Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 17th Mar 2019, 21:58
  #1801 (permalink)  
 
Join Date: Jan 2008
Location: FL 600. West of Mongolia
Posts: 462
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by NWSRG
But that doesn't explain why the system wasn't (a) briefed to the end users, and (b) built with the necessary redundancy...
Totally agree. There's no problem with the necessity of an MCAS type system with the MAX, but the seemingly absense of sufficient input monitoring, let alone training and information regarding the system seems diabolically wrong and completely alien to any system philosophy I've ever encountered.
M2dude is offline  
Old 17th Mar 2019, 21:59
  #1802 (permalink)  
 
Join Date: Jul 2013
Location: Norway
Age: 56
Posts: 140
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by NWSRG
But that doesn't explain why the system wasn't (a) briefed to the end users, and (b) built with the necessary redundancy...
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
SteinarN is offline  
Old 17th Mar 2019, 22:04
  #1803 (permalink)  
 
Join Date: Aug 2001
Location: Greater Aldergrove
Age: 52
Posts: 848
Received 0 Likes on 0 Posts
Originally Posted by SteinarN
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Yep, that's probably all true. But do you then go ahead and release a system into service that isn't actually fit for purpose? It just seems to me here that something is fundamantally wrong in the philosophy of the system design...it should never have gone into service with these shortcomings.
NWSRG is offline  
Old 17th Mar 2019, 22:05
  #1804 (permalink)  
 
Join Date: Jan 2008
Location: FL 600. West of Mongolia
Posts: 462
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by SteinarN
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.
M2dude is offline  
Old 17th Mar 2019, 22:09
  #1805 (permalink)  
 
Join Date: Jan 2008
Location: Reading, UK
Posts: 15,249
Received 89 Likes on 47 Posts
Originally Posted by M2dude
Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.
Particularly when you consider that "AOA DISAGREE" warning functionality is fitted to many 737 Max aircraft.
DaveReidUK is offline  
Old 17th Mar 2019, 22:13
  #1806 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 73
Posts: 275
Likes: 0
Received 0 Likes on 0 Posts
Seattle Roulette.

Seattle Times indicates that the AoAsystem is designed for a 1/100 000 failure rate, which I expect means 1 per 1 e10**5 hours.
There are 350 of the Max flying as of now maybe 10 hours a day, ie 35 000 hours a day.
So one MCAS incident due to a bad sensor can be expected every few days. Exactly what we've been seeing so far.
Seatlle Roulette?

Even if the AoA design study had been made for 1 in 10 Million hours, as it should have been for certification, with the full fleet of 5000 of these flying cows, you would have 50 000 hours a day, and several incidents a year, a hull loss could be expected every few years..

Edmund
edmundronald is offline  
Old 17th Mar 2019, 22:16
  #1807 (permalink)  
 
Join Date: Aug 2001
Location: Greater Aldergrove
Age: 52
Posts: 848
Received 0 Likes on 0 Posts
Yes...those figures seemed concerning.
NWSRG is offline  
Old 17th Mar 2019, 22:17
  #1808 (permalink)  
 
Join Date: Dec 2018
Location: 8th floor
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by SteinarN
I saw the video. I stopped counting the passes after a couple seconds as it was way to difficult. So I looked at the other things going on, saw the gorilla immediately. But then I knew it was a trick video.

But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.
The funny thing is I knew there was a gorilla in the video, because I saw that video in the past, but I followed the instruction to watch very carefully the ball exchanges, and I did that to the best of my ability, so I missed the gorilla I knew was there.

I didn't even believe I missed it after the video replayed the sequence. I thought that replay may have been faked, and I had to manually replay the video to convince me that there indeed was one, and I actually missed it.

So it's perhaps not surprising that the Ethiopian crew, even if they knew about the MCAS gorilla and how it can be disabled, still missed it, if they were focused on following other procedures and checklists to the letter.

Humans are not good at multitasking, especially when dealing with stuff that is not ingrained as muscle memory.

And if it takes only two MCAS cycles to bring the stabilizer to full nose down trim, it means this aircraft is capable to configure itself to kill you in less than a minute when the AoA sensor fails. I wouldn't want to fly such a plane, even if procedures that can prevent that from happening exist.

The FAA certification process needs to be overhauled so that this can't happen again in the future. In my opinion the FAA and Boeing bear together 90% of the responsibility for killing those people.

I found especially disgusting the way Boeing kept implying the pilots were at fault after the Lion Air accident and that the aircraft is perfectly safe, and how after the second accident the FAA kept saying the aircraft was safe and doesn't need to be grounded, when everyone else all over the world started grounding them.

I mean, everyone can make mistakes, Boeing, the FAA, the pilots, the airlines. Not admitting to those mistakes when they become obvious disgusts me.
MemberBerry is offline  
Old 17th Mar 2019, 22:18
  #1809 (permalink)  
 
Join Date: Jul 2013
Location: Norway
Age: 56
Posts: 140
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by M2dude
Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.
I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
SteinarN is offline  
Old 17th Mar 2019, 22:22
  #1810 (permalink)  

Keeping Danny in Sandwiches
 
Join Date: May 1999
Location: UK
Age: 75
Posts: 1,295
Likes: 0
Received 0 Likes on 0 Posts
A/P autoland needs three a/p channels, why isn't the same criteria used for the AOA indicators? What they really need is 4 AOA vanes so they can dispatch with one unserviceable.

But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.
sky9 is offline  
Old 17th Mar 2019, 22:24
  #1811 (permalink)  
 
Join Date: Aug 2000
Posts: 1,497
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by SteinarN
I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
Instead they rushed it with two accidents as the result, and the stocks tumbled, customers are raging and top management will lose their bonuses.
ManaAdaSystem is offline  
Old 17th Mar 2019, 22:25
  #1812 (permalink)  
 
Join Date: Jan 2010
Location: Edinburgh
Age: 84
Posts: 59
Likes: 0
Received 0 Likes on 0 Posts
Discovered late in flight testing????
As a total outsider (apart from some jet engine design many moons ago), I would have thought that the design process would have gone something like:-
What a pity we cant fit these larger engines to the 737.
But we could if you moved them forward and up.
That's a crazy suggestion, it would totally destabilise the aeroplane.
Yes, I know that, but you can fly an unstable aeroplane if you have computer assist, the military do it all the time, and we already have plenty of computing power in the system.
True, that would work, and we can't see any other quick solution. We'll have to go that way.
Just speculation!!
DType is offline  
Old 17th Mar 2019, 22:36
  #1813 (permalink)  
 
Join Date: Jun 2009
Location: Bedford, UK
Age: 69
Posts: 1,328
Likes: 0
Received 0 Likes on 0 Posts
@edmund 3500 perhaps? Doesn't alter argument though.
Mr Optimistic is offline  
Old 17th Mar 2019, 22:43
  #1814 (permalink)  
 
Join Date: Mar 2019
Location: Bavaria
Posts: 17
Likes: 0
Received 0 Likes on 0 Posts
Since I'm working on car functional safety, I'm sometimes around here just to learn from accidents in aviation.

This story here is, if true, really a deviation from good practice and established safety standards on all levels.
The only persons I don't blame are the pilots. If a possible safety hazard is evaluated, there is always the parameter of controlability by the driver / pilot... But this is not 0% or 100%, it's statistics (high, medium, low...). Put one pilot/driver 10 times in the same unexpected situation and he will miss the solution once...
So the residual hazard is always the product of an already safe system and a good estimate of the controlability and training. One cannot design a crappy system and then rely on or blame the human problem solving skill for everything that may happen. Especially of something is repeatedly doing something complete unexpected and useless without warning and gives the pilot a free bodybuilding exercise.
Since many pilots here claim this situation is quite controlable, I just ask myself: How many undocumented or disclosed events of this kind were there?

So despite the failures made in many, if not all aspects of functional safety:
-> Crappy design to avoid recertification (and therefore a flying museum on steroids instead of a state-of-the-art design in all aspects)
-> Basic aerodynamic design flaws
-> Impact analysis of all the changes done within the MAX development
-> Risk accessment for MCAS based on wrong values (0.6)
-> Single sensor/single point fault
-> Sensor comparison sold for $$$ (wtf, imagine this in automotive: Yes for only 500$ extra a blocking rear axle on the highway would be detected by the gearbox and stopped...). Lawyers will love that one
-> Dependent failure analysis incomplete (reset, 5 seconds and there it goes again)
-> Configuration management (application boundaries, 0,6 vs. 2.5)
-> Integration testing (was this error introduces in a test flight/sim and was the reaction controllable)? If, in automotive (ISO26262) one relies on the controlability of a situation, one has to prove it on a test track with every model / release.
-> Safety case consistency (these 2.5 never found their way back in the risk accessment / accessment)
-> Training (MCAS what?)
-> Documentation
-> Accessor independence
-> Financial and time pressure

But still there is one open point to me:
500 Airplanes shipped, maybe 250 days flying on average, 16h a day -> 2,000,000 hours in the air
And already (at least) 2 defective sensors? -> 1,000 FIT???
That's the point where a car manufacturer would consider a recall for a non-safety related part like seat heating. But such a critical part should have:
-> high coverage measure such as 1oo2 / 2oo3 selection or at least comparison and safe state (ne action/warning)
-> low coverage measures like short/open/stuck detection
-> redundancy within the sensor (two potentiometers or other rotary sensors which are compared, again resulting in a high coverage detection method and error signaling)
-> sufficient testing to do statistics that show <10 FIT, FMEDA...
-> FMEA, environmental tests, shaker... the whole program

In this case only one AoA vane was used and this one went into a critical fault without self-diagnosis. And furthermore something like 'frozen to stuck-at' can almost be excluded, or does the airplane see such high angles at startup and the sensors typically freeze just after acceleration?

Someone wrote that the sensors were a carry-over part from the old model. Are ground crews always running around with a bunch of them in their pockets because they fail all over the place or freeze every second rainy day?
Maybe someone can give me a hint on what I'm missing here. Why are we talking about a highly critical part in aviation and it shows 1000 undetected critical failures per billion hour? Even the squeeze protection of a car's power window lifter is far better!

The lives lost in these probably avoidable accidents are a shame and I feel with the relatives.
Since I consult OEM and TIER1/2 automotive companies on critical safety functions, I do my best to get as much lessons learned out of this and transfer this into automotive.
I already sent out the great seattle times article to a lot of people, helps me a lot in justifying the high effort and development costs of safety related functions. I will keep this article on my computer and any time someone is claiming cost or development time or asks for some one-eye blindness, I just need this one link, It really covers everything one should NOT do.

Thanks a lot for all the research which get's collected here, this is really the best and most up-to-date place. The effort is not wasted but read by people who may be able to do it better next time in this or even different industries.
TryingToLearn is offline  
Old 17th Mar 2019, 22:44
  #1815 (permalink)  
 
Join Date: Oct 2002
Location: London UK
Posts: 7,480
Likes: 0
Received 3 Likes on 3 Posts
Originally Posted by DaveReidUK
Particularly when you consider that "AOA DISAGREE" warning functionality is fitted to many 737 Max aircraft.
Apparently this is an additionally chargeable option. All three major US customers (Southwest, American, United) have bought it. Lion and Ethiopian did not. I wonder about others.

And I wonder how the Boeing sales team went about selling this add-on. Why did the US carriers spend the money and others not. Presumably the sales team offered it to everyone. What were their justifications, and why did the US carriers, no fools at tough negotiations, go for it but not others. And how did the FAA certification let it be optional rather than required. How often, for those that fitted it, did it operate ?
WHBM is online now  
Old 17th Mar 2019, 22:49
  #1816 (permalink)  
 
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by StrongEagle
Isn't this rather similar to a Lufthansa A321 incident that occurred Nov 5th 2014, near Bilbao, (Spain), where the aircraft experienced a rate of descent of 4,000 FPM before the pilots got the aircraft back under control?

Incident recorded here: https://avherald.com/h?article=47d74074

And here: https://aviation-safety.net/wikibase/wiki.php?id=171411
Except that A321 has 3 AoA probes, 2 of which were faulty, and the stall protection could be countered by aft stick (on mini-stick required force may not exceed pilot strength, contrary to a control column)
deltafox44 is offline  
Old 17th Mar 2019, 22:52
  #1817 (permalink)  
 
Join Date: Apr 2008
Location: Paris
Age: 73
Posts: 275
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by WHBM
How often, for those that fitted it, did it operate ?
I think the answer to that is in the telemetry databases, and will determine the way the way the compensations trials go, and also how many people from Boeing resign.
Unless the fleet telemetry data turns out to have gone the way of Mrs Clinton's emails, and a State of Washington judge looks the other way.

Edmund
edmundronald is offline  
Old 17th Mar 2019, 22:53
  #1818 (permalink)  
 
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes on 0 Posts
737 get smart...

https://en.wikipedia.org/wiki/Get_Smart

The french title for "Get Smart" TV series is "Max la menace"... here it gives :

737 MAX the mennace
deltafox44 is offline  
Old 17th Mar 2019, 22:54
  #1819 (permalink)  
 
Join Date: Dec 2010
Location: Perth, WESTERN AUSTRALIA
Age: 71
Posts: 875
Likes: 0
Received 4 Likes on 2 Posts
At some point it may be necessary to review also whether the Lion Air accident was given sufficient attention / emphasis; and if not, why not.

It seems to me that a lot of people, including Ppruners, may have been lulled into thinking that the Lion Air incident was, to a certain extent, really their own fault.
And maybe, to a certain extent, it was. But was the response to the incident, in hindsight, even half-way adequate?

An airline with dubious safety, training and procedural standards, prior history, lax management of fault correction immediately prior to final crash, questionable actions on part of the fatal flight crew.
We'll send out a bulletin, throw in a software patch when we get around to it; we just need to make it idiot proof.

Maybe just not affording the incident the degree of attention that it deserved.
WingNut60 is offline  
Old 17th Mar 2019, 23:01
  #1820 (permalink)  
 
Join Date: Jul 2008
Location: wishing to be in YPCC but stuck near EGSS
Age: 74
Posts: 16
Likes: 0
Received 0 Likes on 0 Posts
From BBC News website and also on News At Ten
Flight data from the Ethiopian Airlines disaster a week ago suggest "clear similarities" with a crash off Indonesia last October, Ethiopia's transport minister has said.Both planes were Boeing 737 Max 8 aircraft.

Last Sunday the Ethiopian Airlines jet crashed after take-off from Addis Ababa, killing all 157 people on board.

Transport Minister Dagmawit Moges told journalists that a preliminary report would be released within 30 days."Clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which would be the subject of further study during the investigation," Ms Dagmawit told journalists on Sunday.In both cases flight tracking data showed the aircraft's altitude had fluctuated sharply, as the planes seemed to experience erratic climbs and descents.
A. Muse is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell or Share My Personal Information

Copyright © 2023 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.