The General Aviation Thread

[Fishbreath]

Two things: the Ethiopian aviation authority’s preliminary accident report, and an article on trim forces and recovering from mis-trim situations.

http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-800MAX+%2C(ET-AVJ).pdf

Trim Cutout with Severe Out-of-Trim Stabilizer can be difficult to recover

[Mark_Weston]

Boeing are now doing a kind of road-show where they’re showing off their new MCAS fix to pilots and world aviation regulators.

On the one hand, it seems like a sensible comprehensive multi-layered fix for the problems MCAS has caused.

On the other hand, it turns out this software only fix can compare angle-of-attack data coming into the left- and right-side Flight Control Computers and disable the MCAS system if there is any discrepancy between them. And display a warning to the pilots that this has happened.

In other words, this basic level of redundancy could have been achieved in the original design without incurring any hardware changes or manufacturing costs. Boeing never saw the need, and neither did the regulator.

[KallDrexx]

Probably a really stupid question but wouldn’t the angle of attack only be the same when the plane isn’t turning?

[Mark_Weston]

Apologies for the ginormous copy-and-paste, but the whole thing seems pertinent and it’s behind a paywall.

Also, this sub-quote from the Boeing spokesperson seemed pretty gross. “Upon reflection on what has occurred, it appeared the system could present a high-workload environment—and that’s not our intention.”

Where “high-workload environment” doesn’t at all mean driving your aeroplane into the ground?

Aviation Week: Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding

Guy Norris Apr 9, 2019

Pilot feedback to the proposed software changes to the Boeing 737 MAX Maneuvering Characteristics Augmentation System (MCAS) flight-control law is positive, says Boeing. After demonstrations, pilots believe the potential for further flight-control problems from the system are a “nonissue,” the airframer says.

However, despite the positive response from pilots to the upgraded control system and associated training package, Boeing is gearing up for a prolonged international effort to reinstate the grounded MAX fleet. The embattled company, which first unveiled the proposed MCAS changes to a group of certification authorities and airline pilots in Seattle on March 27, is embarking on a global campaign to convince regulators that the updates will be sufficient to enable the aircraft to return to service.

The campaign encompasses a series of simulator demonstrations and briefings at multiple training sites throughout Europe, Asia and Australia and comes as Boeing attempts to handle a situation unprecedented in its history. Because the MAX was grounded first by China and other authorities around the world days before the FAA followed suit, the company says it is imperative to build support for an international caucus of regulators willing to reauthorize the MAX to return to flight.

The FAA, which in past years would have taken a lead role in such an effort, is similarly shifting gears and is now working alongside a broader group of international regulators to adjudicate the case. The agency says it expects to receive Boeing’s final package of its software enhancement over the coming weeks. Meanwhile the FAA has set up a Joint Authorities Technical Review (JATR) to conduct a comprehensive review of the certification of the aircraft’s automated flight-control system. Chaired by former NTSB Chairman Christopher Hart, the JATR is comprised of a team from the FAA, NASA and international aviation authorities.

Boeing, which on April 5 signaled a 19% production slowdown of its 737 line to ease the growing logjam of undelivered aircraft, is also providing more details about the changes to the MCAS functionality contained in the new P12.1 flight-control computer (FCC) software load that will replace the existing P11.1 software. Based on pilot reaction to date, the company says it is confident its software upgrade is certifiable.

The briefings continue to emphasize that the MCAS, which was added to the speed-trim system to standardize handling qualities with those of the 737 Next Generation, is “not a stall-protection function and not a stall-prevention function,” says Mike Sinnett, Boeing Commercial Airplanes vice president of product development and future airplane development. “It is a handling-qualities function. There’s a misconception it is something other than that.“

Added to ensure a linear relationship between stick force per G, “speed trim is a function of airspeed, so if you’re going fast, it’s a low angle-of-attack (AOA), and if you’re going slow, it’s at higher AOA,” he notes. “The thing you are trying to avoid is a situation where you are pulling back and all of a sudden it gets easier, and you wind up overshooting and making the nose higher than you want it to be.”

Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design. To do that, it activates based on AOA rather than based on speed—which is what speed trim does. Speed trim is a function of airspeed, and MCAS is a function of angle-of-attack and Mach number, but it only triggers off AOA.”

In the initial briefing sessions for pilots on March 27, “we didn’t talk specifically about either of the accidents, but we ran through MCAS scenarios,” says Sinnett. “From the accidents, we now know how MCAS can behave when there is an erroneously high AOA input, so we walked through scenarios where that could occur. We demonstrated those in the simulator.”

In these sessions, pilots and regulators were able to interact via intercom and a big screen with Boeing pilots in the 737 MAX engineering cab. Following the sessions, “we went back to the classroom and said, ‘Here are the things that concern us most when we look at the scenario of the two accidents we just experienced,’” Sinnett says. “Upon reflection on what has occurred, it appeared the system could present a high-workload environment—and that’s not our intention. So we looked at changing the design to compare values from multiple AOA indicators to essentially eliminate the unintended trigger condition that causes MCAS to activate."

Sinnett says pilots appear satisfied that the three main layers of protection now added to the MCAS will prevent any potential repeat of the circumstances involved in the Lion Air and Ethiopian Airlines accidents. “We answered a lot of questions during the discussion, and then we went back into the simulator and demonstrated a number of different scenarios to run against these changes,” Sinnett says. “And the most compelling thing is that the AOA failure case turns into a run-of-the-mill AOA failure case like you might have on any other airplane. We didn’t get any negative feedback. It was all very positive, and any of the pilots who got into the simulator and saw the before and after, it was like, ‘Yes, OK, this is now a nonissue.’”

The first main layer of protection provided by the update is a cross-channel bus between the aircraft’s two FCCs, which now allows data from the two AOA sensors, or alpha vanes, to be shared and compared. AOA data continues to be fed from left and right vanes into their respective air data inertial reference units before being passed to the flight computers. However, the AOA data in both computers is now continuously compared. The change is made by software only and requires no hardware modification.

“In a situation where there is erroneous AOA information, it will not lead to activation of MCAS,” says Sinnett. He underlines that the entire speed-trim system, including the MCAS, will be inhibited for the remainder of the flight if data from the two vanes varies by more than 5.5 deg. If an AOA disagreement of more than 10 deg. occurs between the sensors for more than 10 sec., it will be flagged to the crew on the primary flight display.

The second layer of protection is a change to the logic in the MCAS algorithm that provides “a fundamental robust check to ensure that before it ever activates a second time, pilots really want it to activate,” says Sinnett.

The change would have protected the system from continuing to activate in the case of the Lion Air accident, in which the left AOA vane was stuck in the 20-deg.-nose-high position. In that circumstance, the logic rechecked if the MCAS was required and, registering the apparent nose-high position from the errant vane, commanded more nose-down trim. “Now it sees you’re in the same spot, it says you’ve got a stuck vane and says, ‘I’m not going to activate again,’” Sinnett notes.

“That’s assuming it will activate in the first place, which it won’t because one AOA vane with a high value won’t activate,” he adds. “When you do defense in depth, you have to artificially fail one layer to make sure you adequately design and test the next layer—so that’s what we had to do.”

Explaining the background to the third layer of protection, Sinnett says: “We also made sure if the second layer of protection failed somehow in some weird way and allowed MCAS to activate multiple times, the system now ensures the sum total is command-limited.” The result is that the pilots always have maneuvering authority remaining with the control column. “Pilots will always have the ability to override—although they had that before in other ways, like with the trim switch, for example. But with the software update, the column itself will always provide at least 1.2g of maneuvering capability. So you don’t just have the ability to hold the nose level, you can still pitch up and climb.”

[Mark_Weston]

@KallDrexx

Probably a really stupid question but wouldn’t the angle of attack only be the same when the plane isn’t turning?

Really interesting question that had me (as a layman) stumped for a few minutes. Five minutes of moving my hand around in front of my face has tentatively led me to the conclusion that Angle of Attack, being the rotation of the aircraft around it’s lateral axis, is the same on both sides even if one wing is lower than the other. I think for the two wings to have different angles of attack would require them to twist.

Maybe?

[ShivaX]

@Mark_Weston

Boeing never saw the need, and neither did the regulator.

From what I gather they were likely one and the same.

[Fishbreath]

AoA does vary across the aircraft in turns, although I don’t have a good enough intuitive understanding of the mechanics to explain it. That said, it’s a small effect, and AoA sensors are noisy already, so presumably it’s a fuzzy equality.

We don’t have the Lion Air incident report, but according to the Ethiopian Civil Aviation Authority’s report, the bad AoA sensor read north of 70 degrees, which is an impossibility.

Other random facts from my recent readings:

1. The 737 Max has two flight control computers (left and right) which swap between ‘primary’ status on aircraft startup. Each computer uses the AoA vane on its side of the aircraft for MCAS.
2. Previous versions of the 737 had two stabilizer trim cutout switches, one which disabled flight control computer inputs, while the other disabled the input from the yoke switches. The 737 Max had two stabilizer trim cutout switches, both of which disabled all electric trim inputs. That could have been a sticking point for pilots trained on a 737 NG—if you throw the cutout switch which, on an NG, was for autopilot only, then find that your yoke trim switches unexpectedly don’t work, that could very well contribute to turning the electric trim back on. I still think the forces from elevator deflection ‘locking’ the stabilizer trim beyond what you could feed to the trim wheel by hand is the most likely scenario, though.

[rhamorim]

@Fishbreath

the bad AoA sensor read north of 70 degrees

Maybe all the 737 Max dreamed of was being a Flanker doing Pugachev’s Cobra maneuver? That might explain it… ;)

[Mark_Weston]

@Fishbreath

I still think the forces from elevator deflection ‘locking’ the stabilizer trim beyond what you could feed to the trim wheel by hand is the most likely scenario, though.

Yes. Though this then leads to the next puzzling question; why, having re-enabled electric trim (though that’s inference, not fact, as I understand it) the pilots didn’t make any kind of sustained effort to trim nose-up immediately afterwards.

[Fishbreath]

Good question.

It’s inference, but solid and defensible inference. Evidently, the ECAA’s website is down, or they took the 737 report down, but there’s a section in the flight data recorder graphs which shows the autopilot stabilizer trim output, as well as the actual stabilizer trim motor engagements. After the first nose-down event or two, you see the autopilot continue to output stabilizer trim signals, but the motor no longer engages. Toward the end of the graphs, there’s another autopilot output paired with a trim motor movement.

Switch confusion might explain the ‘why’ there—if the pilot flipped the switch which, on all previous 737s, only permitted the yoke switches to make trim inputs but still inhibited the flight control computer inputs…

[Scott123]

As an engineer, I just had a flashback. Of trying to make sense of Bob’s drawings and his boxes of papers about the trim cutoff function he designed for the 737NG. Bob was obviously a smart guy so I’m confident we can carry his design forward. But he retired 7 years ago so we can’t really go bother him about it. Anyway, I’m sure we can add this gizmo and procedure on top of Bob’s design because we’re only working within the same system scope. Right?

[Fishbreath]

An aviation forum I follow said that the most criminal, least charitable interpretation of the switch change is that if Boeing had left it as it was in the 737 NG, with one switch for automatic electric trim and one switch for manual electric trim, they would have had to add MCAS to the 737 Max manual, in the list of functions the automatic cutout switch inhibits.

[Woolen_Horde]

@Boeing VP

“That’s assuming it will activate in the first place, which it won’t because one AOA vane with a high value won’t activate,” he adds. “When you do defense in depth, you have to artificially fail one layer to make sure you adequately design and test the next layer—so that’s what we had to do.”

SO WHY DIDN’T YOU DO THAT IN THE FIRST PLACE???

[Mark_Weston]

@Woolen_Horde

SO WHY DIDN’T YOU DO THAT IN THE FIRST PLACE???

QFFT!

[Mark_Weston]

@Scott123

As an engineer, I just had a flashback. Of trying to make sense of Bob’s drawings and his boxes of papers about the trim cutoff function he designed for the 737NG. Bob was obviously a smart guy so I’m confident we can carry his design forward. But he retired 7 years ago so we can’t really go bother him about it. Anyway, I’m sure we can add this gizmo and procedure on top of Bob’s design because we’re only working within the same system scope. Right?

Yeah. This reminds me of one piece of the puzzle I came across a few days ago. Apparently the MCAS system wasn’t new in the 737MAX. It (or a version of it) was originally developed and used in a couple of Boeing’s military variants for the USAF.

So “Bob” and his team had to solve this problem for a similar airframe with different engines. Can we just copy-paste it into ours? The spec looks reasonably similar…

[jpinard]

@Mark_Weston

Boeing never saw the need, and neither did the regulator.

LOL - cause they’re one in the same and it would cost them a bit of gross profit.

[Fishbreath]

Now for something entirely different: a 1943 instructional video on assembling a crated P-47 in the field with hand tools only.

[YakAttack]

Will UPS deliver a crated F-35?

[schurem]

They very much will not.

[MattN]

They will but they charge for shipping which is crazy when I’m paying $75,000,000.