Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

Satcom guru has done a search for trim events. Its more common than I thought

https://www.satcom.guru/2019/05/737-pitch-trim-incidents.html#more

"It doesn't appear to have any redundancy for the instrumentation side to side"

All commercial aircraft have redundancy side to side via the standby instrument as minimum. When a mismatch occurs the standby instrument is consulted and then the two out of 3 win and things are reconfigured to only use the deemed good side in none FBW aircraft. How the FBW aircraft do it I have no clue.

"Lots of planes use fly by wire controls. So, why does the proper fix have to be a kludge? "

Because that would bust the grandfather certification and if they made them go through a full FBW certification of the flight controls then the max won't be flying for at least 3 years. It has to be a kludge that walks a very fine line between not triggering recertififcation and complying. They are working with both hands tied behind thier backs and one leg with a ball and chain on it.

 

[LittleInch]

Interesting trim events and to note that the earlier 737 had two actuators. and my reading is that the cut out switches on the NG were split manual and FCC, whereas the Max went for primary and standby, or something like that.

Is one option here to revert to that design and make the cut out switches separate for manual and automatic (FCC/MCAS).

Then in the event of runaway from any source other than the manual switches, cut out the input to the trim motor from the FCC, but allow the manual pilot trim buttons to remain and hence address this issue of manual wheel control unable to turn against the aerodynamic forces?

Such a differentiation might have addressed both crashes - certainly the ET one would have allowed the column control forces to even off and then allowed the crew to slow down / recover the aircraft. Maybe.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[Alistair_Heaton]

I agree that it would add in one layer of redundancy.

But I know for a fact that someone will screw it up and turn both off when they shouldn't but.... It will be many times better than it is currently.

But I still think they will have to give power assisted manual trim functionality to get it flying outside the USA. They should be able to do it for less than 100kg/100 nm hit to range.

Personally I think they should do it anyway to create a headline of going beyond what's required before being told to for pax confidence in the type.

 

[LittleInch]

They might need to shift locations of the cut out switches from next to each other alright, but clearly the manual trim function is now exposed as a key area of weakness.

Mind you at the moment it looks like you need to turn the wheel what 10 time to get one degree? 20 times? A hell of a lot when it's down by your knee.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[LionelHutz]

An argument could be made that if the wheel reduced in size then changes to the linkages running back to the jackscrew could also be done to ensure that the same X force on the wheel handle causes the same Y torque at the jack screw. Then, the only difference would be more turns of the wheel to cause the same amount of stabilizer movement.

 

[Alistair_Heaton]

The gearing on it currently is border line useless for large trim changes. It's something like 40 turns for a full mcas actuation of 6 degs. It's the same on he classic. One of our fo's is a pro sailor and grinds on the Volvo series size racing yachts. He can't move it way out of trim or get anywhere near the speed of the electric trim on a classic size trim wheel. And we are talking a 105kg bloke who has been known to climb a Volvo 70 mast and then slide down the back stay while drunk as a bet. And takes part in short tack harbour races grinding for fun.

I can't see easa letting it fly again without the trim being sorted. And the 800 may have a AD issued on it as well.

There are a few other certification issues also been noted one of which I have mentioned, there are 7-8 other issues which are not public yet and to be honest I don't really understand either.

 

[3DDave]

LittleInch - the ET pilots had full control of the stabilizer with the control wheel trim switch and chose not to use it to restore trim of the plane before shutting off the trim motors. They didn't follow the airspeed disagree memory items and did not follow the AD memory items. It is clear that any reliance on pilot competence is foolish.

 

[LittleInch]

3DDave,

Yes I know that and it remains unclear why they did that without the CVR, but panic, pilot overload and multiple issues going off probably had something to do with it. However with a bit of time to figure it out, they clearly tried to correct the trim manually and couldn't so in the end turned the electric trim back on with fatal results.

Having read the AD a number of times, I think they did follow the key components of it and relied on the AD saying that they could always and at any time use the manual trim. Trouble is that part of it wasn't true.

If they had the ability to disconnect the trim commands from the FCC only and not an all or nothing cut out then things may, just may, have been different. The point I was trying to make was that earlier versions of the 737 appeared to allow that, either two actuators or two different cut out switches as far as I can tell. This has been mentioned before and is in a number of other posts and blogs, but below for info.

737 NG cut out switches (main and Autopilot/FCC) separate

737 MAX (primary and backup) - basically two switches in series apparently, either one cuts out the electric trim

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[Alistair_Heaton]

"It is clear that any reliance on pilot competence is foolish. "

100% correct and I have been saying this all along. It doesn't matter where they trained, what colour they are or what nationality they are. There is always the possibility of them screwing it up if you leave a hole in the design which gives them a possibility of screwing it up.

Although to be honest the blog post above with the control input graphs does make alot of sense what might have gone on.

We will have to wait for the report to find out what the CVR is showing.

 

[3DDave]

AH - wait until it comes out what ET management did. The ET pilots went through 3 holes of their own. Lion Air added a fourth and fifth in their maintenance management.

 

[Alistair_Heaton]

I am sure the ET management will be not compliant as well or the maintence. The ET pilots will have screwed up as well. BY how much we will have to wait and see until the CVR is out.

I haven't heard anything about if it was a bird strike or not for a while.

Lion air it will be a utter mirical if its compliant by anything even resembling normal western airline operations. Thats pilot, maint, operations, mangement and QA.


I have said multiple times in these threads its nearly always the third hole which kills. Crews in general can deal with 2 holes the third kills. If you take off with a one hole already filled with say a MEL DC generator you only have two left. Some of us get it, others don't and don't change thier TEM to account for the increased threat level.

But even if its heavily critical of both pilots and management, its not going to change anything about getting the MAX recertified now or how long it takes. Its going to be at least 18 months for the final report coming out. If the MAX isn't flying before that its a dead duck. Well 1330 dead ducks sitting in car parks around the USA.

 

[LionelHutz]

All commercial aircraft have redundancy side to side via the standby instrument as minimum. When a mismatch occurs the standby instrument is consulted and then the two out of 3 win and things are reconfigured to only use the deemed good side in none FBW aircraft.

But there is still no redundancy for the instruments on each side. The instruments on one side won't continue to work correctly if one of their sensors fails.

 

[waross]

A lot will depend on the findings of the regulators.
If the regulators accept the basic design with the engines in the present location, then the question is:
"How do we make MCAS safe, usable and dependable?"
If the regulators rule that the tendency to pitch up at a high AoA is unacceptable then it's a whole new ball game.
BTW, I understand that the flight issues were first discovered in a simulator during a climbing turn, not in straight ahead flight.




Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[LittleInch]

I'm pretty sure it was discovered in large model wind tunnel testing and later confirmed on test flights which is when they discovered the low speed stall issue which needed more angle to work and took out the high G sensor as part of MXAS.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[waross]

Lionel and Alistair.
In regards to the trim wheels and sailing winches.
One solution may be a planetary gear and a safe reliable method of switching to high ratio when needed.
Sure there will be problems, so, try harder.

As for a solution on the Max it wasn't possible under management guidelines which seem to have been.
1. No re-certification.
2. No new training.
3. Don't spent any money.
and
4. Have it ready by Thursday.

Its going to be at least 18 months for the final report coming out. If the MAX isn't flying before that its a dead duck. Well 1330 dead ducks sitting in car parks around the USA.

1330 dead ducks
All those aircraft, at a discount, with the possibility of a future upgrade to Leap engines will be expensive but may still be a better return than the price of scrap aluminum.
We can speculate but there are probably a few executives running the numbers and there may have been a few phone calls in regards to the availability of suitable engines.

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[waross]

LittleIinch:
Thank you for the clarification.

I'm pretty sure it was discovered in large model wind tunnel testing and later confirmed on test flights which is when they discovered the low speed stall issue which needed more angle to work and took out the high G sensor as part of MXAS.

According to my re-read of the article posted by Alistair, The original high speed problem showed up in wind tunnel tests, test flights and in the simulator.
I believe that it was in flight tests 1n 2016 as you indicate that that low speed issues were detected.
But it is probably better to read the article. (Linked below)

Why the insistence on no simulator training?
This may have been one of the reasons for the reluctance to consider simulator training:
(Or 100 Million reasons)

Early in the process of selling the MAX, according to two people familiar with the discussions, Boeing promised to give Southwest Airlines a substantial rebate for every plane if the MAX required simulator training.

One former MAX worker, Rick Ludtke, said the rebate reported to him by managers was $1 million per plane, a figure another Boeing employee indicated is roughly accurate.

Link

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[VEBill]

BBC: Boeing suffers new 737 Max issue that could delay return

Reuters, which first reported the new issue, said during an FAA pilot simulation in which the stall-prevention system was activated, it took longer than expected to recover the aircraft. Other sources said the problem was linked to the aircraft's computing power and whether the processor lacked enough capacity to keep up.

 

[Alistair_Heaton]

"But there is still no redundancy for the instruments on each side. The instruments on one side won't continue to work correctly if one of their sensors fails."


If you mean the instrumentation in the cockpit in front of the pilot there is multiple reducndancy in EFIS systems. I will give you the basic rundown, there is another level above this which the 737 is because it flys in RVSM airspace.

You have the display screens which there are 5 each pilot has there second screen which they can select if the primary fails and the info will be displayed there. If both screens fail on one side which does happen in some electrical failures then the other side is still working.
The next thing which drives the screens there is the symbol generator there are two of these which normal mode has one driving each side. Failure mode either generator can run both sides one switch to either 1 or 2 away from norm will do this. It will display dual and singular data screens
Then supplying data to the symbol generators is the AHARS and Airdata computers plus configuration data . Again two of both, AHARS deals with which way your pointing and which way is up and the airdata with the input from pitot static system., TAT. Again you can select either one to supply data to both symbol generators. So if you have a bad airspeed coming from ADC 1 (captains) you select ADC 2 and primary flight data is displayed on both sides using the data from the FO's sensors. On the Q it changes colour to show that your now in a down graded mode.

And the final redundancy is a separate instrument which is powered off the emergency battery bus and also has its own internal battery backup. Its connected directly to its own pitot static system no computers or data interpretation by anything else. And it is used as the deciding vote when the two primary systems disagree. It also has its own attitude indication.

We can get the aircraft back to base with one side with certain failures. So if we get a failure on a flight we can continue, land defer it with a cat A 6 flights limit and then fly to a maint base or home. We are grounded if the standby instrument has a fault with either airspeed or altitude.

Rvsm airspace is high up stuff where instrument sensitivity reduces due to air density. For flying in that with reduced separation there is another layer of redundancy with more computers etc. Up high the normal separation is 2000ft between aircraft in RVSM its 1000ft separation. There is a failure tree with that as well which ultimately ends up the aircraft has to descend to exit the RVSM airspace to below FL295. Instrumentation is only one part of required equipment for RVSM airspace.


The stall protection system is a separate system entirely with multiple boxes, it will have data going into the symbol generator for low speed cues etc. For my aircraft type if the AoA sensor fails on one side it will effect the low speed cue on the airspeed indicator and may trigger the stick shaker. There is a button directly infront of the pilot which flashes when the stick shaker triggers, if you hit that it turns it off. It will reset after 5 seconds of not receiving a trigger.

Now please note this is how it works with a Honeywell efis system in general terms. Each aircraft will have many more data flows. BUt the above is pretty standard for airspeed and altitude. Its certainly not the case that a pitot gets blocked on one side or one computer fails and your left with zero redundancy or only one pilot seeing correct data. There is two/three levels of redunancy across the main 5 primary screens and the third/fourth level is the standby instrument. And for info as a captain I have to land the plane at least once every three years in the sim just using the standby instrment and emergency mode instrumentation. I have only ever done it single engine. I believe if you screw it up the first time single engine they will let you do it again with both engines working as the single engine is not a requirement just you have to do one. I have always done it on the first attempt with one engine down as is the case with most Captains. To be honest its not that much harder than a "normal" single engine approach which we do at least 3 of every 6 months.

On old school analogue instruments which we call steam instruments which are the classic 6 you are correct there is no way of transferring the pipes between sides. But your talking over 40 year old aircraft now and there are not many of them flying commercial air transport in first world . And none of them can fly in RVSM airspace which means they are pretty much limited to flying in third world airspace or below FL295 which makes them uneconomic due fuel burn.


Expect a series of announcements about various systems being none compliant. Basically wait until something positive comes out and a couple of days later then next item will be released. The problem with the Stall system is linked I expect to the AP not kicking out when the stick shaker goes off while other things are happening. If its just pitch up due to incorrect autopilot settings, stick shaker will trigger and the AP comes out. If there are other things running it doesn't kick the AP out and will continue pitching into a fully developed stall with wing drop. There is no stick push system on the MAX. I am pretty sure someone else would have spotted it as well but the response to my email to one of the EASA tech pilots on the subject was "that's another one for the list" so you never know this discussion might have had a direct input into things. BTW I don't expect a reply from the tech pilots about what's going on so I am not receiving anything that's not public. And even if I did I wouldn't talk or even hint about it.

 

[Alistair_Heaton]

Latest issue...

Apparently the electrical trim switches are not directly connected to the screw jack.

And a processor (FCC) in the mix takes the input from the thumb switches then commands the screw jack....

This processor is getting overloaded and not passing the command to the screwjack which may account for the crew not using/being able to use the electric trim in a MCAS event.

So the AP staying connected with the stick shaker running is still to surface.

 

[RVAmeche]

Is this a result of the new software patch or did they just realize this processor was always being overloaded?