Ethiopian airliner down in Africa
Join Date: Feb 2008
Location: uk
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
I believe they are referring to this EASA Explanatory Note to TCDS IM.A.120 - Boeing 737 - Issue 10:
(sorry can't post URL but it can be found in EASA document library >product certification >type certificate data sheets (tcds) )
STATEMENT OF ISSUE
The aisle stand trim switches can be used to trim the airplane throughout the flight envelope and
fully complies with the reference regulation Simulation has demonstrated that the thumb switch trim
does not have enough authority to completely trim the aircraft longitudinally in certain corners of
the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear
down/flaps up, at speeds above 230 kts.
In those cases, longitudinal trim is achieved by using the manual stabilizer trim wheel to position
the stabilizer. The trim wheel can be used to trim the airplane throughout the entire flight envelope.
In addition, the autopilot has the authority to trim the airplane in these conditions.
The reference regulation and policy do not specify the method of trim, nor do they state that when
multiple pilot trim control paths exist that they must each independently be able to trim the airplane
throughout the flight envelope.
Boeing did not initially consider this to be a compliance issue because trim could always be
achieved, even during the conditions where use of the aisle stand trim switch was required.
Subsequent to flight testing, the FAA-TAD expressed concern with compliance to the reference
regulation based on an interpretation of the intent behind “trim”. The main issue being that
longitudinal trim cannot be achieved throughout the flight envelope using thumb switch trim only.
EASA POSITION
Boeing set the thumb switch limits in order to increase the level of safety for out-of-trim dive
characteristics (CS 25.255(a)(1)). The resulting thumb switch limits require an alternative trim
method to meet CS 25.161 trim requirements in certain corners of the operational envelope.
The need to use the trim wheel is considered unusual, as it is only required for manual flight in
those corners of the envelope.
The increased safety provided by the Boeing design limits on the thumb switches (for out-of-trim
dive characteristics) provides a compensating factor for the inability to use the thumb switches
throughout the entire flight envelope. Furthermore, the additional crew procedures and training
material will clearly explain to pilots the situations where use of the trim wheel may be needed due
to lack of trim authority with the wheel mounted switches.
The trim systems on the 737Max provide an appropriate level of safety relative to longitudinal trim
capability.
(sorry can't post URL but it can be found in EASA document library >product certification >type certificate data sheets (tcds) )
STATEMENT OF ISSUE
The aisle stand trim switches can be used to trim the airplane throughout the flight envelope and
fully complies with the reference regulation Simulation has demonstrated that the thumb switch trim
does not have enough authority to completely trim the aircraft longitudinally in certain corners of
the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear
down/flaps up, at speeds above 230 kts.
In those cases, longitudinal trim is achieved by using the manual stabilizer trim wheel to position
the stabilizer. The trim wheel can be used to trim the airplane throughout the entire flight envelope.
In addition, the autopilot has the authority to trim the airplane in these conditions.
The reference regulation and policy do not specify the method of trim, nor do they state that when
multiple pilot trim control paths exist that they must each independently be able to trim the airplane
throughout the flight envelope.
Boeing did not initially consider this to be a compliance issue because trim could always be
achieved, even during the conditions where use of the aisle stand trim switch was required.
Subsequent to flight testing, the FAA-TAD expressed concern with compliance to the reference
regulation based on an interpretation of the intent behind “trim”. The main issue being that
longitudinal trim cannot be achieved throughout the flight envelope using thumb switch trim only.
EASA POSITION
Boeing set the thumb switch limits in order to increase the level of safety for out-of-trim dive
characteristics (CS 25.255(a)(1)). The resulting thumb switch limits require an alternative trim
method to meet CS 25.161 trim requirements in certain corners of the operational envelope.
The need to use the trim wheel is considered unusual, as it is only required for manual flight in
those corners of the envelope.
The increased safety provided by the Boeing design limits on the thumb switches (for out-of-trim
dive characteristics) provides a compensating factor for the inability to use the thumb switches
throughout the entire flight envelope. Furthermore, the additional crew procedures and training
material will clearly explain to pilots the situations where use of the trim wheel may be needed due
to lack of trim authority with the wheel mounted switches.
The trim systems on the 737Max provide an appropriate level of safety relative to longitudinal trim
capability.
Relevant passage reuters
Additional procedures and training needed to “clearly explain” when the manual wheel might be needed, according to the document. The EASA spokesman said that was a reference to the Boeing flight crew operations manual.
apparently this wasnt done.
apparently this wasnt done.
Join Date: Nov 2018
Location: madrid
Posts: 47
Likes: 0
Received 0 Likes
on
0 Posts
I think it is a very bad idea, but it's important to get facts straight, it's not a bad idea because they wanted to go all "airbus" about it suddenly.
Fundamentally it's a bad idea because we as humans cheated at solitaire, we created something that allows us to pass a rule that we wrote (pitch moment vs aoa curve test), without getting the good things that the rule is supposed to grant (pitch moment vs aoa at real life speed). And then the added complexity bit us, partly because no engineer is going to give very much thought to a system which is anyway useless in a real life scenario. It's kind of dieselgate all over, only poor man's version of it. And murderous.
Join Date: Nov 2018
Location: Vancouver
Posts: 68
Likes: 0
Received 0 Likes
on
0 Posts
Investigators reportedly believe Boeing 737 Max anti-stall system activated before Ethiopia crash
Investigators looking into the fatal Ethiopian Airlines crash involving a Boeing737 Max plane are said to have reached a preliminary conclusion that an anti-stall system on board misfired, the Wall Street Journal reported Friday.
Based on data retrieved from the flight’s black boxes, the stall prevention system — known as the MCAS, or Maneuvering Characteristics Augmentation System — activated automatically before the plane nose-dived into the ground, the Journal said, citing people briefed on the matter.
Those sources told the WSJ the preliminary finding is subject to revisions and one of the people said the U.S. government air-safety experts have been analyzing details gathered from the Ethiopian investigators.
Boeing did not immediately respond to a request for comments sent outside office hours...
Source:
- https://www.cnbc.com/2019/03/29/ethi...ivatedwsj.html
Investigators looking into the fatal Ethiopian Airlines crash involving a Boeing737 Max plane are said to have reached a preliminary conclusion that an anti-stall system on board misfired, the Wall Street Journal reported Friday.
Based on data retrieved from the flight’s black boxes, the stall prevention system — known as the MCAS, or Maneuvering Characteristics Augmentation System — activated automatically before the plane nose-dived into the ground, the Journal said, citing people briefed on the matter.
Those sources told the WSJ the preliminary finding is subject to revisions and one of the people said the U.S. government air-safety experts have been analyzing details gathered from the Ethiopian investigators.
Boeing did not immediately respond to a request for comments sent outside office hours...
Source:
- https://www.cnbc.com/2019/03/29/ethi...ivatedwsj.html
aeronaught321, #2730, I agree with your interpretation of the Reuter’s article linked by blind pew, #2729. This should be read by everyone contributing to this thread.
https://uk.reuters.com/article/us-et...-idUKKCN1RA0DP
The point being made relates to an existing issue discussed in the thread Boeing advice on "aerodynamically relieving airloads" using manual stabilizer trim which refers to the separate problem of ‘runaway’ trim.
However, this is very relevant to the accident discussion because of the accumulated incremental trim change due to MCAS malfunction can result in the same trim condition.
The difficulties in flying the aircraft in a nose-down mis-trim situation are identified in the Reuter’s article (pilot quotes). Further to this, in a situation where MCAS involves incorrect high AoA value, the inferred stall condition appears to change the pitch feel, with further increase in nose-down control forces, i.e. it is possible - even most probable based on the Lion accident, that the aircraft can reach a condition from which it is physically unrecoverable.
If the Boeing ‘MCAS’ mods sufficiently restrict the trim movement then such high forces should not be encountered, but in some circumstances (failed high AoA) the feel system additive could still apply.
EASA, other regulators, and FAA could revisit the runaway trim certification to check if any of the 737 Max physical, aerodynamic, or engineering changes (cable friction), change the level of out of trim force and thus affect the ability to recover the aircraft, or even if the difficult, unusual manoeuvre required (tech log) is viable based on modern pilot experience, sufficiently trainable, and can be identified in time.
https://uk.reuters.com/article/us-et...-idUKKCN1RA0DP
The point being made relates to an existing issue discussed in the thread Boeing advice on "aerodynamically relieving airloads" using manual stabilizer trim which refers to the separate problem of ‘runaway’ trim.
However, this is very relevant to the accident discussion because of the accumulated incremental trim change due to MCAS malfunction can result in the same trim condition.
The difficulties in flying the aircraft in a nose-down mis-trim situation are identified in the Reuter’s article (pilot quotes). Further to this, in a situation where MCAS involves incorrect high AoA value, the inferred stall condition appears to change the pitch feel, with further increase in nose-down control forces, i.e. it is possible - even most probable based on the Lion accident, that the aircraft can reach a condition from which it is physically unrecoverable.
If the Boeing ‘MCAS’ mods sufficiently restrict the trim movement then such high forces should not be encountered, but in some circumstances (failed high AoA) the feel system additive could still apply.
EASA, other regulators, and FAA could revisit the runaway trim certification to check if any of the 737 Max physical, aerodynamic, or engineering changes (cable friction), change the level of out of trim force and thus affect the ability to recover the aircraft, or even if the difficult, unusual manoeuvre required (tech log) is viable based on modern pilot experience, sufficiently trainable, and can be identified in time.
Join Date: Oct 2017
Location: Vienna
Posts: 143
Likes: 0
Received 0 Likes
on
0 Posts
It has probably no bearing here but ATC should question itself if it is a good idea, to vector a plane around in 30 second intervals if it already stated flight control problems. You would think that they immediate trade that as emergency even when not declared. That vectoring distracts the already over 100% mentally loaded crew.
If that WSJ report is correct you might wonder if SWA might get sued by some victims too. By contract forcing an aircraft manufacturer to cut corners on certification sounds strange.
If that WSJ report is correct you might wonder if SWA might get sued by some victims too. By contract forcing an aircraft manufacturer to cut corners on certification sounds strange.
Reality of corporate world. Politics and power. People who speak the truth get labeled as "being negative" and find themselves out of the company. But yeah, sooner or later it fires back.
Join Date: Apr 2002
Location: the edge of madness
Posts: 493
Likes: 0
Received 0 Likes
on
0 Posts
From Bjorn Fehrm of Leeham today:
This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.
Figure 1. The improved Pilot’s Primary Flight Display presented Wednesday. Source: Boeing.
The 737 has only two Angle of Attack sensors, so no voting can be set up between them. Instead, the system relying on the sensors can be switched off if the sensors disagree and the pilot informed about the missing function.
This is the route chosen for the improved MCAS. It will now be disconnected when the sensed Angle of Attack difference is beyond 5.5 degrees when MCAS activates and over 10 degrees for over 10s when the system is in use.
The wide allowed difference shows what I have written about before. The aerodynamics around these sensor vanes, placed at the nose sides, is dependent on how the aircraft is flown. If there is a sideslip the airflow passing the sensors will be affected and the sensor values will differ.
The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.
Was the use of only one signal OK to trigger the original MCAS? No, it wasn’t. But at least there was a rationale for this decision, whatever one might think about the rationale. A deactivation of MCAS was not an acceptable solution as it would trigger a need for an MCAS not available signal and this would mean more difference training for the Pilots migrating from 737ng to MAX.
If you have a flight control function which is triggered by a single sensor, it means the likelihood it being incorrectly activated is there. Then you implement a nonhazardous augmentation function!
You make sure it only injects the minimum correction necessary and you limit its total authority to not jeopardize the safe flight of the aircraft.
Where others focus on a single trigger signal, my biggest problem is with the function itself. If you have a weak trigger architecture, you limit the authority of what you trigger!
There was no need for the authority MCAS got. We know this today as the software fix only trims once for each elevated Angle of Attack event and limits the total trim amount to a safe level. This is regardless of the sensors being wrong or the function running wild.
It was just a very, very bad function design, and there was no need for it.
In the life of a commercial 737 MAX pilot he should never experience an MCAS augmentation, its use case was so remote. Instead, it became the most known and explained function of all on the 737 MAX. And for the wrong, very sad reasons.
There are only a few airliner OEMs in the world. There is a reason for this. It’s a challenging product to get right and the stakes are very high for any mistakes. In today’s very safe air transport system mistakes of this scale are non-acceptable.
This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.
Figure 1. The improved Pilot’s Primary Flight Display presented Wednesday. Source: Boeing.
Boeing’s MCAS fix casts light on the original implementation
Boeing presented its fix for the MCAS problems Wednesday. By it, it spotlights what was wrong with the original implementation.The reliance on a single triggering signal for MCAS
A lot has been written about the MCAS system relying on a single Angle of Attack input. This is unusual for systems involved in the flight control of aircraft. Normally you have three inputs so a voting procedure can sort out one of them if it has a problem (two singling out the third as faulty).The 737 has only two Angle of Attack sensors, so no voting can be set up between them. Instead, the system relying on the sensors can be switched off if the sensors disagree and the pilot informed about the missing function.
This is the route chosen for the improved MCAS. It will now be disconnected when the sensed Angle of Attack difference is beyond 5.5 degrees when MCAS activates and over 10 degrees for over 10s when the system is in use.
The wide allowed difference shows what I have written about before. The aerodynamics around these sensor vanes, placed at the nose sides, is dependent on how the aircraft is flown. If there is a sideslip the airflow passing the sensors will be affected and the sensor values will differ.
The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.
Was the use of only one signal OK to trigger the original MCAS? No, it wasn’t. But at least there was a rationale for this decision, whatever one might think about the rationale. A deactivation of MCAS was not an acceptable solution as it would trigger a need for an MCAS not available signal and this would mean more difference training for the Pilots migrating from 737ng to MAX.
The design of the original MCAS function
While the reliance on a single sensor is highly questionable, the architecture and implementation of the original MCAS function in inexcusable.If you have a flight control function which is triggered by a single sensor, it means the likelihood it being incorrectly activated is there. Then you implement a nonhazardous augmentation function!
You make sure it only injects the minimum correction necessary and you limit its total authority to not jeopardize the safe flight of the aircraft.
Where others focus on a single trigger signal, my biggest problem is with the function itself. If you have a weak trigger architecture, you limit the authority of what you trigger!
There was no need for the authority MCAS got. We know this today as the software fix only trims once for each elevated Angle of Attack event and limits the total trim amount to a safe level. This is regardless of the sensors being wrong or the function running wild.
It was just a very, very bad function design, and there was no need for it.
Designed to not show, it became the centerpiece of attention
MCAS was a function put there to cater for a very remote case. The pilot needs to maneuver close to the limits of the aircraft and way beyond normal flying practice, to save the aircraft from some emergency. Then MCAS kicked in to make the aircraft easy to fly close to its limits.In the life of a commercial 737 MAX pilot he should never experience an MCAS augmentation, its use case was so remote. Instead, it became the most known and explained function of all on the 737 MAX. And for the wrong, very sad reasons.
There are only a few airliner OEMs in the world. There is a reason for this. It’s a challenging product to get right and the stakes are very high for any mistakes. In today’s very safe air transport system mistakes of this scale are non-acceptable.
Join Date: Apr 2008
Location: back of beyond
Posts: 116
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Jan 2013
Location: UK
Age: 63
Posts: 37
Likes: 0
Received 0 Likes
on
0 Posts
It is important that looking at the root cause of this accident that the investigation does nots stop at the pilots actions and the poor design of MCAS but is pursued as far back as possible into why the design error occured, why it was not picke dup as a problem in development and why the aircraft was certified despite having a design error which could cause a hazardous situation to arise so easily.
Join Date: Apr 2015
Location: Yorktown Heights
Posts: 3
Likes: 0
Received 0 Likes
on
0 Posts
Thank you for your reply. This illustrates the point I am trying to make. I've learned a great deal about the 737 max from following the posts on this long thread, and have learned that the 737 is one of the few airliners that can be flown completely manually. I've also learned, correct me if I'm wrong, that manual recovery from from a seriously out of trim situation involves turning a jackscrew 10's of times to move the horozontal stabilizer back to neutral against strong aerodynamic forces.
What I learned as well was that horizontal stabilizer fulcrum is at the back of the stabilizer, and the jack screw moves the front edge. This means that aerodynamic forces push the stabilizer harder to extreme up or down positions the further it is from neutral and the higher the airspeed. The scenario has been discussed (forgive me if I can't find it in this long thread) where the pilot desperately accellerates to try to gain altitude resulting in a situation where the forces are too great to recover the trim manually.
Consider the situation if the pilot has the option of maintaining power to the trim, and other control surfaces, while shutting off other automated functions. Firstly he/she has a much easier decision than going completely manual and, once taken, will be able to make trim corrections much more quickly and against a much larger force.
Consider, also an option with a higher level of automation, but still using the most reliable and time tested components and software, where, upon activation by the pilot, sets the ac controls to best obtain level and stable flight. The 'panic' button. This way the pilot can start recovery more easily and from a known state.
These options do not absolve the manufacturer from culpability, but make it much easier to recover from higher level automation errors which inevitably will occur as aircraft automation gets more and more complex.
My question again is: Is this all or nothing choice unique to Boeing? Does Airbus offer a more graduated approach?
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes
on
0 Posts
The point being made relates to an existing issue discussed in the thread Boeing advice on "aerodynamically relieving airloads" using manual stabilizer trim which refers to the separate problem of ‘runaway’ trim.
The trim wheels in contrast will run the jack screw to the physical stops, I believe (if you can get there against the aero loads, which the other thread covers). MCAS may also be only limited by the physical stop (singular, since it only runs one way, well should only run one way).
However, this is very relevant to the accident discussion because of the accumulated incremental trim change due to MCAS malfunction can result in the same trim condition.
Please can we stop conflating Boeing's MCAS and Airbus' ALPHA PROT? The latter is part of an envelope protection system, whereas MCAS addresses handling characteristics (stick forces) at or near the stall.
Join Date: Dec 2014
Location: Schiphol
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
Sincerely, .. there is something deeply worrying .. and if it continues (and I am afraid it will, as such things have a momentum of their own), will become deeply disturbing. The following may sound a bit abstract, but it has real, deeply, and widely ranging consequences.
Simplified and compressed, this worry is based on when you rank the growth level of an organization on a scale of: failing - bad - normal - good(objectively factbased&datadriven) - best(culture).
What sets the aerospace industry apart from all others is that over a period of many years it has established a safety culture. And it should be very clear that “culture” is on a level above “factbased and datadriven”. Some subordinate examples: In compliance ‘cultural compliance’ standing above ‘tick-box compliance’. In legal the ‘intent of the law’ standing above ‘the letter of the law’. Etc, etc,..
So when a person uses ‘factbased and datadriven’ in a conversation on aviation safety, I read that as driving a level down from where we are. When he or she repeats that a number of times, then it suggests systemic issues. And the higher ranked a person is, the more serious it gets and the more persistent it will be.
Take the March 27th, 2019, Senate Appropriations Hearing on the 2020 Budget for the Transportation Department. The Secretary of Transportation using the words (when discussing the 737 MAX events and developments): .. “the FAA is professional and fact based” .. “they [FAA] are very fact based” .. and .. “on Wednesday March 13th .. [flight data on] the first 3 minutes of flight [became available] that showed similarity [with the Lion Air crash data] .. physical evidence .. [together this] was the first factual evidence”..
Take the March 27th, 2019, Senate Subcomittee Hearing on Airline Safety. The (Acting) Administrator of the FAA (in this hearing triggered by 737 MAX events) using the words: ... “[FAA’s] fact based data driven approach” .. “data driven” .. “data based” ..
You could use the sketched ranking approach yourself, to reflect on a number of issues that still await an answer.
The FAA administrator was asked on the grounding of the 737 MAX why the FAA was “lagging and not leading”, as most other authorities, countries and airlines had grounded the MAX [days] before, and the administrator holding the FAA as the ‘Golden Standard of safety in aviation’. He answered that the FAA operates “fact based” and that the facts only obtained on the 13th were required before ‘ordering’ a grounding. So the question here is, and we need more information to answer that clearly, is if these other international parties were basing their decisions on cultural grounds or on factbased & datadriven grounds.
The FAA administrator pointed to the 57,000 flights of the 737 MAX in the USA till now. These flights did not provide [any] data that gave them [the FAA, but as he stated also Boeing and three US major airline pilot associations] [any] worries on the 737 MAX. [This implies that AoA vane, or AoA data, or outputs based on AoA data, gave them no worries . A question in quite a few Pprune posts. It does not answer the Pprune questions if there was any activation of MCAS. And writing this I wonder if MCAS activation would be FDR/QAR recorded at all or would be a derived parameter]. Interesting of course is, considering the global effect of FAA decisions, if FAA decisions should be based on US data alone !! This might turn into a fundamental question. It puts my own question on (non-US) ‘launch airline’ capabilities in a new perspective.
The FAA administrator pointed out, when asked about ‘non-positive’ pilot and engineers statements quoted in newspapers on issues and problems, that there were no reports in [any] ‘ASRS’ or ‘whistleblower reporting system’ that pointed to something. He could not answer the question if Boeing had an ODA whistleblower reporting system and if and how that functioned. So a question to be answered is, if the FAA data capture has been wide enough (nationally and internationally).
Simplified and compressed, this worry is based on when you rank the growth level of an organization on a scale of: failing - bad - normal - good(objectively factbased&datadriven) - best(culture).
What sets the aerospace industry apart from all others is that over a period of many years it has established a safety culture. And it should be very clear that “culture” is on a level above “factbased and datadriven”. Some subordinate examples: In compliance ‘cultural compliance’ standing above ‘tick-box compliance’. In legal the ‘intent of the law’ standing above ‘the letter of the law’. Etc, etc,..
So when a person uses ‘factbased and datadriven’ in a conversation on aviation safety, I read that as driving a level down from where we are. When he or she repeats that a number of times, then it suggests systemic issues. And the higher ranked a person is, the more serious it gets and the more persistent it will be.
Take the March 27th, 2019, Senate Appropriations Hearing on the 2020 Budget for the Transportation Department. The Secretary of Transportation using the words (when discussing the 737 MAX events and developments): .. “the FAA is professional and fact based” .. “they [FAA] are very fact based” .. and .. “on Wednesday March 13th .. [flight data on] the first 3 minutes of flight [became available] that showed similarity [with the Lion Air crash data] .. physical evidence .. [together this] was the first factual evidence”..
Take the March 27th, 2019, Senate Subcomittee Hearing on Airline Safety. The (Acting) Administrator of the FAA (in this hearing triggered by 737 MAX events) using the words: ... “[FAA’s] fact based data driven approach” .. “data driven” .. “data based” ..
You could use the sketched ranking approach yourself, to reflect on a number of issues that still await an answer.
The FAA administrator was asked on the grounding of the 737 MAX why the FAA was “lagging and not leading”, as most other authorities, countries and airlines had grounded the MAX [days] before, and the administrator holding the FAA as the ‘Golden Standard of safety in aviation’. He answered that the FAA operates “fact based” and that the facts only obtained on the 13th were required before ‘ordering’ a grounding. So the question here is, and we need more information to answer that clearly, is if these other international parties were basing their decisions on cultural grounds or on factbased & datadriven grounds.
The FAA administrator pointed to the 57,000 flights of the 737 MAX in the USA till now. These flights did not provide [any] data that gave them [the FAA, but as he stated also Boeing and three US major airline pilot associations] [any] worries on the 737 MAX. [This implies that AoA vane, or AoA data, or outputs based on AoA data, gave them no worries . A question in quite a few Pprune posts. It does not answer the Pprune questions if there was any activation of MCAS. And writing this I wonder if MCAS activation would be FDR/QAR recorded at all or would be a derived parameter]. Interesting of course is, considering the global effect of FAA decisions, if FAA decisions should be based on US data alone !! This might turn into a fundamental question. It puts my own question on (non-US) ‘launch airline’ capabilities in a new perspective.
The FAA administrator pointed out, when asked about ‘non-positive’ pilot and engineers statements quoted in newspapers on issues and problems, that there were no reports in [any] ‘ASRS’ or ‘whistleblower reporting system’ that pointed to something. He could not answer the question if Boeing had an ODA whistleblower reporting system and if and how that functioned. So a question to be answered is, if the FAA data capture has been wide enough (nationally and internationally).
Join Date: Jun 2009
Location: Dorset
Posts: 31
Likes: 0
Received 0 Likes
on
0 Posts
I've attached the FDR readout from the first pdf report that was available on the Lion Air crash (with some annotations):
In this graph only the left side altitude readout is plotted, in the preliminary report you can see the difference to the side with working AoA:
https://www.flightradar24.com/blog/w...ary-Report.pdf
In this graph only the left side altitude readout is plotted, in the preliminary report you can see the difference to the side with working AoA:
https://www.flightradar24.com/blog/w...ary-Report.pdf
I have worked for years on the software for aircraft ‘black boxes’ and spent many long days trying to diagnose ‘why is the system doing that??’, usually in a test rig environment, but also post test flight. For what its worth, my diagnostic based on your information is as follows:-
1) There is nothing wrong with the AoA vane in itself. After the left stick shaker kicks in, both sides match perfectly (apart, obviously, the fixed offset), every little blip occurs on both L & R AoA – neither vane is bent/ frozen/ dirty.
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt.
3) The offset is not due to a ‘stuck bit’. The offset in AoA as the aircraft first started to move is about 12 deg, increases to about 17 deg and then settles on about 22 deg. A stuck bit would be 22.5, or 11.25, or 5.625; to get 17 deg would take two ‘stuck’ bits. Besides which serial buses of themselves (e.g. ARINC 429) do not have ‘stuck’ bits, they have multi bit corruption, usually recognised as a ‘bad message’ and rejected.
4) The AoA digital signal goes into the applicable ADIRU for further processing. Part of this processing *should have been* to reject any invalid input!! Another part will be to smooth the data to get rid of the noise, but this is the same software in both ADIRUs, so would not give an offset.
5) ‘Light bulb’ moment -
From Bjorn Fehrm of Leeham today:
This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.
The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.
This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.
The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.
I know which bit of code I would be diving into now!
You would expect Boeing to be gathering data from its global fleet as part of its normal product safety activities because it is core to any airworthiness assurance process. It follows that the FAA, as the lead regulator for MAX certification and continuous airworthiness, should be kept informed about the global picture by the manufacturer. As a hypothetical example, it would be madness for the FAA not to be involved in the issue of a service bulletin that only fixed problems with the left inboard spoiler for aircraft based in Europe because that is where all the occurrences had been reported.
The MAX fleet is still small, it is still very early in its service life, and it should not be a surprise that (possibly) the only 2 known failures of the system have occurred outside the USA. But if the Administrator is taking the view that 'it hasn't happened here so it doesn't count', confidence in the CAW process is going to take an even bigger hit.
The MAX fleet is still small, it is still very early in its service life, and it should not be a surprise that (possibly) the only 2 known failures of the system have occurred outside the USA. But if the Administrator is taking the view that 'it hasn't happened here so it doesn't count', confidence in the CAW process is going to take an even bigger hit.
A0283, #2743 
I agree about the general concerns and risk of escalation.
Meanwhile this forum should ‘cut the design engineers some slack’. These are people doing their normal day job, doing their best given the circumstances at the time.
We, alternatively, with enormous hindsight after two accidents and many months of ‘wisdom from the crowds’ might identify aspects which should previously have been considered.
This, for everyone is ‘the human condition’; beware of our biases.
Some posts have referred to a management ‘Go, go, go’ mentality in developing a new variant; imagine what mentalities might exist after the entire fleet has been grounded.
Consider our posts carefully so as not to add further pressure on these people in the design and test front line, either as unjustified speculative comment, ‘fuel’ for tabloid media, or inaccuracies to be used by those in government.
I agree about the general concerns and risk of escalation.
Meanwhile this forum should ‘cut the design engineers some slack’. These are people doing their normal day job, doing their best given the circumstances at the time.
We, alternatively, with enormous hindsight after two accidents and many months of ‘wisdom from the crowds’ might identify aspects which should previously have been considered.
This, for everyone is ‘the human condition’; beware of our biases.
Some posts have referred to a management ‘Go, go, go’ mentality in developing a new variant; imagine what mentalities might exist after the entire fleet has been grounded.
Consider our posts carefully so as not to add further pressure on these people in the design and test front line, either as unjustified speculative comment, ‘fuel’ for tabloid media, or inaccuracies to be used by those in government.
Last edited by alf5071h; 29th Mar 2019 at 13:04. Reason: ‘unjustified’ speculative comment
The software in the two ADRIUs is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit, so I believe they probably use different correction tables, or the algorithm to apply to them is subtly different, possibly something as simple as using a wrong sign.
Join Date: Apr 2014
Location: Korea
Posts: 126
Likes: 0
Received 0 Likes
on
0 Posts
Is it easy to explain in more detail why and how the software should behave differently between treating left and right AoA sensor data?
It seems that no matter how the ADIRU software might possibly be different, it ought to take a fairly simple comparison analysis to detect an inconsistency, such as a flipped sign or a logical error.
Join Date: Mar 2006
Location: Vance, Belgium
Age: 62
Posts: 270
Likes: 0
Received 5 Likes
on
3 Posts
...
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt.
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt.
it looks as though, at least for the NG, the AOA sensor provides an analog output to both the ADIRU and the SMYD box.
I couldn't find a diagram of the ADIRU Analog interfaces, but here is the SMYD Analog Interfaces diagram.
The three AOA sensor wires are labeled "SIN", "COS", "COM", whose meanings are obvious.
[img]https://3.bp.********.com/-qCwEtMS3-yU/W-xF4QyEZLI/AAAAAAAAFCo/mpLqB83Yau4ph1pPKUjgqSKBFmPoYOWugCLcBGAs/s640/Screen%2BShot%2B2018-11-14%2Bat%2B7.56.25%2BAM.png
Edit: somehow pprune replace "b l o g s p o t" with "********". If you want to see the diagram, you have to retype "b l o g s p o t" (without spaces) after clicking the link.
Last edited by Luc Lion; 29th Mar 2019 at 13:37.
Join Date: Mar 2019
Location: Bristol, UK
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
I think VicMel's analysis is compelling. The AoA vanes are probably conforming to spec and the fault is further down the chain. It is possible that there is a fault in the nose to wing conversions as described. But these faults are reasonably easy to prevent through peer review processes such as code walkthrough and also module testing. What is more difficult is if an event causes some other subsystem to write garbage into the working space of the AoA handler, and that event is low probability. This sort of thing is really difficult to find in real-time systems.