Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Boeing Board to Call for Safety Changes After 737 Max Crashes

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Boeing Board to Call for Safety Changes After 737 Max Crashes

Old 27th Sep 2019, 00:48
  #61 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Aihkio
So nobody thought what would happen when the duty AoA sensor misbehaves for some reason, like getting stuck at lets say 25 deg. Multiple warnings and an activated MCAS. Maybe all primary sensors should be analysed.
Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:
  • Comparing AoA signals could generate a warning.
  • AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
  • A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
  • Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
  • Therefore Boeing choose not compare AoA
The design failures between a single faulty AoA sensor and continuous MCAS activation have not been fully revealed.

Last edited by CurtainTwitcher; 27th Sep 2019 at 01:09.
CurtainTwitcher is offline  
Old 27th Sep 2019, 01:27
  #62 (permalink)  
 
Join Date: Jul 2013
Location: Within AM radio broadcast range of downtown Chicago
Age: 72
Posts: 908
Received 39 Likes on 15 Posts
Originally Posted by lomapaseo
From my view this is not just a Boeing problem, but applies throughout the industry.

In my simplistic view, somehow we can no longer assume that the man machine interface will stop arguing to the point where the recovery is impossible. What does it take to teach the man otherwise?
On some distant sideline of the 40th ICAO Assembly, two very interesting events. One, a discussion with a rising, young leader of a Member State delegation, whose combined diplomatic and flight-training career exemplifies, by all accounts, how to get things in pilot training right - and though saying this ventures somewhat of an educated guess (I don't claim specific factual background knowledge) - getting things right within that country's system for training generally, not just her individually.
Second, a presentation by the DG of EUROCONTROL. In which the increasing role of automation was prominent.
Extraction of thread-related comment: as to the second event, the aviation safety ecosystem better get goin' on the advancement and refinement of the human factors subparts. Which aren't going away. Especially with the management and/or cultural issues laid bare at Boeing, and in the certification process.
As to the first, on one hand ICAO IATA ACI and the rest cheerily forecast large, large gains in traffic, and of course advocate for the capacity building needed to sustain it. But the pioneering spirit, and dedication, this young leader has needed to sustain just to establish a rightful place in international aviation diplomacy is telltale, perhaps. It reveals, I sometimes worry, that the flood of new pilots needed for that doubling of traffic will consist way too much of rote checklist types (to reiterate: the leader is highly well-trained) of any and all the many demographics involved. And saying, "oh you old weeping willow, don't fret none, it'll all be computerized." In Zuckerberg We Trust, I guess....thanks, but no thanks.
WillowRun 6-3 is online now  
Old 27th Sep 2019, 05:05
  #63 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 47
Received 0 Likes on 0 Posts
Originally Posted by CurtainTwitcher
The bullet points are:
  • Comparing AoA signals could generate a warning.
  • AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
  • A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
  • Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
  • Therefore Boeing choose not compare AoA
A bit out of order. The FHA said it was a major hazard so didn't need the comparison. That came first.

The AoA miscompare alert was already there* but MCAS didn't need to use it per the FHA. You don't just add stuff with no requirement and the FHA didn't support adding the requirement.

*I know the alert was not enabled. As discussed it was supposed to be. But again, it wasn't considered serious enough (FHA again) to rush the update.
ST Dog is offline  
Old 27th Sep 2019, 10:52
  #64 (permalink)  
fdr
 
Join Date: Jun 2001
Location: 3rd Rock, #29B
Posts: 2,985
Received 926 Likes on 271 Posts
Originally Posted by CurtainTwitcher

Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:
  • Comparing AoA signals could generate a warning.
  • AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
  • A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
  • Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
  • Therefore Boeing choose not compare AoA
The design failures between a single faulty AoA sensor and continuous MCAS activation have not been fully revealed.
Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.
fdr is offline  
Old 27th Sep 2019, 11:29
  #65 (permalink)  
 
Join Date: Jul 2003
Location: An Island Province
Posts: 1,257
Likes: 0
Received 1 Like on 1 Post
Asimov rule #1

Our industry is at the boundary of rule #1; technological capability, need for automation, economics, balanced by human judgement in complex processes of design, checking, testing, and approval.
Human judgement, either in these process or ultimately in operation (last opportunity to avoid / mitigate), is now limiting.
The critical issue is do we know that, wish to acknowledge that, or act, - but only with the illumination of hindsight.
We are the robots of our thoughts.

https://thenextweb.com/artificial-in...share%2Bbutton
Note the principles 1-6 from Cambridge, and problems to address 1-5 via Google.

Also;
https://www.scientificamerican.com/a...tter-solution/

alf5071h is offline  
Old 27th Sep 2019, 12:44
  #66 (permalink)  
 
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by fdr
Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.
Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.
Tomaski is offline  
Old 27th Sep 2019, 19:47
  #67 (permalink)  
 
Join Date: Sep 2019
Location: leftcoast
Posts: 2
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Tomaski
Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.
FWIW from this SLF engine-ear

Boeing analyzed what would happen if, in normal flight mode, MCAS triggered inadvertently up to its maximum authority and moved the horizontal stabilizer the maximum 0.6 degrees.

It also calculated what would happen on a normal flight if somehow the system kept running for three seconds at its standard rate of 0.27 degrees per second, producing 0.81 degrees of movement, thus exceeding the supposed maximum authority.
OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ...

But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"

seems that the higher math involved was beyond the management involved...
Grebe is offline  
Old 28th Sep 2019, 03:47
  #68 (permalink)  
 
Join Date: Oct 2001
Location: Lost, but often Indonesia
Posts: 656
Received 1 Like on 1 Post
"OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ..."

Not to mention at low level. A system that is unknown to the crew which aggressively and repeatedly tries to dive the aircraft at low level is insane and diabolical however which way people choose to look at it. Arguably, it is criminal..

All the rhetoric by some re pilot training/ incompetence/ error is just a smokescreen to cover the obvious. Poor management decision making/ leadership, poor aircraft design/ sloppy system design (MCAS), poor communication to Airlines/ pilots and complete fixation re the iPad training only mandate are among the causes of these tragedies.
Boeing designed a pig and the lipstick didn't work. The Swiss cheese had so many holes, it's not surprising they lined up..

Last edited by Octane; 28th Sep 2019 at 10:45.
Octane is online now  
Old 28th Sep 2019, 07:58
  #69 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Octane
The Swiss cheese had so many holes, it's not surprising they lined up..
These numbers telling, valid 1959 to 2017, as compiled by Boeing.

Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 2017


Another source, Airsafe.com has compiled 737-MAX departures at 0.65 million, and quotes a hull loss rate of 3.08 per million departures.


source: Airsafe.com Plane crash rates by model

Even more dramatic is the accident rate by phase of flight:




Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 2017


Last edited by CurtainTwitcher; 28th Sep 2019 at 08:12.
CurtainTwitcher is offline  
Old 28th Sep 2019, 13:19
  #70 (permalink)  
 
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Grebe
OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ...
Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.

That being said, it was still a terrible design to have an unknown "background" system input this much stab trim. Assuming the MAX does fly again, this large MCAS input will still be needed in an actual low-speed stall to address the control force issue at high AOA. Keep in mind that in an actual stall, MCAS is offsetting a lightening of the control forces, and not forcing the nose down. However, as I currently understand the system, when the pilots reduce the AOA to break the stall there would no longer be a nose up moment generated by the engine nacelles and the MCAS input would then effectively convert to a large nose down moment. That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver.
Tomaski is offline  
Old 28th Sep 2019, 13:36
  #71 (permalink)  
 
Join Date: Oct 2001
Location: Lost, but often Indonesia
Posts: 656
Received 1 Like on 1 Post
"That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver."

If that is so, it would contradict the whole rationale for the existence of MCAS in the first place..
Octane is online now  
Old 28th Sep 2019, 13:36
  #72 (permalink)  
 
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Tomaski
Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.
What about this "not and anti-stall device" thing, implying the MCAS is supposed to activate before a stall AOA is reached ?

Fly Aiprt is offline  
Old 28th Sep 2019, 14:13
  #73 (permalink)  
 
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Fly Aiprt
What about this "not and anti-stall device" thing, implying the MCAS is supposed to activate before a stall AOA is reached ?
First, a historical note - in the past, airliner stall avoidance training in the sim was directed at the "approach to stall" region. We never actual put the aircraft in the stall because 1) recognition and recovery prior to the stall was the objective, and 2) the sims were never programmed to simulate a full stall in the first place. Thus all the various stall-related warnings and system responses would actually kick in before a full stall was reached. In the aftermath of AF 447 the FAA mandated full-stall training, but that is just now coming on line due to the time required to gather accurate real world data and reprogram the sims.

The whole debate about whether MCAS is an "anti-stall" system is part semantic and part technical. If you browse through FAR Part 25, the particular section dealing with transport category aircraft certification, you will not find any requirement for an "anti-stall" system. On the other hand, you will find requirements for stability and control feel response as the aircraft approaches the stall. The only reason MCAS exists is to meet these requirements. It just so happens that in meeting these requirements, MCAS does assist with control and recovery through the approach to stall region - but technically it is not an "anti-stall" device. That being said, MCAS and a host of other warning indications and system responses in this area of the flight envelope do aid in the stall recovery and could be informally referred to as "anti-stall" devices. While they are technically correct, Boeing and their helpmates have not done themselves any favors by trying to win this technical argument with a largely non-technical audience.

Last edited by Tomaski; 28th Sep 2019 at 18:14.
Tomaski is offline  
Old 28th Sep 2019, 18:11
  #74 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"

seems that the higher math involved was beyond the management involved
It was first set at 0.6 for the high speed departure and maneuvering issues, which is reasonable.

THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.
The change was made apparently without regard to the flight conditions...

This is why you have 2.5 degrees at high speeds.
Smythe is offline  
Old 28th Sep 2019, 19:05
  #75 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 15,984
Received 306 Likes on 158 Posts
Originally Posted by Smythe
THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
DaveReidUK is offline  
Old 28th Sep 2019, 20:37
  #76 (permalink)  
 
Join Date: Mar 2002
Location: Florida
Posts: 4,569
Likes: 0
Received 1 Like on 1 Post
Originally Posted by DaveReidUK
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
In actual fact? or what the computer that's flying thinks?
lomapaseo is offline  
Old 28th Sep 2019, 20:42
  #77 (permalink)  
 
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by DaveReidUK
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
Coffin corner ?
Fly Aiprt is offline  
Old 28th Sep 2019, 21:08
  #78 (permalink)  
 
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by DaveReidUK
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
I would rate the most likely case would be an aircraft upset followed by an nose-low recovery at a speed approaching Va (max maneuvering). Not sure how often this sort of thing has happened in the real world, but the FAR certification requirement that drove the need for MCAS cannot be waived because the possibility of such an event is deemed unlikely.
Tomaski is offline  
Old 28th Sep 2019, 21:14
  #79 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
Wasnt it on DEP, where, at a certain point, the nacelles added lift and pushed it close to the stall envelope?

I thought it was on DEP when there was a climbing turn?
Smythe is offline  
Old 28th Sep 2019, 21:39
  #80 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Smythe
Wasnt it on DEP, where, at a certain point, the nacelles added lift and pushed it close to the stall envelope?

I thought it was on DEP when there was a climbing turn?
satcom Guru: 737 MCAS - Failure is an Option

Boeing describes MCAS as a result of a handling quality shortcoming encountered in an accelerated stall, that would be likely be tested as a wind-up turn. The pilot holds airspeed and progressively increases bank angle and back pressure to result in stalling at high load factors. The flight condition is most likely entered with the aft column travel beyond the column cutout threshold. If the aft column cutout was active, MCAS would be inhibited before it could do anything. For this reason, I think Boeing decided to disable the column cutout feature for MCAS, via autopilot software change.
CurtainTwitcher is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.