Indonesian aircraft missing off Jakarta
Join Date: May 2017
Location: San Diego
Posts: 66
Likes: 0
Received 0 Likes
on
0 Posts
"You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha?"
Well, I'm not a pilot but I have written a lot of laboratory/experimental software. Before a chunk of data is allowed into the record, it is compared with the expected value and trend over the last 5 minutes - if it is >(say)5x the expected value it gets discarded as anomalous and an interpolated value substituted. Inputs must be sanity checked before being accepted.
Having said that, writing more and more code can easily introduce race conditions and more corner-case results, so it is far from easy.
Mac
Well, I'm not a pilot but I have written a lot of laboratory/experimental software. Before a chunk of data is allowed into the record, it is compared with the expected value and trend over the last 5 minutes - if it is >(say)5x the expected value it gets discarded as anomalous and an interpolated value substituted. Inputs must be sanity checked before being accepted.
Having said that, writing more and more code can easily introduce race conditions and more corner-case results, so it is far from easy.
Mac
In a real-time dynamic environment of an aircraft, we can apply estimation algorithms to do a better job at detecting which AOA vane is bad. Sanity checks, reasonableness tests, whatever you want to call it, that Artificial Intelligence is only used to find a bad sensor. That way, it would take multiple failures of more than one subsystem instead of just taking one lone AOA vane value to cause an accident.
Certainly to use any algorithm would require healthy air data & inertial boxes, and the sanity check algorithm would need to be disabled if those redundant systems were determined sick. Those all go into the FTA/FMEA mentioned.
In the past, I've seen sanity check algorithms experience resistance from old management. They think "we've never had to do that before" and "we don't know how the FAA would certify the sanity check" and "Don't cost the company extra expense or you're fired." types of arguments. They are very conservative. 'Split Cockpit' design philosophy here extended to nose-down trim authority, which I think crossed a safety line.
Should the training be mandated by the FAA against assumptions and is it affordable in time/cost?
It would seem that when an operator chooses to operate an airplane they are the one that assumes that their specified training is good enough. If you expect Airbus and Boeing etal. to accept risk then you must sign this off somehow.
Join Date: Jul 2013
Location: Pittsburgh
Posts: 129
Likes: 0
Received 0 Likes
on
0 Posts
Only a software engineer but
.....from reading all the excellent info here, is it too simplistic to say that the airframe’s aerodynamic characteristics were a poor fit for the much-more powerful engines?
Thus extra software logic trees having to save the day, and said patches ultimately finding themselves cornered by certain exception scenarios.
I mean, it just sounds like you couldn’t safely put these engines on this airframe. Am I too simplistic?
Thus extra software logic trees having to save the day, and said patches ultimately finding themselves cornered by certain exception scenarios.
I mean, it just sounds like you couldn’t safely put these engines on this airframe. Am I too simplistic?
Join Date: Oct 2011
Location: Lower Skunk Cabbageland, WA
Age: 74
Posts: 354
Likes: 0
Received 0 Likes
on
0 Posts
What does that leave us with?
Should the training be mandated by the FAA against assumptions and is it affordable in time/cost?
It would seem that when an operator chooses to operate an airplane they are the one that assumes that their specified training is good enough. If you expect Airbus and Boeing etal. to accept risk then you must sign this off somehow.
Should the training be mandated by the FAA against assumptions and is it affordable in time/cost?
It would seem that when an operator chooses to operate an airplane they are the one that assumes that their specified training is good enough. If you expect Airbus and Boeing etal. to accept risk then you must sign this off somehow.
Last edited by Organfreak; 17th Nov 2018 at 19:17. Reason: typo
In the past, I've seen sanity check algorithms experience resistance from old management. They think "we've never had to do that before" and "we don't know how the FAA would certify the sanity check" and "Don't cost the company extra expense or you're fired." types of arguments. They are very conservative. 'Split Cockpit' design philosophy here extended to nose-down trim authority, which I think crossed a safety line.
I don't know what happened during the certification of MCAS, but I seriously doubt it was management interference. Educated guess is that it simply wasn't identified as a flight critical system and didn't get the level of scrutiny appropriate for a system that can have catastrophic consequences if it malfunctions.
Last week FAA spokesman Greg Martin said
On the face of it, a fairly boilerplate statement under the circumstances. However, I've been wondering if the MCAS would have been the only stall protection triggered by erroneous AoA data. The -800 FCOM states:
Can anyone familiar with the systems comment on whether the EFS and/or speed trim protections would likely have been active? Looking at the Runaway Stabilizer checklist, I'm struck by the fact that in the circumstances either or both the EFS and/or speed trim protections may have posed a serious impediment to recovering from an MCAS induced stab trim pitch down.
may be somewhat problematic if the EFS is increasing forward control column force to approximately four times normal feel pressure, and
If the trim system senses that the AoA is already at or aboveabove stickshaker AoA will it recognise nose up trim commands using the main electric trim? (ie will it allow the aircraft to be trimmed further into the 'perceived' stall?)
“the angle of attack values used by several systems, including the air data, the fight controls, the stall warning, etcetera, the safety analysis for each of these systems are currently being reviewed.”
Stall Identification
Stall identification and control is enhanced by the yaw damper, the Elevator Feel Shift (EFS) module and the speed trim system. These three systems work together to help the pilot identify and prevent further movement into a stall condition.
During high AOA operations, the Stall Management/Yaw Damper (SMYD) reduces yaw damper commanded rudder movement.
The EFS module increases hydraulic system A pressure to the elevator feel and centering unit during a stall. This increases forward control column force to approximately four times normal feel pressure. The EFS module is armed whenever an inhibit condition is not present. Inhibit conditions are: on the ground, radio altitude less than 100 feet and autopilot engaged. However, if EFS is active when descending through 100 feet RA, it remains active until AOA is reduced below approximately stickshaker threshold. There are no flight deck indications that the system is properly armed or activated.
As airspeed decreases towards stall speed, the speed trim system trims the stabilizer nose down and enables speed trim above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced.
Stall identification and control is enhanced by the yaw damper, the Elevator Feel Shift (EFS) module and the speed trim system. These three systems work together to help the pilot identify and prevent further movement into a stall condition.
During high AOA operations, the Stall Management/Yaw Damper (SMYD) reduces yaw damper commanded rudder movement.
The EFS module increases hydraulic system A pressure to the elevator feel and centering unit during a stall. This increases forward control column force to approximately four times normal feel pressure. The EFS module is armed whenever an inhibit condition is not present. Inhibit conditions are: on the ground, radio altitude less than 100 feet and autopilot engaged. However, if EFS is active when descending through 100 feet RA, it remains active until AOA is reduced below approximately stickshaker threshold. There are no flight deck indications that the system is properly armed or activated.
As airspeed decreases towards stall speed, the speed trim system trims the stabilizer nose down and enables speed trim above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced.
Control airplane pitch attitude manually with control column ...
... and main electric trim as needed.
Last edited by MickG0105; 17th Nov 2018 at 22:17. Reason: Word choice correction
In the GA world, there is a probeless AOA , description here, based on Sperry Patent #3,948,096.
Join Date: May 2017
Location: San Diego
Posts: 66
Likes: 0
Received 0 Likes
on
0 Posts
Quagmire, when Boeing became a delegated authority, they implemented robust protections against "Undo Pressure" - arguably much better than before delegation. ............ Educated guess is that it simply wasn't identified as a flight critical system and didn't get the level of scrutiny appropriate for a system that can have catastrophic consequences if it malfunctions.
In the GA world, there is a probeless AOA , description here, based on Sperry Patent #3,948,096.
MickG0105 reported above: Last week FAA spokesman Greg Martin said, Quote:“the angle of attack values used by several systems, including the air data, the fight controls, the stall warning, etcetera, the safety analysis for each of these systems are currently being reviewed.”
When writing pitch control laws, the rule is to avoid use of dual sensors in favor of triplex sensors only, where the elevator is involved especially. AOA failures shouldn't affect autopilot modes anyway. This nose down stall protection is similar.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
My understanding is that manual electric trim overrides the Speed Trim System (STS) for 5 seconds, ie if a manual electric trim input is added every 4.9 seconds, STS will not apply nose down trip at high AoA. However as you correctly note, the Elevator forces to hold this high AoA will increase dramatically due to the EFS operation. Pushing forward will feel easy, any back pressure will be significantly more difficult. This protection is another subtle way the system is saying "do you really want to keep pitching nose up", together with the other clues stick shaker and the "stall stall stall" callouts added after the Turkish accident IIRC.
The MCAS however, appears operate at high AoA unless the stab trim switches are in the cutout position. These switch are never touched in normal operation.
Here is a recent stall training video, I believe it may be the MAX. Unfortunately, the trim wheel is difficult to see, and it's not clear if the PF or STS/MCAS is trimming.
Join Date: Mar 2015
Location: antipodies
Posts: 75
Likes: 0
Received 0 Likes
on
0 Posts
How about this for an out of range response.
in case computer senses unreliable data, or in case of pilot disengaging Autopilot.
1 audible alarms are silenced
2 flight display dissapears and is replaced by a full screen attitude display from the selected gyro (the other two gyros displayed small to one side)
3 tastefully displayed at the perimiter of said attitude display could be some suggested thrust settings for common scenarios
4 any further audible prompts must only be driven from the selected gyro
I cannot see the logic of allowing alarms to continue if their data is suspect!
in case computer senses unreliable data, or in case of pilot disengaging Autopilot.
1 audible alarms are silenced
2 flight display dissapears and is replaced by a full screen attitude display from the selected gyro (the other two gyros displayed small to one side)
3 tastefully displayed at the perimiter of said attitude display could be some suggested thrust settings for common scenarios
4 any further audible prompts must only be driven from the selected gyro
I cannot see the logic of allowing alarms to continue if their data is suspect!
Good insights MickG0105, good addition to the knowledge base.
My understanding is that manual electric trim overrides the Speed Trim System (STS) for 5 seconds, ie if a manual electric trim input is added every 4.9 seconds, STS will not apply nose down trip at high AoA. However as you correctly note, the Elevator forces to hold this high AoA will increase dramatically due to the EFS operation. Pushing forward will feel easy, any back pressure will be significantly more difficult. This protection is another subtle way the system is saying "do you really want to keep pitching nose up", together with the other clues stick shaker and the "stall stall stall" callouts added after the Turkish accident IIRC.
The MCAS however, appears operate at high AoA unless the stab trim switches are in the cutout position. These switch are never touched in normal operation.
Here is a recent stall training video, I believe it may be the MAX. Unfortunately, the trim wheel is difficult to see, and it's not clear if the PF or STS/MCAS is trimming.
My understanding is that manual electric trim overrides the Speed Trim System (STS) for 5 seconds, ie if a manual electric trim input is added every 4.9 seconds, STS will not apply nose down trip at high AoA. However as you correctly note, the Elevator forces to hold this high AoA will increase dramatically due to the EFS operation. Pushing forward will feel easy, any back pressure will be significantly more difficult. This protection is another subtle way the system is saying "do you really want to keep pitching nose up", together with the other clues stick shaker and the "stall stall stall" callouts added after the Turkish accident IIRC.
The MCAS however, appears operate at high AoA unless the stab trim switches are in the cutout position. These switch are never touched in normal operation.
Here is a recent stall training video, I believe it may be the MAX. Unfortunately, the trim wheel is difficult to see, and it's not clear if the PF or STS/MCAS is trimming.
That's not a MAX. The simulator software referred to in the video is very new in airline operations. The old software was found to be unrealistic in terms of upset recovery, feed back and stall recovery. The new software gives the pilots G feedback in all axis, limits and parameters for unusual attitude training.
The positive and negative G limits on the 73 are very easy to exceed. Especially in yaw. Nobody really knew they were doing it, until this software was introduced.
Join Date: Jul 2008
Location: Dubai
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
True there. Odd & tragic & stupid how just ONE AOA (alpha) sensor can cause nose down pitch trim. One can argue about the Human Factors involved here concerning stress, panic, time to decide what to do, etc., but I tend to come down on the side of "don't over-stress tired human brains", from the Flight Controls Engineer viewpoint I have.
Assuming the crash was caused by the AOA alpha vane ... continuing on:
"Analytical Redundancy" would have prevented this problem, as it would add a third alpha to the dual vane measurement to break the tie between 2 vane sensors. ... Note that alpha = theta - gamma, received through air data & inertial sensors apart from the alpha vanes. That caclulated third alpha makes the system triple redundant, along with using median value selection.
You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha? Remember we have pitch rate sensors, accelerometers, pitot-static tubes, etc. to help the alpha fault detection out. Remember alpha-dot = pitch rate - (accelerometer / speed); we can use all the kinematic laws to do this.
All the above is what a very fast, sharp, smart pilot or flight engineer would do in a millisecond if they saw an alpha vane sensor measurement hard-over (high) all of a sudden. It would be obvious to an observer actually seeing the sensor values along with the trimmed aircraft state to decide it's a bad sensor. That is if a human could see & monitor the raw sensor values in real-time to make that clear judgement. Computers can.
Algorithms such as the above, along with complementary or Kalman filtering to filter out spectral noise and emphasize the short term estimation of valid alpha would also help. I won't go into the signal processing or kinematic blending algorithms here, but I will say you wouldn't need much.
And, finally, where was the FTA & FMEA in all this? I guess they thought the nose-down trim would be easily countered by pilots & was not deemed catastrophic. Again, Human Factors, and I'm on the side of "don't put the plane in peril and expected tired or paniced pilots figure it out".
Assuming the crash was caused by the AOA alpha vane ... continuing on:
"Analytical Redundancy" would have prevented this problem, as it would add a third alpha to the dual vane measurement to break the tie between 2 vane sensors. ... Note that alpha = theta - gamma, received through air data & inertial sensors apart from the alpha vanes. That caclulated third alpha makes the system triple redundant, along with using median value selection.
You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha? Remember we have pitch rate sensors, accelerometers, pitot-static tubes, etc. to help the alpha fault detection out. Remember alpha-dot = pitch rate - (accelerometer / speed); we can use all the kinematic laws to do this.
All the above is what a very fast, sharp, smart pilot or flight engineer would do in a millisecond if they saw an alpha vane sensor measurement hard-over (high) all of a sudden. It would be obvious to an observer actually seeing the sensor values along with the trimmed aircraft state to decide it's a bad sensor. That is if a human could see & monitor the raw sensor values in real-time to make that clear judgement. Computers can.
Algorithms such as the above, along with complementary or Kalman filtering to filter out spectral noise and emphasize the short term estimation of valid alpha would also help. I won't go into the signal processing or kinematic blending algorithms here, but I will say you wouldn't need much.
And, finally, where was the FTA & FMEA in all this? I guess they thought the nose-down trim would be easily countered by pilots & was not deemed catastrophic. Again, Human Factors, and I'm on the side of "don't put the plane in peril and expected tired or paniced pilots figure it out".
B737 also has two ADIRUs like B777. So I wanted to find out from any one the correct config on B737 MAX. But no one has replied so far.
My Post #841
There has to be more protection in the system design for this not to happen. (Single source failure)
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors. Also there are two computed AoA values. So in total 6 signals.
The full text from the B777 AMM is as below.
AOA Redundancy Management
The AOA redundancy management logic uses a modified midvalue selection.
The modified mid-value selection chooses the mid-value of these three AOA values:
* Left corrected AOA
* Right corrected AOA
* Calculated AOA.
The AOA redundancy management logic receives inputs from the inertial and air data systems to calculate the calculated AOA.
Has any one in this forum have access to B737 MAX AMM (Pages from AMM Chap 34-20-00) and if you can post the same system info for B737 MAX redundancy management of AOA signals.
I am just curious, and hope it does not bore other users. END
However no one has replied. So we have wait for the interim report to come out to understand what happened to LION Air. For other concerned B737 MAX pilots, they have to follow the new procedure, and we have to keep speculating endlessly.
Join Date: Jan 2008
Location: Sydney
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
There has to be more protection in the system design for this not to happen. (Single source failure)
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors. Also there are two computed AoA values. So in total 6 signals.
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors. Also there are two computed AoA values. So in total 6 signals.
The resolvers are all analogue outputs.
I can only presume that the MAX and NG have very similar ADIRU and SMYD set-ups - with the MAX having additional MCAS software/logic in the SMYD stall warning functions.
Join Date: Nov 2018
Location: Brisbane
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
True there. Odd & tragic & stupid how just ONE AOA (alpha) sensor can cause nose down pitch trim. One can argue about the Human Factors involved here concerning stress, panic, time to decide what to do, etc., but I tend to come down on the side of "don't over-stress tired human brains", from the Flight Controls Engineer viewpoint I have.
Assuming the crash was caused by the AOA alpha vane ... continuing on:
"Analytical Redundancy" would have prevented this problem, as it would add a third alpha to the dual vane measurement to break the tie between 2 vane sensors. ... Note that alpha = theta - gamma, received through air data & inertial sensors apart from the alpha vanes. That caclulated third alpha makes the system triple redundant, along with using median value selection.
You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha? Remember we have pitch rate sensors, accelerometers, pitot-static tubes, etc. to help the alpha fault detection out. Remember alpha-dot = pitch rate - (accelerometer / speed); we can use all the kinematic laws to do this.
Assuming the crash was caused by the AOA alpha vane ... continuing on:
"Analytical Redundancy" would have prevented this problem, as it would add a third alpha to the dual vane measurement to break the tie between 2 vane sensors. ... Note that alpha = theta - gamma, received through air data & inertial sensors apart from the alpha vanes. That caclulated third alpha makes the system triple redundant, along with using median value selection.
You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha? Remember we have pitch rate sensors, accelerometers, pitot-static tubes, etc. to help the alpha fault detection out. Remember alpha-dot = pitch rate - (accelerometer / speed); we can use all the kinematic laws to do this.
My Post #841
There has to be more protection in the system design for this not to happen. (Single source failure)
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors. Also there are two computed AoA values. So in total 6 signals.
The full text from the B777 AMM is as below.
AOA Redundancy Management
The AOA redundancy management logic uses a modified midvalue selection.
The modified mid-value selection chooses the mid-value of these three AOA values:
* Left corrected AOA
* Right corrected AOA
* Calculated AOA.
The AOA redundancy management logic receives inputs from the inertial and air data systems to calculate the calculated AOA.
There has to be more protection in the system design for this not to happen. (Single source failure)
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors. Also there are two computed AoA values. So in total 6 signals.
The full text from the B777 AMM is as below.
AOA Redundancy Management
The AOA redundancy management logic uses a modified midvalue selection.
The modified mid-value selection chooses the mid-value of these three AOA values:
* Left corrected AOA
* Right corrected AOA
* Calculated AOA.
The AOA redundancy management logic receives inputs from the inertial and air data systems to calculate the calculated AOA.
is there someone with authority and detailed 737 knowledge who can explain to interested but uninformed nitwits like me whether any consensus as to cause of this tragedy is emerging?
This thread contains a lot of interesting and intelligent proposals to improve pilot training, aircraft system design and certification procedures. But even with all these things still further improved (which is ok of course), modern jets like all other complex systems will go on to produce odd quirks, bugs and failures. Troubleshooting by pilots and maintenance does not get easier with added complexity and some basic failures like a malfunctioning sensor get camouflaged by quadruple redundant systems, voting algorithms, Kalman filters, Fuzzy Logic, Artificial Intelligence and you name it. We all know this.
But what I cannot understand is why an airline organisation does not prevent loading poor SLF and non-pilot crew into an aircraft that had serious problems documented on the three previous flights. This without a thorough assessment of the problem(s) on ground, corrective action and then some test flights by crews prepared for dealing with such problems. That is the real killer in this instance, and not missing pilot knowhow or design/certification flaws. Airworthiness is not only about stamps and signatures on some forms. As a lowly aircraft owner and pilot I will not take along passengers for a ride if my aircraft is plagued by unresolved troubles or untested repairs of such. And I hope the airline I buy my next ticket as a passenger will not do so either. Then I will embark with confidence, be it a Boeing, Airbus, Embraer et altera.
But what I cannot understand is why an airline organisation does not prevent loading poor SLF and non-pilot crew into an aircraft that had serious problems documented on the three previous flights. This without a thorough assessment of the problem(s) on ground, corrective action and then some test flights by crews prepared for dealing with such problems. That is the real killer in this instance, and not missing pilot knowhow or design/certification flaws. Airworthiness is not only about stamps and signatures on some forms. As a lowly aircraft owner and pilot I will not take along passengers for a ride if my aircraft is plagued by unresolved troubles or untested repairs of such. And I hope the airline I buy my next ticket as a passenger will not do so either. Then I will embark with confidence, be it a Boeing, Airbus, Embraer et altera.
Join Date: Jul 2014
Location: Germany
Posts: 344
Likes: 0
Received 0 Likes
on
0 Posts
Read the thread for that speculation.
Also i have neither authority nor detailed 737 knowledge but i have read the thread.
It probably won't be a single cause, some more likely causes in arbritrary ordering are:
Bad maintenance and not going for a test flight after repeated serious air data problems
Pilots overloaded not fixing the trim
Boeing system design
Apart from that you will have to wait for the report.
Anyway even with full FDR data which this forum does not have they still want to wait for the CVR to be found because they are not sure what happened exactly.
(Maybe they will just publish some interim report when they deem finding the CVR unlikely)
I await the report, like everyone, with great interest.