|
Post by cjm on Jun 29, 2019 7:42:37 GMT
|
|
|
Post by Trog on Jun 29, 2019 12:15:10 GMT
They keep pushing the wrong narrative: It was not a software mistake. It was a much deeper and more fundamental problem. That said, I persist in saying that, e.g. had those been Lufthansa flights with Lufthansa pilots, the planes wouldn't have gone down. (Which is basically what Boeing is also saying in the sub-text). But they did, because of problems with the planes which those particular pilots did not have the skill to control. It was not even a technical problem - it's really the result of unbelievable decision errors during system engineering design. The angle-of-attack sensor was always an information only instrument - and one mostly ignored by pilots to boot. Suddenly it was pushed into supplying information that controlled the plane. That is a major, major design change, and a critical one. If the project was properly managed, investigating the implications of this should've been one of the very top priorities, with maybe half of the project budget allocated to it. But is seems as if this was never done. It is blatantly obvious that nobody at Boeing ever asked the question: "What is going to happen if this sensor fails?" And that is utterly unbelievable. In a properly managed project, there would've been thousands of pages of failure-mode-analyses dedicated to exactly that question. To give the input of a single sensor that amount of responsibility is anathema. They have 2 available and at the very least they should've used both. But they even have much more than that: The aircrafts has gyroscopes so that it always knows exactly what its fore-aft trim is, it has Pitout tubes so that it knows what its airspeed is, it has GPS so that it knows what its ground-speed is. From that it should be trivial to calculate its angle of attack with a fair amount of accuracy, quit independently of the AoA sensor itself. The AoA sensors are obviously the most accurate and as primary sensors must necessarily be the input to control-mechanisms, but the derived AoA from alternative instruments should give a very close approximation to what the AoA sensors should measure, and is perfectly capable of saying: Hey - this thing is broken! Do something else! At the very least, the MCAS system should not persist to push the nose-down to beyond horisontal fore-aft trim, particularly not at less than 1000m above the ground. None of these things are under the control of software developers - these are top-level decisions by design engineers. Or probably management, in this case.
|
|
|
Post by cjm on Jun 29, 2019 14:46:57 GMT
They keep pushing the wrong narrative: It was not a software mistake. It was a much deeper and more fundamental problem. That said, I persist in saying that, e.g. had those been Lufthansa flights with Lufthansa pilots, the planes wouldn't have gone down. (Which is basically what Boeing is also saying in the sub-text). But they did, because of problems with the planes which those particular pilots did not have the skill to control. It was not even a technical problem - it's really the result of unbelievable decision errors during system engineering design. The angle-of-attack sensor was always an information only instrument - and one mostly ignored by pilots to boot. Suddenly it was pushed into supplying information that controlled the plane. That is a major, major design change, and a critical one. If the project was properly managed, investigating the implications of this should've been one of the very top priorities, with maybe half of the project budget allocated to it. But is seems as if this was never done. It is blatantly obvious that nobody at Boeing ever asked the question: "What is going to happen if this sensor fails?" And that is utterly unbelievable. In a properly managed project, there would've been thousands of pages of failure-mode-analyses dedicated to exactly that question. To give the input of a single sensor that amount of responsibility is anathema. They have 2 available and at the very least they should've used both. But they even have much more than that: The aircrafts has gyroscopes so that it always knows exactly what its fore-aft trim is, it has Pitout tubes so that it knows what its airspeed is, it has GPS so that it knows what its ground-speed is. From that it should be trivial to calculate its angle of attack with a fair amount of accuracy, quit independently of the AoA sensor itself. The AoA sensors are obviously the most accurate and as primary sensors must necessarily be the input to control-mechanisms, but the derived AoA from alternative instruments should give a very close approximation to what the AoA sensors should measure, and is perfectly capable of saying: Hey - this thing is broken! Do something else! At the very least, the MCAS system should not persist to push the nose-down to beyond horisontal fore-aft trim, particularly not at less than 1000m above the ground. None of these things are under the control of software developers - these are top-level decisions by design engineers. Or probably management, in this case. Are you suggesting that the information provided by the sensor in question should have been double checked automatically, using the alternative sources available?
|
|
|
Post by Trog on Jun 30, 2019 10:54:59 GMT
Are you suggesting that the information provided by the sensor in question should have been double checked automatically, using the alternative sources available? Yes, that is a fundamental principle in the design of all complex, critical systems. It is unbelievable that Boeing did not have it in place. They did not even use the output of the passive AoA sensor as a check on the active sensor. But even if they did, the only thing the on-board intelligence could realise would be that one of the sensors is broken - it could not know which one. The MCAS is supposed to be transparent - the pilots should not be aware of it. All the pilot should feel is that the MAX feels exactly like every other 737 he has ever flown. The AoA sensor and the flight-control computer is supposed to make that happen. With only ONE sensor being used and no alternative system, the flight-control computer has absolutely no way of knowing if the sensor is functional. The only thing it can do is to trust that the sensor is working and act according to its inputs. With the input of 2 AoA sensors, it can decide if one sensor is broken: They do not give the same readings => at least one of them must be wrong. It cannot know which one. So what it then should do (the only thing it can rationally do) is to shut-down the automatic stabiliser-trim system, and tell the pilots that they are on their own - that they need to trim the plane manually. It cannot keep on controlling the plane with the inputs of a system it knows to be defective. As I said, it should be possible to calculate a very accurate estimate of the AoA with the use of other onboard instrumentation and systems. Should that be available, together with the input of both AoA sensors, and one of the AoA sensors is defective, the flight-control computer can now determine which sensor is wrong, and decide to use the one that's working - again alerting the pilots of the fact that there is a problem. It could also happen that there is some system error which causes both AoA sensors to output the wrong data, i.e. even if both sensors indicate the same AoA, they are both wrong. Once again, the derived, calculated result will immediately pick up on this, and the flight-control computer can again disable automatic stabiliser control and inform the pilots. It could, of course, be the derived calculation that has some instrument problem, but the outcome would be exactly the same - disable automatic control. The point is that the flight-control computer can now detect a technical failure which invalidates its confidence to control the plane, disable that control and transfer all control entirely and unconditionally to the pilots. Anyway, for the flight-control computer: At the very least, it should be possible to calculate from the airspeed indicators, fore-and-aft pitch of the plane, and height-above-ground instrumentations that the plane is NOT about to stall, irrespective of what the AoA sensor is telling you, and if you are at a height of less than 2000 meters, in God's name don't try to dive straight down into the ground on the say-so of a single AoA sensor. Even with a fully functional and active MCAS system, it can never be necessary to trim the plane to less than perfectly horizontal flight, which is a gyroscope measurement and not a measurement from the AoA sensor.
|
|
|
Post by cjm on Oct 19, 2019 6:02:58 GMT
|
|
|
Post by cjm on Oct 19, 2019 6:08:18 GMT
|
|
|
Post by Trog on Oct 19, 2019 13:07:12 GMT
As clear as mud to me. Are they talking about the simulator or the plane? It's one of those typical low-signal-to-noise-ratio stories. It relates only obliquely (if at all) to the 737-MAX issue, but all the keywords are there. And it appears that there is someone whom blame can be assigned to. I wish the Americans will come up with a name for this kind of thing - thinking out apt descriptors for nebulous concepts is where their true (and probably only) brilliance lies. (e.g. 'virtue signalling', 'fat shaming', 'challenged', 'man-splaining', 'snowflake' etc.) Once upon a time, REUTERS was a respected agency. Probably when they still employed actual journalists. With the death of journalism, it seems like they're just going the way of everybody else.
|
|
|
Post by cjm on Oct 20, 2019 8:36:55 GMT
|
|
|
Post by cjm on Oct 21, 2019 6:57:43 GMT
|
|
|
Post by cjm on Oct 23, 2019 5:21:23 GMT
|
|
|
Post by cjm on Oct 25, 2019 6:36:02 GMT
|
|
|
Post by cjm on Oct 29, 2019 5:20:22 GMT
|
|
|
Post by cjm on Nov 5, 2019 7:04:43 GMT
|
|
|
Post by cjm on Nov 8, 2019 8:30:34 GMT
|
|
|
Post by cjm on Dec 13, 2019 5:15:43 GMT
|
|