737MAX Stab Trim architecture
Join Date: May 2008
Location: denmark
Posts: 9
Likes: 0
Received 0 Likes
on
0 Posts
What level of fault tolerance is needed?
Is a software fix sufficient? Is the B737M flight controllers reliable enough for the task?
The software changes to the B737M made the detection of a ’trim runaway’ failure mode much more difficult since it is behavior is changed, and masked by other faults and noises.
It may also have increased the frequency of the trim runaways.
If the original DFMEA/Design Risk Assessment had the conclusion that a ’trim runaway’ is something that is easy for the pilots pilots to handle, then the safety case is limited to providing reliable ’cut-out’ switches (And some training).
If the conclusion in the new DFMEA/Design Risk Assessment is changed since it can’t be expected that the pilots reliable can detect and isolate the fault, then this drive a significant change to the hardware (and software) requirements.
It is not enough to have redundant sensors as the voting between flight controllers can also fail. The actuator and its electronics as well as the network may also fail.To me it seems that the THS control is moving in to the realm of a software controlled primary control surface (since if can overpower the muscle strength of pilots if not isolated fast enough). In essence requiring a FBW like system with full byzantine fault tolerance.
What are the capabilities of the existing THS control system:
-Fail safe by means of lock-step operation?
-Voting between fail-silent replicas with byzantine fault tolerance?
The software changes to the B737M made the detection of a ’trim runaway’ failure mode much more difficult since it is behavior is changed, and masked by other faults and noises.
It may also have increased the frequency of the trim runaways.
If the original DFMEA/Design Risk Assessment had the conclusion that a ’trim runaway’ is something that is easy for the pilots pilots to handle, then the safety case is limited to providing reliable ’cut-out’ switches (And some training).
If the conclusion in the new DFMEA/Design Risk Assessment is changed since it can’t be expected that the pilots reliable can detect and isolate the fault, then this drive a significant change to the hardware (and software) requirements.
It is not enough to have redundant sensors as the voting between flight controllers can also fail. The actuator and its electronics as well as the network may also fail.To me it seems that the THS control is moving in to the realm of a software controlled primary control surface (since if can overpower the muscle strength of pilots if not isolated fast enough). In essence requiring a FBW like system with full byzantine fault tolerance.
What are the capabilities of the existing THS control system:
-Fail safe by means of lock-step operation?
-Voting between fail-silent replicas with byzantine fault tolerance?
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
Forgive my curiosity as a complete outsider. Do pilots ever refer to the trim scale on the pedestal, other than before takeoff? Is is part of any scan, or checklist?
Join Date: Apr 2008
Location: Australia
Posts: 669
Likes: 0
Received 0 Likes
on
0 Posts
I would suggest that attempting to comply with a 'feel' requirement by moving a powerful control surface is bad engineering from the start.
But, there was no other way open to them for creating a pitch-down moment, without major airframe modifications. It must have been a miserable time at Boeing when, after realising the MAX needed pitch-down moment(s) at high alpha, it was decreed that they would have to come from the stabiliser. The investigations into certification will surely reveal the opposition within Boeing to taking this route. Will be interesting!
Salute!
Some good aero stuff being discussed.
I have wondered since November if using some variation of aerodynamically loaded slats ( F-100 and others) on the nacelles or even the leading edge of the wing could have moved the center of pressure further aft at high AoA to keep the pitch moments O.K.
I realize that the goal is to have the trim drag at a minimum for cruise AoA, but once up there near stall you would not be worried a lot about fuel economy, ya think?
Gums wonders....
Some good aero stuff being discussed.
I have wondered since November if using some variation of aerodynamically loaded slats ( F-100 and others) on the nacelles or even the leading edge of the wing could have moved the center of pressure further aft at high AoA to keep the pitch moments O.K.
I realize that the goal is to have the trim drag at a minimum for cruise AoA, but once up there near stall you would not be worried a lot about fuel economy, ya think?
Gums wonders....
Join Date: Apr 2008
Location: Australia
Posts: 669
Likes: 0
Received 0 Likes
on
0 Posts
I realize that the goal is to have the trim drag at a minimum for cruise AoA, but once up there near stall you would not be worried a lot about fuel economy, ya think?
Something that would give the pitch-down moment at high alpha, but would not add drag in the cruise. I haven't come up with anything yet. The closest I have come is the idea of some surfaces protruding from the new tail cone. Having such a long arm would mean they wouldn't have to be too big and ugly.
If I can ask a hopefully not trivial question ... for a long time there have been not only stick shakers but, by extension, stick pushers. Was the Trident the first with this ? And how does MCAS differ in its principle to a stick pusher, apart from operating on a separate control, the trim rather than the yoke ? And if it's established, why did Boeing do it on a different control rather than push the yoke forward ?
There's an interesting account of dealing with this from 55 years ago here. Compare and contrast with what Boeing have done. "3,500 test stalls" !!!
https://www.flightglobal.com/FlightP...20-%200246.PDF
There's an interesting account of dealing with this from 55 years ago here. Compare and contrast with what Boeing have done. "3,500 test stalls" !!!
https://www.flightglobal.com/FlightP...20-%200246.PDF
WHBM,
MACS relates to stability.
Stick push relates to stall, identification and initial recovery motion.
The 737 stall characteristic is identifiable and has satisfactory recovery action.
MACS relates to stability.
Stick push relates to stall, identification and initial recovery motion.
The 737 stall characteristic is identifiable and has satisfactory recovery action.
Salute!
Granted, Safety, MCAS is not stall prevention or stall recovery. But media and many folks on these very forums still feel that it is.
In all honesty, having the stick get "lighter" due an aerodynamic effect at high AoA can be conducive to entering a stall. But I do not believe the 737 pitch moments would be like the VooDoo I flew 50 years ago that got a "light" stick , then went end over end, heh heh.
Gums sends...
Granted, Safety, MCAS is not stall prevention or stall recovery. But media and many folks on these very forums still feel that it is.
In all honesty, having the stick get "lighter" due an aerodynamic effect at high AoA can be conducive to entering a stall. But I do not believe the 737 pitch moments would be like the VooDoo I flew 50 years ago that got a "light" stick , then went end over end, heh heh.
Gums sends...
WHBM,
safetypee and gums are absolutely correct.
When we did CofA air tests on VC10s, we always had a third AoA vane mounted on a plug that replaced the glass of one of the cabin windows and an AoA indicator connected to it mounted on the pilot's instrument panel coaming. During stall tests, one crew member was required to watch it like a hawk and shout if it approached (I think) 16degs before the stick pusher pushed.
safetypee and gums are absolutely correct.
When we did CofA air tests on VC10s, we always had a third AoA vane mounted on a plug that replaced the glass of one of the cabin windows and an AoA indicator connected to it mounted on the pilot's instrument panel coaming. During stall tests, one crew member was required to watch it like a hawk and shout if it approached (I think) 16degs before the stick pusher pushed.
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes
on
0 Posts
Are you meaning MCAS with the AOA signal it is using failed high? Try searching on my username. I have made a number of posts that describe how MCAS works nominally and if its AOA signal is failed high. Good related info in both the Rumors and News and the Tech Log sections of PPRUNE
Join Date: Mar 2019
Location: Moon
Posts: 8
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Feb 2017
Location: Bucharest
Age: 39
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
You said it well when you said: "For good or evil". In fact we will see that it's NOT the "good" that will win in this AI (artificial intelligence) fantasy, but the evil itself. We just had 2 awful answers (the 2 accidents of the MAX) from our subject regarding how does the plane try to automatically (apparently intelligent) trim the nose down continuously until "it believes" that the stall has been eliminated. One A330 had a cruise incident while another A330 and a belly (crash) landing due to "automation gone wild" encounters! This case showed one more glimpse of what it's like to lay your belief in automation.
If safety is still to be no.1, then automation should only be there to relax the pilot, NOT turn him into a donkey that doesn't know how to fly anymore after so much "auto" in his head. The pilot remains a pilot, if he still wants to be called that way anymore.
Regards!
If safety is still to be no.1, then automation should only be there to relax the pilot, NOT turn him into a donkey that doesn't know how to fly anymore after so much "auto" in his head. The pilot remains a pilot, if he still wants to be called that way anymore.
Regards!
Join Date: Feb 2009
Location: Seattle
Posts: 379
Likes: 0
Received 0 Likes
on
0 Posts
You said it well when you said: "For good or evil". In fact we will see that it's NOT the "good" that will win in this AI (artificial intelligence) fantasy, but the evil itself. We just had 2 awful answers (the 2 accidents of the MAX) from our subject regarding how does the plane try to automatically (apparently intelligent) trim the nose down continuously until "it believes" that the stall has been eliminated. One A330 had a cruise incident while another A330 and a belly (crash) landing due to "automation gone wild" encounters! This case showed one more glimpse of what it's like to lay your belief in automation.
If safety is still to be no.1, then automation should only be there to relax the pilot, NOT turn him into a donkey that doesn't know how to fly anymore after so much "auto" in his head. The pilot remains a pilot, if he still wants to be called that way anymore.
Regards!
If safety is still to be no.1, then automation should only be there to relax the pilot, NOT turn him into a donkey that doesn't know how to fly anymore after so much "auto" in his head. The pilot remains a pilot, if he still wants to be called that way anymore.
Regards!
There are plenty of examples of automation in the current state of the art in commercial aviation. Many of the performance improvements we have realized over the past generation would not have been possible without automation. That ship has sailed and there is no turning back to pre-automation days in aviation.
On the other hand, while I have no doubt that AI will find itself playing a greater and greater role in commercial aviation over the coming years, we need to proceed with caution down that road. It is one thing to design an AI system to drive a car where you always have the option of slowing and stopping on the side of the road if something unexpected comes up that the AI determines it is not ready to sort out. In an airplane it is quite another story when the unexpected happens. There are no pull over and stop options between takeoff and landing.
Pax. It's been a while since I had anything to do with fault trees but presumably part of the technical evidence underpinning the design solution to MCAS would have started by the need to show that a failure outcome for the system was less than some low, and acceptable, probability threshold. This logic would have a starting event which represented the need for the system to intervene, the aircraft being in the dynamic state that challenged it's stability for which help was needed. That logic sequence must have given the right numbers even when subevents like aoa sensor failure were included.
However the next page of the analysis, and a new fault tree, would be considered, this to cover eventualities on the system intervening when it shouldn't. AOA faults would be one initiating event and would be ascribed a probability of occurrence. To my layman mind, this would be more probable than the starting event in the first tree, ie AOA failure is more likely than the aircraft finding itself in a bad dynamic state.
What I can't understand is if this were true then the rest of the fault tree after AOA failure must also get to an acceptably low probability despite the fact that it is the more likely event chain to start with. Subsequent mitigations, such as the intervention of a trained crew, would have to have a correspondingly low failure rate to make up the numbers.
Can't see the numbers for that working out.
Would love to see the workings out but don't suppose we ever shall.
However the next page of the analysis, and a new fault tree, would be considered, this to cover eventualities on the system intervening when it shouldn't. AOA faults would be one initiating event and would be ascribed a probability of occurrence. To my layman mind, this would be more probable than the starting event in the first tree, ie AOA failure is more likely than the aircraft finding itself in a bad dynamic state.
What I can't understand is if this were true then the rest of the fault tree after AOA failure must also get to an acceptably low probability despite the fact that it is the more likely event chain to start with. Subsequent mitigations, such as the intervention of a trained crew, would have to have a correspondingly low failure rate to make up the numbers.
Can't see the numbers for that working out.
Would love to see the workings out but don't suppose we ever shall.
Moderator
this is certainly a heavily curated forum
One needs to accept that it can take a little while for a mod to review and pass a new post to the thread. Once again, I think I can say that we don't unduly constrain posting to this or any other thread in TL.
One needs to accept that it can take a little while for a mod to review and pass a new post to the thread. Once again, I think I can say that we don't unduly constrain posting to this or any other thread in TL.
Satcom Guru post 19th March
I posted this a couple of days on the Rumours thread where it was suggested it might be more relevant and of interest here, so in case it is.....
Ethiopian ET302 similarities to Lion Air JT610
Ethiopian ET302 similarities to Lion Air JT610
Reports from Ethiopian investigators have implicated the same Angle of Attack (AoA) sensor malfunction that was observed on Lion Air. Lion Air captain AoA sensor read about 22 degrees higher than the First Officer AoA sensor (a large bias error). Initial assessment of Lion Air AoA failure modes did not reveal any obvious electrical malfunction that could create the bias. The simplest explanation was that the AoA vane had been bent, causing a gross aerodynamic offset in the readings. If ET302 encountered the exact same offset, with the likelihood of it being bent exactly the same way not being conceivable, some other factor must be in play. For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA values (all other bits would match). Is it possible that the ARINC 429 word is getting corrupted (software defect)? If the ET302 offset was something like 20 or 24, this theory falls apart.
Full post
https://www.satcom.guru/2019/03/ethi...lion.html#more
Full post
https://www.satcom.guru/2019/03/ethi...lion.html#more
Bjorn's Corner article on JT610 and ET302 crash
Link..
https://leehamnews.com/2019/03/22/bj...-2/#more-29712
The article is not really relevant to the precise topic of this thread as it speculates on the possibility of elevator "blowback" being a factor in the crashes. HOWEVER, I thought the following exchange of comments on the article might be of interest, particularly the emboldened bit in the reply by poster Transworld. As someone who has nothing to do with the industry it was a fascinating piece of information, apologies if it's something professionals knew from day 1.
Knuffi
March 22, 2019 Does this mean that – when the FDR shows the left AoA sensor having 25deg and the right 5deg – the AoA vanes really where in this position? Or would you still consider a failure in how the data was processed by the flight computer yielding the difference?
Reply
https://leehamnews.com/2019/03/22/bj...-2/#more-29712
The article is not really relevant to the precise topic of this thread as it speculates on the possibility of elevator "blowback" being a factor in the crashes. HOWEVER, I thought the following exchange of comments on the article might be of interest, particularly the emboldened bit in the reply by poster Transworld. As someone who has nothing to do with the industry it was a fascinating piece of information, apologies if it's something professionals knew from day 1.
Knuffi
March 22, 2019 Does this mean that – when the FDR shows the left AoA sensor having 25deg and the right 5deg – the AoA vanes really where in this position? Or would you still consider a failure in how the data was processed by the flight computer yielding the difference?
Reply
TransWorld
March 22, 2019 Presently there is no way to tell.If the flopped to full up on less than takeoff speed, both should be flopped the same.How these work, what portions they go to when no significant airflow is all unknown to other than ATR pilots. Possible to even have a test command drifting around in the systemThe two comput3ers are programed by two different teams (its a method of ensuring no code is written duplicated to the computer that is identical so their is not a dual failure under the same circumstances) that said, it seems the two issue were both pilot side so there may be something in that coding on that side. Swap to the other side for control and it should go away but Lion it did not, so just more questions.
Alchad
March 22, 2019 Presently there is no way to tell.If the flopped to full up on less than takeoff speed, both should be flopped the same.How these work, what portions they go to when no significant airflow is all unknown to other than ATR pilots. Possible to even have a test command drifting around in the systemThe two comput3ers are programed by two different teams (its a method of ensuring no code is written duplicated to the computer that is identical so their is not a dual failure under the same circumstances) that said, it seems the two issue were both pilot side so there may be something in that coding on that side. Swap to the other side for control and it should go away but Lion it did not, so just more questions.
Alchad