B737MAX Grounded Worldwide Q1 2019

PixelFlight · Sun Mar 31, 2019 6:17 pm

planecane wrote:
While you make some very good points about the design/oversight, bad engineering and management decisions are not criminal acts. Unless there are emails that show someone being told that a sensor failure could cause a situation where pilots won't know what to do and the plane will crash, nobody will be in jail. Boeing will certainly be held liable for damages in civil court.

My guess would be that any emails about the reaction of MCAS to an AoA sensor failure will show an expectation that the pilots would recognize it as runaway trim, hit the cutoff switches and land safely. Bad assumption? Absolutely. Criminal? Not if that is what happened.

While this story will most probably end like you describes, as a engineer I found hard to believe that within all the talents involved in a such big aircraft program none of them have even challenged the safety of a such borderline MCAS design modification. My guess is that the modification was done by a minimum of peoples that purposely keep the information from spreading as normal into the safety and certification processes. There could be penal liability if a such intention can be proved.

Revelation · Sun Mar 31, 2019 6:36 pm

zeke wrote:
Certification paperwork shows the compliance with various regulations, it does not go into the decision making process or trade offs that were made during development.

MCAS itself is not a FAR 25 required feature, it a tool that was used to meet a stability requirement. It is very likely the fine details of the actual inner workings of the system were never presented to the FAA.

Manufacturers do this to give themselves some room to make improvements with in service data.

I hope you are not suggesting the reviews of the certification paperwork that various world wide aviation regulators have announced are going to be of little value.

That might give some people license to reach the conclusion that they are political rather than technical exercises.

PixelFlight wrote:
While this story will most probably end like you describes, as a engineer I found hard to believe that within all the talents involved in a such big aircraft program none of them have even challenged the safety of a such borderline MCAS design modification. My guess is that the modification was done by a minimum of peoples that purposely keep the information from spreading as normal into the safety and certification processes. There could be penal liability if a such intention can be proved.

Strange. In my experience as a (non-aviation) engineer, I often find "split horizon" problems, where one set of engineers reaches conclusions based on access to one subset of information or based on their specializations whereas different groups of engineers with access to different subsets of information and different skill sets reaches different conclusions, and a problem that looks basic in hind sight is really hard to identify and resolve.

Amiga500 tells us this problem should have been found by any one of seven different sets of engineers, yet we know it was not. It will be interesting to find out what all the various investigations conclude.

markno · Sun Mar 31, 2019 10:24 pm

keesje wrote:
Maybe MCAS/ trimming based on 1 AOA sensor was allowed under grandfathered certification requirements, instead of today requirements.

Finn350 wrote:
As I understand it, the single AoA reading is used for a trim stabilization (STS) in the 737NG series. Trim stabilization is not flight critical, and if it fails there are no flight safety considerations. MCAS in the 737 MAX is similar to the STS in the 737 NG except MCAS is flight critical. I suppose they didn’t properly account single sensor failure modes when designing MCAS.

Grandfathered certification requirements sounds to me not only bad, a bit positive, too.

I can imagine that a Boeing employee might have had the wish to multiply safety, going over the 1 AoA sensor requirement. Since until now nobody said they are going to mount more sensors for the fixed software to work, I assume that the 737-Max already has two or more units that can measure AoA. So what the employee must have felt (?) is like owning a multi-core PC and looking for software with multi-core support.

When their boss had answered "We just have no time" for that, I would find it a bit disturbing. A "Don't break the whole system" would be more understandable for me.

How does the 320neo use less fuel, bigger nacelles or other stall characteristics? Is the only answer to use more AoA sensors? I still wonder a bit whether filters (kalman?) that combine the sensor data have problems, or how likely it is that both sensors fail for frost or dirt. Otherwise, going just for the FAA safety requirement when there is hardware mounted that can do more, is to me illogical.

zeke · Sun Mar 31, 2019 10:47 pm

Revelation wrote:
I hope you are not suggesting the reviews of the certification paperwork that various world wide aviation regulators have announced are going to be of little value.

That might give some people license to reach the conclusion that they are political rather than technical exercises.

A purely technical exercise, however MCAS does not need to be installed in order to meet requirements. Boeing could meet the technical requirement by whichever means they desire.

There is no requirement under the FARs for any aircraft to have a system called MCAS installed. There is no FAR that says MCAS must be installed like GPWS or TCAS.

acechip · Sun Mar 31, 2019 11:42 pm

If Boeing is now talking about reduced intervention of MCAS under the AOA input failure conditions, then what is the purpose of MCAS itself if the plane is deemed controllable in that situation? Either there are larger implications of MCAS in the overall flight regime (sufficient to keep the software itself), or it is just a hurriedly implemented solution, the impact of which was missed under the single AOA sensor failure mode.

9Patch · Mon Apr 01, 2019 12:40 am

mjoelnir wrote:

There are clear differences to the battery issue.

The box was an acceptable solution, practical a bomb.container, taking completely out the danger of an explosion in the electrical cabinet.
I still do not understand how thick people were. A lithium ion battery is based on a hydrocarbon solvent. When heated you get hydrocarbon gas in an electrical cabinet, where spark plugs abound aka relays producing sparks when switching.
The rest, charging and discharging management, was getting rid of nuisance and cost factor, simply how often you have to exchange the battery.

Airbus is using a lithium ion battery in the A350.
Are they thick people too?

Battery supplier Saft has clarified that Airbus installed and delivered the first A350-900 equipped with rechargeable lithium-ion batteries to a customer at the end of last year.

https://www.flightglobal.com/news/artic ... 00-425894/

ubeema · Mon Apr 01, 2019 12:49 am

rheinwaldner wrote:
BlueSky1976 wrote:
Not a rocket science whatsoever, only two words: SELF-CERTIFICATION.

This prompted me to draw this little satirical balsamiq wireframe, which shows how the ominous FAA page could have looked like, that was used to speed up MAX certification:

Be aware: this a satirical contribution, so the presented image might be an exaggeration, but as usual there is also piece of truth in it.

Hahahahaha. Seriously Anyone: if you are FAA or Boeing employees do not download/share this image on company issued devices or you will face HR compliance and possible termination for cause.

Bradin · Mon Apr 01, 2019 4:22 am

Via LATimes: EU agency (EASA) is said to have skipped 737 Max meeting in snub to Boeing

There was a prominent no-show among the 200 regulators, pilots and airline managers that Boeing Co. invited to preview a crucial software update for the 737 Max this week, said people familiar with the matter: European safety officials.

https://www.latimes.com/business/la-fi- ... story.html

QuarkFly · Mon Apr 01, 2019 5:26 am

morrisond wrote:
A well trained crew should have been able to diagnose an electric trim issue and turned it off - even if they had never heard of MCAS.

But there was nothing wrong with the electric trim. The problem was with sensors, MCAS or other issues. Why should the electric trim be turned off when it is in good working order? -- Thus forcing pilots to deal with sensor or other serious issues while operating an archaic manual trim wheel. This is a truly bad design for a passenger airliner.

This is the bigger issue here...the 737 and all of its regulatory grandfathering...has taken the simple concept of cutout switches for the trim electric motors, a reasonable feature for a 1960's era aircraft...and turned these switches into some kind of necessity for disabling a software feature -- a terrible implementation for a passenger aircraft. The manual trim wheel should not have to be used unless the electric trim system itself has a problem, e.g. runaway motor, wiring problem, relays, etc.

Shame on Boeing and the FAA -- MAX should never have been certified...and a simple MCAS software patch should not be enough to get the aircraft back into service. The entire MCAS, trim cutout and software issues should be redesigned. Perhaps aerodynamic changes too if there is a high AOA stability risk.

WIederling · Mon Apr 01, 2019 6:36 am

Revelation wrote:
Amiga500 [/b[b]]tells us this problem should have been found by any one of seven different sets of engineers, yet we know it was not. It will be interesting to find out what all the various investigations conclude.

The outcome shows that the apparent issues did not contribute to the final solution.
We don't know if this was due to the engineering cohorts being fumble minded
or that they brought it up but were talked out of it because .... such .. and ... such ...
this not required, this is covered by ... switching off trim is obvious ...
( wide range of path this could have taken. Boeing internal dissent has not become visible afaik)
I still stumble over the "bocklos" character of the visible engineering in relation to MCAS like
i found the initial 787 batteries solution lacking. Looking back It appears so very similar.

WIederling · Mon Apr 01, 2019 6:42 am

9Patch wrote:
Battery supplier Saft has clarified that Airbus installed and delivered the first A350-900 equipped with rechargeable lithium-ion batteries to a customer at the end of last year.

https://www.flightglobal.com/news/artic ... 00-425894/

Original flight testing was with LiIon batteries. downgrade to a NiCd solution to not have the certification uncertainties
( caused by Boeing really maikng a global PITA out of it ) delay the A350 certification and EIS.

Looking at all the information that could be found Airbus had a much deeper solution from the get go.
( and they did not try to get 111% performance from their design. )

hilram · Mon Apr 01, 2019 6:59 am

Bradin wrote:
Via LATimes: EU agency (EASA) is said to have skipped 737 Max meeting in snub to Boeing

There was a prominent no-show among the 200 regulators, pilots and airline managers that Boeing Co. invited to preview a crucial software update for the 737 Max this week, said people familiar with the matter: European safety officials.

https://www.latimes.com/business/la-fi- ... story.html

I have earlier been ridiculed in this thread for claiming that EASA will go over the entire MAX certification (=all that has changed from NG) with a fine comb, not only MCAS, and that Boeing will not be in the clear with this software fix.

This article from LA Times indicates I was right. :box:

There Is No Quick Fix!

seahawk · Mon Apr 01, 2019 7:06 am

There is little reason for EASA to found a trip to Seattle for their employees to be present at the event and accepting an invitation from Boeing would be in contradiction of the anti corruption rules. So in the end it went to the standard procedure and Boeing is coming to EASA to present their fix.

I would not read too much into it. That this is even an issue is much more disturbing.

Bradin · Mon Apr 01, 2019 7:10 am

hilram wrote:
Bradin wrote:
Via LATimes: EU agency (EASA) is said to have skipped 737 Max meeting in snub to Boeing

There was a prominent no-show among the 200 regulators, pilots and airline managers that Boeing Co. invited to preview a crucial software update for the 737 Max this week, said people familiar with the matter: European safety officials.

https://www.latimes.com/business/la-fi- ... story.html

I have earlier been ridiculed in this thread for claiming that EASA will go over the entire MAX certification (=all that has changed from NG) with a fine comb, not only MCAS, and that Boeing will not be in the clear with this software fix.

This article from LA Times indicates I was right.

There Is No Quick Fix!

Respectfully, I view the lack of presence of EASA as one of politics trumping safety. A single EASA delegate (even one with no final decision making or recommendation authority) sent on a fact finding mission would have been more than sufficient - thereby providing EASA with at least some feedback and observations, therefore enabling EASA to interject and demand the necessary changes, fixes, and repairs now rather than 'kick this issue down the line'.

The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

juliuswong · Mon Apr 01, 2019 7:39 am

I am not sure a re-write of MCAS and related software is a good fix for B737Max. The Max problem seem to run deeper than just a simple software fix.

rheinwaldner · Mon Apr 01, 2019 7:41 am

I am not sure, whether the following links have been discussed:

Here we have some credible statements, which are not hearsay because the name of the source is known (Rick Ludtke, a former Boeing designer, who worked on the MAXs cockpit interfaces):

Statement 1: Penalty charges based on training requirements
As contracted, Boeing owed WN "$1 million per plane if its design ended up requiring pilots to spend additional simulator time". So the "business case", to make MCAS invisible and non existent in the sim and in the training was $280 millions worth for Boeing.

The full text from the article is:

Mr. Ludtke recalled midlevel managers telling subordinates that Boeing had committed to pay the airline $1 million per plane if its design ended up requiring pilots to spend additional simulator time. "We had never, ever seen commitments like that before," he said.

Source is the following full copy of the original WSJ article, which is behind a paywall:
https://www.marketwatch.com/press-relea ... quote_news

More from Ludtke here:
https://www.seattletimes.com/business/b ... _inset_1.1

More statements from the following two links:
https://www.satcom.guru/2019/03/regulat ... stems.html
https://www.satcom.guru/2019/03/aoa-van ... g-fix.html

Statement 2: Pressure to implement no-additional-training solution

"Rick Ludtke, a former Boeing engineer who worked on designing the interfaces on the MAX’s flight deck, said managers mandated that any differences from the previous 737 had to be small enough that they wouldn’t trigger the need for pilots to undergo new simulator training."

"He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off. And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table."

Statement 3: MCAS runaway hard to detect

For the first time, Boeing admits MCAS is an extension of Speed Trim, which I have long suspected, and why it was designed with a single input. Speed Trim is constantly applying stabilizer trim commands in manual flight. This masks MCAS trim commands. Further, MCAS trim commands are effectively a slowover and in the case of the Lion Air flights, intermittent. These factors, combined with the flight deck effects from the high AoA value causing high workload, interfere with the expected human response. There has yet to be any acknowledgement of this, rather the opposite by ignoring it. The FAA repeatedly made the same assertion, the MCAS malfunction is easy to detect.

And

As discussed in earlier posts, in fact MCAS failure is hard to detect as it is a slowover, and Speed Trim System (STS) applies automatic trim routinely, masking MCAS motion. JT043 only related the situation to a stab trim runaway after an observing pilot suggested it. JT610 crew never figured it out. It is possible ET302 flight crew did not detect the failure in spite of specifically be briefed to look for it. The situation was compounded by the AoA trigger of Stall Warning. Boeing should not assume so readily how pilots will perform when MCAS fails, while the evidence is in stark contrast.

Statement 4: After trim cutout, using the trim wheel may be inadequate to deal with the situation

The response to a stabilizer runaway is to cutout the electric trim. Nowhere does anyone caution the consequences of using manual (turn the wheel manually) trim. The manual trim wheel can be very hard to turn if subject to high aero loads, and particularly if the elevator is commanded significantly (loading the stabilizer).

Statement 5: Trim cut out checklist is flawed

The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.

To illustrate, let me explain this hypothetical scenario:
- JT610, after the captain handed over to F/O
- In this hypothetical scenario, the nose down out-of-trim situation would have become obvious to the crew and they would have cut out the trim.
- Now the trim wheel has stopped, they are in a dive, at a low altitude, at high speed, and their task is now to turn the trim wheel to bring the nose up again.
- But - the force to turn the wheel is now too heavy unless they stop pulling the yokes!
- Situation is not recoverable

WIederling · Mon Apr 01, 2019 7:47 am

Bradin wrote:
The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Is this out of the drawer marked: others make errors from incompetence, we have bad luck that we valiantly fight? :-)

speedbored · Mon Apr 01, 2019 8:11 am

rheinwaldner wrote:
I am not sure, whether the following links have been discussed:

Thanks for the links and quotes - what he writes makes a lot of sense, and agrees with what many of us have been suggesting here, too.

While I'm sure this will not result in the MAX being permanently grounded, or in the demise of Boeing commercial, as some people have been suggesting, it's looking likely that the grounding might be lengthier than Boeing have been hoping, and that the financial consequences for Boeing will be quite severe.

XRAYretired · Mon Apr 01, 2019 8:38 am

Bradin wrote:
hilram wrote:
Bradin wrote:
Via LATimes: EU agency (EASA) is said to have skipped 737 Max meeting in snub to Boeing

There was a prominent no-show among the 200 regulators, pilots and airline managers that Boeing Co. invited to preview a crucial software update for the 737 Max this week, said people familiar with the matter: European safety officials.

https://www.latimes.com/business/la-fi- ... story.html

I have earlier been ridiculed in this thread for claiming that EASA will go over the entire MAX certification (=all that has changed from NG) with a fine comb, not only MCAS, and that Boeing will not be in the clear with this software fix.

This article from LA Times indicates I was right.

There Is No Quick Fix!

Respectfully, I view the lack of presence of EASA as one of politics trumping safety. A single EASA delegate (even one with no final decision making or recommendation authority) sent on a fact finding mission would have been more than sufficient - thereby providing EASA with at least some feedback and observations, therefore enabling EASA to interject and demand the necessary changes, fixes, and repairs now rather than 'kick this issue down the line'.

The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Given the Congress Oversight sub-committee recommendation that the certification of the MCAS re-design should be lead by a competent third party, and EASA being one of very few organisations in the world that have credible capability to do so, it may be that their absence was to avoid being 'tainted' prior to the protocols and contacts being established for them to do so?

Ray

Amiga500 · Mon Apr 01, 2019 10:49 am

Revelation wrote:
Amiga500 tells us this problem should have been found by any one of seven different sets of engineers, yet we know it was not. It will be interesting to find out what all the various investigations conclude.

I have a hard time believing it wasn't found by any one (or multiples) of the seven sets of engineers.

I don't have a hard time believing some technically ignorant higher up used slippy words to avoid the need to spend more time/resource on it.

smartplane · Mon Apr 01, 2019 11:08 am

planecane wrote:
Amiga500 wrote:
Boeing wrote:

BULLSH.

It is absolutely not "industry standard practice" for any competent safety engineer to offload the problem from the machine to the pilot.

Some useless MBA qualified c**t up the food chain in Boeing "mitigated" the need to spend the time & money doing the job right as they made a crap judgement call (which probably netted them a nice performance related bonus) that pilots could "figure it out" on the hoof without any documentation referencing any system that would show a failure mechanism like it.

Hopefully there is an email trail leading to the gormless idiot so they can spend a bit of time to reflect on the risks of a continuous nose down pitch when picking up some soap.

Revelation: This problems with MCAS are so far off the beaten track in terms of acceptable mistakes* that multiple serious failures in decisions, processes and oversight within Boeing and the FAA have got us to where we are now. This is deeply concerning precisely because it could also be present elsewhere on the aircraft and we have yet to find out.

*i.e.
1. safety analysis is wrong
2. stability & control is wrong
3. high level system architecture is wrong
4. high level software design is wrong
5. low level system design is wrong
6. low level software coding is wrong
7. oversight failed to pick up any of the above.
[may keep adding to this as I realise more areas that would be required for this development]

That is 7 stages of work that have seen this disaster pass through review gates. Was time pressure in Boeing so much that safety went out the window? Whatever it was - safety definitely was not top priority regardless of what weasel words Dennis says now.

While you make some very good points about the design/oversight, bad engineering and management decisions are not criminal acts. Unless there are emails that show someone being told that a sensor failure could cause a situation where pilots won't know what to do and the plane will crash, nobody will be in jail. Boeing will certainly be held liable for damages in civil court.

My guess would be that any emails about the reaction of MCAS to an AoA sensor failure will show an expectation that the pilots would recognize it as runaway trim, hit the cutoff switches and land safely. Bad assumption? Absolutely. Criminal? Not if that is what happened.

Will the FBI look at social media, to see if there is a link between posts blaming pilots, MX, countries of origin, MCAS theories, etc, and those posters links to the OEM and / or related parties?

smartplane · Mon Apr 01, 2019 11:10 am

smartplane wrote:
planecane wrote:
Amiga500 wrote:

BULLSH.

It is absolutely not "industry standard practice" for any competent safety engineer to offload the problem from the machine to the pilot.

Some useless MBA qualified c**t up the food chain in Boeing "mitigated" the need to spend the time & money doing the job right as they made a crap judgement call (which probably netted them a nice performance related bonus) that pilots could "figure it out" on the hoof without any documentation referencing any system that would show a failure mechanism like it.

Hopefully there is an email trail leading to the gormless idiot so they can spend a bit of time to reflect on the risks of a continuous nose down pitch when picking up some soap.

Revelation: This problems with MCAS are so far off the beaten track in terms of acceptable mistakes* that multiple serious failures in decisions, processes and oversight within Boeing and the FAA have got us to where we are now. This is deeply concerning precisely because it could also be present elsewhere on the aircraft and we have yet to find out.

*i.e.
1. safety analysis is wrong
2. stability & control is wrong
3. high level system architecture is wrong
4. high level software design is wrong
5. low level system design is wrong
6. low level software coding is wrong
7. oversight failed to pick up any of the above.
[may keep adding to this as I realise more areas that would be required for this development]

That is 7 stages of work that have seen this disaster pass through review gates. Was time pressure in Boeing so much that safety went out the window? Whatever it was - safety definitely was not top priority regardless of what weasel words Dennis says now.

While you make some very good points about the design/oversight, bad engineering and management decisions are not criminal acts. Unless there are emails that show someone being told that a sensor failure could cause a situation where pilots won't know what to do and the plane will crash, nobody will be in jail. Boeing will certainly be held liable for damages in civil court.

My guess would be that any emails about the reaction of MCAS to an AoA sensor failure will show an expectation that the pilots would recognize it as runaway trim, hit the cutoff switches and land safely. Bad assumption? Absolutely. Criminal? Not if that is what happened.

Will the FBI look at social media, to see if there is a link between posts blaming pilots, MX, countries of origin, rubbishing MCAS theories, etc, and those posters links to the OEM and / or related parties?

SheikhDjibouti · Mon Apr 01, 2019 11:30 am

Bradin wrote:
Respectfully, I view the lack of presence of EASA as one of politics trumping safety. A single EASA delegate (even one with no final decision making or recommendation authority) sent on a fact finding mission would have been more than sufficient - thereby providing EASA with at least some feedback and observations, therefore enabling EASA to interject and demand the necessary changes, fixes, and repairs now rather than 'kick this issue down the line'.

The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Respectfully, the miserable failure was the inability of Boeing to organise a parallel video conference in Paris (or Geneva), preferably delivered en Français s'il vous plait.

If EASA are expected to send a delegate to Seattle in order to make observations or discover important changes, then America has got itself a real problem.

Treating EASA as if they were simply another "delegate" is just a colossal insult.

(or....maybe we could all agree this is just a storm in a B-cup)

dtw2hyd · Mon Apr 01, 2019 11:33 am

rheinwaldner wrote:
BlueSky1976 wrote:
Not a rocket science whatsoever, only two words: SELF-CERTIFICATION.

This prompted me to draw this little satirical balsamiq wireframe, which shows how the ominous FAA page could have looked like, that was used to speed up MAX certification:

Be aware: this a satirical contribution, so the presented image might be an exaggeration, but as usual there is also piece of truth in it.

That level of sophisticated webpage design would cost several million with several IT giants and multiple defense contractors working on integrating TomCat on MS-DOS 5.1 and CICS backend. Not an easy task. As sophisticated as MCAS itself.

Keep in mind redundancy pre-dates DIGITAL/VAX/VMS clusters which sort of commoditized, and present-day dirt cheap commodity hardware and opensource software came a long way in providing highly-available/near continuous systems.

Yet multimillion aircraft design depends on a single string.

xetroV · Mon Apr 01, 2019 11:49 am

rheinwaldner wrote:
I am not sure, whether the following links have been discussed:

"He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off. And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table." [/i]

What I don't understand is why Boeing didn't just present the MCAS logic as an STS enhancement, instead of treating it as an entirely new system. If MCAS had been considered as being part of STS, they could have piggybacked on the existing FCOM STS system description, QRH procedure and alert light, rather than keeping the system a secret to avoid (costly, because of the Southwest contract) additional pilot training. With minimal procedural changes (if any) it would then have been possible to use the two AOA sensors, disable the MCAS-functionality of STS in case of a disagreement, and alert the crew by means of the SPEED TRIM FAIL light, which already exists in the NG. The consequences of losing MCAS in normal flight are not that serious and could easily be incorporated in the SPEED TRIM FAIL QRH procedure (which currently just says: "continue normal operation").

mjoelnir · Mon Apr 01, 2019 12:12 pm

xetroV wrote:
rheinwaldner wrote:
I am not sure, whether the following links have been discussed:

"He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off. And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table." [/i]

What I don't understand is why Boeing didn't just present the MCAS logic as an STS enhancement, instead of treating it as an entirely new system. If MCAS had been considered as being part of STS, they could have piggybacked on the existing FCOM STS system description, QRH procedure and alert light, rather than keeping the system a secret to avoid (costly, because of the Southwest contract) additional pilot training. With minimal procedural changes (if any) it would then have been possible to use the two AOA sensors, disable the MCAS-functionality of STS in case of a disagreement, and alert the crew by means of the SPEED TRIM FAIL light, which already exists in the NG. The consequences of losing MCAS in normal flight are not that serious and could easily be incorporated in the SPEED TRIM FAIL QRH procedure (which currently just says: "continue normal operation").

Because that would have lead to compulsory simulator training for the difference training NG to MAX. Better to hide it and be able to say you need less difference training between NG and MAX, than between A320ceo and neo.

I assume that Boeing will rue the day this decision was made, it would have been far cheaper to pay the 1 million USD per frame to Southwest.

Revelation · Mon Apr 01, 2019 12:14 pm

dtw2hyd wrote:
That level of sophisticated webpage design would cost several million with several IT giants and multiple defense contractors working on integrating TomCat on MS-DOS 5.1 and CICS backend. Not an easy task. As sophisticated as MCAS itself.

Keep in mind redundancy pre-dates DIGITAL/VAX/VMS clusters which sort of commoditized, and present-day dirt cheap commodity hardware and opensource software came a long way in providing highly-available/near continuous systems.

Thanks for giving this retro-tech nerd a good laugh to start the day. Back in the 80s I worked on a few different projects that in essence used msdos as a bootstrap loader: once you went in to our app code you never could exit since we reused all of the system's memory for other things and would never give it back. So, given the right run time adaptation, I suppose we could have had tomcat on msdos. Too bad tomcat didn't show up till the late 90s! In the 90s I worked for digital not on vms clustering, but on the team that moved a lot of cluster features to digital unix, such as lock manager. A lot of the people I worked with went on to work on high availability for linux systems. A lot of them just got their retirement needs and more taken care of when IBM bought Red Hat for $34B.

lowbank · Mon Apr 01, 2019 1:46 pm

BULLSH.

It is absolutely not "industry standard practice" for any competent safety engineer to offload the problem from the machine to the pilot.

Some useless MBA qualified c**t up the food chain in Boeing "mitigated" the need to spend the time & money doing the job right as they made a crap judgement call (which probably netted them a nice performance related bonus) that pilots could "figure it out" on the hoof without any documentation referencing any system that would show a failure mechanism like it.

Hopefully there is an email trail leading to the gormless idiot so they can spend a bit of time to reflect on the risks of a continuous nose down pitch when picking up some soap.

All Emails are kept and backed up, minutes of meetings are kept. Everything you write down you have to keep as it admissible as evidence, that includes your note book. We do a training course every year that makes sure you know that.

What stuns me still is that the failure mode effect analysis did not highlight this possibility and what the mitigation was. Because I will tell you that worries me more than anything else. If they missed this then there could be other serious issues with their products.

I tried to attach a picture of a pfmea, but failed.

ssteve · Mon Apr 01, 2019 1:57 pm

A baton was dropped. But organizationally I think they'll find a number of people who are strongly motivated to ensure holding the baton is never their job, and work on the assumption that someone else is carrying it.

PW100 · Mon Apr 01, 2019 4:26 pm

Bradin wrote:
The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Why the harsh words?

I usually try to refrain form harsh conclusions if I don't have all the facts. But I feel free to borrow your words: your conclusion is a miserable failure in understanding how certification process work (or should work #FAA).

Bradin · Mon Apr 01, 2019 5:09 pm

PW100 wrote:
Bradin wrote:
The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Why the harsh words?

I usually try to refrain form harsh conclusions if I don't have all the facts. But I feel free to borrow your words: your conclusion is a miserable failure in understanding how certification process work (or should work #FAA).

Point of order Sir. There is no just reason to be attacking any member of this forum for stating their own opinionated position

asdf · Mon Apr 01, 2019 5:45 pm

smartplane wrote:
planecane wrote:
Amiga500 wrote:
....
1. safety analysis is wrong
2. stability & control is wrong
3. high level system architecture is wrong
4. high level software design is wrong
5. low level system design is wrong
6. low level software coding is wrong
7. oversight failed to pick up any of the above.
....

Will the FBI look at social media, to see if there is a link between posts blaming pilots, MX, countries of origin, MCAS theories, etc, and those posters links to the OEM and / or related parties?

IF they do ..... postings like reihnwaldners
viewtopic.php?f=3&t=1417545&start=4050#p21239393
give them a lot to determine ..

Amiga500 · Mon Apr 01, 2019 6:10 pm

lowbank wrote:
All Emails are kept and backed up, minutes of meetings are kept. Everything you write down you have to keep as it admissible as evidence, that includes your note book. We do a training course every year that makes sure you know that.

Yep. The weasels are well aware of what is written down and recorded. This will have been done via phonecalls and face-to-face meetings unless they are even stupider than I can imagine. Hopefully the grunts had the wit to minute everything.

lowbank wrote:
What stuns me still is that the failure mode effect analysis did not highlight this possibility and what the mitigation was. Because I will tell you that worries me more than anything else. If they missed this then there could be other serious issues with their products.

Agreed on that, but the whole lot beggars belief. It really does. I just cannot fathom how this was all missed - thus I can only arrive at the more logical conclusion; it wasn't - but commercial interests took priority over safety.

PW100 · Mon Apr 01, 2019 6:14 pm

Bradin wrote:
PW100 wrote:
Bradin wrote:
The lack of presence or willingness to engage by EASA is a miserable failure by the agency.

Why the harsh words?

I usually try to refrain form harsh conclusions if I don't have all the facts. But I feel free to borrow your words: your conclusion is a miserable failure in understanding how certification process work (or should work #FAA).

Point of order Sir. There is no just reason to be attacking any member of this forum for stating their own opinionated position

Point taken. However, when the same words are pointed at yourself, it is all of a sudden a complete different thing . . . Right.

I'll rephrase using my own words: I don't agree with your conclusion, as I think you do not understand how the certification process works (or should work #FAA).

Now if you would be so kind to rephrase your words . . .

RossW · Mon Apr 01, 2019 9:01 pm

FAA says ‘additional work’ needed for Boeing software fix

https://www.ft.com/content/a2b6c6ec-54b ... 515a54c5b1

PixelPilot · Mon Apr 01, 2019 9:18 pm

RossW wrote:
FAA says ‘additional work’ needed for Boeing software fix

https://www.ft.com/content/a2b6c6ec-54b ... 515a54c5b1

Paywall.
Anybody care to let us know what's in the article?

MrBretz · Mon Apr 01, 2019 9:23 pm

Here's what the article said:

"The Federal Aviation Administration said Monday that Boeing needed to do “additional work” to ensure its software update fixed any issues with its 737 Max.

The US aviation regulator said it expected to receive the software update for review in the “coming weeks” and said it would not approve the fix for installation until it was “satisfied with the submission”.

“Time is needed for additional work by Boeing as the result of an ongoing review of the 737 MAX Flight Control System to ensure that Boeing has identified and appropriately addressed all pertinent issues,” said the FAA in a statement."

scbriml · Mon Apr 01, 2019 9:23 pm

Google helps...

https://www.marketwatch.com/amp/story/g ... 976710C9CB

PacificWest · Mon Apr 01, 2019 9:35 pm

Wondering if anyone else can provide some insight on this...

My understanding was MCAS was required to get the MAX certified under the same type rating; meaning didn't just Boeing just design, create, and add it to the MAX just for sh/ts and giggles.

If this is indeed the case, I'm wondering if Boeing felt they HAD to make it behave that aggressively — as I can't imagine they'd design it that way for for no reason, right?

So, if MCAS was designed to prevent some other unsafe situations -- does 'reigning in' MCAS in this new update open up greater risk in other situations?

MrBretz · Mon Apr 01, 2019 9:59 pm

PacificWest wrote:
Wondering if anyone else can provide some insight on this...

My understanding was MCAS was required to get the MAX certified under the same type rating; meaning didn't just Boeing just design, create, and add it to the MAX just for sh/ts and giggles.

If this is indeed the case, I'm wondering if Boeing felt they HAD to make it behave that aggressively — as I can't imagine they'd design it that way for for no reason, right?

So, if MCAS was designed to prevent some other unsafe situations -- does 'reigning in' MCAS in this new update open up greater risk in other situations?

I think this is exactly what the FAA is saying in their statement. Another way for the FAA to say there will be no rubber stamp.

flyorski · Mon Apr 01, 2019 10:32 pm

Do we know how many days in advance WN has cancelled flights into the schedule based on the MAX being removed?

StTim · Mon Apr 01, 2019 10:50 pm

Looking like mid May earliest - unless it is just sabre rattling from the FAA.

mjoelnir · Mon Apr 01, 2019 11:10 pm

Boeing’s software fix for 737 MAX still weeks away from delivery to FAA

https://www.seattletimes.com/business/b ... ry-to-faa/

Quote: The Federal Aviation Administration (FAA) said Monday that “time is needed for additional work by Boeing … to ensure that Boeing has identified and appropriately addressed all pertinent issues.”
and
Getting the final version to the FAA is only the first step toward lifting the grounding of the MAX. The FAA promised Monday “a rigorous safety review” and said it “will not approve the software for installation until the agency is satisfied with the submission.” And foreign regulators in Canada and Europe have indicated that they will do their own reviews of the Boeing fix and won’t simply take the FAA’s word for it.

IMO it seems that the song and dance show at Boeing was slightly premature, trying to fix the stock price perhaps?

planecane · Mon Apr 01, 2019 11:31 pm

PacificWest wrote:
Wondering if anyone else can provide some insight on this...

My understanding was MCAS was required to get the MAX certified under the same type rating; meaning didn't just Boeing just design, create, and add it to the MAX just for sh/ts and giggles.

If this is indeed the case, I'm wondering if Boeing felt they HAD to make it behave that aggressively — as I can't imagine they'd design it that way for for no reason, right?

So, if MCAS was designed to prevent some other unsafe situations -- does 'reigning in' MCAS in this new update open up greater risk in other situations?

It was added for an edge of envelope situation that the aircraft should never enter in normal operation. The design was if the aircraft approached a stall in the situation that an NG wouldn't, MCAS would pitch down so the MAX would behave like an NG from the pilot's perspective.

Unfortunately, they assumed that MCAS activating due to a sensor failure would prompt the pilots to follow the runaway trim procedure. I think it was just a case of engineer tunnel vision.

If the only thing they had done differently was made it so MCAS only activated once per event, these crashes wouldn't have happened. The nose would have pitched down uncommanded and the pilots would have said "what the hell" and retrimmed. It also would have only been 2.5 degrees of trim instead of the full 5 degrees.

N776AU · Mon Apr 01, 2019 11:52 pm

flyorski wrote:
Do we know how many days in advance WN has cancelled flights into the schedule based on the MAX being removed?

For whatever it’s worth, my 737 MAX8 flight with them on Memorial Day weekend has changed to a regular 737-800. Everything else with timing and such is the same.

mjoelnir · Tue Apr 02, 2019 12:18 am

9Patch wrote:
mjoelnir wrote:

There are clear differences to the battery issue.

The box was an acceptable solution, practical a bomb.container, taking completely out the danger of an explosion in the electrical cabinet.
I still do not understand how thick people were. A lithium ion battery is based on a hydrocarbon solvent. When heated you get hydrocarbon gas in an electrical cabinet, where spark plugs abound aka relays producing sparks when switching.
The rest, charging and discharging management, was getting rid of nuisance and cost factor, simply how often you have to exchange the battery.

Airbus is using a lithium ion battery in the A350.
Are they thick people too?

Battery supplier Saft has clarified that Airbus installed and delivered the first A350-900 equipped with rechargeable lithium-ion batteries to a customer at the end of last year.

https://www.flightglobal.com/news/artic ... 00-425894/

Did Airbus put an lithium ion battery without a serious containment into the electrical cabinet of the A350?

Do you still not understand what Boeing did? Practically putting a uncontained fuel air bomb in their 787 electrical cabinet.

The A350 battery included a containment and venting system right from the start.

http://bloga350.blogspot.com/2014/11/a3 ... aring.html

ArgentoSystems · Tue Apr 02, 2019 2:39 am

PacificWest wrote:
If this is indeed the case, I'm wondering if Boeing felt they HAD to make it behave that aggressively — as I can't imagine they'd design it that way for for no reason, right?

So, if MCAS was designed to prevent some other unsafe situations -- does 'reigning in' MCAS in this new update open up greater risk in other situations?

That is the question that everyone with a bit of common sense is asking.

ArgentoSystems · Tue Apr 02, 2019 2:50 am

How long do you think Boeing can continue making planes without making deliveries?

oschkosch · Tue Apr 02, 2019 3:09 am

ArgentoSystems wrote:
How long do you think Boeing can continue making planes without making deliveries?

My rough estimate is another 11,5 days. Yours?

Gesendet von meinem SM-G950F mit Tapatalk

mwmav8r01 · Tue Apr 02, 2019 4:04 am

rheinwaldner wrote:
To illustrate, let me explain this hypothetical scenario:
- JT610, after the captain handed over to F/O
- In this hypothetical scenario, the nose down out-of-trim situation would have become obvious to the crew and they would have cut out the trim.
- Now the trim wheel has stopped, they are in a dive, at a low altitude, at high speed, and their task is now to turn the trim wheel to bring the nose up again.
- But - the force to turn the wheel is now too heavy unless they stop pulling the yokes!
- Situation is not recoverable

Have you flown a 737? And or a MAX?

If you trim the opposite direction of the MCAS it stops just like speed trim. The lack of info on the MCAS prior to Lion Air... But after....

I think we need to see a report before we assume. I feel like there may be a little more to the story. Time will tell.

Who is online

Popular Searches On Airliners.net