Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 15th Mar 2019, 15:41
  #1481 (permalink)  
 
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
Management documents state that clearly, deviation from accepted quality was permitted to protect schedule. Not the 737 MAX program incidentally, it was the 787.
Not unique to 787- for way too many years after Bill Allen retired, the mantra was ( is ? ) the three most important things in the factory are Schedule- and the other two dont count.
Often its ' load date' ( first load into a specific assembly jig.) Of course other variations - but the basic driving force is the same.

777 was a bit different as both Phil and Alan pushed the ' working together ' mantra in Engineering- and a reasonable amount of it trickled down to shop.
CONSO is offline  
Old 15th Mar 2019, 15:46
  #1482 (permalink)  
 
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes on 0 Posts
So why did they report to the anonymous NASA system and not to their airline and the FAA to have the QAR pulled right away and conserve date?
preservation of job ? uncertain as to problem ? simple write up in log ' check ..... "

CONSO is offline  
Old 15th Mar 2019, 15:55
  #1483 (permalink)  
 
Join Date: Mar 2019
Location: Seattle
Posts: 1
Likes: 0
Received 0 Likes on 0 Posts
Not trying to defend the MCAS or anything, but wouldn't the last line of defense be the pilots' proficiency to identify the immediate problem and hit the Stab Trim cutout switch if there's a runaway trim in any event? Ample type-specific flight training in this case plays the biggest role in whether one is capable of saving the plane from crashing or not, in spite of not having the "paid" AoA indicator. Granted, the MCAS might've gone rogue on the ET flight, but pilot error seems to be the ultimate cause that sealed the aircraft's fate ..
As evident in the DPS-CGK Lion flight, crew handled the situation pretty well. Landed the plane safely.

Just my 0.02

Last edited by Rolesium; 16th Mar 2019 at 00:11.
Rolesium is offline  
Old 15th Mar 2019, 15:57
  #1484 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 61
Posts: 264
Likes: 0
Received 3 Likes on 2 Posts
Originally Posted by clearedtocross
...
So here we have an airplane design spec that was most likely not taking into account the aerodynamic behaviour of relocating the engines. I bet the problem was only detected after some test flying of the new airplane. So time runs out, a redesign of the aircraft is now impossible and so a software patch is called for to get better stall protection. The aircraft is not FBW and thus the triple redundancy and voting concept is neither required nor followed. And as all software engineers know, patches sometimes backfire because they have not been designed with the same care as the original system. Ask Bill Gates.
What I find hard to understand is why Boeing didn't elect to upgrade the Elevator Feel System for compensating this undesired aerodynamic behaviour and instead created a new MCAS software module in the FCC.
Luc Lion is offline  
Old 15th Mar 2019, 16:04
  #1485 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
Article that looked at pilot filings on the MCAS issue...looks like it was common at early DEP, but handled by turning off Autopilot?

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

This description is not currently in the 737 Flight Manual Part 2, nor the Boeing FCOM, though it will be added to them soon. This communication highlights that an entire system is not described in our Flight Manual. This system is now the subject of an AD.

I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models. The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone--even if the pilots aren't sure what those systems are, what redundancies are in place, and failure modes.




https://www.theatlantic.com/notes/2019/03/heres-what-was-on-the-record-about-problems-with-the-737-max/584791/?utm_medium=offsite&utm_source=yahoo&utm_campaign=yahoo-non-hosted&yptr=yahoo
Smythe is offline  
Old 15th Mar 2019, 16:08
  #1486 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes on 0 Posts
I had my first flight on the Max [to] ZZZ1. We found out we were scheduled to fly the aircraft on the way to the airport in the limo. We had a little time [to] review the essentials in the car. Otherwise we would have walked onto the plane cold.

My post flight evaluation is that we lacked the knowledge to operate the aircraft in all weather and aircraft states safely. The instrumentation is completely different - My scan was degraded, slow and labored having had no experience w/ the new ND (Navigation Display) and ADI (Attitude Director Indicator) presentations/format or functions (manipulation between the screens and systems pages were not provided in training materials. If they were, I had no recollection of that material).

We were unable to navigate to systems pages and lacked the knowledge of what systems information was available to us in the different phases of flight. Our weather radar competency was inadequate to safely navigate significant weather on that dark and stormy night. These are just a few issues that were not addressed in our training.

I recommend the following to help crews w/ their introductory flight on the Max:
Email notification the day before the flight (the email should include: Links - Training Video, PSOB and QRG and all relevant updates/FAQ's)
SME (Subject Matter Expert) Observer - the role of the SME is to introduce systems navigation, display management, answer general questions and provide standardized best practices to the next generation aircraft.

Additionally, the SME will collect de-identified data to provide to the training department for analysis and dissemination to the line pilots regarding FAQs and know systems differences as well best practices in fly the new model aircraft.

Synopsis

B737 MAX First Officer reported feeling unprepared for first flight in the MAX, citing inadequate training.


Smythe is offline  
Old 15th Mar 2019, 16:13
  #1487 (permalink)  
 
Join Date: Jan 2004
Location: Planet Earth, mostly
Posts: 467
Received 6 Likes on 3 Posts
Originally Posted by FlightlessParrot
Yes, except that this was not something that "slowly occurred" to the regulators: it was a deliberate political decision for "light-handed regulation" and self-regulation, taken throughout Anglophonia, in the belief that the market would ensure that the regulated entities would want to keep their good reputation (for commercial reasons), and so could attend to the material aspects of regulation, without being stifled by "bureaucratic inertia." We now see the costs, in many industries, in lives that would not have been lost under the old regime.
Well, it worked so well with the banking industry that they thought they would try in aviation.
etrang is offline  
Old 15th Mar 2019, 16:22
  #1488 (permalink)  
 
Join Date: Jan 2008
Location: Singapore
Posts: 16
Likes: 0
Received 0 Likes on 0 Posts
Explanations

1. Complacency, common in market leaders.

And/or

2. Gutlessness - unwillingness to recommend action that would cost (a) money; (b) damage to the company's reputation and customer relationships; (c) career prospects of superiors in corporate hierarchy.
marconiphone is offline  
Old 15th Mar 2019, 16:34
  #1489 (permalink)  
 
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by derjodel
Remember, MCAS is required for (self) certification, so it needs to be there in certain conditions. But it simply can't be there with only two AOA sensors, no matter how you hack it. Whatever you do, it could happen that MCAS does't engage when it should -> hence no certification, or it does when it's deadly.
This is the key I think, triggering MCAS only when both FCCs (and therefore both AOAs) say so would surely be comparatively trivial and they would have done that IF the certification allowed it, ergo it likely doesn't.

Other points to consider:
- the earlier AD implies that MCAS still operates (presumably by design) even in event of AOA disagree (if that warning option is fitted)
- one (only) AOA sensor is on the MMEL for NG, but not for MAX
- speed trim is on MMEL, even for MAX
- MCAS... is not

All starts to look like MCAS is a "must work", more so than speed trim (also required for certification, but can be MELed). What seems to have gone very badly wrong is the assessment of the consequences (rather than the likelihood) of incorrect activation.

As you say, you can't fix this with just two AOA inputs. Adding a third AOA sensor (or calculated reference as on 777/787) to allow everything to work with one failure is going to be a big job.
infrequentflyer789 is offline  
Old 15th Mar 2019, 16:37
  #1490 (permalink)  
 
Join Date: Dec 2003
Location: Tring, UK
Posts: 1,823
Received 2 Likes on 2 Posts
Originally Posted by CONSO
Bird strike or ramp rash or software error are three most obvious- the point is to alllow a SINGLE sensor to directly override pilot input and not be documented that it even exists is as close to criminal as one can imagine.
Originally Posted by Prag
There is no such thing as 100% reliable sensor. You can vote in software, but in case of two sensors you dont know, which value is OK and which is bad, you need at least three to have confident voting system. There are much better options sw engineer can use, if he knows something about the subject and phisical reality it deals with. I'm just plain earth based industry programmer, but can imagine some verification methods that works even with one sensor. The basic method is to observe sensor behavior in time, just as you watching if it works by your own eyes, in many phases of flight.
- during the takeoff run just before plane goes airborne, you can assume that values AoA should be close to zero. If not, sensor is stuck or misaligned.
- after that should the values change to positive normal range, if not, the sensor is stuck. This is also the case of normal in/flight behavior, values in acceptable range, that change slowly and possibly with small difference between two sensors according to actual flight conditions. So you can tell its still living and not stuck somewhere.
And the most significant, dont check for value constantly over the set threshold. You should check if value rises from accepted range dynamically and in one moment oversets it, then act.
Programmers working for Boeing or component manufactors should have known this. I'm somewhat surprised they obviously dont. Or maybe the flight computer is totally out of resources after mods.
I agree with CONSO here. With just one sensor you have to do lot of magic with the input and it gets flaky near the edge of the envelope and/or when there are unusual environmental conditions present, which is just when you need it the most.

Any form of redundancy would be better, even if you just disabled the system when there was a difference between the sensors and displayed a caution to that effect. At least then you are back to pilot inputs only, rather than random stabiliser motion. GIGO, as they say...
FullWings is online now  
Old 15th Mar 2019, 16:37
  #1491 (permalink)  
 
Join Date: Dec 2006
Location: Germany
Posts: 80
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Luc Lion
What I find hard to understand is why Boeing didn't elect to upgrade the Elevator Feel System for compensating this undesired aerodynamic behaviour and instead created a new MCAS software module in the FCC.
Elevator feel / feedback is a simple mechanical system. It is not possible to simply extend that to cover special parts of the flight envelope.
EDML is offline  
Old 15th Mar 2019, 16:45
  #1492 (permalink)  
 
Join Date: Jan 2004
Location: Planet Earth, mostly
Posts: 467
Received 6 Likes on 3 Posts
Originally Posted by indigopete
For me it's difficult to see how this doesn't potentially finish off the "Max" IMO.

Increasingly the perception is that It isn't really a software problem, it's a aerodynamics design problem. Apparently those engines don't work with that body, at least not comfortably. Sure it can be sellotaped over with some software fixes/more sensor redundancy, whatever. But it doesn't solve the design issue and nowadays it isn't only regulator certification that has to be overcome, it's "public opinion certification" as well. We're not in the DC-10 era where controversy takes years to eek out into the open but in the age of instant global knowledge - even if that knowledge is incomplete or based on un-authoratitive sources. 1 hull loss can maybe be got away with by saying "we fixed it". But with 2 it's difficult to see how any ongoing controversy doesn't just mean that people won't refuse to get on the thing.
I think Boeing will definitely have to think of a new name for the MAX. B737 Voyager, B737 Discovery?
etrang is offline  
Old 15th Mar 2019, 16:56
  #1493 (permalink)  
 
Join Date: Feb 2015
Location: New Hampshire
Posts: 152
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by .Scott
If this is what it appears to be - a problem that will need to be addressed by changing firmware and perhaps hardware, then the MAXs may be grounded for weeks or months.
Flight firmware is not quickly developed and certified.
But Boeing is saying perhaps only 10 days...
https://www.cnbc.com/2019/03/15/boei...n-10-days.html

I'm a Software Engineer. Paint me incredulous.
.Scott is offline  
Old 15th Mar 2019, 16:57
  #1494 (permalink)  
 
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Capt Kremin
You must be looking at different data then.
The vertical speed is positive but nothing happens to the altitude till 207 knots is reached. The other possible scenario, which is probably more likely, may be that the aircraft was carrying out a Flaps 1 takeoff, which would be consistent with the speeds reached on the runway at rotate and the gear up call, (the 182 knots). The brand new FO, who at 200 hours may have been doing his first line sector, then inadvertently selected flap up instead of gear up. The aircraft settled back on to the runway and the captain rotated again at 207 knots, which would be a normal recovery, but now the MCAS is activated in a hot and high, extremely low altitude situation.

We will know soon anyway. The flight recorders are being looked at now in Germany.
I'm referring to FR24 CSV data sheet downloaded from their blog : https://www.flightradar24.com/blog/f...es-flight-302/

"nothing happens to the altitude till 207 knots is reached" : yes, altitude when reaching 207 kts is 7300 ft, it has been continuously rising for 16 seconds since 7075 ft at 182 kts

I admire your perspicacity (or is it imagination ?) but initiating rotation 225 ft above runway level puzzles me
deltafox44 is offline  
Old 15th Mar 2019, 17:00
  #1495 (permalink)  
PJ2
 
Join Date: Mar 2003
Location: BC
Age: 76
Posts: 2,484
Received 0 Likes on 0 Posts
Originally Posted by averow
"The normailization of deviance." This. Exactly this. Shown to be a factor in many disasters, including Challenger. Sober thinking, smart people advised against certain actions and designs, and were shut down by others worried more about short term costs or schedule pressure.
Diane Vaughan coined this phrase in 1996 in her sociological examination of culture and deviance at NASA prior to the Challenger accident, (
The Challenger Launch Decision The Challenger Launch Decision
).

The book is worth having in any flight safety library and is worth reading in the present circumstances, not because "it applies", but because don't know if it does but we need to find out.
PJ2 is offline  
Old 15th Mar 2019, 17:07
  #1496 (permalink)  
 
Join Date: Mar 2006
Location: Vance, Belgium
Age: 61
Posts: 264
Likes: 0
Received 3 Likes on 2 Posts
Originally Posted by EDML
Elevator feel / feedback is a simple mechanical system. It is not possible to simply extend that to cover special parts of the flight envelope.
CORRECTION: Do you mean that what Boeing calls a "Elevator Feel Computer" is actually a mechanical computer ???

This is correct for the Elevator Feel Shift (EFS) module which simply increase by a factor 4 the system A pressure fed into the Elevator Feel & Centering Unit.
It is also true for the Elevator Feel & Centering Unit which transforms differential pressure into feel forces.
But the pressure normally fed into the Elevator Feel & Centering Unit is controlled by a computer unit, the Elevator Feel Computer, which uses airspeed and stab position inputs for computing how much hydraulic pressure it should transfer downstream.
I reckon that the AoA is NOT documented as an input data received by the Elevator Feel Computer ; AoA is only available to the EFS (in this area).

But an upgrade of the Elevator Feel Computer by adding AoA input and modifying its algorithms should not be more considerable than fixing the MCAS logic with dual AoA input.
The advantage of acting through the Elevator Feel System is obvious : no effect on the pilot pitch authority if the AoA probe goes mad in normal flight.
Luc Lion is offline  
Old 15th Mar 2019, 17:10
  #1497 (permalink)  
 
Join Date: Sep 2016
Location: USA
Posts: 799
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by BRE
So why did they report to the anonymous NASA system and not to their airline and the FAA to have the QAR pulled right away and conserve date?
​​​​​​​Why do you think they didn't report it to the company?
Vessbot is offline  
Old 15th Mar 2019, 17:17
  #1498 (permalink)  
 
Join Date: Jun 2007
Location: NC, USA
Age: 80
Posts: 92
Likes: 0
Received 0 Likes on 0 Posts
Smile COMMON SENSE

Being an airline captain has always required a logical approach to problem solving & a good knowledge of the equipment flown. If on take-off rotation you get an immediate stick shaker, on ONE SIDE ONLY, with the aircraft climbing & accelerating normally, it should be obvious that you have a sensor failure. You're not going anywhere except back to maintenance. There is no reason to clean up the airplane or climb above pattern altitude. Just fly the circuit, make a normal landing & return to the gate. MCAS never gets activated.

Aircraft manufacturers & federal regulators have spent decades trying to make the airplanes "idiot proof". It can't be done. Any revision Boeing does to their software will be a futile attempt to make the airplane "double idiot proof", but maybe it will placate the public.
BobM2 is offline  
Old 15th Mar 2019, 17:22
  #1499 (permalink)  
YRP
 
Join Date: May 2005
Location: Ontario, Canada
Posts: 163
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by .Scott
But Boeing is saying perhaps only 10 days...
https://www.cnbc.com/2019/03/15/boei...n-10-days.html

I'm a Software Engineer. Paint me incredulous.
This is not for a fix from scratch. This is what they have been working on since the Lionair crash.

The question is whether it will satisfy the regulators (worldwide not just the FAA now) now that the second accident has happened. It appears clear that any FMEA analysis done originally on the MCAS system has turned out to be inadequate. They'd really need to do another -- very careful, very thorough -- think through of this. Relying on pilots to turn off the system has proven [1] not to be sufficient for sensor failure cases that lead to already potentially confusing/overloading situations for the pilots.

And maybe they've done that.

[1] Ya know, assumin' everything we are all assuming' about the cause turns out to actually be the cause.
YRP is offline  
Old 15th Mar 2019, 18:11
  #1500 (permalink)  
 
Join Date: May 2010
Location: PNW
Posts: 76
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by YRP
This is not for a fix from scratch. This is what they have been working on since the Lionair crash.

The question is whether it will satisfy the regulators (worldwide not just the FAA now) now that the second accident has happened.
And it's not just satisfying the regulators. Another "partner" in the decision to get the planes back in the air is the flying public at large, who were scrambling to avoid booking flights on the Max just before the grounding. That's why I'm skeptical that this is a fix that will be in place in 10 days. The flying public has to be convinced, and that will only happen if both crashes are shown to be from an identical cause that Boeing is addressing with the update. That's not going to happen in 10 days, I think, unless the investigation is moving at warp speed.

I know the point was made earlier in the thread somewhere, but it's worth repeating that this has some similarity to the EC225's demise in the offshore oil industry. Airbus never managed a good enough explanation and fix for what happened, and the North Sea oil workers refused to fly in them. It was the passengers that effectively killed off the aircraft model. Boeing and the regulators will have to do a better job of clearly explaining the problem, and why the "fix" solves it completely. At least in this case, the probable cause is known, again assuming both crashes were similar enough. If the root cause was different, the situation becomes vastly more difficult for Boeing.
Photonic is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.