Boeing Board to Call for Safety Changes After 737 Max Crashes
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
The bullet points are:
- Comparing AoA signals could generate a warning.
- AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
- A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
- Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
- Therefore Boeing choose not compare AoA
Last edited by CurtainTwitcher; 27th Sep 2019 at 01:09.
Join Date: Jul 2013
Location: Within AM radio broadcast range of downtown Chicago
Age: 71
Posts: 850
Received 0 Likes
on
0 Posts
From my view this is not just a Boeing problem, but applies throughout the industry.
In my simplistic view, somehow we can no longer assume that the man machine interface will stop arguing to the point where the recovery is impossible. What does it take to teach the man otherwise?
In my simplistic view, somehow we can no longer assume that the man machine interface will stop arguing to the point where the recovery is impossible. What does it take to teach the man otherwise?
Second, a presentation by the DG of EUROCONTROL. In which the increasing role of automation was prominent.
Extraction of thread-related comment: as to the second event, the aviation safety ecosystem better get goin' on the advancement and refinement of the human factors subparts. Which aren't going away. Especially with the management and/or cultural issues laid bare at Boeing, and in the certification process.
As to the first, on one hand ICAO IATA ACI and the rest cheerily forecast large, large gains in traffic, and of course advocate for the capacity building needed to sustain it. But the pioneering spirit, and dedication, this young leader has needed to sustain just to establish a rightful place in international aviation diplomacy is telltale, perhaps. It reveals, I sometimes worry, that the flood of new pilots needed for that doubling of traffic will consist way too much of rote checklist types (to reiterate: the leader is highly well-trained) of any and all the many demographics involved. And saying, "oh you old weeping willow, don't fret none, it'll all be computerized." In Zuckerberg We Trust, I guess....thanks, but no thanks.
The bullet points are:
- Comparing AoA signals could generate a warning.
- AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
- A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
- Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
- Therefore Boeing choose not compare AoA
The AoA miscompare alert was already there* but MCAS didn't need to use it per the FHA. You don't just add stuff with no requirement and the FHA didn't support adding the requirement.
*I know the alert was not enabled. As discussed it was supposed to be. But again, it wasn't considered serious enough (FHA again) to rush the update.
Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:
- Comparing AoA signals could generate a warning.
- AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
- A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
- Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
- Therefore Boeing choose not compare AoA
Asimov rule #1
Our industry is at the boundary of rule #1; technological capability, need for automation, economics, balanced by human judgement in complex processes of design, checking, testing, and approval.
Human judgement, either in these process or ultimately in operation (last opportunity to avoid / mitigate), is now limiting.
The critical issue is do we know that, wish to acknowledge that, or act, - but only with the illumination of hindsight.
We are the robots of our thoughts.
https://thenextweb.com/artificial-in...share%2Bbutton
Note the principles 1-6 from Cambridge, and problems to address 1-5 via Google.
Also;
https://www.scientificamerican.com/a...tter-solution/
Human judgement, either in these process or ultimately in operation (last opportunity to avoid / mitigate), is now limiting.
The critical issue is do we know that, wish to acknowledge that, or act, - but only with the illumination of hindsight.
We are the robots of our thoughts.
https://thenextweb.com/artificial-in...share%2Bbutton
Note the principles 1-6 from Cambridge, and problems to address 1-5 via Google.
Also;
https://www.scientificamerican.com/a...tter-solution/
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.
Join Date: Sep 2019
Location: leftcoast
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.
Boeing analyzed what would happen if, in normal flight mode, MCAS triggered inadvertently up to its maximum authority and moved the horizontal stabilizer the maximum 0.6 degrees.
It also calculated what would happen on a normal flight if somehow the system kept running for three seconds at its standard rate of 0.27 degrees per second, producing 0.81 degrees of movement, thus exceeding the supposed maximum authority.
It also calculated what would happen on a normal flight if somehow the system kept running for three seconds at its standard rate of 0.27 degrees per second, producing 0.81 degrees of movement, thus exceeding the supposed maximum authority.
But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"
seems that the higher math involved was beyond the management involved...
Join Date: Oct 2001
Location: Lost, but often Indonesia
Posts: 653
Received 0 Likes
on
0 Posts
"OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ..."
Not to mention at low level. A system that is unknown to the crew which aggressively and repeatedly tries to dive the aircraft at low level is insane and diabolical however which way people choose to look at it. Arguably, it is criminal..
All the rhetoric by some re pilot training/ incompetence/ error is just a smokescreen to cover the obvious. Poor management decision making/ leadership, poor aircraft design/ sloppy system design (MCAS), poor communication to Airlines/ pilots and complete fixation re the iPad training only mandate are among the causes of these tragedies.
Boeing designed a pig and the lipstick didn't work. The Swiss cheese had so many holes, it's not surprising they lined up..
Not to mention at low level. A system that is unknown to the crew which aggressively and repeatedly tries to dive the aircraft at low level is insane and diabolical however which way people choose to look at it. Arguably, it is criminal..
All the rhetoric by some re pilot training/ incompetence/ error is just a smokescreen to cover the obvious. Poor management decision making/ leadership, poor aircraft design/ sloppy system design (MCAS), poor communication to Airlines/ pilots and complete fixation re the iPad training only mandate are among the causes of these tragedies.
Boeing designed a pig and the lipstick didn't work. The Swiss cheese had so many holes, it's not surprising they lined up..
Last edited by Octane; 28th Sep 2019 at 10:45.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
These numbers telling, valid 1959 to 2017, as compiled by Boeing.
Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017
Another source, Airsafe.com has compiled 737-MAX departures at 0.65 million, and quotes a hull loss rate of 3.08 per million departures.
source: Airsafe.com Plane crash rates by model
Even more dramatic is the accident rate by phase of flight:
Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017
Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017
Another source, Airsafe.com has compiled 737-MAX departures at 0.65 million, and quotes a hull loss rate of 3.08 per million departures.
source: Airsafe.com Plane crash rates by model
Even more dramatic is the accident rate by phase of flight:
Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017
Last edited by CurtainTwitcher; 28th Sep 2019 at 08:12.
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
That being said, it was still a terrible design to have an unknown "background" system input this much stab trim. Assuming the MAX does fly again, this large MCAS input will still be needed in an actual low-speed stall to address the control force issue at high AOA. Keep in mind that in an actual stall, MCAS is offsetting a lightening of the control forces, and not forcing the nose down. However, as I currently understand the system, when the pilots reduce the AOA to break the stall there would no longer be a nose up moment generated by the engine nacelles and the MCAS input would then effectively convert to a large nose down moment. That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver.
Join Date: Oct 2001
Location: Lost, but often Indonesia
Posts: 653
Received 0 Likes
on
0 Posts
"That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver."
If that is so, it would contradict the whole rationale for the existence of MCAS in the first place..
If that is so, it would contradict the whole rationale for the existence of MCAS in the first place..
Join Date: Mar 2019
Location: French Alps
Posts: 326
Likes: 0
Received 0 Likes
on
0 Posts
Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
The whole debate about whether MCAS is an "anti-stall" system is part semantic and part technical. If you browse through FAR Part 25, the particular section dealing with transport category aircraft certification, you will not find any requirement for an "anti-stall" system. On the other hand, you will find requirements for stability and control feel response as the aircraft approaches the stall. The only reason MCAS exists is to meet these requirements. It just so happens that in meeting these requirements, MCAS does assist with control and recovery through the approach to stall region - but technically it is not an "anti-stall" device. That being said, MCAS and a host of other warning indications and system responses in this area of the flight envelope do aid in the stall recovery and could be informally referred to as "anti-stall" devices. While they are technically correct, Boeing and their helpmates have not done themselves any favors by trying to win this technical argument with a largely non-technical audience.
Last edited by Tomaski; 28th Sep 2019 at 18:14.
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"
seems that the higher math involved was beyond the management involved
seems that the higher math involved was beyond the management involved
THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.
The change was made apparently without regard to the flight conditions...
This is why you have 2.5 degrees at high speeds.
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
I would rate the most likely case would be an aircraft upset followed by an nose-low recovery at a speed approaching Va (max maneuvering). Not sure how often this sort of thing has happened in the real world, but the FAR certification requirement that drove the need for MCAS cannot be waived because the possibility of such an event is deemed unlikely.
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
Out of interest, how likely is a high speed/high AoA combination to be encountered ?
I thought it was on DEP when there was a climbing turn?
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
Boeing describes MCAS as a result of a handling quality shortcoming encountered in an accelerated stall, that would be likely be tested as a wind-up turn. The pilot holds airspeed and progressively increases bank angle and back pressure to result in stalling at high load factors. The flight condition is most likely entered with the aft column travel beyond the column cutout threshold. If the aft column cutout was active, MCAS would be inhibited before it could do anything. For this reason, I think Boeing decided to disable the column cutout feature for MCAS, via autopilot software change.