Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

Could the fault have been a failed relay? Either wire chaff or welding causing on or off either continuously or "sparking". A conflicting trigger of flaps down would put a spanner in the works and force the nose down.

The failing of relays seems to be a common fault on the three aircraft types I have flown.

 

[IRstuff]

Whatever the fault was, it was expected that the pilot could recover from the fault by switching the electric trim off.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[Alistair_Heaton]

Thing is those cut out switches don't actually kill the power to the jackscrew only the Stab trim cont CB can do that.

The variations on faults is collosal.

You have to either make the trim stab to be able to be manually used over the full flight envelope plus over speed buffer or you have to go through everything that can control the thing and make them fail safe. If you want the pilot to be the backup system.


BTW I can't see it flying again by January in the USA. And I am 50/50 if it will be flying outside the USA for next summer season.

I susepct it would be quicker and easier to just sort the manual trim system out so the pilots can use it without having to meet responce times. Then they don't have to fault test every input to the screwjack.

 

[BurrowX]

Boeing's 737 Max Software Outsourced to $9-an-Hour Engineers

https://www.bloomberg.com/news/arti...ax-software-outsourced-to-9-an-hour-engineers

Seems like another example of putting profit over people. I know a lot of firms outsource these types of jobs but I didn't know Boeing would too.

Laron B.
Results. Not Recommendations
BurrowX
Sr. Chemical Engineer

 

[waross]

Computer overload, a real world example.
When the 8080 chip arrived on the scene there was an attempt to use it to control a lumber sorter.
As each board arrived at the sorter and was placed on the J hooks it was measured and the information fed to the computer.
The J hooks carried the boards over the sort bins and as each board passed over the correct bin, it would be slid off the J hooks and drop into the bin. When a bin had enough boards to make a standard package, boards of that size would be diverted to the next empty bin.
The momentary inputs would be buffered and acted upon in turn.
The boards would be arriving at a rate of possibly three a second.
With only 8 data bits available, there was a lot of thrashing to memory to handle the information and to make comparisons.
The computer at times could not keep up with the lumber flow and would start missing boards.
Computer control of lumber sorters had to wait until faster chips with more than 8 data bits were available.
One example of the type of thing that may overload a processor.

In an aircraft, processing an input and providing an appropriate output will be rapid.
Then add in error checking, comparisons with other inputs (redundant AoA indicators), a validity check based on rate of change of the signal etc. and the processing time will be multiplied many times over, possible by an order of magnitude or more. (base 10)



Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[davefitz]

As the article linked in BurrowX post indicates, the timeperiod that covers the design of the Max coincides with Boeing laying off many experienced engineers and programmers and relocating design teams to other states (using lower paid inexperienced programmers and engineers), to reduce overhead costs. Some programming work was outsourced to contractors at salaries as low as $9 usd/hr, and apparently there was a loss of communication efficiency between programmers and designers.

"...when logic, and proportion, have fallen, sloppy dead..." Grace Slick

 

[VEBill]

Actually coding the software should be perhaps one percent of the total software related effort. If even that.

The entire DO-178 development process (in hindsight DAL A or B?), with all the detailed specification, formally defining every little detail, traceability (DOORS database) from requirement to test data, testing including bench ATE to assist qualification testing, endless documentation for everything, certification process, flight testing, etc., etc., etc., easily dominates the budget and schedule.

A change taking only an hour of coding might need several people for months to follow the process.

Do the $9/hr coders know how to work within this sort of process? If they don't, then it'd be vastly cheap to hire $90/hr coders that do.

 

[waross]

Those wide nacelles placed so far ahead of its wings have increased the 737's forward horizontal keel area, reducing pitch stability when the flaps are retracted. (Obviously when flaps are extended aft of the wing they restore the balance, so there is no problem.) Worse, those big nacelles actually produce positive lift at high angles of attack. And of course at high powers, as with all podded engines, they produce a significant pitch-up. These things are all cumulative.

This may have been predicted in Boeing's computer simulations and wind tunnel analysis, but it certainly showed up during test flying, when they found that, approaching an accelerated (turning) clean stall, the rearward stick force required no longer continued to increase with speed reduction, but reduced.

Once the bank had been applied and a steep turn started, it was necessary to push forward on the yoke to prevent the turn tightening and the G-force increasing, after which the aeroplane would then pitch up into the stall unless the pilots input a lot of forward control column movement. These characteristics are clearly not acceptable in a civil airliner, although both Spitfires and P-51 Mustangs plus several types of homebuilt kits exhibit them.

Link
Now suppose that MCAS becomes inoperative.
Possibly it has become seized and is no longer free to move. It is reporting that all is good when all is not good.
Possibly there has been instrument disagreements and some or all systems have been turned off.
The pilots do not know which instruments that they can trust.
This is setting the stage for the next accident.
A stall or maybe a back flip like a racing boat that gets too much air under the bow.
MCAS is not addressing the problem, it is covering up the symptoms of the problem.
Should MCAS become inoperative, the original problem is back.


Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[IRstuff]

If you read the Bloomberg article completely, neither Indian company cited was involved in flight controls.

https://www.bloomberg.com/news/articles/2019-06-28/boeing-s-737-max-software-outsourced-to-9-an-hour-engineers[/URL]]Based on resumes posted on social media, HCL engineers helped develop and test the Max’s flight-display software, while employees from another Indian company, Cyient Ltd., handled software for flight-test equipment.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[Alistair_Heaton]

It won't back flip as you call it unless it's loaded outside the c of g envelope towards the rear.

Which is only usually an issue in frieght operations if the cargo moves due to failure to secure it properly. If you go into negative stability it's impossible to stay in control. You will survive maybe 5-10seconds before it gets away from you. I have done it once in the SIM. It's not something which is trained or even discussed in training. We had finished early with 30 mins to spare and my partner asked the examiner about it. So he set it up. I have been religious ever since checking strapped down frieght which has the space to move. Although I suspect the SIM was making it up as it went along because there is no way you can physically flight test it. Anyway it was scary enough not to be lazy about the risk.

The usage of unstable is a bit confusing. The plane is dynamically and statically stable. If it wasn't I don't think public transport aircraft can be certified but I will defer to those that know. But I am 99% sure the max will be because the jump to unstable and requiring constant computer input to remain in control would be an atomic bomb to grandfather certification. I am pretty sure the fbw aircraft are as well because they all have a fall back direct law control.

Through 99% of the normal operation envelope there is absolutely nothing wrong with the max. In fact the guys I know that have flown it say it's nicer to fly than the Ng because the overall control forces are lower in pitch and roll. Roll especially is nice. They have a system on that which uses the spoilers to argument roll. Which means it's finger tip flying instead of a good grip and a peks work out.

The situations where it becomes unstuck is flight upset, go arounds with pilot screw up, wind shear micro burst recovery and terrain avoidance manovers. In some ways failures of sensors etc are about as common as having to deal with one of the above. In the last 3 years and 2500 flights I haven't been required to do any of them. 3 go arounds but without pilot screw up. In that three years I have had 1 Ahars failure, one pitot heater ice protection fail and a symbol generator fail And feel unit go wierd. So realistically from my experience they would be better just getting rid of mcas because faults are more likely to trigger it than the situation that it's meant to help with.

But I am pretty sure that's not an option.

 

[VEBill]

Flight-display software may require DO-178 with a higher DAL.

But I agree that this "$9/hr" topic is presumably not directly related to the MCAS issue.

 

[waross]

Thank you for your patience and kind reply, Alistair.
It would be nice to be able to talk to the author of the article as to what exactly he meant and just how severe the problem is.

it was necessary to push forward on the yoke to prevent the turn tightening and the G-force increasing, after which the aeroplane would then pitch up into the stall unless the pilots input a lot of forward control column movement.

I have the impression that Boeing tried to fix this problem with no success and then went to plan B.
If you can't fix it, try to cover it up.
As I understand it, at high AoA the engines act as a control surface and add to the action of the stabilizers.
Once those engines start to catch enough air to make a difference, the worse it gets, the worse it gets.

If you go into negative stability it's impossible to stay in control. You will survive maybe 5-10seconds before it gets away from you.

I'm not trying to put you on the spot by quoting you.
I'm respectfully asking for your comments.
Another point for comment.
We have talked quite a lot about instrument disagreement.
How about "Seat of the pants" disagreement?
When the plane enters the unstable flight mode, I understand that the G forces on the seat of your pants tell you to back off, while the reducing pressure from the stick may be telling you that you can increase the AoA.
What is that like in the pilots seat?
A hypothetical failure mode.
A late flight, end of the last flight before days off.
For whatever reason MCAS has been disabled.
There may be instrument disagreements that are related to the failure of MCAS.
Bad weather and the pilots make a go around.
They make a climbing turn and get into the unstable condition.
And another one bites the dust.
The focus has been entirely on what happens when MCAS over reacts.
MCAS not acting at all is another serious failure mode.
Thank you again for your patience.



Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[Alistair_Heaton]

As an instrument pilot you veryquickly learn that your bum gives no details to your actual flight profile.

It's a huge section of human performance about the limitations of the human sensory system and what we do with it in aircraft. Basically you can only trust the instruments. Google the leans and that should get you started.

As for the stability stuff Google spiral dive. Stability is to do with returning to a fixed profile. The ossillations have to decrease after an input is injected. They test it by belting the control colum with a hammer. So if you belt the front face and the nose dips then raises again trading kenetic for potential and repeat and the amplitude deceasss with time thats positive stability. If the amplitude increases that negative stability.


If your aircraft is stable given enough hieght it will always return to the same trim speed. If it's unstable it will never do.

 

[Alistair_Heaton]

With your eyes shut I can have you drinking a glass of water upside down thinking your in a gentle turn.


I can also have you straight and level with absolutely nothing required but you are sure we are heading to the moon turning to one side. And need immediate forward stick and roll not to die.

It's all to do with the fluid in your inner ear and it's momentum. Once you don't have a horizon to look at you have no clue, g is subject to the attitude of the aircrsft. Just because it's positive doesn't mean the ground is below your bum.

 

[Alistair_Heaton]

After a couple of days research including technicians that are licensed to work on the max.

It appears that the FDR does not record pilot input to trim via the thumb switches.

It only records input to screw jack controller.

So if the pilots are using the thumb switches and something in-between the thumb switch and screw jack controller does not action said pilot input there is no way of knowing if the pilot had there thumb on the switches for the whole time or never.

Which further adds to the mess because this completely contravenes the Annex 6 requirements.

 

[moon161]

^ That really calls into question a lot of that questionable manual trim input, like stopping at level and not continuing to nose up, doesn't it?

 

[VEBill]

"...FDR does not record pilot input to trim via the thumb switches."

The Preliminary Report for ET302, in Appendix 1 'ET302 Preliminary FDR Data' (page 26 of 33) shows a purple trace marked "Trim Up-Man" and "Trim Down-Man".

The near rectangular shape of the waveform and surrounding context seems to imply it's the thumb switches.

But perhaps I'm misinterpreting it; so clarification always welcome.

Extract:

Edit to add: Perhaps the Manual Trim data is derived from the other data. i.e. Jack Screw actuated and not Automatically, so it must be a Manual command. Pure Speculation Alert on this.

 

[VEBill]

Other side of the same chart confirms it's:
"Manual (Electric) Trim Command".

Extract:

 

[RVAmeche]

Is it possible the manual (electric) trim command lines we see are just the processed outputs?

 

[VEBill]

Yes, that's possible. My edit above offered such a scenario.

"Perhaps the Manual Trim data is derived from the other data. i.e. Jack Screw actuated and not Automatically, so it must be a Manual command. Pure Speculation Alert on this."

If the system designers were running out of FDR input pins, they might quite reasonably decide to prioritize the Jack Screw over the Thumb Switches.

Obviously actual facts will take precedence over such speculation.