Boeing 737 MAX

sbu22 said:

Based on this (the YouTube), it sounds like the computer weenies didn't bother checking in with the aviators in designing the system parameters. All the mods seem directed to curing pretty obvious, from an operational perspective, flaws.

Looks like the buyers who cheaped out on the optional second AOA sensor will have to retrofit #2 to accommodate the new software protocol.

I'm still disturbed that Boeing and at least some operators didn't see fit to prominently emphasise a new system that could directly affect flight controls in manuals and training.

Click to expand...

All of this stuff was in the links I posted in textual format.

And Boeing will pay for the extra input from the AOA...it is not at the Airline's expense. Many of these things are a simple switch.

sbu22 said:

... and at least some operators didn't see fit to prominently emphasise a new system that could directly affect flight controls in manuals and training.

Click to expand...

A lot of operators just use the training materials and manuals that Boeing gives them. The FAA shares some responsibility because they must approve each operator's training program. Using the approved manufacturer's manuals saves a lot of time and effort on the part of the operator.

Flyable up to a point.

Very good explanation of the changes by Boeing in AW. Here are the changes:

"Mike Sinnett,*Boeing Commercial Airplanes*vice president of product development and future airplane development, says the briefings continue to emphasize that the MCAS, which was added to the speed trim system (STS) to standardize handling qualities with those of the 737NG, is neither a stall protection or prevention function.

“It is a handling-qualities function. There’s a misconception it’s something [other],” he says. Added to ensure a linear relationship between stick force per G, “speed trim is a function of airspeed, so if you’re going fast it is a low angle-of-attack [AOA], and if you’re going slow it is at higher AOA,” Sinett says. “The thing you are trying to avoid is a situation where you are pulling back and all of a sudden it gets easier, and you wind up overshooting—making the nose higher than you want it to be.”

Making the system work required changes from the 737NG STS. “Mechanically on the NG, there is a column cut-off switch that stops any automatic trim when the column is back to a certain spot,” Sinnett says. “On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design. To do so, it activates based on AOA rather than speed, which is what speed trim does. Speed trim is a function of airspeed, MCAS is a function of angle-of-attack and Mach number, but it only triggers off AOA.”

The MCAS activation during the two MAX 8 accident sequences sparked Boeing’s decision to reexamine how the system operates and modify its software. The work began shortly after the Lion Air accident. The March 27 gathering briefed key proposed MCAS changes to 200 pilots and regulators.

The first of three new main layers of protection is provided by a cross-channel bus between the aircraft’s two flight-control computers, which now allows data from the two AOA sensors, or alpha vanes, to be shared and compared. “In a situation where there is erroneous AOA information, it will not lead to activation of MCAS,” says Sinnett, who underlines that the entire speed-trim system, including the MCAS, will be inhibited for the remainder of the flight if data from the two vanes varies by more than 5.5 deg. If an AOA disagree of more than 10 deg. occurs between the sensors for more than 10 sec., it will be flagged to the crew on the primary flight display.

The second layer of protection is a change to the logic in the MCAS algorithm that provides “a fundamental robust check to ensure that before it ever activates a second time, pilots really want it to activate,” says Sinnett.

The third layer of defense ensures pilots always retain some control-column authority to counteract MCAS nose-down stabilizer commands. “The column itself will always provide at least 1.2g of maneuvering capability,” he says. “So you don’t just have the ability to hold the nose level, you can still pitch up and climb.”

Sinnett says pilots seem satisfied that the three main layers of protection now added to the MCAS will prevent any potential repeat of the circumstances detected in the tragic Lion Air and Ethiopian accidents.
“The most compelling thing is that the AOA failure case turns into a run-of-the-mill AOA failure case [one] might have on any other airplane.”

I'm pretty confident that the fix will be solid.

The questions that remain are how this got through the design and review process and made it into production.

And how the pilots were not informed enough to handle it.

And since the review process failed, what other sneaky software bits are hidden in the computers?

An interesting discussion. A lot of stuff we already know but ti is a very dense compilation of what we know...and some stuff we didn't.

https://airinsight.com/boeings-max-...H3WY9ffIDEOqENVYi8VzGCkFiO9FxdCwP6lZ90c-9iiuc

As you listen to this I want to clarify something. When he is talking about the realm in which the pilots can trim, he is not wrong but not totally clear. If the flaps are up, the pilots can only use the electrical trim to trim to 2-3 units nose down(I don't remember the figure but it is in fact more than the 4 units he mentions). He makes the point that MCAS has the authority to go full deflection...which is true. BUT, the pilots can in fact use the electrim trim to trim FROM zero units on up into the normal zone. So to reiterate, we used to have a procedure while deicing to put the stabilizer full nose down. How that would take place was to use electric trim until it ran out of authority...around 2-3 units. And then we would manually trim via the wheel all the way to ZERO units. After deicing was complete, we could use the electrim FROM zero all the way back into the normal range.

I say this because he makes it sound like once it is below the authority of the electric trim, then the only way to get it back is the manual wheel. That is not the case. YOu can't get it all the way nose down via electric trim but you can in fact recover it from zero with electric trim. I hope that makes sense. He is not wrong in what he is saying. It is not perfectly clear based on the semantics he used.

Baker- listened to the podcast and it was informative.

One question sticks in my mind: In the Ethiopian incident, when they re-energized the electric trim cutout, if the pilot held the yoke trim switch in nose-up and yet MCAS was commanding nose down trim, what would the stabilizer do? Does the pilot or MCAS have authority over the other?

I think I know the answer as the E pilots once they re-energized trim did trim nose up, but only briefly and not enough to bring the AC into trim. Just trying to get it clear in my mind.

Great thread. I find it a very interesting read.

That and F Air Canada. Keep your standards low and they will be met.

Ski in NC said:

I'm pretty confident that the fix will be solid.

The questions that remain are how this got through the design and review process and made it into production.

And how the pilots were not informed enough to handle it.

And since the review process failed, what other sneaky software bits are hidden in the computers?

Click to expand...

This is at the heart of it. Boeing has lost the plot in relation to risk assessment and risk management.

The batteries on the 787 were an earlier example. The bright young things chose the wrong lithium chemistry, one that was known to have thermal runaway (under adverse conditions). Their heavy metal containment box 'fix' is a kludge. Why not change battery chemistry?

The tragic MCAS incidents are principally a failure of Boeing management's processes. The next crash is unlikely to be a battery or MCAS issue, but something else that poor design and implementation processes have overlooked.

It sounds like a case of a punt on "Commercial vs Safety" gone wrong.

Very important to discover why the errors occurred, less for rapping people over the knuckles, more for avoiding repetition.

Problem for Boeing now is that people traveling have lost faith in that plane, and airlines know it and will be hesitant to put this plane on their schedule knowing that this could impact booking. It is easy to loose faith hard to get it back...

L

Insequent said:

... The batteries on the 787 were an earlier example. The bright young things chose the wrong lithium chemistry, one that was known to have thermal runaway (under adverse conditions). Their heavy metal containment box 'fix' is a kludge. Why not change battery chemistry? ...

Click to expand...

Boeing specified the capacity, charge rate, environmental factors, weight, etc., etc., and then had some vendor supply a battery that met those specs. The chemistry was chosen to meet those specs by the vendor.

Apparently after some cycles, some batteries grew tendrils between the layers in the cells which caused shorts leading to a runaway.

The MCAS thing is a failure of imagination on the part of the system engineers. It may also be a common engineers' trap of thinking "Don't worry, my design is so good it'll never break."

"It is easy to loose faith hard to get it back..."


A simple name change usually does the trick for the public..

FF said:

"It is easy to loose faith hard to get it back..."


A simple name change usually does the trick for the public..

Click to expand...

Seariver Mediterranean comes to mind.

I was a fan of Oriental Nicety.

Ski in NC said:

Baker- listened to the podcast and it was informative.

One question sticks in my mind: In the Ethiopian incident, when they re-energized the electric trim cutout, if the pilot held the yoke trim switch in nose-up and yet MCAS was commanding nose down trim, what would the stabilizer do? Does the pilot or MCAS have authority over the other?

I think I know the answer as the E pilots once they re-energized trim did trim nose up, but only briefly and not enough to bring the AC into trim. Just trying to get it clear in my mind.

Click to expand...

Sorry for the late reply, Ski!!! I was out on the boat all weekend. We finally had a weekend of great weather and had a blast!!

To answer your question, the electrim trim has authority over the Speed Trim System which is really what MCAS is. So yes, for whatever reason they did trim a little nose up but not enough. One report referred to it as "two flicks" of the trim swtiches. And that caused the MCAS to reset itself and be able to trim the rest of the way to full nose down. It was the 350 hour copilot that was in control of the airplane at that point....mind blowing in my opinion. I had 2500 hours when I got hired by a regional and 7500 when I got hired by a major(with 3 type ratings and significant left seat time in a transport category airplane).

Baker said:

It was the 350 hour copilot that was in control of the airplane at that point....mind blowing in my opinion. I had 2500 hours when I got hired by a regional and 7500 when I got hired by a major(with 3 type ratings and significant left seat time in a transport category airplane).

Click to expand...

I asked about this earlier, but nobody took the bait.


Are those hours not massively lower than what's needed in practice in the US for either of those seats?

twistedtree said:

I asked about this earlier, but nobody took the bait.


Are those hours not massively lower than what's needed in practice in the US for either of those seats?

Click to expand...

Yes they are insanely low. Many European airlines do it this way as well. "Ab Initio" is what they used to call it...not sure if they still use that term. It is a program designed to take people from zero time to an airliner seat in very little time. I have a hard time with it. It definitely compromises the crew as the green copilot can be a drag on the performance of the crew. The captain at 8000ish hours is not necessarily lpow time. But I did have about 17000 hours before I saw the left seat at a major. Take it FWIW. There truly is no substitute for experience.

Lots of places outside the US have MPL licenses for aircrew members. This usually takes someone off the street and puts them into the F/O seat of a 737 or A320 after a couple of hundred hours (21-24 months training). It costs around US$100K to do it.

The interesting thing is that an MPL will let you fly F/O on an airliner carrying passengers but will not let you fly a 150 by yourself.

"The aim of the MPL training course is to provide a student with a multi-crew pilot licence (MPL) by training one to the level necessary to operate as a co-pilot in a multi-engine, multi-pilot, turbine-powered commercial air transport aeroplane under visual flight rules (VFR) and instrument flight rules (IFR)."

Ab-initio does not always mean MPL. All it means is that they are taking someone with no pilot experience and making them a pilot of one sort or another. Anyone who walks into the local FBO and wants to take flying lessons for a PPL is an ab-initio student.

In the US the minimum time required for an ATP is 1500 hours. However, there is no certificate weighting for the quality of those hours. Legally someone with 1500 hours of 150 time has the same qualification as someone with 1500 hours turbine multi-engine time. Practically it is different, but the 150 time meets the ATP hours requirement.

The practical number of hours you need to get a pilot position varies with the economy. In times of high demand the hours of new pilots goes down. During a recession, it can be hard for pilots with many thousands of hours to get jobs. In Asia, the Middle East, and parts of Europe, there is a very high demand for pilots which leads to MPL pilots and to western pilots taking jobs in Asia and the Middle East that pay them much more than the pilot jobs in their home countries.

https://www.zerohedge.com/news/2019...are-glitch-disabled-critical-alerts-737-max-8

Interesting bit about Boeing and FAA confused about what the software actually was supposed to do, or did, with disagreeing left/right AoA readings.

So what other "glitches" are in software? That is a universal question for the age, certainly not limited to the Max.

I don't know anything about Zerohedge, as to whether it is a credible source. Just found it while grazing the net...

Ski in NC said:

So what other "glitches" are in software? That is a universal question for the age, certainly not limited to the Max.

Click to expand...

I found this article informative on that subject. Hopefully you can read it.

https://spectrum.ieee.org/aerospace...37-max-disaster-looks-to-a-software-developer

ssobol said:

Lots of places outside the US have MPL licenses for aircrew members. This usually takes someone off the street and puts them into the F/O seat of a 737 or A320 after a couple of hundred hours (21-24 months training). It costs around US$100K to do it.

The interesting thing is that an MPL will let you fly F/O on an airliner carrying passengers but will not let you fly a 150 by yourself.

"The aim of the MPL training course is to provide a student with a multi-crew pilot licence (MPL) by training one to the level necessary to operate as a co-pilot in a multi-engine, multi-pilot, turbine-powered commercial air transport aeroplane under visual flight rules (VFR) and instrument flight rules (IFR)."

Ab-initio does not always mean MPL. All it means is that they are taking someone with no pilot experience and making them a pilot of one sort or another. Anyone who walks into the local FBO and wants to take flying lessons for a PPL is an ab-initio student.

In the US the minimum time required for an ATP is 1500 hours. However, there is no certificate weighting for the quality of those hours. Legally someone with 1500 hours of 150 time has the same qualification as someone with 1500 hours turbine multi-engine time. Practically it is different, but the 150 time meets the ATP hours requirement.

The practical number of hours you need to get a pilot position varies with the economy. In times of high demand the hours of new pilots goes down. During a recession, it can be hard for pilots with many thousands of hours to get jobs. In Asia, the Middle East, and parts of Europe, there is a very high demand for pilots which leads to MPL pilots and to western pilots taking jobs in Asia and the Middle East that pay them much more than the pilot jobs in their home countries.

Click to expand...

Good points... never heard of a MPL license. It's very interesting the qualifications that pilots get hired with. Back in the 60s it wasn't uncommon for a guy with a private pilots license and 200 hours to be hired by a major carrier. In the 70s, you couldn't buy an airline job (let alone a corporate job) with 5000 hours of jet time, college degree, married with 1 and 1/2 kids (that was the minimum requirements them).

Now, US carriers are required to hire pilot with at least 1500 hours, so no more "boy wonders". Like Baker, I had close to 6000 hours before hired by a major, but only took 6 years to the Captains seat which was fast.

The 200 hour copilots are just along for the ride until they get some experience. At that level, they are a hinderance, not a help. And most of them bow down to the captain, even if he's wrong. That culture has changed dramatically in the US, but apparently not elsewhere.

Jeff F said:

I found this article informative on that subject. Hopefully you can read it.

https://spectrum.ieee.org/aerospace...37-max-disaster-looks-to-a-software-developer

Click to expand...

Great link on coping with weight and balance changes with software.

Seevee said:

... And most of them bow down to the captain, even if he's wrong. That culture has changed dramatically in the US, but apparently not elsewhere.

Click to expand...

In the US the days of "the captain is God" has passed. However, in other regions, especially Asia, this is a bigger problem. When a person is indoctrinated from birth to respect their elders, it is very hard to stand up to someone senior to them even when the plane is clearly headed towards a bad end.

There is an example in the US several years ago of a small turbo prop operator where the captain would actually smack the F/O if the F/O said something the captain didn't agree with. Didn't take long for the F/O to stop saying things. In the end it turned out like you'd expect.

The Asiana crash is a perfect example of cultural issues. Everyone in the cockpit knew what was going on...except the captain. That was pure luck that more people didn't die. The airplane almost flipped....but did not. Had it flipped, most souls would have been lost...IMO. Oh and no fire....pure luck!!!

Asiana crash, July 2013, nearly six years ago. Does this sound familiar?

“The National Transportation Safety Board determines that (among other things) contributing to the accident were (1) the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing's documentation and Asiana's pilot training”

soin2la said:

Asiana crash, July 2013, nearly six years ago. Does this sound familiar?

“The National Transportation Safety Board determines that (among other things) contributing to the accident were (1) the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing's documentation and Asiana's pilot training”

Click to expand...

The "ARM" mode of the autothrottle can be confusing. It happens when the pilot is trying to overpower the A/T..and the computer basically says, you want it, you got it!!! And it goes into "passive" mode. The bottom line here is that the pilot should not have been in most of these modes this close to the ground nor V/S. THey should have been in the Approach mode and on the ILS with it coupled up.

soin2la said:

Asiana crash, July 2013, nearly six years ago. Does this sound familiar?

“The National Transportation Safety Board determines that (among other things) contributing to the accident were (1) the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing's documentation and Asiana's pilot training”

Click to expand...

Surprising. I thought that one was pilot error. And disturbing,we flew on Asiana into San Francisco not long before.

BruceK said:

Surprising. I thought that one was pilot error. And disturbing,we flew on Asiana into San Francisco not long before.

Click to expand...

It was majorly big time pilot error. And major big time poor training. Contributing factor may have been Boeing's lack of information on the flight control system.

From Aviation Week:

A simulator session flown by a US-based Boeing 737 MAX crew that mimicked a key portion of the Ethiopian Airlines ET302 crash sequence suggests the*Ethiopian crew*faced a near-impossible task of getting the aircraft back under control, and underscores the importance of pilots understanding severe runaway trim recovery procedures.

Details of the session, shared with*ATW, were flown voluntarily as part of routine, recurrent*training. Its purpose: practice recovering from a scenario in which the aircraft was out of trim and wanting to descend while flying at a high rate of speed. This is what the ET302 crew faced when it toggled cutout switches to de-power the MAX’s automatic stabilizer trim motor, disabling the maneuvering characteristics augmentation system (MCAS) that was erroneously trimming the horizontal stabilizer nose-down.

In such a scenario, once the trim motor is de-powered, pilots must use the hand-operated manual trim wheels to adjust the stabilizers. But they also must keep the aircraft from descending by pulling back on the control columns to deflect the elevator portions of the stabilizer upward. Aerodynamic forces from the nose-up elevator deflection make the entire stabilizer more difficult to move, and higher airspeed exacerbates the issue.

The US crew tested this by setting up a 737 Next Generation*simulator at 10,000 ft., 250 kt. and 2 deg. nose up stabilizer trim. This is slightly higher altitude, but otherwise similar to what the ET302 crew faced as it de-powered the trim motors 3 min. into the 6 min. flight, and about 1 min. after the first uncommanded MCAS input.*Leading up to the scenario, the Ethiopian crew used column-mounted manual electric trim to counter some of the MCAS inputs, but did not get the aircraft back to level trim, as the 737 manual instructs before de-powering the stabilizer trim motor. The crew also did not reduce their unusually high speed.

What the US crew found was eye-opening: keeping the aircraft level required significant aft-column pressure by the captain, and aerodynamic forces prevented the first officer from moving the trim wheel a full turn. They resorted to a little-known procedure to regain control.

ADVERTISING, MOUSE OVER FOR AUDIO

The crew repeatedly executed a three-step process known as the roller coaster: First, let the aircraft’s nose drop, removing elevator nose-down force.*Second, crank the trim wheel, inputting nose-up stabilizer, as the aircraft descends. Third, pull back on the yokes to raise the nose and slow the descent.

The excessive descent rates during the first two steps meant the crew got as low as 2,000 ft. during the recovery.

The Ethiopian Ministry of Transport preliminary report on the March 10 ET302 accident suggests the crew attempted to use manual trim after de-powering the stabilizer motors, but determined it “was not working,” the report said. A constant trust setting at 94% N1 meant ET302’s airspeed increased to the 737 MAX’s maximum (Vmo), 340 kt., soon after the stabilizer trim motors were cut off, and did not drop below that level for the remainder of the flight. The pilots, struggling to keep the aircraft from descending, also maintained steady to strong aft control-column inputs from the time MCAS first fired through the end of the flight.*

The US crew’s session and a video posted recently by YouTube’s Mentour Pilot that shows a similar scenario inside a simulator suggest the resulting forces on ET302’s stabilizer would have made it nearly impossible to move by hand.

Neither the current 737 flight manual nor any*MCAS-related guidance*issued by Boeing in the wake of October’s crash of*Lion Air JT610, when MCAS first came to light for most pilots, discuss the roller-coaster procedure for recovering from severe out-of-trim conditions. The 737 manual explains that “effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions,” but does not provide details.

The pilot who shared the scenario said he learned the roller coaster procedure from excerpts of a 737-200 manual posted in an online pilot forum in the wake of the MAX accidents. It is not taught at his airline.

Boeing’s assumption was that erroneous stabilizer nose-down inputs by MCAS, such as those experienced by both the JT610 and ET302 crews, would be diagnosed as runaway stabilizer. The checklist to counter runaway stabilizer includes using the cutout switches to de-power the stabilizer trim motor. The ET302 crew followed this, but not until the aircraft was severely out of trim following the MCAS inputs triggered by faulty angle-of-attack (AOA) data that told the system the aircraft’s nose was too high.

Unable to move the stabilizer manually, the ET302 crew moved the cutout switches to power the stabilizer trim motors—something the runaway stabilizer checklist states should not be done. While this enabled their column-mounted electric trim input switches, it*also re-activated MCAS, which again received the faulty AOA data and trimmed the stabilizer nose down, leading to a fatal dive.

The simulator session underscored the importance of reacting quickly to uncommanded stabilizer movements and avoiding a severe out-of-trim condition, one of the pilots involved said. “I don’t think the situation would be survivable at 350 kt. and below 5,000 ft.,” this pilot noted.*

The ET302 crew climbed through 5,000 ft. shortly after de-powering the trim motors, and got to about 8,000 ft.—the same amount of altitude the US crew used up during the roller-coaster maneuvers—before the final dive.

A second pilot not involved in the session but who reviewed the scenario’s details said it highlighted several training opportunities.

“This is the sort of simulator experience airline crews need to gain an understanding of how runaway trim can make the aircraft very difficult to control, and how important it is to rehearse use of manual trim inputs,” this pilot said.*

While Boeing’s runaway stabilizer checklist does not specify it, the second pilot recommended a maximum thrust of 75% N1 and a 4 deg. nose-up pitch to keep airspeed under control.

Boeing is developing*modifications*to MCAS as well as additional training.*Simulator sessions*are expected to be integrated into recurrent training, and may be required by some regulators, and opted for by some airlines, before pilots are cleared to fly MAXs again. The MAX fleet has been grounded since mid-March, a direct result of the two accidents.

Sean Broderick,*sean.broderick@aviationweek.com