gordon, re AoA monitoring.
I agree that safety case for most things can be generated with 20/20. However, given that the Max has sufficient electronic fault identification and logs, it would be practical for the manufacturer to access these in real time (cf Rolls Royce inflight engine monitoring). Even so there are issues of what should be done with the data, who chooses the trip values, and to what objective.
There are proposals for massive ‘reactive’ monitoring (EASA Data4Safety), but apart from the difficulties of managing Big Data, many, - most recent aviation accidents could be rejected as ‘noise in the data’, Black Swans, beyond the limits or assumptions of certification.
Afterall the Max met all requirements - until it didn’t
There have been extensive and knowledgable discussions on a range of possibilities for AoA malfunction in the technical forum.
Without supportive evidence from the investigations, supported by FAA, Boeing, etc, it might not be possible to form a public conclusion about the initiating factor.
There were hints in the proposed modifications, but since the first Boeing submission and FAA rejection, there is an ominous lack of official information.
A possible and highly speculative outcome is that the source or exact nature of the erroneous AoA input is not known, or insufficiently explainable for specific modification; or even unknowable, hidden in the depths of the system interaction.
Thus any solution likened to a ‘wet blanket’ pose considerable problems for certification (not entirely unknown), but also public, world-wide acceptably, led by the FAA with a tarnished credibility.
Gordon, re AoA monitoring.
I agree that safety case for most things can be generated with 20/20. However, given that the Max has sufficient electronic fault identification and logs, it would be practical for the manufacturer to access these in real time (cf Rolls Royce inflight engine monitoring). Even so there are issues of what should be done with the data, who chooses the trip values, and to what objective.
There are proposals for massive ‘reactive’ monitoring (EASA Data4Safety), but apart from the difficulties of managing Big Data, many, - most recent aviation accidents could be rejected as ‘noise in the data’, Black Swans, beyond the limits or assumptions of certification.
Afterall the Max met all requirements - until it didn’t
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
Out of interest, before the grounding were there any recorded instances of a more benign air data failure on a MAX, obviously without producing the JT/ET result
https://www.politico.com/story/2019/...ng-737-1266090
https://edition.cnn.com/2019/03/13/u...max/index.html
there is also this FAA AD:
"This proposed AD was prompted by reports of nuisance stick shaker activation while the airplane accelerated to cruise speed at the top of climb. This proposed AD was also prompted by an investigation of those reports that revealed that the angle of attack (AOA) (also known as angle of airflow) sensor vanes could not prevent the build-up of ice, causing the AOA sensor vanes to become immobilized, which resulted in nuisance stick shaker activation. This proposed AD would require a general visual inspection of the AOA sensors for a part number, and replacement of affected AOA sensors. We are proposing this AD to address the unsafe condition on these products.
The AD will apply to certain Boeing aircraft, including the 727, 757, 767-300, -300F and 400ER series."
https://simpleflying.com/faa-boeing-aoa-sensor/
Last edited by Smythe; 22nd Sep 2019 at 15:01.
Join Date: Mar 2010
Location: In the twilight zone
Posts: 252
Likes: 0
Received 0 Likes
on
0 Posts
May be it's been discussed before, but couldn't Boeing just remove the MCAS from the aircraft and have it operate without it? I guess if they haven't done it is because it can't be done. But I wonder why.
Join Date: Oct 2005
Location: Stockport MAN/EGCC
Age: 70
Posts: 991
Likes: 0
Received 1 Like
on
1 Post
David
The JT610 pilot did too, till he handed it over to the CP so he could look for a solution. I expect he could have kept it in the air til a solution was found had he stayed on the controls.
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes
on
0 Posts
No, 10-15 minutes until they finally disabled electric trim (like the prior flight) or went back to flaps down (which was briefly tried earlier),
Maybe I overestimate their problem solving ability.
Conjecture sure, but appears he had worked out it was trim commands and was correcting them maybe even figured out manual trim stopped the unwanted trim (he stopped it midway a few times).
The CRV transcript would shed light on that.
Maybe I overestimate their problem solving ability.
Conjecture sure, but appears he had worked out it was trim commands and was correcting them maybe even figured out manual trim stopped the unwanted trim (he stopped it midway a few times).
The CRV transcript would shed light on that.
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
Takwis, #2469, IFF789, #2467,
It is difficult to understand how MCAS is wrong in principle. As a fix for a stability problem identified during flight test, the design (theory) was adequate (expedient, quick, low cost) although an ‘inelegant patch’ compared with changing the underlying aerodynamics - aircraft structure.
The weakness of MCAS was in its implementation - engineering, and thence safety assessment and certification.
It is difficult to understand how MCAS is wrong in principle. As a fix for a stability problem identified during flight test, the design (theory) was adequate (expedient, quick, low cost) although an ‘inelegant patch’ compared with changing the underlying aerodynamics - aircraft structure.
The weakness of MCAS was in its implementation - engineering, and thence safety assessment and certification.
For the avoidance of doubt: I don't think moving the stab to augment pitch control forces is wrong in principle, bypassing trim/pitch control safety systems to do it, is. You may consider that part of the implementation rather than the design - in which case we more or less agree. I note that STS, including the "stall-id" function, which trims down close to stall AOA, does NOT bypass the column cutout. So, why did MCAS? That is the point it becomes, to me, wrong in principle. It appears that it was fundamental to its operation that it had to bypass pitch-control safety, in which case MCAS could not exist if it was done right - hence why I said MCAS was wrong.
It is not only wrong from a safety point of view either, it's also wrong from an effectiveness point of view. After all, this is a system which, even if it can't be overridden by the control column, does have an off-switch. If we assume the level of pilot competency (and maybe country of origin) which Boeing designers seem to have been assuming, and that, as per Tawkis #2469, the manual still documents the column cutout safety feature (without exception for MCAS, which is undocumented), then MCAS cannot possibly work. Why? - because the pilot that sees the aircraft trimming nose down with stick full back will diagnose trim runaway and immediately switch it off. Furthermore, they may then go on to run into what MCAS was supposed to protect them from - because there are no documented restrictions on flight envelope after you've hit the stab cutouts.
An outstanding puzzle is why MCAS is based on AoA opposed to speed in order to cure what appears to be deficient trim-speed stability. From this arises the (false) association with stall issues, yet the existing stall alerting and protection systems remain unchanged.
Since Boeing apparently didn't even fully document those changes to the FAA, let alone to the rest of us, I would suggest that we don't know whether published/public information about MCAS, from whatever source, actually refers to MCAS-as-originally-designed or MCAS-as-delivered. I now include "MCAS is not about stall protection" in that category as well - MCAS-as-designed, yeah I'll buy "not about stall", MCAS as modified and delivered but not documented to the FAA? - absolutely no idea.
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes
on
0 Posts
Are you sure you do not underestimate the problem ? Did you really have a clear understanding of the situation before reading hundreds of posts on PPRuNe ?
It would help if you could support the idea with pointing us to any pilots having been successful with such a complex situation - even in the sim.
Some proven US pilots seem to think otherwise, like pilot union representatives, pilots having successfully ditched a liner, etc.
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes
on
0 Posts
After all, this is a system which, even if it can't be overridden by the control column, does have an off-switch. If we assume the level of pilot competency (and maybe country of origin) which Boeing designers seem to have been assuming, and that, as per Tawkis #2469, the manual still documents the column cutout safety feature (without exception for MCAS, which is undocumented), then MCAS cannot possibly work. Why? - because the pilot that sees the aircraft trimming nose down with stick full back will diagnose trim runaway and immediately switch it off. Furthermore, they may then go on to run into what MCAS was supposed to protect them from - because there are no documented restrictions on flight envelope after you've hit the stab cutouts.
Indeed what you mention here has been nagging at me for a while.
The MCAS principle doesn't make sense : can't be overridden with the yoke because they say it must stay active, but can be deactivated with pedestal switches...
Last edited by Fly Aiprt; 22nd Sep 2019 at 17:07. Reason: Typo