Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

I have zero clue about this side of certification.

From what I understand it's the Dal standards which are the crux of it. As soon as you start using multi thread and multi proc it's virtually impossible (nobody has managed yet) to get DAL A certified. So fbw they go for three black box's per critical system.

You have to tell the iPhone generation to slow down while inputting into the FMC because you can easily overload it and screw the sync up. So input wait for the effect then start the next command. That's what I know as a pilot of operating with this sort of hardware.

Problem is that with the Pandora's box that's been opened there is loads of things surfacing which don't meet certification standards that have been used for 30 odd years with no issues. So I presume they have to make a choice between changing the standards or enforcing them.

The likes of Boeing and Airbus don't actually make these systems. It's Collins and the like. It's not just a 737 max issue or boeing.

I have zero clue what fbw use as processor's.

The airlines have zero say on these systems. It's very rare they get a choice these days on any flight hardware. They don't even get a choice engines any more. Old days you had three choices for FMC none at all a low end 2d nav management system or a high end full management system which allowed 3d profile management and fuel.

These days everything is that intergrated and optimised for low fuel burn the development and certification cost are that huge its uneconomical in time and money to give options.

Btw there is as much testing going on at airbus as there is at Boeing just now. They have found a few things but only one AD level issue. But fully expect to find more. They just don't have the same pressure of being grounded.

Btw was it the Russian pilots getting thier tickets pulled you were on about?

 

[Alistair_Heaton]

Latest issue that's surfacing is there are objections to the fan disk being forward of the wings to such an extent that the wing root is not giving any protection to the rudder control runs.

As the engine is so new there is no data to be able to counter the possibility of issues.

 

[IRstuff]

Wasn't there a plane that had a turbine failure that result in a blade going to a passenger's window and killing same?

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[Lou Scannon]

Apparently, extending the landing gear of the 737 in order to accommodate larger diameter engines was already a topic 45 years ago, back when the 737 was getting its ass kicked in sales by the DC-9.
Check the third item under Sensor

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

 

[3DDave]

The blade did not enter the aircraft - the dinged window frame allowed the window to blow out and the passenger was partly extruded and then beaten to death by turbulence. Edit - it appears that part of the engine cowl is what hit the window, not the blade.

https://en.wikipedia.org/wiki/Southwest_Airlines_Flight_1380

The blade failed containment because the FAA does not require the cowling to contain shed blades or a cage over the front of an engine.

Interesting - the blade did not exit the engine in the plane of rotation, so the claim that a wing will stop a blade is stupid.

https://www.ntsb.gov/investigations/Pages/DCA18MA142.aspx

 

[waross]

Was that the only time a blade left the engine, Dave?

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[3DDave]

Waross,

Hardly - but if you are talking about turbine disk rupture then nothing on the plane is capable of stopping that debris. Worrying about engine position is a bit wasteful.

If you have a particular instance that is applicable to the 737 then bring the research.

 

[Alistair_Heaton]

The only control runs getting cut due engine failure I can think of is the soux city trimotor crash. Which is a completely different situation to the 737.

I can't see how you could protect against the hub going through the hull.

Maybe it's just a case of missing analysis/safety case.

The details are in the NYT it's a bun fight between FAA engineers, FAA management and Boeing.

 

[VEBill]

Have the requirements been loosened? Blade-Off testing, where a fan blade is rigged to detach by a small explosive charge, is a well known technique. There are videos showing this test. The narrative mentions the difficult requirement to contain the damage.

Here are some links to assist.

https://www.sciencedirect.com/science/article/pii/S100093611200009X

https://www.avm-mag.com/video-showing-turbine-engine-blade-fail-test/

 

[3DDave]

The requirements have not been loosened. In the SW fatality the blade shed caused the shell over the engine to be so damaged that a fragment was chucked hard enough to break out a window. That part of the engine is not subject to containment requirements and similar, though less energetic, damage has happened when latches were not completely closed, allowing the access doors to slam open and disintegrate.

I think a previous, non-injury, blade shedding, also SW, had the blade leak over the remaining front of the engine when the inlet cowl was severed, possibly by the swirl of a fastener in the deicing airflow, scraping and eroding the shell from the inside.

 

[Alistair_Heaton]

the fan blade detachment and bird ingestion tests are the same as always. if the main hub comes off the shaft there is nothing going to stop it departing. Even in the RB211's that they use for power generation which aren't subjected to the same maint as the aero ones it basically rwrecks the whole generation house when they go. I think one of them managed to punch through the whole of an oil rig when one of the rear turbine disks separated. They never did find it.

its this sort of failure they are on about.

or this


Which is a airfrance A380 where the hub sheared off and they have recently found it under the snow.

This issue hasn't come from the pilot side of things. As far as I can tell the engineering grunts at the FAA had issues with it and flagged it and boeing had words with FAA managment and they were then forced to drop the subject.

 

[3DDave]

I was once in essentially a p***ing match with a regulatory engineer. His job was to cancel the contract for-cause because the contracting agency wanted their money back to spend on something else and he was working at it by making up improbable scenarios. The one leveled in my direction was whether a few grams of polysulfide rubber might destroy the integrity of 5 pounds of cured polyurethane that was nearby (not in direct contact) in the few minutes it took for the catalyzed rubber to cure.

"Isn't it possible that something could happen? What have you done to prove that there won't be some adverse effect over the life of the item?"

Sure. Let me get on that 40 year life testing of a few thousand samples in every possible environment to see if two of the most stable elastomers will spontaneously degrade because they are near each other.

I have no doubt that certain parties within the FAA are looking to score political points by destroying Boeing as a way to advance their standing.

Obviously if one loses an engine the adverse torque from the remaining one will require significant rudder and it would really suck to have the loss of the engine cause the loss of the second. As the recent crash of the twin into a hanger showed, even a functioning rudder might not save the plane.

But looking at the potential arc of debris and the ability of it to leave the engine I doubt that a even carefully engineered experiment could sever any cables inside the fuselage. But hey, it's possible. A 1/2inch by 1 foot wide plate of maraging steel the length of the cable run on both sides of the plane will fix it. Sure, it means the 737 would be a one-across airplane, but think of how safe it might be.

 

[Sparweb]

I don't know why I'm encouraging this (somewhat) off-topic discussion, but...

How about I supply some necessary background info about the rotor-burst subject since it's so interesting right now:

https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_20-128A.pdf

That thing is 45 pages and it's just the tip of the iceberg.
Hopefully that provides some anchor to the facts before anyone stirs up a rant about this particular failure mode. One that has nothing to do with the 737Max current difficulties, I might remind you.

The stuff in advisory circulars isn't mandatory, and says so in most of these documents, but if you AREN'T going to do what these AC's are telling you to do, then the FAA/TCCA/EASA expects you to come up with a really convincing explanation and an even better solution. It is also helpful to identify the zones to stay out of if, for instance, your customer wants to install some additional oxygen bottles but they happen to be close to the engine.

Take note of the date on that document: 1997. There weren't many events to learn from at the time, but enough that action was needed and a high proportion of them were catastrophic. The events cited in the posts above add 3 more examples. Each of the recent events could have been disasters leading to a crash, but in the end only one person died in only one of these cases. Bad, but it is a big improvement over the previous track record in the '60's to '80's, where an uncontained rotor failure led to a complete hull loss accident about once every 2 years. And that was a time with an order of magnitude less air traffic. I hope this is convincing evidence that there is a marked improvement in the safety standard in the 20 years since this Advisory was published.

One other point of interest, the example airplane they illustrate in the appendix is an actual aircraft type. Knowing which one makes this AC particularly useful when working on that type of aircraft.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

"As the recent crash of the twin into a hanger showed, even a functioning rudder might not save the plane. "

Vmca roll overs will occur to every twin aircraft unless its a push pull engine setup. TO be honest with most light twins which are not pref A certified your better killing the second engine and landing in a field ahead if you can. Your playing with being spot on your speeds and getting 200ft climb rate. Go 5 knts slower than your blue line speed and your into V mca rollover and the only way to fix it is to reduce power on the working engine then accelerate and reapply it. The Q400 single engine, MTOW, temp ISA +30 at SL will give 1000ft per min climb rate, When you level off at say 5000ft it will overspeed if you leave the power lever of the working engine in the max power gate. There is another emergency range above the power gate which I have never used in 3 years not even in the sim. And the Vmca speeds and Vmcg are calculated at this higher MTOp and Emergency power settings so we have huge margins for error.

" One that has nothing to do with the 737Max current difficulties, I might remind you."

It's now part of the max's current difficulties. Even if they only have to "come up with a really convincing explanation" it adds to the time line and uses resources until its flying again. And there is also the possibility that while they are looking at that something else will surface. Its going to be interesting to see the list of out of certification items which were present on a fully certified aircraft for public transport.

 

[waross]

There is an interesting tangent on page 14 of the Advisory Circular.

A pilot reaction time of 17 seconds for initiation of the emergency decent has been accepted.

The context suggests that a pilot reaction time of 17 seconds was already an accepted factor over 20 years ago.
When critiquing the pilots actions it is interesting to note that after the last unexpected Mac Attack, the pilots died with 2 seconds of unused, allowable reaction time.

There is another interesting point on page 5 of the Advisory Circular.

Continued Safe Flight and Landin2. Continued safe flight and landing means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the airplane.

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[btrueblood]

waross, you forgot to highlight "possibly using emergency procedures", which is what the two sets of pilots failed to do.

 

[charliealphabravo]

I can delete if this is a re-post. This story summarizes pilot reports related to nose-down MCAS anomalies on the Max 8.

I found it interesting that at least two of the events occurred in strong cross winds which might be consistent with the way MCAS was implemented. Air passing across the hull and pushing up on one AOA sensor (the one being used by MCAS) could look like a high climb rate. Also that some pilots were having pre-flight cockpit discussions about the MCAS risks and contingencies I suppose.

Again, sorry if this is a rehash. I didn't see it in the previous posts.

Edit: It also seems that MCAS incidents were occurring while under autopilot and yet in the third or fourth report the pilot states that MCAS only operates in manual flaps-up flight.

 

[Alistair_Heaton]

There is another system called STS which also has control over the trim stab. Which also adds to the confusion.


It is perfectly normal on the NG for the trim stab to be moving none commanded by the pilot while manually flying. Which adds to the issues of realising that its moving incorrectly.


"which is what the two sets of pilots failed to do."

If two sets fail to do in such a short period of time you can garantee that a whole load won't do them either given the same range of indications in the cockpit.

 

[charliealphabravo]

I think it is pretty obvious at this point that skilled and well trained pilots may have averted both incidents, and probably have averted similar incidents.

Does that degree of skill and training represent, say, the second or third standard deviation of pilots in the air these days. With all the talk about response times and poorly documented maneuvers to unload the elevator, I think probably not. If you add physical strength requirements to operate the trim wheel in a worse case scenario we may not even be in the first standard deviation. As has been pointed out, pilots these days are more operating the plane and less flying it. That means that system design should tend more toward fail-safe, redundancy, low-strength input for recovery, longer response times, etc.

For the sake of posterity we should understand what mistakes were made by the pilots. The op-eds and 60 Minute pieces that white-wash any fault of the pilots might be useful for pressuring Boeing but they aren't doing any favors if they don't result in pilot improvements as well.

 

[IRstuff]

This is kind of sad

https://gizmodo.com/turn-it-off-and-on-again-every-149-hours-is-a-concernin-1836818094

apparently, certain older A350s have to be power-cycled within 149 hrs of a previous power cycle, or the controls might get wonky...

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm