|
Originally Posted by jagema
(Post 10425059)
Likewise, when I read their statement, "to make a safe airplane safer" I also raised the eyebrow.
Evidently FAA and Boeing both agreed these were required changes to MCAS logic from what they could learn from LionAir. Why the type was not grounded then and instead they let the fleet fly while developing the fix which is now being required to have them airworthy again is very questionable... "to make a safe airplane safer" is just a Coué-method equivalent of "to make a dangerous airplane a little less dangerous" Or an aeronautical equivalent of washing powder advertisement "to wash whiter than white". If it's whiter now, it was not white before, it was grey :E |
Originally Posted by FCeng84
(Post 10425075)
VicMel - I really appreciate your thoughtful response. I sense that overall you and I are on the same page. Please allow me to provide a few inputs on your points:
A i) The update in work by Boeing is in response to the Lion Air accident, not the Ethiopian accident. Hopefully we will know more about the Ethiopian accident soon and only then will it be possible to determine if this same update would have helped lead to a better outcome in Ethiopia. A ii) It seems that the proposed update will disable MCAS if the two AOA vanes do not track each other sufficiently. The severity of the degradation in handling qualities without MCAS must be minor enough to allow for this reduction in MCAS availability. Boeing must be assuming some probability for an AOA sensor failure and then showing that it is acceptable to turn MCAS off twice as often as a failure of either AOA sensor would lead to MCAS shut down. A iii) No MCAS when AOA vanes do not track. See A ii above. A iv) I doubt that we will find that the MCAS update reduces the size of a single increment of MCAS stabilizer motion. I can't imagine that Boeing would have given this function any more authority than absolutely needed to meet FARs and thus there is probably no room to reduce its single increment authority. C) MCAS is implemented within the FCC within the same software that controls other automatic stabilizer control functions such as offload when A/P is engaged and STS. This code already required to be designed to high standards. Conclusion a) We may need to rely less on critical crew action, but there must be some base level that can be counted upon. I suggest at least: - RTO for engine out below V1 - Pull for takeoff somewhere near Vr - Gear and flap management and coordination with associated speeds throughout flight - Comply with ATC guidance - Ability to navigate to destination - Ability to capture and follow glideslope and localizer to runway and command landing flare - Recognize unstable approach and execute go-around - Sorry for the length of this list. My point is that there are many pilot actions we count on to maintain safe operation Conclusion b) I fully agree and suggest adding that if the inputs are garbage the system should be robust enough to maintain safety. Thanks! |
https://www.reuters.com/article/us-e...-idUSKCN1R11AK
March 20, 2019 / 4:39 AM / Updated 7 minutes ago Boeing, FAA officials called to testify in U.S. Senate on 737 MAX plane crashesMaggie Fick, Cindy Silviana, David Shepardson ADDIS ABABA/JAKARTA/WASHINGTON (Reuters) Boeing Co faced growing pressure in Washington on Wednesday with U.S. lawmakers calling for executives to testify about two crashed 737 MAX jets even as the world’s biggest planemaker works to overcome obstacles to returning the grounded fleet to the skies. |
deltafox44, #2203 The 737 Max testing would have encountered and evaluated the deficient condition - how else would the shortfall be recorded. Perhaps not so for the abnormal drills. An inflight failure of MCAS, in addition to being detected and managed, should not create any significant hazard as the critical flight region is at or beyond the limit of a normal flight envelope. Although I would be concerned about a GA, depending on the level of the initial, reduced thrust setting. The safety case for using manual trim has been made in considering current failure conditions; thus MCAS unavailability should not be more frequent than those, but a ‘fix’ might not even result in the loss off trim for a system failure. Curtain Twitcher # 2201, Your concerns over training should be revised by reconsidering the situation if the existing system were to have been described, with the use of the ’post hoc’ abnormal drill. MCAS training might have been a cursory acknowledgement of the system and that its operation will not intrude on normal flight conditions. The abnormal procedure ticked off by the existing runaway trim drill and continued flight without trim. Discussion of inadequacy might only arise after ‘the first incident’. In this my concern, even with a ‘fix’, would be more about the assumptions for runaway trim, pilot identification, the crews’ ability to manage the stick forces, and to physically move the trim wheel. |
Originally Posted by yanrair
(Post 10425170)
Martin.
Gordon speaks a lot of sense and has it right and well balanced. Yanrair |
Originally Posted by yanrair
(Post 10425032)
Gums says 'cutting accident crew some slack". So does everyone I think. If they made an error and we have no idea if they did, it would not be their fault but poor training. I have never met or heard of a pilot who sets out to do a bad job or kill himself. Other than the Pyrenees incident of co
course. There seems to be a bit of a muddle about AoA sensors and Airpspeed disagree. They are not necessarily connected in any way. AoA detects a stall by measuring the angle of attack with two sensors, one each side. Measuring the angle of airflow. Speed is measured by sensing air pressure in a tube facing forwards (pitot)and converting that into Indicated Airpspeed. Not the same as real speed. GPS measures real speed and is almost never wrong. Say you have blocked pitot tubes as per aF 447, the AoA still works and stall warning still works. Say you have frozen AoA vanes so that they are not able to detect stall, or incorrectly detect a stall (as is suggested in these Max incidents) then the Airspeed should still work. Another scenario is that one airspeed is faulty, but the other two work - there are three airspeed indicators. That one is easy since you go for the two that agree. Backed up with GPS. And in all these cases GPS will still work. So the changes of losing AoA information AND Airspeed information at the same time are pretty remote. This is just for information since there seems to be a misunderstanding about the functions of the various systems here. There is one last way of determining speed. Pitch and power. 6 degrees of pitch and 60% N1 power will fly straight and level and at a safe speed NO MATTER WHAT ANY OF THESE OTHER SYSTEMS ARE SAYING. [True for lower levels] The point is I suppose that this is a very complicated area but we can also overcomplicate it. Yanrair The main reason why the previous pilot failed to write the stick shaker and cutting off the stab trim, probably because: 1. They thought the nose down trim was simply STS malfunctioning and trimming the other way due to air speed difference [i.e. IAS disagreement]. 2. They are convinced that all the plane's problems came from whatever causing the IAS disagreement and unreliable ALT. Little that they know had the stick shaker and stab trim cut-off incident/action were also being written, we'd end up having a different conversation right now [AND perhaps the MCAS thingy would've been remained hidden...]. In other words, we can just throw off all the discussion about malfunctioned AOA vanes or AOA disagreement stuff when we are trying to imagine about the "why and the what" of the Lion Air's pilot action, because they didn't have any means to consider that possibility. |
Originally Posted by yanrair
(Post 10424799)
........737 had a secret weapon- airstairs! ..............
In many years of getting on and off 737s I have never, to my recollection, done so by way of said air-stairs. It's like saying Tupolevs have an advantage cause their undercarriage allows them to land in a cow paddock. Might be useful in time of war but seldom see 'em out grazing with the herd. |
Originally Posted by WingNut60
(Post 10425217)
So secret that they never let anyone see them.
In many years of getting on and off 737s I have never, to my recollection, done so by way of said air-stairs. |
Stumbling back in to deal with days of posts saying "well just look at other sensors!"
Sensor fusion is hard enough to do when you assume all your sensors are working correctly. When you add in "oh, and, toss out any sensors that you think are wrong" you end up in an unverifiable mess. A rule of thumb is that any variable you add into the decision process introduces at least one (and usually far more than one) potential defect. This is a poor candidate for Machine Leaning AI, because there are not enough good AND bad scenarios to train on.. so you have to fall back on algorithmic methods, and you pretty much can't short-cut that.. which means a lot of development work and validation work. TANSTAAFL.. OK, I'll shuffle back to the gate now. ...tom |
Originally Posted by DaveReidUK
(Post 10425227)
Let me help you out:
Just pointing out that for most operator's in these parts, if they can't get an air-bridge, are happy to make do with the push-up stairs with a little bit of protection against the sun and / or rain before you leap on the bus. Not a concern for Ryanair, I guess. |
WSJ article: Inside U.S. Airlines’ Decisions to Keep Flying the 737 MAX
WSJ article: Inside U.S. Airlines’ Decisions to Keep Flying the 737 MAX
Inside U.S. Airlines’ Decisions to Keep Flying the 737 MAX by Scott McCartney Ask chief executives what an airline’s first responsibility is and most will quickly respond that it’s safety. But that industry norm was challenged last week by the Boeing 737 MAX. The CEOs of Southwest, American and United decided to keep flying the plane after the second MAX 8 crash within five months. Three days after the March 10 crash in Ethiopia, after much of the rest of the world had ordered the plane grounded, the Federal Aviation Administration changed course and grounded Boeing’s new version of the 737 in the U.S. What appeared to some as hesitation raised questions of whether potential revenue loss and schedule disruption were placed ahead of safety at Southwest, American and United. One CEO, Gary Kelly of Southwest, talked to the Journal about the process he went through last week to keep flying even as many customers and some employees expressed fears about the plane. The choice, he says, was whether to disrupt flights out of an abundance of caution or continue based on conclusions from the airline’s internal safety team. “The only real factor that we were thinking about was safety,” Mr. Kelly says. “And then No. 2 was to get our customers where they want to go.” Top leaders at American, which has 24 MAX 8 jets, and United, which was flying 14 MAX 9 planes, declined interview requests. American did provide two safety officials to discuss the airline’s decision to keep flying. All three airlines say their decisions were largely data-driven. They routinely download thousands of data points from new aircraft like the MAX, and some began new monitoring to track performance of sensors suspected of contributing to the Oct. 29 crash of Lion Air Flight 610 in Indonesia. The focus on data in aviation safety is seen as a major cause of improvement in the last decade or two. But data don’t always capture the unknown, and just because an airplane hasn’t experienced a problem doesn’t mean it won’t have that problem in the future. Pilots routinely shut down systems suspected of malfunctioning and divert to the nearest airport or wait to take off until maintenance checks something. In aviation, there’s an adage: Better to be down here wishing you were up there than up there wishing you were down here. In the case of the MAX, similarities between the crashes and other factors suggest some kind of problem. Boeing had identified deficiencies with its Maneuvering Characteristics Augmentation System (MCAS), new to the MAX, and was working on major software changes expected by the end of April. Jim Hall, chair of the National Transportation Safety Board from 1994 to 2001, thinks Boeing and the FAA should have acted sooner to ground the plane. He says grounding by airlines would have been appropriate given the questions about MCAS, but not necessarily their responsibility. “The prudent, responsible thing to do, if you actually put aviation safety first, would have been to ground the plane,” Mr. Hall says. Financial questions didn’t come into consideration, all three airlines say. Southwest’s Mr. Kelly says his internal, independent safety team was telling him that data collected from the MAX, which Southwest has been flying since 2017, showed no problem. (The airline flies 34 of those planes.) And even if problems were to occur, Southwest pilots have been briefed on the system that was suspected of malfunctioning in both crashes and have routinely trained on steps to recover should the MAX’s computer mistakenly force the nose down. “These safety-management systems don’t speculate,” Mr. Kelly says. Southwest, which has the largest U.S. fleet of MAX jets, also completed installation earlier this year of warning lights in its MAX cockpits that alert pilots if the two angle-of-attack sensors disagree, a sign one is failing. A faulty angle-of-attack indicator is suspected of playing a role in the Lion Air crash. But with many customers calling on the airline to change flights booked on the MAX and some employees nervous as well, factors beyond safety data did come into play. At the same time, Mr. Kelly says he was also influenced by the FAA’s insistence, up until March 13, that the plane was safe to fly. “There’s a science to it. There’s also art and just compassion as well. Absolutely all of that needs to be factored in,” he says. The process, he adds, “worked as designed.” At American, officials say the same two factors Southwest saw convinced Chief Executive Doug Parker to fly on: data showing no problems and confidence pilots could handle any problems. American had also been studying its MAX 8 jets more closely after the Lion Air crash, increasing analysis of data from monitors installed on the angle-of-attack sensors and the horizontal stabilizer, the part of the tail that moves to point the nose of the plane up or down. No problems had shown up, says Neil Raaz, American’s director of flight safety. “We just didn’t see the indications that told us our airplanes were unsafe, and frankly, we still haven’t,” says Mr. Raaz, who is also a Boeing 737 captain and has U.S. Navy training in accident investigations. But even if there are unknown problems with the MCAS system, American says it is confident pilots can recover because they train for similar problems. MCAS is supposed to push the nose of the plane down if it gets too high by moving the horizontal stabilizer, a panel used all the time to “trim” the airplane. The trim system keeps the plane level, or at a designated rate of climb or descent. The autopilot trims the airplane, or pilots can do it manually. (Ethiopian Airlines has said its pilots had new training for 737 MAX planes after the crash in Indonesia.) If the MCAS system malfunctions, pilots say the prescribed fix is to use manual trim to stabilize the plane, and then disconnect the trim system. There’s a cutoff switch on the center pedestal of the 737, not far from throttles, marked “Stab Trim.” Pilots routinely train to disconnect the automatic trim in the case of runaway trim with autopilot use. Write to Scott McCartney at [email protected] Appeared in the March 21, 2019, print edition as 'Why the 737 MAX Kept Flying.' |
w1pf :
Yup, no free lunch. But we don't need a free lunch -- we don't even need a really cheap lunch. What we do need, if we're going to give an automated system authority over the most powerful control surface on an aircraft, is a system design and implementation that takes every reasonable and practicable step to make sure that the inputs upon which it is relying are valid. Whatever the cost of that insurance -- sensor fusion, voting logic, simple crew warnings, etc. -- is virtually certain to be less than the cost of not providing it and letting a confused HAL fly airplanes into the ground. What could be more expensive than killing 150-200 souls, and losing a $120M hull, because of a sensor failure and an unmanageable sensory overload on a flight crew? |
Originally Posted by nyt
(Post 10425097)
What about the other way around ? Calibrating GPS values continuously based on working sensors and use GPS relative data as a backup in case of sensor failure ? That should work well enough as a workaround while the issue is being sorted, in my opinion.
Originally Posted by w1pf
Sensor fusion is hard enough to do when you assume all your sensors are working correctly. When you add in "oh, and, toss out any sensors that you think are wrong" you end up in an unverifiable mess. ... A rule of thumb is that any variable you add into the decision process introduces at least one (and usually far more than one) potential defect.
Yes, W1PF, sensor fusion and data crosschecking validation approaches Doctorate-degree difficulty - what data do you really trust? However, NYT's suggestion that you can look for unexpected changes is a pretty reasonable, and long-established, method of data validation. I do a lot of work with telemetry data. It's (sometimes) easy to spot "dropout" where the radio signal was interrupted and a value spikes, because value X(t) is starkly different than the surrounding data X(t-1) and X(t+1). It's also (usually) pretty easy to build a metric for how fast a value CAN change... AOA, for example, can only change by X degrees per second, due to the airplane and sensor physics. Any faster, and there's something worth flagging as a likely error. That has been previously mentioned in this thread, although I don't feel inclined to go find the exact quote. On the other hand, it can be very hard to recognize frozen data, where the "sample and hold" process simply says "Gee, nothing new has been received, so I guess it's still the same as before." For example in this case, AOA started at X degrees before takeoff and didn't move... is that bad? Yeah, probably. But other parameters may not be so easy to recognize frozen sensors. I have had that happen many times working with flight test instrumentation data for nearly 30 years. It can be very hard to convince yourself that a parameter is not working. So yes, it's pretty easy to say "that value must be wrong" IN SOME CASES. But not all. So building a definitive validation comes with its own risks. Nonetheless, I suspect that it would catch enough errors that W1PF's concerns don't mean you shouldn't do it. Catching 50% of errors is better than catching 0% of them. And I think that with enough attention, especially with today's computing resources where you really CAN test every possible scenario, you could validate the model pretty well. |
Originally Posted by Capt Kremin
(Post 10425274)
Well said. The Ethiopian Investigators have gone very quiet. Usually after a few days with the Flight recorders a prima facie cause/malfunction/error can be quickly identified. We know the MCAS is probably implicated in some way.
What we don't know is why. If the initiator was a sensor problem like Lion Air it should be obvious. This aircraft appeared to have an MCAS event just after liftoff. That should not happen. |
I hope Boeing fully risk assess this MCAS system in its entirety before they apply a software patch fix. That is to say that so far we have seen a compromise on safety due to an AOA single sensor failure. Now if the same thing were to occur with a flap sensor on a manual approach, would the results be any different? |
Sensor fusion is not an horribly complicated process. You can do it to estimate for example the AOA and airspeed from inertial data/servo/throttle information and a dynamical model of the airplane. I worked on this for UAVs:
It requires only the accelerometers and the gyros (the GPS should not be trusted as it could be spoofed from a passenger). Problem is that, it is basically uncertifiable. No guarantees of convergence as you have a nonlinear dynamical model with multiple modes. Even Extended Kalman Filter would probably not be certifiable (what happens around the stall point), so UKF or EnKF are out of the question. Multiplying the number of sensors helps to some extent, but there are many cases of multiple simultaneous sensor faults like the A320 crash in Perpignan or the upset of a Cathay A330 a few years ago. Besides adding sensors can use a completely different physical principle (like Lidars) to measure airspeed, AOA and sideslip), I don't think that this problem could be solved easily. |
Originally Posted by capngrog
(Post 10425299)
I recall having seen/read something about the MCAS that described it as a "background" feature that pilots would be unaware of under normal circumstances. The article/report went on to describe how a feature of the (MCAS) operation was that the console (aisle pedestal)-mounted trim wheels would not move when MCAS was activated. This had me scratching my head in that the trim wheels are mechanically connected to the jackscrew gearbox and some new engineering would be required to allow jackscrew movement without trim wheel movement. At any rate, I've been trying to find the article with, thus far, no success. Today I had lunch with a friend (retired B-727 Captain) who mentioned that he had also seen the article/report. I've seen several descriptions on how runaway stabilizer trim is dealt with in the B-737, and the techniques have been described as thus: 1) Counter trim using yoke mounted trim switches; 2) Grab and hold the manual trim wheel(s); move the STAB trim cut out switches to cut out. This afternoon, Aviation Week had an online article entitled: "The Boeing 737 MAX MCAS Explained' which cited only two means of stopping runaway MCAS operation: 1) Counter trim using yoke mounted trim switches; 2) move the STAB trim cut out switches to cut out. No mention was made of grabbing the trim wheels. The online article further stated: "The MAX flight-control law changes from speed trim to the MCAS because the MCAS reacts more quickly to AOA changes".
My question is: Will MCAS activation be reflected in movement of the trim wheels? Either the CAPT, PF or both which were occupied on solving the puzzle suddenly realized that all this time the ghost in the machine had been busy and still continued incessantly bringing the plane's nose down to the end of the jackscrew, it's all too late for them to recover. |
I sense that we need another thread in order to coral the discussions about
the original certification basis; how MCAS and other instruments interface with the pilot; What is the final corrective action etc. Mixing it in with two separate accident status threads gets confusing about the accident facts vs theory My only question at this time concerns the certification basis and the onward investigation by the Inspector General of the FAA and the input of the FBI. Such as; when was the type certificate awarded (date, modifications etc.) |
My question is: Will MCAS activation be reflected in movement of the trim wheels? - GY |
Let ne get this straight. a clean stall. Pulling gently back, as we get to 1.1 Vs or so the cowls tend to fly the airplane nose up so the stick pull force lightens instead of getting slowly heavier.
That doesn't suit pedantic test pilots, they want a smoothly increasing pull force all the way to the break. So we put a ghost in the circuit to drive the stabilizer L.E. nose-up to fly the airplane nose down so we have to pull that little bit harder. Fine. Now we are hand flying clean at 250 knots, a dozy AoA probe drives the stab L.E. nose up. Back stick rqd to hold attitude. Re-trim. Release switch. The airplane is now in trim. A few seconds later it happens again. I don't see it getting any more than minimum displacement from the in-trim position. Also. the bacon slicer, it must have moved while the ghost was trimming because the stab trim screw-jack drives it full time. And v.v. Should be flyable. Even without operating the stab trim cut-outs. However, airplanes functioning irrationally can be very disconcerting. I can see a crew nonplussed by such an apparently inexplicable and sinister turn of events getting, in the end, confused. I think Boeing the FAA and EASA are going to have to talk pretty fast to get out of it. A single failure like that shouldn't cause this much grief. Btw, the only 737 pilots who by now aren't on to the existence and function of the stab trim cut-outs must have been asleep or dead for the last six months... so why aren't we back in the air? |
| All times are GMT. The time now is 07:49. |
Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.