Ethiopian airliner down in Africa
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes
on
0 Posts
Several times over the last few days, people have reached the conclusion that with full nose down trim on the stabilizer, there is not enough elevator authority to overcome the trim condition. This Reuters article repeats that idea. I just searched my manual, and in the section on loss of electric trim, the statement is made that:
"NOTE: Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position." Is that difference in control available due to blowdown on the elevator at high speed, or some other reason, or simply not true?
"NOTE: Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position." Is that difference in control available due to blowdown on the elevator at high speed, or some other reason, or simply not true?
Join Date: May 2008
Location: us
Posts: 19
Likes: 0
Received 0 Likes
on
0 Posts
Oh wait, Boeing didn't even admit the existence of MCAS.
For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA values
https://www.satcom.guru/2019/03/ethi...lion.html#more
The full post contains quite a few comments which I think will generate a few talking points.
The full post contains quite a few comments which I think will generate a few talking points.
From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"
Copy here for now -
http://www.flightradar24.com/blog/wp...ary-Report.pdf
- At least one AoA sensor was changed immediately before penultimate flight. Presumably there was a percieved AoA sensor issue.
"replaced angle of attack sensor"
- Captain side AoA sensor showed 22 degree error for entirity of penultimate flight.
- Captain side AoA sensor showed 22 degree error for entirity of crash flight.
Perhaps the AoA sensor was not faulty and the issue lay elsewhere and was not correctly repaired?
I like** the idea of an encoding error. (**like the idea as an explanation for the observed symptoms - I don't like it that there was a crash - added in the hope of deflecting the present preposterous pprune pedants)
I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.
The sensor is an analog device and there will be an A to D converter at some stage.
A bad bit within the AD converter data path seems a distinct possibility.
Last edited by jimjim1; 23rd Mar 2019 at 09:27. Reason: fixed bad flightradar24 link
Join Date: Sep 2018
Location: Laredo, TX
Posts: 133
Likes: 0
Received 0 Likes
on
0 Posts
A nuance that I have not seen stated here previously, one well worth considering as people go back and forth arguing over whether or not the pilots should have saved the day:
MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.
I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.
I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.
We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??
If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??
That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.
We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.
What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.
What we cannot argue is that Boeing and the regulatory system produced a safe airplane.
Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.
The surprising thing isn’t that it happened, it’s that it took so long to happen.
Regards-
dce
MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.
I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.
I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.
We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??
If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??
That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.
We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.
What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.
What we cannot argue is that Boeing and the regulatory system produced a safe airplane.
Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.
The surprising thing isn’t that it happened, it’s that it took so long to happen.
Regards-
dce
Last edited by jimtx; 23rd Mar 2019 at 04:51.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"
Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf
"PRELIMINARY
KNKT.18.10.35.04"
Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf
Join Date: Jul 2014
Location: Berkeley, Ca
Age: 35
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
A nuance that I have not seen stated here previously, one well worth considering as people go back and forth arguing over whether or not the pilots should have saved the day:
MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.
I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.
I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.
We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??
If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??
That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.
We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.
What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.
What we cannot argue is that Boeing and the regulatory system produced a safe airplane.
Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.
The surprising thing isn’t that it happened, it’s that it took so long to happen.
Regards-
dce
MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.
I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.
I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.
We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??
If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??
That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.
We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.
What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.
What we cannot argue is that Boeing and the regulatory system produced a safe airplane.
Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.
The surprising thing isn’t that it happened, it’s that it took so long to happen.
Regards-
dce
Perfectly put.
Reliance on a single sensor driving a system that was not known to the crew and that could take over command of the aircraft is sheer madness (not to mention extreme negligence).
Join Date: Nov 2018
Location: Vancouver
Posts: 68
Likes: 0
Received 0 Likes
on
0 Posts
From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"
Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf
- At least one AoA sensor was changed immediately before penultimate flight. Presumably there was a percieved AoA sensor issue.
"replaced angle of attack sensor"
- Captain side AoA sensor showed 22 degree error for entirity of penultimate flight.
- Captain side AoA sensor showed 22 degree error for entirity of crash flight.
Perhaps the AoA sensor was not faulty and the issue lay elsewhere and was not correctly repaired?
I like** the idea of an encoding error. (**like the idea as an explanation for the observed symptoms - I don't like it that there was a crash - added in the hope of deflecting the present preposterous pprune pedants)
I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.
The sensor is an analog device and there will be an A to D converter at some stage.
A bad bit within the AD converter data path seems a distinct possibility.
"PRELIMINARY
KNKT.18.10.35.04"
Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf
- At least one AoA sensor was changed immediately before penultimate flight. Presumably there was a percieved AoA sensor issue.
"replaced angle of attack sensor"
- Captain side AoA sensor showed 22 degree error for entirity of penultimate flight.
- Captain side AoA sensor showed 22 degree error for entirity of crash flight.
Perhaps the AoA sensor was not faulty and the issue lay elsewhere and was not correctly repaired?
I like** the idea of an encoding error. (**like the idea as an explanation for the observed symptoms - I don't like it that there was a crash - added in the hope of deflecting the present preposterous pprune pedants)
I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.
The sensor is an analog device and there will be an A to D converter at some stage.
A bad bit within the AD converter data path seems a distinct possibility.
..
Found on pp. 7/8/9 of NTSC's Preliminary Report
Looking back to that AC and its symptoms, problems seemed to have revolved around the same area the whole time, albeit it had gotten progressively worse up until that fateful flight when ALL indicators found completely unreliable.
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes
on
0 Posts
While in hindsight it may be found to be otherwise, I am certain that both Boeing and FAA determined that the hazard level associated with an AOA sensor signal failed high on a 737MAX was not catestrophic. As I have mentioned in previous posts I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.
Thread Starter
My pal yesterday took photos at TFS (Tenerife South) showing the grounded TUI UK Max 8 (G-TUMH) and also another Max 8 belonging to Norwegian Air both of which were stranded when the flight ban was imposed leaving them unable to fly back to their respective bases.
Guess that no EU dispensations were granted for ferry flights.
Guess that no EU dispensations were granted for ferry flights.
Join Date: Dec 2007
Location: CARIBE
Posts: 51
Likes: 0
Received 0 Likes
on
0 Posts
I am by no means an expert on electronics. The most modern plane I ever got to feed my desires on is a B767. Back in the airforce, way back then I as the Mil Spec 1553 was new couldn’t believe what it can do. That thing is like a Volkswagen now. Over the years I had the plaesure to talk and fly with a few Boeing test pilots. Their logic about the data buses is that it can get so complicated, they don’t want you to dick with the logic. They can’t possibly provide documentation for every single possibility that might arise because of the bus interaction with stuff. They expect the training departments to be capable of teaching their pilots enough about the airplanes to deal with scenarios like being able to turn things off. Now I flew a B727 as Captain for about 10 years in cargo and their wasn’t a taining event without a trim runaway or freight shift scenario. The cutout switches had some status. Since I fly the 76 I have not done a single such events which does malke me wonder.
Join Date: Jan 2008
Location: Herts, UK
Posts: 748
Likes: 0
Received 0 Likes
on
0 Posts
I don't believe I really get this point. It sounds OK if indeed the airflow was not parallel with the fuselage at some locations. But why wouldn't the streamline effects be well known beforehand from wind tunnel testing and the AOA vanes located at a point where the lines are truly parallel?
FCeng84 or anyone more knowledgeable than me can you explain any relationship between the Feel diff press defect ( written up on the Lion Air aircraft) and the AOA vane?
My thoughts were that Feel Diff Press meant either a hyd system failure or the elevator pitot was in trouble.
Cheers
My thoughts were that Feel Diff Press meant either a hyd system failure or the elevator pitot was in trouble.
Cheers
....................I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.
Having said that, I think that SIM training needs to adapt. For 18 years of commercial airline SIM details, I have been given engine failures on take-off. Then a single engine approach to a go around and then a landing. Once airborne again, we are given a systems failure such as hydraulic or electrical failure, or maybe fire or depressurisation and emergency descent. None of this is particularly difficult: a few memory actions, some memory drills, then work through the ECAM, EICAS or QRH
I can only recall having seen unreliable speed or disagreeing sensors or ADI disagrees on a handful of occasions, but they can be very insidious and dangerous. I think that much more emphasis now needs to be applied to computer faults and sensor failures in today’s electronically enhanced aircraft* . More scenarios should include information conflicts which lead to the requirement to revert to Pitch + Power = Performance to recover the aircraft.
Arguably, if a lot more emphasis had been placed on experiencing and practising cockpit information conflicts, and getting used to constantly checking and confirming that pitch, power and control inputs were appropriate; a great many accidents, such as AF447, the SFO 777, and the Swedish CRJ, several poorly flown or crashed go-arounds etc, in recent years could have been rescued by the crews.
* e.g. FBW, Boeing MCAS.
Join Date: Nov 2010
Location: USA
Posts: 100
Likes: 0
Received 0 Likes
on
0 Posts
FAA Reviews Enhanced MAX Flight-Test Data Aviation Week Article
From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:
FAA Reviews Enhanced MAX Flight-Test Data
Guy Norris Los Angeles
Boeing has completed a key certification flight test of enhanced 737 MAX flight-control computer software, marking a major step toward returning the grounded fleet to service.
The test flight, conducted using the first 737-7 variant of the MAX, validated a set of updates to the Maneuvering Characteristics Augmentation System (MCAS) flight control law as well as improved pilot displays. Although the changes are part of a set of upgrades developed in the aftermath of the Lion Air Flight 610 accident in 2018, they are also expected to address a similar set of control problems implicated in the crash of Ethiopian Airlines Flight 302 this month.
Boeing says it has been “working closely with the FAA on development, planning and certification of the software enhancement, and it will be deployed across the 737 MAX fleet in the coming weeks.” It adds, “The update also incorporates feedback received from our customers.” The FAA is expected to mandate the enhancement with an airworthiness directive at the end of March.
Although the company will not comment on the current status of flight tests, or say whether they have concluded, Boeing Chairman and CEO Dennis Muilenburg says: “[W]hile investigators continue to work to establish definitive conclusions, Boeing is finalizing its development of a previously announced software update and pilot-training revision that will address the MCAS flight control law’s behavior in response to erroneous sensor inputs.”
The software upgrade package, known as the EDFCS (enhanced digital flight control system), significantly modifies the MCAS that was introduced on the MAX to match aircraft-handling characteristics with those of the 737 Next Generation and decrease pitch-up tendency at elevated angles of attack. The MCAS changes are focused on three areas: improving activation logic, enhancing angle-of-attack (AOA) inputs and limiting stabilizer-command authority.
Boeing says the changes are designed to increase overall system redundancy, limit stabilizer trim commands in response to an erroneous AOA reading and retain elevator authority by limiting the degree of stabilizer command. The company is not yet detailing how the changes are being implemented. For example, Boeing has not clarified whether the AOA changes include adding more sensors or, as is considered more likely, revising the MCAS architecture to enable data from both the AOA vanes in the current configuration to be fed into both flight control computers.
A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system. Under the original design, the MCAS trims the aircraft nose down by moving the horizontal stabilizer up at 0.27 deg./sec. for 9.2 sec., stops for 5 sec., then trims nose down again for 9.2 sec., and continues to do so until the trim reaches the stabilizer travel limit or the crew intervenes. Boeing says that, as before, the crew will retain the capability to override the flight control law using either electric or manual trim, or by following the existing runaway stabilizer procedure and using the cutout switches as reinforced in the Operations Manual Bulletin issued on Nov. 6, 2018.
The enhanced software was demonstrated for the FAA on March 12, the day after the Civil Aviation Administration of China announced the first in a wave of 737 MAX groundings around the world; the FAA followed suit on March 13. Aviation Week was told that the software upgrade certification load, dubbed P12.1, was flown on the first 737-7 developmental aircraft, 1E001.
The greater part of the 1-hr. 20-min. test flight was flown at medium altitude between 13,500 and 17,350 ft. in a racetrack pattern over southwest Washington state. According to data from the flight-tracking website Flightradar24, the crew performed a series of high AOA maneuvers to validate the performance of the revised MCAS. These included at least six conducted during initial ascent, followed by descents from 17,000 to around 14,250 ft., during which speed dropped from more than 330 kt. to less than 180 kt.
The aircraft was then flown to 17,350 ft. and 265 kt. before pitching steeply nose down and recovering at around 15,900 ft. and 295 kt. The maneuver was repeated at a slower speed, before a further test point was conducted during which the 737 descended steeply from around 15,550 ft. to 13,500 while speed increased from 180 kt. to almost 270 kt. Two further steep descents and recoveries were then performed before the aircraft leveled off and returned to Seattle for landing.
Along with the MCAS changes, Boeing also is updating training requirements and flight-crew manuals. The company declines to comment on reports in The Wall Street Journal that Boeing and the FAA have struggled to agree on the extent of some of these changes, particularly regarding the revised training procedure. Alterations are planned for the Airplane Flight Manual and Flight Crew Operations Manual, as well as new notes for the speed trim fail checklist in the Quick Reference Handbook. Other changes are being made to the Airplane Maintenance Manual and the Interactive Fault Isolation Manual.
Boeing has outlined updated training documents to advise pilots of the changes as well, but according to the Journal, the FAA has pushed for more extensive training, including a self-guided computer-based instruction course.
Guy Norris Los Angeles
Boeing has completed a key certification flight test of enhanced 737 MAX flight-control computer software, marking a major step toward returning the grounded fleet to service.
The test flight, conducted using the first 737-7 variant of the MAX, validated a set of updates to the Maneuvering Characteristics Augmentation System (MCAS) flight control law as well as improved pilot displays. Although the changes are part of a set of upgrades developed in the aftermath of the Lion Air Flight 610 accident in 2018, they are also expected to address a similar set of control problems implicated in the crash of Ethiopian Airlines Flight 302 this month.
Boeing says it has been “working closely with the FAA on development, planning and certification of the software enhancement, and it will be deployed across the 737 MAX fleet in the coming weeks.” It adds, “The update also incorporates feedback received from our customers.” The FAA is expected to mandate the enhancement with an airworthiness directive at the end of March.
Although the company will not comment on the current status of flight tests, or say whether they have concluded, Boeing Chairman and CEO Dennis Muilenburg says: “[W]hile investigators continue to work to establish definitive conclusions, Boeing is finalizing its development of a previously announced software update and pilot-training revision that will address the MCAS flight control law’s behavior in response to erroneous sensor inputs.”
The software upgrade package, known as the EDFCS (enhanced digital flight control system), significantly modifies the MCAS that was introduced on the MAX to match aircraft-handling characteristics with those of the 737 Next Generation and decrease pitch-up tendency at elevated angles of attack. The MCAS changes are focused on three areas: improving activation logic, enhancing angle-of-attack (AOA) inputs and limiting stabilizer-command authority.
Boeing says the changes are designed to increase overall system redundancy, limit stabilizer trim commands in response to an erroneous AOA reading and retain elevator authority by limiting the degree of stabilizer command. The company is not yet detailing how the changes are being implemented. For example, Boeing has not clarified whether the AOA changes include adding more sensors or, as is considered more likely, revising the MCAS architecture to enable data from both the AOA vanes in the current configuration to be fed into both flight control computers.
A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system. Under the original design, the MCAS trims the aircraft nose down by moving the horizontal stabilizer up at 0.27 deg./sec. for 9.2 sec., stops for 5 sec., then trims nose down again for 9.2 sec., and continues to do so until the trim reaches the stabilizer travel limit or the crew intervenes. Boeing says that, as before, the crew will retain the capability to override the flight control law using either electric or manual trim, or by following the existing runaway stabilizer procedure and using the cutout switches as reinforced in the Operations Manual Bulletin issued on Nov. 6, 2018.
The enhanced software was demonstrated for the FAA on March 12, the day after the Civil Aviation Administration of China announced the first in a wave of 737 MAX groundings around the world; the FAA followed suit on March 13. Aviation Week was told that the software upgrade certification load, dubbed P12.1, was flown on the first 737-7 developmental aircraft, 1E001.
The greater part of the 1-hr. 20-min. test flight was flown at medium altitude between 13,500 and 17,350 ft. in a racetrack pattern over southwest Washington state. According to data from the flight-tracking website Flightradar24, the crew performed a series of high AOA maneuvers to validate the performance of the revised MCAS. These included at least six conducted during initial ascent, followed by descents from 17,000 to around 14,250 ft., during which speed dropped from more than 330 kt. to less than 180 kt.
The aircraft was then flown to 17,350 ft. and 265 kt. before pitching steeply nose down and recovering at around 15,900 ft. and 295 kt. The maneuver was repeated at a slower speed, before a further test point was conducted during which the 737 descended steeply from around 15,550 ft. to 13,500 while speed increased from 180 kt. to almost 270 kt. Two further steep descents and recoveries were then performed before the aircraft leveled off and returned to Seattle for landing.
Along with the MCAS changes, Boeing also is updating training requirements and flight-crew manuals. The company declines to comment on reports in The Wall Street Journal that Boeing and the FAA have struggled to agree on the extent of some of these changes, particularly regarding the revised training procedure. Alterations are planned for the Airplane Flight Manual and Flight Crew Operations Manual, as well as new notes for the speed trim fail checklist in the Quick Reference Handbook. Other changes are being made to the Airplane Maintenance Manual and the Interactive Fault Isolation Manual.
Boeing has outlined updated training documents to advise pilots of the changes as well, but according to the Journal, the FAA has pushed for more extensive training, including a self-guided computer-based instruction course.
Last edited by airman1900; 23rd Mar 2019 at 10:40. Reason: format
Join Date: Jun 2006
Location: Brisbane
Posts: 265
Likes: 0
Received 0 Likes
on
0 Posts
...
To be fair, I am not sure exactly what I would have done in the first two minutes of the 610 scenario. I would not have thought the trim system was my main problem. If my wheel electric switch kept working, I would have kept going and prolly slowed down once flaps were up. ...
To be fair, I am not sure exactly what I would have done in the first two minutes of the 610 scenario. I would not have thought the trim system was my main problem. If my wheel electric switch kept working, I would have kept going and prolly slowed down once flaps were up. ...
First problem: Stick shaker on rotate: fly the aircraft, probably reducing pitch attitude initially, but not into the ground. Assessing performance would quickly identify nuisance stick shaker. Hold an appropriate pitch attitude while moving onto second problem.
Second problem: IAS disagree. Apply Airspeed Unreliable memory items. Autopilot/Autothrottle/Flight-Directors OFF. Set pitch and thrust 10deg/80% N1. Fly the aircraft to a safe altitude and hold that pitch and thrust until completing the checklist by reference to the QRH, which would have had them identify the correct IAS indicator (no.2) and engage autopilot B, and return to land.
If they’ had done this, the flaps would never have come up, MCAS would never have activated, and we probably still wouldn’t even know it exists!
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
airman1900
I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.
A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system.
Beyond that it is clearly a violation of the FARs for a system to have a failure mode arrived at by (1) any combination of failures whose probability is greater that 1x10E-9 or (2) any single failure that results in a catestrophic hazard level.
While in hindsight it may be found to be otherwise, I am certain that both Boeing and FAA determined that the hazard level associated with an AOA sensor signal failed high on a 737MAX was not catestrophic. As I have mentioned in previous posts I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.
The so called system safety e.g. "any combination of failures whose probability is greater that 1x10E-9" may not be specified when a more specific rule has been applied via another part of the regulations.
I think it would be best that we confine our discussions around the actual rulings by the FAA that permitted this control logic.
Join Date: Nov 2018
Location: Vancouver
Posts: 68
Likes: 0
Received 0 Likes
on
0 Posts
airman1900
I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.
I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.
Yes, the sensor vane is integral to the internals.
It is indexed, according to the individual aircraft angle of attack of the wing to fuselage angle. I believe that if you consider the fuselage horizontal or at 0, the wing chord line is at an angle of 2.5 degrees on the 737?
What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?
It is indexed, according to the individual aircraft angle of attack of the wing to fuselage angle. I believe that if you consider the fuselage horizontal or at 0, the wing chord line is at an angle of 2.5 degrees on the 737?
What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?
As a maintenance engineer, I have never worked on any model of the 737, but in my career I have had occasion to change AOA vanes several times on various aircraft models. Only once was the change-out caused by a malfunction of the actual position transducer. The more common malfunction is a failure of the anti-ice heater.
In any case, I have never seen any AOA vane model that did not have either a guide pin, or an offset bolt pattern that would make it physically impossible to install it in the wrong orientation.
The actual position is typically measured in one of two ways. On smaller business jets which have DC electrical systems, the AOA transducer will consist of a precision potentiometer that outputs a variable DC voltage corresponding to position. On larger aircraft with AC electrical systems, the AOA transducer will consist of a RVDT transformer which outputs an AC waveform with position corresponding to the amplitude and phase of the output waveform.
https://en.m.wikipedia.org/wiki/Rota...al_transformer
In any case, the raw position data is an analog signal. At some point downstream, the analog signal will be digitized by an AD (analog-to-digital) converter.
The analysis by “Satcom Guru” is intriguing. He has found that the digital representation of AOA in the 737 is expressed as a 26 bit binary word, and if the 26th bit becomes incorrectly set (goes from binary zero to binary 1), it will correspond to an AOA of exactly 22 degrees, which is what the FDR on the Lion Air flight recorded for the left AOA sensor. It remains to be seen if this was also the case on the Ethiopian flight for one of the two sensors.
I strongly suspect that there was nothing wrong with the AOA sensor on LionAir - but rather some kind of intermittent hardware or software fault in the downstream conversion of the position data from analog to digital. If this also happened on Ethiopian, then the cause of this possible data corruption is going to have to be found and corrected on the Max in addition to any changes made to the MCAS system.
