Ethiopian airliner down in Africa
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
Management documents state that clearly, deviation from accepted quality was permitted to protect schedule. Not the 737 MAX program incidentally, it was the 787.
Often its ' load date' ( first load into a specific assembly jig.) Of course other variations - but the basic driving force is the same.
777 was a bit different as both Phil and Alan pushed the ' working together ' mantra in Engineering- and a reasonable amount of it trickled down to shop.
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
So why did they report to the anonymous NASA system and not to their airline and the FAA to have the QAR pulled right away and conserve date?
Join Date: Mar 2019
Location: Seattle
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Not trying to defend the MCAS or anything, but wouldn't the last line of defense be the pilots' proficiency to identify the immediate problem and hit the Stab Trim cutout switch if there's a runaway trim in any event? Ample type-specific flight training in this case plays the biggest role in whether one is capable of saving the plane from crashing or not, in spite of not having the "paid" AoA indicator. Granted, the MCAS might've gone rogue on the ET flight, but pilot error seems to be the ultimate cause that sealed the aircraft's fate ..
As evident in the DPS-CGK Lion flight, crew handled the situation pretty well. Landed the plane safely.
Just my 0.02
As evident in the DPS-CGK Lion flight, crew handled the situation pretty well. Landed the plane safely.
Just my 0.02
Last edited by Rolesium; 16th Mar 2019 at 00:11.
Join Date: Mar 2006
Location: Vance, Belgium
Age: 62
Posts: 270
Likes: 0
Received 5 Likes
on
3 Posts
...
So here we have an airplane design spec that was most likely not taking into account the aerodynamic behaviour of relocating the engines. I bet the problem was only detected after some test flying of the new airplane. So time runs out, a redesign of the aircraft is now impossible and so a software patch is called for to get better stall protection. The aircraft is not FBW and thus the triple redundancy and voting concept is neither required nor followed. And as all software engineers know, patches sometimes backfire because they have not been designed with the same care as the original system. Ask Bill Gates.
So here we have an airplane design spec that was most likely not taking into account the aerodynamic behaviour of relocating the engines. I bet the problem was only detected after some test flying of the new airplane. So time runs out, a redesign of the aircraft is now impossible and so a software patch is called for to get better stall protection. The aircraft is not FBW and thus the triple redundancy and voting concept is neither required nor followed. And as all software engineers know, patches sometimes backfire because they have not been designed with the same care as the original system. Ask Bill Gates.
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
Article that looked at pilot filings on the MCAS issue...looks like it was common at early DEP, but handled by turning off Autopilot?
The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.
This description is not currently in the 737 Flight Manual Part 2, nor the Boeing FCOM, though it will be added to them soon. This communication highlights that an entire system is not described in our Flight Manual. This system is now the subject of an AD.
I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models. The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone--even if the pilots aren't sure what those systems are, what redundancies are in place, and failure modes.
https://www.theatlantic.com/notes/2019/03/heres-what-was-on-the-record-about-problems-with-the-737-max/584791/?utm_medium=offsite&utm_source=yahoo&utm_campaign=yahoo-non-hosted&yptr=yahoo
The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.
This description is not currently in the 737 Flight Manual Part 2, nor the Boeing FCOM, though it will be added to them soon. This communication highlights that an entire system is not described in our Flight Manual. This system is now the subject of an AD.
I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models. The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone--even if the pilots aren't sure what those systems are, what redundancies are in place, and failure modes.
https://www.theatlantic.com/notes/2019/03/heres-what-was-on-the-record-about-problems-with-the-737-max/584791/?utm_medium=offsite&utm_source=yahoo&utm_campaign=yahoo-non-hosted&yptr=yahoo
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
I had my first flight on the Max [to] ZZZ1. We found out we were scheduled to fly the aircraft on the way to the airport in the limo. We had a little time [to] review the essentials in the car. Otherwise we would have walked onto the plane cold.
My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely. The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).
We were unable to navigate to systems pages and lacked the knowledge of what systems information was available to us in the different phases of flight. Our weather radar competency was inadequate to safely navigate significant weather on that dark and stormy night. These are just a few issues that were not addressed in our training.
I recommend the following to help crews w/ their introductory flight on the Max:
Email notification the day before the flight (the email should include: Links - Training Video, PSOB and QRG and all relevant updates/FAQ's)
SME (Subject Matter Expert) Observer - the role of the SME is to introduce systems navigation, display management, answer general questions and provide standardized best practices to the next generation aircraft.
Additionally, the SME will collect de-identified data to provide to the training department for analysis and dissemination to the line pilots regarding FAQs and know systems differences as well best practices in fly the new model aircraft.
Synopsis
B737 MAX First Officer reported feeling unprepared for first flight in the MAX, citing inadequate training.
My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely. The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).
We were unable to navigate to systems pages and lacked the knowledge of what systems information was available to us in the different phases of flight. Our weather radar competency was inadequate to safely navigate significant weather on that dark and stormy night. These are just a few issues that were not addressed in our training.
I recommend the following to help crews w/ their introductory flight on the Max:
Email notification the day before the flight (the email should include: Links - Training Video, PSOB and QRG and all relevant updates/FAQ's)
SME (Subject Matter Expert) Observer - the role of the SME is to introduce systems navigation, display management, answer general questions and provide standardized best practices to the next generation aircraft.
Additionally, the SME will collect de-identified data to provide to the training department for analysis and dissemination to the line pilots regarding FAQs and know systems differences as well best practices in fly the new model aircraft.
Synopsis
B737 MAX First Officer reported feeling unprepared for first flight in the MAX, citing inadequate training.
Yes, except that this was not something that "slowly occurred" to the regulators: it was a deliberate political decision for "light-handed regulation" and self-regulation, taken throughout Anglophonia, in the belief that the market would ensure that the regulated entities would want to keep their good reputation (for commercial reasons), and so could attend to the material aspects of regulation, without being stifled by "bureaucratic inertia." We now see the costs, in many industries, in lives that would not have been lost under the old regime.
Join Date: Jan 2008
Location: Singapore
Posts: 16
Likes: 0
Received 0 Likes
on
0 Posts
Explanations
1. Complacency, common in market leaders.
And/or
2. Gutlessness - unwillingness to recommend action that would cost (a) money; (b) damage to the company's reputation and customer relationships; (c) career prospects of superiors in corporate hierarchy.
And/or
2. Gutlessness - unwillingness to recommend action that would cost (a) money; (b) damage to the company's reputation and customer relationships; (c) career prospects of superiors in corporate hierarchy.
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
Remember, MCAS is required for (self) certification, so it needs to be there in certain conditions. But it simply can't be there with only two AOA sensors, no matter how you hack it. Whatever you do, it could happen that MCAS does't engage when it should -> hence no certification, or it does when it's deadly.
Other points to consider:
- the earlier AD implies that MCAS still operates (presumably by design) even in event of AOA disagree (if that warning option is fitted)
- one (only) AOA sensor is on the MMEL for NG, but not for MAX
- speed trim is on MMEL, even for MAX
- MCAS... is not
All starts to look like MCAS is a "must work", more so than speed trim (also required for certification, but can be MELed). What seems to have gone very badly wrong is the assessment of the consequences (rather than the likelihood) of incorrect activation.
As you say, you can't fix this with just two AOA inputs. Adding a third AOA sensor (or calculated reference as on 777/787) to allow everything to work with one failure is going to be a big job.
There is no such thing as 100% reliable sensor. You can vote in software, but in case of two sensors you dont know, which value is OK and which is bad, you need at least three to have confident voting system. There are much better options sw engineer can use, if he knows something about the subject and phisical reality it deals with. I'm just plain earth based industry programmer, but can imagine some verification methods that works even with one sensor. The basic method is to observe sensor behavior in time, just as you watching if it works by your own eyes, in many phases of flight.
- during the takeoff run just before plane goes airborne, you can assume that values AoA should be close to zero. If not, sensor is stuck or misaligned.
- after that should the values change to positive normal range, if not, the sensor is stuck. This is also the case of normal in/flight behavior, values in acceptable range, that change slowly and possibly with small difference between two sensors according to actual flight conditions. So you can tell its still living and not stuck somewhere.
And the most significant, dont check for value constantly over the set threshold. You should check if value rises from accepted range dynamically and in one moment oversets it, then act.
Programmers working for Boeing or component manufactors should have known this. I'm somewhat surprised they obviously dont. Or maybe the flight computer is totally out of resources after mods.
- during the takeoff run just before plane goes airborne, you can assume that values AoA should be close to zero. If not, sensor is stuck or misaligned.
- after that should the values change to positive normal range, if not, the sensor is stuck. This is also the case of normal in/flight behavior, values in acceptable range, that change slowly and possibly with small difference between two sensors according to actual flight conditions. So you can tell its still living and not stuck somewhere.
And the most significant, dont check for value constantly over the set threshold. You should check if value rises from accepted range dynamically and in one moment oversets it, then act.
Programmers working for Boeing or component manufactors should have known this. I'm somewhat surprised they obviously dont. Or maybe the flight computer is totally out of resources after mods.
Any form of redundancy would be better, even if you just disabled the system when there was a difference between the sensors and displayed a caution to that effect. At least then you are back to pilot inputs only, rather than random stabiliser motion. GIGO, as they say...
Join Date: Dec 2006
Location: Germany
Posts: 80
Likes: 0
Received 0 Likes
on
0 Posts
Elevator feel / feedback is a simple mechanical system. It is not possible to simply extend that to cover special parts of the flight envelope.
For me it's difficult to see how this doesn't potentially finish off the "Max" IMO.
Increasingly the perception is that It isn't really a software problem, it's a aerodynamics design problem. Apparently those engines don't work with that body, at least not comfortably. Sure it can be sellotaped over with some software fixes/more sensor redundancy, whatever. But it doesn't solve the design issue and nowadays it isn't only regulator certification that has to be overcome, it's "public opinion certification" as well. We're not in the DC-10 era where controversy takes years to eek out into the open but in the age of instant global knowledge - even if that knowledge is incomplete or based on un-authoratitive sources. 1 hull loss can maybe be got away with by saying "we fixed it". But with 2 it's difficult to see how any ongoing controversy doesn't just mean that people won't refuse to get on the thing.
Increasingly the perception is that It isn't really a software problem, it's a aerodynamics design problem. Apparently those engines don't work with that body, at least not comfortably. Sure it can be sellotaped over with some software fixes/more sensor redundancy, whatever. But it doesn't solve the design issue and nowadays it isn't only regulator certification that has to be overcome, it's "public opinion certification" as well. We're not in the DC-10 era where controversy takes years to eek out into the open but in the age of instant global knowledge - even if that knowledge is incomplete or based on un-authoratitive sources. 1 hull loss can maybe be got away with by saying "we fixed it". But with 2 it's difficult to see how any ongoing controversy doesn't just mean that people won't refuse to get on the thing.
Join Date: Feb 2015
Location: New Hampshire
Posts: 152
Likes: 0
Received 0 Likes
on
0 Posts
https://www.cnbc.com/2019/03/15/boei...n-10-days.html
I'm a Software Engineer. Paint me incredulous.
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes
on
0 Posts
You must be looking at different data then.
The vertical speed is positive but nothing happens to the altitude till 207 knots is reached. The other possible scenario, which is probably more likely, may be that the aircraft was carrying out a Flaps 1 takeoff, which would be consistent with the speeds reached on the runway at rotate and the gear up call, (the 182 knots). The brand new FO, who at 200 hours may have been doing his first line sector, then inadvertently selected flap up instead of gear up. The aircraft settled back on to the runway and the captain rotated again at 207 knots, which would be a normal recovery, but now the MCAS is activated in a hot and high, extremely low altitude situation.
We will know soon anyway. The flight recorders are being looked at now in Germany.
The vertical speed is positive but nothing happens to the altitude till 207 knots is reached. The other possible scenario, which is probably more likely, may be that the aircraft was carrying out a Flaps 1 takeoff, which would be consistent with the speeds reached on the runway at rotate and the gear up call, (the 182 knots). The brand new FO, who at 200 hours may have been doing his first line sector, then inadvertently selected flap up instead of gear up. The aircraft settled back on to the runway and the captain rotated again at 207 knots, which would be a normal recovery, but now the MCAS is activated in a hot and high, extremely low altitude situation.
We will know soon anyway. The flight recorders are being looked at now in Germany.
"nothing happens to the altitude till 207 knots is reached" : yes, altitude when reaching 207 kts is 7300 ft, it has been continuously rising for 16 seconds since 7075 ft at 182 kts
I admire your perspicacity (or is it imagination ?) but initiating rotation 225 ft above runway level puzzles me
"The normailization of deviance." This. Exactly this. Shown to be a factor in many disasters, including Challenger. Sober thinking, smart people advised against certain actions and designs, and were shut down by others worried more about short term costs or schedule pressure.
The book is worth having in any flight safety library and is worth reading in the present circumstances, not because "it applies", but because don't know if it does but we need to find out.
Join Date: Mar 2006
Location: Vance, Belgium
Age: 62
Posts: 270
Likes: 0
Received 5 Likes
on
3 Posts
It is also true for the Elevator Feel & Centering Unit which transforms differential pressure into feel forces.
But the pressure normally fed into the Elevator Feel & Centering Unit is controlled by a computer unit, the Elevator Feel Computer, which uses airspeed and stab position inputs for computing how much hydraulic pressure it should transfer downstream.
I reckon that the AoA is NOT documented as an input data received by the Elevator Feel Computer ; AoA is only available to the EFS (in this area).
The advantage of acting through the Elevator Feel System is obvious : no effect on the pilot pitch authority if the AoA probe goes mad in normal flight.
Join Date: Sep 2016
Location: USA
Posts: 803
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Jun 2007
Location: NC, USA
Age: 80
Posts: 92
Likes: 0
Received 0 Likes
on
0 Posts
COMMON SENSE
Being an airline captain has always required a logical approach to problem solving & a good knowledge of the equipment flown. If on take-off rotation you get an immediate stick shaker, on ONE SIDE ONLY, with the aircraft climbing & accelerating normally, it should be obvious that you have a sensor failure. You're not going anywhere except back to maintenance. There is no reason to clean up the airplane or climb above pattern altitude. Just fly the circuit, make a normal landing & return to the gate. MCAS never gets activated.
Aircraft manufacturers & federal regulators have spent decades trying to make the airplanes "idiot proof". It can't be done. Any revision Boeing does to their software will be a futile attempt to make the airplane "double idiot proof", but maybe it will placate the public.
Aircraft manufacturers & federal regulators have spent decades trying to make the airplanes "idiot proof". It can't be done. Any revision Boeing does to their software will be a futile attempt to make the airplane "double idiot proof", but maybe it will placate the public.
Join Date: May 2005
Location: Ontario, Canada
Posts: 163
Likes: 0
Received 0 Likes
on
0 Posts
But Boeing is saying perhaps only 10 days...
https://www.cnbc.com/2019/03/15/boei...n-10-days.html
I'm a Software Engineer. Paint me incredulous.
https://www.cnbc.com/2019/03/15/boei...n-10-days.html
I'm a Software Engineer. Paint me incredulous.
The question is whether it will satisfy the regulators (worldwide not just the FAA now) now that the second accident has happened. It appears clear that any FMEA analysis done originally on the MCAS system has turned out to be inadequate. They'd really need to do another -- very careful, very thorough -- think through of this. Relying on pilots to turn off the system has proven [1] not to be sufficient for sensor failure cases that lead to already potentially confusing/overloading situations for the pilots.
And maybe they've done that.
[1] Ya know, assumin' everything we are all assuming' about the cause turns out to actually be the cause.
Join Date: May 2010
Location: PNW
Posts: 76
Likes: 0
Received 0 Likes
on
0 Posts
I know the point was made earlier in the thread somewhere, but it's worth repeating that this has some similarity to the EC225's demise in the offshore oil industry. Airbus never managed a good enough explanation and fix for what happened, and the North Sea oil workers refused to fly in them. It was the passengers that effectively killed off the aircraft model. Boeing and the regulators will have to do a better job of clearly explaining the problem, and why the "fix" solves it completely. At least in this case, the probable cause is known, again assuming both crashes were similar enough. If the root cause was different, the situation becomes vastly more difficult for Boeing.