Boeing 737 Max8 Aircraft Crashes and Investigations [Part 6] 17

[Sparweb]

This post is the continuation from this series of previous threads:

thread815-445840
thread815-450258
thread815-452000
thread815-454283
thread815-457125

This topic is broken into multiple threads due to the length to be scrolled, and images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

Some key references:
Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

A Boeing 737 Technical Site

Washington Post: When Will Boeing 737 Max Fly Again and More Questions

BBC: Boeing to temporarily halt 737 Max production in January

 

[Alistair_Heaton]

They won't be offered anything.

Its up to Boeing to prove to the regulators that the aircraft is compliant.

They have basically spent the first 9 months trying to bluff and use lawyer talk to get the aircraft flying again. There was also a huge media push to blame the pilots. Which failed miserably I might add globally, but seemed to have an effect in the USA. But as the FAA is seen globally to have failed to do its job its had zero effect.

I think in Nov when there usual power point presentation failed to pass the documentation "check" with basically the regulators walking out. They realised it wasn't going to work.

They then tried putting pressure on about shutting down production, the bluff was called and its now shutdown.

In that period between Nov and now quiet a few of the "faces" have either been removed or have left themselves.

But that's only one side of it, to do with the actual aircraft in question.

The flip side is that the regulators have discovered huge issues amongst themselves. Basically over the last 20 years they have been moving towards a global system of trust so that multiple certification processes don't have to be run. That's been blown out the water.

Also its been noted that the regulations are not fit for use with modern aircraft systems and also the current pilot demographics and training standards. The 737 MAX is a bit of a frankfurter mish mash of standards anyway due to it organically growing from a 1960's design. The 737 was one of the first commercial aircraft without an Engineering station in the cockpit.

Training, information flow, acceptable information load, what can be grandfathered are now for the regulators to sort out before the next batch of new types are started.

Boeings mantra has always been the pilot flies the plane, Airbuses mantra is the pilot manages the system. Like it or not modern aircraft are a load of complex interconnected systems inside an aluminium tube. As soon as you get to the point those systems have a primary input into the aircraft controls you have to manage the complete package because the pilot can't just fly the plane and then work out what is going on. The biggest issue is working out what to turn off to be able to just fly it without fighting with a system.

The current regulation and assumption is the pilot should only need 3 seconds to diagnose the problem and kill the rouge system. That has been proved multiple times as being completely unrealistic. Boeings problem is that a lot of its certification assumptions are that the pilot will respond inside 3 seconds and will stop the failure becoming catastrophic. Therefore the failure and system is deemed acceptable.

After putting more than a few normal pilots through the sim using the current Boeing procedures it was found that over 50% failed to get the correct emergency checklist for the fault. So the whole emergency checklist and operating procedures and training also need to be sorted. Which for the 737 is colossal. Modern new design aircraft have a thing called ECAM which leads you through the checklists, priorities the fault and most importantly remembers the series of failures progressing. So if it starts with a bus fail and as things progresses it ends up with half the electrical system showing a fault as services drop out the ECAM will show the checklist of BUS fail. One switch change to kill a generator or tie a bus bar and everything goes out apart from the guilty system.

MAx could have had a ECAM system same as the 777 but didn't get it due to grandfather certification and costs and time getting it certified and this huge issue for them it would trigger training requirements. So the MAX has a paper book which is about 5 cm thick and you have to find the thing first of all, then work out what your issue is, then find the page and run the checklist... all in 3 seconds. If you get the wrong drill then you can end up making matters worse. For the above electrical failure it is not unknown for people to shut down engines because they haven't spotted the bus fail was the first lamp to light up. Boeings line is that shutting down an engine by mistake is not a catastrophic failure and nobody will die IF the pilots then go onto fly the aircraft properly single engine. So no need to have an ECAM system fitted.

So you have a system which diagnoses the issue and takes you the correct checklist. It is displayed in the middle of the cockpit so its possible for both pilots to see it at the same time. It is impossible to drop it or not find the book in roller coaster conditions. It even automatically checks items when it senses they are done. If they are done already it won't mention them. If things change away from what's required after the checklist is complete it then flags they are incorrect. MAX pilots will still have a 5cm thick paper book behind the FO's seat when it starts flying again.


BTW the QRH paper book is 5cm thick on the MAX....new aircraft

On the Q400 its 2.5cm thick 15 year old aircraft

1cm thick on the Jetstream 31/32 35 year old aircraft.

A220/CS no book and 1 memory item new aircraft with zero grandfather systems.


Its a mess which has been developing for the last 20 years or so. The Boeing MAX is just the trigger for things having to change.

 

[LittleInch]

waross,

without going too far off track, but the incident referred to in amsterdam was actually that initially the auto throttle did exactly what was expected ( went to idle) because they were trying to pick up the glide slope having got a late call to land.

The issue was that after 70 seconds when the throttles should then have kicked in to maintain speed they didn't and hence this was what the report ( which is a long but very good read from the link by AH) says was an unexpected error or basically something didn't happen which should have. These are difficult to pick up when they are normally so reliable. The fact that that system worked differently to all the other systems in its reliance on the left hand R/A wasn't in any manual or any training and it is very difficult to blame the flight crew I think.

The other big issue was that the Radio altimeter wasn't strictly failed, but just giving the wrong data. Hence it was outputting a signal / number / altitude, but just the wrong one. One consequence was that there was a near constant alarm going on about needing to lower the undercarriage which didn't make sense to anyone when they were at or above 2,000ft above the ground.

but yes there has been an insidious creep of automation and control into the Boeing family of planes which means that they have become semi FBW planes without all the required back ups and three seconds to sort something out is not feasible.

In reality how the 737 NG has been so reliable seems to be pure luck / pilot skill.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[waross]

Thanks LittleInch.
Maybe faulty rather than failed.
As far as doing what it should, I once had to trouble shoot a machine that automatically set sizes. If it approached the target from the right it was accurate. If it approached the target size from the left there was an unacceptable 3/4 inch error.
I wouldn't accept the premise that it was doing exactly what it was supposed to, until....
The pilots thought that they were on one system when they were on the other. By reducing power at the proper time, the problem was masked and there was no indication that they were on the faulty sensor until it was too late.
The main point is the similarities in process. lack of training and the direction that Boeing's culture was developing.
While the system reduced power as it should have, by doing so it masked a serious issue.
Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[Alistair_Heaton]

They are a pain in the arse to be honest, with the old school ones which the NG and the MAX will have due grandfathering. But like all these things thier role has morphed over time from just a height indication above ground to being linked to 4-5 safety systems and 2-3 flight control systems on Jets.

They have twin transmitter and receiver under the aircraft. Two pods with a Tx and RX in each for the two channels . The old school units the pod was hollow made out of fibreglass and a cable came through the pressure hull and the connection made inside the pod. The pods were then sealed onto the aircraft with basically bathroom silicone and bolts to hold them on. The fibreglass used to crack and then wick water into it which would then screw with the measurements. The sealant used to go and then a pool of water would form in the bottom of the pod and also corrode the connections. The water used to freeze thaw during flight cycles which just made matters worse.

Modern units have the same fore and aft configuration but the cable goes through the pressure hull and the connector is internal. The whole lot is embedded in resin and there is an outside cover of Kevlar mat which is a 10 min job to replace. When they replace the cover they cook them to dry them out and then reseal them and then paint them again with special paint unless the matrix has been destroyed through getting a stone on it.

The Jetstream it used to regularly appear in the techlog and deferred item list with the old school ones, monthly. In the last 4 years on the Q400 I haven't seen a single mention of rad alt failure and don't have a clue if they are old school or new they just work and never seem to give any trouble. But the Q400 is cat II approved and dual FD approach certified and maintained which may include additional checks and maintenance on that system, as pilot I don't need to know.

The issue per say isn't that it failed and caused a crash. Its the fact that Boeing managed to influence the resulting Accident report to adjust the primary cause of the accident and remove the focus away from the technical and HP issues with the design. And then to add insult to injury they seem to have repeated the same mistake with the MAX on another critical system which has input on a primary flight control.

 

[waross]

The issue per say isn't that it failed and caused a crash. Its the fact that Boeing managed to influence the resulting Accident report to adjust the primary cause of the accident and remove the focus away from the technical and HP issues with the design. And then to add insult to injury they seem to have repeated the same mistake with the MAX on another critical system which has input on a primary flight control.

That is the point of my last post but you have said it much better than i could.
Thank you.

Bill
--------------------
"Why not the best?"
Jimmy Carter

 

[Tomfh]

In reality how the 737 NG has been so reliable seems to be pure luck / pilot skill.

I think that’s an aspect of engineering in general. There are lots of holes, but the holes have to line up for people to die.

Admittedly there are usually more layers of cheese, and people generally fix the gaping holes, rather than assume the pilot layer will catch anything that falls thru...

 

[Alistair_Heaton]

It wasn't me that said it but...

I think what it is, is that Boeing is very good at metal structures. It knows what its doing with hydraulics and good old fashioned relays. And knows its materials (I am not so sure with its composites).

If you going to go off road in an aircraft or the gear collapse Boeing has a superb safety record of sacrificing the airframe and protecting the occupants.

Its just years behind the other OEM's with digital systems. And its not helped by the fact that since the merger it has only pushed stretched model upgrades. Models which if you showed the original designers the current models they would have to sit down with a cold sweat.

These systems which are shoe horned in are removing layers of cheese compared to older versions just to get them to work. So you have far less to line up for a fatal accident.

NG has a disconnect on the yoke so when the pilot pulls back at over xxlbs of force it cuts out the systems input to the stab.
NG has twin cut out switches, one cuts the AP/system input and the other one cuts the electrical trim.

So there you have it, NG the third failure layer is the pilot. And if the max had those options I suspect both crews would have saved the day. One of them would have functioned/been used and the MCAS would have been removed from the equation.



I don't think it is luck with the NG, its just a way better system design. So more layers of cheese.

 

[VEBill]

"[Boeing is] ...years behind the other OEMs with digital systems."

Over the decades, there's been a pattern of Airbus FBW incidents where the pilots didn't intend that the aircraft would strike the ground, but the aircraft rather insisted. A common thread is that the aircraft was in perfect mechanical condition in the millisecond before impact (some with clogged pitot tubes).

During those same decades, the typical Boeing incident often involved something breaking at the outset. A fairly common thread was that the aircraft was mechanically damaged at the beginning of the incident (sometimes faulty repairs).

These historical common threads have largely evaporated over the past decade.

Now we're seeing Boeing giving the automation more authority (e.g. MCAS). I hope that we're not entering an era of mechanically fit Boeing aircraft that occasionally insist on striking the ground.

Lesson to be learned: automation requires more training, not less.

 

[Alistair_Heaton]

I can't remember any, where the airbus aircraft took them into the ground through computer inputs to the flight surfaces. Last one was when it went into the forest believing it was landing and not spooling up because the pilot hadn't pressed TOGA to get it into climb mode.

If your meaning the AF447 where after an airspeed issue the crew pulled back on the controls all the way to the ground in a stall not following the procedures. I might added that we stopped teaching pull the stick back in a stall in world war 1. If you do that with any aircraft you will die.

 

[zeusfaber]

Alistair, I suspect VEBill is thinking back to F-GFKC (where the systems protected the airframe from overload at the expense of failing to clear an obstacle).

A.

 

[Alistair_Heaton]

That's the not spooling up after the pilot did a stupid and illegal low pass and got down to 10ft on idle power on a runway that wasn't long enough for it to land on. All 40 ton+ jets at flight idle will touch the ground from 10ft if you do a go-around a 28500kg dash will never mind a jet. They were at alpha floor anyway because of doing the low slow fly pass if they had been allowed to lift the nose back anymore they would have hit the ground harder in a full stall.

It didn't let them over load the airframe and put them into a stall. They didn't have any energy to climb because the engines were spooling up from idle which takes 5-6 seconds.... They were going to hit the ground what ever happened.

Here is the accident report.

https://reports.aviation-safety.net/1988/19880626-0_A320_F-GFKC.pdf

 

[thebard3]

Lesson to be learned: automation requires more training, not less.

Right. Operators (pilots in this case) have to know how things work in order to make it work properly, and also to be able to figure out why things aren't working. Some operators have more aptitude and therefore better understanding than others do. Training needs to clearly identify thresholds of necessary understanding and be able to detect when an operator just doesn't quite get it right. I know nothing about pilot training, but in my experience this exists across all markets and technologies.

Brad Waybright

It's all okay as long as it's okay.

 

[Lou Scannon]

I know nothing about pilot training, but in my experience this exists across all markets and technologies.

Cases in point, the Uber and Tesla robotic driving accidents.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

 

[VEBill]

China Airlines Flight 140 is an example where the A300 crash was attributed to pilot error, but there was a related software update that hadn't yet been installed.

I've explained the common thread above: that the Airbus was in perfect mechanical condition in the millisecond before impact. There are many such examples.

Attribution of these sorts of incidents to pilot error, especially where the pilots are experienced, rather supports my point.

 

[Alistair_Heaton]

A300 is not fly by wire. It has no flight envelope protections.

Its old school, the current Airbus FBW system with all the envelope protections was sort of fitted to a few of them towards the end but it didn't come in until the A320 in 1984.

Quick google and it turns out that they hit toga by accident probably because the Captain had been flying 747 before and the AP didn't disconnect properly which there was a fix for already released but CA hadn't performed it yet. Funny actually because we spotted the same issue in these threads with the MAX and it got flagged to EASA and Boeing are having to fix it. If it wasn't for the two crashes they more than likely would have spotted it and also put the fix through the same way.

Every single aircraft type in operation today has had a pilot take them into the ground when the aircraft is fully serviceable through not following SOP's or loosing situational awareness.

Here is a A300 cockpit.

Colgan Air Flight 3407 is an example from my own type the Q400. They stalled the aircraft and the Captain decided to pull back even more. Through the stick shaker, then through the stick push which requires over 45lbs pull (which I have never had to do in training I might add) and everyone died. US airline, US crew, US trained. There is a technique for the situation of elevator stall which is not mentioned in the Q400 manuals which does mean you have to pull back on the stick but while your doing that you put the flap back to where you have just moved it from. I got taught it by an old BAe Chief test pilot for the Jetstream 41. Never heard it mentioned before and never heard it mentioned since so I doubt that crew even knew about it.

Some say it was a fault in the aircraft design that the tail fell off the A300 AA585 after the first officer did a good impression of doing "river dance" on the rudder pedals after a wake vortex encounter. Lots of noise after that one as well until they worked out that it had actually failed at 2.75 of the design load which had a safety factor of 1.5 applied to it. But AB had used a composite rudder and everyone said it only broke off because of that. After a few weeks they decided that it was the US technique of lifting the wing with rudder that was being taught
to recover from flight upsets that was at fault. A couple of weeks after that Boeing changed all its type manuals to state cyclic inputs of rudder, elevator and ailerons would result in structural failure at under rough airspeed/Vma. Scary thing is there are still flight schools teaching lift the wing with the rudder.

It sort of supports your point but every type has had the same issues with pilots. Its not unique to a particular make or type, country of operation, country that the pilots trained in, if they have lumpy jumpers or not, sexual preference or skin colour.

 

[moon161]

Colgan Air Flight 3407 is an example from my own type the Q400. They stalled the aircraft and the Captain decided to pull back even more. Through the stick shaker, then through the stick push which requires over 45lbs pull (which I have never had to do in training I might add) and everyone died. US airline, US crew, US trained. There is a technique for the situation of elevator stall which is not mentioned in the Q400 manuals which does mean you have to pull back on the stick but while your doing that you put the flap back to where you have just moved it from. I got taught it by an old BAe Chief test pilot for the Jetstream 41. Never heard it mentioned before and never heard it mentioned since so I doubt that crew even knew about it.

That crash happened about 7 or 8 miles from my house, I live under the SW approach to BUF and the crash was on the NW approach.

Following the clearance for final approach, landing gear and flaps (5 degrees) were extended. The flight data recorder (FDR) indicated the airspeed had slowed to 145 knots (269 km/h).[3] The captain then called for the flaps to be increased to 15 degrees. The airspeed continued to slow to 135 knots (250 km/h). Six seconds later, the aircraft's stick shaker activated, warning of an impending stall as the speed continued to slow to 131 knots (243 km/h). The captain responded by abruptly pulling back on the control column, followed by increasing thrust to 75% power, instead of lowering the nose and applying full power, which was the proper stall recovery technique. That improper action pitched the nose up even further, increasing both the g-load and the stall speed. The stick pusher activated ("The Q400 stick pusher applies an airplane-nose-down control column input to decrease the wing angle-of-attack [AOA] after an aerodynamic stall"),[3] but the captain overrode the stick pusher and continued pulling back on the control column. The first officer retracted the flaps without consulting the captain, making recovery even more difficult.[23]

There was a lot in the local news about pilot fatigue and health because the FO had a bad cold and lived in washington state and took a flight across the lower 48 to nap in the crew lounge in new jersey for a bit before taking off as a co-pilot. The pilot had a bad training record and was chatting up the FO on approach and IIRC mentioned the SAAB 340 or some plane where the stall procedure was supposed to be pull the yoke instead of pushing it. The american fear of doctors and sick days probably figured into the FO's decision to fly sick.

 

[Alistair_Heaton]

There is no aircraft that stall recovers by pulling back on the stick. Power is a bonus but even gliders can recover from a stall.

Please though we are in an Engineering forum, don't use the term Stall speed it is meaningless. The only thing that stalls an aircraft is critical angle of attack exceedance. I can take you up and be doing 0 knots and not be stalled and I can also have you in the stall at Vne in an acrobatic aircraft. You will more than likely throw up somewhere in between the two events though.

And its not the doctors that make US FO's fly. The whole payment system even up to Delta, AA mainstream crews is done by the flying hour. Hence the union taking legal action for damages to earnings in the US on Boeing. It also carries safety aspects because as a captain if you ground the aircraft then you loose pay because the flying hours are not completed. They don't get paid for days off, days on standby or for training.

US regionals are full of pilots with bad training records. It the same in Europe as well but decreasing because the regionals are all going due to loco's. That doesn't mean the pilots are not flying. They just go and fly in Asia and Africa etc. You ask why are the regionals still flying these pilots? because basically they would shut down through lack of crew if they didn't. All the good crew move up the ladder ASAP.

You might ask why I am still flying a crappy regional Q400. Because my roster and disposable income is better than my mate who flies A320 for Easyjet based out of Gatwick. I really don't care what I fly its all about quality of life these days. And his Terms and conditions are far better than working for British Airways.

 

[LionelHutz]

You can go edit the Wiki article if you don't like the quote.

Still, my understanding is that AOA, speed and lift all work together, which means there certainly will be a stall speed for each particular AOA in an aircraft in its current configuration. Operating right at the critical AOA means the highest lift or lowest stall speed, or more simply the ability to keep successfully flying at the slowest speed. However, while flying at critical AOA and the lowest possible speed, any increase or decrease to AOA will reduce lift and the plane will drop. In other words, a change to the AOA away from critical requires more speed to not stall, which is what I believe the Wiki quote was describing.

Even if the pilot had decreased AOA, the plane would still drop until enough speed was reached that enough lift was produced to keep the plane flying.

 

[Alistair_Heaton]

Stall is when the airflow separates for the aerofoil.

When this happens Cd increases significantly and Cl decreases significantly.

There is only one critical angle of attack for each aerofoil. It doesn't vary with weight, or speed, gear down or up. It does though vary with flap setting because that changes the shape of the aerofoil.

You think we always fly with the ground directly under us? Airframe reference coordinate system for lift and drag is completely different to ground coordinate system references. We can climb quite happily at 3o degrees nose up to the ground system but in reality we are only climbing at 10 deg AoA to the aircraft coordinate system.

 

[hpaircraft]

...my understanding is that AOA, speed and lift all work together, which means there certainly will be a stall speed for each particular AOA in an aircraft in its current configuration...

Alistair is correct that stall is primarily linked to AOA, and only secondarily to speed (excepting transonic effects). Exceed the critical angle of attack, and the air unsticks from the upper surface and the wing stalls. Reduce the angle of attack and the air reattaches.

The thing often referred to as "stall speed" is the speed at which the angle of attack required to produce enough lift to maintain 1g level flight at some load condition (usually maximum gross weight) is that at which the wing stalls. Any slower, and you can't support 1g flight because you can no longer increase the angle of attack. Your only choices are to either speed up or reduce the lift required by allowing the aircraft to accelerate downward (sub-1g flight).

If you know a few things about the airplane in question you can easily use the pV^2 family of expressions to find the stall speed associated with every condition of lift and load factor (vertical acceleration). But it's a pretty pointless exercise; if you want to know if the wing is stalled it's easiest to just look at angle of attack: Below critical, not stalled. Above critical, stalled.

His assertion that he can have an unstalled wing at 0 kts airspeed is easily demonstrated: In 0g flight the wing produces no lift and is essentially at 0 AOA, so the air happily sticks to wing and flows over it just fine. Or would if it were moving, like at a half knot or so. This is the condition encountered in a parabola or its subset the vertical climb.

His assertion that he can have a stalled wing at Vne (never exceed speed) is perhaps true, but demands a very robust aerobatic airplane, as he suggests. By inspection of most airplane V-N diagrams, we see that Vne is well above the speed at which the critical angle of attack produces so much lift that it overstresses the airframe. However, there are exceptions, and I think the Boeing Stearman Model 75 trainer might be one of them. Make sure he uses one of those to demonstrate. And bring a neck brace.

--Bob K.