MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures Mk II
 

It is not clear (to me at least) how exactly the modified FC software (including tamed MCAS) can allow re-certification.

1) The original certification was heavily based on "grandfather rights" (an arrangement under which an aircraft can be approved per a variation of the original Type Certificate, simplifying certification and allowing to ignore some new requirements that the original did not have to meet). It is not sure to what degree the FAA will now allows that, much less all other certification authorities. Loss of all grandfather right would immensely complicate return to service, and the following.

2) MCAS is there to mitigate at least an unsatisfactory stick feel, which would be un-certifiable (without MCAS) under the current type certificate. Some speculate MCAS may even be required to mitigate a deeper nose-up tendency in some corners of the flight envelope. Thus MCAS should be highly reliable. But the current hardware is not meant for that: only two FC and AOA vanes, and some scenarios disable MCAS leaving the plane without its protection.

3) The elevator can't be actuated manually (using trim wheel) in some (abnormal) conditions of the flight envelope (heavy mistrim at high speed), because the muscular force of the pilots is just not high enough. This always has been a serious issue with the 737, worsened with design changes (smaller trim wheel) of the NG also applying to the MAX. There is evidence that this issue was involved in the ET302 crash. Partial mitigation (yoyo maneuver) is not longer taught to pilots, many simulators do not attempt to simulate trim wheel force, and it surfaced that those that do had not been properly simulating that.

4) It surfaced that in the opinion of a panel of FAA engineers, the MAX did not meet standards of protection against shrapnel that could be thrown by engine malfunction and could severe essential cables, leading to loss of control: the larger engines increase the risk, and the standards became more stringent. This judgment was apparently overruled, but the facts remains, and 1 seems to make it worse from a re-certification standpoint.

What's Boeing plan on these items ? I vaguely see a tenable position that with extra pilot qualification, the plane is flyable with MCAS disabled, and pilots have time enough to react so that the plane does not enter the abnormal conditions making the trim wheel inop. Can that can take care of 2/3, facing 1? And what about 4 facing 1?

Financial Times, today:

Checklist - delay
 

The reported of poor performance in checklist action during simulator tests might identify further problems.
Assuming that MCAS 2.0 is sufficiently protected from AoA input failure - MCAS trim is inhibited, then why should checklist items be of great concern.

Considering the MAX as an extension of the NG, the baseline alerts with AoA failure are the Air Data disagree alerts (speed, altitude), Feel Diff Pressure - higher stick force, together with AP disengagement and continuous Stick Shake. Also, there will be changes in the EFIS display of speed and altitude and the low speed awareness symbology, and AoA display if shown.
The addition of AoA (mis compare) alert might not be a significant burden; it is available for the NG.

We might confidently assume that there will be an MCAS ‘OFF’ (fail /inhibit) alert, but the consequences of this on flight restriction is not known.
Why should there be discussion about additional checks; would this involve further layer of trim inhibit - manual switching.
If so why; MCAS inhibit should be sufficiently robust so that pilots do not have to disable electric trim (assume no AP/FD due to Air Data Issues).

Why was there reference to a reset procedure; why should MCAS be reset. It might be expected that the aircraft can be flown safely - away from the edges of the flight envelope, and thus for landing similar to any other system malfunction. If not … what is the nature of the residual problem - stability, manual handling, stick force (higher forces due to Feel Diff).

If the problem has its roots in the combination of many alerts, then the after takeoff situation might be most limiting, irrespective of the accident crews performance. There is no need to inhibit MCAS (trim system) immediately if the flap inhibit works, but if it is inhibited, then it may be overly difficult to manage the flight and several drills without electric trim. The NG would be similar except for inhibiting the trim; which could strengthen any argument that pilot trimming is a high workload task in combination checklist actions.

Also see discussion on trim issues in https://www.pprune.org/rumours-news/...l#post10642086
Would the trim characteristics add problems with manual trim wheel operation and stick centering/feel, particularly when resolving stick shake and unreliable airspeed issues with higher stick forces ?
Would higher stick force (feel diff) change the feel - the ease of operating the trim wheel ?

What pitch instability? It's just a nonlinear control response which might or might not affect the pilot. It apparently does not affect the autopilot although maybe MCAS is not needed for the autopilot because the autopilot is not capable of entering the flight regime which Boeing is keeping to itself.

That seems to be a question that has not yet been adequately answered -- at least not clearly and publicly. From the JATR report:

You think it’s a big call? Boeing and the certifying authorities are well advised to not cock this up again by taking any shortcuts. If they do, and there is yet another accident which can be traced back to MCAS and/or basic problems with the aerodynamic stability of the airframe, Boeing is going to be toast, at least in the short/med haul sector.
Sure, the stock market may still hope that there is a quick short term solution for the MAX problem. But that very same stock market is not very loyal and will drop Boeing like a hot piece of charcoal on any new mishap.

It doesn't matter for the AP because the AP doesn't care about stick force gradient.

fgrieu, #1, medod, #4,
The basic aircraft was certificated on the basis of MCAS. The theory and inservice experience confirmed that this option is satisfactory, excepting for AoA malfunction.
Thus the approval to fly again depends on the robustness of the changes to protect the system from AoA malfunction; evaluated as required against existing requirements and recommendations from accident investigations.
Technically the second iteration of modification appears to be satisfactory. However, there appears to be issues with pilot interaction, using checklists, presumably after the system has failed safe, #3 considers these.

The aircraft is not inherently unstable; there is a reduction in stability margin in small areas of the flight envelope, which MCAS alleviates.
There should not be any significant concerns about abnormal flight without MCAS - after an inhibit - an assumption. The aircraft has ‘normal’ stability characteristic in most areas of the flight envelope - as demonstrated with lengthy time in service - but how often did MCAS work. Crews can be alerted to the need for care in the less stable ‘corner points’ when flying without MCAS.

The remaining oddity is trim. Historically the 737 trim has been ‘different’, which has changed (for the worse) with series development - extensive tech log discussion.
In the NG, a trim runaway appears to be acceptable, but depends on quick pilot reaction - trim inhibit, and as a last resort a yo-yo recovery manoeuvre (not in all situations - certification probability argument for acceptability).

The Max might have crossed the boundary of acceptability for timely pilot intervention and/or an increased need for, or impractical yo-yo.
How far does the trim run before MCAS shuts down, is this offset acceptable in every possible part of the flight envelope; with consideration of the variability and physical range of human ability to operate the trim wheel, (5sec ?)
How does a non MCAS Max differ from the NG; do aerodynamic differences effect the ability to trim with the wheel ?

The certification requirements involve judgement of how much piloting contribution can be assumed towards mitigating failures - with all alerted conditions coincident with, and consequential to an AoA failure. Whatever ‘piloting’ arguments have been used for NG have been negated by the two accidents in the Max; thus assessments are now clean sheet reappraisals by an authority under national and international pressure to demonstrate the highest quality processes.

Overall, excellent summary

But what to do about the bolded section above?

The masses of reader opinion are calling for a massive crackdown on the FAA-Boeing interaction process regarding product certification. But where is the update to the assumption about pilot responses to unreliable instruments and their aircraft response?

How can we expect a manufacturer to make a product that is airworthy yet confuses a crew? Is that in the certification review of the FARs or just a trust by the regulator that they can ultimately find blame outside their own processes?

Methinks this is not a Boeing problem to be buried in a grounding until the questions stop and enough pain endured

Could you expand on this statement? This sounds like the sort of thing that the shipyard's lawyer says after the boat tips over...

If it can't be fixed within a year can it ever be fixed?

I don't think that's accurate. First, by definition, theory can't confirm anything. And it is doubtful that MAX with MCAS 1.0 saw enough inservice time to confirm that it was satisfactory except for AoA failure.

We have nothing but weakly-sourced reports about MCAS 2.0

Again, none of us have seen data on the aerodynamics of the bare airframe. And many, including JATR, think it would be wise to find out just how it behaves in those corners without MCAS.

Yes, so far, just an assumption.

The MAX has not had "lengthy time in service."

If anyone has any clue as to the answer to that question, it certainly hasn't been made public.

Assuming that the airplane can be certified to fly without MCAS.

Unless the regulations change, one way it differs is that it can't be certified.

lomapasseo,
:ok:
Much of the judgement about human-system interaction is in the application of AMC 25.1302 ‘Installed Systems and Equipment for Use by the Flight Crew’ (I assume that you are familiar).
The application and processes for the 737 Max failed.

The requirement is ‘relatively’ new such that early versions of the 737 may not have had a full evaluation. The industry has struggled (continues to do so) with the human aspects. The dependence on judgement vs hard regulation requirers that both manufacturers and regulators understand and agree critical assumptions and justifications. This process was weakened with self certification and poor regulatory oversight, and thus the appropriate application of the requirement is central to the 737 Max re-evaluation.
The task involves both aircraft modification and reviewing / repairing the regulatory process, the latter requiring more regulators, trained and conversant with the 737, in regulation interpretation, and processes for evaluation, approval; … time.

The ‘massive crackdown on the FAA-Boeing interaction process regarding product certification‘ is required, but it’s not directly part of the current regulatory process; who oversees the regulators. Max flights don’t depend on this as it appears that the manufacturer is largely excluded from current ‘judgements’.

Water pilot, certification stability requirements depend on increasing stick force with speed reduction (fixed trim). This is particularly important at low speed where increasing pull helps identify approach to the stall. If the force required reverses - decreases, or the aircraft exhibits tendency to pitch-up into the stall, these identify unacceptable stability characteristics without being ‘unstable’. The details are within the lengthy and complex requirements of CS / FAR part 25.
The Max appears to differ in the nature of the low speed characteristics and also when manoeuvring at high speed - use of AoA / Mach vs speed; there are few precise details.

P.S. You or others might wish to see the free course https://www.futurelearn.com/courses/flight-mechanics stability is in week 4

From Bloomberg:

OldnGrounded,
Certification approval is a mixture of theory, design, engineering, documentation, proof of concept, assessment, and testing. It does not depend on being inservice for some time.

There are some significant assumptions; reading between the lines, and extrapolation of what is known publicly …, … joining up the dots; but first what is a ‘dot’.

Normal stability throughout the flight envelope had to be demonstrated in certification. No abnormalities were identified (excluding the MCAS flight envelope). Indeed the Max ‘had to be the same’ as previous series.

The task is not to provide type certification without MCAS; the ‘naked’ 737 Max does not meet requirements. Within the certification process it is necessary to asses an aircraft for abnormal operation after a required system fails, e.g. 737 single engine flight is within certification, being ‘acceptable’ for emergency operation, safety recovery and landing.

The extent of 737 Max approval for abnormal operation with MCAS inhibited is not known; we assume that it would not involve significant flight restrictions - slow down, select flaps - trim. However, within that assumption, the extent and use of checklists appears to be a problem; human machine interaction.

The abnormal piloting task has to consider the overall operation with AoA disagree, other failed systems; simultaneously no MCAS - offset trim, recover attitude, continuous Stick Shake, Air Data disagree - use st by instruments, incorrect low speed awareness, increased stick force (feel diff), manual operated wheel trim.
The approval of this operation requires judgement, of piloting capability, in context, at any time, to public satisfaction via the FAA, with or without published reasoning.
First the FAA has to reacquire public trust, not change regulations.

Is it possible for Boeing to somehow support its own stock price?

You are a cool dude not worrying about stick gradients, but when I handfly it is usually at minimum maneuvering speeds, that is high(er) AOA and I also make turns and look out the window as well so I do worry about stick gradients.
I also don’t follow your reasoning for windshear, that is instrument flying, overcontrolling is a known threat in any aircraft. It requires tunneling on pitch/ flightdirector guidance and stickforces are different from day to day operation already..

Certification approval is a mixture of theory, design, engineering, documentation, proof of concept, assessment, and testing self-imposed as a result of successful lobbying to the FAA.

Sorry, I couldn't resist! Seriously though, the trust aspect is a major factor now, especially outside the US.

FAA and Boeing has a bit of work to do in rebuilding this trust, and so far I don't know if there's been much progress. Considering how a "released cargo door" can turn out to be a split fuselage (777x wing loading), I'm not sure how to interpret light stick load in relation to pitch up tendencies of the Max. I would prefer to see results of the bare airframe stall characteristics (as asked for by JATR in recommendation R3.4) before taking Boeings word for what is the purpose of MCAS.

For the -800 AP engage was min 400', but most SOP was higher. Is this the same for the MAX?

Of course. I was responding to an assertion that theory and long service had "confirmed" satisfactory operation excep in the case of AoA failure. That, rather obviously, is not accurate.

Yes, and concern about possible, not-previously-identified issues are rather widespread, which is what I said.

Anyway, I think you may be responding to an interpretation of what I wrote rather than to the plain language. I'll take a close look and stand corrected if I "spoke" in error.

Sure, Boeing is a master at that. Dividends and buybacks have been key parts of the effort for quite some time, and the list of other possible tactics is long.

Many old aircraft wouldn't meet today's certification requirements and that's is what the B737 basically is, an old generation jet tarted up. Imagine trying to get the B707 certified against modern regulations concerning handling, performance and safety. It would be a nightmare, easier to make a clean start with a new aircraft designed with today's regs in mind, incorporating modern systems in the design process, rather than trying to bolt them on afterwards.

Boeing have some of the best brains in the industry working for them, state of the art production facilities and are capable of making a class leading narrowbody replacement for the B737. Everything was going well until the B787 came along at which point it was apparent that the things were going off the rails. The "old" Boeing Company produced some excellent aircraft such as the current generation B777 which dominates its section of the market and has an enviable safety record.

Hard decisions need to be made in the next few weeks:

1. Bite the bullet and pull the plug on the MAX, scrap 400+ airframes, nearly 100 fuselages and pay everyone compensation. Back to the drawing board for a new type designed by engineers, not accountants and properly certified by the FAA. Whilst this would be the best solution, the amount of money involved would be colossal given the 5 - 10 year lead time, expense of developing a new type and greatly reduced income during this time. Government support along the lines of that given to the auto industry would be necessary on the "too big to fail basis". Also all the rhetoric about EU support for Airbus would seem rather hypocritical.

2. Persevere with getting the MAX flying again at whatever cost whilst hoping the band aid solution is acceptable to aviation authorities in the rest of the world, particularly the Chinese. Develop a replacement as quickly as possible alongside changing the company culture back to quality and safety instead of cost cutting and share price.

If the MAX solution isn't unanimously accepted by the world's aviation authorities, which is quite possible, and the type is only approved to fly in certain regions, then Boeing will be practically giving them away in order to maintain market share and customers. Complaints about dumping would undoubtedly be forthcoming to the WTO, sound familiar ? Airlines will be offering seats for free to those willing to fly on an aircraft which is banned on safety grounds in other countries.

After years of accusations of state support for Airbus, it will be interesting to hear the American explanation if they are forced to step in and prop up Boeing, which is becoming a real possibility given the contribution it makes to the US economy and knock on effects of a failure.

At one time Britain dominated the aircraft industry and was a major car producer, that all changed. Unless Boeing get their act together quickly, we could be watching a "sea change" in the world aerospace industry with Airbus dominating, the Chinese taking second place and Boeing coming third.

Any fix to the MAX in its present form would be a band aid solution to a fundamentally flawed design, this may or may not be acceptable depending on the quality and strength of the bandage. If not, see solution #1.

Whatever happens, cost cutting and share price need to take a backseat to the ethos of safety and quality.

As I'm sure I've mentioned, I don't think customers world-wide would be very happy about the value of their MAX acquisitions.

A middle road? Possibly an agreed loss making price based on ten years use of the aircraft. Airlines win and there's some revenue to buffer the losses. However, my heart sank when I saw the lawsuit filed by the Dublin firm. Could it be that's why Dennis ordered the suspension of production?

If Boeing were to give up on the MAX - not getting the grounding lifted, buying back and scrapping the previously delivered MAX aircraft plus over 400 more built but undelivered MAX - the resultant total loss would be well in excess of $100 billion (USD). Even if Boeing survived such a hit (not to mention the impacted suppliers), coming with a clean sheet replacement and putting it into production would take a decade. Just financing such a new aircraft program is going to be a challenge after taking a $100+ billion hit. Boeing might even decide to concede the narrow body market and focus on wide bodies.
I doubt even the biggest Airbus fans would see granting them a virtual monopoly on the narrow body market for at least the next decade as desirable for the long term health of commercial aviation.

I think that this is a massive overstatement of the situation. Fundamentally flawed? Really?

The reality is the aircraft flew for nearly two years before the first incident. Both crashes related to the AoA vane and crew responses to an "unknown" system, at least the first crash.

The defect is reliance on a single input to a system with a great deal of authority to put the aircraft out of trim. This is significant in an industry where many pilots are apprehensive about hand flying and may have lost the trim response reaction that may have once had, or never did.

The MCAS is fixable. What remains in question is whether regulatory agencies will approve the fix and whether politics will play a large part in the answer to that.

With the investments that they are doing into aerospace, China is not going to be second place unless we in the west get our act together pronto...

The skills available and the skills required must match, a state of the art supersonic fighter requires a thoroughly trained and highly skilled pilot which the operating airforce supplies through careful selection and lengthy instruction. Boeing must have known about the deterioration in flying skills and training levels and should have accounted for this by making the aircraft easier to fly, and building in safety systems like Airbus did with its ECAM and flight envelope protections. Basically, Airbus dumbed down it's entry level product to suit the new generation of pilots who would be flying it whereas Boeing didn't.

The MAX is fundamentally flawed because it took the basic B737 design way past the point where it was supposed to go. It was never meant to have a fuselage of that length or engines of that size. It should have been put to bed with the last 200 series in the 1980s and a clean sheet design produced. Even the 300 series wasn't meant for high bypass engines and had to have the bottom of the cowlings flattened out, the 700 series was an improvement but by that stage the systems should have been brought up to modern standards rather than trying to ride along on the original type certificate. The MAX shouldn't have been produced if it lacked modern safety systems and required MCAS to alleviate an aerodynamic problem.

The reality is the aircraft flew for nearly two years

How long did the Space Shuttle fly before the first disaster ?

Yes. They have a Public Relations smoke and mirrors department.

Has any other passenger transport aircraft achieved a death rate of 137 per annum ?

MCAS seems so deeply rooted in the 737 MAX's flight control systems it seems pretty obvious to most of us here that Boeing still cannot fathom out, nor procure a safe fixable software rewrite/redesign/patch solution, (whatever you want to name it) to gain back the aircraft's stability thus to get it back in line with it's 1967 737-100/200 type approval Grandfather rights certificate,

Thus the current 737 MAX air frame is unstable (as is) in certain flight envelopes, thus un-certifiable on that old type ticket approval.(and likely should never have been approved)
Which is we we are at right now with all new production halted after months of soothing noises, and lots of hand wringing, but NO fix.

To now start a re-design of the air frame, or part of it (Thus to remove the need for MCAS) will surely mean a new type approval needed and 737NG crews will not be able to fly such a
reincarnation on the same licence. (which was not part of the MAX deal to airlines as we know)

This is utterly meaningless. Statistics based on two incidents . . . well, just isn't.

The following is based on years of strong feelings about ETOPS and indeed, very inexperienced P2's.

I coined the phrase years ago, randomness comes in lumps. Also, given the two AoA sensor failures were of a disparate nature, having two failures so close together was bizarre bad luck. Yes, I know the fact that one item failing and causing such chaos is the prime issue, but that core failure in each case was because of a third-party manufacturer's design (or refurb company's quality control) in the first accident, and perhaps an 'Act of God' in the second. However, I'm not so sure about that. The unit is mechanically complex and at first glance, robust. But as we've seen, it has frailties; certain vulnerabilities that make the continued use of it very questionable. Use the output of two? Still open to a statistical lump, but so is flying over water with one engine out.

And that would bring me to having one experienced pilot and a kid out of school as the total means of controlling all this wondrous technology. What is incredible is the historic wellbeing of the only really competent soul on board - specifically where the P2 is very inexperienced. I suppose having the captain out of the loop leaves a situation much like the worst ETOPS scenario. The numbers favour success but really don't make much allowance for the lumpiness of statistics.

Yes of course it was meaningless. It was a response to the equally meaningless point that the MAX hadn't crashed for nearly two years.

If we're talking about whether the MAX returns to service with MCAS or not, it's only fixable if regulators approve the fix. Absent approval, a "fix" is just a proposal.

Politics is the way people govern themselves and each other. It plays a large part in every collective process and decision.