Message boards :
Politics :
Profits 1st, Safety 2nd? Pt 2
Message board moderation
Previous · 1 · 2 · 3 · 4 · 5 · 6 · 7 . . . 37 · Next
Author | Message |
---|---|
Richard Haselgrove Send message Joined: 4 Jul 99 Posts: 14679 Credit: 200,643,578 RAC: 874 |
So, what are the differences between the military MCAS, the civilian 767 MCAS, and the civilian 737 MCAS? And how come? Is that a deliberate post-hoc design change, or a lack of communication and common design standards between different teams within the same company? |
moomin Send message Joined: 21 Oct 17 Posts: 6204 Credit: 38,420 RAC: 0 |
|
Sirius B Send message Joined: 26 Dec 00 Posts: 24912 Credit: 3,081,182 RAC: 7 |
|
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
One of Mentour's gripes is the lack of access to funding for potential candidates, which coupled with an all-too-often poor selection process means that too many unsuitable people are getting into flight school, and thus the "gene pool" of potential pilots is not as strong as it should be. Now couple that with a world-wide shortage of pilots.... Bob Smith Member of Seti PIPPS (Pluto is a Planet Protest Society) Somewhere in the (un)known Universe? |
Sirius B Send message Joined: 26 Dec 00 Posts: 24912 Credit: 3,081,182 RAC: 7 |
...also occurring in the road & rail industry. :-( |
Gary Charpentier Send message Joined: 25 Dec 00 Posts: 31013 Credit: 53,134,872 RAC: 32 |
Ouch - I didn't realise until I read this that one of the things that may have prevented this crash was installed on B737NG, but not on B737MAX - an AoA disagree indicator.If media reports are correct, that was a software bug. The AoA readout wasn't standard equipment - extra cost item - but the AoA disagree was supposed to be standard equipment. When they wrote the code to enable/disable the AoA readout, they also by error killed the AoA disagree indicator. One has to ask, when they did the flight testing with the simulator did they always have it in all options installed mode? Might be more gremlins waiting to bring down some more planes. |
Sirius B Send message Joined: 26 Dec 00 Posts: 24912 Credit: 3,081,182 RAC: 7 |
Never experienced it on a CRT monitor but since switching to flat screens, experienced a black screen with a dialogue box floating across the screen stating "out of range" on numerous occasions. From the reports already read, wasn't it a case that on one incident one sensor gave wild readings while the second gave correct readings? So using the testing of MCAS v1.0, wouldn't it have been appropriate to have a range of min & max readings within the software? Had that been the case, then the correct readings would have been applicable from the second sensor. Then the argument of only operating from one sensor would not have been a problem, as the sensor providing the wild readings would have been ignored. Edited to prevent scrolling. |
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
I quoted directly from the Indonesian air accident agency report (JT610-PK-LQP-Final-Report) not a media report. How often do you have to be told -IT WAS A DESIGN DECISION BY BOEING. NOT A BUG. A DESIGN DECISION, WRONGLY INTERPRETED BY THE MEDIA, BUT STILL A DESIGN DECISION BY BOEING. To answer your question about how MCAS was certified I suggest you read the section in the report on how the B737MAX MCAS system was certified for flight. I would add one comment about the use of simulators (and to a lesser extent test flights). To an extent the simulator pilots know the script of events they are going to faced with. In flight tests there are two subtle differences, one is that every effort is made NOT to put the aircraft into an unrecoverable situation, and second there is always the weather to toss in an odd ball.... [edit to add] - It is ten pages of heavy reading, so make sure the coffee pot is on. Bob Smith Member of Seti PIPPS (Pluto is a Planet Protest Society) Somewhere in the (un)known Universe? |
Gary Charpentier Send message Joined: 25 Dec 00 Posts: 31013 Credit: 53,134,872 RAC: 32 |
I quoted directly from the Indonesian air accident agency report (JT610-PK-LQP-Final-Report) not a media report. Which may or may not have the complete story. I didn't bring a copy of the report to work to find it in there but I thought I read something about that: design decision - bug - feature as described by the marketing department, in the report. If the media reports are correct then the design decision was to include an AoA disagree indicator. The software did not. I call that a bug because that was not the intention of the designers. Perhaps implementation error is more indicative of the actual circumstance. Media reports indicate Boeing acknowledged that implementation error after Lion Air and was working on a push fix when Ethiopian went down. From a legal perspective, it would be informative to know if Boeing was aware of the issue before Lion Air. From a safety perspective, how could Boeing not been aware of it? Once found why did Boeing not quickly do a fault search to determine if that missing indicator could be a critical item? I'm sure if they found a supplier of a bolt shipped a bad batch they would immediately issue an AD. Why the difference with software? |
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
I suggest you read the reports raised by US pilots some months before the Lion Air crash, including those by BOEING test pilots before asking such naive questions. Various people have posted links to them in this thread, so there's no excuse for you - and you have commented on them. Bob Smith Member of Seti PIPPS (Pluto is a Planet Protest Society) Somewhere in the (un)known Universe? |
Gary Charpentier Send message Joined: 25 Dec 00 Posts: 31013 Credit: 53,134,872 RAC: 32 |
I suggest you read the reports raised by US pilots some months before the Lion Air crash, including those by BOEING test pilots before asking such naive questions. Various people have posted links to them in this thread, so there's no excuse for you - and you have commented on them. You read my question as not highly specific. It is. "Issue" is restricted to AoA disagree indicator not present. Nothing about MCAS being a POS. Or to put it, AoA disagree indication is not part of MCAS as far as I am aware, nor are the AoA display indicators which were not paid for on the subject aircraft hence not present. |
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
The event "AoA disagree" may not be part of the MCAS system as it was designed, and that is the root of the issue. Without the flight crew having an indication that there was an issue with one of the AoA they were in the dark about the fault that underlay all the symptoms they were seeing and hearing. One may ask "Why didn't Boeing fit the AoA conflict" indicator as standard"? There are two parts to the answer, firstly they had convinced themselves (at a high level) that it was not required on safety grounds. And second, as the title of this thread says "Profit over Safety", they could make more money selling this "un-nesseccary" indicator. Put yourself in the shoes of those purchasing a B737MAX for a moment: Salesman "Do you want this AoA disagree indicator, it's $$$$$ per aircaft?" Customer "What does it do"? Salesman "It indicates that the AoA sensors aren't giving the same data" Customer "Is it required for the safe operation of this aircraft?" Salesman "Our analysis shows it has nothing to do with flight safety" (I know I am simplifying the conversation, but that's the gist of the sort of thing that may have happened.) Bob Smith Member of Seti PIPPS (Pluto is a Planet Protest Society) Somewhere in the (un)known Universe? |
Gary Charpentier Send message Joined: 25 Dec 00 Posts: 31013 Credit: 53,134,872 RAC: 32 |
One may ask "Why didn't Boeing fit the AoA conflict" indicator as standard"? There are two parts to the answer, firstly they had convinced themselves (at a high level) that it was not required on safety grounds. And second, as the title of this thread says "Profit over Safety", they could make more money selling this "un-nesseccary" indicator. Nope. Was supposed to be standard feature. (Looks like a 3rd party made that decision for them.) Time to quote the report. "Synopsis: On 26 October 2018, the SPD (speed) and ALT (altimeter) flags on the Captain’s primary flight display first occurred on the flight from Tianjin, China to Manado, Indonesia. Following reoccurrence of these problems, the left angle of attack (AOA) sensor was replaced in Denpasar on 28 October 2018. The installed left AOA sensor had a 21° bias which was undetected during the installation test in Denpasar. The erroneous AOA resulted in different indications during the flight from Denpasar to Jakarta, including IAS (indicated airspeed) DISAGREE, ALT (altitude) DISAGREE, FEEL DIFF PRESS (feel differential pressure) light, activations of Maneuvering Characteristics Augmentation System (MCAS) and left control column stick shaker which were active throughout the flight. The flight crew was able to stop the repetitive MCAS activation by switched the stabilizer trim to cut out. After landed in Jakarta, the flight crew reported some malfunctions, but did not include the activation of stick shaker and STAB TRIM to CUT OUT. The AOA DISAGREE alert was not available on the aircraft therefore, the flight crew did not report it. The reported problem would only be able to rectify by performing tasks of AOA Disagree." These two paragraphs apply to the 737NG, not the Max "The AOA DISAGREE message was first implemented on the Boeing 737 NG fleet in 2006 in response to customer requests. Since 2006, the AOA DISAGREE alert has been installed on all newly manufactured Boeing 737 NG aircraft, and is available as a retrofit for older aircraft. The AOA DISAGREE alert has not been considered as a safety feature by Boeing, and is not necessary to safely operate the aircraft. Airspeed, attitude, altitude, vertical speed, heading and engine thrust settings are the primary parameters the flight crews use to safely operate the aircraft in normal flight. Stick shaker and the pitch limit indicator are the primary features used for the operation of the aircraft at elevated angles of attack. The AOA DISAGREE alert provides supplemental information only. The AOA DISAGREE non-normal procedure alerts pilots to the possibility of airspeed and altitude errors, and of the IAS DISAGREE and ALT DISAGREE alerts occurring; but the non-normal procedure does not include any flight crew action in response to the AOA DISAGREE alert." "The requirements for the AOA DISAGREE alert were carried over from the Boeing 737 NG to the Boeing 737-8 (MAX). In 2017, however, within several months after beginning Boeing 737- 8 (MAX) deliveries, Boeing identified that the Boeing 737-8 (MAX) display system software did not correctly implement the AOA DISAGREE alert requirements. As with the Boeing 737 NG, the Boeing display system requirements for the Boeing 737-8 (MAX) called for the activation of the AOA DISAGREE alert as a standard feature on all aircraft. The software delivered to Boeing, however, linked the AOA DISAGREE alert to the AOA position indicator, which is an optional feature on the Boeing 737 (MAX) series. Accordingly, the software activated the AOA DISAGREE alert only if an airline opted for the AOA indicator." "When the discrepancy between the AOA display requirements and the software was identified, Boeing determined that the absence of the AOA DISAGREE alert did not adversely impact aircraft safety or operation. Accordingly, Boeing concluded that the existing functionality was acceptable until the originally intended functionality could be implemented in a display system software upgrade, scheduled for the third quarter of 2020. Following the Lion Air accident, Boeing convened a Safety Review Board (SRB) to reconsider whether the absence of the AOA DISAGREE alert from certain Boeing 737-8 (MAX) flight displays presented a safety issue. That SRB confirmed Boeing’s prior conclusion that it did not. Boeing also elected to accelerate the software change. Boeing advised that new software implementing the AOA DISAGREE alert will be available before the Boeing 737-8 (MAX) aircraft return to service." 1.6.6.5 & 1.6.6.6 go into detail on steps to fix. However it seems as if both of them ASSUME there is a AoA Disagree alert available. Obviously there was not. If the service requires performing an AoA disagree checklist, but there is no possibility of an AoA disagree indication ... 1.17.7.9 Pretty bad practice to clean up the testing so it isn't real world when you are determining workload and hazard assessment. 1.18.1 Is a read of interest and shows just what normal is at Lion Air. "2.2 The certified design of Boeing 737-8 (MAX) was to include an AOA DISAGREE message on all aircraft. The software which generates the AOA DISAGREE message was subcontracted by Boeing another company. The installed software did not include the AOA DISAGREE message for aircraft that was not installed with the AOA indicator. The Lion Air elected not to enable the AOA indicators on the PFDs and such the AOA DISAGREE message would not appear on both PFDs even though the DFDR recorded AOA value difference of about 21°. The lack of an AOA DISAGREE message did not match the Boeing system description that was the basis for certifying the aircraft design. The software not having the intended functionality was not detected by Boeing nor the FAA during development and certification of the 737-8 MAX before the aircraft had entered service. Soon after, Boeing reviewed the situation and concluded that the inoperative AOA DISAGREE message on selected aircraft did not represent a safety of flight issue. One consideration was that additional maintenance alerts (e.g. stuck AOA or bent AOA) were still available. As a result, the implementation error was scheduled to be corrected for the next display system software update." "2.3.3 Flight crews trained on previous versions of the B737 aircraft would have been aware of the AOA DISAGREE message on the PFD, should such a condition arise. However, because the AOA DISAGREE message was not available on B737-8 (MAX) aircraft not fitted with the optional AOA indicator, flight crews would not be aware that this message would not appear if the AOA DISAGREE conditions were met. This would contribute to flight crew being denied valid information about abnormal conditions being faced and lead to a significant reduction in situational awareness by the flight crew." Conclusion 63, 64 & 73 Finding 5. Looks very much like the people writing the manuals for the flight crew didn't think an AoA disagree was a big thing, but the people writing the manuals for servicing did and were never asked if the absence of the AoA disagree would cause problems in finding and fixing problems. Damn unfortunate it wasn't there because if it had been 99.9% that plane would not have taken off the second time with the failed AoA sensor. Still doesn't excuse the original mechanic who obviously did not preform the post install check. |
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
Boeing "did not see" that the certified design and the flown design were different - that really stinks. It indicts that the culture at Boeing was not sufficiently robust to detect that a system was not functioning as it was initially designed. As the organisation for the integration of the whole FCC system they were RESPONSIBLE for its correct function. If a third party didn't deliver correctly functioning software, and Boeing didn't detect it not complying with the requirements placed on them the responsibility for allowing that whole system to carry on along the track to delivery lies with Boeing. And the FAA, acting as "gate keeper", failing to notice this error are also culpable - it was their job to make sure the every "i" and "t" had its correct dots and crosses in place. In short, Boeing made a mess, and the FAA didn't spot that Boeing made a mess - neither comes out of this covered in roses. Bob Smith Member of Seti PIPPS (Pluto is a Planet Protest Society) Somewhere in the (un)known Universe? |
Gary Charpentier Send message Joined: 25 Dec 00 Posts: 31013 Credit: 53,134,872 RAC: 32 |
Boeing "did not see" that the certified design and the flown design were different - that really stinks.And just how did this come to be? Did Boeing rely on a signature from the third party that they tested it and it operates as per the specifications? You do allow the manufacturer of a bolt or an AoA sensor to tell you it meets specifications. I'm sure at some point a test suite will be pulled out of files and a check for the AoA Disagree indicator will not be there. Who wrote the test suite? Who certified it tested all aspects of the software? Why was a test for it overlooked? What would be damning is to find it was tested and the result of fail was recorded but the software flew anyway. It indicts that the culture at Boeing was not sufficiently robust to detect that a system was not functioning as it was initially designed.Can't say that yet. First you have to know if Boeing even tested it at all, or if that was the job of an outside company. At some level everything operates on trust that others do their job. This is where the failure is. Placing trust in the untrustworthy. At some level "to err is human." As the organisation for the integration of the whole FCC system they were RESPONSIBLE for its correct function. If a third party didn't deliver correctly functioning software, and Boeing didn't detect it not complying with the requirements placed on them the responsibility for allowing that whole system to carry on along the track to delivery lies with Boeing.Yes, but that is no no help in making sure it doesn't happen again. Who, When, What, Where, Why and How must be answered. And the FAA, acting as "gate keeper", failing to notice this error are also culpable - it was their job to make sure the every "i" and "t" had its correct dots and crosses in place.FAA does not have this job. Deregulation push from GOP. Same as at banks, stock brokers, chemical plants -- they have decided it is not the job of the Government to protect you from stupid or greed. In short, Boeing made a mess, and the FAA didn't spot that Boeing made a mess - neither comes out of this covered in roses. |
W-K 666 Send message Joined: 18 May 99 Posts: 19402 Credit: 40,757,560 RAC: 67 |
New read at BBC, https://www.bbc.co.uk/news/extra/sd9LGK2S9m/battle_over_blame. I haven't read it yet, just got in. (it is Tuesday, isn't it?) edit] Boeing CEO at Senate today. edit2] https://www.washingtonpost.com/business/2019/10/28/our-daughter-died-vain-what-boeing-learns-plane-crashes/ |
Sirius B Send message Joined: 26 Dec 00 Posts: 24912 Credit: 3,081,182 RAC: 7 |
A wristwatch frozen at 6:56 honors the moment when Japan Airlines Flight 123 crashed into a mountain in 1985, a deadly crash that led to improved repair protocols across the industry.Hmm... |
rob smith Send message Joined: 7 Mar 03 Posts: 22535 Credit: 416,307,556 RAC: 380 |
You are totally incapable of understanding "corporate responsibility". Where a company purchases goods or services, then sells them on as a part of their product that "commissioning company" is RESPONSIBLE in ensuring that the entire product meets its requirements, and failure to do so rest primarily with the commissioning company - they may subsequently proportion some of the liability down to the organisation they procured those goods or service from. But the commissioning company remains the responsible party for the whole system. When Boeing integrated that software into its host system, and SHOULD have performed test to ensure that everything worked - its called "regression testing". It wouldn't be the first time that a "certified" new bit of software caused an existing system to not function correctly when the two are integrated together. In past lives I have seen new functions that were "OK" trip over themselves when brought into an existing system, with effects similar to those described (or inferred) in the report. I've been on both sides of the fence, but, thankfully PROPER integration of the new into the existing has trapped the issues before they got "out into the wild". Sorry, but the FAA have the job of ensuring that the aircraft is certified, and certified correctly, and that includes whatever checks it takes to make sure that all procedures are adequate for the job, and are correctly followed (note the sequence - get that wrong and it is more likely that bad things will happen). The fact that they have/had a "nice cozy" agreement with Boeing (or any other company for that matter) is verging on corruption, which I really hope is not the case. |
W-K 666 Send message Joined: 18 May 99 Posts: 19402 Credit: 40,757,560 RAC: 67 |
Boeing meeting in the House today - live updates available at https://www.nytimes.com/2019/10/30/business/boeing-muilenburg-testimony-congress.html?action=click&module=Latest&pgtype=Homepage. Some things that have been admitted. This new document is crucial. Shows at least one Boeing employee was worried that MCAS was vulnerable to a single point of failure, TWO years before the Max was cleared to fly. The first document showed that Boeing employees considered putting an alert for an MCAS failure in the cockpit, but that the feature never appeared on the plane. John Hamilton, a vice president at the company, said that the light would only indicate when MCAS wasn’t triggering when it was supposed to activate. |
Sirius B Send message Joined: 26 Dec 00 Posts: 24912 Credit: 3,081,182 RAC: 7 |
“Frankly right now all my internal warning bells are going off,†the employee wrote.Says it all. |
©2024 University of California
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.