PixelFlight wrote:

The technical information shared in this thread showed that the 737 design predate the deployment of aircraft ADIRU redundancy, as found in more recent design, and that the adaptation made in the various 737 iterations did keep the same *split sides" design. Implementing the MCAS function on the 737 FCC design require specific safety precautions because there is only a single AoA sensor / ADIRU available on the FCC data link. That's the technical facts.

Okay, I checked out some of the posts dated 12/10/2018, and FlyXLsa posted a functional AOA/SMYD/FCC block diagram.



From that diagram, it implies (using plural AOA "sensors") multiple AOA sensors input to SMYD subsystem. This implies data validation/source selection (DV/SL) happening within the SMYD.

It also shows ADIRU input to SMYD. But not for AOA I'm guessing, but for the AOA-corrected IAS and ALT data.

It also shows outputs going to FCC, but doesn't detail which, although one would suspect ADIRU pass through (after SMYD DV/SL? probably not since it isn't plural) and AOA sensor/sensors data (likely after DV/SL, else why have multiple inputs?).

Then someone (you?) shared that each AOA sensor on the 737 Max has dual outputs, one going to the SMYD, and one going to it's own side's ADIRU. (Can we have the source reference for that information?)
Assuming it's accurate, there are total of four AOA channels:
Left AOA - to - Left ADIRU
Left AOA - to - SMYD : source selection for FCC?
Right AOA - to - SMYD : source selection for FCC?
Right AOA - to - Right ADIRU

Since stall detection depends on accurate AOA and IAS, there's probably DV/SL within the SMYD for that as well.

So, unless there's something I missed, this all supports the case of source selection on multiple AOA sensors on the 737 Max.

NTSC, the Indonesian travel safety commission, had confirmed the other day that they had successfully downloaded 124-minute worth of data from the PK-LQP's CVR. They also announced that the recording is clear, and they had been in the process of filtering out some unwanted noise before they started transcribing the data. They had been in direct contact with and being assisted by investigators from Australia, the US and Boeing.

What's interesting, as pointed out before, the fateful flight lasted only about 15 minutes, and the 124-minute duration of the data makes it possible to also "listen" as to what had transpired on the previous flight as well.

Sources:
- Lion Air's CVR audio is clear, KNKT starts the conversation transcript at Cockpit

- The NTSC has downloaded Lion Air PK-LQP CVR, 124 Minutes Total Record

patplan wrote:

NTSC, the Indonesian travel safety commission, had confirmed the other day that they had successfully downloaded 124-minute worth of data from the PK-LQP's CVR. They also announced that the recording is clear, and they had been in the process of filtering out some unwanted noise before they started transcribing the data. They had been in direct contact with and being assisted by investigators from Australia, the US and Boeing.

What's interesting, as pointed out before, the fateful flight lasted only about 15 minutes, and the 124-minute duration of the data makes it possible to also "listen" as to what had transpired on the previous flight as well.

Sources:
- Lion Air's CVR audio is clear, KNKT starts the conversation transcript at Cockpit

- The NTSC has downloaded Lion Air PK-LQP CVR, 124 Minutes Total Record

Thats's hot! I so look forward after the many assumption and doubts on knowledge and the tools

So, no reveal of the contents of the CvR for almost a year since the crash.

Nice.

Plenty of time for corruption to ensue!

FrenchPotatoEye wrote:

So, no reveal of the contents of the CvR for almost a year since the crash.

Nice.

Plenty of time for corruption to ensue!

I assume you are joking?
The crash was Oct 29 2018, and the CVR was just recovered on Jan 14 2019.

airnorth wrote:

FrenchPotatoEye wrote:

So, no reveal of the contents of the CvR for almost a year since the crash.

Nice.

Plenty of time for corruption to ensue!

I assume you are joking?
The crash was Oct 29 2018, and the CVR was just recovered on Jan 14 2019.

Reuters cites that the Indonesian investigators will not reveal the CvR content until Aug/Sep. That will be some ten/eleven months after the crash (hence the "almost a year" reference).

sgrow787 wrote:

PixelFlight wrote:

The technical information shared in this thread showed that the 737 design predate the deployment of aircraft ADIRU redundancy, as found in more recent design, and that the adaptation made in the various 737 iterations did keep the same *split sides" design. Implementing the MCAS function on the 737 FCC design require specific safety precautions because there is only a single AoA sensor / ADIRU available on the FCC data link. That's the technical facts.

Okay, I checked out some of the posts dated 12/10/2018, and FlyXLsa posted a functional AOA/SMYD/FCC block diagram.



From that diagram, it implies (using plural AOA "sensors") multiple AOA sensors input to SMYD subsystem. This implies data validation/source selection (DV/SL) happening within the SMYD.

It also shows ADIRU input to SMYD. But not for AOA I'm guessing, but for the AOA-corrected IAS and ALT data.

It also shows outputs going to FCC, but doesn't detail which, although one would suspect ADIRU pass through (after SMYD DV/SL? probably not since it isn't plural) and AOA sensor/sensors data (likely after DV/SL, else why have multiple inputs?).

Then someone (you?) shared that each AOA sensor on the 737 Max has dual outputs, one going to the SMYD, and one going to it's own side's ADIRU. (Can we have the source reference for that information?)
Assuming it's accurate, there are total of four AOA channels:
Left AOA - to - Left ADIRU
Left AOA - to - SMYD : source selection for FCC?
Right AOA - to - SMYD : source selection for FCC?
Right AOA - to - Right ADIRU

Since stall detection depends on accurate AOA and IAS, there's probably DV/SL within the SMYD for that as well.

So, unless there's something I missed, this all supports the case of source selection on multiple AOA sensors on the 737 Max.

I discovered (only now) this page that explain all in deep details:
https://www.satcom.guru/2018/11/737-fcc ... mmand.html
I encourage anyone to read it with attention. I think this is the kind of analysis that should be in the final report.

Some key points about SYMD that support your findings:
* There are two Stall Management Yaw Dampers (SMYD) on a 737ng. The 737MAX does not use a separate SMYD "box", rather the functions have migrated to other "boxes".
* SMYD 1 is used for primary yaw damping and is connected to the both ADIRUs and left AOA Sensor for inputs.
* SMYD 2 is used to match SMYD 1 primary yaw damper commands, and is available as a backup under certain conditions when SMYD 1 is not available. SMYD 2 uses both ADIRUs and the right AOA sensor for inputs.
* The Yaw Damper architecture is an example of a dual-channel philosophy.

Some key points about the FCC:
* Each FCC has two 16-bit CPUs. The CPUs calculate different commands.
* For Mach trim, Speed trim, and possibly MCAS; the single active FCC CPU#1 command is made regardless of CPU#2, and regardless of the non-active FCC.
* Active FCC CPU#1 commands are made based on a single sensor set. Active FCC CPU#2 raises an alert if the output command disagrees with the CPU#1 calculation, but does not stop CPU#1 command.
* It appears CPU#2 is using the same sensor data as CPU#1, making it susceptible to a common failure, using the same valid but false data.
* There is a cross-talk bus between the FCC's to allow sharing of sensor data. This may be already occurring in some cases.

So it appear that the data link architecture of the 737 NG and MAX have the capability to cross check the both sides ADIRU. But for some reason this was not [always] the case at least for the MCAS. The same page have a explanation in his conclusion:
"The FCC engaged-mode calculations, even single channel, depend on two sensor systems to prevent inappropriate response to a single sensor failure. Yet no such feature exists for FCC commands while not engaged." [my emphasis]

This could be the very detail that forced Boeing to write that the MCAS rely on a single AoA sensor in manual flight only. If all this are true, this greatly improve the understanding of the MCAS design context. It's maybe possible that there simply added the MCAS function where the mach trim and speed trim already exists, and those was already defective in manual flight but not as dangerous as the MCAS in case of a AoA fault.

FrenchPotatoEye wrote:

airnorth wrote:

FrenchPotatoEye wrote:

So, no reveal of the contents of the CvR for almost a year since the crash.

Nice.

Plenty of time for corruption to ensue!

I assume you are joking?
The crash was Oct 29 2018, and the CVR was just recovered on Jan 14 2019.

Reuters cites that the Indonesian investigators will not reveal the CvR content until Aug/Sep. That will be some ten/eleven months after the crash (hence the "almost a year" reference).

And that is when the preliminary report is due according to convention on these investigations - absolutely in line with the rules.

This idea that investigators are withholding / tampering with information comes up every single time there's a big event these days. And it's always the same thing: "It's been X weeks already, why haven't they given us laypeople all the information they have? I smell a fish..." - completely ignoring that all parties are *supposed to* analyse the data in private until the preliminary report is released and then again while preparing the final report.

PixelFlight wrote:

sgrow787 wrote:

PixelFlight wrote:

The technical information shared in this thread showed that the 737 design predate the deployment of aircraft ADIRU redundancy, as found in more recent design, and that the adaptation made in the various 737 iterations did keep the same *split sides" design. Implementing the MCAS function on the 737 FCC design require specific safety precautions because there is only a single AoA sensor / ADIRU available on the FCC data link. That's the technical facts.

Okay, I checked out some of the posts dated 12/10/2018, and FlyXLsa posted a functional AOA/SMYD/FCC block diagram.



From that diagram, it implies (using plural AOA "sensors") multiple AOA sensors input to SMYD subsystem. This implies data validation/source selection (DV/SL) happening within the SMYD.

It also shows ADIRU input to SMYD. But not for AOA I'm guessing, but for the AOA-corrected IAS and ALT data.

It also shows outputs going to FCC, but doesn't detail which, although one would suspect ADIRU pass through (after SMYD DV/SL? probably not since it isn't plural) and AOA sensor/sensors data (likely after DV/SL, else why have multiple inputs?).

Then someone (you?) shared that each AOA sensor on the 737 Max has dual outputs, one going to the SMYD, and one going to it's own side's ADIRU. (Can we have the source reference for that information?)
Assuming it's accurate, there are total of four AOA channels:
Left AOA - to - Left ADIRU
Left AOA - to - SMYD : source selection for FCC?
Right AOA - to - SMYD : source selection for FCC?
Right AOA - to - Right ADIRU

Since stall detection depends on accurate AOA and IAS, there's probably DV/SL within the SMYD for that as well.

So, unless there's something I missed, this all supports the case of source selection on multiple AOA sensors on the 737 Max.

I discovered (only now) this page that explain all in deep details:
https://www.satcom.guru/2018/11/737-fcc ... mmand.html
I encourage anyone to read it with attention. I think this is the kind of analysis that should be in the final report.

Some key points about SYMD that support your findings:
* There are two Stall Management Yaw Dampers (SMYD) on a 737ng. The 737MAX does not use a separate SMYD "box", rather the functions have migrated to other "boxes".
* SMYD 1 is used for primary yaw damping and is connected to the both ADIRUs and left AOA Sensor for inputs.
* SMYD 2 is used to match SMYD 1 primary yaw damper commands, and is available as a backup under certain conditions when SMYD 1 is not available. SMYD 2 uses both ADIRUs and the right AOA sensor for inputs.
* The Yaw Damper architecture is an example of a dual-channel philosophy.

Some key points about the FCC:
* Each FCC has two 16-bit CPUs. The CPUs calculate different commands.
* For Mach trim, Speed trim, and possibly MCAS; the single active FCC CPU#1 command is made regardless of CPU#2, and regardless of the non-active FCC.
* Active FCC CPU#1 commands are made based on a single sensor set. Active FCC CPU#2 raises an alert if the output command disagrees with the CPU#1 calculation, but does not stop CPU#1 command.
* It appears CPU#2 is using the same sensor data as CPU#1, making it susceptible to a common failure, using the same valid but false data.
* There is a cross-talk bus between the FCC's to allow sharing of sensor data. This may be already occurring in some cases.

So it appear that the data link architecture of the 737 NG and MAX have the capability to cross check the both sides ADIRU. But for some reason this was not [always] the case at least for the MCAS. The same page have a explanation in his conclusion:
"The FCC engaged-mode calculations, even single channel, depend on two sensor systems to prevent inappropriate response to a single sensor failure. Yet no such feature exists for FCC commands while not engaged." [my emphasis]

This could be the very detail that forced Boeing to write that the MCAS rely on a single AoA sensor in manual flight only. If all this are true, this greatly improve the understanding of the MCAS design context. It's maybe possible that there simply added the MCAS function where the mach trim and speed trim already exists, and those was already defective in manual flight but not as dangerous as the MCAS in case of a AoA fault.

STS and Mach trim inputs are bounded, whereas MCAS will keep commanding increments if enabling condition continue to exist.
That key difference probably makes hazard classification of STS/Mach trim failure different from MCAS failure

Of course they can't release it right away -- they have to hire the actors to fabricate 124 minutes of audio, right? That's got to take time.

(just trying to add some levity to the absurdity -- I absolutely do not think that's what's happening)

LDRA wrote:

PixelFlight wrote:

So it appear that the data link architecture of the 737 NG and MAX have the capability to cross check the both sides ADIRU. But for some reason this was not [always] the case at least for the MCAS. The same page have a explanation in his conclusion:
"The FCC engaged-mode calculations, even single channel, depend on two sensor systems to prevent inappropriate response to a single sensor failure. Yet no such feature exists for FCC commands while not engaged." [my emphasis]

This could be the very detail that forced Boeing to write that the MCAS rely on a single AoA sensor in manual flight only. If all this are true, this greatly improve the understanding of the MCAS design context. It's maybe possible that there simply added the MCAS function where the mach trim and speed trim already exists, and those was already defective in manual flight but not as dangerous as the MCAS in case of a AoA fault.

STS and Mach trim inputs are bounded, whereas MCAS will keep commanding increments if enabling condition continue to exist.
That key difference probably makes hazard classification of STS/Mach trim failure different from MCAS failure

Make a lot of sense, yes.

In the meantime, I was thinking about the statement "The 737MAX does not use a separate SMYD "box", rather the functions have migrated to other "boxes"." and I realized that if that others boxes are the ADIRU, then maybe the MAX have a single AoA link to feed both the ADIRU processors and the SYMD processors. This is pure speculation, but in that case a fault into the AoA link input will fit the observations that the FCC (via the ADIRU) and the SYMD both detected a high AoA value (FDR AoA graph + stick shaker) and that the replacement of the AoA sensor did not fixed the fault. This could also explain why there is yet still no published information about the FDR data before the AoA replacement nor about for the replaced AoA analysis. But again this part is pure speculation.

PixelFlight wrote:

In the meantime, I was thinking about the statement "The 737MAX does not use a separate SMYD "box", rather the functions have migrated to other "boxes"." and I realized that if that others boxes are the ADIRU, then maybe the MAX have a single AoA link to feed both the ADIRU processors and the SYMD processors. This is pure speculation, but in that case a fault into the AoA link input will fit the observations that the FCC (via the ADIRU) and the SYMD both detected a high AoA value (FDR AoA graph + stick shaker) and that the replacement of the AoA sensor did not fixed the fault. This could also explain why there is yet still no published information about the FDR data before the AoA replacement nor about for the replaced AoA analysis. But again this part is pure speculation.

The ADIRUs have a specific function, so I would expect the SMYD to be merged into FCC. As to SMYD-1 and SMYD-2 and the rest of your response, I think that changes things, at least for the non-Max 737s. I don't understand why the FlyXLsa's block diagram show multiple AOA sensor inputs going into SMYD if, as you say, SMYD-1 gets the left AOA and SMYD-2 gets the right AOA.

A bit of unknown and waiting for others to chime in.

sgrow787 wrote:

I don't understand why the FlyXLsa's block diagram show multiple AOA sensor inputs going into SMYD if, as you say, SMYD-1 gets the left AOA and SMYD-2 gets the right AOA.

I was wrong for the SMYD. My confusion was from the NG SMYD analog interface diagram that show only a single AoA analog input. The other side AoA seem to be transmitted with a digital bus. I have not yet identified witch one do that exactly. I have see a NG diagram with an ADIRU ADR ARNIC 429 input but from the same side as for the analog AoA input. I suspect the ARNIC 429 SMYD cross-channel bus, but this will make a SMYD susceptible to an other side SMYD failure compared to a direct link fro the other side ADIRU.

PixelFlight wrote:

sgrow787 wrote:

I don't understand why the FlyXLsa's block diagram show multiple AOA sensor inputs going into SMYD if, as you say, SMYD-1 gets the left AOA and SMYD-2 gets the right AOA.

I was wrong for the SMYD. My confusion was from the NG SMYD analog interface diagram that show only a single AoA analog input. The other side AoA seem to be transmitted with a digital bus. I have not yet identified witch one do that exactly. I have see a NG diagram with an ADIRU ADR ARNIC 429 input but from the same side as for the analog AoA input. I suspect the ARNIC 429 SMYD cross-channel bus, but this will make a SMYD susceptible to an other side SMYD failure compared to a direct link fro the other side ADIRU.

So many diagrams with partial view only... I have see now a NG diagram with SMYD 1 connected to both ADIRUs. There is no AoA value is the list of transmitted variables. Could be the case for the MAX, but the MCAS is implemented into the FCC.

SomebodyInTLS wrote:

FrenchPotatoEye wrote:

airnorth wrote:

I assume you are joking?
The crash was Oct 29 2018, and the CVR was just recovered on Jan 14 2019.

Reuters cites that the Indonesian investigators will not reveal the CvR content until Aug/Sep. That will be some ten/eleven months after the crash (hence the "almost a year" reference).

And that is when the preliminary report is due according to convention on these investigations - absolutely in line with the rules.

This idea that investigators are withholding / tampering with information comes up every single time there's a big event these days. And it's always the same thing: "It's been X weeks already, why haven't they given us laypeople all the information they have? I smell a fish..." - completely ignoring that all parties are *supposed to* analyse the data in private until the preliminary report is released and then again while preparing the final report.

Given the penchant for corruption in this neck of the world, that they won't even release the cvr recordings for almost a year is disgusting.

I really do not understand what it is with the internet that makes demands to see raw data as soon as it is available to investigators.

Aircraft crash investigations need to be measured analysis not shoot from the hip. It is obvious from comments on here that many have already made their mind up about what happened. The actual investigation team, which will include Boeing and I hope NTSB, need to take a much more considered approach. That is the way that safety in the industry actually improves.

FrenchPotatoEye wrote:

SomebodyInTLS wrote:

This idea that investigators are withholding / tampering with information comes up every single time there's a big event these days. And it's always the same thing: "It's been X weeks already, why haven't they given us laypeople all the information they have? I smell a fish..." - completely ignoring that all parties are *supposed to* analyse the data in private until the preliminary report is released and then again while preparing the final report.

Given the penchant for corruption in this neck of the world, that they won't even release the cvr recordings for almost a year is disgusting.

So 1) you are hugely prejudiced and 2) you didn't read what I wrote at all.

These things are *NORMALLY* released with the preliminary findings! And that *NORMALLY* occurs one year after the incident!

If the lawsuit against Boeing goes forward, would the plaintiffs be able to subpoena the CVR contents from Boeing before the one year duration? Certainly Boeing (and the NTSB) have a copy of the CVR at this point.

Or would it actually work backwards.. families of victims living in Indonesia would petition a copy of the contents, examine it, then decide whether to move forward with the Boeing suit?

sgrow787 wrote:

If the lawsuit against Boeing goes forward, would the plaintiffs be able to subpoena the CVR contents from Boeing before the one year duration? Certainly Boeing (and the NTSB) have a copy of the CVR at this point.

Or would it actually work backwards.. families of victims living in Indonesia would petition a copy of the contents, examine it, then decide whether to move forward with the Boeing suit?

First, I don't think there is any decision. Boring is a big company with a lot of money and insurance. Therefore, if a Boeing plane crashes they will be sued even if it is determined that a 5 year old was allowed to fly the plane and crashed it.

There is very little chance that a plaintiff could subpoena anything before release. Lawsuits take years so there is no compelling reason for the plaintiff to need the evidence that quickly. My former neighbor is being sued for an automobile accident with no fatalities that happened in 2012. The suit was filed in 2013 and the trial is next week, almost 6 years after filling.

Would people please take their conspiracy theories elsewhere, I'm sure there are plenty of places on the internet they can meet like minds. It adds nothing to the conversation and there are some very knowledgeable people here who are providing some incredibly informative contributions regarding what may have happened. They are being drowned out by this nonsense and I wouldn't blame them if they stopped.

This forum already lost some of its best contributors because they got tired of people with nothing to say dragging down conversations. It does the credibility of the forum no good and we will all suffer for that.

Lets remember that the CVR is not the only source of information, nor is this particular crew's action where this accident investigation ends (unless they were hugely negligent). Something bad happened, some fraction of blame goes to crew, some to other sources (e.g., airplane or user interface design).

Planetalk wrote:

This forum already lost some of its best contributors because they got tired of people with nothing to say dragging down conversations. It does the credibility of the forum no good and we will all suffer for that.

If you're referring to the informative and well-placed Mr. Mandala, not to worry. His posts can no longer be found in search engine.

AirlineCritic wrote:

Lets remember that the CVR is not the only source of information, nor is this particular crew's action where this accident investigation ends (unless they were hugely negligent). Something bad happened, some fraction of blame goes to crew, some to other sources (e.g., airplane or user interface design).

So true. However, you omit that Lion Air may share in the blame due to their culture, maintenance, procedures, etc.

In reality and based on my experience with these types of investigations: I foresee that the final report will mostly likely cite Lion Air procedures and practices and it's crew as having more contributors to this accident than Boeing, although the Boeing MCAS system documentation is likely to be cited as a contributing factor.

I also anticipate that there will be some form of revision to the MCAS system and or documentation in the future from this accident as Boeing has demonstrated that they do in fact respond to accident report issues.

I am patient though... Having run Root Cause investigations I know how long and what kind of detail goes into these investigations and reports (and how wrong initial assumptions are on initial data often are). While certain areas are essentially wrapped up by now... other areas are likely just really getting started with the recovery of the CVR.

I trust the process - as long as the investigation agency is not itself corrupt; which I do not suspect in this case.

Have a great day,

"lion air having more contributor than boeing to this accident?" boeing did Not told about Mcas Can overide pilot control.. most max pilot did not know about that and if its not lion air may be another airline pilot will face that danger moment... emagine if that moment happening above a big city not above the sea....sory for my english..

2175301 wrote:

So true. However, you omit that Lion Air may share in the blame due to their culture, maintenance, procedures, etc.

In reality and based on my experience with these types of investigations: I foresee that the final report will mostly likely cite Lion Air procedures and practices and it's crew as having more contributors to this accident than Boeing, although the Boeing MCAS system documentation is likely to be cited as a contributing factor.

I also anticipate that there will be some form of revision to the MCAS system and or documentation in the future from this accident as Boeing has demonstrated that they do in fact respond to accident report issues.

Looking at some recent lawsuits, such shared blame may be bad news for the victims (or their relatives). The conclusion in those cases had been basically: "Lots of people made small mistakes each, which resulted in the catastrophy, but no individual mistake was severe enough to hold that person liable. Thus, both everybody and nobody is actually at fault."

You'll find very few crashes that didn't involve some mistake by the pilots, but at the same time many crashes were initiated or contributed to by external factors and poor design. I have seen a quite common mindset of "two independent simultaneous failures are too unlikely to be considered". In this case (1) the AoA vane had to fail, (2) it had to be missed by all people involved and (3) the pilots had to react in a wrong manner. If an engineer had brought this up in a Boeing meeting, he'd have been laughed at for conceiving an "impossible" scenario and possibly critiziced for adding extra work to implement warnings and/or redundancy.

Let's jut wait for the report. There is no need for early spin doctoring here.
The report however will not come to legal conclusions but just name the reason for the accident.

mxaxai wrote:

You'll find very few crashes that didn't involve some mistake by the pilots, but at the same time many crashes were initiated or contributed to by external factors and poor design. I have seen a quite common mindset of "two independent simultaneous failures are too unlikely to be considered". In this case (1) the AoA vane had to fail, (2) it had to be missed by all people involved and (3) the pilots had to react in a wrong manner. If an engineer had brought this up in a Boeing meeting, he'd have been laughed at for conceiving an "impossible" scenario and possibly critiziced for adding extra work to implement warnings and/or redundancy.

Sorry, but this is really not how safety assessment activity is intended to be implemented in practice.

PixelFlight wrote:

mxaxai wrote:

You'll find very few crashes that didn't involve some mistake by the pilots, but at the same time many crashes were initiated or contributed to by external factors and poor design. I have seen a quite common mindset of "two independent simultaneous failures are too unlikely to be considered". In this case (1) the AoA vane had to fail, (2) it had to be missed by all people involved and (3) the pilots had to react in a wrong manner. If an engineer had brought this up in a Boeing meeting, he'd have been laughed at for conceiving an "impossible" scenario and possibly critiziced for adding extra work to implement warnings and/or redundancy.

Sorry, but this is really not how safety assessment activity is intended to be implemented in practice.

I can assure you that, in practice, safety engineering is always in conflict with the design teams, especially when significant financial consequences are involved.
Adding an alert may have forced Boeing to conduct extra equipment & flight tests, easily costing millions of dollars. It may have forced airlines to extend the pilot training, again costing millions of dollars across the fleet. Adding redundancy & fault monitoring may have required additional engineering resources and delayed the project. It is very difficult to convince all the people involved to accept that cost for such an "unlikely" and "minor" event, especially when the FAA doesn't object.

The NYT published an article on this overnight. I haven't seen it posted here so here is the link

https://www.nytimes.com/2019/02/03/worl ... e=Homepage

here is also a link from Google News if the previous link isn't available to non subscribers

https://www.nytimes.com/2019/02/03/worl ... ilots.html

A.

The NYT article doesn't say anything that those of us following the issue didn't know, but it's a good explainer for the general public of the issues surrounding the certification of the MAX with MCAS.

RogerMurdock wrote:

The NYT article doesn't say anything that those of us following the issue didn't know, but it's a good explainer for the general public of the issues surrounding the certification of the MAX with MCAS.

It says nothing new at all. Just the same reporters insistence on forming public opinion to match his opinion.

The aircraft wasn’t airworthy, hadn’t been for days. Airplanes that aren’t airworthy are not safe to fly. Period. Poorly trained pilots flying aircraft that aren’t airworthy is sure to lead to disaster, and it did. Boeing made a design change. So what, they make design changes within variants. The first 737-800 is different from the newest 737-800, that doesn’t make it dangerous. Any competent 737 pilot knows to disconnect his stab if it’s running away. Why didn’t he do it and manually trim the plane? Shouldn’t he have been trained to handle it considering it’s an established procedure?

So Boeing bears no responsibilty?

Wait for the report - I suspect it will not agree in totality with that opinion.

StTim wrote:

:banghead: So Boeing bears no responsibilty?

Wait for the report - I suspect it will not agree in totality with that opinion.

And what do you expect then?

It says nothing new at all. Just the same unqualified "experts" insistence on forming public opinion to match their opinion.

The aircraft wasn’t airworthy, hadn’t been for days. Airplanes that aren’t airworthy are not safe to fly. Period. Poorly trained pilots flying aircraft that aren’t airworthy is sure to lead to disaster,

I expect that there will be blame on almost every party - including the FAA.

An accident is as someone said an alignment of holes in a Swiss cheese. The pilots are in effect the last line of defence - but they are not omnipotent.

From the NYT article;
"European regulators initially disagreed with the F.A.A.’s judgment about the need for additional training but ultimately went along, a pilot familiar with the certification process said, while regulators in Brazil broke with the F.A.A. and required that pilots be made familiar with the change. ------------ When Brazilian regulators published their required training for pilots, they singled out M.C.A.S. as one of the changes that needed to be flagged."

Now we know why the MCAS system and its functionality was included in the difference training manuals for the pilots at Brazilian airlines. It seems like it was beacuse the Brazilian regulators demanded that Boeing included this information in the training manuals for the pilots.

Skyteam10001 wrote:

https://www.nytimes.com/2019/02/03/world/asia/lion-air-plane-crash-pilots.html

"Boeing did not hide the modified system. It was documented in maintenance manuals for the plane, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737."

I wonder if Boeing detailed it as an enhancement rather than as a necessary system due to the larger engines and the increased stall characteristic.

"In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight."

I'd like to see a source reference for that statement. A stall prevention/detection system that uses only one of the two sensors available to it is ludicrous to me. Perhaps now is the time to ask for a Congressional hearing on what both FAA and Boeing knew at the time of certification.

sgrow787 wrote:

"In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight."

I'd like to see a source reference for that statement. A stall prevention/detection system that uses only one of the two sensors available to it is ludicrous to me. Perhaps now is the time to ask for a Congressional hearing on what both FAA and Boeing knew at the time of certification.

This is the second time the exact word "ludicrous" was used to deny this fact which was established very early in the thread by several posters.

Now while I do not pretend to be an expert in avionics, the evidence seemed convincing and it was the generally accepted thread concensus at the time. People suddenly starting to call it into doubt now does seem to smack of an agenda...

SomebodyInTLS wrote:

sgrow787 wrote:

"In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight."

I'd like to see a source reference for that statement. A stall prevention/detection system that uses only one of the two sensors available to it is ludicrous to me. Perhaps now is the time to ask for a Congressional hearing on what both FAA and Boeing knew at the time of certification.

This is the second time the exact word "ludicrous" was used to deny this fact which was established very early in the thread by several posters.

Now while I do not pretend to be an expert in avionics, the evidence seemed convincing and it was the generally accepted thread concensus at the time. People suddenly starting to call it into doubt now does seem to smack of an agenda...

Well, maybe because even if single-sensor design is actually used, it is still unexpected way of doing things for avionics. ludicrous.
If I tell you that a certain engine maker rated service life as longest an engine lasted on a stand, not as time when multiple engines showed signs of failure - how would you feel about that? Crazy, unreasonable, ridiculous?... Sure. But NASA got it changed only when that practice was brought to light by post-Challenger investigation. Too bad people pay with their lives for catching such mistakes.

I still assume that single sensor approach was an unintended consequence - like misunderstanding between different teams. Too bad it wasn't caught by Boeing. Too bad FAA and EASA didn't catch it as well. Too bad it was in a revenue flight.... But shit happens.

kalvado wrote:

Too bad it wasn't caught by Boeing. Too bad FAA and EASA didn't catch it as well.

The NYT article referenced above implies that the design was intended and that Boeing (and the FAA) understood the potential for single point failure --

"In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight. That decision kept the system simpler, but also left it vulnerable to a single malfunctioning sensor, or data improperly transferred from it — as appeared to occur on the day of the crash.

There is no evidence that Boeing did flight-testing of M.C.A.S. with erroneous sensor data, and it is not clear whether the F.A.A. did so. European regulators flight-tested the new version of the plane with normal sensor data feeding into M.C.A.S. but not with bad data, the pilot familiar with the European certification process said.."

mxaxai wrote:

PixelFlight wrote:

mxaxai wrote:

You'll find very few crashes that didn't involve some mistake by the pilots, but at the same time many crashes were initiated or contributed to by external factors and poor design. I have seen a quite common mindset of "two independent simultaneous failures are too unlikely to be considered". In this case (1) the AoA vane had to fail, (2) it had to be missed by all people involved and (3) the pilots had to react in a wrong manner. If an engineer had brought this up in a Boeing meeting, he'd have been laughed at for conceiving an "impossible" scenario and possibly critiziced for adding extra work to implement warnings and/or redundancy.

Sorry, but this is really not how safety assessment activity is intended to be implemented in practice.

I can assure you that, in practice, safety engineering is always in conflict with the design teams, especially when significant financial consequences are involved.
Adding an alert may have forced Boeing to conduct extra equipment & flight tests, easily costing millions of dollars. It may have forced airlines to extend the pilot training, again costing millions of dollars across the fleet. Adding redundancy & fault monitoring may have required additional engineering resources and delayed the project. It is very difficult to convince all the people involved to accept that cost for such an "unlikely" and "minor" event, especially when the FAA doesn't object.

This new version is a bit more realistic for this particular case. Thanks.

And also, PK-LQP is not owned by Lion, it's a leased airplane. The only thing I know is that the hybrid Batik+Lion MAX is actually owned by the airline, the rest are leased.

SomebodyInTLS wrote:

This is the second time the exact word "ludicrous" was used to deny this fact which was established very early in the thread by several posters.

Now while I do not pretend to be an expert in avionics, the evidence seemed convincing and it was the generally accepted thread concensus at the time. People suddenly starting to call it into doubt now does seem to smack of an agenda...

I spent several hours one weekend recently trying to find that information in this thread (using the Search tool) and posted what I found. I also googled for Boeing statements on MCAS and only got hits from their FCOM Bulletin which says that an erroneous AOA fail condition could _potentially_ cause MCAS to kick in:

"In the event of erroneous AOA data, the pitch trim system _can_ trim the stabilizer nose down..."

But as I've said, even if the FCOM Bulletin stated a single AOA sensor would definitely cause MCAS to kick in, it still doesn't mean we can conclude that was Boeing's intended design.

Now taking the single sensor design view, the NYT article seems to imply that the redundancy is accomplished by having two FCC computers, one for the pilot and one for the copilot, but doesn't say how one or the other is selected (ie "active on that flight"):

"In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight."

If that's the case - and assuming the pilot is communicating to the copilot - then a possible solution is to simply switch control to the copilot's FCC. But I think I read here somewhere that takes some time to do. Perhaps this is why it was not chosen as a NNC procedure for the FCOM bulletin?

mxaxai wrote:

PixelFlight wrote:

mxaxai wrote:

You'll find very few crashes that didn't involve some mistake by the pilots, but at the same time many crashes were initiated or contributed to by external factors and poor design. I have seen a quite common mindset of "two independent simultaneous failures are too unlikely to be considered". In this case (1) the AoA vane had to fail, (2) it had to be missed by all people involved and (3) the pilots had to react in a wrong manner. If an engineer had brought this up in a Boeing meeting, he'd have been laughed at for conceiving an "impossible" scenario and possibly critiziced for adding extra work to implement warnings and/or redundancy.

Sorry, but this is really not how safety assessment activity is intended to be implemented in practice.

I can assure you that, in practice, safety engineering is always in conflict with the design teams, especially when significant financial consequences are involved.
Adding an alert may have forced Boeing to conduct extra equipment & flight tests, easily costing millions of dollars. It may have forced airlines to extend the pilot training, again costing millions of dollars across the fleet. Adding redundancy & fault monitoring may have required additional engineering resources and delayed the project. It is very difficult to convince all the people involved to accept that cost for such an "unlikely" and "minor" event, especially when the FAA doesn't object.

And differences training and documentation highlight changes. Changes get a 'please explain' and are allocated points with a weighting (significance and duration of grandfathering). When sum of total points (change points times weighting) exceed a pre-determined number, grandfathering should be reviewed / challenged by in this case, the FAA.

https://www.seattletimes.com/business/b ... air-crash/

here is an article from the Seattle Times, a newspaper one hardly can call unfriendly to Boeing.

If it is true that Boeing did not test fly the MAX with erroneous data regarding the MCAS and the FAA did not pressure them to do it, it opens the question if the FAA and Boeing are collaborating and if the FAA does its due diligence in regards to Boeings decisions regarding safety.
EASA also seems to have backed down too, both in regards to the test flights and regarding difference training.

The Brazilian regulators did not accept the Boeing/FAA view regarding MCAS and require difference training.

mjoelnir wrote:

The Brazilian regulators did not accept the Boeing/FAA view regarding MCAS and require difference training.

So what prevented the Europeans and other agencies from doing the same, not bowing to the pressure from the American's has been the norm for many for many years, what changed?

mjoelnir wrote:

https://www.seattletimes.com/business/boeing-faa-face-scrutiny-after-deadly-lion-air-crash/

here is an article from the Seattle Times, a newspaper one hardly can call unfriendly to Boeing.

That's exactly the same as the New York Times article, they're republishing it.

RogerMurdock wrote:

mjoelnir wrote:

https://www.seattletimes.com/business/boeing-faa-face-scrutiny-after-deadly-lion-air-crash/

here is an article from the Seattle Times, a newspaper one hardly can call unfriendly to Boeing.

That's exactly the same as the New York Times article, they're republishing it.

They would not republish it, if they would not agree with it.

mjoelnir wrote:

RogerMurdock wrote:

mjoelnir wrote:

https://www.seattletimes.com/business/boeing-faa-face-scrutiny-after-deadly-lion-air-crash/

here is an article from the Seattle Times, a newspaper one hardly can call unfriendly to Boeing.

That's exactly the same as the New York Times article, they're republishing it.

They would not republish it, if they would not agree with it.

Who cares if they agree with it or not? If it’s the same article, why post it again like it’s new information?

Seattle newspapers are quite critical of just about anything Boeing does. Certainly not a warm relationship.