Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 15th Mar 2019, 16:13
  #1501 (permalink)  
 
Join Date: Jan 2004
Location: Planet Earth, mostly
Posts: 435
Originally Posted by FlightlessParrot View Post
Yes, except that this was not something that "slowly occurred" to the regulators: it was a deliberate political decision for "light-handed regulation" and self-regulation, taken throughout Anglophonia, in the belief that the market would ensure that the regulated entities would want to keep their good reputation (for commercial reasons), and so could attend to the material aspects of regulation, without being stifled by "bureaucratic inertia." We now see the costs, in many industries, in lives that would not have been lost under the old regime.
Well, it worked so well with the banking industry that they thought they would try in aviation.
etrang is offline  
Old 15th Mar 2019, 16:22
  #1502 (permalink)  
 
Join Date: Jan 2008
Location: Singapore
Posts: 15
Explanations

1. Complacency, common in market leaders.

And/or

2. Gutlessness - unwillingness to recommend action that would cost (a) money; (b) damage to the company's reputation and customer relationships; (c) career prospects of superiors in corporate hierarchy.
marconiphone is offline  
Old 15th Mar 2019, 16:34
  #1503 (permalink)  
 
Join Date: Jan 2008
Location: uk
Posts: 732
Originally Posted by derjodel View Post
Remember, MCAS is required for (self) certification, so it needs to be there in certain conditions. But it simply can't be there with only two AOA sensors, no matter how you hack it. Whatever you do, it could happen that MCAS does't engage when it should -> hence no certification, or it does when it's deadly.
This is the key I think, triggering MCAS only when both FCCs (and therefore both AOAs) say so would surely be comparatively trivial and they would have done that IF the certification allowed it, ergo it likely doesn't.

Other points to consider:
- the earlier AD implies that MCAS still operates (presumably by design) even in event of AOA disagree (if that warning option is fitted)
- one (only) AOA sensor is on the MMEL for NG, but not for MAX
- speed trim is on MMEL, even for MAX
- MCAS... is not

All starts to look like MCAS is a "must work", more so than speed trim (also required for certification, but can be MELed). What seems to have gone very badly wrong is the assessment of the consequences (rather than the likelihood) of incorrect activation.

As you say, you can't fix this with just two AOA inputs. Adding a third AOA sensor (or calculated reference as on 777/787) to allow everything to work with one failure is going to be a big job.
infrequentflyer789 is offline  
Old 15th Mar 2019, 16:37
  #1504 (permalink)  
 
Join Date: Dec 2003
Location: Tring, UK
Posts: 1,345
Originally Posted by CONSO
Bird strike or ramp rash or software error are three most obvious- the point is to alllow a SINGLE sensor to directly override pilot input and not be documented that it even exists is as close to criminal as one can imagine.
Originally Posted by Prag View Post
There is no such thing as 100% reliable sensor. You can vote in software, but in case of two sensors you dont know, which value is OK and which is bad, you need at least three to have confident voting system. There are much better options sw engineer can use, if he knows something about the subject and phisical reality it deals with. I'm just plain earth based industry programmer, but can imagine some verification methods that works even with one sensor. The basic method is to observe sensor behavior in time, just as you watching if it works by your own eyes, in many phases of flight.
- during the takeoff run just before plane goes airborne, you can assume that values AoA should be close to zero. If not, sensor is stuck or misaligned.
- after that should the values change to positive normal range, if not, the sensor is stuck. This is also the case of normal in/flight behavior, values in acceptable range, that change slowly and possibly with small difference between two sensors according to actual flight conditions. So you can tell its still living and not stuck somewhere.
And the most significant, dont check for value constantly over the set threshold. You should check if value rises from accepted range dynamically and in one moment oversets it, then act.
Programmers working for Boeing or component manufactors should have known this. I'm somewhat surprised they obviously dont. Or maybe the flight computer is totally out of resources after mods.
I agree with CONSO here. With just one sensor you have to do lot of magic with the input and it gets flaky near the edge of the envelope and/or when there are unusual environmental conditions present, which is just when you need it the most.

Any form of redundancy would be better, even if you just disabled the system when there was a difference between the sensors and displayed a caution to that effect. At least then you are back to pilot inputs only, rather than random stabiliser motion. GIGO, as they say...
FullWings is offline  
Old 15th Mar 2019, 16:37
  #1505 (permalink)  
 
Join Date: Dec 2006
Location: Germany
Posts: 23
Originally Posted by Luc Lion View Post
What I find hard to understand is why Boeing didn't elect to upgrade the Elevator Feel System for compensating this undesired aerodynamic behaviour and instead created a new MCAS software module in the FCC.
Elevator feel / feedback is a simple mechanical system. It is not possible to simply extend that to cover special parts of the flight envelope.
EDML is offline  
Old 15th Mar 2019, 16:45
  #1506 (permalink)  
 
Join Date: Jan 2004
Location: Planet Earth, mostly
Posts: 435
Originally Posted by indigopete View Post
For me it's difficult to see how this doesn't potentially finish off the "Max" IMO.

Increasingly the perception is that It isn't really a software problem, it's a aerodynamics design problem. Apparently those engines don't work with that body, at least not comfortably. Sure it can be sellotaped over with some software fixes/more sensor redundancy, whatever. But it doesn't solve the design issue and nowadays it isn't only regulator certification that has to be overcome, it's "public opinion certification" as well. We're not in the DC-10 era where controversy takes years to eek out into the open but in the age of instant global knowledge - even if that knowledge is incomplete or based on un-authoratitive sources. 1 hull loss can maybe be got away with by saying "we fixed it". But with 2 it's difficult to see how any ongoing controversy doesn't just mean that people won't refuse to get on the thing.
I think Boeing will definitely have to think of a new name for the MAX. B737 Voyager, B737 Discovery?
etrang is offline  
Old 15th Mar 2019, 16:56
  #1507 (permalink)  
 
Join Date: Feb 2015
Location: New Hampshire
Posts: 133
Originally Posted by .Scott View Post
If this is what it appears to be - a problem that will need to be addressed by changing firmware and perhaps hardware, then the MAXs may be grounded for weeks or months.
Flight firmware is not quickly developed and certified.
But Boeing is saying perhaps only 10 days...
https://www.cnbc.com/2019/03/15/boei...n-10-days.html

I'm a Software Engineer. Paint me incredulous.
.Scott is offline  
Old 15th Mar 2019, 16:57
  #1508 (permalink)  
 
Join Date: May 2016
Location: Nantes
Posts: 63
Originally Posted by Capt Kremin View Post
You must be looking at different data then.
The vertical speed is positive but nothing happens to the altitude till 207 knots is reached. The other possible scenario, which is probably more likely, may be that the aircraft was carrying out a Flaps 1 takeoff, which would be consistent with the speeds reached on the runway at rotate and the gear up call, (the 182 knots). The brand new FO, who at 200 hours may have been doing his first line sector, then inadvertently selected flap up instead of gear up. The aircraft settled back on to the runway and the captain rotated again at 207 knots, which would be a normal recovery, but now the MCAS is activated in a hot and high, extremely low altitude situation.

We will know soon anyway. The flight recorders are being looked at now in Germany.
I'm referring to FR24 CSV data sheet downloaded from their blog : https://www.flightradar24.com/blog/f...es-flight-302/

"nothing happens to the altitude till 207 knots is reached" : yes, altitude when reaching 207 kts is 7300 ft, it has been continuously rising for 16 seconds since 7075 ft at 182 kts

I admire your perspicacity (or is it imagination ?) but initiating rotation 225 ft above runway level puzzles me
deltafox44 is offline  
Old 15th Mar 2019, 17:00
  #1509 (permalink)  
PJ2
 
Join Date: Mar 2003
Location: East of the sun, West of the moon
Age: 71
Posts: 2,403
Originally Posted by averow View Post
"The normailization of deviance." This. Exactly this. Shown to be a factor in many disasters, including Challenger. Sober thinking, smart people advised against certain actions and designs, and were shut down by others worried more about short term costs or schedule pressure.
Diane Vaughan coined this phrase in 1996 in her sociological examination of culture and deviance at NASA prior to the Challenger accident, (
The Challenger Launch Decision The Challenger Launch Decision
).

The book is worth having in any flight safety library and is worth reading in the present circumstances, not because "it applies", but because don't know if it does but we need to find out.
PJ2 is offline  
Old 15th Mar 2019, 17:07
  #1510 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 57
Posts: 150
Originally Posted by EDML View Post
Elevator feel / feedback is a simple mechanical system. It is not possible to simply extend that to cover special parts of the flight envelope.
CORRECTION: Do you mean that what Boeing calls a "Elevator Feel Computer" is actually a mechanical computer ???

This is correct for the Elevator Feel Shift (EFS) module which simply increase by a factor 4 the system A pressure fed into the Elevator Feel & Centering Unit.
It is also true for the Elevator Feel & Centering Unit which transforms differential pressure into feel forces.
But the pressure normally fed into the Elevator Feel & Centering Unit is controlled by a computer unit, the Elevator Feel Computer, which uses airspeed and stab position inputs for computing how much hydraulic pressure it should transfer downstream.
I reckon that the AoA is NOT documented as an input data received by the Elevator Feel Computer ; AoA is only available to the EFS (in this area).

But an upgrade of the Elevator Feel Computer by adding AoA input and modifying its algorithms should not be more considerable than fixing the MCAS logic with dual AoA input.
The advantage of acting through the Elevator Feel System is obvious : no effect on the pilot pitch authority if the AoA probe goes mad in normal flight.
Luc Lion is offline  
Old 15th Mar 2019, 17:10
  #1511 (permalink)  
 
Join Date: Sep 2016
Location: USA
Posts: 418
Originally Posted by BRE View Post
So why did they report to the anonymous NASA system and not to their airline and the FAA to have the QAR pulled right away and conserve date?
​​​​​​​Why do you think they didn't report it to the company?
Vessbot is offline  
Old 15th Mar 2019, 17:17
  #1512 (permalink)  
 
Join Date: Jun 2007
Location: NC, USA
Age: 75
Posts: 92
Smile COMMON SENSE

Being an airline captain has always required a logical approach to problem solving & a good knowledge of the equipment flown. If on take-off rotation you get an immediate stick shaker, on ONE SIDE ONLY, with the aircraft climbing & accelerating normally, it should be obvious that you have a sensor failure. You're not going anywhere except back to maintenance. There is no reason to clean up the airplane or climb above pattern altitude. Just fly the circuit, make a normal landing & return to the gate. MCAS never gets activated.

Aircraft manufacturers & federal regulators have spent decades trying to make the airplanes "idiot proof". It can't be done. Any revision Boeing does to their software will be a futile attempt to make the airplane "double idiot proof", but maybe it will placate the public.
BobM2 is offline  
Old 15th Mar 2019, 17:22
  #1513 (permalink)  
YRP
 
Join Date: May 2005
Location: Ontario, Canada
Posts: 120
Originally Posted by .Scott View Post
But Boeing is saying perhaps only 10 days...
https://www.cnbc.com/2019/03/15/boei...n-10-days.html

I'm a Software Engineer. Paint me incredulous.
This is not for a fix from scratch. This is what they have been working on since the Lionair crash.

The question is whether it will satisfy the regulators (worldwide not just the FAA now) now that the second accident has happened. It appears clear that any FMEA analysis done originally on the MCAS system has turned out to be inadequate. They'd really need to do another -- very careful, very thorough -- think through of this. Relying on pilots to turn off the system has proven [1] not to be sufficient for sensor failure cases that lead to already potentially confusing/overloading situations for the pilots.

And maybe they've done that.

[1] Ya know, assumin' everything we are all assuming' about the cause turns out to actually be the cause.
YRP is offline  
Old 15th Mar 2019, 18:11
  #1514 (permalink)  
 
Join Date: May 2010
Location: PNW
Posts: 68
Originally Posted by YRP View Post
This is not for a fix from scratch. This is what they have been working on since the Lionair crash.

The question is whether it will satisfy the regulators (worldwide not just the FAA now) now that the second accident has happened.
And it's not just satisfying the regulators. Another "partner" in the decision to get the planes back in the air is the flying public at large, who were scrambling to avoid booking flights on the Max just before the grounding. That's why I'm skeptical that this is a fix that will be in place in 10 days. The flying public has to be convinced, and that will only happen if both crashes are shown to be from an identical cause that Boeing is addressing with the update. That's not going to happen in 10 days, I think, unless the investigation is moving at warp speed.

I know the point was made earlier in the thread somewhere, but it's worth repeating that this has some similarity to the EC225's demise in the offshore oil industry. Airbus never managed a good enough explanation and fix for what happened, and the North Sea oil workers refused to fly in them. It was the passengers that effectively killed off the aircraft model. Boeing and the regulators will have to do a better job of clearly explaining the problem, and why the "fix" solves it completely. At least in this case, the probable cause is known, again assuming both crashes were similar enough. If the root cause was different, the situation becomes vastly more difficult for Boeing.
Photonic is offline  
Old 15th Mar 2019, 18:30
  #1515 (permalink)  
 
Join Date: Dec 2003
Location: Tring, UK
Posts: 1,345
Originally Posted by BobM2 View Post
Being an airline captain has always required a logical approach to problem solving & a good knowledge of the equipment flown. If on take-off rotation you get an immediate stick shaker, on ONE SIDE ONLY, with the aircraft climbing & accelerating normally, it should be obvious that you have a sensor failure. You're not going anywhere except back to maintenance. There is no reason to clean up the airplane or climb above pattern altitude. Just fly the circuit, make a normal landing & return to the gate. MCAS never gets activated.

Aircraft manufacturers & federal regulators have spent decades trying to make the airplanes "idiot proof". It can't be done. Any revision Boeing does to their software will be a futile attempt to make the airplane "double idiot proof", but maybe it will placate the public.
Right. But how do you diagnose a stick shaker on one side only, if you’re the PF and it’s on your side? Not to mention that the control columns are physically connected. OK, given enough time you could, with good CRM but much like a hard GPWS, having a mindset of ‘oh, it’s a likely false warning’ is not a fantastic survival trait.

There are many reasons you could get stick shaker activation near the ground, one of the more prominent ones being that you are close to stalling, be it from lack of high-lift devices, windshear, unreliable airspeed or whatever. I remember the BA 747-400 that rotated at JNB and got a stick shake because some LEDs had retracted without pilot input - the pitch/power was right but the config changed from that selected.

If the aeroplane is flying and climbing, then getting it to a safe height and trying to diagnose the problem(s) and work out what to do is normally the preferred course of action. There are always exceptions (which might be MCAS) but the mindset of rushing round a short circuit, especially if you were constrained by weather and/or terrain, without having examined any other options is relying a bit on luck over judgement...
FullWings is offline  
Old 15th Mar 2019, 18:40
  #1516 (permalink)  
 
Join Date: Jan 2008
Location: UK
Posts: 1,338
Originally Posted by DaveReidUK View Post
Yes, that's what I meant. In the old days, we would call that a compiler directive. The same would apply to the bit of code (also a $$$ option) that adds the AoA indicator to the PFD.
Don't think it's a compiler directive - if it was then each set of options would have to have a separate compilation. I suspect the license turns various bits & pieces on or off, according to the $$$ (or $$$$$$$$$) paid.
cats_five is offline  
Old 15th Mar 2019, 18:43
  #1517 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Originally Posted by joig View Post
If the trim is at max down and the pilot uses the Stab trim cut out switches does that mean that the aircraft is permanently trimmed down ? If this is the case can the pilots have any hope of recovery?
Manual trim wheel still provides crew means of moving the stabilizer to offload column force.
FCeng84 is offline  
Old 15th Mar 2019, 18:46
  #1518 (permalink)  
 
Join Date: Feb 2009
Location: Seattle
Posts: 379
Originally Posted by Sailvi767 View Post


They remove all power from the trim motors and completely disable the system.
MCAS includes logic and wiring to bypass pull column cutout switch when active.
FCeng84 is offline  
Old 15th Mar 2019, 18:47
  #1519 (permalink)  
 
Join Date: Oct 2001
Location: mountains central Europe
Posts: 11
why not....

Dear gents

I followed this thread for a few days. the cause of the accident of the ET seems to point in the direction of a MCAS system activated due to a faulty AoA sensor and the crew nor being aware of the real problem.
In the first place, as mentioned allready in other posts, such a crucial system operating on a sole sensor (if this is correct) without any indication of "MCAS active" is an absolute nogo.
My proposition: install a "MCAS active" indicator/annunciator light right in front of the pilots (glareshield) and if this warning gets active together with a "AoA" disagree message on the ECAM, every pilot, even probably a 200 flighthour copi in ET, knows what to do right away.....
By heart item..... Stabilizer Motor Cut off Switches to OFF. ...... and then sort out the problem.
I am aware of the thing.....yet another warning.... I flew Airbus 330 and 340 for abt 7 years and know abt the random and erronuous multiple failures (luckily only in the Sim) on the AB ECAM, which can drive you nuts.
But as I remeber in the old days, on the MD-80 we had this big "STALL" warning flashing light right in front of us, impossible not to notice this one when activated.

And @ FC eng84.... thanks for all yr explanations, great stuff
rdejo793 is offline  
Old 15th Mar 2019, 18:49
  #1520 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 1,770
FCeng84, #1538,
Does that still apply if near or at jack stall; any difference between electric actuation and manual in this regard ?
safetypee is offline  

Thread Tools
Search this Thread

Contact Us Archive Advertising Cookie Policy Privacy Statement Terms of Service

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.