Woody Pusher

Members
  • Content Count

    119
  • Joined

  • Last visited

  • Days Won

    1

Woody Pusher last won the day on May 7

Woody Pusher had the most liked content!

Community Reputation

13 Good

About Woody Pusher

  • Rank
    2

Profile Information

  • Gender
    Male
  • Location
    Man Cave

Recent Profile Visitors

1,608 profile views
  1. Newly stringent FAA tests spur a fundamental software redesign of Boeing’s 737 MAX flight controls Aug. 1, 2019 at 11:18 am Updated Aug. 1, 2019 at 9:45 pm By Dominic Gates Seattle Times aerospace reporter While conducting newly stringent tests on the Boeing 737 MAX flight control system, the Federal Aviation Administration (FAA) in June uncovered a potential flaw that now has spurred Boeing to make a fundamental software-design change. Boeing is changing the MAX’s automated flight-control system’s software so that it will take input from both flight-control computers at once instead of using only one on each flight. That might seem simple and obvious, but in the architecture that has been in place on the 737 for decades, the automated systems take input from only one computer on a flight, switching to use the other computer on the next flight. Boeing believes the changes can be accomplished in time to win new regulatory approval for the MAX to fly again by October. Significant slipping of that schedule could lead to a temporary halt in production at its Renton plant where 10,000 workers assemble the 737. After two deadly crashes of Boeing’s 737 MAX and the ensuing heavy criticism of the FAA for its limited oversight of the jet’s original certification, the agency has been reevaluating and recertifying Boeing’s updated flight-control systems. It has specifically rejected Boeing’s assumption that the plane’s pilots can be relied upon as the backstop safeguard in scenarios such as the uncommanded movement of the horizontal tail involved in both the Indonesian and Ethiopian crashes. That notion was ruled out by FAA pilots in June when, during testing of the effect of a glitch in the computer hardware, one out of three pilots in a simulation failed to save the aircraft. The thoroughness of the ongoing review of the MAX flight controls in light of the two crashes is apparent in how a new potential fault with a microprocessor in the flight-control computer was discovered during the June testing. Details of that fault not previously reported were confirmed both by an FAA official and by a person at Boeing familiar with the tests. In response to finding that new glitch, Boeing developed the plan to fundamentally change the software architecture of the MAX flight-control system and take input simultaneously from the two flight-control computers that are standard on the 737. “This is a huge deal,” Peter Lemme, a former flight-controls engineer at Boeing and avionics expert, said about the change. Lemme said the proposed software architecture switch to a “fail-safe,” two-channel system, with each of the computers operating from an independent set of sensors, will not only address the new microprocessor issue but will also make the flawed Maneuvering Characteristics Augmentation System (MCAS) that went haywire on the two crash flights more reliable and safe. “I’m overjoyed to hear Boeing is doing this,” Lemme said. “It’s absolutely the right thing to do.” According to a third person familiar with the details, Boeing expects to have this new software architecture ready for testing toward the end of September. Meanwhile, it will continue certification activities in parallel so that it can stick to its announced schedule and hope for clearance from the FAA and other regulators in October. Flipping bits When Boeing announced June 26 that a new potential flaw had been discovered on the MAX — this time in a microprocessor in the jet’s flight-control computer — it even caught Boeing CEO Dennis Muilenburg by surprise. Speaking at a conference in Aspen, Colorado, that morning, Muilenburg reiterated a prior projection that the MAX could be carrying passengers again by “the end of summer.” Later that day, Boeing announced the problem in a Securities and Exchange Commission filing, and soon after projected that the issue could add a further three months’ delay. What the FAA was testing when it discovered this new vulnerability was esoteric and remote. According to the person familiar with the details, who asked for anonymity because of the sensitivity of the ongoing investigations, the specific fault that showed up has “never happened in 200 million flight hours on this same flight-control computer in [older model] 737 NGs.” In sessions in a Boeing flight simulator in Seattle, two FAA engineering test pilots, typically ex-military test pilots, and a pilot from the FAA’s Flight Standards Aircraft Evaluation Group (AEG), typically an ex-airline pilot, set up a session to test 33 different scenarios that might be sparked by a rare, random microprocessor fault in the jet’s flight-control computer. This was standard testing that’s typically done in certifying an airplane, but this time it was deliberately set up to produce specific effects similar to what happened on the Lion Air and Ethiopian flights. The fault occurs when bits inside the microprocessor are randomly flipped from 0 to 1 or vice versa. This is a known phenomenon that can happen due to cosmic rays striking the circuitry. Electronics inside aircraft are particularly vulnerable to such radiation because they fly at high altitudes and high geographic latitudes where the rays are more intense. A neutron hitting a cell on a microprocessor can change the cell’s electrical charge, flipping its binary state from 0 to 1 or from 1 to 0. The result is that although the software code is right and the inputs to the computer are correct, the output is corrupted by this one wrong bit. So for example, a value of 1 on a single bit might indicate that the jet’s wing flaps are up, while a 0 would mean they are down. A value of 1 on a different bit might tell the computer that the MAX’s problematic flight-control system called MCAS is engaged, while a 0 would indicate it is not. This isn’t as alarming as it may sound. There are standard ways to protect against such bit flips having any dangerous impact on an airplane system, and FAA regulations require that this possibility be accounted for in the design of all critical electronics on board aircraft. The simulator sessions in June were designed to test for any such vulnerability. During the tests, 33 different scenarios were artificially induced by deliberately flipping five bits on the microprocessor, an error rate determined appropriate by prior analysis. For all five bits, each 1 became a 0 and each 0 became a 1. This is considered a single fault, on the assumption that some cause, whether cosmic rays or something else, might flip all five bits at once. For these simulations, the five bits flipped were chosen in light of the two deadly crashes to create the worst possible combinations of failures to test if the pilots could cope. In one scenario, the bits chosen first told the computer that MCAS was engaged when it wasn’t. This had the effect of disabling the cut-off switches inside the pilot-control column, which normally stop any uncommanded movement of the horizontal tail if the pilot pulls in the opposite direction. MCAS cannot work with those cut-off switches active and so the computer, fooled into thinking MCAS was operating, disabled them. Since MCAS exists only on the MAX, not on earlier 737 models, this potential failure applies only to the MAX. A second bit was chosen to make the horizontal tail, also known as the stabilizer, swivel upward uncommanded by the pilot, which has the effect of pitching the plane’s nose down. Other bits were flipped to add three more complications. Even though the MCAS system that pushed the nose down on the two crash flights had not been activated, these changes in essence gave the FAA test pilots in the simulator an emergency situation similar to what transpired on those flights. This was deliberate. The FAA demanded, with knowledge about the crashes, that this scenario be rigorously reexamined in a new System Safety Analysis of the MAX’s flight controls. “We were deliberately emulating some aspects of MCAS in a theoretical failure mode,” the person familiar with the tests said. We need your support In-depth journalism takes time and effort to produce, and it depends on paying subscribers. If you value these kinds of stories, consider subscribing. This person emphasized how extremely improbable it is that five single bits on the microprocessor would flip at once and that the random bits would make these specific critical changes to the aircraft’s systems. “While it’s a theoretical failure mode that has never been known to occur, we cannot prove it can’t happen,” he said. “So we have to account for it in the design.” He added that early published accounts of the fault suggesting that the microprocessor had been overwhelmed and its data-processing speed slowed, causing the pilot-control column thumb switches that move the stabilizer to respond slowly, were inaccurate. Lemme said he was happy to learn this because those accounts hadn’t made sense technically. And he said that the description of the fault and the chosen combination of random bit flips represent “a terribly worst-case condition that I cannot imagine happening in reality.” Dwight Schaeffer, a former senior manager at Boeing Commercial Electronics, the company’s one-time in-house avionics division, agreed. “Five independent bit flips is really an extremely improbable event,” he said. A crash in the simulator What happened in the initial simulated run of this fault scenario in June is that the FAA test pilots handled the emergency using the standard procedure for a “runaway stabilizer” and recovered the aircraft. But they felt it took too long and that a less attentive pilot caught by surprise might have had a worse outcome. FAA guidelines say that if an emergency arises on a plane flying by autopilot, the assumption is that a pilot will begin to respond within 3 seconds. If the plane is being flown manually, the assumption is 1 second. That may seem a very short response time, but it’s not dissimilar to what a driver would be expected to do if, for example, a car skidded on ice or a tire blew. Still, not every driver and not every pilot is attentive. “It took too long to recover,” said the FAA official familiar with the tests, who also asked for anonymity because of the sensitivity of ongoing investigations. “An important aspect of these simulations is to capture how a representative airline pilot would respond to the situation.” So again in light of what happened in the crashes, the FAA pilots took a further step. They flew the same fault scenario again, this time deliberately allowing the fault to run for some time before responding. This time, one of the three pilots didn’t manage to recover and lost the aircraft. Reclassified as “catastrophic” In testimony Wednesday before a U.S. Senate Appropriations Subcommittee hearing on FAA oversight, Ali Bahrami, associate FAA administrator for aviation safety, confirmed this. Describing what was tested in June as “a particular failure that was extremely remote,” Bahrami said “several of our pilots were able to recover. But there was one or so that could not recover successfully.” According to a second FAA source, it was the AEG pilot, representing a typical U.S. airline captain, who failed to recover the jet. That outcome changed everything for Boeing. Prior to that, Boeing had classified this failure mode as a “major fault,” a category that can be mitigated by flight-crew action. The one pilot’s failure to recover immediately changed the classification to “catastrophic,” and FAA regulations require that no single fault can be permitted to lead to a catastrophic outcome. That meant Boeing must fix it and eliminate the possibility. “There are active means of protecting against bit flips,” said retired Boeing electronics manager Schaeffer. “We always built it into our own software.” One standard way to fix such a problem is to have the second independent microprocessor inside the same flight-control computer check the output of the first. If the second processor output disagrees with that of the first processor for some specific automated flight control, then no automated action is initiated and the pilot must fly manually. “Now it takes two processors to fail to get the bad result,” the person familiar with the tests said. “You are no longer in the realm of a single point failure.” A radical redesign Boeing could have just rewritten the software governing what functions are monitored within the flight-control computer to eliminate this failure scenario. Instead, it’s decided to make a much more radical software redesign, one that will not only fix this problem but make the MAX’s entire flight-control system — including MCAS — more reliable, according to three sources. This change means the flight-control system will take input from both of the airplane’s flight computers and compare their outputs. This goes beyond what Boeing had previously decided to do, which is to adjust the MCAS software so that it took input from two angle of attack sensors instead of one. The problem with that earlier approach is that if something serious goes wrong with the single flight computer receiving this input — whether it’s the bit flipping issue, or a memory corruption or a chip failure of any kind — then the computer output to the flight controls could be wrong even if both angle of attack sensors are working correctly. For the MAX, the new MCAS was simply added to an existing 737 flight control system called the Speed Trim System, which was introduced with this one-channel computer architecture on the older model 737-300 in the 1980s. With the proposed dual-channel configuration, both computers will be used to activate the automated flight controls. They will each take input from a wholly independent set of sensors (air speed, angle of attack, altitude and so on) and compare outputs. If the outputs disagree, indicating a computer fault, the computers will initiate no action and just let the pilot fly manually. In other words, the new system will detect not only any disagreement between the sensors but also check for any processing error in interpreting the information from the sensors. “This is a really good solution,” said Lemme, adding that “it should have been designed this way” from the beginning of the flight control system in the 1980s. This raises the separate question of why the potential microprocessor fault discovered in June wasn’t caught in the original System Safety Analysis when the MAX was certified. That original System Safety Analysis, as The Seattle Times reported in March, was performed by Boeing, and FAA technical staff felt pressure from managers to sign off on it. And as reported in May, there was also pressure from Boeing managers on the engineers conducting the work to limit safety testing during the analysis. The person familiar with the testing said the new tests in June were informed by the knowledge of what had happened in the crashes, especially the erroneous activation of MCAS that pushed down the nose of the aircraft on both flights. “It was a reassessment in light of everything else going on in the world with MCAS,” he said. “It’s a different set of eyes, asking a different set of questions.” David Hinds, a retired Boeing flight controls and autopilot expert, said that clearly “something got missed” in the original MAX certification of MCAS and now this microprocessor fault. “I’d like to think you’d catch this on first pass,” said Hinds. “They should have looked harder at some of this.”
  2. 60 Minutes Australia - Boeing 737 MAX - Fatal Flaw https://www.youtube.com/watch?v=cFKk8iI4taI On a subject that 60 Minutes USA is not likely to show.
  3. Look at what has turned up in the Wall Street Journal! https://www.wsj.com/articles/boeings-own-test-pilots-lacked-key-details-of-737-max-flight-control-system-11556877600 Boeing’s Own Test Pilots Lacked Key Details of 737 MAX Flight-Control System A culture of close collaboration between test pilots, engineering staff deteriorated in later stages of aircraft’s development By Andrew Tangel and Andy Pasztor May 3, 2019 6:00 a.m. ET Boeing Co. limited the role of its own pilots in the final stages of developing the 737 MAX flight-control system implicated in two fatal crashes, departing from a longstanding practice of seeking their detailed input, people familiar with the matter said. As a result, Boeing test pilots and senior pilots involved in the MAX’s development didn’t receive detailed briefings about how fast or steeply the automated system known as MCAS could push down a plane’s nose, these people said. Nor were they informed that the system relied on a single sensor—rather than two—to verify the accuracy of incoming data about the angle of a plane’s nose, they added. Investigators have linked faulty sensor data to the flight-control system’s misfire, which led to crashes in Indonesia and Ethiopia that took 346 lives. The extent of pilots’ lack of involvement hasn’t been previously reported and could bring fresh scrutiny from investigators and regulators already looking into Boeing’s design and engineering practices. It isn’t clear whether greater pilot participation would have altered the ultimate design of the flight-control system. But the scaling back of pilots’ involvement and their lack of detailed knowledge about the plane’s system add to the list of questions about engineering and design practices facing the Chicago-based aerospace giant. A Boeing spokesman said test pilots and senior pilots didn’t have less of a role in the design, briefing and testing of the final version of MCAS when compared with their counterparts who worked on previous models featuring important new systems. “Listening to pilots is an important aspect of our work,” the spokesman said. “Their experienced input is front and center in our mind when we develop airplanes. We share a common priority—safety—and we listen to them carefully.” The MAX fleet has been grounded world-wide since the second crash in March, while Boeing and the Federal Aviation Administration complete a software fix to make MCAS less potent and have it rely on dual sensors. Chief Executive Dennis Muilenburg recently told investors Boeing would examine how it could improve the process of developing airplanes. Boeing’s test pilots are an elite full-time crew, usually consisting of former military aviators, who try out systems on new aircraft before engineering specifics are locked in. Such test flights occur before the final version of the airplane is produced, cockpit procedures are set and the aircraft is delivered to customers. Boeing’s management has long prided itself on close collaboration between test pilots and engineering staff. For decades, and particularly through the development of the first version of the wide-body 777 in the early 1990s, Boeing talked up how its roster of pilots and commercial aviators specifically recruited for feedback provided suggestions about the model’s cockpit design and function. A senior Boeing executive said pilots have remained intimately involved in aircraft development. “The test pilots have to be fully aware of what those capabilities are, and how the airplane will respond in those situations because they are ultimately the judge and jury,” the senior Boeing executive said in a recent Wall Street Journal interview. After Boeing decided to develop the MAX in 2011, executives overseeing the program welcomed and acted upon pilots’ suggestions, including adding larger cockpit displays, a senior pilot involved in the process said. Any suggestions that touched on safety got full attention, this pilot said. But over time, an internal restructuring that began in 2009 introduced changes in that process, eventually reducing pilots’ clout, according to people familiar with pilots’ role in the process. Boeing had consolidated its testing and evaluation teams into a companywide group of pilots and labs to streamline operations as it kept a lid on costs. The teams had previously worked independently within Boeing’s commercial and defense divisions, which some pilots say had the effect of keeping aviators closer to engineering divisions on particular development programs. About midway through the MAX’s development, the senior pilot recalls warning a Boeing executive about taking pilots out of the loop: “Something is going to get by, and it’s not going to be pretty.” The senior Boeing executive said he hadn’t heard such concerns and defended the consolidated testing group. The restructuring added no additional cost pressure for testing, he said, and instead strengthened the group by making more resources available across the company. The MCAS system was a new addition to Boeing’s 737 series, meant to kick in automatically and operate in the background to prevent a plane from stalling. A stall can occur when a plane is flying too slowly and its nose is too high to maintain lift. In the MAX, MCAS uses sensor data about the plane’s angle to push down its nose and keep it from stalling. One former Boeing pilot who participated in some later-stage MAX test flights recalls hearing about MCAS in a general way, but wasn’t given further details. For instance, this pilot never learned about the system’s reliance on a single sensor transmitting data about the angle of a plane’s nose, or how far MCAS would be able to move a plane’s adjustable tail fin known as a “horizontal stabilizer,” which controls the up-and-down movement of a jet’s nose. Test pilots did have the opportunity to try out the MAX and its automated system under various scenarios, but those didn’t include testing the full force of MCAS, some of these people said. Looking back, some pilots contend Boeing could have missed design flaws given their cohort’s at times limited involvement in the craft’s development. In 2016, a year before the MAX began commercial service, some test pilots suggested adapting MCAS, initially designed to operate at high speeds, to also work when the plane was traveling at slower speeds, according to one of the people familiar with the matter. By then, test pilots had less say in how design revisions were implemented. They also weren’t told explicitly that in its final iteration, MCAS commands would be four times as powerful than in earlier versions, according to people familiar with the matter. That change was earlier reported by the Seattle Times. In hindsight, test pilots “had no real input” into the ultimate MCAS design, one of the people said. Senior Boeing pilots at times found themselves excluded from meetings involving engineers, prompting them to sometimes invite themselves or show up unannounced, according to this person. The senior Boeing executive said last week that current development programs aren’t characterized by such friction.
  4. @Don Hudson Thanks for your reply to my last post (a couple of pages back!). Yes, I agree with your interpretation of how the final AND occurred. However, in respect of my comment, " manual trimming may be impossible ", a Mentour Pilot video taken in a B738 Full Simulator has some points of interest - applicable to ET320. The "roller coaster" method - to unload the HS and allow manual trimming, IF they'd known to use it, wouldn't get a look in due to terrain. Speed reduction may have, but it appears the crew didn't understand what they were dealing with. Note:- these runaway stabilizer correction scenarios were migrated from the FCOM to the FCTM as of the 732. The damming feature of the MCAS fitted to the MAX, is it is actually a system configuration control activated without cross reference to other ADIRU data, and hasn't the ability to detect a 'single point' air-data failure and remove itself from the control equation.
  5. @Don Hudson, It's the bits that are not said, that lead to confusion. Boeing's FCOM Bulletin states that "Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT". Missing; is it failed to WARN that the electric trim MUST be used BEFORE using the CUTOUT switches, in order to NEUTRALIZE the back force on the control column. This effectively means that if the aircraft is not properly trimmed before activating the CUTOUT switches, manual trimming may be impossible. My feeling is that the throttles were set for the projected climb, and the trim problem, UAS, stick shaker, warnings etc.. overwhelmed the crew, and eventually the increasing airspeed resulted in HS 'blow-back' - or HS stall. That's when the final AND occurred.
  6. FBI joining criminal investigation into certification of Boeing 737 MAX March 20, 2019 at 12:55 pm - Updated March 20, 2019 at 1:29 pm By Steve Miletich Seattle Times staff reporter The FBI has joined the criminal investigation into the certification of the Boeing 737 MAX, lending its considerable resources to an inquiry already being conducted by U.S. Department of Transportation agents, according to people familiar with the matter. The federal grand jury investigation, based in Washington, D.C., is looking into the certification process that approved the safety of the new Boeing plane, two of which have crashed since October. The FBI’s Seattle field office lies in proximity to Boeing’s 737 manufacturing plant in Renton, as well as nearby offices of Boeing and Federal Aviation Administration (FAA) officials involved in the certification of the plane. The investigation, which is being overseen by the U.S. Justice Department’s criminal division and carried out by the Transportation Department’s Inspector General, began in response to information obtained after a Lion Air 737 MAX 8 crashed shortly after takeoff from Jakarta on Oct. 29, killing 189 people, Bloomberg reported earlier this week, citing an unnamed source. It has widened since then, The Associated Press reported this week, with the grand jury issuing a subpoena on March 11 for information from someone involved in the plane’s development, one day after the crash of an Ethiopian Airlines 737 MAX 8 near Addis Ababa that killed 157 people. The FBI’s support role was described by people on condition of anonymity because of the confidential nature of the investigation Representatives of the Justice Department, the FBI and Transportation Department declined to comment, saying they could neither confirm nor deny an investigation. A Seattle Times story over the weekend detailed how FAA managers pushed its engineers to delegate more of the certification process to Boeing itself. The Times story also detailed flaws in an original safety analysis that Boeing delivered to the FAA. Criminal investigations into the federal oversight of airplane manufacturing and flight are rare, in part because of the longstanding belief that a civil-enforcement system better promotes candid reporting of concerns without fear of criminal repercussions. Those criminal cases that have occurred have focused on false entries and misrepresentations. In 1998, Transportation Department and FBI agents, acting on a whistleblower’s allegations, served a criminal search warrant on Alaska Airlines, seeking evidence of maintenance irregularities. The investigation expanded to include the January 2000 crash of Alaska Flight 261 that killed 88 people, which the National Transportation Safety Board later blamed on the airline’s faulty maintenance practices and poor FAA oversight. But no criminal charges were filed, although the FAA, in a separate administrative review, ultimately found that Alaska and three of its managers had violated safety regulations, fining the carrier $44,000, revoking the mechanic licenses of two of the managers and suspending the license of the third. Federal criminal charges were brought over the May 11, 1996, ValuJet Flight 592 crash that took off from Miami International Airport and plunged into the Everglades minutes later, killing 110 people. Federal prosecutors in Florida filed a 24-count indictment against SabreTech, an airline maintenance contractor, and its workers over alleged violations in the handling of oxygen containers blamed for the crash. SabreTech was found guilty on nine counts but was acquitted on conspiracy charges, according to news reports. An appeals court later overturned all but one of the counts, the improper training of employees.
  7. PARIS (Reuters) - France’s air accident investigation agency BEA will analysis black-box flight recorders from a Boeing 737 MAX 8 which crashed near Addis Ababa on Sunday, a spokesman said. Ethiopian Airlines said earlier it would send the two cockpit voice and data recorders abroad for analysis. The French announcement resolved uncertainty over the fate of the two recorders after Germany’s BFU said it had declined a request to handle them because it could not process the new type of recorder used on the 737 MAX jets, in service since 2017. The BEA is one of the world’s most active air crash agencies alongside the National Transportation Safety Board of the United States and has laboratories at its Le Bourget headquarters.
  8. Well, you are in a no win situation. You can't be in or go into A/P mode because you'd have an air-data discrepancy, yet the AD says STS runaway trim wont happen in Auto Pilot mode? No good arguing over it now, the problem the Lion Air crew encountered was the proverbial 'elephant in the room' one. Looked for the expected UAS and got kicked in the bum.