Ethiopian 737-8 MAX down. No survivors. | Page 13 | FerrariChat

Ethiopian 737-8 MAX down. No survivors.

Discussion in 'Aviation Chat' started by RWatters, Mar 10, 2019.

This site may earn a commission from merchant affiliate links, including eBay, Amazon, Skimlinks, and others.

  1. BoulderFCar

    BoulderFCar F1 World Champ
    Silver Subscribed

    Dec 16, 2004
    12,109
    Asheville, NC/Ft Lauderdale
    Full Name:
    Tom
    Thanks for the answer. That is insane. The reduction has to be so great that it takes a lot of muscle or turns to make the stabilizer move. Especially in dense air at high speed.
     
    celestialcoop likes this.
  2. sf_hombre

    sf_hombre Formula 3
    Silver Subscribed

    Nov 22, 2008
    1,272
    Stimulus Bill
    Full Name:
    Don
    So the trim wheel on the 737max uses a cable — NOT linked rods — to run all the way from the cockpit to the tail and has no power assist whatsoever? That seems nuts to me.
     
  3. jcurry

    jcurry Two Time F1 World Champ
    Silver Subscribed

    Jan 16, 2012
    21,369
    In the past
    Full Name:
    Jim
    All the controls are that way on all 737's (and 747, 767, 757), except the MAX where they now use fly-by-wire on the wing spoilers (everything else is still cables).
     
  4. jcurry

    jcurry Two Time F1 World Champ
    Silver Subscribed

    Jan 16, 2012
    21,369
    In the past
    Full Name:
    Jim
    All depends on the design of the jackscrew and wheel. Jackscrews have the ability to carry tremendous loads while only needing light torque to turn the screw. As I posted above (#286) the regs specify max pilot effort, which in theory should be sufficient to turn the screw throughout the flight envelope.
     
  5. KKSBA

    KKSBA F1 World Champ
    Rossa Subscribed

    Oct 31, 2003
    14,921
    SBarbara-La Jolla CA
    Full Name:
    KKSBA
    The trim wheel has handles that fold out that the pilot and copilot can crank (both at the same time for more force if necessary) to effect a pitch change. But, the faster the aircraft is moving the harder the force you need.

    They literally entered a Catch-22 situation at a certain point when they lost control of their speed.
     
  6. sf_hombre

    sf_hombre Formula 3
    Silver Subscribed

    Nov 22, 2008
    1,272
    Stimulus Bill
    Full Name:
    Don
    Assuming the crew was able to manually operate the trim wheel at the the speed the aircraft was traveling during the emergency, wouldn’t torque in a 129 foot long cable overcorrect the trim if the speed slowed significantly and perhaps cause another pitch down?
     
  7. Boomhauer

    Boomhauer Formula Junior

    Aug 18, 2007
    881
    Milano - Italia
    Full Name:
    Cardinal
    Ethiopian pilots fought the Boeing 737 MAX flight controls almost from takeoff

    https://www.seattletimes.com/business/boeing-aerospace/preliminary-crash-report-reveals-detail-of-ethiopian-pilots-fight-against-the-737-max-flight-controls/

    Retired Boeing director Bob Bogash, a veteran of the local aviation scene, wrote in a note to peers Thursday that though Americans “are so fond of bad-mouthing foreign air carriers, foreign pilots, foreign maintenance, etc as the cause of our accidents … we do like their money.”

    As a result of the Lion Air accident, he wrote, the Ethiopian crew was “totally tuned in to the latest and greatest about the MAX and the MCAS system. Didn’t help them … Hitting the Stab Trim Cutout switches didn’t save them. Using the Manual Trim Wheel didn’t save them.”
     
  8. solofast

    solofast Formula 3

    Oct 8, 2007
    1,773
    Indianapolis
    The MCAS system should also have been "speed limited". That is, since it's related to the stall prevention system it should not activate at higher airspeeds. This was commanding nose down trim at speeds over 300 knots. The people who were doing the programming of the system totally missed a number of failure effects and there were several reasons why the system should not have been active. Those include high airspeed, negative vertical acceleration and decreasing altitude. The sad part is that there was plenty of information in the computer saying that MCAS shouldn't have been invoked and after the first time was turned on, it should have been disabled and should have been ignoring the bad AOA sensor. I wasn't aware that the trim could become so hard to move that you couldn't move the trim wheel unless you were superman.. As someone above noted that's a really bad place to be.
     
    energy88 and jcurry like this.
  9. Ferrari 308 GTB

    Ferrari 308 GTB F1 Veteran

    Feb 21, 2015
    7,716
    Tropical
    I await the full CVR, they say the pilots followed Boeing procedures,which would include memory items and checklists etc.
     
    Boomhauer likes this.
  10. BoulderFCar

    BoulderFCar F1 World Champ
    Silver Subscribed

    Dec 16, 2004
    12,109
    Asheville, NC/Ft Lauderdale
    Full Name:
    Tom
    Again, not a pilot with domain expertise. Your comment seems hard to believe. Boeing has got to have the best and most experienced engineers in the world. They know the variables very well. It seems like something else was missed.
     
  11. Bob Parks

    Bob Parks F1 Veteran
    Consultant

    Nov 29, 2003
    7,911
    Shoreline,Washington
    Full Name:
    Robert Parks
    I have often felt that software designers and computer experts sometimes miss the effects of reality. Some are in a different world than the rest of us. The software systems are the same , they do their thing outside of what is actually going on if the designers aren't plugged in to the human element. When I was at the Big Kite Factory and had a computer problem there was always some digital driven voice that said, " WELL! You have to assume that what was displayed was...." Automatic software responses without associated human inputs can be problematic.
     
    energy88 and afterburner like this.
  12. F1tommy

    F1tommy F1 World Champ
    Silver Subscribed

    Dec 15, 2007
    10,254
    Chicagoland USA
    Full Name:
    Tom Tanner
    Yep Boeing really screwed up on this. I still cant believe one system would not feed info from more than one of the aircraft systems. It's like they added MCAS as a totally separate entity with it's own monitoring system but allowed it to completely take over control. My only question is will this tarnish the 737 so badly that Boeing will built it's long over due replacement faster.
     
  13. donv

    donv Two Time F1 World Champ
    Owner Rossa Subscribed

    Jan 5, 2002
    23,988
    Portland, Oregon
    Full Name:
    Don
    Boeing did have a replacement... it was called the 757. The 737 is a fine airframe for what it was intended to do.
     
  14. xs10shl

    xs10shl Formula 3

    Dec 17, 2003
    2,037
    San Francisco
    #314 xs10shl, Apr 6, 2019
    Last edited: Apr 6, 2019
    Like others, I'm still not understanding why the system was designed without any redundancy, especially when there are 2 sensors already installed. We are talking about a few lines of code to verify an assertion that the readings agree to within a specific tolerance, and issuing an alert otherwise. Programming a level of fault tolerance is not that difficult, as is programming for graceful failure - it just takes a little more thought into outlining the execution flow.

    I get the argument that you really need three sensors, in case one fails. That said, most of the modern planes I've flown on are required to have two backup neural net processors on board, which when given the entire range of inputs available, are likely capable of making a determination as to which sensor is reading correctly when given the opportunity to make such a determination. It's just a shame it wasn't at least designed that way in the first place.
     
  15. F1tommy

    F1tommy F1 World Champ
    Silver Subscribed

    Dec 15, 2007
    10,254
    Chicagoland USA
    Full Name:
    Tom Tanner
    No the 757 was the 727 replacement.. You are probably getting confused because Boeing has morphed the 737 into what a 757 was designed to do. I hope they replace it sooner than later with an all new carbon fiber fuselage medium haul aircraft.
     
    celestialcoop likes this.
  16. jcurry

    jcurry Two Time F1 World Champ
    Silver Subscribed

    Jan 16, 2012
    21,369
    In the past
    Full Name:
    Jim
    Likely because the MCAS system was not a flight critical system, rather just an aide. If you shut it off the airplane was still perfectly flyable, and they could have thought that if the system activated it would be enough to get the pilots to self correct the issue, e.g. high angle of attack.
     
  17. donv

    donv Two Time F1 World Champ
    Owner Rossa Subscribed

    Jan 5, 2002
    23,988
    Portland, Oregon
    Full Name:
    Don
    Reread your post and you'll see what I posted was correct. You said "Boeing has morphed the 737 into what a 757 was designed to do. " Exactly.

    They considered making a re-engined 757 but chose not to because airlines, particularly Southwest, demanded commonality with their existing fleet of 737s. I'm sure there were some other reasons as well, but that's what it boils down to.
     
  18. xs10shl

    xs10shl Formula 3

    Dec 17, 2003
    2,037
    San Francisco
    Perhaps that was the reasoning... and yet, that proved not to be the case. It's just hard to fathom that someone, in some meeting, didn't ask " . . . err, what happens if the system gets a continuous erroneous input of, say, 80 degrees, and the pilots don't catch it immediately?" From what I've understood to be the case, pilots weren't alerted in advance that the system was about to activate, until all of a sudden the trim settings began to change, and then keep changing. Perhaps I'm incorrectly informed about this last point, and I missed reading it.
     
    jcurry likes this.
  19. Remy Zero

    Remy Zero Two Time F1 World Champ

    Apr 26, 2005
    23,319
    KL, Malaysia
    Full Name:
    MC Cool Breeze
    I was in a train in Munich yesterday. Had some kids playing in the track a few kilometers up front. They shut down the entire line while the cops went to get them. We were delayed for around 2 hours. Striked up a conversation with a dude who was as clueless as I was, as I did not understand German. He was a pilot from Portugal, and have been flying long routes, Portugal to the Americas, and he only flew Airbus.

    He mentioned that interestingly, Airbus has the same issue with the earlier models of the A320s. In Layman terms, he explained the conflicts in the software, sending the same codes to different parts of the aircraft, and then that is how the software started glitching. Difference is, Airbus quickly rectified it, when they were notified by pilots. Boeing, i think did not, based on all the readings so far.

    It was kinda shocking listening to him explaining the step by step what went wrong roughly on this 737 max. From the pitching right till he mentioned that the plane was probably disintegration process just before it hit the ground, due to the stress of the plane going through those speeds in a diving mode, and taking into account of the G forces.
     
    INRange likes this.
  20. donv

    donv Two Time F1 World Champ
    Owner Rossa Subscribed

    Jan 5, 2002
    23,988
    Portland, Oregon
    Full Name:
    Don
    I'm pretty sure that they did consider that. My guess is that it has something to do with the AOA comparator feature being an option and not on all airplanes. I could completely be wrong, though.
     
  21. solofast

    solofast Formula 3

    Oct 8, 2007
    1,773
    Indianapolis
    Our problem with our software was that the people doing the programming weren't pilots, they were software engineers who took the FAA criteria of "2 failures deep" literally. They didn't understand what would happen in the real world as a result of the failure of a sensor. This is most likely the same thing. You have controls engineers who aren't pilots laying out block diagrams for code and since the code block is not flight critical it only had one sensor input and it wasn't given a critical analysis because it was only a "helper" system. Airbus had similar problems back when they were doing their first highly automated systems and learned their lessons. Boeing didn't have the same level of computer authority until the Max and now they are going through the same experience. It's unfortunate that Boeing didn't learn from the mistakes of Airbus and others like myself that have been down this road and learned the lessons. The real lesson from this is that the FAA's criteria for electrical system failure is outmoded in today's computer world. Failures of electrical components like sensors are more common because the systems are far more complex. Failures don't just stop something from working, they can send erroneous information and the system needs to be smart enough to know when it is getting bad information from any sensor and then needs to be robust enough to not just throw up it's hands and say I'm out of here. There's plenty of information in the system in all of these cases, going back to the Airbus crashes 20 years ago to the present Boeing situation to have kept the aircraft safe, but the reality is that the criteria for redundancy and the levels of failure are not adequate. The way to fix it is to adopt a criteria that goes much deeper, and has the system look at inputs that are not consistent with what is really happening and then decide on what information is good and what isn't. The problem is that this is a more expensive proposition than knocking out a quick fix or a simple "2 failures deep and done" approach that is the current industry standard. I would guess that this is what Boeing is learning right now and this is why the software fix for the Max is taking longer than one would anticipate. We'll see how Boeing handles this and if their approach is sufficiently robust that I would fly on a Max. There's a fundamental difference between what is statistically "safe" and what is the right way to do it. Up until now Boeing was doing it right and with the Max they followed the FAA criteria and we can all see what that led to. It is sad that the FAA didn't recognize this a long time ago, they've had plenty of examples with multiple Airbus crashes and now this Boeing problem to see that the criteria isn't adequate.
     
    jcurry and KKSBA like this.
  22. Jeff Kennedy

    Jeff Kennedy F1 Veteran
    Owner Silver Subscribed

    Oct 16, 2007
    6,535
    Edwardsville, IL
    Full Name:
    Jeff Kennedy
    From Aviation Week:

    Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding
    Apr 9, 2019Guy Norris | Aviation Week & Space Technology
    COMMENTS 13

    Pilot feedback to the proposed software changes to the Boeing 737 MAX Maneuvering Characteristics Augmentation System (MCAS) flight-control law is positive, says Boeing. After demonstrations, pilots believe the potential for further flight-control problems from the system are a “nonissue,” the airframer says.

    However, despite the positive response from pilots to the upgraded control system and associated training package, Boeing is gearing up for a prolonged international effort to reinstate the grounded MAX fleet. The embattled company, which first unveiled the proposed MCAS changes to a group of certification authorities and airline pilots in Seattle on March 27, is embarking on a global campaign to convince regulators that the updates will be sufficient to enable the aircraft to return to service.

    The campaign encompasses a series of simulator demonstrations and briefings at multiple training sites throughout Europe, Asia and Australia and comes as Boeing attempts to handle a situation unprecedented in its history. Because the MAX was grounded first by China and other authorities around the world days before the FAAfollowed suit, the company says it is imperative to build support for an international caucus of regulators willing to reauthorize the MAX to return to flight.

    The new P12.1 software load has three protection layers

    The updated MCAS is being demonstrated in training sites worldwide

    The FAA, which in past years would have taken a lead role in such an effort, is similarly shifting gears and is now working alongside a broader group of international regulators to adjudicate the case. The agency says it expects to receive Boeing’s final package of its software enhancement over the coming weeks. Meanwhile the FAA has set up a Joint Authorities Technical Review (JATR) to conduct a comprehensive review of the certification of the aircraft’s automated flight-control system. Chaired by former NTSBChairman Christopher Hart, the JATR is comprised of a team from the FAA, NASA and international aviation authorities.

    Boeing, which on April 5 signaled a 19% production slowdown of its 737 line to ease the growing logjam of undelivered aircraft, is also providing more details about the changes to the MCAS functionality contained in the new P12.1 flight-control computer (FCC) software load that will replace the existing P11.1 software. Based on pilot reaction to date, the company says it is confident its software upgrade is certifiable.

    The briefings continue to emphasize that the MCAS, which was added to the speed-trim system to standardize handling qualities with those of the 737 Next Generation, is “not a stall-protection function and not a stall-prevention function,” says Mike Sinnett, Boeing Commercial Airplanes vice president of product development and future airplane development. “It is a handling-qualities function. There’s a misconception it is something other than that. “

    Added to ensure a linear relationship between stick force per G, “speed trim is a function of airspeed, so if you’re going fast, it’s a low angle-of-attack (AOA), and if you’re going slow, it’s at higher AOA,” he notes. “The thing you are trying to avoid is a situation where you are pulling back and all of a sudden it gets easier, and you wind up overshooting and making the nose higher than you want it to be.”



    Image Unavailable, Please Login
    The updated MCAS is being demonstrated to pilots in MAX simulators around the world. Credit: Boeing


    Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design. To do that, it activates based on AOA rather than based on speed—which is what speed trim does. Speed trim is a function of airspeed, and MCAS is a function of angle-of-attack and Mach number, but it only triggers off AOA.”

    In the initial briefing sessions for pilots on March 27, “we didn’t talk specifically about either of the accidents, but we ran through MCAS scenarios,” says Sinnett. “From the accidents, we now know how MCAS can behave when there is an erroneously high AOA input, so we walked through scenarios where that could occur. We demonstrated those in the simulator.”

    In these sessions, pilots and regulators were able to interact via intercom and a big screen with Boeing pilots in the 737 MAX engineering cab. Following the sessions, “we went back to the classroom and said, ‘Here are the things that concern us most when we look at the scenario of the two accidents we just experienced,’” Sinnett says. “Upon reflection on what has occurred, it appeared the system could present a high-workload environment—and that’s not our intention. So we looked at changing the design to compare values from multiple AOA indicators to essentially eliminate the unintended trigger condition that causes MCAS to activate. “

    Sinnett says pilots appear satisfied that the three main layers of protection now added to the MCAS will prevent any potential repeat of the circumstances involved in the Lion Air and Ethiopian Airlines accidents. “We answered a lot of questions during the discussion, and then we went back into the simulator and demonstrated a number of different scenarios to run against these changes,” Sinnett says. “And the most compelling thing is that the AOA failure case turns into a run-of-the-mill AOA failure case like you might have on any other airplane. We didn’t get any negative feedback. It was all very positive, and any of the pilots who got into the simulator and saw the before and after, it was like, ‘Yes, OK, this is now a nonissue.’”

    The first main layer of protection provided by the update is a cross-channel bus between the aircraft’s two FCCs, which now allows data from the two AOA sensors, or alpha vanes, to be shared and compared. AOA data continues to be fed from left and right vanes into their respective air data inertial reference units before being passed to the flight computers. However, the AOA data in both computers is now continuously compared. The change is made by software only and requires no hardware modification.

    “In a situation where there is erroneous AOA information, it will not lead to activation of MCAS,” says Sinnett. He underlines that the entire speed-trim system, including the MCAS, will be inhibited for the remainder of the flight if data from the two vanes varies by more than 5.5 deg. If an AOA disagreement of more than 10 deg. occurs between the sensors for more than 10 sec., it will be flagged to the crew on the primary flight display.

    The second layer of protection is a change to the logic in the MCAS algorithm that provides “a fundamental robust check to ensure that before it ever activates a second time, pilots really want it to activate,” says Sinnett.

    The change would have protected the system from continuing to activate in the case of the Lion Air accident, in which the left AOA vane was stuck in the 20-deg.-nose-high position. In that circumstance, the logic rechecked if the MCAS was required and, registering the apparent nose-high position from the errant vane, commanded more nose-down trim. “Now it sees you’re in the same spot, it says you’ve got a stuck vane and says, ‘I’m not going to activate again,’” Sinnett notes.

    “That’s assuming it will activate in the first place, which it won’t because one AOA vane with a high value won’t activate,” he adds. “When you do defense in depth, you have to artificially fail one layer to make sure you adequately design and test the next layer—so that’s what we had to do.”

    Explaining the background to the third layer of protection, Sinnett says: “We also made sure if the second layer of protection failed somehow in some weird way and allowed MCAS to activate multiple times, the system now ensures the sum total is command-limited.” The result is that the pilots always have maneuvering authority remaining with the control column. “Pilots will always have the ability to override—although they had that before in other ways, like with the trim switch, for example. But with the software update, the column itself will always provide at least 1.2g of maneuvering capability. So you don’t just have the ability to hold the nose level, you can still pitch up and climb.”
     
  23. KKSBA

    KKSBA F1 World Champ
    Rossa Subscribed

    Oct 31, 2003
    14,921
    SBarbara-La Jolla CA
    Full Name:
    KKSBA
    So P11.1 software was beta (That contributed to two complete loss of life incidents), and P12.1 is a release candidate. Got it! They really should be ashamed of themselves for not getting the software right the first time around with such deficiencies like not crosschecking sensors, not establishing a maximum amount of trim change, not describing the MCAS system in the FCOM (which is why there is such confusion over what it was supposed to do in the first place... Many thought it was stall prevention) etc...
     
    solofast and Boomhauer like this.
  24. Remy Zero

    Remy Zero Two Time F1 World Champ

    Apr 26, 2005
    23,319
    KL, Malaysia
    Full Name:
    MC Cool Breeze
    I call that BS, and Boeing just dont want to admit it.
     
    Boomhauer likes this.
  25. red27

    red27 Formula Junior

    Sep 7, 2010
    829
    London UK
    Full Name:
    Mark Oliver
    Is it just me or does the Boeing statement rather gloss over the fatal results of their previous ineptitude.
    If it was so easy to design the fix, then evidently it should have been in there from the start. Having a 1 channel AoA input to the stab was idiotic from the word go. Criminal liability lawyers will be rubbing their hands with glee I suspect.

    Thanks to the sloth-like speed and woeful leadership with which both the FAA and Boeing have managed this debacle, I would not be at all surprised if EASA insisted on recertifying the design in its entirety independently of the FAA for European operation.

    It certainly is not over yet...
     

Share This Page