Bjorn’s Corner: 737 MAX ungrounding, ANAC’s and EASA’s decisions

By Bjorn Fehrm

November 27, 2020, ©. Leeham News: After the lifting on the grounding order by the FAA, ANAC (Brazils regulator) followed in the week, and EASA issued its plans for public comment.

What are the differences in the ungrounding conditions, and what are the reasons for any differences?

Figure 1. Circuit Breaker placement for the 737 NG and MAX. Source: Leeham Co. and Flightdeck737.be

 

ANAC’s ungrounding conditions

ANAC, Brazil’s regulator, which has the competence to certify airliners through decades of work with Embraer, lifted its grounding order for the 737 MAX Wednesday. ANAC based it on FAA’s conditions with no changes, but in comments around its lifting on the grounding, it refers to ongoing work on further improvements to the MAX. The one Brasilian airline that operates the MAX, GOL, can immediately update its 737 MAXs and retrain its crews.

One can only speculate what ANAC means with the “further improvements,” but these likely include the third synthetic AoA sensor that EASA wants and some further clean-up of the warnings in the 737 cockpit. I write “737 cockpit” and not 737 MAX cockpit as a large factor in operating the 737 MAX is its use with a 737 NG fleet. In such a case, the airline and the certification authorities want to minimize any differences in the types’ behaviors.

EASA’s plans

EASA, the EU regulator, Tuesday issued a “Notification of a Proposal to issue an Airworthiness Directive.” This is its candidate for the un-grounding Airworthiness Directive (AD), published for public comment. The comment time ends 22nd of December, then the comments shall be reviewed by EASA. We can expect the AD by mid-January.

The AD proposal is based on the FAA ungrounding directive, but It adds a couple of conditions and restrictions.

The simplest condition is the requirement for the top part of the stick shaker system’s circuit breakers to change from black to red color. It’s to make them easier to identify should a crew decide to silence an erroneous stick shaker.

The circuit breakers in the 737 are placed on the back wall of the cockpit, Figure 1. Pulling the breaker requires a crew member to un-buckle and at least lean over to pull the circuit breaker (the Captain’s Stick Shaker breaker is behind the First Officer and vice versa). Is this safe or not?

Well, the crew is allowed to stand up and go to the WC, so leaning over or standing up to pull a circuit breaker should be no different. A decision to pull the breaker will only be taken in a situation of full control of the aircraft. It’s difficult to identify the correct Circuit Breakers (and pulling the wrong one is not good) so making the Stick Shaker caps red help.

FAA says there is no need to silence a rough stick shaker while EASA (and Transport Canada we presume) says it improves the recognition of the other side Stick shaker should the aircraft run into a real high AoA situation. As there is no urgency to silence the asymmetric rotating counterweight attached to the Yoke column, pulling the breaker for an erroneous Stick Shaker should be OK.

The other condition has its root in the disconnection of Speed Trim, MCAS, Autopilot, and Flight Directors should the two Angle of Attack systems disagree. EASA will temporarily revoke the 737 MAX certification for Required Navigation Performance – Authorization Required (RNP AR) approaches.

Such approaches are demanding as they are often curved approaches in valleys to difficult to access airports. Look at this famous Queenstown, New Zeeland RNP-AR approach, and you see what I mean. Imagine sticking your nose down there when it’s all covered in clouds.

Should the AoA monitor trip, Speed Trim, MCAS, and more importantly, Autopilot and Flight Directors disconnect, it puts a crew in a very tight spot as the difficulty of such approaches are high (they require special crew training and certification). You need all the tools you have in such approaches and don’t want a sudden disconnect of the Autopilot and Flight Directors combined with Speed Trim warning, followed by AOA, IAS and ALT DISAGREE.

The revoke of the RPN AR approach certification is temporary. One can guess it will be allowed again once a synthetic third AoA sensor is introduced to the MAX. It creates a voting “two versus one” situation when one of the sensors presents suspicious values. It would then result in an AOA DISAGREE warning, but the Autopilot and Flight directors would stay on and IAS and ALT would still get the required AoA corrections. The AOA DISAGREE is then an indication for required maintenance rather than a major system hiccup.

The EASA decision makes sense, and one would wonder what the situation in the FAA jurisdiction is? Are there no operators that fly the demanding RNP AR approaches? Or has the FAA another view on what is OK?

The restriction makes EASA’s argument for a third sensor understandable. For regular operations, the two AoA sensor solution is OK, but something better is required for demanding operations. The revoking of the RPN-AR certification is the way for EASA to allow the 737 MAX back to service with two sensors while Boeing gets time to do the software changes to create a third, synthetic sensor. This then enables more advanced approaches.

Is the non-allowance of RNP AR approaches a significant restriction for EU operators? To my knowledge, no.

RNP AR approaches are rare as they require specially equipped aircraft and require the airlines and their pilots to be specifically trained and certified for shooting this type of procedure.

They are the last resort when nature prohibits standard approaches like ILS or in the future GLS (GPS approach similar to ILS CAT II and III, with local correction of the GPS signals).

Pilot training

Both ANAC and EASA require training along the lines of the FAA. EASA point’s out training preparations can start now, no need to wait for the AD to come into effect after the comment period. The simulator requirement will occupy the 50 MAX simulators that are spread over the world. EASA warns that it will take time for all Pilots to complete the 737 MAX syllabus.

78 Comments on “Bjorn’s Corner: 737 MAX ungrounding, ANAC’s and EASA’s decisions

  1. RNP AR in Europe? I guess Madeira will require it, and maybe Innsbruck. Saint-Tropez-La Mole is also on the sporting side, but I doubt if it can handle a 737.

    • We have plenty of RNP approaches in Norway and Sweden, and use them frequently – with B737 NG and A320 Neo. And new RNP approaches are appearing all the time throughout the rest of Europe. At some of the airports, RNP has given us approaches to runways where we previously had none, or just high cloud breaking procedures, because of the terrrain, and at others we save huge amounts of time and fuel since they have been able to create them much tighter than the conventional procedures. Coming in to Oslo from the opposite direction of runway in use, we can save almost 10 minutes when we are lucky enough to be cleared for the RNP approach, instead of the long full ILS procedure.

      Revoking RNP sertification temporarily isn’t a huge problem, but it is certainly a disadvantage for those who will fly the Max in Scandinavia (which is not the case for my airline though).

  2. I imagine flights crews struggling to keep the aircraft in the air, while an incorrect stick rumbler futher confuses the situation, steered by the aging alerts system and absence of EICAS.

    “Pulling the breaker requires a crew member to un-buckle and at least lean over to pull the circuit breaker (the Captain’s Stick Shaker breaker is behind the First Officer and vice versa). Is this safe or not?

    Well, the crew is allowed to stand up and go to the WC, so leaning over or standing up to pull a circuit breaker should be no different. A decision to pull the breaker will only be taken in a situation of full control of the aircraft”

    We are not discussing a situation of a crew member going to the toilet. Would you locate those circuitbreakers there in a new cockpit design?

    I spot tendency to put a lot of energy in explaining why systems are good enough, using old requirements. Not creating the safest systems. Pitty.

    • A few clarifications in the comment above:

      1. For AoA failure, the stick shaker is active on one control side only. The other side, along with the reference instruments, remain fully operational, without alarm or shaker. This is why the unreliable airspeed checklist calls for using the other control side, once determined it is valid by visual or reference comparison.

      2. FAA policy is not to use the circuit breakers either as primary means of control, or to disable important warning systems. So Boeing will come up with another solution for this. It will likely require the shaker to be active for a certain period before shutoff, and will also reset on landing.

      3. In the accident flights, this feature may not have mattered until after the runaway checklist was completed, with stabilizer turned off. At that point the crew could turn their attention to the still-active shaker. It would have helped JT043 where the flight continued to the destination with continuous shaker all the way.

      4. Most commercial aircraft have circuit breaker panels on the rear wall of the cockpit. Since this has never been an issue in 5o years of service, it’s not surprising the shaker breaker would be located there. Hardly an issue of poor design.

      • “Hardly an issue of poor design.”

        It is the same all over.
        2 AoA that have no direct “Durchgriff” to plane control in a 2 unconnected brain lobes arrangement were OK.

        This concept was broken and that
        has repercussions:
        what formerly was OK is no longer OK.

        This is nothing you can fix with debate club proficiency.

  3. I think Alsaka uses a number of RNP approaches and it is popular for Green approaches/landings where the Aircraft can follow a curved approach minimizing noice in densly populated areas around Airports.
    The A220 and the G500/600 as well as Global7500 have new technology force feedback sticks that in theory could drive the 737 yoke to emulate the 737NG

    • Alaska was acualy the place that got ADS going though it was called Capstone back then and out Western Alaska where no NAV aids.

      Alaska Airlines saw it and wanted it for South East AK as its bad weather a lot down there and the Juneau approach is the worst. (Alaska Airlines lost a 727 down there when they got lost on that approach) . You come in, have to make a turn just before final as there is mountains close on one side, more on the other the side of the channel.

      Alaska Airlines does fly to Western Alaska, the approaches are not mountainous.

  4. @Bjorn, you indicate that the EASA requirement for a third AoA sensor will create a “voting ‘two versus one’ situation”, do you think Boeing will achieve this via software integration (feed to ADIRU), or will it merely be that the third AoA sensor is added to the reference instruments, and a decision will be made by the pilots in the event of AoA mismatch.

    Has EASA specified that the third AoA must be integrated ?

    If the pilots are required to make a manual decision on AoA mismatch, in your opinion would that be good enough for RNP-AR approaches where the pilots have a necessarily high workload ?

    While adding a version of EICAS may be a very sensible thing to do, I completely understand why Boeing don’t want to spend time/money on further changes to the MAX, or open the door to retro-fitting anything to the NG series.

    I just hope it isn’t something that they come to regret in time. Variants of the 737 will still be flying in the next 20 to 30 years.

    • I was wondering this too, I have heard nothing from Boeing or FAA that indicates a voting system would be used or preferable. Given the Boeing AoA DISAGREE alarm and control philosophy, it might make more sense as a fallback in the event of that alarm. Especially if synthetic. But Bjorn may have more information.

    • About EICAS, the MAX has the EI but not the CAS. Boeing has said the MAX doesn’t have the sensors or the wiring to support CAS. According to Boeing, it isn’t a retrofit solution, it really needs to be introduced with a new aircraft.

      • I know it wouldn’t be cheap, or easy, but they have EICAS on the 757 as possibly the closest match in terms of aircraft with EICAS.

        To be honest it could have been added to the NG, the 757 flew quite a while before the NG.

        I thought that Mike Carriker suggested putting EICAS on the MAX saying “it was necessary for the 737 to be a modern airplane.” I can also see why Boeing decided not to.

        Having watched the Queenstown, New Zealand RNP-AR approach that Bjorn provided a link to I can see that you’d really want the third AoA sensor to be seamlessly integrated, and not rely on a mismatch warning, for the pilots to notice, and make a decision on after referencing their third AoA. In bad weather on that approach I don’t think you have much time / room for error.

        I’m very interested to see if EASA is expecting it to be integrated.

        • JakDak, there is also this:

          “Installing EICAS on the 737 “would be challenging,” said Mike Carriker, Boeing’s chief pilot for product development. “There aren’t enough sensors on the 737. Even if it were possible, it would require a new type certificate and new pilot training.”

          So the last bit may be a factor as well. Customers may not have welcomed the new pilot rating. I’ve read that was the case (Southwest) in other forums, but it may be only speculation.

          I tend to believe Boeing’s position on this, but I realize others may not (the basis of most disagreement here).

          As far as the approaches, the third AoA sensor is a safety improvement for that case, so there is no objection. But we have to remember the 737 has been doing them for as long as the technology has been available, without issue.

          The 737 has three ADIRU’s and two autopilots. The ADIRU’s are fail-operational, except for AoA, for which they are fail-passive. So the third AoA would make them fully fail-operational, but it wouldn’t be in a voting configuration, unless EASA mandates that.

          The autopilots would still be fail-passive, which means the pilots fly a missed approach, followed by a manual approach.

        • The 757 is a contemporary of the 767, shares flight deck and much of the digital avionics.

          As for EASA’s complex approach concern, a question in my mind is what AOA is needed to abandon the approach when a vane fails, is ‘synthetic AOA’ good enough for that?

      • CAS being the diagnostic/monitoring bottom part IIRC.

        Has to be done well though Boeing has the company history. The 767 was plagued by phantom faults and by troubleshooting guides that did not cover that possibility.

        A jerk maintenance director at Pacific Western forbid mechanics from talking to pilots, as they had for decades.

        But they often ended up at the same cafeteria tables in the bowels of YVR terminal.

        So they developed a solution for faults arising after pushback when pilots exercised controls, typically for first flight of day. (Cause was often maintenance work confusing systems.)

        PW had mechanics authorized to taxi airplanes. So the new SOP was for mechanics to taxi the 767s to the terminal after maintenance, and exercise controls enroute.

  5. Bjorn’s article mentions
    “I write “737 cockpit” and not 737 MAX cockpit as a large factor in operating the 737 MAX is its use with a 737 NG fleet.
    In such a case, the airline and the certification authorities want to minimize any differences in the types’ behaviors.”

    The behavior difference between the various 737 cockpits and differences in the types is enormous.
    The 737 was originally designed and built in the 1960’s. Over a half century ago. The engine thrust and takeoff weight is now twice that of the original 737.
    The current glass cockpit looks and operates much differently than the original steam gauge cockpit. There are now complex flight control computers
    in the new 737-MAX’s that weren’t even conceived of in 1967. The wing design has been modified to add winglets (shark fins) to the tips of the main wings.
    The 737 Amended type certificate now prints out at almost 100 pages in length.
    =================================
    The Boeing 737 Type Certificate
    http://www.b737.org.uk/a16we.pdf
    =================================
    The Boeing 737-specs (Thrust / Weight through the years)
    https://modernairliners.com/boeing-737/boeing-737-specifications/
    =========================================
    When do you stop “grandfathering” the 737 design, and call for a completely new Type Certification? A completely new design review top to bottom?
    According to the FAA Section 21.19
    “Section 21.19 requires an applicant to apply for a new TC for a changed product if the FAA finds that the change in design, power, thrust, or weight is so extensive that a substantially complete investigation of compliance with the applicable regulations is required. ”
    =================================
    https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_21.101-1B.pdf
    ===============================
    I say that the 737 design amendments have been stretched past the point of requiring an entirely new Type Certificate.
    Over 50 years of grandfathering former rules, with the doubling of thrust and weight along with a new wing and tail design
    requires an entirely brand new type certification.
    Why has the FAA let these extensive changes to the original 737 design go on and on by just amendments to the orignal 1960’s Type Certificate, of 50 years ago?

    Bjorn’s article mentions a requirement of disconnecting MCAS.
    “The other condition has its root in the disconnection of Speed Trim, MCAS, Autopilot, and Flight Directors should the two Angle of Attack systems disagree.
    EASA will temporarily revoke the 737 MAX certification for Required Navigation Performance – Authorization Required (RNP AR) approaches.”

    One of the many changes on the 737-MAX, to ensure the Pilots DON’T have control, also seems minor, but, has enormous implications. The rewiring of the Stabilizer CUTOUT switches. Since MCAS controls the plane without any means of turning it OFF as you can with the AutoPilot and AutoThottle,
    Boeing rewired the Stab CUTOUT switches on ONLY the MAX version. WHY? It leaves the pilot, in an emergency situation, outside the normal flight envelope,
    having to attempt a last ditch effort, when seconds count, trying to turn a manual cable system, which in the Etheopean crash, was impossible to work.
    In most any other Boeing aircraft, and EVERY other Boeing 737, pilots would have been able to cut off ONLY the AutoPilot allowing them another option to save the aircraft from the broken computer system. Even after the FAA has approved the changes to the MCAS system, this option still is missing.
    The final authority is still a computer program on the 737-MAX, without an OFF switch. Boeing says the computer is smart enough to save itself. I don’t want to put that
    much trust in a computer, unless it’s been certified to fly-by-wire standards as AIRBUS aircraft are.
    ===================
    https://www.kuow.org/stories/old-switches-could-have-saved-ethiopian-flight-engi
    =====================

  6. Bjron:

    Thank you for showin the location, a lot talked about it but no one was shwoing it, its really critiail to understaning the MAX/NG issue

    That said I am also reaidn EASA uses the stick shakery deactive as a starnd procedure which wold indicated to me it has a swtihc or CB in an asily reahil postion. I would go with a swtich as CBs are a different form fucnbion though you can have a toggle like CB.

    Equally, if you need to stop the stick shaker, I getting out of their seat as a response is Iffy at best.

    In the case of the 737, you have to swap to the NFP side to stop it and in the case of Indonesia and Ethiopian those were low hour pilots in those positions.

    They can only be as good as their experience and training which for those two countries per their regs is very low.

    US is 1500 hours I believe though you hope that is not just cross country boring through the skies. When I was flying that hour build was flight instructors (which is a good learning lab for someone considering some of the stunts their student (not me) pulled)

    • We’ve discussed this at the time of the article, and it’s given in the House report as a smoking gun. But it really isn’t, under the modified MCAS, it can still run its 10-second cycle to completion without causing a significant control problem for the pilots.

      That has now been confirmed by the regulators, and this scenario will be run in the simulators during mandatory training so pilots can experience it.

  7. As a production manager with many years experience one of the issues that has baffled me about the whole Max situation is the control logic of MCAS. In equipment in a production environment there is the electrical/mechanical equipment and the control system. In automatic mode the equipment runs itself according to various inputs and logic of the control system.
    If you have a problem you can switch to manual mode and drive the equipment using switches and buttons manually.
    For the life of me I cannot understand that if there was a trim problem such as occurred with MCAS or even runaway trim you switched the system off and had to rely on winding a wheel on a multi million pound plane..
    Why not leave the electrical power and just drive the stabiliser via the trim switches on the yoke with the control logic disabled.
    I have probably missed something and over simplified.

      • If the only procedure is to disable both switches together, then what is the point of having two switches? Just change it to one switch. Why wasn’t it changed to one switch? Too obvious that things were getting changed? That said, why wasn’t the procedure (for both the NG and the MAX) to shut off trim motor auto pilot first, and then if that didn’t work shut off the motor, as Lemme implies? That seems like common sense, so short of a good explanation from Boeing or the FAA, I’m a skeptic. ‘That’s the way we’ve always done it’, who can argue with that rationale?

        • Ted, the FAA response was that the two switches were wired in series so as to provide redundancy in case of switch failure. Both switches being already present anyway.

          • So Boeing was so worried about a switch failure they rewired the two switches to be in series but, only used one AOA sensor? I find that impossible to believe. Someone at Boeing, for some as yet unknown reason intentionally changed the wiring of the two Stab Cutout switch design, to remove the yoke switch control from being activated without MCAS. I think the reason could be that MCAS at the last moment was rewired through the Manual electric control, in order to run the trim motor at the high speed setting. But, by doing this, it changed the functionality of the two stab cutout switches. Instead of Manual / Automatic, it was now Manual + MCAS / Automatic. That would necessitate MCAS being described in the Flight manual, and possible additional training for Pilots, and since the Boeing management dictate at the moment was “no additional training” at any cost, someone elected to change the face plate text description on the Cutout switches and rewire them in series. I’m wide open to hearing other explanations for the rewiring.

          • Richard, this is a conspiracy theory. You have the answers you seek, you just don’t accept them.

            There is nothing factually more that anyone can tell you. You’re welcome to believe what you choose, and post it here.

          • Richard:

            Two switches because there used to be two trim motors.

            There is a story there but I don’t know what it is.

            When the 2nd trim motor went away, they just left the two switches and (from memory ) wired them in series. Any one switch will do the same things as two.

            Maybe it saves on training changes? YO know, re-wring those manuals. Its such an annoyance.

            Like MCAS, lets just assume its not there and we don’t have to mention it!

          • There’s a lot of switches on an airplane. Do they need two for everything in case one goes bad? I have a hard time taking that argument seriously.

          • Ted, you have to switched already present. Only need one function. Logical solution is to put them in series.

          • I think my conspiracy theory as you call it, is much more plausible than the FAA saying Boeing wanted to have double redundancy, so they rewired the cutout switches, just on the 737-MAX to be in series. I find that reasoning to be quite laughable. But, if you want to go down the conspiracy theory, as the reason to change the switch wiring, how about this rabbit hole… The yoke mounted switches aren’t wired directly to the trim motor any more on the MAX. They are wired into the flight control computers (FCC’s) as inputs to the FCC/MCAS/STS programming that controls the trim motor. So Boeing had to rewire the cutout switches in line with the FCC in order to cut out the only one control circuit left to the trim motor. If this was true, an Airline mechanic could verify by firing up a 737-MAX on the ground, somehow shutting down the FCC (is there a circuit breaker for the FCC’s?), and then seeing if the yoke mounted switches still work or not. Now that’s what you call a conspiracy theory! Opening up a huge can of worms, if it were true.

          • I keep repeating it.

            Two Trim motors. A switch for each (two)

            They just did not remove them and linked them together behind the counsel. But no, lets pretend that is not it and beat it to death.

            Sheese.

        • Also with regard to your latter comment, the column electric trim buttons override all other stabilizer controls. So effectively there is no difference between using the buttons directly, and first turning off the autopilot cutout switch, and then trying the buttons. The method given in the checklist is the most efficient and has the least steps as a memory item. That was the logic followed by Boeing and FAA.

        • TW, this is quite clearly incorrect. Please read the link I posted for the history of the 737. The switches were never used for the two trim motors. If you can provide evidence that they were, please feel free to present it here.

    • If you read the article that Richard linked to, you will see that Peter Lemme talks about the changes to the stab trim cutout switches on the MAX.

      I think he has a point, I’d love to know why Boeing changed the switches from the way they were on the NG, …

      Is it a kind of dogma … “the checklist on the NG and on the MAX are the same, throw both switches” … “do not deviate”

      So how I have to look at this is in a realistic way, Boeing design the aircraft to fly within a certain flight envelope, the FAA has regulations to be adhered to, again within the specified flight envelope.

      The FAA regulates, they do not design, so the ball is really in the airframer’s court if they want to improve the design, and cater for possibilities outside the certified flight envelope. Indeed the FAA may face legal challenges from an airframer if they were to specify changes that were perhaps a very sensible idea, but outside of the regulations.

      There isn’t really an incentive for an airframer to do this. It’s possible that the trim wheels may be too difficult to turn when the aircraft is outside the certified envelope (but safe as certified), hence a comment I made previously (pilots will pay attention, and NOT get outside the envelope, whatever the distractions).

      I’m very sure every 737 pilot for any decent airline will be very aware of the MAX accidents, and training should hopefully help hammer home the importance of staying within the envelope.

      I can’t understand why Boeing hasn’t just gone back to the NG wiring of the trim cutout switches, for me it’s low hanging fruit, it wouldn’t cost that much to do, and the procedures remain the same in the checklist, and completely compatible with the NG.

      It’s possible that there have been issues with switch failure over the years, and it is indeed sensible to re-wire them. There MAY be another sensible reason.

      Just because Peter Lemme, or I can’t see why they wired them up differently doesn’t mean there isn’t a very, very good reason. Note to Boeing being very transparent is actually a good thing, reminder to self don’t ever assume a conspiracy when a series of circumstances or a plain old ####up or dogma is actually the real reason.

      If in future a MAX somehow through some unforeseen event ended up in a situation where the pilots needed to stop the autopilot from controlling the elevator, and they needed electric trim, that option would be available, it may make a difference, it may not.

      I do wonder though when they first built the 737, why did they have two
      separate switches anyway, why didn’t they just have one switch ?

      If they had two switches, and the procedure is to throw both at the same time, why weren’t they wired up on the NG the way they are now wired up on the MAX. ?

      Human factors, and safety are a particular interest of mine, I loathe the “we’ve done it this way for the last 50 years, so we’re not going to change anything” attitude, if there’s a better way, especially with regard to safety, take a slice of humble pie, and do things better.

      Dogma can quite often dig you into a hole.

      • JakDak, the checklists evolved over time, as have the switches. Here is a link to a history of the runaway trim checklists for all the 737 models.

        As can be seen it wasn’t a case so much of things being removed from the checklist, as the switches evolving to match the evolving checklist.

        http://www.b737.org.uk/runawaystab.htm

        • Two trim motors at one time.

          Why the 2nd tiem motor was removed and why not a cover and a single switch.

          Rob is incorrect in that the two switch are a safety feature. It was a convenient for Boeing though whether that is manuals, training or even other reasons is un reported.

          We do know Boeing is big on cutting costs at any price.

          And electrically, the right approach is to kill the main power to the motor with a switch not the control power to the relays.

          Interesting my world had a higher standard than the air world (I don’t know its exclusive to Boeing)

          I was shocked (pun intended) that is how the switches work.

      • It seems like most Boeing planes have the 2 cutout switches.
        =========
        the following quotes from this article
        https://www.seattletimes.com/business/boeing-aerospace/boeing-altered-key-switches-in-737-max-cockpit-limiting-ability-to-shut-off-mcas/
        ========================
        “Boeing could have instructed pilots after the Lion Air crash last year to simply flip the “AUTO PILOT” switch to deactivate MCAS and continue flying with the normal trim buttons on the control wheel. He said that would have saved the Ethiopian Airlines plane and the 157 people on board.

        “There’s no doubt in my mind that they would have been fine,” Lemme said.”
        ==========
        One for the manual control, and one for the autopilot controls.
        “A veteran Boeing 737 test pilot said that all Boeing planes have two such cutoff switches, not just the 737. And both he and American Airlines Captain Dennis Tajer, a spokesman for the Allied Pilots Association who flies 737s, said they could think of no existing procedure that called for flipping only one of the switches.”
        ========
        there may be no documented procedure, but, in the ET302, they could have really used the old functionality. Or, a simple true OFF switch for MCAS.
        ======

        • Yes, they could have flipped that switch, but the evidence is that they didn’t use the trim buttons as is required by the runaway trim checklist. Nothing prevented them from using the buttons in the same way after they reactivated the stabilizer, but they still didn’t.

          So nothing really is changed by the presence of that switch, except that they might have had more time to figure it out. They were already at nearly 400 knots with 94% throttle, accelerating in a climb, and with a severe mis-trim. That’s why they had to turn the stabilizer back on, which itself was against procedure.

          A solution that was available to them the entire time, was to reduce throttle and airspeed by 150 knots or more. That would have allowed them to move the trim wheels in accordance with the checklist, while also reducing the force on the column required for level flight. Note that throttle was reduced, although belatedly, on both JT043 and JT610. But it never happened on ET302.

          While one can debate whether the NG switch configuration might be better, I don’t think you can conclude that ET302 is automatically saved with that switch. That wasn’t the conclusion of any of the investigations, which didn’t include the switch as a causal factor.

      • I recall the dual side-by-side switch arrangement on the control wheel dates from the 707.

        Other switches in control of stab I am not familiar with.

        • Oh, unclear.

          I was thinking of the pair of switches on one horn of each control wheel, which if I understand correctly Rob is calling ‘buttons’. Operated by pilot thumb pushing both together in desired direction, sort of very short levers. They are the normal manual method of adjusting stabilizer trim.

          Other switches are on the aisle stand, forward panel, and on bottom of control column below floor.

    • I personally agree that the NG two switch design is better. It provides an option that is available even if never needed.

      The FAA explained in their response to comments that the switches were reverted to one function because no checklists remained that called for the pilots to disable the autopilot trim but leave the electric trim enabled.

      They also said that the behavior of the new STS/MCAS effectively emulates that function. There are no circumstances remaining where MCAS is not disabled by faults in the tree. If MCAS somehow fails in a manner not foreseen in the fault tree, then its authority is reduced to the point where the pilots can still easily retain control.

      Lastly in the accidents, it’s not clear that it would have changed the outcome. The JT610 crew did not attempt to use the switches. The ET302 crew did not use the electric trim function to mitigate the effects of MCAS, even after restoring power to the stabilizer motor for that purpose.

      • @Rob, The ET302 pilots did use the switches twice after they couldn’t get the trim wheel to move, because of the heavy load, caused by the high speed. Bjorn described the situation, very well, in a previous article.
        =========
        https://leehamnews.com/2019/04/05/bjorns-corner-et302-crash-report-the-first-analysis/
        =====
        The reason for the two short manual electric trim activation’s was probably because of the very high speed dive the aircraft was in. Pilots would hesitate to use a lot of trim quickly, rather they’d give it a shot or two, and see the response. MCAS on the other hand, apparently had no sensing of the speed, and put in a full 10 second burst, which sealed their fate. Now, if they pilots had the ability to shut ONLY MCAS OFF…………???

        • Richard, the high-speed dive did not occur until after the last unopposed action of MCAS. The pilots did not use the electric trim buttons to mitigate MCAS, as was listed in the checklist and part of their training for runaway trim..

          The subsequent pilot testing showed their behavior was not unique or unusual, so we don’t use that fact to assign blame. But it is a fact which will be addressed in the training.

          Some members of flights JT043 and JT610 used the buttons to neutralize MCAS, some did not. It was a necessary component for success. That’s why it will be reinforced in the training.

          • The checklist you are referring to all the time proved to be useless (it’s impossible to trim manually with pressure on the flight controls). The fact is Boeing added a new feature, capable of applying violent and lethal trim applications, without telling the operators, and without changing the checklist, thinking that the old memory items for runaway trim procedure should be sufficient, which it clearly wasn’t. That checklist did / does mention the yoke trim switch, as a note, but how could the pilots know this was actually the most important thing in the desperate and confusing situation they were in? And were they able at all to operate it while pulling 2 negative G’s after that last extreme MCAS application? (2 units of trim at 400+ knots – how could they possibly make a system allowed to do something like that!)

            I don’t know what the checklist will say now, when the aicraft return to service – but what should have been number one from the very beginning, in bold type, was to counter with the manual trim switch, then do the rest of that checklist (quickly, before that MCAS tried to kill you again). Would have worked fine with the NG as well, maintaining commonality. And the procedure should of course have included a big Warning about the MCAS.

            I believe the Max will be safe when it returns to service, it’s just so tragic it claimed all these lives before getting it right, technically and procedurally.

    • Ian: Its a very confused situation, I will try to untangle it as you are getting scattered answers.

      The basic part is that the Stabilizer is moved by a motor that is linked to a jack screw, but there are a couple of elements further before it gets to the jack screw.

      Above the motor is a gear box. Below the gear box (between the motor and the gear box) is a clutch. Its not your car clutch, its fixed pressure clutch (I know one feature it serves and it may service a second) . Automatic gates have the same feature, if a car gets stuck in the gate the clutch lets go.

      The Manual Trim works thorough the gear box (see note at the end)

      So, the switches that are involved in the system remove the control power to the motor (a bit more complicated, there are relays involved for up and down motor ops) more notes.

      So, when you turn the switches off, you no longer have the auto trim but you also do not have the yoke trim buttons working either as they both use the same circuity (aka relays) to make the motor spin one way or the others.

      Switches off the electric trim motor no longer runs.

      At that point you are depending on the much discussed manual trim (which takes a gazillion turns to get effective movement, peop0le can only turn so many RPM but an electric motor (trim) can turn really fast and move as fast as the gearing allows. I don’t know what RPM the trim motor turns, 100s of rpms maybe int the thousand area.

      In essence you sort of have two manual trims, one though the yoke toggle switches though they are really elecric though of course the PF (pilot flying) has to push the button to get it to move one way or the other. Behind the scenes is speed trim to make the air cart feel the same through the range of its motion.

      Now some interesting tidbits.

      Note 1: if the trim motor seizes up, you have a locked system. Ergo, manual trim can still work but you have to break that clutch free. As you don’t want slippage in normal ops, its a pretty hard thing to do and reports are its very very hard. Also note the trim wheel itself is now smaller that it used to be.

      Note 2: At one time there were two trim motors (in the so called Classics 737, ala -300/400/500/600. That is why there are two switches, now they both do the same thing but the other one was for the other trim motor.
      I have yest to see the reasoning for removing the second trim motor nor what affect that has per current setup.

      note 3. Manual trim is exasperated by higher speeds (the stab loads up and is harder to move). Originally they taught a dump the nose, relieve the load, manual trim, then nose back up (a great deal of discussion on this but the FAA has decided the pilots never (well that is patently not true) go there and need to worry their pretty little heads about that. I call it pretending the monster is not in the closet.

      note 4: One of the issues in the electrical world is relays welding the contract together and putting power to the end device and it will not stop.
      The solution to that is the safety is in the power line not the relay coil and you just kill the power. Why this is not followed in the 737 (and possibly other aircraft). I do not know. Its not been a problem I have ever heard about on 737 (or other aircraft0 but it gives a controls tech the heebie jeebies to see that (and yes I have worked on safeties that ensure a motor stops by power removal as welded contacts is possible). Its a separate feature and is vastly safer approach.

      What is amazing is how much assuming Boeing did and ran no tests to confirm the assume. But then Boeing decided putting a nail into a battery was a great test based on not testing of that test as it were.

      I am amazed at my level we did far more testing that Boeing does at its level.

      Any time I designed a circuit, I tested it and tried to make it fail.

      Boeing take is design a circuit and assume it won’t fail.

      On my end it was mostly embarrassment if it did not work in all modes, in
      Boeing’s case, you can kill people with assumptions.

        • 700 is NG. But they have it mixed up and you can’t even go hull length with those models.

          • I sit corrected!

            I could not keep up with all the numbers on the NG. My mistake.

            As a note though, this is all so hosed up.

            A Classic per tech definition is the original system (737-100/200). I don’t know how many Classic Control systems I have retired.

            But no, Boeing decides has to use the term wrongfully on the 300-600. That is corporate pr garbage. Techs hate that.

            Airbus decided that winglets were Sharklets (have you ever seen a shark with two fins X distance apart and parallel not linear? ) No.

            So what we really have is the Classic, Gen 2, Gen 3 and MAX.

            Rant over.

          • Gets confusing, people seem to be referring to the second generation 737 as ‘classic’, which irks me.

            First came 737-100, not many of those.
            Then came 737-200, many built.
            Essentially same but longer, engines were P&W JT8D of various dash numbers.
            (But to irritate techs, pilots, …. there were two versions of the -200, the second one called ADV sometimes, small tweaks to wing features made a significant improvement in airplane performance at the margin (short fields).)

            Then came the models with CFM56 engines, the -300/400/500, which some call Classic and call the original -100 and -200 the Originals. (Sounds like an RnR retro musical group.)

            The NG with larger wing and also some version of CFM56 engines were -600/700/800/900, perhaps with some aerodynamic and function tweaks to reduce field length needs. (Enhanced Performance Package option)

            And then the MAX, -7/8/9/10 with higher bypass ratio version of the CFM56 engines.

            And I don’t list military versions, some of which may be a bit of Frankenplane. (And I’ll call the A330 and A340 Morpenplane, same wing with two or four engines. :-o)

    • The MCAS design was majorly botched.
      Not only but by having to fit into the certificated solution space
      and the sales promise of “no extra training”.
      That forbid things like a dedicated MCAS_off switch ( even though one switch was only an “in series” wart after those trim motor changes.)

      • Switches had nothing to do with trim motor changes. The link I gave for history of 737 runaway trim checklist shows the switches had not changed from the classic model.

        An off switch for MCAS was not forbidden by training requirements or certification. We have training now for MCAS and that has not altered the type designation. Further it has not been added or mandated by the regulators.

        Airlines had requested that training be minimized, and built penalty provisions into the contract to help insure it. Boeing was entirely complicit in this. Not the first time that customers and manufacturers have done that, it’s been a common contractual clause, but is a poor operational practice.

        • ” the switches had not changed from the classic model.”

          The hardware behind the switches has changed
          as two trim motors were folded into one.
          My understanding is that this changed the switch indivial switch functions into a single switch effect by way of in series wiring.

          “Boeing was entirely complicit in this. Not the first time that customers and manufacturers have done that, it’s been a common contractual clause, but is a poor operational practice.”

          Airlines did afaics not know about elevated risk of stall/change of behavior and thus introduction of MCAS to mend this ( in theory.)

          One could tag this as “complicit”.

          But the backstory would indicate that Boeing offered “no Xtra training” to stay (superficially) competitive and silently introduced this hairball of half assed fixes to get there.
          i.e. the complicity of airlines execs was being dumb enough to believe Boeing sales persons.
          After the 787 over achievement that was obviously a dumb thing to do.

          • Uwe, your claim about the evolution of the switches is false, there were never two switches because of two trim motors. Your understanding is wrong.

            Whether two trim motors were merged into one is of no consequence to the MCAS issue or the accidents. It hasn’t been identified as a causal factor, nor have the switches themselves been identified as a causal factor. That is the factual truth, despite what is posted here.

            Neither Boeing nor the airlines advocated additional training until the pilot testing revealed that the mistakes made in the accidents were not isolated or unusual. At that point there was no longer any doubt that training was needed. This is being corrected now in the mandatory training for runaway trim and AoA failure, as well as MCAS.

            The superficially competitive argument is your opinion, but in fact standardizing ratings across various aircraft models is a widespread practice, not just by Boeing. Airlines highly favor this approach, and they are the customer.

            Any airline is free to train above and beyond the minimum standards, and a few of them do. Note that they didn’t build incentives for training into their contracts, they built penalties. Boeing did not require those clauses, the airlines did.

  8. My problem with the FAA & Boeing & Airlines is the fact that Capitalism has taken on more importance than what there real purpose is for & that’s a response to there flying public & there safety first & foremost.

    • Yes, most of us feel that way.

      Currently is how corporations work. GM just acknowledged that the lethal Takata airbag are now magically in need of recall (same ones killing and injuring people in other cars)

      Of course I am sure they did research and it is just a coincidence that when the President is being changed to a consumer interested one they figured they needed to concede before they were forced to.

      But then I am a skeptic and not a Corporate cheerleader.

      • With regard to the GM Takata recalls, they complied with the first recall order, based on the production batch that had the known faulty inflators.

        The NHTSA had mandated a second wave based on a second batch that might have the same issue, due to the use of the same chemical, but in a different design.

        GM had argued that none of this batch had exploded or ruptured, all had functioned correctly in 44,000 deployments in accidents. They also had pulled and tested about 4,000 units by subjecting them to years worth of the high humidity/temperature cycling conditions that cause them to crack. All of those units also deployed correctly when tested.

        However NHTSA rejected GM’s appeal and now the second batch will be recalled and replaced. So it wasn’t magical or related to politics, just the normal resolution of the appeals process.

          • TW, if you have facts to dispute those I presented, you are free to present them, as you always are, but never do.

            This is your go-to move of “all businesses are evil”, followed by ridicule. That’s becoming a bit boring, not even original anymore.

          • Rob:

            You do not present facts. You present corporate propaganda (or Bureaucratic in the case of the FAA).

            Trump says he won the election. By your standards that is a fact.

            The facts say he did not.

            You do not argue facts, you present corporate press releases.

            As Data and Spock would say, you are illogical.

            Or “none are so blind as those who will not see”.

            Its now called a Rob-ism. Corporate press release presented as fact.

            Yep, Trump had the bigger crowd in 2017.

        • TW, this is the usual reversal of truth. I have given the facts surrounding the issue, you have given your beliefs, with no substantiation. As you frequently do.

          The election delivered facts, Trump delivered his beliefs, just the same as you have done here. Pointing at me and trying to reverse that, does not change the facts. It just confirms what I have long said, that like Trump, you don’t differentiate between the truth and what you believe to be true. To you, they are one and the same.

          So I invite you again, to present the facts that justify your position, or to show that my position is incorrect. The facts are what determine the truth.

      • “Yes, most of us feel that way.”

        Most of who?

        Even in the current election for POTUS the higher proportion of votes for the Marxism-founded candidates is not ‘most’ of voters.

        Don’t try to pull the neo-Marxist trick of claiming to speak for everyone.

  9. Regarding RNP-AR. They are excellent tools to access airports where terrain is an issue, but, in Canada, they’re also used for shortening track miles flown, and reducing seperation in terminal airspace. Canada has many RNP-AR approaches. Some airports have RNP-AR approaches that link to STARs, and provide both the flight crew and ATC a nice predictable track and decent path from TOD all the way to the runway. Taking this to another level is Calgary. With two parallel runways, ATC has come up with a method to reduce seperation between traffic approaching opposite sides of the airport using a procedure called Established on RNP.

    https://blog.navcanada.ca/world-first-nav-canada-implements-new-icao-separation-standard-at-yyc/

    It’s worked very well at Calgary, and I’ve heard they were considering expanding it to Vancouver and Toronto (grain of salt there). Given both Air Canada and WestJet will want to use this procedure with their MAXs, I’m curious to see what Transport Canada comes up with.

    Cheers!

    • I saw this only after having written a similar comment regarding Norway. RNP has given us approaches to runways where we previously had none because of the terrain, and at others we save a lot of track miles. So our experiences are similar it seems! 🙂

      • Yep. Juneau is very Norway like. Not true Fjords, mainland on one side and an Island on the other in a more or less North South aspect.

        As I recall Juneau was an NDB fix on the final turn and then onto the final with the VOR and finally the ILS

  10. Tell pilots their aircraft is fitted with MCAS. Provide on/off switch. Only an idiot would ever turn it on.

    • Some day this may get sorted, but the ruling was it was deemed needed.

      From the EASA report, no.

      If the pilot could turn it off he wold be in violation.

      We don’t need manual trim because no one flies here (well they do don’t they, aka Ethiopia 302)

      But MCAS even though it only actives right at stall, yep.

      So the FAA and other regulators cherry pick.

      Weird stuff.

      All I can say is once a Bureaucracy makes a decision only a big asteroid strikes changes their mind (if it lands on top of them and removes them)

      Part of my job at one time was to make tech recommends. I found out we had been sold a bill of goods on grease on a couple of aspects.

      I did the research and reported , we need to change that grease, we were sold a bill of goods. Its not compatible with what most mfgs put in their bearings.

      No, we can’t do that, corporate will kill us. Amazing, like corporate even looks at our grease orders? I don’t think so.

      But they never changed their mind though they complained about all the bearings that were going out too soon. Weird stuff.

  11. Nov 4: Boeing has delayed plans to manufacture the new 737 Max 10 jet at its Renton factory for as long as two years, Ryanair Group CEO Michael O’Leary said.

    • No change from the 2022 expectations Boeing had given earlier, in the third quarter earnings call.

      The exact quote from Ryanair:

      “I think the MAX 10 deal will be a little longer. The MAX 10 has slightly been delayed, because one of the issues with Boeing and the FAA and EASA is they’ve committed to more design changes on the MAX 10. So I think the first MAX 10 has been delayed or pulled back by two years or something.”

      “Boeing’s priority at the moment is to get the MAX back in the air and get the 200 certified and delivered, to eliminate the backlog of deliveries, which take them 12 or 18 months to get rid of that, and then really focus on changing the design of the Max 10s and delivering another great aircraft.”

      “The 737 is the greatest aircraft ever built. It is the backbone of most airline fleets across the world. And we’re very proud to be one of Boeing’s leading partners across the world.”

  12. “…these likely include the third synthetic AoA sensor that EASA wants..”

    To be sure, do you mean:
    – a third AOA vane (a sensor_
    OR
    – addition of ‘synthetic AOA’ computation (which isn’t a ‘sensor’
    ?

    Seems to me that ‘synthetic AOA’ has the advantage of independence from the AOA vanes which depend on airflow.

    • The third AoA value appears to the aircraft as a sensor, regardless of the source (physical or synthetic). Also the synthetic computation would be manifested within a new device, so in effect that device can be regarded as an independent sensor.

      In the 787, the “central core” computers are robust enough to absorb & consolidate many computational functions like this. That wouldn’t be the case for the 737, it would need an add-on system. That’s why the 787 SADS cannot simply be copied or transferred to the MAX. Nor does the 787 SADS synthesize AoA.

      Synthetic AoA is trickier than most other metrics in synthetic air data. It’s possible but will require extensive development. So Boeing will have to decide how best to proceed. Other physical sensors besides vanes are also possible.

      • I use ‘sensor’ to mean direct sensing, like the AOA vane, TAT probe, pitot probe, radar, pants (seat of :-), …

        Everything else is artificial. (Even Mach number is calculated, from airspeed and other parameters.)

        Albeit sensors are massaged by computers, probably the AOA vane included.

        A computer is not a sensor.

        (Other sensors are possible you say? Interesting. Mebbe Doppler navigator beams I speculate – well no, that’s ground notion not airflow referenced, it is pitch attitude. :-o)

        • Keith, there are a couple kinds of pressure-based AoA sensors, and more have been proposed. I don’t know if they would meet commercial aviation standards. They are used in civil aviation in place of vanes.

          • Thanks.

            I’ve been told that United/Sundstrand Data Control in Redmond WA produced an angle of airflow sensor using rows of air holes on a shaft sticking out from the fuselage, but it was prone to blockage of the holes from things in the air.

            I understand that small aircraft sometimes have a tab at wing LE that moves a switch for stall warning. Such aircraft don’t have LE lift devices, don’t know if they even had TE flaps.

            The Rosemount AOA vane has been around a long time, probably should be redesigned for better internal reliability, but externally is prone to damage.

            Siting of any sensor would take study and flight testing.

      • Thanks for pointing to the difficulties of computing a ‘synthetic AOA’ parameter to cross-check AOA sensing vanes with.

        (Background: the computed parameter ‘Mach’ (number) is very important for safety, so as to not exceed a limit value.

        Development testing includes an overspeed test, from which an operational Mach limit is established, providing a margin for overspeed if upset.

        Eurosnobs who like to bash Boeing herein might explain why Airbus didn’t grasp that in a pitch to USAF. They confused that test with KC-135s diving to go faster for fighter aircraft. In both cases diving the airplane may be required because thrust in level flight is not sufficient to get the desired speed. (Which in the first case is a flight test overspeed, in the second trying to get to maximum approved operating speed.)

  13. There are media reports that FAA have issued the first certificate for a modified 737MAX. https://www.theglobeandmail.com/business/international-business/us-business/article-faa-issues-first-certificate-for-a-boeing-737-max-since-march-2019/ (paywalled)

    American Airlines is actively preparing to fly in revenue service, planning one flight a day initially, starting December 29, 2020: https://www.msn.com/en-us/travel/news/how-american-airlines-plans-to-restore-confidence-in-the-boeing-737-max/ar-BB1bAlOM

    Appears AA has been maintaining the aircraft with regular maintenance.

    AA has now flown media and relatives of employees on MAX.

    It is being proactive in order to demonstrate confidence in the aircraft.

    (More on Transport Canada approving flight soon:
    https://www.cbc.ca/news/politics/boeing-737-max-soon-to-be-ungrounded-canada-1.5826075 (dated December 2)
    Families have been pushing TC hard to do more checking, and to explain how the certification system will prevent more crashes.

    And one of the usual suspects rants to Transport Canada as he did to the FAA, I cut that Marxist some slack because tragically a grand-niece died in the Ethiopian crash.)

  14. Keith Sketchley,

    About the 737 generations: Absolutely correct. Only that in the company I flew for before we were bought up, where we went through the first three 737 generations – we called the -200 “the “Scud”. 😀 (After some not very accurate missiles used by Iraq in the first Gulf war…)

Leave a Reply

Your email address will not be published. Required fields are marked *