Ethiopian airliner down in Africa
Join Date: Sep 2007
Location: Europe
Age: 46
Posts: 30
Likes: 0
Received 0 Likes
on
0 Posts
Hi,
can anyone pls explain to me, why they had an IAS disagree with just an AOA sensor fault.
I thought the pitot/static system is independent...or is there some „mixing of data“ going on in the ADIRUs?
thx
can anyone pls explain to me, why they had an IAS disagree with just an AOA sensor fault.
I thought the pitot/static system is independent...or is there some „mixing of data“ going on in the ADIRUs?
thx
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes
on
0 Posts
Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
However, there are bigger issues at stake. MCAS has the potential, without quick and correct intervention by the crew, to cause a catastrophic outcome ("catastrophic" is not just a fancy term, it is quite well defined in certification specifications.) Therefore software for systems with such severe possible consequences, need to be developed to particularly stringent standards of requirements specification, analysis, coding practices, planning, documentation, verification, etc. That is what some people here mean when they refer to "DAL A" or "Level A": That is the most stringent category for safety-critical software in airborne systems, as defined in DO-178C (or ED-12C in Europe, which is excatly the same standard):
Level A: Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a catastrophic failure condition for the aircraft.
Objectives that need to be demonstrated include things like
- High-level requirements are accurate and consistent.
- Low-level requirements are verifiable.
- Software architecture is verifiable.
- Source Code is verifiable.
- Source Code is traceable to low-level requirements.
- Source Code is accurate and consistent.
- High-level requirements are accurate and consistent.
- Low-level requirements are traceable to high-level requirements.
Bernd
Only half a speed-brake
1) CAS is derived from pitots and static using an adjustment for AoA.
2) To disable MCAS: physically workable suggestion but knowingly failing a certification requirement is not an option.
2) To disable MCAS: physically workable suggestion but knowingly failing a certification requirement is not an option.
Join Date: Sep 2018
Location: Laredo, TX
Posts: 134
Likes: 0
Received 0 Likes
on
0 Posts
Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
Join Date: May 2008
Location: denmark
Posts: 9
Likes: 0
Received 0 Likes
on
0 Posts
That is possibly the worst suggestion so far.
Assembly code is almost impossible to analyse for correctness in any meaningful way. It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it.
Assembly code is almost impossible to analyse for correctness in any meaningful way. It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it.
Both tools generate C code, but with SCADE you don't have to inspect the C once the tool chain have been qualified. (Considered the safest alternative of the two)
SCADE is used by Airbus (Both French products), and Boeing might use Simulink.
But this is irrelevant for this discussion since the fault is in the specification, not the software.
So I don’t think that the MAXes in storage will hit the friendly skies anytime soon.
Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.
Join Date: Jan 2013
Location: UK
Age: 63
Posts: 37
Likes: 0
Received 0 Likes
on
0 Posts
There are a lot of confident and ridiculously detailed statements about the softare use din MCAS even the language used to code it. None of thsi is relevant. It is clear that the root is a system design error compounded by a failure of hazard and failure analysis and the regulatory/certification process.
I can see quick fixes which address the deficiencies in the way MCAS responds to erroneous inputs which from a functional point of view make the behaviour safe. I can't see a quick fix which address the wider hazard/failure analysis and regulatory concerns.
I write safety related software but discussing which language or tools to use to develop SW when the fundamental concept is flawed make no sense. The best solution to a safety hazard is intrinsic - remove the hazard, in this case that means aerodynamic changes and I assume that won't happen but it should have been thought about at the design stage. If intrinisc safety is not possible then a functional safety like MCAS is possible but the consequences of failures must be considered and controlled and any additional hazards by introducing the functional safety sub-system must be considered. I assume this was done, at least in the formal sense but it seems to have been done inexplicably poorly. This was not a case of a complicated combination of unlikely events but an entirely forseeable concsequence of a single failure. IF MCAS is retained it has to be designed and developed appropriately given the impact of it failing and that is not going to happen very quickly.
Ther eis no evidence I am aware of that the software did anything other than what it was intended and specified to do. Even the software specification was not really the eproblem. The problem was the overall system design and the safety analysis behind it. It is actually quite shocking and shoud result in a very deep analysis of both the development and regulatory processes.
I can see quick fixes which address the deficiencies in the way MCAS responds to erroneous inputs which from a functional point of view make the behaviour safe. I can't see a quick fix which address the wider hazard/failure analysis and regulatory concerns.
I write safety related software but discussing which language or tools to use to develop SW when the fundamental concept is flawed make no sense. The best solution to a safety hazard is intrinsic - remove the hazard, in this case that means aerodynamic changes and I assume that won't happen but it should have been thought about at the design stage. If intrinisc safety is not possible then a functional safety like MCAS is possible but the consequences of failures must be considered and controlled and any additional hazards by introducing the functional safety sub-system must be considered. I assume this was done, at least in the formal sense but it seems to have been done inexplicably poorly. This was not a case of a complicated combination of unlikely events but an entirely forseeable concsequence of a single failure. IF MCAS is retained it has to be designed and developed appropriately given the impact of it failing and that is not going to happen very quickly.
Ther eis no evidence I am aware of that the software did anything other than what it was intended and specified to do. Even the software specification was not really the eproblem. The problem was the overall system design and the safety analysis behind it. It is actually quite shocking and shoud result in a very deep analysis of both the development and regulatory processes.
Join Date: Jun 2010
Location: On the ground too often
Age: 49
Posts: 127
Likes: 0
Received 0 Likes
on
0 Posts
In hindsight that is probably a shortcoming of the risk and hazard assessment of the ADIRUs of the A330, yes. But the rationale for regarding all air data invalid at indicated air speed below 60 knots is that it was simply not known how the aircraft would behave in that regime.
Golf - Sierra
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes
on
0 Posts
The problem looks intractable to me but that is why "A team" engineers exist. I didn't think that they were going to get the tunneling machine that got stuck under Seattle working again, but they did. Whether or not the public ever trusts the plane and whether SouthWest and Boeing survive without a government bailout may be another question.
The overall problem is far more insidious than relying on a single sensor, and I think that is what they are running into. Moving the stabilizer seemed like an elegant solution but there are circumstances where moving it can get it stuck due to aerodynamic forces. This requires heroic efforts from the pilots to unstick it (whether or not that was a factor in either accident is being debated). Low cost airlines can't afford to hire hero pilots, and an alternative plane exists that does not require them (allegedly.)
What I don't understand is how the system met the requirement for a continuous pressure gradient on the stick (I'm probably phrasing that badly.) So you have constant pressure when pulling the jetliner up rapidly to avoid that drone in your path, which is great because you don't get a sudden light stick sensation that lets you pull up too far into stall, but now push down to get back to level flight. This is probably yet another stupid question, but with the stab trimmed down, aren't the stick forces pushing down going to be much lighter than they normally are? I haven't seen anything -- although I could have missed it -- that MCAS trims back up when the AOA decreases, that is supposed to be noticed and handled by the pilot. This may be a reasonable assumption, but remember this is the pilot who couldn't be trusted not to pull the plane into a stall!
The overall problem is far more insidious than relying on a single sensor, and I think that is what they are running into. Moving the stabilizer seemed like an elegant solution but there are circumstances where moving it can get it stuck due to aerodynamic forces. This requires heroic efforts from the pilots to unstick it (whether or not that was a factor in either accident is being debated). Low cost airlines can't afford to hire hero pilots, and an alternative plane exists that does not require them (allegedly.)
What I don't understand is how the system met the requirement for a continuous pressure gradient on the stick (I'm probably phrasing that badly.) So you have constant pressure when pulling the jetliner up rapidly to avoid that drone in your path, which is great because you don't get a sudden light stick sensation that lets you pull up too far into stall, but now push down to get back to level flight. This is probably yet another stupid question, but with the stab trimmed down, aren't the stick forces pushing down going to be much lighter than they normally are? I haven't seen anything -- although I could have missed it -- that MCAS trims back up when the AOA decreases, that is supposed to be noticed and handled by the pilot. This may be a reasonable assumption, but remember this is the pilot who couldn't be trusted not to pull the plane into a stall!
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
IAS is divergent (expected as ADIRU does use AOA to correct it, and AOA is massively diverged), but IAS DISAGREE isn't confirmed. I am pretty certain it should have happened, particularly given that it did with LionAir with AOA far less divergent, however there are several oddities in the narrative and traces that I can't get my head round at all.
Join Date: Nov 2006
Location: Scotland
Posts: 56
Likes: 0
Received 0 Likes
on
0 Posts
EDLB:
The FAA stuck their neck out already when they nodded through the original MCAS bodge and look at the mess that has got them into. I don't think they will approve any B737 MAX fix without first getting the agreement of other important regulating authorities such as EASA, Canadian CAA, Chinese CAA, etc. If a further catastrophe were to occur the FAA will want to be able to say that the 'fix' was also approved by other regulators. Also, for the commercial success of the MAX it has to be approved for operations in Canadian, European and Chinese airspace.
Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
Bernd
Pegase Driver
My guesimate is more a year if they have already started and they are lucky. Can easily be more. A Level A software piece need to run on a hardware worth that level. Don’t think that they have it in the 737 so they will need an additional box.
So I don’t think that the MAXes in storage will hit the friendly skies anytime soon.
Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .
Join Date: Mar 2015
Location: Washington state
Posts: 209
Likes: 0
Received 0 Likes
on
0 Posts
Thanks for your explanations. Since it would be another lottery win the thumb switch going south at that exact instance (besides why less, not no stab movement): Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?
Salute!
Thanks, bernd
Guess many were not there for the megathon AF447 discussion about the stall warning relationship to the Aoa when speed was under 60 knots.
On that night, the plane proved it was very stable in a deeply stalled part of the envelope, and had only a slight change in heading versus a violent yaw/roll . So smooth that the crew didn't understand that they had actually stalled - no stall warning audio due to the 60 knot criteria and the "you can't stall this plane" mentality of many at the time.
Gums sends...
Thanks, bernd
Guess many were not there for the megathon AF447 discussion about the stall warning relationship to the Aoa when speed was under 60 knots.
On that night, the plane proved it was very stable in a deeply stalled part of the envelope, and had only a slight change in heading versus a violent yaw/roll . So smooth that the crew didn't understand that they had actually stalled - no stall warning audio due to the 60 knot criteria and the "you can't stall this plane" mentality of many at the time.
Gums sends...
Join Date: Jul 2004
Location: Found in Toronto
Posts: 615
Likes: 0
Received 0 Likes
on
0 Posts
Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.
Edmund
I suspect that without MCAS there would need to be a major aerodynamic redesign to meet the stability requirements.
Assembler vs C, C++ etc
I spent a large part of my career deep in mainframe Assembler applications and operating systems. A lot of it was really good and some was absolutely dreadful.
The principal determinant of success was elegance (or lack thereof) in design.
Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.
Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.
The principal determinant of success was elegance (or lack thereof) in design.
Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.
Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.
Join Date: Jul 2005
Location: btw SAMAR and TOSPA
Posts: 566
Likes: 0
Received 0 Likes
on
0 Posts
As mentioned already , maybe the FAA, but not the Canadians and EASA to name only two, Then the Max will be restricted to domestic US , which is maybe what will happen in the end., as in previous cases, and then possibly a new " Super 737" or even 797 will roll out with some new features , @ la MD-11.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .
Doing otherwise is gross negligence and you'd have a good chance to never get to OSH.
That means, if the Max fleet is back before, it is just up to daily operations to fuse it in again.
Join Date: Nov 2007
Location: dublin
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Well, that assumption turned out to be false for the A330. It was in this spectacular upset, with indicated airspeed < 60 kts, for almost 3 minutes with only short interruptions. During almost the entire time (again, with only brief interruptions), computed airspeed values alternate between 400, 45, 0, 45, 400, etc. where both 0 and 400 are recording artifacts, and the 45 possibly more or less accurate. During periods where the values were valid again, computed airspeed rose to 150, 120 and 100 knots, respectively, before returning to the invalid values.
Bernd
Bernd