"The JATR team will conduct a comprehensive review of the certification of the aircraft’s automated flight control system, The team will evaluate aspects of the 737 Max automated flight control system, including its design and pilots’ interaction with the system, to determine its compliance with all applicable regulations and to identify future enhancements that might be needed."
So we can agree that Boeing has submitted its fix. And that the FAA has forwarded that fix to the JATR for review. Even though it was just a few days ago that the FAA said it was inquiring with airline operators for newbie Max pilots for design evaluation. If the JATR is interested in pilots "interaction with the [new] system", then why would the FAA forward the fix without that data (since its inconceivable they would have that information in just a few days).
Also, with such a quick turnaround (a month or so) for Boeing's FCC re-architecture, any ideas on what the fix could be? If the "data flow" issue was due to the loading of the cross-channel bus (my speculation up thread), I'm thinking they could have reprioritized other non-AOA data, reducing the periodic reading and transmission of that data, to allow the AOA data to fit without overflowing the channel. Otherwise, any real re-architecture would take 6 months or more IMO.
MCAS fix was essentially completed in the ~April timeframe. Formal submission was delayed by a Flaps System reported 'catastrophic' categorised problem, also probably essentially completed likely in the ~June timeframe. Formal submission was again delayed due to the 'BitFlip' 'catastrophic' categorised problem and we await formal submission following completion of the fix characterised by reportedly architecture change to Active/Standby and Fail Safe.
As per the quote, I believe taken from the officially stated scope, JATR was to review the control systems and certification pre-fix. Reports since have suggested that they have actually spent some time looking at the fix due to Boeing failure to disclose data related to the original certification (one presumes). Its the TAB that was officially charged with shadowing the fix certification.
The understanding from reports is that the exercise involving 'newbie' pilots is in regard to evaluation of revised procedures and training requirements and not directly related to the testing of the design changes.
Nonsense. I can't think of a single reason why you would want pilot experience data unless it was post-fix flight control system.
I have previously posted thoughts on the architecture change floated, that were not well received by yourself, I have no desire to repeat them. Suffice to say, it is clear, that whatever the nature of the change, it is possible it has been under test for some time and final submission is expected in the September/October timeframe. Peter Lemme's expectation as to the scope would seem to be more extensive than that you suggest.
I did have a reread of Seattle Times bit flipping "cosmic ray" piece:https://www.seattletimes.com/business/b ... -controls/
The piece only goes into 2 of the 5 reported bits that were flipped:
- MCAS engaged
- Horiz stab AND
Since the testing was done on MCAS 2.0, one can probably assume the remaining 3 bits were:
- AOA disagree
- Flaps UP
- Autopilot engaged
And two scenarios (of the 33 total that were tried) were:
- MCAS engaged flipped to ON
- MCAS engaged flipped to OFF, and stab AND flipped ON
- repeat the above two over prolonged period
As for the fix, the Seattle Times article says:
“For the MAX, the new MCAS was simply added to an existing 737 flight control system called the Speed Trim System, which was introduced with this one-channel computer architecture
on the older model 737-300 in the 1980s.
With the proposed dual-channel configuration
, both computers will be used to activate the automated flight controls. They will each take input from a wholly independent set of sensors (air speed, angle of attack, altitude and so on) and compare outputs.
If the outputs disagree, indicating a computer fault, the computers will initiate no action and just let the pilot fly manually.”
So it seems they are achieving two-sensor redundancy by comparing outputs from AOA-L-to-FCC-L and AOA-R-to-FCC-R, and then having AOA-L and AOA-R being forwarded to FCC outputs for compare. So in essence, the changes look like:
(1) Forward the AOA-L sensor data to FCC-L outputs
(2) Forward the AOA-R sensor data to FCC-R outputs(3) Route the outputs (through cross-channel or to separate computer?) for comparison
- FCC-L Stab AND
- FCC-R Stab AND
- FCC-L MCAS Engaged
- FCC-R MCAS Engaged
(4) Deactivate MCAS if things don't compare
(5) Illuminate AOA disagree if things don't compare
The one question might be: where did they come up with cosmic rays**? Since sensor data is usually read on a cyclic schedule, any bit flip would be reset on the next processing cycle. It's possible that on old hardware, the cycle period is slow enough that one bad cycle could cause a significant delay to risk the "one second" the FAA requires from a pilot responding to a catastrophic event when in manual flying mode (3 seconds if in autopilot mode).
**Or is this just another means by which Boeing tries to mitigate the risk by saying the situation will rarely happen to begin with?
Last edited by sgrow787
on Sun Sep 01, 2019 12:28 pm, edited 3 times in total.