• 1
  • 2
  • 3
  • 4
  • 5
  • 55
 
VanBosch
Posts: 32
Joined: Mon Aug 14, 2017 5:18 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 9:58 pm

Revelation wrote:
No one should hope for that.

It'd take ~half the narrow body airliner production out of the market for ~five years and lay waste to lots of airline's plans.



Would it? Would they not just sell NG’s again, not ideal but can’t see them not producing /selling anything?
 
sgrow787
Posts: 165
Joined: Fri May 16, 2014 8:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:01 pm

RickNRoll wrote:
LDRA wrote:
Reading online it appears the actual failure mode tested is one FCC inop. That configuration requires the second FCC to handle more computation than normal case.

It does appear that worst case computation resource analysis is botched so that FCC task overrun and hence electric trim not responding is not showing up as aircraft level effect. That is why it takes an actual flight sim test to find the real effect and associated hazard classification
That makes sense. Similar to disabling an engine during take off. The plane should still make it off the ground safely.


But the FCCs dont share computational resources. Instead they run in parallel.
 
RickNRoll
Posts: 1728
Joined: Fri Jan 06, 2012 9:30 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:07 pm

glideslope wrote:
Personally, I would like to see the test run again with line Max pilots not FAA Pilots. It's not beyond the scope for this to have been an attempt to "see we are being tough" by the FAA. I would not put this past them given their current quandary. There is simply too much of a disconnect in information being released and interpretations.
I don't think anyone wants a test to be run that is going to go easy on the MAX flight system. Imagine if people wanted the stress test on the new 777 wings to go easy in case it broke them to soon.
 
hivue
Posts: 1903
Joined: Tue Feb 26, 2013 2:26 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:08 pm

tropical wrote:
In other words, if Boeing had bitten the bullet of the additional training costs associated with the pilot training that would have been required by the different handling characteristics of an NG and a MAX without MCAS, the MAX would still have been a highly fuel efficient plane and attractive to many airlines, and with the right training no less safe than other models. And the tragic crashes would have been avoided. Hindsight is a wonderful thing, of course.


The problem is that airlines would have needed their 737 pilot corps to be split into two type rating groups -- especially onerous for WN, but undesirable for AA and others.
"You're sitting. In a chair. In the SKY!!" ~ Louis C.K.
 
LDRA
Posts: 272
Joined: Fri Jan 15, 2016 3:01 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:09 pm

sgrow787 wrote:
RickNRoll wrote:
LDRA wrote:
Reading online it appears the actual failure mode tested is one FCC inop. That configuration requires the second FCC to handle more computation than normal case.

It does appear that worst case computation resource analysis is botched so that FCC task overrun and hence electric trim not responding is not showing up as aircraft level effect. That is why it takes an actual flight sim test to find the real effect and associated hazard classification
That makes sense. Similar to disabling an engine during take off. The plane should still make it off the ground safely.


But the FCCs dont share computational resources. Instead they run in parallel.


@sgrow787 @RickNRoll

I think I mixed up the failure mode FAA was testing. It is one processor out of the pair in the active FCC faulted

Source is Leeham

https://leehamnews.com/2019/06/28/bjorn ... -software/

During a check on how different faults (in this case a fault in one of the microprocessors in the Flight Control computer) can cause Trim Runaway conditions the FAA found the 737 MAX Flight Control computer got overwhelmed by the data flows the simulated fault caused and it delayed the actions the FAA pilot could take to stop the trim runaway.


The analysis still stands. The aircraft level effect documented on Boeing FMEA likely does not indicate temporary loss of electric trim, otherwise the hazard rating of only "Major" would be caught without going through sim
 
hivue
Posts: 1903
Joined: Tue Feb 26, 2013 2:26 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:14 pm

glideslope wrote:
Personally, I would like to see the test run again with line Max pilots not FAA Pilots. It's not beyond the scope for this to have been an attempt to "see we are being tough" by the FAA. I would not put this past them given their current quandary. There is simply too much of a disconnect in information being released and interpretations.


Other pilots (Boeing pilots) were involved. After all, it's Boeing's simulator. The FAA call was a judgment call that the problem fell into the potentially "catastrophic" category; Boeing saw it as "major" category. Other pilots' opinions aren't likely to change the FAA's judgment any more than Boeing's did.
Last edited by hivue on Mon Jul 01, 2019 10:15 pm, edited 1 time in total.
"You're sitting. In a chair. In the SKY!!" ~ Louis C.K.
 
sgrow787
Posts: 165
Joined: Fri May 16, 2014 8:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:15 pm

LDRA wrote:
sgrow787 wrote:
RickNRoll wrote:
That makes sense. Similar to disabling an engine during take off. The plane should still make it off the ground safely.


But the FCCs dont share computational resources. Instead they run in parallel.


@sgrow787 @RickNRoll

I think I mixed up the failure mode FAA was testing. It is one processor out of the pair in the active FCC faulted

Source is Leeham

https://leehamnews.com/2019/06/28/bjorn ... -software/

During a check on how different faults (in this case a fault in one of the microprocessors in the Flight Control computer) can cause Trim Runaway conditions the FAA found the 737 MAX Flight Control computer got overwhelmed by the data flows the simulated fault caused and it delayed the actions the FAA pilot could take to stop the trim runaway.


The analysis still stands. The aircraft level effect documented on Boeing FMEA likely does not indicate temporary loss of electric trim, otherwise the hazard rating of only "Major" would be caught without going through sim


And that is still consistent with my FCC post above. Ill read the Leeham article this evening.
 
sgrow787
Posts: 165
Joined: Fri May 16, 2014 8:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:17 pm

Can someone provide the lyrics to the Phil Collins equivalent "Just One Sensor"??

Because Boeing was just one sensor shy of success.
Last edited by sgrow787 on Mon Jul 01, 2019 10:30 pm, edited 1 time in total.
 
sgrow787
Posts: 165
Joined: Fri May 16, 2014 8:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:21 pm

LDRA wrote:
sgrow787 wrote:
RickNRoll wrote:
That makes sense. Similar to disabling an engine during take off. The plane should still make it off the ground safely.


But the FCCs dont share computational resources. Instead they run in parallel.


@sgrow787 @RickNRoll

I think I mixed up the failure mode FAA was testing. It is one processor out of the pair in the active FCC faulted

Source is Leeham

https://leehamnews.com/2019/06/28/bjorn ... -software/

During a check on how different faults (in this case a fault in one of the microprocessors in the Flight Control computer) can cause Trim Runaway conditions the FAA found the 737 MAX Flight Control computer got overwhelmed by the data flows the simulated fault caused and it delayed the actions the FAA pilot could take to stop the trim runaway.


The analysis still stands. The aircraft level effect documented on Boeing FMEA likely does not indicate temporary loss of electric trim, otherwise the hazard rating of only "Major" would be caught without going through sim


So a fried DFCSp_collins and the transfer of control (and data) to the other side FCC was slower than expected. If thats what they did in their test, then yes its feasible and not inconsistent with the design put forth by Satcomguru. And that is a different failure mode than the one I put forth above. Assuming its correct.
 
TTailedTiger
Posts: 1274
Joined: Sun Aug 26, 2018 5:19 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 10:42 pm

sgrow787 wrote:
Revelation wrote:
TTailedTiger wrote:
Is there any article that explains just what the FAA did to fry the MCAS CPU? We need some context.

We all need some context if you think the "MCAS CPU" was "fried", because such a statement is not consistent with what we've read so far.

kalvado wrote:
People above think that such tests should have been done before first delivery; and assume that Boeing would save itself from embarrassment of being hit with another delay at the time everyone expected final fix and return to flight.
Love it or hate it - but I had a much better opinion about Boeing in terms of being able to do things right, at least on a second attempt. Well, maybe third time is a charm?

There's no doubt the delay in response should not have happened.

What's not clear to me if this was some sort of "special" test FAA was doing to "bless" some or all of the MCAS fix, or if this was a "routine" test activity that FAA participates in as a part of its job as regulator to make sure the base line functionality is solid before doing MCAS testing. Given the media says it wasn't a MCAS specific test and MCAS was not involved in the issue that was found it would seem it's more of the later than the former.

LDRA wrote:
Reading online it appears the actual failure mode tested is one FCC inop. That configuration requires the second FCC to handle more computation than normal case.

It does appear that worst case computation resource analysis is botched so that FCC task overrun and hence electric trim not responding is not showing up as aircraft level effect. That is why it takes an actual flight sim test to find the real effect and associated hazard classification

Which source are you reading to reach this kind of understanding?

All of this is murky because all we have are various leaks in the media written by non-technical writers.


According to Satcomguru, each FCC is identical - copilot v pilot. But there are two processors on each FCC, and each one is running a DFCS app that was developed independently:

FCCp - FCC pilot
FCCc - FCC copilot
results in..
DFCSp_honey
DFCSp_collins
DFCSc_honey
DFCSc_collins

Because of independent development, its safe to assume that a resource allocation issue on one architecture (eg DFCSc_collins) wouldnt exist (or wouldnt exist at the same time) for the other architecture running in parallel.

And if, during a DFCSp_collins lockup, the design is supposed to transfer control - along with onside data - to the other sides FCC, well because that DFCSc_collins is also likely experiencing the same lockup (its the same architecture) then you have the failure affecting the usable flight control system.

In summary, this architecture is a failsafe against a fried processor and or entire FCC. So it cant possibly be what was tested for. Instead, the FAA guy likely did a performance stress test of sorts to cause the above scenario.

Note: I assumed here that a locked DFCSc_collins would cause a disagree flag and the design would transfer control to the other side FCC.


Thanks for the explanation. Much appreciated.
 
h1fl1er
Posts: 93
Joined: Thu Jun 06, 2019 5:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 11:04 pm

DenverTed wrote:
tropical wrote:
Question to those with the technical know-how: putting aside the financial side of things for a moment, if instead of creating and installing MCAS Boeing had simply designed the MAX without it and opted to tackle the different handling characteristics of the model by requiring additional training for the pilots, would the plane be considered as unsafe? A bit more challenging to handle than the model it replaces I’m sure, but surely still perfectly reasonable and I suspect still more forgiving and easier to fly than many aircraft models from the 60s and 70s that nobody would describe as unsafe if flown by a properly trained pilot.

In other words, if Boeing had bitten the bullet of the additional training costs associated with the pilot training that would have been required by the different handling characteristics of an NG and a MAX without MCAS, the MAX would still have been a highly fuel efficient plane and attractive to many airlines, and with the right training no less safe than other models. And the tragic crashes would have been avoided. Hindsight is a wonderful thing, of course.

As I understand it from asking the question on this thread, MCAS was required to meet the pitch stability for righting moment as the aircraft entered a high speed and low speed stall. But I have never seen this question answered by Boeing or the FAA. Seems like an easy enough question for either of them to answer.


???

mcas's necessity has been explained more than a dozen times as a solution to maintain appropriate average stick force gradient at high AOA in manual flight

regulations require that the force necessary to pull the yoke backward increase as the plane approaches stall. due to the increased lift of the LEAP engines, the max could not meet this newer requirement and the engineers decided to use MCAS as their solution. the nose-down attack of the stab after MCAS requires an increased pull force to maintain pitch attitude.

It is a Maneuvering Characteristics Augmentation System. Not stall protection, not envelope protection, nothing of the sort. This is why, given what it is, it is so perplexing that the software was written to continue to execute and have authority to command full nose down. the miswriting of the software, and its ultimate failure along with poor journalism are what has confused everyone into thinking that this was an anti-stall or envelope protection system.

why boeing chose to do it this way is confusing.
 
User avatar
Revelation
Posts: 20972
Joined: Wed Feb 09, 2005 9:37 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Mon Jul 01, 2019 11:50 pm

VanBosch wrote:
Revelation wrote:
No one should hope for that.

It'd take ~half the narrow body airliner production out of the market for ~five years and lay waste to lots of airline's plans.

Would it? Would they not just sell NG’s again, not ideal but can’t see them not producing /selling anything?

A few problems with that idea.

First of all, all those airlines buying ~half the world's narrowbody production were promised ~11% better fuel burn per seat than NG provides. Who is going to agree to buy an inferior product that is already out of date and pay enough for Boeing to make a profit building them?

Second of all, if you are CFM how do you cope with moving back to making CFM56 after you just spent so much time and money switching over to LEAP?

Third of all, how long would all this take? Some parts are truly long lead time, needing to be ordered a year in advance. All the stuff in the pipeline now would have to be diverted and a whole different batch of stuff would have to re-enter the pipeline.
Wake up to find out that you are the eyes of the world
The heart has its beaches, its homeland and thoughts of its own
Wake now, discover that you are the song that the morning brings
The heart has its seasons, its evenings and songs of its own
 
User avatar
7BOEING7
Posts: 3038
Joined: Fri Oct 12, 2012 5:28 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 2:37 am

hivue wrote:
tropical wrote:

The problem is that airlines would have needed their 737 pilot corps to be split into two type rating groups -- especially onerous for WN, but undesirable for AA and others.


There might have been more extensive transition requirements and maybe even separate ratings (doubtful) but the crews would have been interchangeable. Lool at the 757/767, there’s a lot more differences there than between the NG/MAX.
 
TTailedTiger
Posts: 1274
Joined: Sun Aug 26, 2018 5:19 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:06 am

glideslope wrote:
Personally, I would like to see the test run again with line Max pilots not FAA Pilots. It's not beyond the scope for this to have been an attempt to "see we are being tough" by the FAA. I would not put this past them given their current quandary. There is simply too much of a disconnect in information being released and interpretations.


Agreed. It seems highly suspect that the processors would fail. As I stated in another post, new aircraft use older computer hardware since the reliability stats are known. They wouldn't put a brand new processor type in a new airplane.
 
speedking
Posts: 68
Joined: Thu Nov 15, 2018 3:00 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:49 am

Revelation wrote:
VanBosch wrote:
Revelation wrote:
No one should hope for that.

It'd take ~half the narrow body airliner production out of the market for ~five years and lay waste to lots of airline's plans.

Would it? Would they not just sell NG’s again, not ideal but can’t see them not producing /selling anything?

A few problems with that idea.

First of all, all those airlines buying ~half the world's narrowbody production were promised ~11% better fuel burn per seat than NG provides. Who is going to agree to buy an inferior product that is already out of date and pay enough for Boeing to make a profit building them?

Second of all, if you are CFM how do you cope with moving back to making CFM56 after you just spent so much time and money switching over to LEAP?

Third of all, how long would all this take? Some parts are truly long lead time, needing to be ordered a year in advance. All the stuff in the pipeline now would have to be diverted and a whole different batch of stuff would have to re-enter the pipeline.


For the flying public the money the airlines spend on buying planes and operating them is secondary to safety, I'm afraid. Also who cares what happens to CFM? I find this attention to cost to serve over peoples lives disturbing.
Further,I believe, the flying public are paying a lot of attention to where the planes are built. Nobody wants to fly with Sukhoi Superjet, even the Russians themselves. I'm afraid the Bombay-Boeing will share the same destiny.
 
sgrow787
Posts: 165
Joined: Fri May 16, 2014 8:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:49 am

There's another possibility here. Is the new delay a manufactured ploy to get the ungrounding date delayed to post-NTSB investigative report (its safe to assume that report will contain a section on pilot blame)? Then with FAA approval and NTSB backing in Jan 2020, they put the Max back into service and if another crash then happens then THATS when SHTF. Give us one more chance please.
 
IADFCO
Posts: 119
Joined: Sun May 22, 2016 4:20 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 4:29 am

h1fl1er wrote:
DenverTed wrote:

[...]

As I understand it from asking the question on this thread, MCAS was required to meet the pitch stability for righting moment as the aircraft entered a high speed and low speed stall. But I have never seen this question answered by Boeing or the FAA. Seems like an easy enough question for either of them to answer.


???

mcas's necessity has been explained more than a dozen times as a solution to maintain appropriate average stick force gradient at high AOA in manual flight

regulations require that the force necessary to pull the yoke backward increase as the plane approaches stall. due to the increased lift of the LEAP engines, the max could not meet this newer requirement and the engineers decided to use MCAS as their solution. the nose-down attack of the stab after MCAS requires an increased pull force to maintain pitch attitude.

It is a Maneuvering Characteristics Augmentation System. Not stall protection, not envelope protection, nothing of the sort. This is why, given what it is, it is so perplexing that the software was written to continue to execute and have authority to command full nose down. the miswriting of the software, and its ultimate failure along with poor journalism are what has confused everyone into thinking that this was an anti-stall or envelope protection system.

why boeing chose to do it this way is confusing.


We don't know key technical information.

For example, the increased lift of the engine nacelles has been mentioned many many times, but it's not clear why that should change the stick gradient. If the nacelle behaves like an annular airfoil, annular airfoils tend to stall late, beyond the 15 or so degrees that seem to be the critical angle of attack here (e.g., NACA TN-4117, downloadable from ntrs.nasa.gov). If so, the nacelle would generate a nose-up pitching moment, probably higher than for the NG, but with constant gradient with AoA. In other words, the stick would be lighter in the MAX, but uniformly so with angle of attack. The NG presumably has no stick lightening problem. So, what causes the stick lightening? What changes the gradient?

If the original wing does not have a gradient problem, and the nacelle on its own does not change the gradient either, then the problem could be caused by the interaction between the two, which could be messy. The circumstantial evidence (=leaks in the press) does point to that.

Obviously this is all at best informed speculation, because we interested bystanders don't have the required information, but IMHO it's not technical nitpicking, because it could determine how hard it's going to be to really fix MCAS.
 
rheinwaldner
Posts: 1709
Joined: Wed Jan 02, 2008 4:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 4:41 am

VanBosch wrote:
Revelation wrote:
No one should hope for that.

It'd take ~half the narrow body airliner production out of the market for ~five years and lay waste to lots of airline's plans.



Would it? Would they not just sell NG’s again, not ideal but can’t see them not producing /selling anything?

Then the airlines would just keep the NGs they have, wouldn't they? It would be inevitable that Boeing sales & production would stay on a very low level. Unless they would start producing A320s under license.
Many things are difficult, all things are possible!
 
Andy33
Posts: 2428
Joined: Tue Sep 15, 2009 9:30 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 7:55 am

rheinwaldner wrote:
VanBosch wrote:
Revelation wrote:
No one should hope for that.

It'd take ~half the narrow body airliner production out of the market for ~five years and lay waste to lots of airline's plans.



Would it? Would they not just sell NG’s again, not ideal but can’t see them not producing /selling anything?

Then the airlines would just keep the NGs they have, wouldn't they? It would be inevitable that Boeing sales & production would stay on a very low level. Unless they would start producing A320s under license.

There are several airlines who were not using their MAX orders to replace 737NGs. Instead they had no NGs in the first place (Air Canada being a good example) or were using them for missions the NG can't do at all, or only with severe weight restrictions (such as Norwegian and Icelandair); or they intended them mainly for expansion. Airlines in the first and third groups might go for a revived NG range, especially if they can't get A320s for ages. Airilines in the middle group would have to rethink their strategy altogether.
 
xmp125a
Posts: 233
Joined: Mon Mar 11, 2019 6:38 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 9:31 am

glideslope wrote:
Personally, I would like to see the test run again with line Max pilots not FAA Pilots. It's not beyond the scope for this to have been an attempt to "see we are being tough" by the FAA. I would not put this past them given their current quandary. There is simply too much of a disconnect in information being released and interpretations.


So you are against stress-testing the plane in conditions that are unusual, but may appear??

And, can anybody point me to the authoritative source regarding how test was done? Currently, I assume the test was done on fully working FCC, nothing was "broken" pre-flight.

Correction: I see that Bjorn is describing the test as "During a check on how different faults (in this case a fault in one of the microprocessors in the Flight Control computer)", but from the rest of the text is not clear whether the fault in the processor is reason to slowdown - the fault in processor causes the pitch down, but recovery may be slow even in not-faulty system when downtrim is triggered by any other means?
 
User avatar
PW100
Posts: 3723
Joined: Mon Jan 28, 2002 9:17 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 10:32 am

IADFCO wrote:
If the nacelle behaves like an annular airfoil, annular airfoils tend to stall late, beyond the 15 or so degrees that seem to be the critical angle of attack here (e.g., NACA TN-4117, downloadable from ntrs.nasa.gov). If so, the nacelle would generate a nose-up pitching moment, probably higher than for the NG, but with constant gradient with AoA. In other words, the stick would be lighter in the MAX, but uniformly so with angle of attack. The NG presumably has no stick lightening problem. So, what causes the stick lightening? What changes the gradient?

If the original wing does not have a gradient problem, and the nacelle on its own does not change the gradient either, then the problem could be caused by the interaction between the two, which could be messy. The circumstantial evidence (=leaks in the press) does point to that.

Obviously this is all at best informed speculation, because we interested bystanders don't have the required information, but IMHO it's not technical nitpicking, because it could determine how hard it's going to be to really fix MCAS.


So, what causes the stick lightening? What changes the gradient?

It's the stabilizer task to balance out nose-up moment forces with increasing AoA. So it is the stabilizer moment force (nose down) acting against nacelle moment force (nose up) at increasing AoA. In fact, stabilizer should win with higher AoA. Or in other words, the higher the AoA, the higher stick force should be.

On the MAX it is the opposite under certain flight conditions (where MCAS should become active); with higher AoA stick force becomes lighter. This is caused by dissimilarity in Aero- a)Shape, b) Area and c) angle of incidence between stabilizer vs nacelle (including associated wing flow disturbance) which results in aero moment forces gradient, felt as stick lightening.

Stabilizer moment force is fairly linear with increasing AoA, as most aerofoils. The nacelles though have a totally different aero shape, and the same AoA-moment force-linearity of aero forces (including nacelle wing flow disturbance) should therefore not be expected.

Further, since neutral moment force of nacelle and stabilizer is most likely not at the same AoA, dissimilar net effective aero area probably also comes into play.


On mechanically operated air planes (ie. no boosted/powered controls), stick force AoA gradient is a function of natural stability margin; the more stable platform will require more stick force to take it away from the neutral (stable) point. Power Controls, and the Elevator Feel System can (and will) have an effect on that gradient. On FBW, the stick force gradient can be any gradient one feels fit, and can be totally decoupled (by means of algorithm) from the airplane’s natural stability characteristics (ie. relaxed stability as seen in all modern fighter jets , started with F-16).
Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 11:06 am

MartijnNL wrote:
LDRA wrote:
There is nothing wrong with using single sensor, STS also relies on single air speed signal. The key is to limit control authority so that elevator still can overpower stab in fault condition

From the Bloomberg article:"During the crashes of Lion Air and Ethiopian Airlines planes that killed 346 people, investigators suspect, the MCAS system pushed the planes into uncontrollable dives because of bad data from a single sensor.

That design violated basic principles of redundancy for generations of Boeing engineers, and the company apparently never tested to see how the software would respond, Lemme said. "It was a stunning fail. A lot of people should have thought of this problem - not one person - and asked about it", he said."


There is nothing wrong with a single sensor?! I believe I don't understand you. A single sensor is what cost 346 people their lives.

The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0. So I thought I'd have a look at STS a bit deeper to try to understand it. Surprisingly, there seems to be little information out there especially regarding technical detail.

I found it very difficult to understand what STS is actually doing and why. However, I felt in good company when reading back on some of the other forums to find that many 737 pilots don't quite understand what it is doing or why either. Some of these were just constantly concerned STS appeared to work against their intentions, some said they just ignored it under the assumption it was doing something for a reason and at least one said he purposely countermanded STS whenever it operated, presumably by blipping the thumb switch.

As near as I can get to it, STS is intended to maintain the most efficient and stable pitch and neutral stick force for a given Computed Airspeed, so if you are at a ~constant speed and everything else is equal it will stick at a stabiliser position it has chosen. During acceleration or deceleration, it will adjust the trim to try to maintain the previous speed measurement, and the next iteration the previous speed measurement ad-infinitum that is what gives the impression of acting against the pilot because it is effectively slugging the accel/decal with AND or ANU and contrary stick force. It would also appear that STS cannot move the stabiliser beyond a maximum of ~6deg of travel from 0 in ANU direction at the maximum Computed Airspeed it is operational.

So, I would guess, if the Airspeed sensor fails low within valid range (bearing in mind Computed Airspeed is also slugged by other parameters within the ADIRU and note that AOA is just converted to digital effectively raw) could, at high actual Airspeed, pull the Stabiliser in AND from 6deg to 0 or conversely fails high, within a valid range, at low actual Airspeed could pull the stabiliser up to 6deg ANU (at the appropriate rates) also bearing in mind, if it fails high beyond the STS operating range, STS will be inhibited. I am not sure how the degrees of travel relates to the actual trim measurement expressed in units but I would have though 0 degrees in this context would be trim setting in units at T/O ~5units?

However, as I understand it (no detail I could find), the STS algorithm is also moderated by Thrust and - Vertical Speed - I.e. 'G' (where have we heard that before). I make a presumption that STS will assume for high thrust that acceleration or deceleration in the case of low thrust is intended and so moderate its trim correction accordingly and similarly will moderate trim correction ANU at higher +G or AND for higher -G. These are protections that appear to be missing from MCAS V1.0. Of course, over correction by STS can also be countermanded by pulling the yoke through the ANU or AND microswitches and only one of these is present for MCAS. Or Thumb switch available for both.

In conclusion, my view would be that single sensor STS is an over simplification and can not be used as justification for single sensor MCAS. I could be completely wrong of course, if so I am sure someone will put me right.

Ray
 
planecane
Posts: 1041
Joined: Thu Feb 09, 2017 4:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 12:28 pm

sgrow787 wrote:
There's another possibility here. Is the new delay a manufactured ploy to get the ungrounding date delayed to post-NTSB investigative report (its safe to assume that report will contain a section on pilot blame)? Then with FAA approval and NTSB backing in Jan 2020, they put the Max back into service and if another crash then happens then THATS when SHTF. Give us one more chance please.

No. What difference would it make? If there is a CFIT suicide on a MAX with the pilot announcing his intentions over the radio within a year of return to service Boeing will be blamed.

There is a 0% chance that Boeing would add to their financial liability and continued erosion of their reputation by purposely delaying return to service in some attempt to put some blame on the pilots.

There is no argument to blame the Lion Air pilots because of MCAS not being disclosed to them. There may be an argument with respect to ET (depending on the final report to answer questions like was the electric trim working properly and capable of getting the aircraft back in trim) but they'd have to keep the MAX grounded for a year or more to wait for that report.
 
kalvado
Posts: 1821
Joined: Wed Mar 01, 2006 4:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 12:35 pm

TTailedTiger wrote:
glideslope wrote:
Personally, I would like to see the test run again with line Max pilots not FAA Pilots. It's not beyond the scope for this to have been an attempt to "see we are being tough" by the FAA. I would not put this past them given their current quandary. There is simply too much of a disconnect in information being released and interpretations.


Agreed. It seems highly suspect that the processors would fail. As I stated in another post, new aircraft use older computer hardware since the reliability stats are known. They wouldn't put a brand new processor type in a new airplane.

A great example of why pilots - even gray-haired captains - should have only that much say in engineering questions.
Certification requirements extend well beyond what a line pilot may experience. Let's assume airline operates 400 jets of certain model from delivery to the desert ( for example AA had 385 MD-8x); for 100k cycles each (DC-9 family started at 40k certified, ended up with 110k certified). That is a total of 40 million cycles. Certification requirements extend to events which can happen 1 in a billion events, or 4% probability over service life for such airline.

To translate certification requirements into real life terms:
-it never happened to me or my friends, and we were flying these birds our entire life!: probability around 1e-5, such failures can have major severity, meaning "Physical distress to passengers, possibly including injuries; Physical crew discomfort or a significant increase in workload"
-it never happened at my airline!: probability around 1e-7; can be a hazardous failure, meaning "Serious or fatal injury to an occupant, Crew physical distress or excessive workload impairs ability to perform tasks"

We're talking about failure Boeing classified as major, i.e. having up to -it never happened to me or my friends, and we were flying these birds our entire life! probability
 
User avatar
PW100
Posts: 3723
Joined: Mon Jan 28, 2002 9:17 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 12:45 pm

XRAYretired wrote:
The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0.

In my mind, but that may just be me, single-sensor thing correlates to each parameter. If MCAS x.x needs AoA and G to do its thing, that would be two parameters. But if one (or both) of these parameters only rely on one sensor (i.e. one AoA sensor), its architecture is still what I would call, single-sensor. Never mind the second parameter sensor (G-sensor), the AoA input is still depending on one single sensor. And that would still require single-sensor failure mode effect analyses (FMEA).

So to me the removal of G-sensor is a bit of a red herring in terms of single-sensor thing, and associated system requirements in terms of reliability, crew actions, fale-safe etc. Of course, MCAS algorithms would be different for such g-sensor, and the associated failure modes and effects would also be different. But the fact in itself that there is a second parameter, doesn't change the principals of FMEA, and I would still consider it as a single-sensor system.

My understanding of STS is, that it is an auto(pilot) functionality, active when autopilot is disengaged, to assist the pilot in pitch trimming when flying manually with changing speeds. Speed changes (and resulting AoA effects) will change the aerodynamic centre of lift, and results in changes to neutral trimming. Under manual copntrol, the pilot would be adjusting the trim constantly during acceleration from take-off to cruise and vv. Using a smart algorithm, this task can be automated, which is what STS is all about. STS manipulates the same control function as the trim switch and manual trim wheel (ie. stabilizer trim jackscrew).
Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
 
User avatar
PW100
Posts: 3723
Joined: Mon Jan 28, 2002 9:17 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 12:48 pm

planecane wrote:
sgrow787 wrote:
There's another possibility here. Is the new delay a manufactured ploy to get the ungrounding date delayed to post-NTSB investigative report (its safe to assume that report will contain a section on pilot blame)? Then with FAA approval and NTSB backing in Jan 2020, they put the Max back into service and if another crash then happens then THATS when SHTF. Give us one more chance please.

No. What difference would it make? If there is a CFIT suicide on a MAX with the pilot announcing his intentions over the radio within a year of return to service Boeing will be blamed.

There is a 0% chance that Boeing would add to their financial liability and continued erosion of their reputation by purposely delaying return to service in some attempt to put some blame on the pilots.

There is no argument to blame the Lion Air pilots because of MCAS not being disclosed to them. There may be an argument with respect to ET (depending on the final report to answer questions like was the electric trim working properly and capable of getting the aircraft back in trim) but they'd have to keep the MAX grounded for a year or more to wait for that report.


Agreed. I think the reverse is (much) more likely: the investigation stumbled on issues and the FAA may be applying them in their fault mode analysis.
Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
 
h1fl1er
Posts: 93
Joined: Thu Jun 06, 2019 5:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 1:12 pm

IADFCO wrote:
We don't know key technical information.

For example, the increased lift of the engine nacelles has been mentioned many many times, but it's not clear why that should change the stick gradient. If the nacelle behaves like an annular airfoil, annular airfoils tend to stall late, beyond the 15 or so degrees that seem to be the critical angle of attack here (e.g., NACA TN-4117, downloadable from ntrs.nasa.gov). If so, the nacelle would generate a nose-up pitching moment, probably higher than for the NG, but with constant gradient with AoA. In other words, the stick would be lighter in the MAX, but uniformly so with angle of attack. The NG presumably has no stick lightening problem. So, what causes the stick lightening? What changes the gradient?

If the original wing does not have a gradient problem, and the nacelle on its own does not change the gradient either, then the problem could be caused by the interaction between the two, which could be messy. The circumstantial evidence (=leaks in the press) does point to that.

Obviously this is all at best informed speculation, because we interested bystanders don't have the required information, but IMHO it's not technical nitpicking, because it could determine how hard it's going to be to really fix MCAS.


the gradient must be increasing stick force as you approach stall

increased lift from nacelles decreases stick force. any airplane with forward mounted engines has nacelle lift

the placement of the LEAP engines on MAX cause different lift gradients as AOA changes as they're further forward and higher mounted. they have a bigger moment arm. simple as that
 
kalvado
Posts: 1821
Joined: Wed Mar 01, 2006 4:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 1:22 pm

PW100 wrote:
XRAYretired wrote:
The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0.

In my mind, but that may just be me, single-sensor thing correlates to each parameter. If MCAS x.x needs AoA and G to do its thing, that would be two parameters. But if one (or both) of these parameters only rely on one sensor (i.e. one AoA sensor), its architecture is still what I would call, single-sensor. Never mind the second parameter sensor (G-sensor), the AoA input is still depending on one single sensor. And that would still require single-sensor failure mode effect analyses (FMEA).

So to me the removal of G-sensor is a bit of a red herring in terms of single-sensor thing, and associated system requirements in terms of reliability, crew actions, fale-safe etc. Of course, MCAS algorithms would be different for such g-sensor, and the associated failure modes and effects would also be different. But the fact in itself that there is a second parameter, doesn't change the principals of FMEA, and I would still consider it as a single-sensor system.

My understanding of STS is, that it is an auto(pilot) functionality, active when autopilot is disengaged, to assist the pilot in pitch trimming when flying manually with changing speeds. Speed changes (and resulting AoA effects) will change the aerodynamic centre of lift, and results in changes to neutral trimming. Under manual copntrol, the pilot would be adjusting the trim constantly during acceleration from take-off to cruise and vv. Using a smart algorithm, this task can be automated, which is what STS is all about. STS manipulates the same control function as the trim switch and manual trim wheel (ie. stabilizer trim jackscrew).

"Single sensor" is terminology which may not make sense beyond a.net discussion.
What matters is the probability of proper operation and of different failure modes. False actuation requires misfire of all sensors (2 and 1 respectively) for all designs discussed.
Failure to actuate requires failure (in a different mode) of just 1 sensor if we're talking about 2 dissimilar devices; also 1 sensor in current MCAS design - but with the option (Boeing likely didn't take) of choosing a working one based on other data.
So in a sense 2 dissimilar sensors are the same reliability-wise as 2 similar ones.
 
Amiga500
Posts: 2267
Joined: Tue Mar 03, 2015 8:22 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 1:31 pm

Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.
 
LDRA
Posts: 272
Joined: Fri Jan 15, 2016 3:01 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 1:43 pm

XRAYretired wrote:
MartijnNL wrote:
LDRA wrote:
There is nothing wrong with using single sensor, STS also relies on single air speed signal. The key is to limit control authority so that elevator still can overpower stab in fault condition

From the Bloomberg article:"During the crashes of Lion Air and Ethiopian Airlines planes that killed 346 people, investigators suspect, the MCAS system pushed the planes into uncontrollable dives because of bad data from a single sensor.



That design violated basic principles of redundancy for generations of Boeing engineers, and the company apparently never tested to see how the software would respond, Lemme said. "It was a stunning fail. A lot of people should have thought of this problem - not one person - and asked about it", he said."


There is nothing wrong with a single sensor?! I believe I don't understand you. A single sensor is what cost 346 people their lives.

The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0. So I thought I'd have a look at STS a bit deeper to try to understand it. Surprisingly, there seems to be little information out there especially regarding technical detail.

I found it very difficult to understand what STS is actually doing and why. However, I felt in good company when reading back on some of the other forums to find that many 737 pilots don't quite understand what it is doing or why either. Some of these were just constantly concerned STS appeared to work against their intentions, some said they just ignored it under the assumption it was doing something for a reason and at least one said he purposely countermanded STS whenever it operated, presumably by blipping the thumb switch.

As near as I can get to it, STS is intended to maintain the most efficient and stable pitch and neutral stick force for a given Computed Airspeed, so if you are at a ~constant speed and everything else is equal it will stick at a stabiliser position it has chosen. During acceleration or deceleration, it will adjust the trim to try to maintain the previous speed measurement, and the next iteration the previous speed measurement ad-infinitum that is what gives the impression of acting against the pilot because it is effectively slugging the accel/decal with AND or ANU and contrary stick force. It would also appear that STS cannot move the stabiliser beyond a maximum of ~6deg of travel from 0 in ANU direction at the maximum Computed Airspeed it is operational.

So, I would guess, if the Airspeed sensor fails low within valid range (bearing in mind Computed Airspeed is also slugged by other parameters within the ADIRU and note that AOA is just converted to digital effectively raw) could, at high actual Airspeed, pull the Stabiliser in AND from 6deg to 0 or conversely fails high, within a valid range, at low actual Airspeed could pull the stabiliser up to 6deg ANU (at the appropriate rates) also bearing in mind, if it fails high beyond the STS operating range, STS will be inhibited. I am not sure how the degrees of travel relates to the actual trim measurement expressed in units but I would have though 0 degrees in this context would be trim setting in units at T/O ~5units?

However, as I understand it (no detail I could find), the STS algorithm is also moderated by Thrust and - Vertical Speed - I.e. 'G' (where have we heard that before). I make a presumption that STS will assume for high thrust that acceleration or deceleration in the case of low thrust is intended and so moderate its trim correction accordingly and similarly will moderate trim correction ANU at higher +G or AND for higher -G. These are protections that appear to be missing from MCAS V1.0. Of course, over correction by STS can also be countermanded by pulling the yoke through the ANU or AND microswitches and only one of these is present for MCAS. Or Thumb switch available for both.

In conclusion, my view would be that single sensor STS is an over simplification and can not be used as justification for single sensor MCAS. I could be completely wrong of course, if so I am sure someone will put me right.

Ray


@XRAYretired @ PW100

STS is exactly designed to "work against [pilot] intentions". It is not an autotrim system. It is an anti-autotrim system where it takes 737 MORE out of trim as air speed changes. It is only there to meet some Part 25 clauses.

STS is primary scheduled off air speed. I found an actual speed trim schedule for 737-500 on P87 of this report

https://skybrary.aero/bookshelf/books/3640.pdf
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 2:50 pm

Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.


2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray
 
Amiga500
Posts: 2267
Joined: Tue Mar 03, 2015 8:22 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 2:55 pm

XRAYretired wrote:
Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.


2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray


As long as loss of that system doesn't immediately put you in a hazardous condition.

I would assume that MCAS is not treated as such - and as long as the aircraft is entirely stable up to stall then I don't see any reason why it would not be [the stink would have been much greater by now if it were].
Last edited by Amiga500 on Tue Jul 02, 2019 2:58 pm, edited 1 time in total.
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 2:55 pm

Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.

2 sensors compared is fail safe. I sensor is not - effectively single point failure. You can argue about the failure categorisation, but we have two catastrophic events.

Ray
 
kalvado
Posts: 1821
Joined: Wed Mar 01, 2006 4:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 2:58 pm

XRAYretired wrote:
Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.


2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray

Not that simple. MCAS with 2 sensors and out on disagree would be unacceptable if it was needed on every flight.
Since it is designed for some uncommon scenarios, relatively ~(0.1-1)e-5 failure rate is mitigated by (guesstimating) 1e-5 occurrence rate for activating conditions.
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:04 pm

Amiga500 wrote:
XRAYretired wrote:
Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.


2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray


As long as loss of that system doesn't immediately put you in a hazardous condition.

I would assume that MCAS is not treated as such - and as long as the aircraft is entirely stable up to stall then I don't see any reason why it would not be [the stink would have been much greater by now if it were].


Yes. From what has been reported, I think we can assume the Hazardous condition for fail to operate was during high speed wind up turn, so the estimate would be ~10E-5*~10E-5 (assuming the frequency of entering wind up turn is ~10E-5) therefore ~10E-10 i.e. in excess of 10E-9 expectation for harzardous.

Ray
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:23 pm

kalvado wrote:
XRAYretired wrote:
Amiga500 wrote:
Single point of failure is probably what your talking around.

2 input signals are of little use except in declaring your system is broken - you don't know how its broken or what specific part is broken - you just know its broken as they disagree.


2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray

Not that simple. MCAS with 2 sensors and out on disagree would be unacceptable if it was needed on every flight.
Since it is designed for some uncommon scenarios, relatively ~(0.1-1)e-5 failure rate is mitigated by (guesstimating) 1e-5 occurrence rate for activating conditions.


I'm not sure what you are trying say. If you are talking availability during high speed wind up turn? then both sensors are available on despatch, so the probability for one sensor failing governs avaiability i.e. ~10E-05.If the rate of entering high speed wind up turn is ~10E-05 then, the rate for non availability in high speed wind upturn is ~10E-10per hour. If you've got better numbers please share.

the 'guestimate' is based on the reported 223 trillion hours MTB reported.

Ray
 
kalvado
Posts: 1821
Joined: Wed Mar 01, 2006 4:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:49 pm

XRAYretired wrote:
kalvado wrote:
XRAYretired wrote:

2 sensor is fail safe when compared, except when both fail in common mode >10E-10 per hour. 1 sensor is not ~10E-5per hour. Hence MCAS V2.0 is acceptable.

Ray

Not that simple. MCAS with 2 sensors and out on disagree would be unacceptable if it was needed on every flight.
Since it is designed for some uncommon scenarios, relatively ~(0.1-1)e-5 failure rate is mitigated by (guesstimating) 1e-5 occurrence rate for activating conditions.


I'm not sure what you are trying say. If you are talking availability during high speed wind up turn? then both sensors are available on despatch, so the probability for one sensor failing governs avaiability i.e. ~10E-05.If the rate of entering high speed wind up turn is ~10E-05 then, the rate for non availability in high speed wind upturn is ~10E-10per hour. If you've got better numbers please share.

the 'guestimate' is based on the reported 223 trillion hours MTB reported.

Ray

I am talking about probability of crash, which (swiss cheese model!) would occur if holes line up: pilots enter a situation where MCAS is needed (say 1e-5), MCAS is off at that particular moment due to sensor failure (1e-5), and pilots do not recognize "control lightening" or whatever it is, and make things worse (20%). So crash probability is in e-11 range, which is deemed acceptable.
Another scenario is false actuation - that being a separate story
 
XRAYretired
Posts: 488
Joined: Fri Mar 15, 2019 11:21 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 3:58 pm

PW100 wrote:
XRAYretired wrote:
The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0.

In my mind, but that may just be me, single-sensor thing correlates to each parameter. If MCAS x.x needs AoA and G to do its thing, that would be two parameters. But if one (or both) of these parameters only rely on one sensor (i.e. one AoA sensor), its architecture is still what I would call, single-sensor. Never mind the second parameter sensor (G-sensor), the AoA input is still depending on one single sensor. And that would still require single-sensor failure mode effect analyses (FMEA).

So to me the removal of G-sensor is a bit of a red herring in terms of single-sensor thing, and associated system requirements in terms of reliability, crew actions, fale-safe etc. Of course, MCAS algorithms would be different for such g-sensor, and the associated failure modes and effects would also be different. But the fact in itself that there is a second parameter, doesn't change the principals of FMEA, and I would still consider it as a single-sensor system.

My understanding of STS is, that it is an auto(pilot) functionality, active when autopilot is disengaged, to assist the pilot in pitch trimming when flying manually with changing speeds. Speed changes (and resulting AoA effects) will change the aerodynamic centre of lift, and results in changes to neutral trimming. Under manual copntrol, the pilot would be adjusting the trim constantly during acceleration from take-off to cruise and vv. Using a smart algorithm, this task can be automated, which is what STS is all about. STS manipulates the same control function as the trim switch and manual trim wheel (ie. stabilizer trim jackscrew).

Apologies, seem to be responding to posts in reverse order today for some reason.

Anyway, this is terminology. We can call them both parameters or apples if you like. The point is MCAS V0.0 requires both apples to fail in the same direction to erroneously initiate MCAS - ~10E-10 (or in the order of E-10 if you prefer). Failure to initiate requires only apple to fail ~10E-05, but is reported only to be hazardous in wind up turn estimated at 10E-05, so 10E-10 for it to occur. G apple is not a red herring in this respect since whilst failure to initiate remains in the order 10E-10, erroneous initiation is reduced to 10E-05. The failure effects are the same irrespective of sensors or apples.


Ray
 
rheinwaldner
Posts: 1709
Joined: Wed Jan 02, 2008 4:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 4:16 pm

Andy33 wrote:
There are several airlines who were not using their MAX orders to replace 737NGs. Instead they had no NGs in the first place (Air Canada being a good example) or were using them for missions the NG can't do at all, or only with severe weight restrictions (such as Norwegian and Icelandair); or they intended them mainly for expansion. Airlines in the first and third groups might go for a revived NG range, especially if they can't get A320s for ages. Airilines in the middle group would have to rethink their strategy altogether.

If they had A320 before, they would rather cancel the MAX order than buying just a "as-good" plane (which the NG is vs the A320)…
Many things are difficult, all things are possible!
 
DenverTed
Posts: 243
Joined: Wed Mar 27, 2019 11:12 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 5:03 pm

PW100 wrote:
PixelFlight wrote:
1989worstyear wrote:
Hard to believe a few 80286's can't handle MCAS, but a few 68000's and 80186's can keep a spanking new GTF-powered A321LR controllable without a hitch.

I don't think it's the hardware - most likely bloated code done by millennials like myself (I.E. Windows 10).

I agree with you.
The change between MCAS v1 and MCAS v2 is minimal:
1) Grab the AoA from the other side ADIRU via the ARINC bus.
2) Compare if the two AoA values disagree more than 5.5°. Most probably include a filtering.
3) Active the MCAS only one single time per too high AoA value.
4) Limit MCAS trim to keep the elevator authority.
This should not take a big processing time. Something is not coherent in the very few information actually available, or the trouble is even deeper...

It is not clear, but this new problem may apply also to MCAS 1.0. It could be that FAA found this issue because of extensive diligence after two accidents. Perhaps the first time aorund they (or Boeing = self-certitifying . . . ) were not so thorough in testing/validating such scenarios.

Right? Look at any skyscraper or stadium. If they inspect it or the plans long enough, there will always be flaws and code violations to be found if they look long enough.
My question is always, does this apply to the NG as well? Not that I wish for the grounding of the NG, just that if it is put under scrutiny, I'm sure there are some similar defects hiding in there. Same with the 787 or A350. The increasing complexity of the systems would take years for a second party to review. To some extent, I think that the safety is because of people getting it right the first time, and the numerous uncaught failure modes being low occurring enough that they never rear their ugly heads for 30 years of service.
 
packsonflight
Posts: 381
Joined: Tue Jan 12, 2010 2:55 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Tue Jul 02, 2019 10:56 pm

IADFCO wrote:
h1fl1er wrote:
DenverTed wrote:

[...]

As I understand it from asking the question on this thread, MCAS was required to meet the pitch stability for righting moment as the aircraft entered a high speed and low speed stall. But I have never seen this question answered by Boeing or the FAA. Seems like an easy enough question for either of them to answer.


???

mcas's necessity has been explained more than a dozen times as a solution to maintain appropriate average stick force gradient at high AOA in manual flight

regulations require that the force necessary to pull the yoke backward increase as the plane approaches stall. due to the increased lift of the LEAP engines, the max could not meet this newer requirement and the engineers decided to use MCAS as their solution. the nose-down attack of the stab after MCAS requires an increased pull force to maintain pitch attitude.

It is a Maneuvering Characteristics Augmentation System. Not stall protection, not envelope protection, nothing of the sort. This is why, given what it is, it is so perplexing that the software was written to continue to execute and have authority to command full nose down. the miswriting of the software, and its ultimate failure along with poor journalism are what has confused everyone into thinking that this was an anti-stall or envelope protection system.

why boeing chose to do it this way is confusing.


We don't know key technical information.

For example, the increased lift of the engine nacelles has been mentioned many many times, but it's not clear why that should change the stick gradient. If the nacelle behaves like an annular airfoil, annular airfoils tend to stall late, beyond the 15 or so degrees that seem to be the critical angle of attack here (e.g., NACA TN-4117, downloadable from ntrs.nasa.gov). If so, the nacelle would generate a nose-up pitching moment, probably higher than for the NG, but with constant gradient with AoA. In other words, the stick would be lighter in the MAX, but uniformly so with angle of attack. The NG presumably has no stick lightening problem. So, what causes the stick lightening? What changes the gradient?

If the original wing does not have a gradient problem, and the nacelle on its own does not change the gradient either, then the problem could be caused by the interaction between the two, which could be messy. The circumstantial evidence (=leaks in the press) does point to that.

Obviously this is all at best informed speculation, because we interested bystanders don't have the required information, but IMHO it's not technical nitpicking, because it could determine how hard it's going to be to really fix MCAS.


Adding to the speculation... At extremely high AOA, beyond 15 deg the engine, because of it sheer size, could interfere with the airflow over the wing and destroying the lift right behind it. At the same time the nacelle is not stalled, and still creating lift. The centre of lift would move forward, creating sudden pitch up moment.

If this is what is happening the lack of linear stick force is simply a result of an unstable aircraft.

Is it really possible to certify transport category aircraft, and use single channel MCAS system to mask inherent instability?

I assume classic transport category FBW alpha protected aircraft, has to be flight tested and demonstrated stable in direct mode.

So how is it possible to certify 737 MAX without addressing the stall behaviour with MCAS ioperative?
 
planecane
Posts: 1041
Joined: Thu Feb 09, 2017 4:58 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 3:52 am

packsonflight wrote:


So how is it possible to certify 737 MAX without addressing the stall behaviour with MCAS ioperative?


Because MCAS inoperative will be a non-normal situation and have a non-normal checklist for the pilots to follow. If certification was impossible because an aircraft behaves differently in non-normal situations then no aircraft could be certified.

Remember from the WSJ report that the "old school" test pilot was ok with MCAS because it would almost never activate in normal service. It had to be included because it is possible to get the 737 into those parts of the flight envelope, not because it is normal.

I don't know if anybody has stats but I'd guess that the incidence of near stall situations on aircraft in commercial service is infinitesimal.

The cases (AF447, colgan 3407) where there were stalls weren't helped by having stable aircraft.

Honestly, if they had not included MCAS and faked the certification paperwork, there would likely never been a crash due to an easier to enter stall during an extreme maneuver.
 
User avatar
BoeingVista
Posts: 1991
Joined: Mon Jan 12, 2009 9:54 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 4:01 am

planecane wrote:

Remember from the WSJ report that the "old school" test pilot was ok with MCAS because it would almost never activate in normal service. It had to be included because it is possible to get the 737 into those parts of the flight envelope, not because it is normal.



Not true, on two counts

1) The old school test pilot wanted vortex generators to alleviate the problem rather than a software solution, he was told it couldn't be fixed that way.

2) MCAS had to be included to satisfy a certification criteria of equal stick pressure when approaching a stall.
BV
 
User avatar
seahawk
Posts: 8524
Joined: Fri May 27, 2005 1:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 5:09 am

kalvado wrote:
XRAYretired wrote:
kalvado wrote:
Not that simple. MCAS with 2 sensors and out on disagree would be unacceptable if it was needed on every flight.
Since it is designed for some uncommon scenarios, relatively ~(0.1-1)e-5 failure rate is mitigated by (guesstimating) 1e-5 occurrence rate for activating conditions.


I'm not sure what you are trying say. If you are talking availability during high speed wind up turn? then both sensors are available on despatch, so the probability for one sensor failing governs avaiability i.e. ~10E-05.If the rate of entering high speed wind up turn is ~10E-05 then, the rate for non availability in high speed wind upturn is ~10E-10per hour. If you've got better numbers please share.

the 'guestimate' is based on the reported 223 trillion hours MTB reported.

Ray

I am talking about probability of crash, which (swiss cheese model!) would occur if holes line up: pilots enter a situation where MCAS is needed (say 1e-5), MCAS is off at that particular moment due to sensor failure (1e-5), and pilots do not recognize "control lightening" or whatever it is, and make things worse (20%). So crash probability is in e-11 range, which is deemed acceptable.
Another scenario is false actuation - that being a separate story


The problem is that the 2 crashes have shown that a MCAS malfunction alone is hazardous. The problem is not a MCAS deactivation but a MCAS malfunction. And to reduce the chance of a malfunction which currently is 100% in case of a sensor failure, you need to use a second sensor.
 
IADFCO
Posts: 119
Joined: Sun May 22, 2016 4:20 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 5:40 am

planecane wrote:
packsonflight wrote:


So how is it possible to certify 737 MAX without addressing the stall behaviour with MCAS ioperative?


Because MCAS inoperative will be a non-normal situation and have a non-normal checklist for the pilots to follow. If certification was impossible because an aircraft behaves differently in non-normal situations then no aircraft could be certified.

[...]


Wrong! MCAS will be inoperative by design (= not a "non-normal" situation) after one activation in a wind-up turn -- plausible scenario: evasive maneuver. Hopefully the FAA will test this situation in flight (not in the simulator) through stall.
 
IADFCO
Posts: 119
Joined: Sun May 22, 2016 4:20 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 5:59 am

packsonflight wrote:
Adding to the speculation... At extremely high AOA, beyond 15 deg the engine, because of it sheer size, could interfere with the airflow over the wing and destroying the lift right behind it. At the same time the nacelle is not stalled, and still creating lift. The centre of lift would move forward, creating sudden pitch up moment.
[...]


I agree with you, it's quite plausible. I don't think it's the nacelle by itself because, as I wrote earlier, the nacelle presumably stalls after the wing, so it may increase or decrease the stick force gradient, but uniformly for all angles of attack, so it should not be contributing by itself to stick lightening.

It's probably not the wing by itself either, because the qualitative behavior should be the same as in the NG, which apparently does not suffer from stick lightening.

The combination engine-plus-wing seems like a possible culprit. At some high angle of attack, the engine would not stall, the wing with the engine "NG-style" would not stall either, but the wing with the flow perturbation caused by the big engine would, leading to the nonlinearity in the stick gradient. Circumstantial evidence is that the original chief test pilot asked for modifications to the nacelle, according to the NYT article, but they were unsuccessful. Making the nacelle stall together with the wing or earlier wouldn't seem too hard, but if it's not an issue of stalling/nacelle lift, but rather of flow interference/blockage by the engine, that wouldn't work.

It may turn out that MCAS is not an anti-stall device only if a lawyer carefully parses the words, but instead it is both an anti-stall device and an envelope protection device.
 
User avatar
seahawk
Posts: 8524
Joined: Fri May 27, 2005 1:29 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 6:11 am

Th engine / wing work like a slotted flap at certain AoAs.
 
StTim
Posts: 3409
Joined: Thu Aug 08, 2013 7:39 am

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 6:40 am

DenverTed wrote:
PW100 wrote:
PixelFlight wrote:
I agree with you.
The change between MCAS v1 and MCAS v2 is minimal:
1) Grab the AoA from the other side ADIRU via the ARINC bus.
2) Compare if the two AoA values disagree more than 5.5°. Most probably include a filtering.
3) Active the MCAS only one single time per too high AoA value.
4) Limit MCAS trim to keep the elevator authority.
This should not take a big processing time. Something is not coherent in the very few information actually available, or the trouble is even deeper...

It is not clear, but this new problem may apply also to MCAS 1.0. It could be that FAA found this issue because of extensive diligence after two accidents. Perhaps the first time aorund they (or Boeing = self-certitifying . . . ) were not so thorough in testing/validating such scenarios.

Right? Look at any skyscraper or stadium. If they inspect it or the plans long enough, there will always be flaws and code violations to be found if they look long enough.
My question is always, does this apply to the NG as well? Not that I wish for the grounding of the NG, just that if it is put under scrutiny, I'm sure there are some similar defects hiding in there. Same with the 787 or A350. The increasing complexity of the systems would take years for a second party to review. To some extent, I think that the safety is because of people getting it right the first time, and the numerous uncaught failure modes being low occurring enough that they never rear their ugly heads for 30 years of service.


You have a different understanding of how we have achieved such a good safety record in the industry. We have rigorously investigated crashes and safety incidents to learn the lessons to improve safety in the future. I suspect the MAX crashes will add to that body of learning and thus make future flying safer.
 
User avatar
PW100
Posts: 3723
Joined: Mon Jan 28, 2002 9:17 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 8:16 am

XRAYretired wrote:
PW100 wrote:
XRAYretired wrote:
The single sensor STS thing seems to come up periodically as some sort of justification for changing to a single sensor MCAS or avoiding having a two sensor MCAS post V0.0.

In my mind, but that may just be me, single-sensor thing correlates to each parameter. If MCAS x.x needs AoA and G to do its thing, that would be two parameters. But if one (or both) of these parameters only rely on one sensor (i.e. one AoA sensor), its architecture is still what I would call, single-sensor. Never mind the second parameter sensor (G-sensor), the AoA input is still depending on one single sensor. And that would still require single-sensor failure mode effect analyses (FMEA).

So to me the removal of G-sensor is a bit of a red herring in terms of single-sensor thing, and associated system requirements in terms of reliability, crew actions, fale-safe etc. Of course, MCAS algorithms would be different for such g-sensor, and the associated failure modes and effects would also be different. But the fact in itself that there is a second parameter, doesn't change the principals of FMEA, and I would still consider it as a single-sensor system.

My understanding of STS is, that it is an auto(pilot) functionality, active when autopilot is disengaged, to assist the pilot in pitch trimming when flying manually with changing speeds. Speed changes (and resulting AoA effects) will change the aerodynamic centre of lift, and results in changes to neutral trimming. Under manual copntrol, the pilot would be adjusting the trim constantly during acceleration from take-off to cruise and vv. Using a smart algorithm, this task can be automated, which is what STS is all about. STS manipulates the same control function as the trim switch and manual trim wheel (ie. stabilizer trim jackscrew).

Apologies, seem to be responding to posts in reverse order today for some reason.

Anyway, this is terminology. We can call them both parameters or apples if you like. The point is MCAS V0.0 requires both apples to fail in the same direction to erroneously initiate MCAS - ~10E-10 (or in the order of E-10 if you prefer). Failure to initiate requires only apple to fail ~10E-05, but is reported only to be hazardous in wind up turn estimated at 10E-05, so 10E-10 for it to occur. G apple is not a red herring in this respect since whilst failure to initiate remains in the order 10E-10, erroneous initiation is reduced to 10E-05. The failure effects are the same irrespective of sensors or apples.


Ray


OK, I see and agree. It is important to distinguish between failure to work, and false activation.
I agree that the second apple(s) will still prevent false activation when the first apple(s) fails.
Thanks.
Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
 
oschkosch
Posts: 202
Joined: Mon Oct 29, 2018 3:41 pm

Re: Boeing 737MAX Grounded Worldwide Q3 2019

Wed Jul 03, 2019 8:16 am

More bad press!

https://www.businessinsider.com/boeing- ... ogy-2019-6

And meanwhile in India, engineers are protesting at being even associated with the max.

https://interestingengineering.com/indi ... ax-failure

And Somon Air has cancelled its planned lease.

https://simpleflying.com/somon-air-boeing-737-max/

Gesendet von meinem SM-G950F mit Tapatalk
  • 1
  • 2
  • 3
  • 4
  • 5
  • 55

Popular Searches On Airliners.net

Top Photos of Last:   24 Hours  •  48 Hours  •  7 Days  •  30 Days  •  180 Days  •  365 Days  •  All Time

Military Aircraft Every type from fighters to helicopters from air forces around the globe

Classic Airliners Props and jets from the good old days

Flight Decks Views from inside the cockpit

Aircraft Cabins Passenger cabin shots showing seat arrangements as well as cargo aircraft interior

Cargo Aircraft Pictures of great freighter aircraft

Government Aircraft Aircraft flying government officials

Helicopters Our large helicopter section. Both military and civil versions

Blimps / Airships Everything from the Goodyear blimp to the Zeppelin

Night Photos Beautiful shots taken while the sun is below the horizon

Accidents Accident, incident and crash related photos

Air to Air Photos taken by airborne photographers of airborne aircraft

Special Paint Schemes Aircraft painted in beautiful and original liveries

Airport Overviews Airport overviews from the air or ground

Tails and Winglets Tail and Winglet closeups with beautiful airline logos