Ethiopian airliner down in Africa

[infrequentflyer789]

Originally Posted by KRH270/12

[left]Hi,

can anyone pls explain to me, why they had an IAS disagree with just an AOA sensor fault.

On that point - can you show where it is confirmed that they did have IAS disagree, because as far as I can see it isn't mentioned at all in the report.

IAS is divergent (expected as ADIRU does use AOA to correct it, and AOA is massively diverged), but IAS DISAGREE isn't confirmed. I am pretty certain it should have happened, particularly given that it did with LionAir with AOA far less divergent, however there are several oddities in the narrative and traces that I can't get my head round at all.

[Avionista]

EDLB:

Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.

The FAA stuck their neck out already when they nodded through the original MCAS bodge and look at the mess that has got them into. I don't think they will approve any B737 MAX fix without first getting the agreement of other important regulating authorities such as EASA, Canadian CAA, Chinese CAA, etc. If a further catastrophe were to occur the FAA will want to be able to say that the 'fix' was also approved by other regulators. Also, for the commercial success of the MAX it has to be approved for operations in Canadian, European and Chinese airspace.

[bsieker]

Originally Posted by Golf-Sierra

In real life reality an A330 could not be at or below 60 knots kias other than either with the wheels on the ground or during some quite spectacular upset - and even then it would last for maybe a few seconds.

Golf - Sierra

Well, that assumption turned out to be false for the A330. It was in this spectacular upset, with indicated airspeed < 60 kts, for almost 3 minutes with only short interruptions. During almost the entire time (again, with only brief interruptions), computed airspeed values alternate between 400, 45, 0, 45, 400, etc. where both 0 and 400 are recording artifacts, and the 45 possibly more or less accurate. During periods where the values were valid again, computed airspeed rose to 150, 120 and 100 knots, respectively, before returning to the invalid values.

Bernd

[ATC Watcher]

Originally Posted by EDLB

My guesimate is more a year if they have already started and they are lucky. Can easily be more. A Level A software piece need to run on a hardware worth that level. Don’t think that they have it in the 737 so they will need an additional box.
So I don’t think that the MAXes in storage will hit the friendly skies anytime soon.
Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.

As mentioned already , maybe the FAA, but not the Canadians and EASA to name only two, Then the Max will be restricted to domestic US , which is maybe what will happen in the end., as in previous cases, and then possibly a new " Super 737" or even 797 will roll out with some new features , @ la MD-11.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .

[Water pilot]

Originally Posted by spornrad

Thanks for your explanations. Since it would be another lottery win the thumb switch going south at that exact instance (besides why less, not no stab movement): Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?

Not particularly remote since it was the left side that the shaker was active on. We don't really know how the thumb switches operate, at first I thought that they were just switches to a solenoid but it seems more likely that they are just inputs to the fancy two computer/four processor 'black box' that is part of the flight control system. At that point, anything is possible since it is software.

[gums]

Salute!

Thanks, bernd

Guess many were not there for the megathon AF447 discussion about the stall warning relationship to the Aoa when speed was under 60 knots.
On that night, the plane proved it was very stable in a deeply stalled part of the envelope, and had only a slight change in heading versus a violent yaw/roll . So smooth that the crew didn't understand that they had actually stalled - no stall warning audio due to the 60 knot criteria and the "you can't stall this plane" mentality of many at the time.

Gums sends...

[Lost in Saigon]

Originally Posted by edmundronald

Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.


Edmund

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed. If you disable MCAS, the B737 MAX will not meet the FAA stability requirements of Sec. 25.173 (Static longitudinal stability)

I suspect that without MCAS there would need to be a major aerodynamic redesign to meet the stability requirements.

[RatherBeFlying]

Assembler vs C, C++ etc

I spent a large part of my career deep in mainframe Assembler applications and operating systems. A lot of it was really good and some was absolutely dreadful.

The principal determinant of success was elegance (or lack thereof) in design.

Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.

Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.

[threemiles]

Originally Posted by ATC Watcher

As mentioned already , maybe the FAA, but not the Canadians and EASA to name only two, Then the Max will be restricted to domestic US , which is maybe what will happen in the end., as in previous cases, and then possibly a new " Super 737" or even 797 will roll out with some new features , @ la MD-11.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .

Re-scheduling has nothing to do with "expectations". You have to keep managing the operations about 180 days in advance, i.e. availability of the right aircraft and crew at the right time, feeding the res systems with the right capacity and classes, and so on. The deadlines are different for each airline but 90 days before take-off everything needs to be fixed.
Doing otherwise is gross negligence and you'd have a good chance to never get to OSH.
That means, if the Max fleet is back before, it is just up to daily operations to fuse it in again.

[yanrair]

Originally Posted by bsieker

Well, that assumption turned out to be false for the A330. It was in this spectacular upset, with indicated airspeed < 60 kts, for almost 3 minutes with only short interruptions. During almost the entire time (again, with only brief interruptions), computed airspeed values alternate between 400, 45, 0, 45, 400, etc. where both 0 and 400 are recording artifacts, and the 45 possibly more or less accurate. During periods where the values were valid again, computed airspeed rose to 150, 120 and 100 knots, respectively, before returning to the invalid values.

Bernd

What was the most accurate speed readout on the plane indicating, during AF447 and the recent two MAX incidents - that being the GPS?? In AF447 it was reading something like 450 kts at the time of losing IAS. It is not going to change unless you do something like change pitch or power. Which is what happened to AF447 of course. You can fly on GPS speed for a long time until you have sorted out the problem. You can fly an immaculate circuit to land using just GPS. Yet in all the posts so far I have not seen much reference to its use in sorting out conflicting IAS/Stick shaker style events. Climbing out at 15deg pitch, 200 kts IAS Full power. GPS will be reading something similar, depending on wind and altitude. All hell breaks lose ( I am ignoring MCAS here which is a separate matter). Indicated speed all over the place. IAS disagree messages. Stick Shaker going off (one side failure) - what to believe?? Your GPS PITCH AND POWER. They are real, they are going to work and are unaffected by the ADIRU which relies among other things such as AOA and Indicated Airspeed.

[KRH270/12]

Originally Posted by infrequentflyer789

On that point - can you show where it is confirmed that they did have IAS disagree, because as far as I can see it isn't mentioned at all in the report.

IAS is divergent (expected as ADIRU does use AOA to correct it, and AOA is massively diverged), but IAS DISAGREE isn't confirmed. I am pretty certain it should have happened, particularly given that it did with LionAir with AOA far less divergent, however there are several oddities in the narrative and traces that I can't get my head round at all.

eh, the FDR readout from the preliminary report shows some 20kt disagree and the non normal checklist for AOA disagree mentions possible IAS and ALT disagree....

so i wonder whats going on in the ADIRUs... the MAX documentation I got is no help at all...

[gums]

Salute Water !

Great point about hybrid systems as we see with this plane. I do not normally like big quotes, but need to include to set the stage

Quote:

Originally Posted by
spornrad Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?
Water replies:

Not particularly remote since it was the left side that the shaker was active on. We don't really know how the thumb switches operate, at first I thought that they were just switches to a solenoid but it seems more likely that they are just inputs to the fancy two computer/four processor 'black box' that is part of the flight control system. At that point, anything is possible since it is software.

If the data we have thus far on the architecture is close to accurate, then the MCAS software or maybe a switch somewhere that feeds the software or ..... ignores some of the previous model features that disabled some trim functions if the control column was pulled or pushed in opposition to what HAL was commanding.

It's the problem with a hybrid system, and a kludge one at that. The 'bus and military FBW systems give up from the beginning, and admit that the computers read control inputs and then give the pilot all the capability the plane has. The interfaces with the controls and computers are strightforward and easy to troubleshoot. It's also easy to determine whether you have a sensor problem or a stick problem or faulty gear/flap position switch and so forth.

Hate to break the bad news to our old, experienced 737 pilots who were unaware of MCAS and how it was implemented, but this new kid on the block ain't the one you flew 5 years ago. We now have had three documented cases where all the pulleys, levers and cables were not enough to overcome stabilizer trim position due to a kludge hdwe/sfwe "fix" to meet the aerodynamic requirements of the certification requirements. You know? Make the thing act/feel like "real" planes are supposed to act/feel.

Since 1973, we have only had a half dozen or so FBW failures in the F-16 that resulted in loss of the aircraft. They were primarily related to power supply design problems, wiring harness chafing, and in one case the loss of the radome due to a pelican impact that destroyed AoA and other air data sensors ( plane flew for another 8 or 9 minutes using just rate and attitude sensors before the pilot used the nylon let down).

I would also put up the Airbus statistics along with those of that little jet I first flew 40 years ago and the newer ones like the Raptor and Stubby (F-35). And be advised that the Stubby does not even have hydraulic lines to some control surface actuators. They are powered by electric motors or electrically powered hydraulic pumps. Makes for survivability if one of your ailerons is blown off by flak, see?

Gums sends...

[jimtx]

Originally Posted by Lost in Saigon

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed. If you disable MCAS, the B737 MAX will not meet the FAA stability requirements of Sec. 25.173 (Static longitudinal stability)

I suspect that without MCAS there would need to be a major aerodynamic redesign to meet the stability requirements.

The autopilot does not need MCAS. I don’t know which part of 25.173 MCAS was there for but I thought it was the stick force gradient. There is an exception to the trim speed requirement if exceptional attention is not required of the pilot. The lack of concern of FAA/Boeing to identify an envelope of concern if you actually had a malfunction involving turning off MCAS makes me think you could certify the MAX without MCAS if waivers are allowed for Part 25.

[astrodog3]

Originally Posted by Lost in Saigon

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed.

All indications are that the MAX does this.

What MCAS does is insure that the pilot must keep pulling on the control column harder and harder to continue pitching the nose up further as AoA rises. It was added because the regulations do not allow the resisting force of the column to decrease as elevator input increases and AoA rises.

The Lion Air and Ethiopian crashes seem to have occurred because the aircraft was unable to accurately judge if it was in this flight regime, and in the short, distracting time available to them, it did not occur to the pilots to perpetually counter AND trim from MCAS with ANU trim of their own or to trim the aircraft to neutral and then disable electric trim completly.

[1066]

Airline Influence

If it is true that SWA were a major push for the common type rating for the Max, (comments somewhere above in this thread that SWA could be in line for $1m per aircraft ordered if sim time was required for Max conversion), SWA were consistent with the way they influenced the introduction of the NG again with the intention of a common type rating for the NG and the 'classic' 300/400. I understand that the NG could have had a flight deck much like the 747-400 but this was ruled out to ensure the common type rating.
I'm not blaming SWA for any part in these two accidents but I think their part, as a very large customer, in the development of the 737 is relevant.

1066

[TachyonID]

SWA Training Requirements

Originally Posted by 1066

If it is true that SWA were a major push for the common type rating for the Max, (comments somewhere above in this thread that SWA could be in line for $1m per aircraft ordered if sim time was required for Max conversion), SWA were consistent with the way they influenced the introduction of the NG again with the intention of a common type rating for the NG and the 'classic' 300/400. I understand that the NG could have had a flight deck much like the 747-400 but this was ruled out to ensure the common type rating.
I'm not blaming SWA for any part in these two accidents but I think their part, as a very large customer, in the development of the 737 is relevant.

1066

Well, one of the "lined up holes in the cheese" here will undoubtedly be the question of which parties provided fiscal incentives to cut corners.
As an aero engineer, I'm appalled at Boeing's response. It is after all their design.
As a pilot, I'm disappointed in the design decisions that led to this point.
As a stakeholder in the aviation industry, though, we'll eventually get to the question of whether the industry leaders with the purse strings applied too much pressure that rippled through some bad decision making. If SWA offered $1M per plane to "not need additional simulator time"... well it will get interesting.

[fergusd]

Originally Posted by RatherBeFlying

I spent a large part of my career deep in mainframe Assembler applications and operating systems. A lot of it was really good and some was absolutely dreadful.

The principal determinant of success was elegance (or lack thereof) in design.

Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.

Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.

Simplicity, understandability and testability . . . and these days provability.

Modern safety standards strictly limit the use of assembler, because it meets none of the criteria above at all.

C is going the same way on some of those criteria IMHO especially as software complexity inevitably increases, C++ with very strict limitations (basically like very strongly typed C) has many things going for it with appropriate mitigations.

I don't think anybody would consider what I describe as anything other than archaic in terms of modern software development, about as far away from fashionable as it's possible to get.

;-)

Fd

[TryingToLearn]

Originally Posted by .Scott

Having programmed in machine language, I would NOT recommend it. It would be very difficult to reach the level of confidence for direct machine code (or even assembly) that would be required for this software.

The sequence would be: requirements, requirements review, design, design review against the requirements, test development based on the design, test procedure review, coding, code review, code testing. This requires code that can be examined by several team members with no chance of misinterpretation.

I fully agree, as an example the automotive functional safety process has the following steps:
-> Hazard & Risk analysis
-> Functional safety concept
-> Technical system safety concept
-> System achitecture
-> Technical Software Safety concept
-> Software architecture
-> fine design
-> implementation (code writing)
-> Module test
-> SW integration test
-> System integration test
-> System test
-> Vehicle Integration test
It is recommended to write technical safety documents in formal language to exclude misinterpretation. Implementation is less than 10% of the work. Toolchain qualification is also an important part of the process. Even the best compiler may cause errors if the memory module within the programmer's laptop has defective bits... (Yes, it already happened).
All documents are to be reviewed, accessed, there are walkthrough meetings and so on. All requirements need to have verification criteria specified together with the requirement and test cases are later based on there criteria... Within accessments, certain levels of safety require a certain independence between accessor and author (other team, department, division, company...).

Safe code can be done and if this was skipped just because one feared a diagnosis (AoA disagree), reaction (deactivate MCAS) and pilot teaching (continue flying, you probably never need MCAS anyway), this is a violation of safety culture beyond my imagination.
Fun fact: Emission standards for cars (onboard diagnosis 2) require 2 out of 2 for every sensor which may cause the violation of emission standards (ULEV, EU6...) and the engine control light on disagree. Seems like this is more important than a few hundred airplane passengers...

Oh, just one question:
People claim that the manual trim may not be operable in certain flight conditions while the electric trim motor is more powerful.
On the other hand the manual states that in case CUTOUT does not work, one should grasp and hold the wheel (?against the motor?). Did I miss something?

[MarcK]

Originally Posted by fergusd

I don't think anybody would consider what I describe as anything other than archaic in terms of modern software development, about as far away from fashionable as it's possible to get. ;-) Fd

Maybe someone thought that "Agile" was the way to implement MCAS.

[sycamore]

Anyone care to say what the aircraft trim change is at 350kts if you pop the speedbrales...?