MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures Mk II

[LowObservable]

Originally Posted by BDAttitude

Can't it? Even not with enough lipstick and citing "alternate means of compliance" ?
I'm still guessing it all has been agreed on and they are just fighting about documention, training and other "formalities" . Everyone needs that plane back in the air - even the Chinese.

What EASA was saying during most of the fall was that the solution was a third AoA vane. Hopefully, Boeing has had a Team B working on exactly that, including a retrofit kit that can be installed in 15 minutes using a Leatherman and a Dremel.

[OldnGrounded]

Originally Posted by LowObservable

What EASA was saying during most of the fall was that the solution was a third AoA vane. Hopefully, Boeing has had a Team B working on exactly that, including a retrofit kit that can be installed in 15 minutes using a Leatherman and a Dremel.

On the other hand, the information that has been shared* about what B is actually doing says that MCAS 2.0 will use only the two existing vanes, together with both FCCs operating simultaneously, and logic that disables MCAS (and perhaps other automatics) on disagreement. I don't think they're working on a third AoA sensor solution, although that, fairly obviously, would be the right thing to do if you were starting from a clean sheet for MCAS.

Of course, if you were actually starting from a clean sheet, it might be a good idea to design an airframe that didn't require MCAS.

* Boeing's Fix Tames the Tiger . . .

[turbidus]

I thought the whole MAX saga was already a PR disaster of the highest order,

Yes, the 3x5 cards! I see in the presentation, that the cards were also to go to the pilots. Was this to make them feel more confident to fly the MAX?

My thoughts are that the pilots should NOT be involved in this in any way, I can imagine some unintended consequences.

FAQ and Key Points cards for pilots???????? Is this instead of sim training????

This Boeing slide is what they should be very concerned about: TRUST

[LowObservable]

Originally Posted by OldnGrounded

On the other hand, the information that has been shared* about what B is actually doing says that MCAS 2.0 will use only the two existing vanes, together with both FCCs operating simultaneously, and logic that disables MCAS (and perhaps other automatics) on disagreement.

That's what I call "pseudo-triplex". I don't think the international authorities are buying it.

[Grebe]

Originally Posted by LowObservable

That's what I call "pseudo-triplex". I don't think the international authorities are buying it.

https://www.isasi.org/Documents/libr...ducing-787.pdf

SEE Pages 39 to 42

787 Synthetic Airspeed

Introducing the 787 - Effect on Major Investigations - And Interesting Tidbits

Tom Dodt Chief Engineer – Air Safety Investigation ISASI September, 2011
+++

I would think a simple inertial compare re pitch angle ( eg floor angle ) and horizontal flight path would give an reasonably approximate AOA via a totally internal system- at least accurate enough to identify out of range or false compares of two external AOAS sensors.

After all- Boeing must use a similar internal - inertial compare to their military orbital spaceplane which stays up for a year or more and then lands automatically. Reentry no doubt does not alllow external vane type sensors , etc.

[GlobalNav]

Originally Posted by LowObservable

That's what I call "pseudo-triplex". I don't think the international authorities are buying it.

Perhaps I misunderstand your meaning, but I think triplex architecture provides for continued function in the case of a single AoA sensor failure. Not what the Boeing fix, if you can call it that, could do. By having two two AoA sensors in the loop, a disagreement can be noted and the MCAS function disabled. With two FCC involved, (not exactly sure why), additional failure modes may be detected and again, the function disabled. Not sure what pseudo-triplex means, but it does not offer what a full triplex architecture does.

Not sure if Boeing considered it, but one possible approach is to use non-AoA information from attitude and perhaps inertial sensors to detect a discontinuity in AoA sensor output as a validity check, and continue using the other AoA sensor if it is behaving normally. Not substituting the alternative attitude/inertial sensors for AoA, but only as a validity check. Only a thought, not trying to redesign the system.

[Chris2303]

So the protection given by MCAS in certain conditions of flight is a certification requirement?

How can that then be abrogated by disabling MCAS if there is an AOA disagreement?

[OldnGrounded]

Originally Posted by Chris2303

So the protection given by MCAS in certain conditions of flight is a certification requirement?

Yes. That's what we have all been told.

How can that then be abrogated by disabling MCAS if there is an AOA disagreement?

Excellent question.

[gums]

Salute!

Outstanding question by Chris...

The problem is not using two sensors. The problem is not simply using one sensor, but alternating between the seats in the cockpit, and not telling either of them about the system and how it worked, and then disconnecting the column switches they had used for thousands of hours, and then...... and then.....

I will take a huge bet that if every Max pilot back in 2017 had to read a description of MCAS and potential problems if an AoA vane went south, and /or had a stick shaker going and various caution lights indicating airspeed problems or yada yada, and even best! a MCAS light! Imagine that?. How many crashes?

Good grief!

The pissant cert thing about stick forces is the most tiny problem in this mess. Besides obvious aero problems due to the new motors and their mounting, the crude attempt to meet FAA cert using a crude kludge and possible FAA negligence passing the cert, the failure to tell ME, the guy that has to get 150 folks to Topeka, Kansas is bordering on criminal.

The lawyers of the lost souls are gonna have a field day.

Gums sends....

[OldnGrounded]

Originally Posted by gums

I will take a huge bet that if every Max pilot back in 2017 had to read a description of MCAS and potential problems if an AoA vane went south, and /or had a stick shaker going and various caution lights indicating airspeed problems or yada yada, and even best! a MCAS light! Imagine that?. How many crashes?

Very few, if any. It would also have been nice to toss in a switch to disable MCAS without killing MET.

[HighWind]

Originally Posted by GlobalNav

With two FCC involved, (not exactly sure why), additional failure modes may be detected and again, the function disabled. .

This allow the system to detect if one of the two FCC's calculate a different value, due to a bit flip. This can then disable MCAS for the remainder of the flight, but it is not possible to detect the faulty FCC, and restart it. This is not a good design, since the two CPU's are loose coupled, there is limit on how much information they can check (bandwith), and there is a risk that they get out of sync. and fails safe (No MCAS, and maybe no autopilot?).
It would be better if each FCC had two CPU's (in the same enclosure) doing the same job (COM and MON), this make the FCC fail-silent i.e. the fault does not propagate to the other side.
It would also be good if in case of a faulted FCC, the remaining FCC has access to air-data sensors in the other side.

[MurphyWasRight]

Originally Posted by OldnGrounded

Very few, if any. It would also have been nice to toss in a switch to disable MCAS without killing MET.

That switch existed on 737 until max, one of the two cutout switches disabled all automatic trim the other disabled all, including manual, electric trim.

This was discussed in the prior threads but no solid reason for change in MAX where either switch disables all electric trim.

Also brought up is that the training changed some time ago to allways use both switches on suspect trim runaway.

Had this changed not been made the ET crew might have been able to recover by enabling manual electric trim only.

[Fly Aiprt]

Originally Posted by The AvgasDinosaur

If the other involved airworthiness authorities got together and put together an acceptable to all package of requirements to recertify MAX and presented it to Boeing and FAA with a comply or die request!

Didn't EASA do that in a way some months ago, with its published key points ?
Boeing and the FAA would say they "appreciate the input, and are fully committed to work with the agencies"... and then continue whatever they are doing to this date.
What are they presently doing, by the way ?

[edmundronald]

Originally Posted by gums

Salute!

Outstanding question by Chris...

The problem is not using two sensors. The problem is not simply using one sensor, but alternating between the seats in the cockpit, and not telling either of them about the system and how it worked, and then disconnecting the column switches they had used for thousands of hours, and then...... and then.....

I will take a huge bet that if every Max pilot back in 2017 had to read a description of MCAS and potential problems if an AoA vane went south, and /or had a stick shaker going and various caution lights indicating airspeed problems or yada yada, and even best! a MCAS light! Imagine that?. How many crashes?

Good grief!

The pissant cert thing about stick forces is the most tiny problem in this mess. Besides obvious aero problems due to the new motors and their mounting, the crude attempt to meet FAA cert using a crude kludge and possible FAA negligence passing the cert, the failure to tell ME, the guy that has to get 150 folks to Topeka, Kansas is bordering on criminal.

The lawyers of the lost souls are gonna have a field day.

Gums sends....

Gums,

The lawyers for the deceased will get $2M per American passenger, peanuts for others, and mucho moolah for lawyers themselves.

Shareholder lawsuits, customer lawsuits, possible criminal negligence, and the MAX not flying for another year or two, now that’s a different story.

I think that for the Max to get certified again it will take either a miracle or a clear act of political policy, and from this point on the FAA will have to give clear written assurances that they will waive any right to contest ANY European or Chinese certification in the future. The reason being that something about the 737 needing MCAS is clearly not kosher, the native aerodynamics escaped scrutiny the first time round and can’t pass the regs that apply to civilian airliners, so certifying the Max with this envelope protection system will infringe on regulations, and that will be known to all in the business.

Edmund

[turbidus]

With two FCC involved, (not exactly sure why), additional failure modes may be detected and again, the function disabled.

I understand how they did this, as it is easier to compare one FCC to another as the AOA vanes are wired one right and one left. What concerns me is this seems like reducing redundancy in some ways, as now you have lost the redundancy of 2 independent FCC's. There must be a whole Fton of cascading scenarios by tying the 2 together.
Doesnt it seem much more difficult to trace a fault through 2 FCC's? Comparing 3 versus 2 seems like far better redundancy and error trapping. Still the same with comparing 2, which one do you pick?

[Bend alot]

Originally Posted by The AvgasDinosaur

Consider this if you have time?
If the other involved airworthiness authorities got together and put together an acceptable to all package of requirements to recertify MAX and presented it to Boeing and FAA with a comply or die request!
What would be the likely reaction of Boeing and FAA to such a scenario?
Your thoughts and comments appreciated
Be lucky
David

The "thanks for the input" reply seems accurate.

Many/most regulators keep clear from giving solutions/advice on what to do or what will be accepted to be approved.

Mostly this is so they are immune to any faults that the solution/advice may contain when accidents happen. We have seen Boeing saying the FAA approved MCAS, but also that Boeing did not inform the FAA of changes made to MCAS during design.

Imagine if the FAA suggested the MAX needed MCAS to be certified?
Dennis would still be in the top job!

The regulators are (should) be there to confirm compliance of regulation are meet, not to tell companies how to meet compliance of regulation.

[GlobalNav]

Originally Posted by turbidus

I understand how they did this, as it is easier to compare one FCC to another as the AOA vanes are wired one right and one left. What concerns me is this seems like reducing redundancy in some ways, as now you have lost the redundancy of 2 independent FCC's. There must be a whole Fton of cascading scenarios by tying the 2 together.
Doesnt it seem much more difficult to trace a fault through 2 FCC's? Comparing 3 versus 2 seems like far better redundancy and error trapping. Still the same with comparing 2, which one do you pick?

If all the design does is compare two sources without anything independent for verification, you shouldn’t pick one. Functionality should require agreement between the two, otherwise shut it down. While triplex architecture compares three and disregards the outlier, there have been cases where the outlier was most correct. It’s called having a bad day. And when it happens there’s typically a common cause or condition that made the two wrong. Not a high probability, but it has happened with air data sensors. One reason that it’s useful to have independent and dissimilar system(s) to verify.

[MechEngr]

Originally Posted by turbidus

I understand how they did this, as it is easier to compare one FCC to another as the AOA vanes are wired one right and one left. What concerns me is this seems like reducing redundancy in some ways, as now you have lost the redundancy of 2 independent FCC's. There must be a whole Fton of cascading scenarios by tying the 2 together.
Doesnt it seem much more difficult to trace a fault through 2 FCC's? Comparing 3 versus 2 seems like far better redundancy and error trapping. Still the same with comparing 2, which one do you pick?

They are already tied together to disable the autopilot based on AoA disagree. Since the plane will be in fully manual control at that point it is up to the pilots, just like always.

[MechEngr]

Originally Posted by MurphyWasRight

That switch existed on 737 until max, one of the two cutout switches disabled all automatic trim the other disabled all, including manual, electric trim.

This was discussed in the prior threads but no solid reason for change in MAX where either switch disables all electric trim.

Also brought up is that the training changed some time ago to allways use both switches on suspect trim runaway.

Had this changed not been made the ET crew might have been able to recover by enabling manual electric trim only.

It might not have been required if the ET crew trimmed to neutral or even nose up before shutting off the trim. Recall that the electric trim was re-enabled at the point you are thinking of, but they did not retrim the airplane using electric trim; instead they tapped the button a couple of times without making a change to the stab trim and then attempted to re-enable the autopilot.

I suspect the change was made in order to prevent confused pilots shutting off the working trim system and allowing the erroneous one to keep working, much like pilots have shut down the remaining functioning engine in a panic.

[Longtimer]

737 Max Wiring Issues

A reviewing wiring issue that could cause short circuit on 737 Max

PUBLISHED SUN, JAN 5 20208:01 PM EST

KEY POINTS

• The New York Times reported Boeing is reviewing whether two bundles of wiring are too close together, which could lead to a short circuit and potentially result in a crash if pilots did not respond appropriately.
• The FAA said in a statement Sunday the agency and company “are analyzing certain findings from a recent review of the proposed modifications to the Boeing 737 MAX.”
• Link to article: https://www.cnbc.com/2020/01/06/boei...n-737-max.html
• Boeing is currently working to design separating the wiring bundles if necessary and conducting extensive analysis to establish if the electrical fault could occur in a real-world scenario, a company official said.