Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[RolMec]

if extrapolating from previous experience (gulf oil spill):
For some company managements there's seemingly but one way to bring them back into conciousness, that's litigation with relevant sums at stake.

Then, did the Boeing system engineers know about the faulty design? i use this word, to be technically clear. That's not an accusation. Did someone there rise the red flag?

This would be the person to start rebuilding the system & also public confidence, similar to Alan McDonald & the boosters for the Shuttle.

Why not respecting, demanding, encouraging diverging technical opinion as proof of soundness within the design world?

Roland Heilmann

 

[Alistair_Heaton]

There seems to have been many red flags.

One of the test pilots has stated that when he tested the system early on there was two seperate sensor systems linked to the MCAS. They had both AoA's in the loop and the aircraft G and it was limited to one input cycle of the reduced amount and you needed to be in the high positive G section of the flight envelope. He still wasn't happy with it and said so. But as the system needed high G as well as AoA input he relalistically couldn't see it activating so with reservations said it was OK.

He has since left Boeing and now flys for a US airline and was as surpised as everyone else when the production system as fitted to the MAX became public knowledge it was very far away from what he had signed off.

https://www.planeandpilotmag.com/going-direct-boeing-did-what-test-pilots-share-737-max-details/

https://www.nytimes.com/2019/06/01/business/boeing-737-max-crash.html

And this article has loads in it how the various flight augmentation systems work on the 737

https://www.satcom.guru/2018/11/737-fcc-pitch-axis-augmentation-command.html

"This would be the person to start rebuilding the system & also public confidence, similar to Alan McDonald & the boosters for the Shuttle."

Sully could be a face for the team...... But as there are more than likely voodoo dolls of him around the US getting daily stabbings I doudt he would be acceptable to the main industry players. But he would sort the public confidence side of things if he said it was now good.

 

[davefitz]

In the old days of digital computers, the golden rule was GI=GO, or garbage in = garbage out. To base a critical computer response algorithym on an assumption that a single instrument was fabricated correctly, calibrated correctly ,maintained correctly and not damaged from airfield debris seems to be a gross error.I had thought that components of commercial airliners were designed using probability based on a 3*std deviation proof , but I guess that rule is no longer used anymore

"...when logic, and proportion, have fallen, sloppy dead..." Grace Slick

 

[3DDave]

IRstuff - control systems or Systems? Was your primary product Powerpoint slide decks and your goal to present at an INCOSE symposium?

 

[IRstuff]

Weapon target and acquisition systems, and I've never been to an INCOSE symposium nor produced any Powerpoint slides for any.

I think it's more than a bit insulting to assume that all systems engineers are paper-pushers; it may be the case that many are, just as there as many designers who don't bother understanding their requirements. The systems engineering process is the minimum threshold required to manage a design, but as with a PE license, it does not guarantee a successful design; that still requires knowledgeable systems and design engineers to produce a valid product. You can look to Uber's and Tesla's fatalities to see identical processes at work with identical lack of understanding of requirements.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[3DDave]

I can look at FCS as well.

I'm looking at the Systems Engineering slides where SEs are the central and controlling figures for the entire development process, considered the sole source of knowledge and their general lack of experience in managing and understanding failure is clearly shown by the manner in which INCOSE supplies the concept that if one just keeps track of requirements and does a pile of AoA paperwork that that is enough.

The way that the process failed in the 737 Max matches my experience with high-level SEs.

 

[IRstuff]

OK, fair enough; I worked on FCS, and it was snafu'ed by by a bunch of problems, but the big issue isn't the systems engineering, per se, it's the lack of knowledgeable SMEs trying to go through the process. As I alluded to earlier, even a perfect process still requires experienced engineers; you can't parse or question requirements that you don't fundamentally understand. Part of the systems engineering process includes a System Requirements Review (SRR) wherein you hash out the interpretations and scope of each requirement; that can't be done with people that have no experience.

This is no different than Uber hiring a bunch of LIDAR and image processing guys that only understand target segmentation, and not target tracking. The end result is that Uber's target processor detected the pedestrian, but ignored the fact that the pedestrian was on an intercept course well before the pedestrian actually got into the path of the car. So, whatever faults Boeing has, it's nowhere unique, since both Uber and Tesla have almost identical issues with processing of targets beyond the basic detection step.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[waross]

but the big issue isn't the systems engineering, per se, it's the lack of knowledgeable SMEs trying to go through the process. As I alluded to earlier, even a perfect process still requires experienced engineers;

As far as engineers on this project.
I am sure that Boeing managers carefully selected the engineers for the Max project.
It is easy to imagine that any engineer with the moral courage to stand up to management and say:
"This is wrong."
would not be on the team.
One engineer with such moral courage slipped through the net.
When he did stand up to management, and was supported by his team and another senior engineer, he was quickly removed from the program.
I am sure that the engineers did their best.
The best engineers may not have been chosen for the Max team.

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[HamburgerHelper]

You don't have to try hard to create systems where self-reporting is a precious thing to do. Just basing bonuses and raises on the number of self-reports will passively prevent 95%+ of a team from bringing up an issue. Why should anyone fight too hard if they will likely be on another project,contract, or company in a few years anyways? OSHA in their safety guidelines strongly discourages financial rewards be tired to self-reports. I am sure those engineers at Boeing had a manager breathing down their neck over deadlines. Any pushback would probably be a career mistake. At Wells Fargo, you just had to create unrealistic expectations and make people afraid to get them to be unethical. Companies with poor ethical culture in my opinion more times than not are that way by design.

------------------------------------------------------------------------------------------
If you can't explain it to a six year old, you don't understand it yourself.

 

[Alistair_Heaton]

In the pilot side of things self reporting is a variable topic. I am lucky in my current job that a flight safety report goes to the flight safety department who are separate to the fleet management. And I am pretty happy the way it works and issues dealt with.

For the vast majority of things it usually heads out to either the Engineering side of things or operations. A quick interview to see what the crew did and you get the results a bit later.

If its due to a crew screw up they dig in and find out the root cause. Then deal with it. Thats not to say you can't be fired over something you have submitted if you have been negligent or there is shall we say history. But to my knowledge nobody has been fired for a one off event. Even to the point of structural damage to an aircraft.

Heavy landings are always an issue with any airline especially as FO' come on line and float up the experence curve. Thats not to say Captains don't do them as well. The hardest I have done in the dash was 1.89G the trigger for heavy landing is 2.1G. It was my own fault didn't put enough power in when we got sink in the flare and hit the pitch limit and arrived. Calm winds and 10k viz so no excuse. Apologised to everyone on board and that was that. Must admit when the FO does one I take the blame, well ultimately everything is the fault of the Captain even if its not them flying the aircraft.

 

[Eufalconimorph]

https://www.reuters.com/article/us-...-tests-for-new-aircraft-sources-idUSKCN1TH0A3

"...Boeing’s Test & Evaluation group is developing the technology to replace costly and labor intensive physical safety tests used for decades - such as using machines to bend the wings to extreme angles and shaking the fuselage until it cracks - with computer modeling..."

I see no way in which this could possibly go wrong.

 

[VEBill]

BBC - Battle over blame

Includes some interesting details, clearly explained.

 

[Alistair_Heaton]

BBC are doing quiet well over reporting the whole thing.


There is huge cultral differences surfacing around the world over the removing thrust issue. I must admit the European thoughts are that it is understandble why they didn't remove the power with the pitch power couple adding to the nose down.

The only other thing I have seen and heard is that the whole use of the trim system is under review on the NG including its use for the STS system.

There is a fundememntal reduncancy issue using the trim stab for anything with its ability to produce outside pilot controllable or recoverable control forces.

Putting through adjustments shall we say through the elevator isn't a problem because if anything goes wrong the trim stab at 32m sqrt V 7m sgrt will easily over power the elevator in both extremes and you have the option of just killing the hydralic power to the elevator. It can also be protected from causing structural damge at high speed using blow back pressure release valves.

The STS on the 800 is okish but is getting huge frowns and why the hell was that let through, but as its linked to the pitot system which has multiple sensors and an extremely mature set of procedures and sensor error catching logic I can't see an issue with it. PLus it hasn't had any issues so far. So I don't think they are going to enforce changes to the 800.

The crux seems to be the window that the pilot has to catch the aircraft before it gets into an unable to manually trim the aircraft hole. Its apparently suprisingly small on the 800 and max due to the gearing of the manual trim system.

And I susepect there will be a new certification rule on the subject and no grandfather bypasses for future new versions for all OEM's.


There has been chat of adding a powered manual trim system but that brings new failure modes as well.

My thoughts are that a hydralic motor driven off the elevator hydralic supply via a PT couple with a backup electrical pump and/or accumulator might be an option. When the electric trim is turned off the hydralic system is powered up and you will have 3000 psi to assist moving the stab. But we shall see.

So realistically the MCAS system and its software fix is pretty much is the least of Boeings problems. They have to solve the whole of the Elevator/trim system design and logic plus failure modes etc etc. I also can't see now the FAA releasing the aircraft for US airspace in September with only a software fix. They will not break ranks now with the other authorities.


They are also having issues with the folding wing tips on the 777 new variant. The failure modes of them and the indications and the control power of a one side has flipped up is getting very closely looked at. PLus a load of stuff that would have got waved through by the FAA pre MAX is getting the full monty oversight.

 

[LittleInch]

STS = Speed Trim System?

But what you're saying is that there is now a push to go right back to basics on use of stabilizer trim vs elevator control??

Wow.

I do get the issue over the pilots both not re-trimming all the way back to where they were before they pulled the cut-outs, but the criticism the poor guys are getting about speed control of an aircraft which was barely climbing and doing something counter intuitive (reduce thrust) would be very difficult to assess in such a stressful condition is, IMHO, excessive.

The fact the Ethiopian crew couldn't physically turn the smaller (than the legacy 737s) manual trim wheel which the Boeing guidelines claim they could is the key issue here and clearly got the regulators worried. They clearly can't re-design the relative sizes of the elevator versus stabilizer so it must be something that they are looking at.



Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[Alistair_Heaton]

It's a can of worms this has opened up.

Quiet where they will wiggle off to I have no clue.

There is lumps of organic fertilizer which were thought to be wrapped up nicely and hidden starting to leak and people are following the smell and finding them.

And while looking for the leaking ones they are finding other ones that haven't leaked yet but explode when you touch them.

 

[waross]

There has been criticism of the pilots training and actions.
According to the BBC, (linked by VE1BLL)

This checklist - which is meant to be memorised by flight crew - instructed them to flip switches on the centre console, to turn off the stabiliser electronics, then balance the aircraft using manual trim wheels beside the pilots’ knees.

The pilots were in an emergency situation and followed the memorized procedures.
Congressman Graves has criticized the pilots for not reducing power.
They had conflicting information and followed the Boeing procedure and it didn't work.
Why didn't the pilots not reduce power?
Why is reducing power not on the memory checklist?
Congressman Graves may have more credibility if he asked this question instead.

Ethiopian Airlines rejects any suggestion that its training standards fall short. Tewolde says the company has invested more than $500,000,000 (£396,000,000) on its Aviation Academy over the past five years

Within the academy, rows of flight simulators sit in two vast hangars. Large, unwieldy-looking boxes on stilts, they sway and swerve as they replicate the movements of giant airliners.

These simulators cost millions of dollars each. The company has one for each of the large airliners in its fleet, including the Boeing 787 Dreamliner, the Airbus A350 – and the 737 Max.

The latter is something of a rarity. There are still relatively few in service, and this is the only one in Africa. It started operating in January

Well, suppose that the pilots had been trained on the State of the Art 737 Max Simulator?
They probably would still have died.
Another gotcha from Boeing,

Yet one thing the simulator cannot yet do is replicate the circumstances of that accident or the previous crash off Indonesia. In late May, Boeing admitted that software provided to simulator operators was flawed, and incapable of reproducing some flight conditions, including the failures experienced by ET302

I understand that older versions of 737 simulators can do a more accurate job of replicating the forces that the pilots experiencedin the 737 max than the 737 Max simulator.
There has been criticism of Boeing bashing.
There are also some Boeing apologists and Boeing boosters who are very active.
Did you know that Boeing has 14,566 employees in Missouri?
Second only to Washington state and ahead of California.
That's a lot of Votes for Congressman Graves.
I think that potential votes may color his comments on the pilot's actions and training.
Engineering by management decree doesn't always work well.

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[3DDave]

The BBC coverage is sensationalist, which makes sense for them. It's also largely inaccurate with just enough truth in there to support the flaws. They imply that MCAS inputs are unstoppable large step inputs and that the pilots need to physically overpower the system rather than move a thumb. MCAS is a problem and it will be fixed, but the 737 Max is not the only plane driven into the ground by badly handled stab trim problems; it is the first to demonstrate the glaring gap in pilot training, but investigating that gap would demonstrate that pilots are a part of the steps to disaster.

ET302 didn't follow the AD. They did some things on the list, just not completely, and finally, they did the one thing the AD said should not be done.

The simulator does not do a good job simulating operations outside the safe operating envelope. Shocking.

I'd give the BBC and other articles some small level of credence if they included the first MCAS-problem flight, the one that landed safely, and then asked, if it was so similar to the others, what was the difference? I'm betting on training and actual trim experience. Oh - since no one called that first crew "Heroes," why claim that only "hero" pilots could save them?

 

[Alistair_Heaton]

I agree with that 3D

But it's always a problem with public media and aviation.

The hero pilot bit gets to the pilots never mind the rest of the team.

"Hero pilot avoids hospital" we don't have a clue where hospitals and schools are. They are not depicted on any charts unless it's your local airport you will only know it's a big building and best avoided if your going to crash.

The pilot training is an issue. But regulators have even taken a step back from that. In my day your initial instrument rating test was done by a caa staff examiner. These days it's done by a self employed examiner who if they fail to many they just don't get used.

Same in the SIM it wasn't uncommon for a quality caa examiner to turn up at the SIM center and spend the day auditing every session. Haven't seen that for years.

Training the pilots....

An hour in the SIM costs 1400 euro ish an hour just for hardware rental for two pilots.

3 crews per aircraft a SIM session is 4 hours. And three sessions would not be unreasonable for difference training

So per aircraft call it 50 000 euros.

There are 4500 of them on order.

So 225 000 000 euro. Just for SIM hire

Not counting hotac, 4 days lost line flying, the cost of the instructor etc etc.

To be honest it would be cheaper to train the engineers to make aircraft that are within the current skill base.

And I have said before you need to design and expect for the reactions of a human that's been flying 4-6 sectors 12 hour day for 6 days starting at 4am for the first two then 2pm for the next two and 10pm for the next.

36 hours off then repeat.

The responce of even a well trained individual varies hugely from day 1 of a block to the last sector. You have to design for that last sector.

Try that schedule yourself for a month then go sit a car driving test and see if you pass.

 

[Alistair_Heaton]

I suppose one solution could be to mandate increased recurrent training on type by say two additional sessions per year at cost of 33 600 euro per aircraft and 4 days lost from flying the line for each pilot.

And reduce the max working hours that can be flown on the type by say 2 hours per day and say down to 800 hours per year instead of 900.

Oh and so we don't have a 10 billion dollar hit to our company again due to foreigners they will have to do an extra test every three years with an external Boeing approved examiner. This will need to be done in a hydraulic powered SIM which is the only type which has enough grunt to simulate the max when it's in crazy Ivan mode, The electrical actuated Sims don't have enough power. Oh there is only two of them and your pilots will have to be able to get a US visa to be able to use them.

That would solve the issue. Pretty much put every Boeing short haul operator out of business within two years.

Save a fortune in booze at airshows everyone would be laughing walking past your enclosure.. muttering they should have opened up the 757 line again and stuck the leaps on that.

 

[3DDave]

Gee, I hope those pilots never encounter weather on their last sector. That would be terrible. From now on I'll ask the gate agent which sector the crew is on and bail if it's the last one.