Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 24th Mar 2019, 06:39
  #2441 (permalink)  
 
Join Date: Oct 2008
Location: Melbourne, ɐıןɐɹʇsn∀
Age: 70
Posts: 58
A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system. Under the original design, the MCAS trims the aircraft nose down by moving the horizontal stabilizer up at 0.27 deg./sec. for 9.2 sec., stops for 5 sec., then trims nose down again for 9.2 sec., and continues to do so until the trim reaches the stabilizer travel limit or the crew intervenes. Boeing says that, as before, the crew will retain the capability to override the flight control law using either electric or manual trim, or by following the existing runaway stabilizer procedure and using the cutout switches as reinforced in the Operations Manual Bulletin issued on Nov. 6, 2018.

The enhanced software was demonstrated for the FAA on March 12, the day after the Civil Aviation Administration of China announced the first in a wave of 737 MAX groundings around the world; the FAA followed suit on March 13. Aviation Week was told that the software upgrade certification load, dubbed P12.1, was flown on the first 737-7 developmental aircraft, 1E001.

The greater part of the 1-hr. 20-min. test flight was flown at medium altitude between 13,500 and 17,350 ft. in a racetrack pattern over southwest Washington state. According to data from the flight-tracking website Flightradar24, the crew performed a series of high AOA maneuvers to validate the performance of the revised MCAS. These included at least six conducted during initial ascent, followed by descents from 17,000 to around 14,250 ft., during which speed dropped from more than 330 kt. to less than 180 kt.

The aircraft was then flown to 17,350 ft. and 265 kt. before pitching steeply nose down and recovering at around 15,900 ft. and 295 kt. The maneuver was repeated at a slower speed, before a further test point was conducted during which the 737 descended steeply from around 15,550 ft. to 13,500 while speed increased from 180 kt. to almost 270 kt. Two further steep descents and recoveries were then performed before the aircraft leveled off and returned to Seattle for landing.
Those were great test flights at higher altitudes. I read into the figures some steep descents of maybe 2000 ft even when the pilots presumably knew what to expect. I wonder if Boeing test pilots would like to do a test flight at about 1000ft or even 3000ft above ground (like ET302 or JT610 accidents) in the jump seat while some line pilots, who have not been told what the exercise is, are in the hot seats? Or is the new MCAS disabled until more than say 5000ft above ground? Also for what parameters will the repetitive trimming be restricted. And what will the authority limits of the trim units be and whether different at different speeds and altitudes. If MCAS disables itself for erroneous sensor input, if its moved trim then will it re-trim to a "neutral" or expect the pilots to break out the handles on the trim wheels?

It will be interesting to see the full details of the new MCAS.

Last edited by LandIT; 24th Mar 2019 at 10:43.
LandIT is offline  
Old 24th Mar 2019, 06:56
  #2442 (permalink)  
 
Join Date: Oct 2017
Location: Vienna
Posts: 104
Originally Posted by deltafox44 View Post
Airflow is horizontal only in level flight ! not in climb or descent
If by horizontal you mean at AoA ~ 0 degrees, that is very, very incorrect
derjodel is offline  
Old 24th Mar 2019, 07:20
  #2443 (permalink)  
 
Join Date: Jul 2014
Location: Berkeley, Ca
Age: 31
Posts: 5
AoA vane question

Could someone familiar with the AoA vane and MCAS tell me what would happen if a bird strike jammed the vane in either an up or down condition?
Can the system detect a damaged sensor and if not, what would happen?
mosquito88 is offline  
Old 24th Mar 2019, 07:48
  #2444 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 624
Originally Posted by mosquito88 View Post
Could someone familiar with the AoA vane and MCAS tell me what would happen if a bird strike jammed the vane in either an up or down condition?
Can the system detect a damaged sensor and if not, what would happen?
In its certified form or yet to be released updated version? No one really knows, but I believe the PPRuNe brains trust would say something along the lines "it depends".

There would be many different failure scenario's, the AoA reported value could be frozen at its last known good position, it could detect the failure and report no value, and many other possibilities in between (erratic oscillations etc). The next question is the software side, and how much error checking and validation it does and how gracefully it handles anticipated failure modes.

Generally, the opinion (and Boeings own failure analysis) of the MCAS software is assumes the pilot will handle any system input error and disable the system via the stab trim via the cutout switches. This turned out to be a heroic assumption...

Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system
System failed on a single sensor
The bottom line of Boeing’s System Safety Analysis with regard to MCAS was that, in normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.

In the case of an extreme maneuver, specifically when the plane is in a banked descending spiral, an activation of MCAS was classified as a “hazardous failure,meaning that it could cause serious or fatal injuries to a small number of passengers. That’s still one level below a “catastrophic failure,” which represents the loss of the plane with multiple fatalities.
CurtainTwitcher is offline  
Old 24th Mar 2019, 09:26
  #2445 (permalink)  
 
Join Date: Feb 2019
Location: MOW
Posts: 32
I just wonder why B737 (and B767 recently) nosedive into the ground every so often? Can't remember Airbuses nosediving recently.

B737 CL September 14, 2008 Perm - roll and nosedive just before approach
B737 CL November 17, 2013 Kazan - nosedive after GA
B737 NG March 19, 2016 Rostov - nosedive on final or after GA
B737 MAX October 29, 2018 Jakarta - nosedive after TO
B737 MAX March 10, 2019 Addis-Abeba - nosedive after TO

B767 23rd Feb 2019 Texas - nosedive just before approach
jantar99 is offline  
Old 24th Mar 2019, 10:02
  #2446 (permalink)  
 
Join Date: Aug 2005
Location: EDLB
Posts: 173
Originally Posted by jimjim1 View Post
This is not correct. The error detection is a simple parity bit and so a bus error is not vanishingly unlikely.

ARINC 429 is pretty crude in the age of the interwebby
Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.


EDLB is offline  
Old 24th Mar 2019, 11:10
  #2447 (permalink)  
 
Join Date: Sep 2014
Location: UK
Posts: 81
That information is not hard to find https://en.wikipedia.org/wiki/ARINC_429

There is a lot of 1970s stuff in aviation, that should not be a surprise.
donotdespisethesnake is offline  
Old 24th Mar 2019, 11:18
  #2448 (permalink)  

"Mildly" Eccentric Stardriver
 
Join Date: Jan 2000
Location: England
Age: 73
Posts: 3,015
I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
Herod is offline  
Old 24th Mar 2019, 11:43
  #2449 (permalink)  
 
Join Date: Feb 2019
Location: MOW
Posts: 32
Originally Posted by Herod View Post
I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
To my understanding. There is a requirement of smth like 'linear pull': in the MAX, as the plane approaches stall, either pitch force on the stick, or force increment on the stick to pitch up, decreases and that's a big, uncertifiable drawback.
jantar99 is offline  
Old 24th Mar 2019, 12:07
  #2450 (permalink)  
 
Join Date: Jan 2008
Location: Irvine, CA
Posts: 94
WSJ:
U.S. air-safety regulators ... said the enhanced training, relying on self-guided interactive instruction on laptops, ...
Alright. The regulatory governmental body thinks, the cheapest possible means, ‘self-guided interactive instruction on laptops’ is actual training. Or better, even ENHANCED training. You can’t make this sh** up. No damn expensive instructors or simulators necessary. Is this still a safety minded world? Is everybody insane now? More catastrophies in the making. You can read it right there.
Interflug is offline  
Old 24th Mar 2019, 12:08
  #2451 (permalink)  
 
Join Date: Apr 2014
Location: Korea
Posts: 69
Originally Posted by Herod View Post
I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
The reason for MCAS was stated by a previous poster. It is needed for purpose of certification. I reproduce the entire paragraph § 25.173, since I have not seen it in full in the thread.

AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

§ 25.173 Static longitudinal stability.

Under the conditions specified in § 25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or V FC /M FC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.

The item that describes the specific details is § 25.175 Demonstration of static longitudinal stability.
Euclideanplane is offline  
Old 24th Mar 2019, 12:22
  #2452 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 58
Posts: 421
Originally Posted by jantar99 View Post
To my understanding. There is a requirement of smth like 'linear pull': in the MAX, as the plane approaches stall, either pitch force on the stick, or force increment on the stick to pitch up, decreases and that's a big, uncertifiable drawback.
I have read and understood all the certification requirements that led to MCAS. Can someone explain to a non-pilot: In what common circumstances would (edit badly worded question) the pilot of an aircraft actually want to raise the nose (end-edit) close to the stall angle, while flying with flaps up? High altitude turbulence avoidance or maneuvering? Tight turns at high bank angle?

Last edited by GordonR_Cape; 24th Mar 2019 at 13:36.
GordonR_Cape is offline  
Old 24th Mar 2019, 12:30
  #2453 (permalink)  
 
Join Date: Jul 2013
Location: Australia
Posts: 178
Originally Posted by Euclideanplane View Post
The reason for MCAS was stated by a previous poster. It is needed for purpose of certification. I reproduce the entire paragraph § 25.173, since I have not seen it in full in the thread.

AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

§ 25.173 Static longitudinal stability.

Under the conditions specified in § 25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or V FC /M FC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.

The item that describes the specific details is § 25.175 Demonstration of static longitudinal stability.
It also allowed Boeing to claim that all that was need to transition to the Max was a short video presentation.
https://edition.cnn.com/2019/03/22/u...ntl/index.html
RickNRoll is offline  
Old 24th Mar 2019, 12:35
  #2454 (permalink)  
 
Join Date: Aug 2005
Location: EDLB
Posts: 173
Originally Posted by GordonR_Cape View Post
High order bit correction is mostly used in noisy transmission neworks, such as phones and satellites. If you have interference on the data lines in your brand new aircraft, then there are much more serious things to worry about.
Thats valid only if there is no fault in the harness, connection and in all receiving devices. With a single parity bit for 32 bits it’s as good as no protection at all. What if your data line signal noise level becomes marginal because of one failed receiver or a harness problem? You will process false data which are still valid and look as good data. In automotive CAN for example there is a more robust CRC protection and the same as your above argument for the system can be made. Troubleshooting of intermittent problems is much easier if you can get a fault statistic in the devices and you have a robust method to detect communication errors.
EDLB is offline  
Old 24th Mar 2019, 12:41
  #2455 (permalink)  
 
Join Date: May 2001
Location: UK
Posts: 18
Parity bits

Originally Posted by EDLB View Post

Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.


It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.
Grummaniser is offline  
Old 24th Mar 2019, 12:41
  #2456 (permalink)  
 
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,830
Originally Posted by Lake1952
As has been repeatedly pointed out , it is not an unstable airplane.
Err, the reason for the inclusion of MCAS is to address a certification issue regarding static stability. The issue is wholly to do with reduced static stability which appears to be erring towards static neutrality. In other words, in certification terms, without MCAS the aircraft is not stable enough.
Cows getting bigger is offline  
Old 24th Mar 2019, 12:44
  #2457 (permalink)  
 
Join Date: Apr 2008
Location: Australia
Posts: 663
This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
Actually, with the thrust line higher than previous versions, and the jet outlet further forward, the pitch-up on thrust increase will be less.

But, the MCAS is not there for the pitch-up. It is there to improve the handling qualities at high angles of attack. What Boeing were after was a steadily increasing nose-down stick force as the alpha increased.

Can someone explain to a non-pilot: In what common circumstances would an aircraft actually need to pitch up close to the stall angle, while flying with flaps up? High altitude turbulence avoidance or maneuvering? Tight turns at high bank angle?
There is no circumstance where the aircraft would need to pitch up when close to the stall angle. Such behaviour is considered undesirable. The MAX has a tendency for this, hence the MCAS system to "tame" it.
FGD135 is offline  
Old 24th Mar 2019, 12:51
  #2458 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 70
Posts: 273
Possible data corruption opens a real can of worms.

If there really was a data transmission error, and Boeing designed in a single point of failure with no serious data integrity checking on the digital transmission (each packet with a serial number and with a CRC so none can get lost or corrupted), and no software filtering to see whether values make sense,and restore sanity, it would be literally unbelievable. (You can do that in a lab, not in a transportation machine). But then ALL of the DIGITAL avionics on this plane will be similar, and the whole type becomes suspect, and in fact will need at least a fundamental software refactoring with a bunch of software crosschecks and filtering on all sensors that feed into mission-critical automation - it's not at all obvious that MCAS is the only such novelty on this plane, there may be more stuff hidden away.

I may not be the most competent engineer in the world but I have a Master's in Electronics/Telecoms and a PhD. This is my professional opinion. Feel free to call me incompetent but there needs to be an adult in the room. I am sure there are a bunch of pilots out there who are engineers and can chime in.


Edmund

Originally Posted by Grummaniser View Post
It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.

Last edited by edmundronald; 24th Mar 2019 at 13:14.
edmundronald is offline  
Old 24th Mar 2019, 12:51
  #2459 (permalink)  
 
Join Date: Jul 2013
Location: Norway
Age: 53
Posts: 122
Originally Posted by Cows getting bigger View Post
Err, the reason for the inclusion of MCAS is to address a certification issue regarding static stability. The issue is wholly to do with reduced static stability which appears to be erring towards static neutrality. In other words, in certification terms, without MCAS the aircraft is not stable enough.
It would have been really interesting to know what the stability margin actually is at high AoA. If the full 2,5 deg stabilizer travel really is needed to give the Max a sufficient positive stability/stick force gradient when going from about 10 deg AoA up to about 14 deg AoA, it would seem that a large part of the positive stability in this region is lost without MCAS?
SteinarN is online now  
Old 24th Mar 2019, 13:00
  #2460 (permalink)  
 
Join Date: Aug 2005
Location: EDLB
Posts: 173
Originally Posted by Grummaniser View Post
It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.
In automotive acceleration pedals the duplicate sensor (potentiometer and/or magnetic angle sensor) and duplicate A/D conversion is standard. But all that effort would be mute if the communication channel is not error protected. So at least there is a robust CRC or even duplicate signalling channels.

As far as I understand in the AoA sensor and data bus neither is done so at any point errornous data could be created.
That would not even muster for an automotive acceleration pedal let alone more safety critical systems like brakes.

The only chance I see that that passes any functional safety analysis is at least two independent sensor data, and if they differ then either a safe system state is commanded or if this can’t be achieved, then a third input data (like in this case from the inertial system generated) will be needed.
EDLB is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.