Lion Air 737-Max missing, presumed down in the sea near CGK (Jakarta)

[Schwartz]

Stuff like that has happened, though not close to the ground. And usually you wouldn't expect AoA vanes contaminated with water to freeze when the plane is close to the ground as opposed to being at altitude. But there is a procedure to deal with this and it has been used successfully, though not avoiding a scary incident.

The point is, I and many others feel Boeing is still moving in the wrong direction. At a time when 3 AoA vanes have been shown not to be bulletproof, when some airplanes come standard with 4 AoAs, Boeing is fixing a troubled system by keeping its 2 AoA vanes.

That logic is predicated on MCAS being considered an essential safety system (vs a safety hazzard as it clearly was initially implemented). I have a feeling it is not considered such. I believe it was added to make it feel more like the old models. More sensors increases the odds of a failure and depending on the nature of typical failures for this type of sensor, perhaps it isn't all that unlikely that 2 fail close together.

[Gabriel]

The odds of an A320 having a bad ‘final AoA’ are extremely remote, and this was the standard used to certify it. I don’t recall the actual odds used, but they were considered, for all intents and purposes, impossible (barring any maintenance stoogery, of course). Even so, there are procedures to quickly degrade to alternate law without losing controllability or FBW methodology (whether those procedures are widely known is another story). But the point is, every REASONABLE precaution was taken to ensure that envelope protections required to certify the aircraft would be fail-operational following the failure of a single air-data source.

As I understand it, MCAS will now be inop following the failure of a single air-data source. It is now fail-safe but not fail-operational. That means the airplane, by certification criteria, is potentially unsafe (and we have learned many times over that aviation disasters often are the result of a rare but still foreseeable combination of failures and pilot error).

So the question I would like answered is: why is requiring triple modular redundancy for MCAS unreasonable in an age where it is the standard for critical systems?

Evan, I am not stating that it is unreasonable to require triple redundancy for the MCAS. What I am saying is that using the A320 certification as a basis for claiming so is not reasonable.

In your own words:

The A320 needed three AoA sensors to achieve certification. Why? Because AoA data can override pilot inputs.

That's not the case with Boeing, with ANY Boeing, even with the previous version of the MCAS which was horrible and unacceptable for other reasons.

[Evan]

Evan, I am not stating that it is unreasonable to require triple redundancy for the MCAS. What I am saying is that using the A320 certification as a basis for claiming so is not reasonable.

In your own words:



That's not the case with Boeing, with ANY Boeing, even with the previous version of the MCAS which was horrible and unacceptable for other reasons.

Ok, let me be more clear on this: certifying the A320 without trim force feedback REQUIRED envelope protections, as they compensated for a serious safety concern (the A320 can not be dispatched for revenue service in alternate law). Therefore, triple modular redundancy was REQUIRED for air data systems that those protections depend on. Airbus FBW protections are fail-operational by design.

From everything I’ve learned about MCAS this far, it seems that it was also REQUIRED to compensate for a serious safety concern at the limits of the safe envelope and the -MAX cannot be dispatched for revenue service with MCAS inop. Yet MCAS was designed (and certified) without redundancy and now redesigned to be fail-safe, not fail-operational, after a single-point failure.

That seems a lot like a double standard to me. And I still would like to know why they didn’t require it to be fail-operational.

[Evan]

The Airbus control design is fundamentally different and a loose comparison is not valid. Remember, MCAS may have only been necessary to make the MAX feel exactly like the old 737, so no new training was required. I would not be surprised, if they mandate new training for the MAX now. On it's own, the MCAS may not have been required as a safety issue. To be fair, I'm not certain of that, but again, I don't think your comparison is valid. It seems to me, the plane is entirely flyable without MCAS and the override if properly programmed is something the pilots train for.

You need to read up more on MCAS. There were pitch behaviors created by the aerodynamic effects of the repositioned nacelles that resulted in serious concerns during approach to stall. The aircraft in this state was considered unsafe. There were concerns that a recovery might be overcome by these effects. And, while more complexity does increase the risk of a single failure, triple modular redundancy DECREASES the consequences of a single failure and INCREASES the robustness of the larger system, which is all that matters.

[Gabriel]

You need to read up more on MCAS. There were pitch behaviors created by the aerodynamic effects of the repositioned nacelles that resulted in serious concerns during approach to stall. The aircraft in this state was considered unsafe.

Source please. It can be the case, but I could never find clarity on whether it was a feature that was required for certification (at any level) or if it was a feature that allowed commonality with the NG.

[Gabriel]

Ok, let me be more clear on this: certifying the A320 without trim force feedback REQUIRED envelope protections

Again, not the case with any Boeing, all of them have trim force feedback.

From everything I’ve learned about MCAS this far, it seems that it was also REQUIRED to compensate for a serious safety concern at the limits of the safe envelope

I am eager to find a source for that.

All airplanes with underslung engines have a strong tendency to pitch up when power is added from very low thrust to very high thrust especially at low airspeed and high AoAs. There were even serious incidents with different airplanes where control was lost due to this combined with improper pilot handling of the situation. The fact that the MAX has a stronger effect than the NG doesn't per se make it a more serious safety concern than it is in other types. However, it may imply specific training that Boeing was trying to avoid.

[ATLcrew]

...and did I ever mention the fact that when I arranged for Gabriel to get 2 hours in the 74 sim that he showed up an hour and 20 minutes late?

Then why, in Saint Agatha's name, did you let him anywhere near the sim?

[ATLcrew]

The New York Times would be a good place to start.

Oh aviation matters? I don't think so, Tim.

[3WE]

From everything I’ve learned about MCAS this far, it seems that it was also REQUIRED to compensate for a serious safety concern at the limits of the safe envelope

Dittos to Gabriel's comments: Source for this, or it's not true.

There may be SOME validity, but conversely, I question whether a slow trim response is really appropriate for an unrecoverable stall...

If unrecoverable stalls are an issue, I'd think a mega stick pusher might be more called for.

As Gabbieee has repeatedly stated, the goal to not have special training requirements was very big too.

I can see where special training to shove HARDER could be avoided with something MCASISH.

Also, if it's UNRECOVERABLE stall, I'd speculate they would have done double AOA instead of single AOA reading for MCAS...

If you just want to make it FEEL nicer, then what the heck, only one AOA vane is good enough.

[BoeingBobby]

Then why, in Saint Agatha's name, did you let him anywhere near the sim?

Not sure I have an answer for that. I will tell you that my friend that arranged it and ran the Sim, turned down the invitation for dinner afterwards. He was not a happy camper.

[Evan]

Oh aviation matters? I don't think so, Tim.

You still don’t get it. This isn’t an aviation matter. It’s a matter of reckless management serving investor relations at the expense of safety. It’s a sort of industrial epidemic lately. And yes, the Times is a good place to find those truths.

[ATLcrew]

You still don’t get it. This isn’t an aviation matter. It’s a matter of reckless management serving investor relations at the expense of safety. It’s a sort of industrial epidemic lately. And yes, the Times is a good place to find those truths.

Noted.

[Schwartz]

You still don’t get it. This isn’t an aviation matter. It’s a matter of reckless management serving investor relations at the expense of safety. It’s a sort of industrial epidemic lately. And yes, the Times is a good place to find those truths.

That is exactly what led us here. That doesn't mean everything being proposed is the same. This will NOT be status quo. Boeing is fundamentally a different company now, because they will border on bankruptcy and they have lost the trust of all their clients. This is catestrophic for investors at this point. They will demand any change to get them out of this, including a focus on safety.

[Gabriel]

Even the NTSC's report on Lion AIr's accident (which is being praised by the industry at great) is ambiguous on the matter:

During the preliminary design stage of the Boeing 737-8 (MAX), Boeing tests and analysis revealed that the addition of the LEAP-1B engine and associated nacelle changes was deemed likely to negatively affect the stick force per g (FS/g) characteristics required by 14 FAR 25.255 and the controllability and maneuverability requirements of 14 FAR 25.143(f). After the study of various options for addressing this issue, Boeing implemented aerodynamic changes as well as a stability augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an extension of the existing Speed Trim System (STS), to improve aircraft handling characteristics at elevated angles of attack. The MCAS was needed in order to make the Boeing 737-8 (MAX) handling characteristics so similar to the NG versions that no simulator training was needed for type rating. It was also required so that the 737 MAX passed the certification that the pitch controls could not get lighter on the approach to stall. If the aircraft had substantially different pitch behavior, then there would be a simulator training requirement for the pilots.

[3WE]

Even the NTSC's report on Lion AIr's accident (which is being praised by the industry at great) is ambiguous on the matter:

Genuinely noted.