Teardown of an angle of attack sensor from a Hercules aircraft. Redux of the Boeing 737 with a discussion on how Boeing Engineers, the FAA and Air Lines are complicit in the catastrophes.
I work in Nuclear. Some of our suppliers build for nuclear and aerospace. They say the difference is that you lift the aerospace version in your hand and need a forklift for the nuclear version. Both of them need an extra forklift for the associated documentation.
I had a customer involved with nuclear power stations. In the DO one day I just said “what happens if?” Apparently my “what happens if” cost about £4,000,000 and a two month design change to sort.
I work in light rail. Our trains have a max speed of 50mph with an operator in the seat and a big, red STOP button to press. The automated control systems we use all have double redundancy with CPU-CPU crosschecks of every computation. It's essentially 2 computers sharing their data every 20 milliseconds and if there's a miscomparison, the system seamlessly switches to ANOTHER SET OF COMPUTERS waiting on hot-standby to take over train control. The main control computer has TRIPLE REDUNDANCY as the entire system depends on it. These are trains. THEY CAN JUST STOP. It is incomprehensible to me that an airplane would only use data from one sensor (even though 2 are installed) and erroneous readings from the ONE SENSOR send the plane crashing into the ground. There should have been at least 3, the computer should be monitoring and averaging all 3 readings, there should be a threshold of variation for any one sensor that would cause the computer to ignore that sensor and SEND A SPECIFIC WARNING TO THE PILOT. I try to play devil's advocate with these scenarios but Boeing really screwed the pooch here. They know better than this.
hot-standby would have to be running and in the signal-loop to take primary control ♦ What i read of the approved fix places sanity checks though it is incomprehensible to me anyway since the item defeats simple basic plain feel via controls thus is not only not needed but removes one avenue of feedback to pilot what the plane is actually doing
I was using our positive train control system as an example of properly executed redundant electronics. The backup computers receive identical information to the primaries and mimic their outputs but are isolated from the trackside equipment by switchover relays. In an airplane the ability to isolate a faulty sensor seems like an obvious feature, coupled with concise indication to the pilot. But the simplest fix to me would be to simply program MCAS to disengage based on input from the control yoke. Say, 50% or more input back or forward on the yoke disabling MCAS with an accompanying indication would have prevented all of this.
@@brianp6965 The problem with disabling the MCAS is that these pilots were never trained to handle the irregular pitch vector when the plain is under full throttle. They're used to the flight characteristics of the standard 737. That's the whole reason this system was put in place. I think it would be smarter to have a threshold by which to disengage the system. IE, if pilot feedback exceeds a certain limit, disengage the system. Once you're back inside the threshold and after a reasonable delay, rengage the system. If this happens more than once, you're in a feedback loop and the system should be disengaged entirely. I would also like to think that a pilot operating one of these planes would be able to correct the irregular pitch based on feedback from the airspeed sensors. If you're reaching stall speed and have the engines maxed, your best bet is to pitch down and gain some velocity. I'm no pilot, but I feel like that's probably flight school 101. You need speed to generate lift, you have two ways of creating that, engines and gravity. This is all a moot point, though, because the system was horribly engineered to begin with. To say this would have saved the flight is overshadowing the many larger design decisions (like lack of redundant systems) that should have been in place to begin with. Not to mention the fact that pilots weren't made aware of the system or given any additional training to properly fly these planes.
This is why the Shuttle had quad redundant computers and double or triple on as much of the other stuff as they could. We've become way too trusting of drive-by-wire systems.
"Military Grade" always sounds great to civilians. As a long-time mil pilot I can tell you that military grade means that the lowest bidder not only submitted the lowest bid by using the lowest grade parts available, they also got to design the test used to determine the winner.
During the early days of space flight the ground crew, just before closing the hatch, would remind the astronauts "remember everything around you was supplied by the lowest bidder"
@AvE - quick thing on Challenger - actually, the engineers warned them repeatedly this wasn't expected behavior. The appendix you joke about actually was written, by none other than Richard Feynman, the guy who worked on the Manhattan project and considered the father of quantum mechanics, where he went into some detail about how, step by infuriating step, management ignored engineers at every step. No engineer said any amount of blow by was acceptable, this was unexpected behavior - the design called for zero. Any performance outside design spec is a red flag to any engineer. Managers repeatedly changed the qualification criterion (not engineers), repeatedly tweaked (read: ignored) statistical models, until they got the result they wanted. Any engineer that signed off on those numbers was signing off based on what management told them to qualify it as, not what another engineer had said. Please don't crap on the engineers. They were good people. One of them spent almost the entirety of his life after desperately trying to get the flight aborted, knowing full well it would explode, in a deep depression and in relative social isolation. His wife reported that he was crying as the TV played the launch, repeating over and over again they were going to die, if memory serves.
A guy I know did the Avionics conversion training for the MAX before it came into service. He said there was no mention of the MCAS system at all. Pretty unbelievable that neither the pilots or the engineers knew about it!
They didn't need to know about it. What they needed to know is the memory procedure, in place since 1967, that when you have an electric trim overrun situation (MCAS is just one of the possible causes) you flip both elevator trim override switches to "override" and leave them off for the rest of the flight. You hand fly the plane with the yoke to a safe altitude, assume normal level cruise attitude and airspeed THEN and only then manually trim the aircraft to eliminate load on the yoke. Pilots are required to know that procedure from memory and all 737 pilots from Fred Flintstone's time have had to demonstrate that they memorized the elevator trim overrun procedure in order to obtain their type certificate for the 737 series. In both 737 Max crashes air crew didn't know the procedure they were required to memorize, and they violated procedures that would have saved 300 lives. But oh, yeah, that's Boeing's fault. No plane will ever be built that is so safe that a pilot can't crash it if he's sufficiently determined. Following the blame 'em and punish 'em road will mean that we will have no commercial airlines any more. Then people will be forced to drive to their destinations, a tens of times more dangerous procedure than flying.
RockinRobbins13 That’s a really interesting point. I had kind of wondered if correct trim over run procedures would have solved the issue. I work in GA myself so I have only ever read about AoA sensors and indicators if I’m honest...your average 172 is certainly not equipped with such technology! I just can’t imagine a situation where a system so vital to the safety of an aircraft isn’t even mentioned to pilots let alone engineers.
@@RockinRobbins13 : I think you just pointed out the different standards of training for US based pilots versus third world pilots. There are plenty of Western youtube pilots who knew the exact same thing you said. Also the previous non-crashed Lion Air crew also knew to disable the elevator trim override and landed safely.
Watch the video, again. The emergency procedures, in place since 1967, no longer apply to the new engines on the old airframe. Boeing prematurely released an airplane to compete with Airbus, and the entire fleet has now been grounded. The Max pilots were certified on the new design with obsolete emergency procedures, and no briefing on the new stabilization systems. And, the new systems were specifically engineered to avoid re-certification and immediately bring the competing design to market. Regardless of the deceased pilot's actions, the Boeing 737 Max is the largest aircraft recall in the history of aviation.
On the 737 max simply cutting to override won't help if there is already an elevator mistrim. You also have to use the roller coaster maneuver to relieve pressure on the trim tabs. At low altitudes it is probably a non recoverable situation. Boeing made the trim wheels on the 737 max smaller, which causes the pilot to use more force fo tuen the wheel. In the lion air crash, the overrides were flipped, then later re engaged, likely because they could not turn the trim wheels.
30 years as an aircraft mechanic. I love your terminology. We always thought that it was weird. So many other professions have had movies and tv shows about them. Doctors , pilots, ship captains, etc. Who did we have? Lowell on Wings. Our hero!!!
The new 737's do have 2 AOA sensors, but they only read from one at a time, swapping between them before a new flight. blancolirio on youtube here has a bunch of great videos explaining these crashes, and what Boeing is doing about these crashes. Boeing is changing their software to read from both sensors during the flight now, as well as changing how their software adjusts the AOA in certain situations.
Both sensors *were* used, that's why a single failure was able to cascade. What they needed was an algorithm to decide under what circumstances to _not_ use one of the two sensors, i.e. to decide when one has malfunctioned and ignore it, rather than accept an out of threshold condition from either sensor with equal priority. And that warning light is pretty useless, it's only getting attention now because it _maybe_ might have helped in this one particular failure mode which has been fixed anyway.
@@wagglebutt Actually, no it doesn't. There are numerous algorithms which can deduce a failed input from a two-sensor array, with varied reliability based on the actual failure modes. The simplest example would be, well, if one value is not physically possible, then that sensor must have failed and should be disregarded. Aside from the range of valid values, you can also consider factors such as the rate of change. For example an extreme discontinuity over time in a sensor output might also indicate a sensor failure, depending on the type of sensor and / or the magnitude of the discontinuity. Take a few such algorithms as appropriate, apply a heuristic to assimilate their outputs and, boom, failed sensor detection routine. I'm an automation engineer, so this is the sort of problem I actually get to solve for money.
So reading the comments here, its quite clear that people don't quite understand the functionality of this stuff with respect to aerodynamics... The AoA sensor ONLY reads the relative airflow to the aircrafts body. In a stable climb, the AoA is the same as in cruise - despite the nose being pitched up. This is because the airflow over the aircraft stays at the same angles. You can't cross check AoA vs the IRS (Inertial Reference System - aka gyros). We don't really care about how many degrees up the nose is pitched - but we do care about the angle of airflow. The most efficient AoA on most wings is ~4 degrees relative airflow to the wing chord... Most wings will stall at 16 degrees or higher... Of course, most aircraft climb at more than 16 degrees nose up - which is how people get confused between AoA and aircraft attitude - but the two should not be confused. Yes, this should have been much more obvious to pilots that the trim is essentially in runaway.... The trim wheels would have been spinning around like a mofo - so it *should* have been pretty obvious to the crew what was happening. I'm pretty sure that even a pilot grabbing the trim wheel to stop it rotating is enough to override the trim mechanism - I've seen references to getting the copilot to jam his leg against the trim wheel in a runaway situation... However, we're so dependant on automation in flying these days that I'm sure that was the last thing on the crews mind...
The resolver is a very robust and accurate device. It is somewhat like a motor but a rotary transformer is more accurate as it consists of a rotor and a sine and cosine winding. I work with aeronautic derivative jet engines in the oil and gas industry. We have duel resolvers on the fuel control valves as they must be controlled in tight tolerance to ensure peak HP yet maintain combustion temperatures below 1550 to maintain the 50000hr TBO. This being said I would never run a life safety device with one resolver let alone tie automated controls to it. I hope that you do get your hands on a AOA sensor that is used on the Max8, so that we can learn from the mistakes of others to improve are decisions in the future
We also used RVDTs in our retrofit of fuel control valves back in 1994, when improving the fuel system of GE LM-2500 gas turbines for our offshore platform compressors, 27,000 BHP at that time. The fuel valves were supplied by Hawker-Siddeley and the initial resolution of 512 steps was finer and much more reliable than the older fuel valves supplied with the previous LM-2500 turbines. As far as I know, not a single one RVDT of those installed on the platforms has failed since 1996, when the compressors were put online. By the way; "RVDT" means "Rotary Variable Differential Transformer", which hppen to present almost infinite resolution.
isnak907 In the Navy, we called those 3-wire synchros. They were all over the A7-E. They worked very well and failure modes were not to hard to find. On rudder, ailerons, and elevator, there was triple redundancy. The flight computer could vote out a failed synchro and keep on flying.
I read that there are actually 2 sensors but the computer only looked at a single one at a time, alternating after each flight (restart). In fact, on the Indonesian flight, the sensor failed on the previous flight and was reported to maintenance. The engineers performed testing while on the ground and couldn't recreate the problem (because it had switched to the other "good" sensor) and certified the plane for flight. The next day, after yet another restart, the computer switched back to reading from the failed sensor and the rest, sadly, is history. What's more disturbing is that even after the Indonesian disaster, steps were not taken or at least not taken fast enough, to communicate the problem and provide a fix or provide the necessary knowledge and training.
So it's the engineers who didn't know that the sensor they were testing was not the sensor that failed in-flight. We can only guess if the locals informed Boeing properly about that.
What i have heard: when testing the AoA, it has to be tested twice since it only tests one sensor at a time and switches the sensor between tests. They only tested it once.
The "hunk of gravity" isn't the important thing...they can easily pack the aircraft differently or pump fuel around to keep the center of gravity the same. The important thing is that the engine is a big bucket of thrust, and more importantly the location of that thrust. Moving the thrust forward and up was the problem, not the weight.
@@hyperhektor7733 Weight. If the voltage is higher you need a lower current. Lower current means thinner conductor. Even though the insulation may need to be a bit thicker, the overall weight of the cables will be less. Secondly if a PCB operates at 3V3 (which is slowly becoming obsolete just like 5V) I wouldn't like the supply coming from a cable to be the same as the board voltage. The reason is that resistance in cables will cause the voltage to fluctuate depending on the consumption. This can even be caused by other devices on the same power source. You will therefore always need to stabilize the voltage. Doing that is easier when you come from a somewhat higher voltage. (Easier, because it's avionics, documentation, not because you can't purchase chips that does this).
Oh, I can contribute something useful there: On the A350 (and I believe on the B787) there is also 230VAC 400Hz, because there are more and more electrical systems on those aircraft (that used to be pneumatic or hydraulic) so the higher voltage is needed to keep the wire sizes to those consumers reasonable.
AvE, not true on challenger. Look up Bob Ebeling, he's the engineer from Thiacol that tried to warn about the o-ring up and down the company and NASA, but no one wanted to listen. I think the people that designed the SRB's were fully aware the o rings wouldnt work. Ebeling died a few years ago and spent most of his life living in guilt that he didnt speak up loud enough. Very similar to the boeing situation and as you mention in your video, where they tell their engineer STFU if you want to make your 160k a year. That's essentially happened to Ebeling... Anyway here's the link www.npr.org/sections/thetwo-way/2016/03/21/470870426/challenger-engineer-who-warned-of-shuttle-disaster-dies
Sample bias. The Ebling that spoke up loud enough to stop the flight in a parallel universe was just never promoted because he was too much of a pain in the arse, that flight didn't go, but the next one did and Ebling's replacement did nothing.
It's all relative. I work for a company that manufactures 3d printed parts for both space and commercial aerospace applications. Space program engineers are the "cowboys". They do have some regulations, but only about 10% of what is needed to make even non-flight critical parts for commercial aerospace.
The o-rings have putty slathered on them. Previous to Challenger that putty contained asbestos expanding it's temperature range of pliability. Not too thin in the heat and not thick in the cold. The EPA refused to make an exception so the putty was changed to something else "just as good". It wasn't. Back in the year or so after the Challenger there were several articles and interviews about the putty but rarely was it in the biggest mainstream publications. Now finding those articles is like the holy grail and mostly requires going to a library with an old fashioned card catalog and good collections of old magazines.
@@TheMuel18 as an electronic engineer and not a mechanic (hate to touch grease and dirt) I have done some minor repairs on my German cars. Every time I start wondering around them, I get fascinated how much engineering has gone into those cars to be maintenaned easily. Water pump took me 20 min to swap and I have never had done anything like that before. Radiator and radiator fan took me longer, about 30 min. It's amazingly easy to work on BMW at least, not sure about the rest. I have only looked at somebody working on a Honda once and to me is a peace of crap compared to a German car.
The extra sad part is many of the engineers got PTSD and spent the rest of their lives blaming themselves for the tragedy even though they all stated not to fly that day and were overruled up the food chain.
NordoCeltic A simple o-ring that was mistreated and told wouldn’t work tons of *recorded* times. Dealing with a classroom of assholes still can’t beat being blown up in the atmosphere.
Hit the nail on the head from the FAA rubber stamp point. From what I have heard and read. A two sensor system would have required FAA re-certs. So no redundancy it was. All in the name of the almighty dollar!
The idea that no redundancy is necessary comes from the fact that that the AoA isn't normally REQUIRED for control of the aircraft. If it fails in flight it's not even an emergency because the pilot can just fly the plane. When they added non-autopilot control software to it, it should have been doubled, but under normal conditions nobody sees it as a critical instrument.
That's the whole issue, the sensor wasn't critical until then, now their new thing makes it so but they didn't act on it and upgrade it to become redundant... Maybe cause that wouldn't have fitted in the "minor change" category they wanted.
@@kilrahvp don't disagree with you that it became an issue, just trying to provide some perspective as to why it could be overlooked. There are tons of these thing and most of them are non-critical. It was a huge oversight, but having flown lots of aircraft without AoAs I can understand why a project being rushed through could overlook a normally non-critical instrument suddenly being critical.
@@GigAnonymous there's lots of non-critical sensors and instruments, and it didn't feed into the autopilot. That's the software issue. MCAS is not autopilot. I'm not excusing what they did, just trying to provide context from an aviation background
Profitcy from Fight Club: "A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."
@@elmikeomysterio5496 yup, thats the one. The pinto had an issue with fuel tank rupture in a crash, causing fires. Ford ran the numbers, worked out it would cost less to pay out wrongful death suits than redesign the car, and decided to ignore the issue. The memo got leaked, and Ford found THEMSELVES in the fire.
@@elmikeomysterio5496 There's been some good follow ups on what happened with the Pinto. From what I remember from the engineer who looked at the car after the accident the problem (going from sketchy memory here) was with the aluminum shielding around the gas tank(?) which when punctured caused the fire. But the design was common to that line of car regardless of manufacturer. But the details of the accident was so horrible that it led in every newspaper (young women burning alive). He also said Ford had a room where they tracked every fatal accident in their cars (with pictures) and had a budget for fixing problems. Since they don't have infinite money it becomes a problem of opportunity cost. They chose to fix the shielding problem due to the bad press but it was costly and that money might have saved more lives if used on more common problems.
Angle of the dangle sensor can be more reliably applied to the pilot's balls. Freeze protected, and if you get into trouble, the balls retract, giving added indication.
15:30 It really does hit you in the feels. Hearing it hit you in the feels really made me respect you that much more cause we realize just how small the sensor is and if that fails, which it did for the Ethiopian flight, it can cost the lives of over a hundred people. And it did. Thank you AvE.
The diamond pin is for ease of assembly, to try and line up two dowel pins perfectly and assemble that can be very difficult especially with tolerance stackups and manufacturing errors thrown in the mix, the solid pin does the locating in the x and y axis and the diamond pin takes up the rotational orientation! Much easier to align and slide together than two full diameter tightly fit pins!! Love the videos keep up the good work!
What he said. We use round/diamond pin combos all the time in fixturing for machine tooling. Two fully round pins are just too easy to get cocked and cause all sorts of drama.
The most I pressure part here.... Someone must at some point thought. "Someone will eventually mount this part back to front, best make that impossible"
If it’s a resolver hook up a o scope to the two output legs using Chan a and b then hook up 11 volts to the stator. Then using the trig function on the o scope it will show you the angle
I've never worked on a 737 Max, but I've done functional test troubleshooting on 747, 767 and 777, and that is how throttle resolvers work. In fact the channels are labeled sin and cos on the schematic. It's an RVDT.
always super impressed of how much you know of basicly any random thing that falls in your hand. the engineering, tinkering and machining community on youtube is simply phenomenal ❤ (and the humour is the icing on the cake)
From a former airline pilot who's been flying since 1995. The pilots, rest in peace to all, had no SIM time in the 737 Max. Plus, counter to emergency procedure... Per the non-biased preliminary report from Africa, they left the auto throttles on, and re-engaged the auto trim. A car analogy.....you hit the ice with cruise control engaged at 70MPH.....yet leave it on. Even with alleged faulty sensors and/or poorly written software.....with a U.S. trained crew, I would fly in a 737 Max with my family. There's plenty of warning prior to a stall (loss of lift), and standard procedures to both prevent a stall, and recover from a stall. Yes as noted in the video, due to larger engines and resulting mounting, the CG if different. Easily addressed in SIM training....w and without "enhanced automation" If the nose is incorrectly forced down....step one is situational awareness. When was nose forced down? When did they know it? What is not disputed.....they didn't follow procedure, No dispect/RIP Why not? Boeing is presenting proper remorse and PR. But, if sued, these pilots will be front and center. There will be PR backlash by some narrative pushers...but... unemotional and unbiased truth will come out. I've zero inside info, but this will settle out of court. Contribution % to crash? Very rough.... claiming no inside info If public domain info holds factual....80%+ airline & pilots 20% or less on Boeing & contactors. I've talked w 3 737 pilots, granted, non are Max But, these two crashes would not have happened per them, given proper training...aka U.S. training. Bottom line: When automation fails, turn it off....in an aircraft or car. Rest in peace, but for at least two critical items...the pilots didn't disconnect/disengage/turn off by
Warning prior to a stall? But I thought it was MCAS that was incorrectly thinking there was a stall and causing the plane to nosedive. I don't know how much warming time you'd have if the plane just started plummeting automatically.
@@avypath MCAS doesn't apply full nose down trim all at once. It does it by a couple of degrees at a time over the course of a couple of minutes. On the flight before Indonesia crash, a pilot was deadheading and was in the cockpit. The same fault happened and he told the pilots flying the plane how to deal with it. The pilots did have time to follow the emergency procedure.
@@oirvine the way to not crash if the mcas engages when it shouldn't comes down to: Noticing the trim is changing when you don't want it to Disabling the electronic trim adjustment and then adjusting the trim with the giant wheel right next to each pilot.
@@RobertSzasz I thought it was more involved than that to shut down MCAS, since it was more fundamental than autopilot. As in, it would still take over when autopilot was off unless power was specifically cut to it.
definitely the part I don't understand... even the memory items lead you to turning off auto pilot (could be directing an unwanted altitutde change erroneously), auto throttles (could be causing under throttle nose down erroneously) , and cutting out automatic drive of elevator trim (motor could be getting faulty input).... and if trim is still moving, grasp and hold manual trim wheel.... its been that way in the 737 for a very long time... I mean this is basic flying the plane stuff.... if the plane is not doing what you expect, kill all the automated stuff and fly the plane until you can consult the troubleshooting handbook for how to recover (if possible)... so that its just a panpan not a mayday... not saying single-sensor vote on something that can take the plane to full down trim isnt something that needs to be fixed, but this was a completely avoidable from the memory items.... its ... sad...
I'm a software guy with no knowledge in electronics or mechanics, I was recommended your videos by RU-vid and I'm hooked. It's like profane technical poetry that I barely understand and yet am fascinated by lol.
@UCRF95Q0a5HpH-vgCUZy_o4A Oh, totally. I love her, but I'm not blind to her flaws. What I'm saying is that one of the first heavy class aircraft designed (in the mid '80s) to be totally fly by wire has what amounts to 66% redundancy in this amazingly critical during low energy states piece of information to the confusers. AoA is majorly important and can't readily be digitized because it involves knowing specific information about current air flow states. C-17 has issues despite the amount of redundancy! There's only so much of the aircraft that is a good spot to measure AoA. Despite the redundancy numbers, there are physical constraints and as a result, despite having an impressive number of redundant systems - they are all in the same spot! So while the number of systems guards effectively against component failure, it does not guard effectively against catastrophic failure. Case in point - the USAF nearly lost a C-17 in the 2006 timeframe when a birdstrike on the nose of the aircraft destroyed the radome (at 300 feet AGL and 330ish KCAS) and pieces of the nose ripped ALL of the AoA vanes off of the aircraft. Only the quick thinking of the instructor pilot and the design philosophy of McDonnel Douglass saved the aircraft. The point? Redundancy is standard practice on government procured combat specific aircraft. Because governments don't have to be concerned with the bottom line or weight vs. fuel consumption. When commercial aviation was a luxury good airlines didn't have to worry either. Now, the market has shifted air travel into commodity territory and commercial aviation has to scrimp for margins wherever it can find them. Redundancy is one of the areas that always looks juicy in the budget review.
wolfedog99 - not illegal at all! We do it daily. Exceeding 250 knots below 10,000 is permissible for military on certain types of Military Training Routes. It is how we practice low level contour flying - and it is exactly as awesome as it sounds.
The Boeing has 2 AOA sensors. The "Single point of failure" was in how they were used in the programming for the MCAS (i.e. nose down) software. And you better believe there is more to this than just the sensors. How the software worked should be more of the focus here, especially with reports that pilots disabled MCAS on one of those flights and it reengaged shortly after keeping the nose down....
I got a presentation from an engineer working in aerospace about this problem just the other day. The failure mode was as follow: - Two AoA sensors were present, but only one was actually used by the computer (EDIT: on the pilot's side. The other sensor was use on the copilot side, and never the twain shall meet). - The AoA sensors disagreed SIGNIFICANTLY on the measurements but no fault was found by the computer (EDIT: well there was an option for that...). - Manual input (i.e. the sticks) disabled the automatic AoA adjustment for 10 (or 20, can't recall) seconds only. Then it kicked back in, which caused: - An abnormal heating of the 'motors' (I don't know the correct term in English) adjusting the elevation in the tail. The computer also failed to notice (or at least report) this fault. - There was no clear indicator signaling the AoA compensation kicked in. As far as the pilots were concerned, the aircraft was just 'fighting' them, until the tail 'motors' burned out and then they had no control at all - And finally, the documentation required to understand and remediate to the problem wasn't readily available. Sure, they had a paper version, but you really don't want to be perusing a phone book when your bird is about to crash. Their take on the matter: as far as they are concerned, it's CRIMINAL negligence, and I kind of agree. They were flaws at every step of the way: system design (why the hell does this system kicks back after being 'told' it was wrong by the operator?), software implementation (only one sensor being used? no error reporting? no abnormal temperature reporting), user interface (no clear visual and auditory feedback), documentation (use tablets along with the paper docs ffs!), mechanical engineering (the tail shouldn't have locked up and failed without a backup ONLY linked to the pilot, i.e. hydraulics direct inputs or assimilated) operations (the problem OCCURRED IN PREVIOUS FLIGHTS but the planes weren't grounded!) and certification (the FAA essentially allowed Boeing to certify themselves, what a joke). EDIT: to clarify and to answer something you noted: YES, redundancy is MANDATORY when it comes to avionics. In fact, double redundancy is pretty weak. It's not uncommon to have triple or quadruple redundancy on critical systems such as, you know... AoA sensors. EDIT2: and that came from a fairly high-up engineer in one of those soulless corporations. No one wants to be responsible for an accidental death or a hundred, and if an engineer at Boeing were to walk through the door they wouldn't stay unemployed very long... there's just no excuse for thinking that was 'good enough'.
Gig Anonymous 737 isn't hydraulic. The pilot uses a handle to crank the trim by the crank wheel pulling wires that turn the jackscrew. When the motor turns the jackscrew, the crank in the cockpit turns and hits the pilots legs. Unfortunately the crank is very hard to turn in this situation. Arnold Schwarzenegger in his prime might be able to.
" "And finally, the documentation required to understand and remediate to the problem wasn't readily available." as a matter of fact, it was. auto trim cutoff in a uncontrolled trim scenario is a memory item. please stop spreading misinformation. ": YES, redundancy is MANDATORY when it comes to avionics. In fact, double redundancy is pretty weak. " double redundancy is fine when the proper error correction algorithms are used
Why is it that when this situation has happened with American carriers, they knew how to rectify the problem without incident? Could it be the experience factor?
@@SuperAWaC In the Lion Air flight, the crew was misinformed or untrained about the procedures to follow when problem arose with the MCAS, or how to troubleshoot them. In the Ethiopian Airlines flight, the crew KNEW the procedures, followed them, and then crashed because it was not enough. It doesn't matter that the correct response to this problem is a "memory item" if: A/ The crew was not trained properly or B/ Even with a trained crew, the 'proper' procedure turns out to be unsufficient. At least, that's my two cents on it. I'm not an aeronautic expert nor a pilot, I'm merely repeating what the expert who gave the presentation said based on the preliminary reports and his own experience.
i just wana jump on the correction bus and reiterate that the 737 max has leap 1b engines. i should know because i do sub assemblies on them before they go to safran of france.
Flight engineers, engine pylons, etc. The B737-100 originally had a three man crew (captain, 1st officer, FE). Boeing had a hard time selling them because of that. At the time, DC9s (always a two man cockpit) were flying in essentially the same market (medium haul), so the airlines leaned heavily toward them. For several years, United was virtually the only one flying them. I don't know when Boeing reconfigured the airplane to a two man crew, but the -300 version was reengined to a high bypass engine, which is much greater in diameter than the original JT8Ds. Without having to reengineer the landing gear (also part of the current argument), Boeing built a cowl with a flat spot on the bottom. 737s (-300s and above) are very obvious on that score. Re designing to a glass cockpit and a two man crew is what enabled 737 sales to skyrocket and blow past 727 units to become the world's most popular airliner. Now, pylons. I think the first was on the B-36. I don't remember this being a general discussion item until after the UA-232 flight (DC-10 with exploding center engine taking out all flight controls), which successfully got down in order to attempt a landing at FSD (Sioux Falls, SD). The "landing" was partially successful in that nearly 200 people survived it. Sadly, 111 died. The most discussed factor in the success in getting the airplane down from FL370 and in a position to even attempt a landing was crew coordination and luck in the make up of the crew. Sparing the details, they were able to maneuver the airplanes by the use of differential power to the two wing mounted engines. At its simplest, and as any multi engine rated pilot knows, they could turn left and right by the use of assymetric thrust. However, because the engines were pylon mounted (almost all wing mounted jet engines are), they were able to climb and descend by power management, as well. The thrust vector on a pylon mounted engine is not only axially to the engine centerline, but has a vertical component because the engine is mounted out and down from the chord of the wing. Thus, there's always been the moment of pitch when power is applied to pylon mounted engines. However, when Boeing mounted the 737-Max engines higher and farther out, they increased that pitch moment more than the original engines. Their fix was the MCAS program. Automation in flight control is somewhat new to Boeing--Airbus has been doing it for years, and for my money, the jury is still out on its safety--too many Airbus accidents which can be tied to automation. But worst of all, automation without retraining, especially with a program like MCAS is criminal. By the way, most training does not involve fuel. It's been done mostly in simulators for decades.
Boeing has had "automation in flight control" since the early 90's with the 777 launch (100% fly by wire). Boeing just leans more heavily on the pilot and allows the pilot to override in a larger percentage than Airbii aircraft.
The 737 was always a 2-person crew. Union contracts required many airlines to fly a 3rd crew member on the 737 into the 1970’s (this person had nothing to do, because the aircraft was designed from the start for 2-crew operation). There were also foreign countries that had similar requirements but Boeing never built F/E stations on the 737 series (production anyway), they just threw the extra crew in one of the observer seats.....
@@YCbCr, the Electra doesn't have pylons. The engines are mounted in a nacelle on the leading edge of the wing, very much like radial engines. And, in fact, the exhaust goes out over the top of the wing.
This is fantastic. I just recently started working for the company that makes these as an engineer. I was just bumbling around in the vids of our colorful and insightful host and saw this and had to watch.
I'd probably be more likely to condemn the coder/their management before the actual piece of equipment. A complete system takeover is pretty ridiculous for something that could be one faulty line of code
@@jameshilferty5403 well was it the sensor that failed or the software? It's easier to test the software tens of millions of times however the sensor is hardware that can wear down and fail.
I got my computer on and went to youtube. It say AvE has a new video up 4 hours ago. In that time, it already had 2,000 views. I gather that when AvE speaks, people listen. Tis a great channel.
@Agent J Sober up before you reply, agent J. I do appreciate your honesty in identifying yourself as N agent. Not that I would't have figured it out, of course. You guys are everywhere now. Enjoy the decline!
@Agent J I had not come to any certain results and AvE offered possibilities that ought to be explored. Which branch of the government do you work for. By the way, I save shill names.
@@SuperAWaC that has everything to do with corporate overlords...the carriers are corporations, the suppliers are corporations, the lawyers are probably corporations...
One quick correction: There were two, not one, AOA sensors on those planes. However, the MCAS system only polled one at a time, and in the case of the failures it's believed that it stuck polling the failed sensor and thus the pitch down when not otherwise needed and eventually the crashes.
Thats not that hard to fix tho, the computer sees the two disagree, throws up a warning saying hey, i dont know the angle of attack, you figure it out, im out
Apparently the new software compares the two, and if they disagree, the MCAS system shuts itself down and doesn't even point the nose into the ground. Which is nice. The plane will be a bit harder to control, but they'd be very unlikely to crash it- I mean the plane has stall sensors up the wazzoo anyway, any pilot should be able to figure out how to not stall it. The MCAS system was there for handling reasons, and wasn't considered safety critical. Boy were they wrong.
the failure rate might be very low, but if your relying on a single point of failure (especially one prone to mechanical failure) its a matter of when , not if something bad is going to happen.
SolarWebsite Less iron in the cores of transformers and motors. Same with ships. Good example is the newer dc to dc circuits, running into the high kHz, use simple small transformers.. Very efficient conversion.
Super precision is an under statement -- they are designated ABEC 9. For people not familiar (the following is from Wikipedia), "the ABEC scale is an industry accepted standard for the tolerances of a ball bearing. It was developed by the Annular Bearing Engineering Committee (ABEC) of the American Bearing Manufacturers Association (ABMA). There are five classes from largest to smallest tolerances: 1, 3, 5, 7, 9. The higher ABEC classes provide better precision, efficiency, and the possibility of greater speed capabilities, but do not necessarily allow the components to spin faster."
This sensor is a thing called a selsyn or a synchro, it's similar to a resolver, but has sort of built in redundancy, being a three phase sensor needing only two phases to reconstruct angle. In the days of the past, it would be connected directly to an electromechanical display that would keep itself synchronized with the position of the sensing element, hence selsyn, which stands for self-synchronous
I think you are mistaken, if I remember correctly. Syncros are made up of to electromagnetic systems that transfers AoA information from the sensor (AoA vane mechanically connected to the first syncro). You have 5 wires that builds/transfers the electromagnetic field. 3 wires and 2 wires that makes the system. If one of the 3 wires fail, you will get a 60 degrees fault in the AoA angle from the syncro system. If one of the 2 wires fail you will get an 180 degree error in the syncro signal ( if I remember correctly, more than 30 years since I went through the theory .....).
@@steing7827 oh yes, the actual synchro system was 5 wire only, but I have seen later systems that reused the 'sensor' (sender) component adding a sixth wire for creating redundancy (using it like a resolver with the phase wye winding). It wasn't really selsyn anymore, just the parts were mature and available and it was easier to adapt the winding of a selsyn than using two resolvers.
Stein G You are correct. In the Aviation Shop, we called them 3 wire synchros, but they all had 5 wires. Wow. The A7-E has a bunch on the flight surfaces and AOA sensors. The flight computer had synchro to digital converters. That was one heck of a board. It could handle 3 synchros at a time and I think it had 5 boards. And the failure modes were plentiful. I think the A7-E has no less than 5 full backup modes for the flight surfaces and 6 fallback modes for navigation. So, if you had a synchro go bad, the flight computer would vote that sensor out and ignore it. Pretty cool for 1970’s technology.
this is a hugely underrated video. I actually knew what was going on, the idea of the hardware and software. being able to look at the actual hardware and dive in further into discussions adds depth to what I already knew. this should require redundancy you know those little wire brushes will corrode or oxidized at some point, maybe it takes ten years of bad weather but at some point becomes less reliable.
Yes 100% Now ask why? Because investers want SHORT term ROI. Therefore the corporation are managed to produce just that. So managers that take orders and execute them, no questions asked, are promoted. Anyone who stands in the way of next quarters profit is a nuisance and must be ‘managed’ Long term (>2years?) profitability solves a lot of these issues.
@spikedone2 the accident report for the Ethiopian crash stated that the crew first recognized the problem sort of correctly. In the case of a MCAS malfunction, the crew is to treat it like a runaway trim condition. The guide for runaway trim states to disable electric trim and go to manual, which they did. Doing this will disable MCAS as well. The guide also states to not turn it back on for the remainder of the flight. For some reason they decided to turn it back on. The RU-vid channel blancolirio goes into great detail about this crash and the Lion Air one as well.
@spikedone2 From what little I have read on the history of this whole MCAS debacle you have the story about right. Sometime before the Ethiopian crash the FAA sent out a "pilot advisory" (can't remember what it is called exactly) that if you are having an issue with the MCAS system, treat it exactly like a runaway trim condition. This problem is in the manual that pilots have on board. It seems that any "advisory" put out by the FAA is required reading for American pilots, but I do not know if international pilots are required to do so. The short story of the Ethiopian crash is there was an issue after takeoff with the angle of attack sensor, which was reading a higher nose up condition than what it actually was. This caused the MCAS to start nosing down the aircraft toward the ground. The pilots recognized this, shutdown the electric trim, and went to manual control. The whole time this was occurring the throttles we're not set to auto, instead they were in manual. While the pilots were trying to figure out if the problem was resolved the aircraft was getting harder to manually trim because it was reaching, and eventually surpassing, max recommended airspeed. It seems that the pilots never realized they had the throttles in manual, because it never moved after it was set before the MCAS problem started. Just before the plane went into a nose dive and crashed black box data showed the electric trim was turned back on and the MCAS system also started back up.
Everything he said also applies to the government. Regulation seems a tempting solution, but you have shifted the power to something even more tyrranical and evil.
When it comes to dieing, I want to go peacefully in my sleep like my grandfather did... Not screaming in panic like the rest of the passengers in his car.
Dw I'm sure the panic and/or sudden depressurization will help to aid you in unconsciousness before actual death ensues for your brief peacefulness amongst all the screaming 🤣
I love the way this guy talks. Very funny changes to words. On the actual AoA sensor, I thought it was standard practise to have tripe-redundancy for ALL flight systems on modern aircraft? One sensor is not three.....
Sealant for most instruments and sensors do have a part #. It's always just an off the self sealant, but the manufacturer wants you to use THAT one when servicing, because that's the one that's certified. Gotta keep the paperwork in line.
I have always said and thought that if you can explain ideas in plain or common language...and not lose the "elegance" of the point...this shows true understanding...always entertaining , cheers.
I've wondered since the this story broke, why there isn't a 3rd option on the 'stab cut out' switch? It seems like it's either 100% manual control, using the stab trim wheel, which can be extremely difficult, especially at high speed. Or 100% computer controlled, which takes inputs from the FMS, MCAS, pickle switch, etc. Why not a 3rd option, which is powered control, but only from the pilot operated pickle switch? That way the pilot has full manual trim control, but it's hydraulically assisted? Instead of a system that requires the pilot and copilot to simultaneously vigorously manually crank the trim wheel in a potentially life threatening situation, with mere seconds to respond?
agreed. The "runaway trim" procedure which is to hit the stab trim cutout switch works ONLY if you can use the manual trim wheel to move the horizontal stabilizer. But as you mentioned, at high speed the aeronautical forces on the stabilizer can be so great that turning the manual wheel is next to impossible and even if the pilots are able to turn it, they might not be able to turn it fast enough (it takes many turns to move the stabilizer a very small amount) to prevent a crash. Yes, they need a manually operated hydraulic or electric driven trim option.
The electric trim button on the yoke overrides MCAS so they can trim the plane using that but MCAS will take over again after about 6 seconds. So they could trim the plane electrically then do the stab cutout then use the trim wheel but the pilots didn't know about MCAS. The Ethiopian pilots also let their speed get way out of control. They were going over 500 mph. Impossible to trim at that speed.
You are right, except that the 737 trim assistance is electrical and not hydraulic. The Max has three possible inputs on the elevators. The stab trim wheel acts through cables like most cars emergency brake. The pilot controls trim by a switch on the yoke, the equivalent of your brake pedal, and the computers also act through an electric motor on the elevator. On your car, the ABS computer can fail or be inactivated by removing a fuse and your brake pedal will still work. On the Max, the pilot inactivating the MCAS will at the same time inactivate the yoke electric trim. Aviation used to rely on redundancy, but the opposite is true on the mad Max.
The primary sensor is a synchro transmitter consisting of three stator fields and a movable rotor (armature). The principle is the rotor induces a voltage into the stator windings which are connected to a synchro receiver's stator windings. That causes the rotor (armature) in the receiver to rotate so as to precisely align with the rotor in the sensor. This is very useful to transmit angular position electrically from one point to another. The receiver rotor is often connected directly to an instrument's indicating needle such that the instrument faithfully depicts the sensor's shaft (angular) position. Old analog technology - used extensively in aircraft instrumentation. Biggest problems come from synchros turning into motors and the dial spins at about 3600 rpm if I recall correctly (been 50 years since I worked on them) or the needle will occasionally end up 180 degrees out of sync (sync - synchro funny hun?) when power is removed and reapplied. That's easy to fix ... move power and tap the case until the needle is within 180 degrees and reconnect - boom - locks right on. Thanks for the trip down memory lane ...
retrain whom? i thought they said having 2 needs more certification and more paperwork, and they just..."didn't have time". i guess now they have the time...
FYI... Temple Grandin, Author of Visual Thinking. In Chapter 6 of her book, ' Visualizing Risk to Prevent Disaster,' she talks about the Boeing 737 failure, and how as you discussed the angle of attack sensor was the cause of the crash. I watched your video before reading the chapter in her book and boy clearly it made what she was saying makes sense. I thoroughly enjoy your episodes, and your insight into how things work, fail, and the beauty of a well-designed part, or tool. 👍
The catastrophic failure mode resulting in an unflyable aircraft would have shown up in a proper hazard analysis. Maybe they skipped the hazard analysis entirely, or did it incompetently, or disregarded it because it was too costly to resolve. Either way it's a failure of the design process that was preventable and shouldn't have ever happened.
Former flight deck Navy Avionics Tech here. I’ve worked on F-18’s A-6’s Huey UH-1N’s and and the T-6 post DD-214. Every fixed wing I worked on had at least h2 AOA sensors. I would have lot a years pay betting against a single AOA on a Passenger jet. I am truly surprised and amazed this got Qualed given all of the PFMEA’s that we’re surely reviewed.
