NefMoto

Technical => Tuning => Topic started by: nyet on March 13, 2019, 04:11:52 PM



Title: This is why you don't bindly disable DTCs
Post by: nyet on March 13, 2019, 04:11:52 PM
Notice the HUGE discrepancy between the two AoA sensors (20+ degrees). Notice that MCAS is *still* forcing the nose down.

In ME7, this would be noticed by the monitor, which would throw an implausibility code. At that point, it would disable anything that would use that input, unless you are stupid enough to disable implausibility checks. Have fun running your airplane into the ground.

(https://static.seattletimes.com/wp-content/uploads/2018/11/LionAir-BlackBox-WEB-1020x680.jpg)


Title: Re: This is why you don't bindly disable DTCs
Post by: fknbrkn on March 13, 2019, 04:33:35 PM
Sometimes when i see some complex management systems like those in planes i think 'wow this guys really badass in coding' because i cant even imagine how much situations and conditions theyre calculated in ecu, how they tested all of these and how much safety monitors / limp modes / dtc conditions etc theyre implemented because its a people lives.  (yep im comparing it with 20yrs me7 too)

But thats a really bad news how easily a stupid code (is it italian magnetty marelly btw?) can be responsibly to our lives


Title: Re: This is why you don't bindly disable DTCs
Post by: dal on March 13, 2019, 05:19:20 PM
Thats really really sad.


Title: Re: This is why you don't bindly disable DTCs
Post by: Risky on March 13, 2019, 05:28:42 PM
Forgive my ignorance on the situation, but this whole incident was because someone disabled a "DTC"?

Edit: Some other people I know are saying the pilots are instructed to disable the sensor, so that way the computer doesn't get a false nose dive reading, if the sensor is faulty. Again forgive my ignorance.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 13, 2019, 05:37:38 PM
https://www.seattletimes.com/business/boeing-aerospace/black-box-data-reveals-lion-air-pilots-struggle-against-boeings-737-max-flight-control-system/

Quote
The data confirms that a sensor that measures the plane’s angle of attack, the angle between the wings and the air flow, was feeding a faulty reading to the flight computer. The two angle-of-attack sensors on either side of the jet’s nose differed by about 20 degrees in their measurements even during the ground taxi phase when the plane’s pitch was level. One of those readings was clearly completely wrong.

This should trigger an implausibility fault and MCAS should be disabled, and both inputs ignored. It should not be up to the pilot to disable MCAS.

Quote
On any given flight, the flight computer takes data from only one of the angle-of-attack (AOA) sensors, apparently for simplicity of design. In this case, the computer interpreted the AOA reading as much too high an angle, suggesting an imminent stall that required MCAS to kick in and save the airplane.

But apparently, no such fault was triggered, so it just randomly chose a sensor to use.

Yes, this is exactly what happens when a hack ME7 "pro tuner" decides to just disable a DTC.


Title: Re: This is why you don't bindly disable DTCs
Post by: Risky on March 13, 2019, 05:56:21 PM
Thanks for clearing that up. RIP to those 189 people that died on the flight.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 13, 2019, 10:24:58 PM
What I don't understand is which sensor is "wrong".

Right (green) clearly can't be right, it's showing negative alpha during climbout.

But if left (red) is right, then MCAS is properly triggering, since red is showing a much higher AoA.

The only reasonable answer is that neither reading is right. Right is reading too high, and left is reading too low. Really strange.

Unfortunately, the NTSB doesn't trust the average schmo with technical information, and you'll never see the mainstream media do any useful reporting on anything technical.

Pathetic, really.


Title: Re: This is why you don't bindly disable DTCs
Post by: 199X on March 13, 2019, 11:53:17 PM
Well that is just crazy that there was no plausibility checking between 1. The equivalent sensor on the other side of the plan 2. A known value or typical value before take-off.  I mean how could something like that not be in place?  It seems to be the most basic of tests.  It also shifts blame entirely towards Boeing and the Boeing engineering team.  They need to understand that their error has cost > 400 lives.


Title: Re: This is why you don't bindly disable DTCs
Post by: Blazius on March 14, 2019, 03:34:58 AM
Rest assured this plane is grounded by every single country lol.. also its one thing to fuck around with ur own car,hopefully in a place with no traffic , and its one thing to fuck up something that 150+ travel on hourly...

Boeing is amazing , they are doing some good stuff but this is unacceptable.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 09:06:40 AM
Rest assured this plane is grounded by every single country lol.. also its one thing to fuck around with ur own car,hopefully in a place with no traffic , and its one thing to fuck up something that 150+ travel on hourly...

Boeing is amazing , they are doing some good stuff but this is unacceptable.

Copy pasted from another discussion I have been participating in. This should terrify you (if true)

Quote
I asked what I think Nyet would ask - if there are two AoA sensors, but only one is being used for input, wtf is the other one there for and doing?


Response - It's doing jack shit. It's on hot standby, but unused until the pilot selects it for use during flight planning.


me - What? who chooses which sensor is the one that will used? At build, a computer, or it's actually chosen by the pilot?

Response - yes, the pilot and co-pilot during flight planning are agreeing on the settings and toggle positions for various things, and which sensor is toggled on that plane. Airbus uses an automated system that will choose one sensor for one leg, then swap to the other sensor on the next leg.

Me - But the max8 has no "argue sensor" right?

Response - correct. The airbus has a third sensor who's duty is to "argue" with the input of whatever AoA sensor is active to check it's validity.


Title: Re: This is why you don't bindly disable DTCs
Post by: Blazius on March 14, 2019, 09:10:53 AM
Copy pasted from another discussion I have been participating in. This should terrify you (if true)


Dang..thats fucked up, but apparently Lion Air wasnt the best at maintenance either to cut costs... I'll take my car on trips :D ( i know plane is one of the safest way to travel but whatever :D)


Title: Re: This is why you don't bindly disable DTCs
Post by: Risky on March 14, 2019, 12:10:33 PM
The data I heard was the plane was going 430 knots. That is a big no no and 180 knots (I think that's what he said) at takeoff is the max that ATC allows. More than that you're speeding and you get a "ticket." (lol) They had changed the the auto-trim routines on that plane because of the increased thrust of the new engines, and changed the anti-stall programs. So the 400+ airspeed makes me think that the anti-stall was fighting the auto-pitch/trim routines, and the one system nose down's the plane, and the anti-stall kicks into push full thrust, so I think that basically both were fighting and caused the plane to pitch down and at the same time demand full thrust, driving it into the ground, which is why you end up with a massive crater, rather than a skidmark.


That is some scary shit. Can you just imagine?


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 02:38:45 PM
That is some scary shit. Can you just imagine?

Pretty nuts.. btw Apologies for deleting that section from my post, but i did so because i dont see "430 knots" anywhere in the OP graph


Title: Re: This is why you don't bindly disable DTCs
Post by: Blazius on March 14, 2019, 02:59:38 PM
Pretty nuts.. btw Apologies for deleting that section from my post, but i did so because i dont see "430 knots" anywhere in the OP graph

it does, look at the end of graph ( when the plane crashes) it speed up by 200 knots or so.


Title: Re: This is why you don't bindly disable DTCs
Post by: littco on March 14, 2019, 03:11:53 PM
Pretty nuts.. btw Apologies for deleting that section from my post, but i did so because i dont see "430 knots" anywhere in the OP graph

Nyet, I am a pilot by profession and fly commercially, one thing that is not shown that graph is the throttle position ( speed is ). The whole reason Mcas was fitted to these new MAX aircraft was to over come the larger engines which where further forward and higher than the older NG ones, this meant with a change of power (not speed) setting the pitch moment was greater ( up or down ) and thus MCAS was fitted to correct this. Issue with these is that pilot training and conversion from the old aircraft to new ones was a 1 hour conversation including a supposed youtube video. With auto throttles, and the stage of flight they where, IE flap retractions and gear, the possibility for the MCAS to over correct is possible and then big changes in pitch to occur that the pilot due to lack of suitable training where not prepared for, leading to a war between a pilot that wants to 1 thing and a flight computer wanting to do the opposite. The planes wins and result is a non survivable pitch down. It is as much pilot lack of training, the system could of been turned off, as much as it is bad programming for allowing it, ie trip out. It could be the error was noted by the crew but the paper work allowed them to fly, The Mcas was seen , I believe as a flight enhancer rather than a safety critical item. Ie makes the crews life easier.

I agree with the AOA sensors, but generally the air date computer will take both sets of data and for the auto pilot use the sensor relating to the side which is flying, IE of the captain is flying on the left use the left hand AOA sensor, should this fail then the backup will be used, but typically a set limit of tolerance will be built in, ie 6degress then a fault flag will be given, this will be part of the whats called an MEL will give guidance to the pilots if they can fly with the error or not, and in some cases it will allow this.

I am no expert on this particular plane by any means but I know from experience until a problem happens it may have gone unnoticed for years and not been any issue. Computers are only as good as the people who program them or the people that use them.



Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 03:19:28 PM
Thanks, littco.

I think what really bothers me, though (from my history of staring at ME7L logs lol) is this:

What I don't understand is which sensor is "wrong".

Right (green) clearly can't be right, it's showing negative alpha during climbout.

But if left (red) is right, then MCAS is properly triggering, since red is showing a much higher AoA.

The only reasonable answer is that neither reading is right. Right is reading too high, and left is reading too low. Really strange.

Do you have any further thoughts on that?


Title: Re: This is why you don't bindly disable DTCs
Post by: Blazius on March 14, 2019, 03:26:27 PM
Thanks, littco.

I think what really bothers me, though (from my history of staring and ME7L logs lol) is this:

Do you have any further thoughts on that?

Wow a pilot on nefmoto , thats nice :)





One of those sensor is reading right, most likely the green one , when when on ground my guess  is that the nose is slightly downward ( -5 or so) [ or upward if the red one is right - but I dont think you will have 20 degress angle on even if the front is raised with the new added front landing gear ]

and the other one being offset by a constant value as it still follows the other one exactly just with a set difference.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 03:28:45 PM
But the green one is showing negative angle of attack on climb... is that even possible? Even with flaps extended?

AoA is angle of attack with incident airmass, not pitch attitude, so I'd expect them to be zeroed on the ground (unless there was some strange crosswinds or updraft/downdraft) with some spring assisted centering (they're physical vanes as far as i know)

and the other one being offset by a constant value as it still follows the other one exactly just with a set difference.

But not constant on log start and later leading up to takeoff...


Title: Re: This is why you don't bindly disable DTCs
Post by: Blazius on March 14, 2019, 03:35:11 PM
But the green one is showing negative angle of attack on climb... is that even possible? Even with flaps extended?

AoA is angle of attack with incident airmass, not pitch attitude, so I'd expect them to be zeroed on the ground (unless there was some strange crosswinds or updraft/downdraft) with some spring assisted centering (they're physical vanes as far as i know)

But not constant on log start and later leading up to takeoff...

idk, some fuckery going on , prolly maintenance or configuration issue. If these sensors have to be calibrated after every flight then maybe they didnt do it or something again, apparently Lion Air was cutting costs on maintenance.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 03:38:02 PM
Incidentally, a previous crew noticed the problem and logged it (IIRC). One or both sensors were serviced, i think the one on the left (i'd have to look it up)


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 03:56:41 PM
Interesting post on /. https://tech.slashdot.org/comments.pl?sid=13577684&cid=58274744

Quote
It has fuselage from the 737, Engines from the 787, flight controls from the A320 (the famous plane where the automation led to crashes. Now 737 Max has taken that mantle)

Boeing should have done a clean sheet design as a replacement of 737 instead of putting engines so big on an airframe meant for much smaller engine.

They created and unstable plane and tried to fix it in software.

While this is an approach often used in fighter jets which are deliberately made unstable so that they can change directions easily its not something you do on a civilian airplane. A civilian pilot does not have the reflexes of a fighter pilot to fix things if the computer is misbehaving

To recap the plane was too small for the engines they wanted to put on it. So they put the engines in a cantilevered position so now the center of thrust was significantly away from the centre of gravity and the plane had a tendency to pitch up and stall. To avoid this they added MCAS which would pitch the nose down in case of a stall detection. To detect the stall they used the AoA sensor and in a freshman Fault Tolerant Computing bug depended on only one sensor when they had 2. They made the warning light showing the AoA sensor is broken an option (only American signed up for this option which is probably why American hasnt had a crash). Then to make things worse they didnt tell the pilots. Also in the NG if the auto trim was runaway pulling back on the yoke would disengage the auto trim. With MCAS they changed this. The auto trim would only disengage for 10 seconds and then MCAS would add more trim and it would keep adding more and more trim till the pilots could not counter even if they pulled the yoke all the way back. Again a software bug. Further to make things worse THEY DID NOT TELL THE PILOTS ABOUT THIS CHANGE. So the yoke maneouver does not work so the only maneovour that works is disengaing the trim using the 2 cutoff switches but this only disengages the Auto trim. If the plane is already nose down it doesnt go back to normal trim. Now you have to pull back on the yoke which was not working till a moment ago or spin two manual trim wheels to get the trim back. All this is happening close to ground as MCAS only engages at low speeds found at takeoff.

Boeing could have avoided this in many ways

1) Build a clean sheet design which is stable with the larger engines
2) Failing that build a MCAS which is fault tolerant with multiple sensors or can be countermanded by the pilot by pulling back on the yoke (This is what they are doing now with the software fix). Not ideal for if the pilot is really flying badly now he can stall the plane
3) Failing that tell the pilots about the MCAS system, the change in the yoke behaviour and have them go through difference training.

They did not do 1 as it would cost too much money
They did not do 3 as they wanted to avoid airlines having to train pilots making the plane easier to sell. One of the reasons there are 5000 737 Max orders is that it needs no crosstraining to fly (officially)
They did not do 2 because of sheer laziness or stupidity in the engineering team

So the Engineering team is now fixing their error No 2. But the Exec team's error No 1 and the Marketing team's error no 3 are still not fixed.


Title: Re: This is why you don't bindly disable DTCs
Post by: littco on March 14, 2019, 04:02:49 PM
Thanks, littco.

I think what really bothers me, though (from my history of staring and ME7L logs lol) is this:

Do you have any further thoughts on that?
AOA is the the aircraft relative to the airflow, The AOA sensor is basically a wing on pivot , due to gravity they fall down when the aircraft is stationary as the speed increases they will start to lift, same putting you hand out a car window, until they are basically flat to the airflow. this would normally read on the AOA sensor as a small positive number. as you then pitch up on take off the AOA sensor will stay flat relative to the oncoming air but the reading will increase as the plane pivots around the airflow. Typically a pitch up of 20degrees could be seen with a AOA of maybe 4 degrees on the aircraft due to the flaps so 25-30 AOA could been seen. After this the AOA will vary due to speed, plane configuration, c of g etc its dynamic and always changing.

Looking I would say Green is correct. As the plane taxies the AOA sensor is hanging down as no airflow over it, as it accelerates as it takes of it rises into the airflow and increases AOA and then increases with pitch. The RED line not only starts at a high AOA while taxing but also then decreases as it rotates .

A simple error check would be, when aircraft is on the ground, squat switch is active and airspeed is less than 15knts then AOA sensor should read X, if not then error, or if left or right are more than say 5degrees different a warning light is activated. We have it on just about every other system. As far as im aware up until now certainly all the aircraft I have flown the AOA sensor is there as a guide and not needed other than a good airmanship guide. IE optimimal fuel burn or C of G . ITs not like a pitot or gryo which is a critical flight instrument .

Also I believe this is the 1st time Boeing has done the coding for it's aircrafts where before it was outsourced so maybe a lack of experience was to blame.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 04:06:37 PM
Looking I would say Green is correct. As the plane taxies the AOA sensor is hanging down as no airflow over it, as it accelerates as it takes of it rises into the airflow and increases AOA and then increases with pitch. The RED line not only starts at a high AOA while taxing but also then decreases as it rotates

Thank you! This is the last missing piece in my mind.

Quote
Also I believe this is the 1st time Boeing has done the coding for it's aircrafts where before it was outsourced so maybe a lack of experience was to blame.

YGTBFKM

That is... pathetic.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 14, 2019, 04:13:07 PM
As far as im aware up until now certainly all the aircraft I have flown the AOA sensor is there as a guide and not needed other than a good airmanship guide. IE optimimal fuel burn or C of G . ITs not like a pitot or gryo which is a critical flight instrument .

More than that, I think the critical point is that in this case it is also used as an INPUT to a system which can overcome pilot input, with absolutely no plausibility checking. That is truly insane. Literally criminal negligence.


Title: Re: This is why you don't bindly disable DTCs
Post by: littco on March 14, 2019, 04:17:14 PM
YGTBFKM

That is... pathetic.

Due to the monumental cockups with the 787 and it's outsourced avionics they brought it all in house.



Title: Re: This is why you don't bindly disable DTCs
Post by: littco on March 14, 2019, 04:24:54 PM
More than that, I think the critical point is that in this case it is also used as an INPUT to a system which can overcome pilot input, with absolutely no plausibility checking. That is truly insane. Literally criminal negligence.

To be fair the Airbus is like that, depending on the stage of flight, the envelope you are allowed to use, is controlled and if the computer doesn't like it , it will override your controls.

Being trained or experienced to recognise what is happening is nearly as important as actual flying. I think the negligence is in the lack of training or knowledge as I am sure now if any pilot where to experience the same thing they would automatically turn off the MCAS and I am sure that if neither had crashed AND Boeing had trained for this, nothing would have changed. It has a name, normalisation of deviation, ie making something wrong normal. Now though they will have to change it so it can never happen again.


Title: Re: This is why you don't bindly disable DTCs
Post by: vwaudiguy on March 15, 2019, 11:56:01 AM
Nyet, I am a pilot by profession and fly commercially, one thing that is not shown that graph is the throttle position ( speed is ). The whole reason Mcas was fitted to these new MAX aircraft was to over come the larger engines which where further forward and higher than the older NG ones, this meant with a change of power (not speed) setting the pitch moment was greater ( up or down ) and thus MCAS was fitted to correct this. Issue with these is that pilot training and conversion from the old aircraft to new ones was a 1 hour conversation including a supposed youtube video. With auto throttles, and the stage of flight they where, IE flap retractions and gear, the possibility for the MCAS to over correct is possible and then big changes in pitch to occur that the pilot due to lack of suitable training where not prepared for, leading to a war between a pilot that wants to 1 thing and a flight computer wanting to do the opposite. The planes wins and result is a non survivable pitch down. It is as much pilot lack of training, the system could of been turned off, as much as it is bad programming for allowing it, ie trip out. It could be the error was noted by the crew but the paper work allowed them to fly, The Mcas was seen , I believe as a flight enhancer rather than a safety critical item. Ie makes the crews life easier.

I agree with the AOA sensors, but generally the air date computer will take both sets of data and for the auto pilot use the sensor relating to the side which is flying, IE of the captain is flying on the left use the left hand AOA sensor, should this fail then the backup will be used, but typically a set limit of tolerance will be built in, ie 6degress then a fault flag will be given, this will be part of the whats called an MEL will give guidance to the pilots if they can fly with the error or not, and in some cases it will allow this.

I am no expert on this particular plane by any means but I know from experience until a problem happens it may have gone unnoticed for years and not been any issue. Computers are only as good as the people who program them or the people that use them.



Thanks for sharing your experience.


Title: Re: This is why you don't bindly disable DTCs
Post by: nyet on March 18, 2019, 12:46:51 PM
Great breakdown here
https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/


Title: Re: This is why you don't bindly disable DTCs
Post by: Risky on March 18, 2019, 02:48:23 PM
Quote from: Article
According to a detailed FAA briefing to legislators, Boeing will change the MCAS software to give the system input from both angle-of-attack sensors.

Input from both sensors should've been allowed from the start.





Title: Re: This is why you don't bindly disable DTCs
Post by: mysman on March 21, 2019, 08:02:35 AM
Apparently Boeing did incorporate plausibility checking but it was an optional "upgrade"... sigh.

https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html


Title: Re: This is why you don't bindly disable DTCs
Post by: Risky on March 21, 2019, 08:07:34 AM
Apparently Boeing did incorporate plausibility checking but it was an optional "upgrade"... sigh.

https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html


Seriously... WTF.


Title: Re: This is why you don't bindly disable DTCs
Post by: 316LV on March 21, 2019, 07:08:17 PM
Wow a pilot on nefmoto , thats nice :)

I'm sure there are a few of us on here.

Wish I had something to add to this, but I eschewed moving up to the heavy tin and stayed with piston twins doing specialized aerial work. No computers on those (too old, like 70s vintage), just direct cable connection to the control surfaces. If something goes wrong, it is the nut attached to the control column that is to blame. I can barely comprehend the complexity of a modern airliner which is another reason I took the path I did...