Boeing 737 Max Recertification Testing - Finally.
Join Date: Jan 2008
Location: UK
Posts: 12
Likes: 0
Received 0 Likes
on
0 Posts
Sorry to hear that, hopefully the redundancy package softens the blow. What's the situation with other Boeing run 737 max engineering operations? Similar lay offs? Surprised given the alleged return to service as you say.
Join Date: Jul 2020
Location: Liscannor
Posts: 3
Likes: 0
Received 0 Likes
on
0 Posts
Derisory I am lead to believe in comparison to the industry standard and a mere shadow of what the DAA staff have been offered in their concurrent redundancy procedure.
In relation to your second question, they operate two teams of engineers operating in Dublin and Gatwick respectively under the auspices of an Irish part 145. Only the Irish engineers are being made redundant however.
It seems some engineers are more equal than others.
A terrible time for the industry.
In relation to your second question, they operate two teams of engineers operating in Dublin and Gatwick respectively under the auspices of an Irish part 145. Only the Irish engineers are being made redundant however.
It seems some engineers are more equal than others.
A terrible time for the industry.
Thread Starter
Ditching
Yesterday Boeing announced a $2.4 Billion loss in the last quarter - adding to the billions they'd already lost last year. Many thousand Boeing employees have already been laid off in the Puget Sound area, with thousands more to come (not to mention the many thousands of employees at the Boeing suppliers that have been let go in the last 12 months). Right now, regardless of the mistakes that were made during the MAX development, Boeing is trying to do what it has to do to simply survive until air traffic recovers.
Yes, it sucks for the people in Dublin, but I doubt the thousands who have lost their job in the Puget Sound will have much sympathy.
Yesterday Boeing announced a $2.4 Billion loss in the last quarter - adding to the billions they'd already lost last year. Many thousand Boeing employees have already been laid off in the Puget Sound area, with thousands more to come (not to mention the many thousands of employees at the Boeing suppliers that have been let go in the last 12 months). Right now, regardless of the mistakes that were made during the MAX development, Boeing is trying to do what it has to do to simply survive until air traffic recovers.
Yes, it sucks for the people in Dublin, but I doubt the thousands who have lost their job in the Puget Sound will have much sympathy.
The chances of either the B787 or the B737MAX programmes reaching their 'accounting block' production targets in the foreseeable future - or indeed ever - are becoming more and more remote each Quarter. However, continued use of Program Accounting allows Boeing to defer recognising and crystallising billions and billions of dollars in losses until the indefinite future, or until the company wants to put Boeing Commercial Aircraft into Chapter 11. My own view is that's at least a 50/50 proposition.
Join Date: Jan 2013
Location: Seattle Area
Posts: 263
Likes: 0
Received 0 Likes
on
0 Posts
737 Max flight control system NPRM has been posted on line by FAA:
https://www.faa.gov/news/updates/?newsId=93206
https://www.faa.gov/news/updates/?newsId=93206
Join Date: Oct 2017
Location: Vienna
Posts: 143
Likes: 0
Received 0 Likes
on
0 Posts
To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws 10 associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.
The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, 11 the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.
To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.
The updated FCC software would also limit12 the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrew’s ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position – before or after the MCAS command.
An undesired MCAS activation could prompt the flightcrew to perform a nonnormal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.
First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.
Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a nonnormal procedure.
The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold13 would cause an AOA DISAGREE alert on the primary flight displays (PFDs).
...
...
As part of the FAA’s review of these design changes, the agency reviewed the entirety of the 737 MAX horizontal stabilizer control system. This review revealed that the physical separation of the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring does not meet the criteria specified in 14 CFR 25.1707. This design standard was promulgated in 2007 and therefore is part of the certification basis of the 737 MAX but not of previous Boeing Model 737 airplanes. Certain wiring installations must have enough physical separation so that a wiring failure cannot create a hazard. Since design changes must comply with FAA regulations, the FAA proposes to require changes to the wiring installation to meet the required physical separation between the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring. The FAA proposes this action to bring the airplanes into regulatory compliance.
My question: can MAX be certified with:
a) a single MCAS input per AOA event
b) MCAS limited so that it would preserve the flightcrew’s ability to control the airplane pitch by using only the control column.
In essence, does MAX with these limitations still meet the certification criteria which required MCAS in the first place??
The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, 11 the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.
To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.
The updated FCC software would also limit12 the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrew’s ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position – before or after the MCAS command.
An undesired MCAS activation could prompt the flightcrew to perform a nonnormal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.
First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.
Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a nonnormal procedure.
The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold13 would cause an AOA DISAGREE alert on the primary flight displays (PFDs).
...
...
As part of the FAA’s review of these design changes, the agency reviewed the entirety of the 737 MAX horizontal stabilizer control system. This review revealed that the physical separation of the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring does not meet the criteria specified in 14 CFR 25.1707. This design standard was promulgated in 2007 and therefore is part of the certification basis of the 737 MAX but not of previous Boeing Model 737 airplanes. Certain wiring installations must have enough physical separation so that a wiring failure cannot create a hazard. Since design changes must comply with FAA regulations, the FAA proposes to require changes to the wiring installation to meet the required physical separation between the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring. The FAA proposes this action to bring the airplanes into regulatory compliance.
My question: can MAX be certified with:
a) a single MCAS input per AOA event
b) MCAS limited so that it would preserve the flightcrew’s ability to control the airplane pitch by using only the control column.
In essence, does MAX with these limitations still meet the certification criteria which required MCAS in the first place??
Join Date: Jan 2016
Location: Uk
Posts: 74
Likes: 0
Received 0 Likes
on
0 Posts
Indeed, it seems that the FAA are proposing that it is fine to fly in effect with MCAS disabled (AOA disagree) or crippled (only one activation) - in which case why it there in the first place?
Would you expect AOA disagree to be "land at nearest suitable airport"
Would you expect AOA disagree to be "land at nearest suitable airport"
Indeed, it seems that the FAA are proposing that it is fine to fly in effect with MCAS disabled (AOA disagree) or crippled (only one activation) - in which case why it there in the first place?
Join Date: Jun 2020
Location: Europe
Posts: 22
Likes: 0
Received 0 Likes
on
0 Posts
On one hand: This is about basic cert criteria, handling/stability during approach to stall. In former times this had to be ensured by fundamental design no matter what. Now Boeing introduced a gadget to mitigate the issue. If you approached to stall 100 times a flight it would counter 100 times. Now it wouldn't: once an AoA disagree momentarily(!) exceeds a set value, MCAS will be disabled. That's when the plane enters an inherent state of being aerodynamic instable. This can justify "Land nearest suitable".
On the other hand: Compare to stick pusher gadget to mitigate actual stall, which is also used to certify types. What happens if this fails? Is there detection at all? Land nearest if detected?
On the other hand: Compare to stick pusher gadget to mitigate actual stall, which is also used to certify types. What happens if this fails? Is there detection at all? Land nearest if detected?
Last edited by Ray_Y; 4th Aug 2020 at 13:03.
Join Date: Jun 2020
Location: Europe
Posts: 22
Likes: 0
Received 0 Likes
on
0 Posts
Like this:
- AOA DISAGREE alert on PFD installed by default (activates when more than 10 degrees difference for more than 10 seconds)
- Inputs of both AoA sensors processed as source for activating MCAS
- AoA disagree exceeding a calculated threshold will inop STS/MCAS for the remainder of the flight
(treshold as function of magnitude of disagreement between AoA sensors and rate of change of the values)
This will activate an indication to crew (STS/MCAS off) - Only one MCAS activation per high AoA event
- The magnitude of MCAS stab command will be limited so that the plane thereafter can be controlled by elevator only to climp/level/descend.
The magnitude varies according to parameters such as the airplane’s altitude and airspeed - Not only MCAS related checklist changes
- Wiring Changes to comply with current regulation
Maintenance:
- AoA prope system test once befor RTS
- MEL affected, new MMEL
Details I digged out:
WRT checklist changes:
Airspeed Unreliable
Runaway Stabilizer
Stabilizer Trim Inoperative
Speed Trim Fail
Stabilizer Out of Trim
AOA Disagree
ALT Disagree
IAS Disagree
I also found the answer to my question "land next suitable" in a proposed new NNC:Runaway Stabilizer
Stabilizer Trim Inoperative
Speed Trim Fail
Stabilizer Out of Trim
AOA Disagree
ALT Disagree
IAS Disagree
Speed Trim Fail (Required by AD 2020-**-**)
The Speed Trim function and MCAS function are inoperative.
Continue normal operation.
Note: The Speed Trim System will not provide stabilizer trim inputs when
deviating from a trimmed airspeed.
...with the background
(...)To assist the flightcrew in properly responding to such
an occurrence, a non-normal checklist, called the Speed Trim Fail checklist, would be
added to the AFM. This checklist would be used when the STS and MCAS functions are
inoperative, and inform the flightcrew to continue normal operation. (...)
Protection from aerodynamic instability lost? Continue normal! Even in the notes no addressing of approach to stall issues. Wow. But the document states: checklist proposals may be altered as a result of flight evaluation.an occurrence, a non-normal checklist, called the Speed Trim Fail checklist, would be
added to the AFM. This checklist would be used when the STS and MCAS functions are
inoperative, and inform the flightcrew to continue normal operation. (...)
Regarding MEL and Flight Control System, this is suggested:
(1) Dispatch is not permitted with both autopilot systems inoperative.
(2) The autopilot disengage aural warning system must be operative for dispatch.
(3) The STAB OUT OF TRIM light must be operative for dispatch.
(4) The speed trim function must be operative for dispatch. NOTE: This requires both FCCs to be operative for dispatch.
(5) The SPEED TRIM FAIL light must be operative for dispatch.
(6) Dispatch is not permitted with both A/P ENGAGE Command (CMD) Switches (A and B) inoperative.
(7) Dispatch is not permitted with both A/P ENGAGE Command (CMD) switch lights inoperative.
(8) Dispatch is not permitted with both autopilot (A/P) disengage lights inoperative. Dispatch may be made with one A/P disengage light inoperative provided the autopilot disengage aural warning system operates normally.
(9) Dispatch is not permitted with both Control Wheel Autopilot Disengage Switches inoperative. Dispatch may be made with one control wheel autopilot disengage switch inoperative provided the following conditions are met. a) Mode Control Panel autopilot DISENGAGE bar operates normally, b) Autopilot is not used below 1,500 feet AGL, and c) Approach minimums do not require use of autopilot.
(10) Both control wheel trim switch systems must be operative for dispatch.
Last edited by Ray_Y; 4th Aug 2020 at 18:02. Reason: Completing the interesting content
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
Many failures of safety and envelope protection systems result in them being locked out for the rest of the flight following a sensor or computer malfunction, you normally can't dispatch without them but if they fail in flight you continue with appropriate mitigations.
And note that if the flight indeed could not be completed safely under normal circumstances, you would have to design some kind of backup or alternative - even a "land immediately" type instruction doesn't alter the fact that it will take some period of time to get back on the ground, so you have at least to be able to achieve that minimum "continued safe flight and landing" in any case.
derjodel, #187.
Q a). Presumably both Boeing and the FAA believe that a single MCAS cycle is sufficient to meet certification requirements for normal operation.
Item 6 page 22 describes the revised logic for further MCAS activation, this assumes appropriate pilot response to the change in stick force - adjusting AoA and re-trimming, as for normal manual flight, before further MCAS input.
However, the assumption of normality might not be so sound during manoeuvring flight, when MCAS AoA trim demand may be higher due to less trimming.
The key aspect appears to depend on comparisons with previous variants; thus in normal operation if a single activation is sufficient to match other 737 handling characteristics ( including range of possible cg ) then there is certification 'equivalence'. Also note that we don't know the extent of, or changes made to the MCAS AoA trigger point, which is described as involving time / magnitude, and previously sensed Mach.
Q b). From the above, a single, normal MCAS trim input would probably not be noticed by pilot, it adjusts the feel of the aircraft in the background.
With failure, MCAS trim input could occur in a situation where stab trim is very powerful and thus a hazard. The chosen point of trim-cutout would have to be a sufficient for the crew to retain control, within certification limits for 'abnormal' stick forces, and then manual trim, again without excessive force.
Equivalence' in abnormal operation; the resultant stability issue is certificated according to in-flight-failures as discussed in previous posts.
These points raise other concerns.
The trim monitor senses abnormal operation by comparing output from the FCCs. Is the detection at the 'box' output, or at the trim servo. If within the FCC, then an electrical short could still result in a trim runaway, which as in previous variants required pilot identification and timely action (challenged as an inappropriate assumption by the MCAS accidents). A hazard is that crews could be less concerned with trim runaway because of the new MCAS protections, and with similar limiting human performance may not react quickly enough. Again equivalence could be the judge; as debated widely in Pprune - trim failure, roller coaster, etc. The wiring changes may also be involved with this.
It is not clear how MCAS would function when disconnecting the AP where MCAS activation was required. Previous descriptions suggested that MCAS did not require stability enhancing trim input ( doesn't depend on stick force ), thus with AP disconnect the pilot may detect a 'jump in control response / stick force before MCAS trim is computed ( time / magnitude ).
Of greater concern is how the 737 autopilot manages AP control overpower. If it is similar to the 767 (re Atlas accident), then manual overpowering input could create a follow-up trim response without opposing MCAS input; i.e. aircraft trims into the turn with increased AoA, worst case trimming into a stall.
Q a). Presumably both Boeing and the FAA believe that a single MCAS cycle is sufficient to meet certification requirements for normal operation.
Item 6 page 22 describes the revised logic for further MCAS activation, this assumes appropriate pilot response to the change in stick force - adjusting AoA and re-trimming, as for normal manual flight, before further MCAS input.
However, the assumption of normality might not be so sound during manoeuvring flight, when MCAS AoA trim demand may be higher due to less trimming.
The key aspect appears to depend on comparisons with previous variants; thus in normal operation if a single activation is sufficient to match other 737 handling characteristics ( including range of possible cg ) then there is certification 'equivalence'. Also note that we don't know the extent of, or changes made to the MCAS AoA trigger point, which is described as involving time / magnitude, and previously sensed Mach.
Q b). From the above, a single, normal MCAS trim input would probably not be noticed by pilot, it adjusts the feel of the aircraft in the background.
With failure, MCAS trim input could occur in a situation where stab trim is very powerful and thus a hazard. The chosen point of trim-cutout would have to be a sufficient for the crew to retain control, within certification limits for 'abnormal' stick forces, and then manual trim, again without excessive force.
Equivalence' in abnormal operation; the resultant stability issue is certificated according to in-flight-failures as discussed in previous posts.
These points raise other concerns.
The trim monitor senses abnormal operation by comparing output from the FCCs. Is the detection at the 'box' output, or at the trim servo. If within the FCC, then an electrical short could still result in a trim runaway, which as in previous variants required pilot identification and timely action (challenged as an inappropriate assumption by the MCAS accidents). A hazard is that crews could be less concerned with trim runaway because of the new MCAS protections, and with similar limiting human performance may not react quickly enough. Again equivalence could be the judge; as debated widely in Pprune - trim failure, roller coaster, etc. The wiring changes may also be involved with this.
It is not clear how MCAS would function when disconnecting the AP where MCAS activation was required. Previous descriptions suggested that MCAS did not require stability enhancing trim input ( doesn't depend on stick force ), thus with AP disconnect the pilot may detect a 'jump in control response / stick force before MCAS trim is computed ( time / magnitude ).
Of greater concern is how the 737 autopilot manages AP control overpower. If it is similar to the 767 (re Atlas accident), then manual overpowering input could create a follow-up trim response without opposing MCAS input; i.e. aircraft trims into the turn with increased AoA, worst case trimming into a stall.
Last edited by safetypee; 4th Aug 2020 at 13:40.
Join Date: Oct 2017
Location: Vienna
Posts: 143
Likes: 0
Received 0 Likes
on
0 Posts
As for the single cycle... MCAS is triggered at specific AOA, presumably to comply with elevator feel, right? I mean, that was the original story. Now Boeing themselves are saying it's in order to "to enhance the pitch stability of the airplane", which does kinda smell like anti-stall system.
Anyway, let's assume AOA is exceeded (due to nacelle lift), MCAS is triggered, but AOA remains above threshold and even increases due to nacelle lift.. is this now the same event or new event? If AOA newer fell below threshold, it's the same event, right? But then, what's the point? Why have MCAS at all? Unless a single cycle is the magic potion. But if it is, why wasn't it designed as such in the first place. If a single cycle is enough, then surely Boeing is guilty for the two crashes?
Join Date: Jun 2020
Location: Europe
Posts: 22
Likes: 0
Received 0 Likes
on
0 Posts
So will you file comments to the FAA? Which ones? FAA published the NPRM early before it's formally available on regulations.gov:
And it's basically this invitation:
The FAA is posting the NPRM on its website today to enable the public to begin review early.
Comments Invited
The FAA invites you to participate in this rulemaking by submitting written comments, data, or views about this proposal. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. To ensure the docket does not contain duplicate comments, commenters should submit only one copy of the comments. Send your comments to an address listed under the ADDRESSES section. Include “Docket No. FAA-2020-0686; Product Identifier 2019-NM-035-AD” at the beginning of your comments.
The FAA invites you to participate in this rulemaking by submitting written comments, data, or views about this proposal. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. To ensure the docket does not contain duplicate comments, commenters should submit only one copy of the comments. Send your comments to an address listed under the ADDRESSES section. Include “Docket No. FAA-2020-0686; Product Identifier 2019-NM-035-AD” at the beginning of your comments.
Is EASA still insisting that the Max demonstrates acceptable high AOA handling characteristics without MCAS? Also what about the inability to move the trim wheel at higher airspeeds. Is the hillbilly roller coaster procedure going to be the only approved method?
I find it amazing that Boeing and the FAA still think it is OK to have an airplane where inside normal operation speed if the main stab trim motor fails or is turned off, the only other way to move the stab is with the manual wheels which can’t be moved by a normal human being unless significant into the out of trim control wheel deflection is applied. This is craziness.
I find it amazing that Boeing and the FAA still think it is OK to have an airplane where inside normal operation speed if the main stab trim motor fails or is turned off, the only other way to move the stab is with the manual wheels which can’t be moved by a normal human being unless significant into the out of trim control wheel deflection is applied. This is craziness.
Ehiopian’s mistake was, unfortunately, buying the airplane. Be assured that EASA, Transport Canada and FAA, including their test pilots and flight control specialists, after significant investigation, consider Boeing and the faulty Max design to be responsible.