Forse mi sbaglio ma non la Cina non ha un accordo con Airbus per assemblare A320 (in Cina ovviamente
)?
737 MAX 8 Ethiopian si schianta subito dopo il decollo da Addis Abeba
- Autore Discussione carter72
- Data d'inizio
Forse mi sbaglio ma non la Cina non ha un accordo con Airbus per assemblare A320 (in Cina ovviamente
)?
emergenza per un max 8 in Florida (senza PAX)
https://www.repubblica.it/esteri/20...ida-222579766/?ref=RHPPLF-BH-I0-C8-P1-S1.8-T1
https://www.repubblica.it/esteri/20...ida-222579766/?ref=RHPPLF-BH-I0-C8-P1-S1.8-T1
Secondo il tracciato di Flightradar24 però non ha mai superato i 2.094 ft e già a 2 minuti dal decollo avevano iniziato a ridiscendere, non 10 minuti. In 17 min erano di nuovo a terra.
Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet
https://www.seattletimes.com/busine...has-baffled-even-those-who-worked-on-the-jet/
Boeing has long embraced the power of redundancy to protect its jets and their passengers from a range of potential disruptions, from electrical faults to lightning strikes.
The company typically uses two or even three separate components as fail-safes for crucial tasks to reduce the possibility of a disastrous failure. Its most advanced planes, for instance, have three flight computers that function independently, with each computer containing three different processors manufactured by different companies.
So even some of the people who have worked on Boeing’s new 737 MAX airplane were baffled to learn that the company had designed an automated safety system that abandoned the principles of component redundancy, ultimately entrusting the automated decision-making to just one sensor — a type of sensor that was known to fail. Boeing’s rival, Airbus, has typically depended on three such sensors.
“A single point of failure is an absolute no-no,” said one former Boeing engineer who worked on the MAX, who requested anonymity to speak frankly about the program in an interview with The Seattle Times. “That is just a huge system engineering oversight. To just have missed it, I can’t imagine how.”
Boeing’s design made the flight crew the fail-safe backup to the safety system known as the Maneuvering Characteristics Augmentation System, or MCAS.
The Times has interviewed eight people in recent days who were involved in developing the MAX, which remains grounded around the globe in the wake of two crashes that killed a total of 346 people.
A faulty reading from an angle-of-attack sensor (AOA) — used to assess whether the plane is angled up so much that it is at risk of stalling — is now suspected in the October crash of a 737 MAX in Indonesia, with data suggesting that MCAS pushed the aircraft’s nose toward Earth to avoid a stall that wasn’t happening. Investigators have said another crash in Ethiopia this month has parallels to the first.
Boeing has been working to rejigger its MAX software in recent months, and that includes a plan to have MCAS consider input from both of the plane’s angle-of-attack sensors, according to officials familiar with the new design.
“Our proposed software update incorporates additional limits and safeguards to the system and reduces crew workload,” Boeing said in a statement.
But one problem with two-point redundancies is that if one sensor goes haywire, the plane may not be able to automatically determine which of the two readings is correct, so Boeing has indicated that the MCAS safety system will not function when the sensors record substantial disagreement.
Some observers, including the former Boeing engineer, think the safest option would be for Boeing to have a third sensor to help ferret out an erroneous reading, much like the three-sensor systems on the airplanes at rival Airbus. Adding that option, however, could require a physical retrofit of the MAX.
Andrew Kornecki, a former professor at Embry-Riddle Aeronautical University who has studied redundancy systems in Airbus and Boeing planes, said operating the automated system with one or two sensors would be fine if all the pilots were sufficiently trained in how to assess and handle the plane in the event of a problem. But, he said, if he were designing the system from scratch, he would emphasize the training while also building the plane with three sensors.
“As they say: belt and suspenders,” Kornecki said.
Prosegue sul sito
https://www.seattletimes.com/busine...has-baffled-even-those-who-worked-on-the-jet/
https://www.seattletimes.com/busine...has-baffled-even-those-who-worked-on-the-jet/
Boeing has long embraced the power of redundancy to protect its jets and their passengers from a range of potential disruptions, from electrical faults to lightning strikes.
The company typically uses two or even three separate components as fail-safes for crucial tasks to reduce the possibility of a disastrous failure. Its most advanced planes, for instance, have three flight computers that function independently, with each computer containing three different processors manufactured by different companies.
So even some of the people who have worked on Boeing’s new 737 MAX airplane were baffled to learn that the company had designed an automated safety system that abandoned the principles of component redundancy, ultimately entrusting the automated decision-making to just one sensor — a type of sensor that was known to fail. Boeing’s rival, Airbus, has typically depended on three such sensors.
“A single point of failure is an absolute no-no,” said one former Boeing engineer who worked on the MAX, who requested anonymity to speak frankly about the program in an interview with The Seattle Times. “That is just a huge system engineering oversight. To just have missed it, I can’t imagine how.”
Boeing’s design made the flight crew the fail-safe backup to the safety system known as the Maneuvering Characteristics Augmentation System, or MCAS.
The Times has interviewed eight people in recent days who were involved in developing the MAX, which remains grounded around the globe in the wake of two crashes that killed a total of 346 people.
A faulty reading from an angle-of-attack sensor (AOA) — used to assess whether the plane is angled up so much that it is at risk of stalling — is now suspected in the October crash of a 737 MAX in Indonesia, with data suggesting that MCAS pushed the aircraft’s nose toward Earth to avoid a stall that wasn’t happening. Investigators have said another crash in Ethiopia this month has parallels to the first.
Boeing has been working to rejigger its MAX software in recent months, and that includes a plan to have MCAS consider input from both of the plane’s angle-of-attack sensors, according to officials familiar with the new design.
“Our proposed software update incorporates additional limits and safeguards to the system and reduces crew workload,” Boeing said in a statement.
But one problem with two-point redundancies is that if one sensor goes haywire, the plane may not be able to automatically determine which of the two readings is correct, so Boeing has indicated that the MCAS safety system will not function when the sensors record substantial disagreement.
Some observers, including the former Boeing engineer, think the safest option would be for Boeing to have a third sensor to help ferret out an erroneous reading, much like the three-sensor systems on the airplanes at rival Airbus. Adding that option, however, could require a physical retrofit of the MAX.
Andrew Kornecki, a former professor at Embry-Riddle Aeronautical University who has studied redundancy systems in Airbus and Boeing planes, said operating the automated system with one or two sensors would be fine if all the pilots were sufficiently trained in how to assess and handle the plane in the event of a problem. But, he said, if he were designing the system from scratch, he would emphasize the training while also building the plane with three sensors.
“As they say: belt and suspenders,” Kornecki said.
Prosegue sul sito
https://www.seattletimes.com/busine...has-baffled-even-those-who-worked-on-the-jet/
Ultima modifica:
Boeing has disclosed details of a software update to its 737 Max that the company says eliminates the chance erroneous data can cause onboard computers to place the aircraft into a dive.
The company has already developed the software and tested it inflight, and is now working to achieve certification of the changes from federal authorities, Boeing officials say in Renton on 27 March.
"This combination of things will eliminate the chance of erroneous data ever causing MCAS activation," says a Boeing official who declined to be identified.
The manoeuvring characteristics augmentation system (MCAS) played a role in at least one of two recent 737 Max 8 crashes — incidents that have shown similarities and that prompted a global 737 Max grounding.
Company officials frame the MCAS modifications as improvements to an already safe system, saying the updates do not represent any concession by Boeing that the 737 Max was unsafe to begin with.
Boeing has put the upgraded MCAS system "through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration representatives on board as observers", the company says.
Boeing declines to speculate a timeline by which the changes might be certified, which would allow the grounding to be lifted.
Company officials described three notable MCAS tweaks.
First, the upgraded MCAS operates based on data from both of the 737 Max's two angle-of-attack (AOA) sensors. It will collect data from both sensors all the time, and compare inputs from both, Boeing says.
"If those inputs vary by more than 5.5°, the system will inhibit MCAS and the entire speed trim function for the remainder of the flight," a Boeing official says. "That first level of protection… will keep MCAS from ever firing in the case of a single angle-of-attack" error, he adds
The current system relies on only one sensor at a time, though it alternates between the left- and right-side sensors.
Second, the upgrade will allow MCAS to activate – meaning to drop the aircraft's nose – only once for each time it registers an unusually high angle of attack, Boeing says.
The system will then reset and will engage again only if the aircraft enters another "elevated angle of attack situation", the official says.
"However, if for some reason an angle-of-attack vain gets stuck in a high position, the system will detect the inconsistency between the two inputs and it would not operate a second time," adds the official. "There are no known or envisioned failure conditions where MCAS would provide multiple inputs."
Finally, the company has tweaked MCAS so that it cannot command nose-down stabiliser movement to a degree to which a pilot pulling back on the control column cannot overcome, the company says.
"The control column will always be able to override MCAS input with sufficient manoeuvring ability that the aircraft can still climb," the official says.
Boeing has also updated computer-based "differences" training for pilots transferring from flying the 737NG to the 737 Max.
The course, though not yet approved, "is designed to provide 737-type-rated pilots with an enhanced understanding of the 737 Max speed trim system, including the MCAS function, associated existing crew procedures and related software changes", Boeing says.
The MCAS updates follow the October 2018 crash of a Lion Air737 Max and the March crash of an Ethiopian Airlines aircraft of the same type. The pilots of the Lion Air crash fought against MCAS, which repeatedly pushed the aircraft's nose down, possibly due to erroneous angle-of-attack data, according to investigators.
Boeing has insisted pilots can disable MCAS by following existing cockpit procedures.
https://www.flightglobal.com/news/a...-737-max-software-changes-as-groundin-456952/
Ora, va bene che col senno di poi siamo tutti scienziati, ma non mi paiono soluzioni alle quali non si poteva, e doveva, pensare prima.
United meets with Boeing on 737 MAX
United and other carriers met on Wednesday with representatives of Boeing in Renton, Washington, to review Boeing’s presentation on the updated 737 MAX software.
Nothing is more important to the men and women of United than the safety of our customers and employees. After reviewing Boeing’s presentation, we are optimistic that the updates address the reported concerns about the maneuvering characteristics augmentation system (MCAS). But, the U.S. commercial aviation system is the safest in the world because its foundation is built on rigorous data analysis and evidence-based independent oversight, and we look to the FAA to employ these tools as it reviews and certifies this software update. As always, we stand ready to support and cooperate with that process.
We remain confident that United pilots are properly trained to safely fly the MAX aircraft in our fleet. Moving forward, we’ll continue to work closely with investigators, regulatory authorities and Boeing as they gather information and use it to ensure our highest priority: the safety of our customers and employees.
United and other carriers met on Wednesday with representatives of Boeing in Renton, Washington, to review Boeing’s presentation on the updated 737 MAX software.
Nothing is more important to the men and women of United than the safety of our customers and employees. After reviewing Boeing’s presentation, we are optimistic that the updates address the reported concerns about the maneuvering characteristics augmentation system (MCAS). But, the U.S. commercial aviation system is the safest in the world because its foundation is built on rigorous data analysis and evidence-based independent oversight, and we look to the FAA to employ these tools as it reviews and certifies this software update. As always, we stand ready to support and cooperate with that process.
We remain confident that United pilots are properly trained to safely fly the MAX aircraft in our fleet. Moving forward, we’ll continue to work closely with investigators, regulatory authorities and Boeing as they gather information and use it to ensure our highest priority: the safety of our customers and employees.
Hai indovinato col senno di poi e con gli scienziati, mi pare un po' troppo facile commentare ora in questo modo.
In queste settimane tutti hanno straparlato della scelta avventata di affidarsi a un solo sensore AoA e già da questo comunicato si capisce che sono state considerazioni mal riposte per la maggior parte.
Ultima modifica:
Scusa ma non ti capisco, il comunicato dice che col nuovo software l’MCAS passerà alla lettura comparata dei 2 sensori AOA, quindi a mio modo di vedere le critiche alla lettura a singolo sensore erano assolutamente BEN riposte
Il testo parla al presente per lo stato delle cose e al futuro per la modifica. Quindi da:
Io capisco che il sistema aggiornato userà sempre (all the time) entrambi gli input confrontando gli scarti.
Il sistema attuale (current) usa un sensore per volta alternandoli (e la logica secondo cui lo fa non è spiegata qui, quindi voli pindarici non possiamo farne).
si esatto, ma anche se non spiegano è facile immaginare che se i 2 sensori danno valori diversi è impossibile capire quale dei due sia in errore (e infatti Airbus usa un sistema con 3 AOA). L'unica cosa sensata era segnalare la cosa con un allarme e disattivare l'MCAS (cosa che infatti faranno adesso).
Affidarsi alla lettura di un solo sensore (seppure alternandoli) non mi sembra sia stata una grande idea...
E' verissimo che col senno di poi siamo tutti scienziati, però è anche vero che esistono delle cose terra a terra...se sul mio triciclo ho due freni, se se ne guasta uno col secondo riuscirò comunque a fermarmi o perlomeno a rallentare...
Infatti chi lavora nel campo della manutenzione aeronautica sa perchè te lo dicono ad ogni corso Type rating da inserire nell' AML che gli aerei sono progettati secondo dei criteri: Fail Safe, Damage Tollerance o Safe Life, su questo sistema di protezione all' inviluppo di volo, non mi sembra sia stata applicata nessuno di questi criteri di progettazione.
Inviato dal mio SM-G935F utilizzando Tapatalk
Non so di cosa ti occupi, io coi sistemi di voto ho un pochino di dimestichezza e pensare che "3 meglio di 2" tout court è un po' semplicistico (FR447 aveva 3 pitot (CPT, SBY, FO) eppure è caduto, perchè non 5 invece di 3 a 'sto punto?), a maggior ragione senza avere idea di come sono stati utilizzati i due attuali. Ogni giorno escono aggiornamenti delle macchine e nessuno poi scrive sui forum "non ci voleva Einstein" o "cose terra terra".
Con questo non voglio passare per strenuo difensore di Boeing, tanto mi sembra che ormai sia tutto deciso. Per fortuna oltre a noi che chiacchieriamo al baretto ci sono professionisti che prendono le cose sul serio.
Salve
Non conosco quasi niente di aereonatica e dintorni, spero quindi di non scrivere un'inesatttezza enorme.
In vari punti della discussione si diceva che Boeing (per non confondere con troppe informazioni i piloti) non aveva reso palese la presenza del MCAS (es post 633/pag 26) e poi Boing afferma che "The pilots of the Lion Air crash fought against MCAS, which repeatedly pushed the aircraft's nose down, possibly due to erroneous angle-of-attack data, according to investigators. Boeing has insisted pilots can disable MCAS by following existing cockpit procedures." (post 725/pag 29)
Scusate, ma qui mi perdo. Per non distrarmi il pilota sorvoli sulla presenza di qualcosa e poi affermi che il pilota può disattivarlo se segue le procedure ? Disattiva qualcosa di cui ignora la presenza ?
Non conosco quasi niente di aereonatica e dintorni, spero quindi di non scrivere un'inesatttezza enorme.
In vari punti della discussione si diceva che Boeing (per non confondere con troppe informazioni i piloti) non aveva reso palese la presenza del MCAS (es post 633/pag 26) e poi Boing afferma che "The pilots of the Lion Air crash fought against MCAS, which repeatedly pushed the aircraft's nose down, possibly due to erroneous angle-of-attack data, according to investigators. Boeing has insisted pilots can disable MCAS by following existing cockpit procedures." (post 725/pag 29)
Scusate, ma qui mi perdo. Per non distrarmi il pilota sorvoli sulla presenza di qualcosa e poi affermi che il pilota può disattivarlo se segue le procedure ? Disattiva qualcosa di cui ignora la presenza ?
La seconda parte "Finally, the company has tweaked MCAS so that it cannot command nose-down stabiliser movement to a degree to which a pilot pulling back on the control column cannot overcome, the company says." a me pare quella più interessante e che per gli amanti del gossip apre scenari da prima pagina. Si riferisce abbastanza chiaramente ai problemi di autorità affiorati altrove e che si verificano anche quando il pilota abbia capito cosa deve fare (tirare) senza aver disattivato il trim autonomo. Rispetto a quanto già discusso la corsa dello stabilizzatore arriverebbe a 4° contro una deflessione massima che non ricordo, ma inferiore a 1°, che era stata dichiarata e precedentemente certificata. Ora pare che sia stato limitato il viaggio dello stabilizzatore, immagino per tornare nei parametri indicati in precedenza oppure in quelli nuovi che stanno certificando. Per la prima volta vedo qualcosa che mi puzza, quantomeno servirà chiarezza sui valori certificati e quelli effettivi.
Sulla prima ripeto che, non sapendo come funzionava prima, è difficile fare grandi ragionamenti.
“3 è meglio di 2” semplicente perché il terzo elemento è quello discriminante
Peraltro le probabilità che 3 tubi di Pitot si blocchino per lo stesso problema (ghiaccio) sono basse ma tutt’altro che nulle, mentre quelle che due AOA si blocchino sullo stesso valore di lettura sono veramente tendenti a zero (e con tre AOA siamo veramente nel campo dell’impossibile..più facile andare al casinò e azzeccare lo stesso numero contemporaneamente su tre roulette differenti)
Per come è stato pensato e realizzato, usa un solo sensore durante il volo, nel volo successivo utilizza l'altro sensore.
Avevo definito questa cosa mancanza di ridondanza, oltre ad essere una cosa stupida in quanto di sensori ne hai due sempre e semplicemente, come in molti altri impianti, come cioè da prassi, li utilizzi entrambi sempre. Avere due "sorgenti" implica il non poter discriminare quale sia errata in caso di discordanza, e come da prassi aeronautica in questo caso impedisci al sistema collegato a queste informazioni di compiere una qualsiasi azione ma semplicementi tramite avviso (spia luminosa, scritta su display ecc..) rendi partecipe della cosa chi sta pilotando e nel caso prevedi una procedura da applicare. Avere due sensori però rende il sistema ridondante in quanto è in grado di rilevare che sicuramente uno dei due sensori non è attendibile, e se così fosse stato semplicemente il MCAS non sarebbe intervenuto a sproposito, costringendo il pilota a fare braccio di ferro contro una macchina...
Nel caso dell'FR447 è stata determinante l'inesperienza di chi aveva i comandi in mano in quel momento perché, a differenza dei problemi con l'MCAS, l'aereo non si era messo a contrastare le azioni impartite manualmente. Per paradosso, un sistema come quello Boeing in quella situazione avrebbe salvato l'aereo inpedendogli di andare in stallo.
Inviato dal mio LG-H870 utilizzando Tapatalk