Ethiopian airliner down in Africa
Join Date: Jul 2013
Location: Norway
Age: 57
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Join Date: Aug 2001
Location: Greater Aldergrove
Age: 52
Posts: 851
Received 0 Likes
on
0 Posts
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Join Date: Jan 2008
Location: FL 600. West of Mongolia
Posts: 463
Likes: 0
Received 0 Likes
on
0 Posts
Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Particularly when you consider that "AOA DISAGREE" warning functionality is fitted to many 737 Max aircraft.
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes
on
0 Posts
Seattle Roulette.
Seattle Times indicates that the AoAsystem is designed for a 1/100 000 failure rate, which I expect means 1 per 1 e10**5 hours.
There are 350 of the Max flying as of now maybe 10 hours a day, ie 35 000 hours a day.
So one MCAS incident due to a bad sensor can be expected every few days. Exactly what we've been seeing so far.
Seatlle Roulette?
Even if the AoA design study had been made for 1 in 10 Million hours, as it should have been for certification, with the full fleet of 5000 of these flying cows, you would have 50 000 hours a day, and several incidents a year, a hull loss could be expected every few years..
Edmund
There are 350 of the Max flying as of now maybe 10 hours a day, ie 35 000 hours a day.
So one MCAS incident due to a bad sensor can be expected every few days. Exactly what we've been seeing so far.
Seatlle Roulette?
Even if the AoA design study had been made for 1 in 10 Million hours, as it should have been for certification, with the full fleet of 5000 of these flying cows, you would have 50 000 hours a day, and several incidents a year, a hull loss could be expected every few years..
Edmund
Join Date: Dec 2018
Location: 8th floor
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
I saw the video. I stopped counting the passes after a couple seconds as it was way to difficult. So I looked at the other things going on, saw the gorilla immediately. But then I knew it was a trick video.
But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.
But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.
I didn't even believe I missed it after the video replayed the sequence. I thought that replay may have been faked, and I had to manually replay the video to convince me that there indeed was one, and I actually missed it.
So it's perhaps not surprising that the Ethiopian crew, even if they knew about the MCAS gorilla and how it can be disabled, still missed it, if they were focused on following other procedures and checklists to the letter.
Humans are not good at multitasking, especially when dealing with stuff that is not ingrained as muscle memory.
And if it takes only two MCAS cycles to bring the stabilizer to full nose down trim, it means this aircraft is capable to configure itself to kill you in less than a minute when the AoA sensor fails. I wouldn't want to fly such a plane, even if procedures that can prevent that from happening exist.
The FAA certification process needs to be overhauled so that this can't happen again in the future. In my opinion the FAA and Boeing bear together 90% of the responsibility for killing those people.
I found especially disgusting the way Boeing kept implying the pilots were at fault after the Lion Air accident and that the aircraft is perfectly safe, and how after the second accident the FAA kept saying the aircraft was safe and doesn't need to be grounded, when everyone else all over the world started grounding them.
I mean, everyone can make mistakes, Boeing, the FAA, the pilots, the airlines. Not admitting to those mistakes when they become obvious disgusts me.
Join Date: Jul 2013
Location: Norway
Age: 57
Posts: 140
Likes: 0
Received 0 Likes
on
0 Posts
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.
I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
Keeping Danny in Sandwiches
Join Date: May 1999
Location: UK
Age: 76
Posts: 1,294
Likes: 0
Received 0 Likes
on
0 Posts
A/P autoland needs three a/p channels, why isn't the same criteria used for the AOA indicators? What they really need is 4 AOA vanes so they can dispatch with one unserviceable.
But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.
But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.
Join Date: Aug 2000
Posts: 1,501
Likes: 0
Received 0 Likes
on
0 Posts
I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.
I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.
I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
Discovered late in flight testing????
As a total outsider (apart from some jet engine design many moons ago), I would have thought that the design process would have gone something like:-
What a pity we cant fit these larger engines to the 737.
But we could if you moved them forward and up.
That's a crazy suggestion, it would totally destabilise the aeroplane.
Yes, I know that, but you can fly an unstable aeroplane if you have computer assist, the military do it all the time, and we already have plenty of computing power in the system.
True, that would work, and we can't see any other quick solution. We'll have to go that way.
Just speculation!!
As a total outsider (apart from some jet engine design many moons ago), I would have thought that the design process would have gone something like:-
What a pity we cant fit these larger engines to the 737.
But we could if you moved them forward and up.
That's a crazy suggestion, it would totally destabilise the aeroplane.
Yes, I know that, but you can fly an unstable aeroplane if you have computer assist, the military do it all the time, and we already have plenty of computing power in the system.
True, that would work, and we can't see any other quick solution. We'll have to go that way.
Just speculation!!
Join Date: Mar 2019
Location: Bavaria
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
Since I'm working on car functional safety, I'm sometimes around here just to learn from accidents in aviation.
This story here is, if true, really a deviation from good practice and established safety standards on all levels.
The only persons I don't blame are the pilots. If a possible safety hazard is evaluated, there is always the parameter of controlability by the driver / pilot... But this is not 0% or 100%, it's statistics (high, medium, low...). Put one pilot/driver 10 times in the same unexpected situation and he will miss the solution once...
So the residual hazard is always the product of an already safe system and a good estimate of the controlability and training. One cannot design a crappy system and then rely on or blame the human problem solving skill for everything that may happen. Especially of something is repeatedly doing something complete unexpected and useless without warning and gives the pilot a free bodybuilding exercise.
Since many pilots here claim this situation is quite controlable, I just ask myself: How many undocumented or disclosed events of this kind were there?
So despite the failures made in many, if not all aspects of functional safety:
-> Crappy design to avoid recertification (and therefore a flying museum on steroids instead of a state-of-the-art design in all aspects)
-> Basic aerodynamic design flaws
-> Impact analysis of all the changes done within the MAX development
-> Risk accessment for MCAS based on wrong values (0.6°)
-> Single sensor/single point fault
-> Sensor comparison sold for $$$ (wtf, imagine this in automotive: Yes for only 500$ extra a blocking rear axle on the highway would be detected by the gearbox and stopped...). Lawyers will love that one
-> Dependent failure analysis incomplete (reset, 5 seconds and there it goes again)
-> Configuration management (application boundaries, 0,6° vs. 2.5°)
-> Integration testing (was this error introduces in a test flight/sim and was the reaction controllable)? If, in automotive (ISO26262) one relies on the controlability of a situation, one has to prove it on a test track with every model / release.
-> Safety case consistency (these 2.5° never found their way back in the risk accessment / accessment)
-> Training (MCAS what?)
-> Documentation
-> Accessor independence
-> Financial and time pressure
But still there is one open point to me:
500 Airplanes shipped, maybe 250 days flying on average, 16h a day -> 2,000,000 hours in the air
And already (at least) 2 defective sensors? -> 1,000 FIT???
That's the point where a car manufacturer would consider a recall for a non-safety related part like seat heating. But such a critical part should have:
-> high coverage measure such as 1oo2 / 2oo3 selection or at least comparison and safe state (ne action/warning)
-> low coverage measures like short/open/stuck detection
-> redundancy within the sensor (two potentiometers or other rotary sensors which are compared, again resulting in a high coverage detection method and error signaling)
-> sufficient testing to do statistics that show <10 FIT, FMEDA...
-> FMEA, environmental tests, shaker... the whole program
In this case only one AoA vane was used and this one went into a critical fault without self-diagnosis. And furthermore something like 'frozen to stuck-at' can almost be excluded, or does the airplane see such high angles at startup and the sensors typically freeze just after acceleration?
Someone wrote that the sensors were a carry-over part from the old model. Are ground crews always running around with a bunch of them in their pockets because they fail all over the place or freeze every second rainy day?
Maybe someone can give me a hint on what I'm missing here. Why are we talking about a highly critical part in aviation and it shows 1000 undetected critical failures per billion hour? Even the squeeze protection of a car's power window lifter is far better!
The lives lost in these probably avoidable accidents are a shame and I feel with the relatives.
Since I consult OEM and TIER1/2 automotive companies on critical safety functions, I do my best to get as much lessons learned out of this and transfer this into automotive.
I already sent out the great seattle times article to a lot of people, helps me a lot in justifying the high effort and development costs of safety related functions. I will keep this article on my computer and any time someone is claiming cost or development time or asks for some one-eye blindness, I just need this one link, It really covers everything one should NOT do.
Thanks a lot for all the research which get's collected here, this is really the best and most up-to-date place. The effort is not wasted but read by people who may be able to do it better next time in this or even different industries.
This story here is, if true, really a deviation from good practice and established safety standards on all levels.
The only persons I don't blame are the pilots. If a possible safety hazard is evaluated, there is always the parameter of controlability by the driver / pilot... But this is not 0% or 100%, it's statistics (high, medium, low...). Put one pilot/driver 10 times in the same unexpected situation and he will miss the solution once...
So the residual hazard is always the product of an already safe system and a good estimate of the controlability and training. One cannot design a crappy system and then rely on or blame the human problem solving skill for everything that may happen. Especially of something is repeatedly doing something complete unexpected and useless without warning and gives the pilot a free bodybuilding exercise.
Since many pilots here claim this situation is quite controlable, I just ask myself: How many undocumented or disclosed events of this kind were there?
So despite the failures made in many, if not all aspects of functional safety:
-> Crappy design to avoid recertification (and therefore a flying museum on steroids instead of a state-of-the-art design in all aspects)
-> Basic aerodynamic design flaws
-> Impact analysis of all the changes done within the MAX development
-> Risk accessment for MCAS based on wrong values (0.6°)
-> Single sensor/single point fault
-> Sensor comparison sold for $$$ (wtf, imagine this in automotive: Yes for only 500$ extra a blocking rear axle on the highway would be detected by the gearbox and stopped...). Lawyers will love that one
-> Dependent failure analysis incomplete (reset, 5 seconds and there it goes again)
-> Configuration management (application boundaries, 0,6° vs. 2.5°)
-> Integration testing (was this error introduces in a test flight/sim and was the reaction controllable)? If, in automotive (ISO26262) one relies on the controlability of a situation, one has to prove it on a test track with every model / release.
-> Safety case consistency (these 2.5° never found their way back in the risk accessment / accessment)
-> Training (MCAS what?)
-> Documentation
-> Accessor independence
-> Financial and time pressure
But still there is one open point to me:
500 Airplanes shipped, maybe 250 days flying on average, 16h a day -> 2,000,000 hours in the air
And already (at least) 2 defective sensors? -> 1,000 FIT???
That's the point where a car manufacturer would consider a recall for a non-safety related part like seat heating. But such a critical part should have:
-> high coverage measure such as 1oo2 / 2oo3 selection or at least comparison and safe state (ne action/warning)
-> low coverage measures like short/open/stuck detection
-> redundancy within the sensor (two potentiometers or other rotary sensors which are compared, again resulting in a high coverage detection method and error signaling)
-> sufficient testing to do statistics that show <10 FIT, FMEDA...
-> FMEA, environmental tests, shaker... the whole program
In this case only one AoA vane was used and this one went into a critical fault without self-diagnosis. And furthermore something like 'frozen to stuck-at' can almost be excluded, or does the airplane see such high angles at startup and the sensors typically freeze just after acceleration?
Someone wrote that the sensors were a carry-over part from the old model. Are ground crews always running around with a bunch of them in their pockets because they fail all over the place or freeze every second rainy day?
Maybe someone can give me a hint on what I'm missing here. Why are we talking about a highly critical part in aviation and it shows 1000 undetected critical failures per billion hour? Even the squeeze protection of a car's power window lifter is far better!
The lives lost in these probably avoidable accidents are a shame and I feel with the relatives.
Since I consult OEM and TIER1/2 automotive companies on critical safety functions, I do my best to get as much lessons learned out of this and transfer this into automotive.
I already sent out the great seattle times article to a lot of people, helps me a lot in justifying the high effort and development costs of safety related functions. I will keep this article on my computer and any time someone is claiming cost or development time or asks for some one-eye blindness, I just need this one link, It really covers everything one should NOT do.
Thanks a lot for all the research which get's collected here, this is really the best and most up-to-date place. The effort is not wasted but read by people who may be able to do it better next time in this or even different industries.
And I wonder how the Boeing sales team went about selling this add-on. Why did the US carriers spend the money and others not. Presumably the sales team offered it to everyone. What were their justifications, and why did the US carriers, no fools at tough negotiations, go for it but not others. And how did the FAA certification let it be optional rather than required. How often, for those that fitted it, did it operate ?
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes
on
0 Posts
Isn't this rather similar to a Lufthansa A321 incident that occurred Nov 5th 2014, near Bilbao, (Spain), where the aircraft experienced a rate of descent of 4,000 FPM before the pilots got the aircraft back under control?
Incident recorded here: https://avherald.com/h?article=47d74074
And here: https://aviation-safety.net/wikibase/wiki.php?id=171411
Incident recorded here: https://avherald.com/h?article=47d74074
And here: https://aviation-safety.net/wikibase/wiki.php?id=171411
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes
on
0 Posts
I think the answer to that is in the telemetry databases, and will determine the way the way the compensations trials go, and also how many people from Boeing resign.
Unless the fleet telemetry data turns out to have gone the way of Mrs Clinton's emails, and a State of Washington judge looks the other way.
Edmund
Unless the fleet telemetry data turns out to have gone the way of Mrs Clinton's emails, and a State of Washington judge looks the other way.
Edmund
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes
on
0 Posts
737 get smart...
https://en.wikipedia.org/wiki/Get_Smart
The french title for "Get Smart" TV series is "Max la menace"... here it gives :
737 MAX the mennace
https://en.wikipedia.org/wiki/Get_Smart
The french title for "Get Smart" TV series is "Max la menace"... here it gives :
737 MAX the mennace
At some point it may be necessary to review also whether the Lion Air accident was given sufficient attention / emphasis; and if not, why not.
It seems to me that a lot of people, including Ppruners, may have been lulled into thinking that the Lion Air incident was, to a certain extent, really their own fault.
And maybe, to a certain extent, it was. But was the response to the incident, in hindsight, even half-way adequate?
An airline with dubious safety, training and procedural standards, prior history, lax management of fault correction immediately prior to final crash, questionable actions on part of the fatal flight crew.
We'll send out a bulletin, throw in a software patch when we get around to it; we just need to make it idiot proof.
Maybe just not affording the incident the degree of attention that it deserved.
It seems to me that a lot of people, including Ppruners, may have been lulled into thinking that the Lion Air incident was, to a certain extent, really their own fault.
And maybe, to a certain extent, it was. But was the response to the incident, in hindsight, even half-way adequate?
An airline with dubious safety, training and procedural standards, prior history, lax management of fault correction immediately prior to final crash, questionable actions on part of the fatal flight crew.
We'll send out a bulletin, throw in a software patch when we get around to it; we just need to make it idiot proof.
Maybe just not affording the incident the degree of attention that it deserved.
Join Date: Jul 2008
Location: wishing to be in YPCC but stuck near EGSS
Age: 75
Posts: 16
Likes: 0
Received 0 Likes
on
0 Posts
From BBC News website and also on News At Ten
Flight data from the Ethiopian Airlines disaster a week ago suggest "clear similarities" with a crash off Indonesia last October, Ethiopia's transport minister has said.Both planes were Boeing 737 Max 8 aircraft.
Last Sunday the Ethiopian Airlines jet crashed after take-off from Addis Ababa, killing all 157 people on board.
Transport Minister Dagmawit Moges told journalists that a preliminary report would be released within 30 days."Clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which would be the subject of further study during the investigation," Ms Dagmawit told journalists on Sunday.In both cases flight tracking data showed the aircraft's altitude had fluctuated sharply, as the planes seemed to experience erratic climbs and descents.
Last Sunday the Ethiopian Airlines jet crashed after take-off from Addis Ababa, killing all 157 people on board.
Transport Minister Dagmawit Moges told journalists that a preliminary report would be released within 30 days."Clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which would be the subject of further study during the investigation," Ms Dagmawit told journalists on Sunday.In both cases flight tracking data showed the aircraft's altitude had fluctuated sharply, as the planes seemed to experience erratic climbs and descents.
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes
on
0 Posts
8 years ago, An Airbus crashed due to a blocked' AOA sensor- which fooled both the pilots AND HALBUS .
So a few years later during gestation-certification of MAX, Boeing played word games re critical definitions in how failures affect safety of flight- which allowed a single point ' failure' to take control from pilot ( for the first time ever ? ) and then decdided to not notify anyone via some oversight or creative pencil whipping
https://news.aviation-safety.net/201...-check-flight/
Report: blocked AOA sensors caused loss of control during A320 check flight
note this was with experienced pilots !!
So a few years later during gestation-certification of MAX, Boeing played word games re critical definitions in how failures affect safety of flight- which allowed a single point ' failure' to take control from pilot ( for the first time ever ? ) and then decdided to not notify anyone via some oversight or creative pencil whipping
https://news.aviation-safety.net/201...-check-flight/
Report: blocked AOA sensors caused loss of control during A320 check flight
note this was with experienced pilots !!
