10 ms·

One thing I haven't seen fully explained ( maybe it was but I missed it ). Were these vanes damaged on both of these downed flights? Why didn't all the other

by newsoul2019 8y ago

One thing I haven't seen fully explained ( maybe it was but I missed it ). Were these vanes damaged on both of these downed flights? Why didn't all the other 737 MAX 8's crash around the world, Was it something about the flight profile or the weather? Can the plane be flown as-is with a sufficiently conservative flight profile?

VBprogrammer 8y ago
The speculation on the Ethiopian flight was a bird strike. The data was normal until a few seconds after take off. Another issue could be the failure mode, if it failed at or near 0 AoA it wouldn't cause too many safety of flight issues on a normal flight.
- linuxftw 8y ago
  Well, unless you need the MCAS to kick in, and the plane plummets to the earth in a hard stall because it didn't.
  - VBprogrammer 8y ago
    If a pilot goes anywhere near a stall on a normal commercial flight then they have fucked something up. MCAS is only required to maintain a positive slope to AoA - stick force curve. MCAS resulted in 2 crashes because the implementation was completely brain dead. Not because the aircraft is impossible to fly without it.
    - linuxftw 8y ago
      > MCAS is only required to maintain a positive slope to AoA - stick force curve. You and other keeps parroting this line, I don't believe it to be true. MCAS is an anti-stall device, show me once source that says otherwise. > Not because the aircraft is impossible to fly without it. Not impossible, but possibly also not safe. The system was implemented to prevent stalls in the MAX 8 planes due to it's flight characteristics.
      - peteradio 8y ago
        System was implemented as cost avoidance.
        kayfox 8y ago
        I don't think you understand the market the A32x and the 737 are in. They are planes flown by carriers who want to keep costs low. The MAX was designed the way it was because the airlines wanted more of the same with minimal retraining and support retooling. Boeing had originally proposed and may still pursue a carbon-fiber redesign of the 737 incorporating more of the lessons learned from the 787, but for now the airlines wanted and got a progressive improvement on the 737. The MCAS system was designed as a response to FAA requirements and directives based on a concern about performance at the edge of the flight envelope. Since as we see it now (the public does not have enough information to conclude on how well the design process went except in the result) it was designed poorly and improvements are being made. Once those improvements are made I expect the MAX to be, at that point a safer aircraft than the 737 NG. Its unfortunate that so many people had to die before the issue was identified, maybe congress should provide more funding for aviation safety enforcement and research at the FAA, NTSB and NASA.
      - VBprogrammer 8y ago
        > You and other keeps parroting this line, I don't believe it to be true. You are free to believe anything you want to believe. Of course if you where involved in the 737 Max development and you have inside information to the contrary then I'll accept that. It's the explanation which best tallies with the official description of the system, the circumstances surrounding its introduction and the certification requirements. Many aircraft have systems implemented to prevent stalls (see stick pusher); and systems to prevent undamped yawing movements becoming uncontrollable (see yaw damper). And to prevent mach tuck (see mach trim system); and to prevent changes in pitch trim due to speed changes (see Speed trim system).
      - drawkbox 8y ago
        The 737 Max does fly differently, the MCAS and AoA checks to offset the engine "pitch up" due to more powerful engines was to get around a regulation/certification [1]. > The LEAP engine nacelles are larger and had to be mounted slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA. As the nacelle is ahead of the C of G, this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up. The regulation that they had to make to fit within the 14CFR §25.203(a) regulation/rule was first tried by physical designs but ultimately settled on a sensor/software solution that constantly polls every 9 seconds to check the nose pitch/attitude and adjust, if it goes to0 far MCAS is triggered and pulls the nose down. Since there was a faulty sensor, this caused the nose dive catastrophic failures. The 14CFR §25.203(a) regulation (a) is [2]: >It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls. Since the change had to do with "No abnormal nose-up pitching may occur" in that rule, then the plane definitely flies differently as the cause of the MCAS and sensor flow is to constantly check for a nose pitch up that it corrects, if too far, enable MCAS to bring the nose down. This plane flies differently definitely and a bit opposite in that other planes will pitch down, it pitches up due to engine power of the larger more fuel efficient LEAP engines. Ultimately the root of the problem was cost cutting which led to retro-fitting the 737NG to the 737 Max 7-10 to fit within cost/training/testing/regulations and in the end that was the problem that caused the end result of a software/sensor single point of failure which has squandered trust in Boeing engineering, management and safety as well as the 737 brand. Most people don't know the 737 Max is essentially an entire new plane. How the FAA let Boeing get away with this will be a focus as time goes on. As a software engineer, the 737 Max looks like a legacy system hack that they tried to version 2 with it rather than make a new plane and incur all the training/testing/certifications of a new plane. Boeing other planes don't have these issues, the 767 is has only had a couple issues beyond terrorism and those were related to pilots and fuel [3]. Two crashes of two new Boeing 737 Maxs within months of release and service is not a good trust enabling product. [1] http://www.b737.org.uk/mcas.htm http://www.b737.org.uk/mcas.htm [2] https://www.law.cornell.edu/cfr/text/14/25.203 https://www.law.cornell.edu/cfr/text/14/25.203 [3] https://en.wikipedia.org/wiki/Category:Accidents_and_incidents_involving_the_Boeing_767 https://en.wikipedia.org/wiki/Category:Accidents_and_inciden...
- drawkbox 8y ago
  The AoA sensor that MCAS uses, as well as the nose pitch monitoring adjustment due to the larger more powerful LEAP engines that causes a pitch up on the nose, is external and in the front [1][2]. > Stall sensors are common, but the MAX is the only 737 to have a blade-like sensor on the exterior of the plane that can automatically pitch the plane down when it detects stall conditions -- without input any input from the crew [2] Not only is it susceptible to birds but it could be sabotaged as well from the location of it, if I were investigating it I'd check into maintenance/storage/possible sabotage just in case. Since the nose pitch monitoring system and MCAS use the AoA single sensor it is a single point of failure, it also seems like a security issue. About the single sensor and single point of failure[2]: > Boeing's 737 MAX, the model being flown by Indonesia's Lion Air that crashed last October killing all 189 on board, had been criticized for relying on a single sensor to detect the aircraft's angle of attack, according to today's Wall Street Journal. A preliminary investigation by Indonesia's National Transportation Safety Committee (NTSC) blamed the stall prevention system (known as Maneuvering Characteristics Augmentation System, or MCAS) which relied on a the single sensor that provided erroneous data, causing the MCAS to misfire, leading to a series of events that put the plane into a nosedive. > After the October crash, Boeing began updating the plane's software so multiple sensors would provide data to the stall prevention system, the company said in a statement on Monday. About the external AoA sensor [1][2]: > The 737 MAX with its larger engines mounted even more forward needed a separate sensor to sense stall, the nose up attitude of a plane that turns off aerodynamic lift over the wings. Stall sensors are common, but the MAX is the only 737 to have a blade-like sensor on the exterior of the plane that can automatically pitch the plane down when it detects stall conditions -- without input any input from the crew --according to Seattle Times veteran aerospace reporter, Dominic Gates, who is close to Renton, Washington where the 737 MAX is assembled. > According to the preliminary report from Indonesia's NTSC and in a Boeing service bulletin, Lion Air flight 610 was providing erroneous data from a angle of attack (AOA) sensor. It appears the crew may have been fighting against: bad sensor data, a multitude of warnings and an automatic flight control system that seemed to be malfunctioning by automatically pushing the nose of the plane down repeatedly during the 11-minute flight. Ground control was contacted numerous times by the crew, who were repeatedly requesting permission to return to the airport. [1] https://i.imgur.com/XTrf6EX.jpg https://i.imgur.com/XTrf6EX.jpg [2] https://www.engineering.com/ElectronicsDesign/ElectronicsDesignArticles/ArticleID/18734/Breaking-Faulty-Sensor-Data-May-Have-Caused-Boeing-737-MAX-Crashes.aspx https://www.engineering.com/ElectronicsDesign/ElectronicsDes...
cjbprime 8y ago
There just aren't that many MAX planes. Only went into production in 2017, around 350 delivered to airlines. The vanes were presumably damaged (either mechanically or electrically) on both downed planes but not others.
stevelambert3 8y ago
On the lion air the sensor was non-operable from the start of the flight; so yes on both flights the AoA sensor was in a non-flightworthy condition. One point of clarification: on the 737 and most other airplanes the airspeed is unreliable if the AoA sensor becomes damaged. This occurred on both the ET302 and the lion air flight. In such a state, it is up to the pilot to place the plane in safe flying state that does not depend on access to the airspeed. The pilot should by memory, ideally, set the thrust and nose up attitude of the plane along with other control surfaces. Failure to do this is what indirectly caused the AF447 disaster and it seems the the crew didn't execute this procedure on the ET302 flight. At the very least, attempting to engage the autopilot and disengaging flaps were contrary to standard procedure. Not executing this procedure dramatically increases the workload on the pilot and increases the risk that either airspeed wall outside of the safe operating range of the aircraft or the pilot will have to take drastic action to maintain airspeed in a safe range. Both are dangerous and even an experienced pilot can fail to take appropriate action especially in an emergency with the flight crew attending to other anomalies. With that caveat stated, there is nothing inherently unsafe about flying with the combination of unreliable airspeed and an uncommanded MCAS activation in theory. The previous flight of the lion air flight was able to counteract 20+ instances of MCAS activation by simply trimming the aircraft using manual trim before they tried disengaging electrical power to the stabilizer motors. After disengaging trim the pilots felt comfortable continuing the flight and adjusting trim using the manual cockpit trim wheels. With all that being said, no aviation regulator would certify a plane that couldn't fly safely with an unreliable airspeed and manual trim turned off. I think the question about why the 737 MAX's haven't crashed more is two fold. First, a birdstrike that takes out an AoA sensor is very rare. In that sense, Boeing got very unlucky in that they had a birdstrike that knocked out the specific AoA sensor tied to MCAS a month before they planned on rolling out the software update. Additionally, flight sensors are usually maintained very well as they are a critical item. You would never expect standard maintenance procedure not to fix an unreliable airspeed. When it has happened before though, the outcome can be tragic just as it was on the lion air flights regardless of any issues with MCAS.
heisenbit 8y ago
The sensor was never designed for what it was used. It was designed to provide input to a visual display for the pilot. The pilot always had a lot of other inputs. The reliability requirements were totally different to what was needed to directly control an airplane in a critical situation. The software design compounded the problem with some bizare design decisions. This was a system design failure. High level reliability requirements were not properly communicated to the subsystems. Subsystem failure was not properly analyzed. Human Machine interface considerations were ignored. Considering the rush job and shortcuts Boeing made for this "feature" a valid consideration by a regulator would be to question their quality system. And that should trigger a systematic approach to reviewing all other requirements and design work going into the 737MAX.

VBprogrammer 8y ago

The speculation on the Ethiopian flight was a bird strike. The data was normal until a few seconds after take off. Another issue could be the failure mode, if it failed at or near 0 AoA it wouldn't cause too many safety of flight issues on a normal flight.

linuxftw 8y ago
Well, unless you need the MCAS to kick in, and the plane plummets to the earth in a hard stall because it didn't.
- VBprogrammer 8y ago
  If a pilot goes anywhere near a stall on a normal commercial flight then they have fucked something up. MCAS is only required to maintain a positive slope to AoA - stick force curve. MCAS resulted in 2 crashes because the implementation was completely brain dead. Not because the aircraft is impossible to fly without it.
  - linuxftw 8y ago
    > MCAS is only required to maintain a positive slope to AoA - stick force curve. You and other keeps parroting this line, I don't believe it to be true. MCAS is an anti-stall device, show me once source that says otherwise. > Not because the aircraft is impossible to fly without it. Not impossible, but possibly also not safe. The system was implemented to prevent stalls in the MAX 8 planes due to it's flight characteristics.
    - peteradio 8y ago
      System was implemented as cost avoidance.
      - kayfox 8y ago
        I don't think you understand the market the A32x and the 737 are in. They are planes flown by carriers who want to keep costs low. The MAX was designed the way it was because the airlines wanted more of the same with minimal retraining and support retooling. Boeing had originally proposed and may still pursue a carbon-fiber redesign of the 737 incorporating more of the lessons learned from the 787, but for now the airlines wanted and got a progressive improvement on the 737. The MCAS system was designed as a response to FAA requirements and directives based on a concern about performance at the edge of the flight envelope. Since as we see it now (the public does not have enough information to conclude on how well the design process went except in the result) it was designed poorly and improvements are being made. Once those improvements are made I expect the MAX to be, at that point a safer aircraft than the 737 NG. Its unfortunate that so many people had to die before the issue was identified, maybe congress should provide more funding for aviation safety enforcement and research at the FAA, NTSB and NASA.
    - VBprogrammer 8y ago
      > You and other keeps parroting this line, I don't believe it to be true. You are free to believe anything you want to believe. Of course if you where involved in the 737 Max development and you have inside information to the contrary then I'll accept that. It's the explanation which best tallies with the official description of the system, the circumstances surrounding its introduction and the certification requirements. Many aircraft have systems implemented to prevent stalls (see stick pusher); and systems to prevent undamped yawing movements becoming uncontrollable (see yaw damper). And to prevent mach tuck (see mach trim system); and to prevent changes in pitch trim due to speed changes (see Speed trim system).
    - drawkbox 8y ago
      The 737 Max does fly differently, the MCAS and AoA checks to offset the engine "pitch up" due to more powerful engines was to get around a regulation/certification [1]. > The LEAP engine nacelles are larger and had to be mounted slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA. As the nacelle is ahead of the C of G, this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up. The regulation that they had to make to fit within the 14CFR §25.203(a) regulation/rule was first tried by physical designs but ultimately settled on a sensor/software solution that constantly polls every 9 seconds to check the nose pitch/attitude and adjust, if it goes to0 far MCAS is triggered and pulls the nose down. Since there was a faulty sensor, this caused the nose dive catastrophic failures. The 14CFR §25.203(a) regulation (a) is [2]: >It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls. Since the change had to do with "No abnormal nose-up pitching may occur" in that rule, then the plane definitely flies differently as the cause of the MCAS and sensor flow is to constantly check for a nose pitch up that it corrects, if too far, enable MCAS to bring the nose down. This plane flies differently definitely and a bit opposite in that other planes will pitch down, it pitches up due to engine power of the larger more fuel efficient LEAP engines. Ultimately the root of the problem was cost cutting which led to retro-fitting the 737NG to the 737 Max 7-10 to fit within cost/training/testing/regulations and in the end that was the problem that caused the end result of a software/sensor single point of failure which has squandered trust in Boeing engineering, management and safety as well as the 737 brand. Most people don't know the 737 Max is essentially an entire new plane. How the FAA let Boeing get away with this will be a focus as time goes on. As a software engineer, the 737 Max looks like a legacy system hack that they tried to version 2 with it rather than make a new plane and incur all the training/testing/certifications of a new plane. Boeing other planes don't have these issues, the 767 is has only had a couple issues beyond terrorism and those were related to pilots and fuel [3]. Two crashes of two new Boeing 737 Maxs within months of release and service is not a good trust enabling product. [1] http://www.b737.org.uk/mcas.htm http://www.b737.org.uk/mcas.htm [2] https://www.law.cornell.edu/cfr/text/14/25.203 https://www.law.cornell.edu/cfr/text/14/25.203 [3] https://en.wikipedia.org/wiki/Category:Accidents_and_incidents_involving_the_Boeing_767 https://en.wikipedia.org/wiki/Category:Accidents_and_inciden...
drawkbox 8y ago
The AoA sensor that MCAS uses, as well as the nose pitch monitoring adjustment due to the larger more powerful LEAP engines that causes a pitch up on the nose, is external and in the front [1][2]. > Stall sensors are common, but the MAX is the only 737 to have a blade-like sensor on the exterior of the plane that can automatically pitch the plane down when it detects stall conditions -- without input any input from the crew [2] Not only is it susceptible to birds but it could be sabotaged as well from the location of it, if I were investigating it I'd check into maintenance/storage/possible sabotage just in case. Since the nose pitch monitoring system and MCAS use the AoA single sensor it is a single point of failure, it also seems like a security issue. About the single sensor and single point of failure[2]: > Boeing's 737 MAX, the model being flown by Indonesia's Lion Air that crashed last October killing all 189 on board, had been criticized for relying on a single sensor to detect the aircraft's angle of attack, according to today's Wall Street Journal. A preliminary investigation by Indonesia's National Transportation Safety Committee (NTSC) blamed the stall prevention system (known as Maneuvering Characteristics Augmentation System, or MCAS) which relied on a the single sensor that provided erroneous data, causing the MCAS to misfire, leading to a series of events that put the plane into a nosedive. > After the October crash, Boeing began updating the plane's software so multiple sensors would provide data to the stall prevention system, the company said in a statement on Monday. About the external AoA sensor [1][2]: > The 737 MAX with its larger engines mounted even more forward needed a separate sensor to sense stall, the nose up attitude of a plane that turns off aerodynamic lift over the wings. Stall sensors are common, but the MAX is the only 737 to have a blade-like sensor on the exterior of the plane that can automatically pitch the plane down when it detects stall conditions -- without input any input from the crew --according to Seattle Times veteran aerospace reporter, Dominic Gates, who is close to Renton, Washington where the 737 MAX is assembled. > According to the preliminary report from Indonesia's NTSC and in a Boeing service bulletin, Lion Air flight 610 was providing erroneous data from a angle of attack (AOA) sensor. It appears the crew may have been fighting against: bad sensor data, a multitude of warnings and an automatic flight control system that seemed to be malfunctioning by automatically pushing the nose of the plane down repeatedly during the 11-minute flight. Ground control was contacted numerous times by the crew, who were repeatedly requesting permission to return to the airport. [1] https://i.imgur.com/XTrf6EX.jpg https://i.imgur.com/XTrf6EX.jpg [2] https://www.engineering.com/ElectronicsDesign/ElectronicsDesignArticles/ArticleID/18734/Breaking-Faulty-Sensor-Data-May-Have-Caused-Boeing-737-MAX-Crashes.aspx https://www.engineering.com/ElectronicsDesign/ElectronicsDes...

cjbprime 8y ago

There just aren't that many MAX planes. Only went into production in 2017, around 350 delivered to airlines. The vanes were presumably damaged (either mechanically or electrically) on both downed planes but not others.

stevelambert3 8y ago

On the lion air the sensor was non-operable from the start of the flight; so yes on both flights the AoA sensor was in a non-flightworthy condition. One point of clarification: on the 737 and most other airplanes the airspeed is unreliable if the AoA sensor becomes damaged. This occurred on both the ET302 and the lion air flight. In such a state, it is up to the pilot to place the plane in safe flying state that does not depend on access to the airspeed. The pilot should by memory, ideally, set the thrust and nose up attitude of the plane along with other control surfaces. Failure to do this is what indirectly caused the AF447 disaster and it seems the the crew didn't execute this procedure on the ET302 flight. At the very least, attempting to engage the autopilot and disengaging flaps were contrary to standard procedure. Not executing this procedure dramatically increases the workload on the pilot and increases the risk that either airspeed wall outside of the safe operating range of the aircraft or the pilot will have to take drastic action to maintain airspeed in a safe range. Both are dangerous and even an experienced pilot can fail to take appropriate action especially in an emergency with the flight crew attending to other anomalies. With that caveat stated, there is nothing inherently unsafe about flying with the combination of unreliable airspeed and an uncommanded MCAS activation in theory. The previous flight of the lion air flight was able to counteract 20+ instances of MCAS activation by simply trimming the aircraft using manual trim before they tried disengaging electrical power to the stabilizer motors. After disengaging trim the pilots felt comfortable continuing the flight and adjusting trim using the manual cockpit trim wheels. With all that being said, no aviation regulator would certify a plane that couldn't fly safely with an unreliable airspeed and manual trim turned off. I think the question about why the 737 MAX's haven't crashed more is two fold. First, a birdstrike that takes out an AoA sensor is very rare. In that sense, Boeing got very unlucky in that they had a birdstrike that knocked out the specific AoA sensor tied to MCAS a month before they planned on rolling out the software update. Additionally, flight sensors are usually maintained very well as they are a critical item. You would never expect standard maintenance procedure not to fix an unreliable airspeed. When it has happened before though, the outcome can be tragic just as it was on the lion air flights regardless of any issues with MCAS.

heisenbit 8y ago

The sensor was never designed for what it was used. It was designed to provide input to a visual display for the pilot. The pilot always had a lot of other inputs. The reliability requirements were totally different to what was needed to directly control an airplane in a critical situation. The software design compounded the problem with some bizare design decisions. This was a system design failure. High level reliability requirements were not properly communicated to the subsystems. Subsystem failure was not properly analyzed. Human Machine interface considerations were ignored. Considering the rush job and shortcuts Boeing made for this "feature" a valid consideration by a regulator would be to question their quality system. And that should trigger a systematic approach to reviewing all other requirements and design work going into the 737MAX.