
Boeing 737 Max Simulators Are in High Demand, But Flawed - howard941
https://www.nytimes.com/2019/05/17/business/boeing-737-max-simulators.html
======
bronco21016
I’m not sure where the misconception comes from about simulator training being
equal to the aircraft being a new type certificate. The DC-9/MD-80 series/B717
are all the same DC-9 type certificate despite spanning many decades, longer
than the 737 even. Pilots receive a DC-9 type certificate to fly any variant,
however, for obvious reasons, the FAA requires what’s known as differences
training in a simulator to transition between the different aircraft.

I can’t possibly imagine that the FAA is or any aviation governing body is
going to jump from iPad distance learning to full on new type certificate.
B737 type rated pilots will receive 2-3 sessions in the MAX simulator and be
sent on their way flying 737NG and MAX variants and the aircraft will go on to
have a normal safety record.

The more concerning aspect of this entire situation is finding where the
system broke down to prevent this additional training to begin with and how do
we fix the breaks in that system.

~~~
ozmaverick72
They will have to fix the simulator first. As I understand it they can't
currently simulate the handling of the aircraft under MCAS failure modes. If
they correct the simulator and require pilots to train for the handling of
MCAS failures then I have to problem with the reintroduction of the max on the
same type certificate. From what we are hearing in the press it sounds like
Boeing is still pressing for nothing more that a dumb iPad lesson. If the FAA
falls for that they will loose all credibility in my eyes.

~~~
wjnc
Has the whole world subscribed to FAA oversight or would other regulators be
able to pick their own fight with Boeing?

~~~
lrem
EU has its own oversight that has, at least at some point in the past, been
pretty much copying FAA word-for-word. Other countries obviously have their
own, but also leaned on FAA for its influence. Yet another aspect of soft
power of the US.

------
tlb
How would you accurately simulate the force needed to turn the trim wheel
under aerodynamic loads that vary with elevator position? It sounds like a
very tricky mechanical setup.

~~~
krallja
Brakes, or a strong motor.

~~~
dbcurtis
The way I would approach it (based on mechantronics I have done for robots) is
to back up the control wheel with an encoded motor. (Position/rotation encoder
on the tail shaft.) The encoder will give you wheel position, the motor allows
you to apply arbitrary torque to the wheel to simulate the feedback forces
felt by the pilot. Typically, that would be done by measuring motor current
and writing a control loop that controlled for target wheel position (based on
encoder) and target maximum motor current (as a proxy for torque). Then the
simulator would give out the simulated results of wheel position and torque,
which the control loop would attempt to follow with its control law.

Alternatively, you could put an actual torque sensor between the motor and the
control wheel, which might buy you some accuracy at considerably more expense.
For a flight simulator, expense is unlikely to be an issue -- I tend not to
have that luxury, and typically don't need that much accuracy anyway.

These kind of control systems are all over modern aircraft, much less
simulators. Any new grad control systems engineer should be able to knock
something like this out.

~~~
blattimwind
> The way I would approach it (based on mechantronics I have done for robots)
> is to back up the control wheel with an encoded motor. (Position/rotation
> encoder on the tail shaft.) The encoder will give you wheel position, the
> motor allows you to apply arbitrary torque to the wheel to simulate the
> feedback forces felt by the pilot. Typically, that would be done by
> measuring motor current and writing a control loop that controlled for
> target wheel position (based on encoder) and target maximum motor current
> (as a proxy for torque). Then the simulator would give out the simulated
> results of wheel position and torque, which the control loop would attempt
> to follow with its control law.

Or you just buy a COTS servo that does all that for you. Just saying, hardly a
need to reinvent these particular wheels...

~~~
dbcurtis
Yeah, good point. I'm sure there are servos that have the required specs. I'm
just not in the habit of looking at catalogs where the prices are that high :)
Maybe I should switch to building flight simulators so that I can order the
good stuff :)

~~~
rasz
racing sim guys already figured it out
[http://opensimwheel.wikidot.com/](http://opensimwheel.wikidot.com/)

------
forgetcolor
Why does MCAS have to take control of trim at all? Would it not be sufficient
to alert the pilot of an imminent stall situation so they can adjust the angle
of attack themselves? Is it because doing so would put the MAX too far afield
from the old 737 such that it would require simulator training?

~~~
cjbprime
There's an airworthiness rule requiring monotonically increasing yoke
backpressure as the plane approaches a stall. It appears that the MAX violates
this rule aerodynamically due to extra lift at high power generated by the
high and forward nacelles, combined with the yoke being mechanically coupled.
It can get easier to induce a stall as the plane approaches critical AoA.

This isn't directly the same thing as saying the MAX will stall itself: if you
aren't pulling back on the yoke near critical AoA then you don't stall. It's
just easier to stall with the yoke than regulations say it must be. MCAS
"fixes" that handling issue.

I don't think an audible warning would be sufficient to turn unairworthy
behavior into airworthy, so if all the assumptions above are correct, that's
why it has to use trim -- or a stick pusher, but perhaps that wouldn't have
enough control authority and also I'm not sure the MAX _has_ a stick pusher,
as opposed to just a stick shaker. It's a very mechanical cockpit, in general
the forces you feel are coupled to aerodynamics, in stark contrast to an
Airbus (or even more modern Boeing airframes).

~~~
cmurf
Maybe it's 25.173(c)
[https://www.law.cornell.edu/cfr/text/14/25.173](https://www.law.cornell.edu/cfr/text/14/25.173)

In the working case, MCAS presumably triggers at a particular AoA, trims nose
down (but is this a fixed amount and what is it?) which in effect requires
more stick back pressure to maintain the angle of attack. Thing is, it seems
like MCAS, again in the working case, has a trigger AoA and will incrementally
nose down until it goes below some defined angle of attack - which is not
really a stick force moderator alone. It's acting as a kind of AoA guardian.

------
bumby
A good software assurance program in a flight environment should also be
ensuring simulators are of high enough fidelity for testing and training.

As this story develops, it sure seems like there are either gaps in Boeings QA
program or there is a culture that overrides quality concerns

~~~
crocal
> A good software assurance program in a flight environment should also be
> ensuring simulators are of high enough fidelity for testing and training.

Actually, "must" not "should". Aeronautics certification standards require
tools such as simulators to be qualified for their intended use. Similar
requirement have been introduced in recent release of railway standards.

~~~
bumby
I agree with you're correcting my imprecise wording, but it still seems like
there's an issue with the certification process if this particular "must"
didn't get built in.

I guess my question is: why didn't the QA flag get raised on this or if it
did, why wasn't it given any credence?

I'm not trying to armchair quarterback this, but I'm legitimately curious if
this issue is one the certification process is expected to catch

~~~
bbayer
Certification process is generic enough to apply it to different types of
aircrafts. There is no specific requirements for different subsystems
introduced by manufacturer. Simulation fidelity is tested against real world
data but it is not possible to collect data for every condition that might
occur during flight. You may refer to FAA FSS Level-D QTG document for further
reference. [1]

[1]:
[https://www.faa.gov/about/initiatives/nsp/media/14CFR60_Sear...](https://www.faa.gov/about/initiatives/nsp/media/14CFR60_Searchable_Version.pdf)

------
heisenbit
Considering how fast and strong the trim wheel is spinning under MCAS control
the simulator may be unsafe to use. Touching a wheel spinning so fast is
outright dangerous.

~~~
tjohns
The trim wheel spins like that anyway under normal operation, both due to
pilot input and while on autopilot.

More importantly, you don't grab the trim wheel while it's moving... If the
aircraft is operating normally, you use the trim switch on the yoke.

The only time you'd spin the trim wheel by hand is if you've had to cutout the
electric trim motor... and once that's done it's not going to move on its own
anyway.

~~~
tgsovlerkhgsel
> once that's done it's not going to move on its own anyway.

Unless the short is somewhere where you don't expect it to be, which is why a
memory item if the runaway trim continues is

    
    
        STABILIZER TRIM WHEEL - GRASP and HOLD

~~~
Doxin
They teach pilots a specific way to grab the trim wheel for that scenario as
to not break their wrists. It still can (and occasionally does) cause abrasive
wounds to the hands however.

------
jayalpha
"who will need to approve them before the plane can start flying again."

Yes, thanks. I guess I pass for now.

------
inamberclad
Every simulator is flawed, some are useful.

------
FabHK
Small nitpick: I don't think MCAS is well characterised as an "anti-stall
system".

~~~
avar
From
[https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...](https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Augmentation_System#Operation)

> "The system is explicitly designed to override pilot action and prevent them
> from regaining control authority, in order to avoid an inadvertent stall."

If it's not an anti-stall system what would you characterize it as?

~~~
FabHK
Good question. Not sure the "flight envelope protection" description in the
Wikipedia article is good.

If I'm not mistaken, MCAS was put in to fulfil certification requirements
stipulated in 14 CFR § 25.173 - Static longitudinal stability, and § 25.175
Demonstration of static longitudinal stability, which states that "The stick
force curve must have a stable slope". The MAX has a curved slope in some
regions of the flight envelope, due to the fact that the nacelles generate
lift in front of the centre of gravity. (It is not clear to me whether the
slope of the stick force at high AoA in a MAX without MCAS goes negative, or
just decreases (while staying positive)).

Note the Wikipedia article you quote also says:

> It is thus distinct from an anti-stall device, such as stick pusher which
> physically moves the pilot's control column forward when the airplane is
> approaching a stall.[5]

See also here [1]:

> Numerous reports have incorrectly said that MCAS is a stall prevention, or
> stall recovery, system. It is a Maneuvering Characteristics Augmentation
> System and would not be expected to activate during any normal flight
> conditions.

Or here:

>> It does seem MCAS is closely related to protecting the plane from entering
a stall scenario.

> Only in the sense that it is giving the pilots the feedback, through the
> stick force, about how close the plane is to a stall, that the pilots are
> used to from previous 737 models. The point of MCAS is that without it, the
> stick force feedback as a function of angle of attack would be different
> from what the pilots were used to, so they might misjudge how close to a
> stall they were.

[1]
[https://www.pilotsofamerica.com/community/threads/engineers-...](https://www.pilotsofamerica.com/community/threads/engineers-
take-on-the-737-max-design.118273/)

[2] [https://www.physicsforums.com/threads/boeing-737-max-mcas-
sy...](https://www.physicsforums.com/threads/boeing-737-max-mcas-
system.967958/page-3)

------
FabHK
Question:

> In a tense meeting with the American Airlines pilots union after the crash,
> a Boeing vice president, Mike Sinnett, said he was confident that pilots
> were equipped to deal with problems, according to an audio recording review
> by The New York Times. A top Boeing test pilot, Craig Bomben, agreed,
> saying, “I don’t know that understanding the system would have changed the
> outcome of this.”

Should that be Craig Bomben "disagreed"?

~~~
voxic11
No he is agreeing that the pilots were as well equipped as they could have
been, because he believes understanding the system wouldn't have made a
difference anyways.

~~~
droithomme
Ok, so you believe it was a sarcastic response. Very interesting take. You
might be correct.

~~~
FabHK
I don't think it was a sarcastic response, and I don't think GP meant it that
way, either.

Remember, Boeing at the time had not disclosed MCAS to the pilot community.
Both speakers are from Boeing, and the first one says that the accident
pilots, even though they did not manage to fix the problem, were well equipped
(by standard Boeing procedures for stab trim runaway) to do so. The second
speaker agrees, saying that knowing about MCAS would not have made any
difference.

~~~
droithomme
_> The second speaker agrees, saying that knowing about MCAS would not have
made any difference._

The article directly quotes him as saying, "I don’t know that understanding
the system would have changed the outcome of this." The "this" refers to a
deadly crash in which everyone died. He is saying that if a pilot knew about
MCAS, the plane still would have crashed. He said this in response to a claim
that pilots didn't need to know about MCAS. That is disagreeing by using
sarcasm. The Times interprets it though as agreeing and doesn't see the
sarcasm.

To summarize:

Claim: Pilots don't need to know about MCAS.

Response: Correct, even if they knew, given the system's flawed design,
everyone still would have died in this case, so, technically, knowing about it
wouldn't have helped.

Now maybe that's not what he meant. But it looks like he did. I don't believe
that the context of the conversation supports an interpretation that he was
agreeing that sufficiently skilled pilots would not have crashed whether or
not they knew about MCAS given that he refers to "the outcome of this" not
changing, the "outcome of this" being the crash.

~~~
cptskippy
What part if that is sarcasm? If anything he's saying a failed AOT sensor
means a fatal crash regardless of whether you know why or not. Which is
alarming and terrifying.

~~~
FabHK
Given that he's a Boeing test pilot (and in the context of agreeing with the
VP), his take would probably be that pilots should have followed the good old
Stab Trim Runaway checklist, and all would've been fine (whether or not you
know about MCAS).

~~~
cptskippy
I am genuinely confused though about how his remarks we're sarcastic.

~~~
FabHK
I agree with you that the test pilot's remarks were not sarcastic. However,
you write "he's saying a failed AOT sensor means a fatal crash regardless of
whether you know why or not", and I disagree with that. He's saying a failed
AoA sensor invoking MCAS can be fixed like any other Stab Trim Runaway,
regardless of what you know about MCAS.

~~~
salawat
Except that it doesn't manifest like a classic Stabilizer Trim Runaway.

The classic Stabilizer Trim Runaway is a continuous uncommanded actuation of
the trim mechanism on a particular direction.

Catastrophic MCAS failure manifests as a series of discrete, amplifying
activations, which are far easier for a pilot to dismiss as the normal
operation of the Auto-Trim, and speed trim systems.

The is is a manifestly different pattern to look for, and was only caught by
one air crew (on the penultimate flight of the Lion Air aircraft) by the
assistance of a third, uninvolved pilot along for the ride.

I understand how one could see Boeing's internal test pilot as being
reasonable, but keep in mind who signs his paycheck, and future prospects for
him if the company gets found liable.

Perspective, and understanding of what different parties have at stake is
essential in evaluating what is _actually_ being communicated, and why. Words
have long tails in the aftermath of a crisis like this.

~~~
FabHK
Yes, agreed with everything. I don't think Boeing's test pilot's dismissal
(basically: they had their checklists, and knowing about MCAS wouldn't have
made a difference) was reasonable, but neither do I think it was sarcastic.

------
droithomme
_> Boeing has maintained that simulator training is not necessary for the 737
Max and regulators do not require it, but many airlines bought the
multimillion-dollar machines to give their pilots more practice._

Boeing is only arguing this because if they say simulator training is
necessary, then the plane _must_ be recertified. Their executive MBA analyst
and stock watcher types under no circumstances will tolerate recertification,
therefore regardless of facts, their position _must_ be that simulator
training is not necessary. Even though it obviously is. Key point to observing
this and everything else about this debacle is that Boeing has no concern
whatsoever for safety, professionalism or lives, and is only interested in
their own profit, executive bonuses, and stock dividend gains and will do
absolutely anything to protect those, even though it inevitably is going to
lead to another crash and more deaths. At which point they will again start by
doing everything they can to blame the pilot and the culture of whatever
country he hails from, as well as paying shills to post nonsense and attack
pilots, engineers and others who question their narrative publicly.

~~~
MaxBarraclough
But that's only half the story.

The other half is that the FAA -- which is meant to be the counterweight to
those perverse incentives -- is no longer credible.

(I've made this point before [0] but it bears repeating here.)

[0]
[https://news.ycombinator.com/item?id=19888207](https://news.ycombinator.com/item?id=19888207)

~~~
SilasX
That’s not making the point; that’s just asserting it.

~~~
virtual_void
I’m confused as to the difference.

No snark intended.

I’m likely missing something.

~~~
jplayer01
[https://en.wiktionary.org/wiki/make_a_point](https://en.wiktionary.org/wiki/make_a_point)

"(idiomatic) To argue or promote an idea."

It isn't enough to just say a statement when you want to make a point. It's
usually expected, especially here on HN, to put some effort into demonstrating
why you believe that statement is true, something which his linked comment
doesn't do. It doesn't need to be anything elaborate, even references to other
comments mentioning things FAA has done would be more than enough to make the
point, which gives people something factual or "real" to respond to or look
into.

I don't think there's anything wrong with his statement per se. You don't
always need to write a treatise whenever you want to join a discussion or
throw in your two cents. Just that when he says he's made the point before,
it'd be more helpful to link to something more substantial than the same
statement in a different place.

~~~
SilasX
Thank you, confirming this is what I meant (except this is better than I could
have said it myself).

------
gist
> Since the two fatal crashes of the Boeing 737 Max, airlines around the world
> have moved to buy flight simulators to train their pilots. They don’t always
> work. Boeing recently discovered that the simulators could not accurately
> replicate the difficult conditions

Typical article which does not address the entire context of the issue. In
other words it isolates what a 737 simulator can't do without regard to what a
typical simulator (for another aircraft or by even a different manufacturer)
is or is not able to do. [1] The idea is to make the manufacture look like a
total ignorant screw up in every way to create anger and compelling content.

[1] This is like a news story talking about what a company fails to do and
then gets hacked without talking at all about how likely the same thing
happens at another company.

~~~
FabHK
Are you suggesting that most simulators get control forces wrong for things
that can realistically occur within the recoverable flight envelope after one
single sensor fails? I'd have thought that that is something you'd want to get
right.

