Check-Six Forums

TOPOLO a écrit : ↑

dim. oct. 18, 2020 6:12 pm

PS: y a t il une version publique de la modification à appliquer au MAX-8 pour le rendre conforme à son nouveau certificat de navigabilité ?

OPIT a écrit : ↑

dim. oct. 18, 2020 6:56 pm

TOPOLO a écrit : ↑

dim. oct. 18, 2020 6:12 pm

PS: y a t il une version publique de la modification à appliquer au MAX-8 pour le rendre conforme à son nouveau certificat de navigabilité ?

J'ai trouvé ça en fouillant chez la FAA. Ca date du 3 août 2020. Pas sûr cependant que ce soit ce que tu cherches

Proposed Design Changes

The FAA proposes mandating the following changes to the 737 MAX type design, to address the various aspects of the unsafe condition.

To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws  (10) associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.

The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, (11) the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.

To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.

The updated FCC software would also limit  (12) the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrew's ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position—before or after the MCAS command.

An undesired MCAS activation could prompt the flightcrew to perform a non-normal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.

First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.

Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a non-normal procedure.

The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold  (13) would cause an AOA DISAGREE alert on the primary flight displays (PFDs).

Also, as a result of the installation of this revised MDS software, operators would be required to remove “INOP” markers, if present, from the electronic flight instrument system (EFIS) panel of the airplane, because the markers would no longer be necessary, due to other changes in the updated MDS software that are unrelated to this unsafe condition. These markers, labeled “INOP,” indicate that one of the positions on the dial that selects display settings is inoperative.

To facilitate the flightcrew's ability to recognize and respond to undesired horizontal stabilizer movement and the effects of a potential AOA sensor failure, the FAA proposes to mandate revising and adding certain operating procedures (checklists) of the AFM  (14) used by the flightcrew for the 737 MAX. All transport category airplanes have non-normal checklists to aid the pilots in responding to airplane failures.

The following is a general description of the changes that would be made to these checklists, (15) and the purpose of each change. The FAA will conduct an operational evaluation before finalizing these checklists. (See Flightcrew Training section in this preamble for further information.)

To reduce the workload on the flightcrew when they suspect that the airspeed indications are unreliable, the FAA proposes to revise the Airspeed Unreliable checklist of the AFM. This checklist would be revised to (1) add a step to allow the flightcrew to determine a reliable airspeed indication without the use of reference tables, (2) improve the procedure for go-arounds to allow for increased use of automation, (3) add a step to ensure that erroneous altitude information is not transmitted via the transponder to air traffic control (ATC), and (4) add erroneous AOA as a potential cause for unreliable airspeed conditions.

The Runaway Stabilizer checklist of the AFM is used when there is undesired movement of the airplane's horizontal stabilizer. The FAA proposes revisions to the criteria for this checklist's use, to include when uncommanded horizontal stabilizer movement occurs continuously or in a manner not appropriate for current flight conditions. The revised checklist would include an explicit recall item that instructs the flightcrew to use their thumb-actuated trim switch to reduce forces on the control column. The checklist would also include a recall item to use the control column and thrust levers to control the airplane's pitch attitude and airspeed. Finally, the checklist would be revised to add a reference item to manually trim the horizontal stabilizer for pitch control, and note that a two-pilot effort may be used to correct an out-of-trim condition.

The Stabilizer Trim Inoperative checklist of the AFM would be revised to better align with the other non-normal checklists, and modified to provide guidance for manually trimming the stabilizer for pitch control, noting that a two-pilot effort may be used and will not cause system damage.

As previously discussed, one of the design changes proposed by this NPRM is a flight control law that would render the STS and MCAS functions inoperative if the airplane's AOA sensors disagree. To assist the flightcrew in properly responding to such an occurrence, a non-normal checklist, called the Speed Trim Fail checklist, would be added to the AFM. This checklist would be used when the STS and MCAS functions are inoperative, and inform the flightcrew to continue normal operation. It would also note that the STS will not provide horizontal stabilizer trim inputs when the airplane deviates from its trimmed airspeed.

The FAA proposes adding the Stabilizer Out of Trim checklist to the AFM. The Stabilizer Out of Trim checklist would be used when the autopilot does not set the horizontal stabilizer trim correctly. Under the current design, the STAB OUT OF TRIM light illuminates in flight to inform the flightcrew that the airplane's autopilot is not setting the horizontal stabilizer trim correctly. Under the new design, as part of the aforementioned FCC software update, this light will now also illuminate on the ground, to inform the flightcrew of a partial failure of a flight control computer. If the airplane is on the ground, the checklist will instruct the flightcrew to not take off. The checklist provides additional information for the flightcrew to use if the airplane is in flight.

The FAA proposes to add an AOA Disagree checklist as a procedure to the AFM, because the FAA proposes that the AOA DISAGREE alert be available on the PFDs for all 737 MAX airplanes. Therefore, this proposed checklist would be used when there is an indication, such as an AOA DISAGREE alert, that the airplane's left and right AOA vanes disagree. The checklist would inform the flightcrew to accomplish the Airspeed Unreliable checklist.

The FAA proposes to add the ALT Disagree checklist as a procedure to the AFM. This checklist is used when the captain's and first officer's altitude indicators disagree, generating an ALT DISAGREE alert on the airplane's PFDs. This proposed checklist would provide procedures to the flightcrew that would initially be driven by whether there is also an IAS DISAGREE alert shown on the airplane's PFDs. The checklist would also provide additional steps for the flightcrew to subsequently complete for the descent, approach, and landing phases of flight.

The final checklist that the FAA proposes to add to the AFM is a new IAS Disagree checklist. This checklist is used when captain's and first officer's airspeed indicators—their “indicated airspeed” or “IAS”—disagree. The checklist directs the flightcrew to accomplish the Airspeed Unreliable checklist.

Since this NPRM proposes to supersede AD 2018-23-51, the procedural information required by that AD would be outdated when the final rule is effective and therefore would be removed.

As part of the FAA's review of these design changes, the agency reviewed the entirety of the 737 MAX horizontal stabilizer control system. This review revealed that the physical separation of the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring does not meet the criteria specified in 14 CFR 25.1707. This design standard was promulgated in 2007 and therefore is part of the certification basis of the 737 MAX but not of previous Boeing Model 737 airplanes. Certain wiring installations must have enough physical separation so that a wiring failure cannot create a hazard. Since design changes must comply with FAA regulations, the FAA proposes to require changes to the wiring installation to meet the required physical separation between the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring. The FAA proposes this action to bring the airplanes into regulatory compliance.

larsenjp a écrit : ↑

jeu. oct. 22, 2020 11:48 pm

Est-ce une façon de reconnaitre qu'il n'y a pas de véritable solution au pb posé par la fiabilité de la mesure des capteurs d'incidence?

OPIT a écrit : Pas vraiment. Le problème posé est la perte de contrôle consécutive au déclenchement du MCAS. Même si tu élimines une cause connue (fiabilité des sondes), tu n'es pas à l'abris d'un déclenchement intempestif pour une autre raison, avec à la clé la même conséquence.
Donc l'approche consiste d'abord par atténuer les conséquences jusqu'à éliminer celles qui ne sont pas acceptables, puis à peaufiner en réduisant les causes (qui peuvent avoir d'autres conséquences, acceptables mais pas insignifiantes pour autant).
Pour le dire autrement, puisque le risque zéro n'existe pas tu fais d'abord en sorte de limiter la casse dans tous les cas de figure.

larsenjp a écrit : ↑

ven. oct. 23, 2020 9:21 am

Sauf que les autres causes dont tu parles ne sont pas identifiées, en tout cas pas dans l’extrait fourni par Topolo....

ergo a écrit : ↑

ven. oct. 23, 2020 9:43 am

Ce que je comprend pas c'est que s'ils ont donné une telle autorité au MCAS initialement c'est qu'il y avait une raison.
Réduire cette autorité permet d'éviter le problème connu, mais va aussi limiter la capacité du MCAS a faire ce qu'il faut dans les autres cas.

OPIT a écrit : Ce n'est pas parce qu'elles ne sont pas identifiées qu'elles n'existent pas. En revanche les conséquences, elles, sont connues et non désirables. Donc soit tu te contentes de traiter les causes connues en espérant qu'il n'y en aura pas d'autres, soit tu élimines les conséquences indésirables à la suite de quoi les causes (connues ou non) ne sont alors plus un problème. Tu choisis quoi ?

TOPOLO a écrit : Le MCAS aurait alors été non seulement nuisible, mais aussi presque inutile

TOPOLO a écrit :Difficile avec les infos disponibles de savoir si c’est par complaisance ou si l’avion est effectivement opérable dans ces conditions, mais on peut peut-être faire confiance à l’AESA...
Je crois de toutes façons qu’il n’y a pas d’autres choix si on veut conserver une aviation civile

larsenjp a écrit : ↑

ven. oct. 23, 2020 12:13 pm

Tu es en train d'essayer de justifier un truc injustifiable.

ergo a écrit : ↑

ven. oct. 23, 2020 2:24 pm

Ils ont donc rendu le MCAS inutile ...

OPIT a écrit : Je ne justifie rien, je développe un principe basique (mais apparemment non trivial) de maîtrise des risques qui est, en premier lieu, de limiter les conséquences, et en second lieu de s'attaquer aux causes qui mènent à ces conséquences. Et c'est dans cet ordre là parce qu'il est impossible de faire l'inventaire de toutes les causes, et donc illusoire de vouloir éliminer un risque en traitant plus ou moins bien les causes identifiées dans une liste incomplète.
Donc ils ont fait en sorte que le MCAS ne puisse plus conduire à une perte de contrôle, quelle que soit la cause de son déclenchement.

TooCool_12f a écrit : ↑

ven. oct. 23, 2020 8:40 pm

La question que je me pose, le nouveau MAX, va-t-il toujours passer en QT commune avec les autres?