That simply, physically, should not be possible. There simply should be no network connection to such systems...

This is not really possible in these days of highly connected flight systems to aid monitoring and fault finding while the aircraft is in flight. Perhaps the most dramatic example of this was when the Air France Airbus stalled into the Atlantic a few years back. They were able to locate which sensor had failed before the black box had been recovered by use of the in-flight telemetry, at the time, was primarily used to monitor engine status, but additionally had data from the pitot tubes and external air temperature sensors to "calibrate" the engine instrumentation. (As an aside some people have suggested that had a ground based engine engineer been watching that flight the discrepancy between engine derived data and flight sensor data would have given sufficient time for the stall to have been prevented.)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

That simply, physically, should not be possible. There simply should be no network connection to such systems...

This is not really possible in these days of highly connected flight systems to aid monitoring and fault finding while the aircraft is in flight. Perhaps the most dramatic example of this was when the Air France Airbus stalled into the Atlantic a few years back. They were able to locate which sensor had failed before the black box had been recovered by use of the in-flight telemetry, at the time, was primarily used to monitor engine status, but additionally had data from the pitot tubes and external air temperature sensors to "calibrate" the engine instrumentation. (As an aside some people have suggested that had a ground based engine engineer been watching that flight the discrepancy between engine derived data and flight sensor data would have given sufficient time for the stall to have been prevented.)

Such connectedness can be done (and should be done) such that the system doing the 'connecting' is separate and independent of the Flight Control System.

That is easily done using monitoring devices that can only monitor the signals and data of interest. It is then that monitoring device/system that is 'internet connected' to report back to home.

For such a safety critical system as the Flight Control Computer, there simply should be no physical way to endanger that system in flight...


IT is what we make it and what we (or in this case, the FAA) allow it to be...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

That simply, physically, should not be possible. There simply should be no network connection to such systems...

This is not really possible in these days of highly connected flight systems to aid monitoring and fault finding while the aircraft is in flight. Perhaps the most dramatic example of this was when the Air France Airbus stalled into the Atlantic a few years back. They were able to locate which sensor had failed before the black box had been recovered by use of the in-flight telemetry, at the time, was primarily used to monitor engine status, but additionally had data from the pitot tubes and external air temperature sensors to "calibrate" the engine instrumentation. (As an aside some people have suggested that had a ground based engine engineer been watching that flight the discrepancy between engine derived data and flight sensor data would have given sufficient time for the stall to have been prevented.)

Such connectedness can be done (and should be done) such that the system doing the 'connecting' is separate and independent of the Flight Control System.

That is easily done using monitoring devices that can only monitor the signals and data of interest. It is then that monitoring device/system that is 'internet connected' to report back to home.

For such a safety critical system as the Flight Control Computer, there simply should be no physical way to endanger that system in flight...

Never going to happen. One upload from the ground in flight that happens now is a change in flight plan. Also the fuel weight and balance, weight of cargo and which cargo hold has how much is updated usually in taxi not airborne. All of this feeds into the FMS. Others are all the same ones for any computer such a a BIOS flash. You simply can't allow a rouge ground person the opportunity to plug a carefully crafted update USB into a jack on the flight deck where trust would be implicit. No NO NO! That update needs to be verified by a ground computer and then loaded via satellite radio. There are far too many ways to compromise ramp personnel and there are lots of them. Or that will be the thinking of some safety person and they might be right. The maps that are part of the navigation system are valid for only 28 days. Updated a little more often than your Tom Tom.

Such connectedness can be done (and should be done) such that the system doing the 'connecting' is separate and independent of the Flight Control System.

That is easily done using monitoring devices that can only monitor the signals and data of interest. It is then that monitoring device/system that is 'internet connected' to report back to home.

For such a safety critical system as the Flight Control Computer, there simply should be no physical way to endanger that system in flight...

Never going to happen. One upload from the ground in flight that happens now is a change in flight plan. Also the fuel weight and balance, weight of cargo and which cargo hold has how much is updated usually in taxi not airborne. All of this feeds into the FMS. Others are all the same ones for any computer such a a BIOS flash. You simply can't allow a rouge ground person the opportunity to plug a carefully crafted update USB into a jack on the flight deck where trust would be implicit. No NO NO! That update needs to be verified by a ground computer and then loaded via satellite radio. There are far too many ways to compromise ramp personnel and there are lots of them. Or that will be the thinking of some safety person and they might be right. The maps that are part of the navigation system are valid for only 28 days. Updated a little more often than your Tom Tom.

That may well be so for the Flight Management System (FMS).

But for the critical Flight Control Computers (FCC)?...

So, where is there any documentation for what is actually implemented and what is actually done?


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Continuing to unravel the Boeing 737 Max disaster:

[...]

All greedily deadly stuff.

So... Why was there not an immediate grounding of the Boeing 737 MAX immediately after the first fatal disaster?...

With those fatal ingredients so quickly deduced, why no useful action by the FAA to bring Boeing safely to heel?...

More detail of the lead up to the consequences:


The inside story of MCAS: How Boeing’s 737 MAX system gained power and lost safeguards

Early in the development of the 737 MAX, engineers gathered at Boeing’s transonic wind tunnel in Seattle to test the jet’s aerodynamics using a scale model ... The testing in 2012, with air flow approaching the speed of sound, allowed engineers to analyze how the airplane’s aerodynamics would handle a range of extreme maneuvers. When the data came back, according to an engineer involved in the testing, it was clear there was an issue to address.

Engineers observed a tendency for the plane’s nose to pitch upward during a specific extreme maneuver. After other efforts to fix the problem failed...

... As Boeing and the FAA advanced the 737 MAX toward production, they limited the scrutiny and testing of the MCAS design. Then they agreed not to inform pilots about MCAS in manuals, even though Boeing’s safety analysis expected pilots to be the primary backstop in the event the system went haywire.

In the wake of the two crashes, despite an outcry from the public and from some pilot and airline industry officials, Boeing has ... refused to accept blame...

... During flight tests to certify an airplane, pilots must safely fly an extreme maneuver, a banked spiral called a wind-up turn that brings the plane through a stall. While passengers would likely never experience the maneuver on a normal commercial flight, it could occur if pilots for some reason needed to execute a steep banking turn...

... Why three seconds? That’s the period of time that FAA guidance says it should take a pilot to recognize what’s happening and begin to counter it. Boeing assessed both of these failure modes as “major.” Finally, the analysis looked at the inadvertent operation of MCAS during a wind-up turn, which was assessed as “hazardous,” defined in a cold actuarial analysis as an event causing serious or fatal injuries to a small number of people, but short of losing the plane (that’s called “catastrophic”)...

... However on both accident flights, the angle-of-attack sensor failure set off multiple alerts causing distraction and confusion from the moment of takeoff, even before MCAS kicked in...



So, the AoA failure was never tested for MCAS operation! And despite multiple alerts, at very high stress immediately after takeoff near to the ground, really the pilots were supposed to give all their attention within 3 seconds to a system they didn't even know existed?!

My reading of all this gives me the impression that this story gets yet ever worse...


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

From memory the entire avionics and engineering data was available in flight, but normally only a very small sample was actually "actively monitored" - if certain sets of readings went out of scope then alarms would be raised. Again from memory those actively monitored included pitch and yaw control inputs and movement, but (strangley in the light of events) not the pitot tube data. But all the data was logged and could be post-flight analysed.
Although not officially supported it has been suggested that it was a member of the engine team who spotted a pitot icing issue on another flight (the plane had allegedly been suffering some strange engine instrumentation issues) and suggested to his mate on the AF investigation team it might be worth having a look at that data. (Lunch/coffee/bar time chats can be a great source of inspiration)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

That simply, physically, should not be possible. There simply should be no network connection to such systems..

I hate to put it this way, but the necessary skills are not being taught and drilled into the IT world.

Since February 1975, I've always stated that anything man made is not 100% safe. Then it was mechanical & electrical operation. A major failure of either one & it was taken out of service.

Progress is always needed & often is the case that the progress made was an improvement.
Unfortunately today, that progress involves too much electronics & software which is running rampant & unchecked.

Will there be more?
Boeing loses big order for 737 Max aircraft

Flyadeal, the low-cost Saudi Arabian airline, has cancelled an order for 30 Boeing 737 Max aircraft.
The decision follows the crashes of two 737 Max jets, the first in Indonesia in October followed by one in Ethiopia in March, which killed 346 people.
Since then the aircraft has been grounded and Boeing has been working on a fix that will satisfy regulators.
Boeing said that flyadeal had decided not go ahead with the provisional order because of "schedule requirements".
The deal, which included an additional option to purchase 20 more 737 Max aircraft, was worth $5.9bn at list prices, but the airline would have been offered a discount on that price tag.
Instead flyadeal, which is controlled by state-owned Saudi Arabian Airlines, will operate a fleet of Airbus A320 planes.

Just read that. Also from that report:

Last week Boeing announced that it would give $100m to help families affected by the two crashes.
The payment, stretching over several years, is independent of lawsuits filed in the wake of the disasters, which together killed 346 people.
Lawyers for victims' families dismissed the move.

Just read that. Also from that report:

Last week Boeing announced that it would give $100m to help families affected by the two crashes.
The payment, stretching over several years, is independent of lawsuits filed in the wake of the disasters, which together killed 346 people.
Lawyers for victims' families dismissed the move.

No profit for any of the lawyers.

Even Ford didn't learn from the Pinto
https://www.freep.com/in-depth/money/cars/ford/2019/07/11/ford-focus-fiesta-transmission-defect/1671198001/

Ford knew Focus, Fiesta models had flawed transmission, sold them anyway

... So, the AoA failure was never tested for MCAS operation! And despite multiple alerts, at very high stress immediately after takeoff near to the ground, really the pilots were supposed to give all their attention within 3 seconds to a system they didn't even know existed?!

My reading of all this gives me the impression that this story gets yet ever worse...

And is this yet another potential (potent) killer on the Boeing 737 Max flight control system?


New Report Finds Boeing 737 MAX Autopilot Could Fail During Emergencies

... According to the European Union Aviation Safety Agency (EASA), in some emergencies the Boeing 737 MAX’s Autopilot may fail to disengage, preventing pilots from taking manual control of the aircraft...


Now The Boeing 737 MAX Has An Autopilot Problem

... This time, there are safety concerns regarding the autopilot. Autopilot issues are a new concern, recently identified as the aircraft undergoes additional scrutiny...

... The European Union Aviation Safety Agency (EASA) identified key details they wish to see remedied before allowing the 737 MAX to return to service. Most of these details were previously known issues with the aircraft. Here is the list, as reported by Bloomberg, of issues Boeing needs to fix with the 737 MAX:

The potential difficulty pilots have in turning the jet’s manual trim wheel
The unreliability of the angle of attack sensors
Inadequate training procedures for pilots
Software issue regarding a lagging microprocessor (the FAA identified this issue recently)
Failure of the autopilot to disengage in certain emergencies...

... The FAA has been tight-lipped about all of this. Currently, the FAA faces multiple questions about their certification process that has diminished their credibility as a worldwide aviation safety regulator. Thus, the EASA is likely to wield significant influence for the rest of the world’s aviation agencies...



How in [whatever strange demented worlds] did that latest Boeing potential killer get through 'Certification' let alone design and test?...

What of the flight control systems on the other Boeing aircraft that have seen similar development?


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

How in [whatever strange demented worlds] did that latest Boeing potential killer get through 'Certification' let alone design and test?...
What of the flight control systems on the other Boeing aircraft that have seen similar development?

How indeed!
Development is a funny old beast.

The Space Launch System (SLS) is taller than a 30-storey building and will be able to launch payloads of up to 130 metric tonnes – the equivalent of 10 of London's New Routemaster buses.
“It is truly an immense rocket. It is just jaw-droppingly big,” says John Shannon, vice president and programme manager for the SLS at Boeing, which is building the rocket for Nasa.
The SLS re-uses technology developed for the space shuttle. But the new rocket is a completely different beast. The huge core stage is based on the external tanks that fed propellant to the shuttle’s main engines. Its two solid rocket boosters are also modified shuttle elements.
But this created challenges, because the SLS exerts very different levels of stress on components. “We took some of the hardware from the space shuttle and put it in that environment and it did not survive,” Shannon explains. “We had to go back and do significant re-designs in a number of instances.”
Developing it has cost about $12.5bn (£10bn), and a government oversight report released in June detailed cost overruns totalling $1.8bn.

The Boeing 737 was envisioned in 1964 & 1st flew in 1967. The shuttle was envisioned in 1972 & 1st flew in 1981.
So when the taxpayer is funding development, redesigns are acceptable but when it is Boeing's profits at risk, redesign goes to the bottom of the requirement list.

This bit o news explains why my session in the B737MNax simulator has been delayed a couple of times. I guess the EASA have grabbed all the simulator time going to do their testing and "joy rides" are #11 in a queue of 10...

This is a rather sad bit of news as it will further delay the B737Max's return to service as more "I" are dotted and more "T" crossed, and possibly (probably?) even more software is updated.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

... The Boeing 737 was envisioned in 1964 & 1st flew in 1967. The shuttle was envisioned in 1972 & 1st flew in 1981.
So when the taxpayer is funding development, redesigns are acceptable but when it is Boeing's profits at risk, redesign goes to the bottom of the requirement list.

Thanks for that good example...

All rather scary. Especially so if there is no oversight or peer review, or for when whatever oversight/review is deficient...


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

New Report Finds Boeing 737 MAX Autopilot Could Fail During Emergencies

... According to the European Union Aviation Safety Agency (EASA), in some emergencies the Boeing 737 MAX’s Autopilot may fail to disengage, preventing pilots from taking manual control of the aircraft...
Now The Boeing 737 MAX Has An Autopilot Problem

Since MCAS is part of the autopilot of course it has an autopilot problem. Bloomberg, cited by both your sources as their source does not disclose any detail at all about the problem. So it very well could be an issue with MCAS not disengaging, which we already know about. Such wild speculation without any detail serves only the purpose of selling advertising and putting tracking cookies on hard drives worldwide.

MCAS is NOT part of the autopilot, but is a system that can turn autopilot off.
(I suspect had MCAS been part of the autopilot system it would have been better managed and implemented)

(Edited to sort out mess made by using my phone to type on)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Thanks. I wasn't quite 18 months old when Sputnik launched & have seen many changes, both good & bad in the following six decades. Everything man made has an eventual EOL. Over those decades have seen that EOL be 30/40/50 years before being phased out. A classic example is our own Double Decker red bus, the Routemaster - 50 years (& missed).

With the good changes, its been noted that those changes were made due to learning from the past, & it is good to see that trend continue.

The computers are of a type built for Boeing’s 787 commercial airliner. But they have been toughened up for the rigours of space travel, where G-forces, vibration and radiation can damage delicate hardware. “That’s why we have four sets of flight computers, it’s not because we expect them to burn out through electrical failure. It’s to handle that deep space environment,” Chambers adds.
The computers aren’t the most up-to-date ones available. With space travel, tried-and-tested hardware is preferable to something that’s more innovative but less well-understood.

The same should apply to air travel considering there is a huge difference between a few astronauts & a plane full of paying passengers.

John Shannon believes things are now looking up. “We’ve been through the hard part: the qualification and design of the hardware,” he says. “We’re at a great point right now, the factory is humming, we’ve got our first vehicle, it will roll out of the door by the end of this year.”
Its maiden flight is expected to take place no earlier that June 2020.

Hmm, Mr Shannon, a Boeing VP is quite happy to spend taxpayer funds & time in getting a design & hardware qualified, shame Boeing cannot do the same for their own non-taxpayer funded products.
Personally, I hope that Boeing does not suffer any more mishaps as I would love to see Orion fly atop their SLS.

Quote source - To the Moon & beyond

Have I misunderstood all the reports about the MCAS system?
It's from my understanding it's an augmented system to help the pilot not to become in a stall situation.
Coupled to the Automated Flight Control https://www.faa.gov/regulations_policies/handbooks_manuals/aviation/advanced_avionics_handbook/media/aah_ch04.pdf
To me it seems there are now two systems that doesn't work together so well. MCAS and AFC.
Then bring in the third component, the pilot...
Perhaps it's about time to introduce airliners without pilots that doesn't read written instructions that are not distributed to them...

MCAS is NOT part of the autopilot, but is a system that can turn autopilot off.

European Union Aviation Safety Agency (EASA) may or may not agree.
Wiki: "An autopilot is a system used to control the trajectory of an aircraft without constant 'hands-on' control by a human operator being required."
A couple of translations between languages can have profound effects on meaning. I know Boeing doesn't consider it part.

(I suspect had MCAS been part of the autopilot system it would have been better managed and implemented)

I doubt it. Boeing is in the business of building Ford Pintos. It may just be that most of that code hasn't been touched in decades so the flaws have been reduced in number to manageable.

If this is a new flaw and not related to MCAS, is it in old code and perhaps on every 737 model made?

My question is how many different computers are there? Not different boxes on a functional diagram - that could easily be different threads on the same CPU, but actual physical CPU's. Part of this question is because these functional diagram blocks may just be a servo interface box - an A/D convertor if you will - plus a circuit breaker but the thinking is done centrally. I'm sure they do have A and B (Pilot - CoPilot).