Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Boeing Board to Call for Safety Changes After 737 Max Crashes

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Boeing Board to Call for Safety Changes After 737 Max Crashes

Old 29th Sep 2019, 13:55
  #81 (permalink)  
 
Join Date: Dec 2010
Location: Middle America
Age: 84
Posts: 1,167
Likes: 0
Received 0 Likes on 0 Posts
Wall Street Journal article published 09/29/2019:

Before 737 MAX, Boeing’s Flight-Control System Included Key Safeguards

Earlier military version of MCAS had features to prevent misfires implicated in two 737 MAX crashes

By
Alison Sider and
Andrew Tangel
Sept. 29, 2019 7:00 am ET
After Indonesia’s Lion Air crash, Air Force officials were worried their tanker, the KC-46A Pegasus, shared the same problems as Boeing’s 737 MAX.

Boeing Co. engineers working on a flight-control system for the 737 MAX omitted key safeguards that had been included in an earlier version of the same system used on a military tanker jet, people familiar with the matter said.

Accident investigators have implicated the system, known as MCAS, in two deadly crashes of the jetliner that killed a total of 346 people.

The engineers who created MCAS more than a decade ago for the military refueling plane designed the system to rely on inputs from multiple sensors and with limited power to move the tanker’s nose—which one person familiar with the design described as deliberate checks against the system acting erroneously or causing a pilot to lose control.

“It was a choice,” this person said. “You don’t want the solution to be worse than the initial problem.”

The MAX’s version of MCAS, however, relied on input from just one of the plane’s two sensors that measure the angle of the plane’s nose. The system also proved tougher for pilots to override. Investigators have implicated the system in the fatal nosedives of Indonesia’s Lion Air jet in October 2018 and of an Ethiopian Airlines MAX in March. Indonesia is expected to fault that MCAS design, in addition to U.S. oversight lapses and pilot missteps, in their final report on the first crash, The Wall Street Journal has reported.

Now, Boeing’s expected fix for the 737 MAX will make its MCAS more like the one used in the tanker, according to people familiar with the matter.

Details of the system’s history and engineers’ desire to build in safeguards on the tanker version of MCAS haven’t been previously reported. The existence of a version of MCAS on the tanker was earlier reported by Air Force magazine.MCAS stands for the Maneuvering Characteristics Augmentation System. A Boeing spokesman declined to explain why the systems differ on two airplanes, but said, “The systems are not directly comparable.” The contrast in design highlights how different teams of Boeing engineers wound up including protections on one airplane but not on a later model of another aircraft. Boeing has said the MAX, with its revised MCAS, will be among the safest airplanes ever to fly.

After the MAX operated by Indonesia’s Lion Air crashed, Air Force officials said they were concerned their tanker, known as the KC-46A Pegasus, shared the same problems. An Air Force spokeswoman said senior officials met with their Boeing counterparts to confirm the tanker’s MCAS complied with military requirements for designs that prevent a single faulty sensor from causing a system to fail.

Boeing developed the MCAS for the military tanker around the early 2000s, another person familiar with the project said. The tanker was a military derivative of Boeing’s wide-body 767 commercial jet and included pods on its wings used for air-to-air refueling of fighters and other war planes. Those wing pods added lift and caused the tanker’s nose to pitch up in some flight conditions, risking the plane’s ability to meet Federal Aviation Administration safety requirements, people familiar with the matter said. So engineers devised MCAS software, which automatically pushes down the tanker’s nose if necessary, to comply with FAA standards, these people said..

In a key difference from the subsequent version of the system used on the MAX, the system on the tanker moves the plane’s horizontal stabilizer—the control surface perpendicular to the airplane’s tail—once per activation and not repeatedly, the person familiar with the tanker project said.

The tanker engineers also gave the system only limited power to nudge the plane’s nose down to ensure that pilots would be able to recover if it accidentally pushed the plane into a dive, said the person familiar with the tanker’s MCAS design. That meant MCAS had little authority over the stabilizer, which made it much easier for pilots to counteract.

Boeing began developing the MAX in 2011 amid competition with rival Airbus SE, which had been enticing airline customers with its new single-aisle passenger jet.

The MAX’s new fuel-efficient engines were larger and placed farther forward on the wing than on previous 737 models. That caused the plane’s nose to pitch up in certain extreme flight conditions, endangering the plane’s ability to win FAA certification, people familiar with the matter said. The large engines on the MAX essentially had the same effect on the plane’s aerodynamics that the refueling pods had on the military plane.

Engineers who had worked on the tanker suggested MCAS as a possible solution for the MAX engineers, people familiar with the matter said.

Boeing said it isn’t aware of any consideration to rely on both sensors that measure the angle of the plane’s nose when its engineers designed MCAS for the 737 MAX. A single “angle of attack” sensor was deemed sufficient, and Boeing has said it complied with safety and regulatory requirements. Other systems on earlier 737s relied on single sensors, former Boeing engineers and others familiar with the designs have said.

Boeing instead relied primarily on pilots as the backstop should that plane’s MCAS misfire. MAX engineers determined pilots would quickly identify an MCAS misfire as an emergency known as a “runaway stabilizer,” then counteract the system with a longstanding cockpit procedure.

The more advanced flight-control computer systems on the tanker also made it easier for MCAS to compare data from multiple sensors, the person familiar with the tanker project said. “The underlying architecture was there to take advantage of,” this person said.

Aside from sensors, the tanker MCAS has another key safeguard. Pilots of the tanker can override MCAS by simply pulling back on controls, according to a senior Air Force official and others familiar with the matter.

“We have better sensor data,” Will Roper, an assistant Air Force secretary who is the branch’s procurement chief, said. “But most importantly, when the pilot grabs the stick, the pilot is completely in control.”

On the MAX, MCAS’s design required it to remain active even if pilots pulled back on the controls, making it more complicated to stop the system from forcefully and repeatedly pushing down the nose.

Since days after a second 737 MAX crashed in Ethiopia in March, that aircraft has been grounded world-wide. The flight ban has thrown a wrench into airline finances and planning, and disrupted customers’ travel plans.

The new MCAS for the 737 MAX is expected to rely on two sensors to verify data. It will fire once, not repeatedly, each time it activates. And pilots will be able to override the system by pulling back on the controls.

—Andy Pasztor, Elisa Cho and Jim Oberman contributed to this article.
Turbine D is offline  
Old 29th Sep 2019, 16:18
  #82 (permalink)  
 
Join Date: Oct 2001
Location: Lost, but often Indonesia
Posts: 652
Received 0 Likes on 0 Posts
"Boeing has said the MAX, with its revised MCAS, will be among the safest airplanes ever to fly"

Nice rhetoric from Boeing but perhaps they mean to say "among the the safest MCAS airplanes ever to fly"? Quite likely it would be very safe if it had no MCAS at all, with the drawback it wouldn't be certifiable..
Why they didn't implement the MCAS safeguards on the MAX they did on the military aeroplane is a question possibly the accountants in Chicago can answer. Especially considering the enormous revenue the MAX was going to generate. Alternatively, they could have tried designing a state of the art aircraft in the first place.

"Boeing instead relied primarily on pilots as the backstop should that plane’s MCAS misfire. MAX engineers determined pilots would quickly identify an MCAS misfire as an emergency known as a “runaway stabilizer,” then counteract the system with a longstanding cockpit procedure."

Really? Expecting line pilots to troubleshoot a malfunctioning system they didn't know existed (Lion) in a critical flight phase? (and not deactivated by control column inputs a la Tanker version).
Since when did airline pilots have double duty as Boeing test pilots?
Lawyers will be busy for years...
Octane is offline  
Old 29th Sep 2019, 17:38
  #83 (permalink)  
 
Join Date: Nov 2018
Location: Planet Earth
Posts: 17
Likes: 0
Received 0 Likes on 0 Posts
It boggles the mind. So pilots are expected to identify an unknown system as misfiring and at the same time let it do its thing when firing properly. An unknown system designed to work as a runaway trim for up to nine seconds at a time.
robocoder is offline  
Old 30th Sep 2019, 23:44
  #84 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 46
Received 0 Likes on 0 Posts
The tanker version appears to target a different issue.

On the MAX it was specifically to counter a situation where the stick was being pulled back well past the cutoff switch activation point.


I also question the statement about repeated cycles. We know on the MAX a manual electric trim input resets the system. If not for the MET input it wouldn't move the stabilizer again until AoA decreased, and then it would take out the stab trim it added.

What resets the system on the tanker?

ST Dog is offline  
Old 1st Oct 2019, 00:27
  #85 (permalink)  
 
Join Date: Aug 2019
Location: Rocket City
Posts: 46
Received 0 Likes on 0 Posts
Originally Posted by robocoder
It boggles the mind. So pilots are expected to identify an unknown system as misfiring and at the same time let it do its thing when firing properly.
When it was designed to be active it wouldn't be noticed as it would make the plane act as expected (steady increasing pull needed to increase pitch up). And it was a max of 9s but not always 9s.

But at other times (when not at high AoA) it would appear to be runaway since nothing is expected to run that long. 3 seconds was supposed to be enough to note runaway which suggests auto trim is usually less than 1s. If system cutout in 3-6 seconds you still have a controllable plane.

Level flight and sudden trim like that I'll bet would be noticed. And acted on, though probably not fast/correctly since it's not practiced.


I wonder if any crew would survive a real runaway trim (like a fault in the motor) during take off.

Boeing misjudged the detection speed with all the alarms. They incorrectly assumed the memory items would be followed quickly from memory.

And I think they just didn't consider an AoA failure to high reading during the takeoff phase of flight.

They need to revamp the safety process and the assumptions used in it.
ST Dog is offline  
Old 1st Oct 2019, 00:47
  #86 (permalink)  
 
Join Date: Sep 2017
Location: Europe
Posts: 1,674
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by OldnGrounded
What we actually have is an example of unrestrained capitalism destroying competition to the point that the "market" provides only two choices for purchasers of large airliners. It doesn't much resemble a "free" market at all.
Precisely.

The assumption that capitalism equates "competition" is erroneous.

The natural state is comfortable duopoly.
The myth was eloquently destroyed by Johnathan Tepper: The Myth of Capitalism
Rated De is offline  

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.