The "Real Aerospace" Thread

[gaerzi]

Because if relations with that nation sour, your military may be screwed.

It doesn't matter who designed it; it's who builds it. The Marine AV-8B is built by Boeing.

France frequently ends up on the other side of arguments with the US.

The last time France was on the other side of a serious argument with the US, it was 18 years ago when France held that invading Iraq was a terrible idea... There haven't been real arguments since. Even when Trump decided to take his ball home and leave the COP-21 or the JCPOA, there was no argument.

But you shouldn't worry, even if the USAF were to fly some Airbus A330 MRTT, they wouldn't be built in Toulouse, they'd be built in Mobile. Just like when the US Coast Guards bought some Falcon 20 jets (designated as HU-25), they were built in Little Rock, not in Mérignac.

See there's this stuff about it being simply illegal for US administrations to buy stuff from abroad. If you're a non-US company and you want to participate in public tenders in the USA? You create an American subsidiary, that employs American workers to build American versions of your stuff on the American soil for the American market. It's either that or you can't play ball. That's why it's always funny when the US complains about protectionism in other countries (which it does all the time).

Amusing anecdote, when Trump was unhappy about the new Air Force One, he thought "hey, the Airbus A380 is the biggest airplane around, why not go for it instead" and then Airbus declined, saying it wouldn't be economically sensible to set up an assembly line for it at Mobile for just two aircraft.

[QuakeIV]

The 737 max concept didn't have any fundamental issues. The airframe can take the engines if you somehow deal with the balance/trim issue, and their plan was to use angle of attack sensors to augment the angle of attack control. That frankly aught to have worked fine had it been conducted competently (also companies do that sort of thing all the time and nobody notices because it works fine).

I would personally say the main issue is the lack of redundancy. I work in the embedded domain and can say that I/O, particularly on older computers, is a limiting factor. Boeing did attempt to re-use the existing computers. I personally guess what happened is the computers literally didn't have the spare I/O to talk to more than one AoA sensor each (actually honestly, maybe the sensors were already present and there was 0 spare IO whatsoever), the system wasn't really built to allow redundancy across flight computers, and they didn't want to pay to bring new computers into the equation (this probably would have resulted in a more or less complete re-work of the computer systems, which would have cost quite a lot). So, they pressed on with the fucked design out of stupidity at the management level, simply not grasping how bad of an idea that was (despite probably accumulating plenty of complaints to that effect).

The last time France was on the other side of a serious argument with the US, it was 18 years ago when France held that invading Iraq was a terrible idea... There haven't been real arguments since.

Regarding domestic production of jets, I think it aught to be kindof obvious that we would want to produce any critical military hardware domestically. Whether you agree with the Iraq war or not, in any case France should not have a say in who we go to war with, to the extent that its literally impossible for us to do so due to the threat of being cut off from their equipment.

[gaerzi]

Regarding domestic production of jets, I think it aught to be kindof obvious that we would want to produce any critical military hardware domestically. Whether you agree with the Iraq war or not, in any case France should not have a say in who we go to war with, to the extent that its literally impossible for us to do so due to the threat of being cut off from their equipment.

Did you read the rest of my post?

Also I don't recall France managing to stop the US from going on their reality-reshaping Iraq war. I also don't recall any sanction by France against the US. I don't remember anything about the US having to stop operating their HH-65 Dolphin or HU-25 Guardian due to fallout from the Iraq war. Nor did the US went shy about procuring the UH-72 Lakota in 2006.

[Cthulhu]

The 737 max concept didn't have any fundamental issues. The airframe can take the engines if you somehow deal with the balance/trim issue, and their plan was to use angle of attack sensors to augment the angle of attack control. That frankly aught to have worked fine had it been conducted competently (also companies do that sort of thing all the time and nobody notices because it works fine).

Oh no, it did, even though on a different scale. The issues were borderline criminal cases. Instead of properly fixing up the airframe or the crutch of the MCAS, they simply let a half-baked system try to counter an overburdened design.

Boeing's goal was to have the MAX certified as another 737 version, which would appeal to airlines for the reduced cost of pilot training. The Federal Aviation Administration approved Boeing's request to remove a description of MCAS from the aircraft manual, leaving pilots unaware of the system when the airplane entered service in 2017.

Not only was this thing a deathtrap, the pilots weren't even told what it was or how it could be triggered.

After the Lion Air crash, Boeing and the FAA, still not revealing MCAS, referred pilots to a revised checklist procedure that must be performed in case of a malfunction. Boeing then received many requests for more information and revealed MCAS in another message, and that it can intervene without pilot input. According to Boeing, MCAS was supposed to compensate for an excessive nose up angle by adjusting horizontal stabilizer before the aircraft would potentially stall. Boeing denied that MCAS was an anti-stall system, and stressed it was intended to improve the handling of the aircraft.

Only the second crash forced them to admit everything.

In April 2019, a month after the second crash, Ethiopian authorities stated that the procedure did not enable the crew to prevent the accident, which occurred while a fix to MCAS was under development. Boeing admitted MCAS played a role in both accidents, when it acted on false data from a single angle of attack (AoA) sensor.

But the worst irony is actually the fact that the MCAS was too invasive. Basically, the skewed design stumbled over its crutch, the MCAS.

In early 2020, the FAA, Transport Canada, and EASA evaluated flight test results with MCAS disabled, and suggested that the MAX might not have needed MCAS at all.
In late 2020, an FAA Airworthiness Directive approved design changes for each MAX aircraft, which would prevent MCAS activation unless both AoA sensors register similar readings, eliminate MCAS's ability to repeatedly activate, and allow pilots to override the system if necessary. The FAA began requiring all MAX pilots to undergo MCAS-related training in flight simulators by 2021.

[Mjolnir]

The 737 max concept didn't have any fundamental issues. The airframe can take the engines if you somehow deal with the balance/trim issue, and their plan was to use angle of attack sensors to augment the angle of attack control. That frankly aught to have worked fine had it been conducted competently (also companies do that sort of thing all the time and nobody notices because it works fine).

I would personally say the main issue is the lack of redundancy. I work in the embedded domain and can say that I/O, particularly on older computers, is a limiting factor. Boeing did attempt to re-use the existing computers. I personally guess what happened is the computers literally didn't have the spare I/O to talk to more than one AoA sensor each (actually honestly, maybe the sensors were already present and there was 0 spare IO whatsoever), the system wasn't really built to allow redundancy across flight computers, and they didn't want to pay to bring new computers into the equation (this probably would have resulted in a more or less complete re-work of the computer systems, which would have cost quite a lot). So, they pressed on with the fucked design out of stupidity at the management level, simply not grasping how bad of an idea that was (despite probably accumulating plenty of complaints to that effect).

Redundancy could still have been implemented, just use a separate processor to monitor the sensors, discard outliers, and synthesize a signal to the main computer, which would just operate as if it was connected to a single sensor. This processor and the connection to the computer would still lack redundancy, but these can be made far more reliable than the AoA sensors. But I'm not sure this was actually the issue, because the system did have an "AoA disagree" indicator.

Which brings up another example of the stupidly ridiculous extent of the penny-pinching and nickel-and-diming that was going on: the AoA indicator (separate from the AoA disagree indicator) was an optional extra only installed in about 1/5th of the planes. This is notable because the software had a bug where the AoA disagree indicator only functioned if the AoA indicator was installed.

[QuakeIV]

Redundancy could still have been implemented, just use a separate processor to monitor the sensors, discard outliers, and synthesize a signal to the main computer, which would just operate as if it was connected to a single sensor. This processor and the connection to the computer would still lack redundancy, but these can be made far more reliable than the AoA sensors. But I'm not sure this was actually the issue, because the system did have an "AoA disagree" indicator.

Which brings up another example of the stupidly ridiculous extent of the penny-pinching and nickel-and-diming that was going on: the AoA indicator (separate from the AoA disagree indicator) was an optional extra only installed in about 1/5th of the planes. This is notable because the software had a bug where the AoA disagree indicator only functioned if the AoA indicator was installed.

This doesn't actually fix the redundancy issue, you still have a single point of failure at that suggested processor.

Oh no, it did, even though on a different scale. The issues were borderline criminal cases. Instead of properly fixing up the airframe or the crutch of the MCAS, they simply let a half-baked system try to counter an overburdened design.

Boeing's goal was to have the MAX certified as another 737 version, which would appeal to airlines for the reduced cost of pilot training. The Federal Aviation Administration approved Boeing's request to remove a description of MCAS from the aircraft manual, leaving pilots unaware of the system when the airplane entered service in 2017.

Not only was this thing a deathtrap, the pilots weren't even told what it was or how it could be triggered.

I think you are missing my point more or less entirely. The design was put slightly off balance by the off-center engines (as they were moved forward of the intended position), otherwise the design can take the load just fine. The issue is entirely the fact that they did a bad job of dealing with the trim issues caused by the messed up center of mass. All of their issues here were caused by their half assed solution to that, not the fact that the plane was 'overburdened'.

[Mjolnir]

Redundancy could still have been implemented, just use a separate processor to monitor the sensors, discard outliers, and synthesize a signal to the main computer, which would just operate as if it was connected to a single sensor. This processor and the connection to the computer would still lack redundancy, but these can be made far more reliable than the AoA sensors. But I'm not sure this was actually the issue, because the system did have an "AoA disagree" indicator.

Which brings up another example of the stupidly ridiculous extent of the penny-pinching and nickel-and-diming that was going on: the AoA indicator (separate from the AoA disagree indicator) was an optional extra only installed in about 1/5th of the planes. This is notable because the software had a bug where the AoA disagree indicator only functioned if the AoA indicator was installed.

This doesn't actually fix the redundancy issue, you still have a single point of failure at that suggested processor.

As I said, the processor and the connection to the computer would still lack redundancy, but these can be made far more reliable than the AoA sensors. The overall probability of failure could easily be shifted several decimal places this way. The processor itself could even be made redundant, leaving the only single point of failure being the port on the main computer. But with how failure-prone the AoA sensors seem to be, a double or triple sensor failure may be more likely than a single processor failure.

[QuakeIV]

They aren't particularly failure prone compared to any other given component, what accounts for the failures is the fact that there were a lot of them in use all of the time, and even momentary failings could result in catastrophe (IE the failure might not normally be considered a catastrophic failure mode for that particular model of AoA sensor). Hundreds of the planes were flying by the time it was grounded, and were operating on normal (continually busy) schedules.

edit, I will try to engage more with exactly what you are saying:

The processor itself could even be made redundant, leaving the only single point of failure being the port on the main computer.

I'll be up front with you and say this is flat out a bad idea. This would depend on the exact interface as to whether this is physically possible or not, for instance with ARINC-429 this would probably easily be physically possible. However this makes fairly broad and likely inaccurate assumptions as to the main mode of failure for a given computer. This would probably involve a hot backup configuration where if the main fake AoA sensor stops transmitting, the backup comes online. However, in the case where the main fake AoA sensor gets stuck transmitting erroneous data, or perhaps has some kind of short where it is pulling a transmit line low or pushing it high, this would bring the whole bus down due to a single failure (and wouldn't necessarily be all that unlikely compared to any other given failure). This also doesn't account for the possibility of the computers choking on values they didn't know how to handle, and both going down at the same time (since they are listening to the same set of sensors), then having to somehow re-negotiate who is the main computer when they reboot.

To be honest with you I think you are falling into the same trap as the nontechnical (IE not embedded software engineer) Boeing managers probably originally did. They mostly likely pretty much said 'why cant we just use the existing angle of attack sensors to fix the angle of attack' or something along those lines, then got defensive when their idea was not received well and continued to defend what they were suggesting. You are suggesting something that is physically possible but would not necessarily significantly improve the situation.

In general aerospace computers are extremely hardcoded and not really friendly to any given changes, but also are generally extremely reliable at doing exactly what they were originally intended to do pretty much forever. Trying to work new things into that system without fairly carefully checking (and re-working if needed) pretty much every part of the rest of the system to make sure it will still perform correctly is what killed hundreds of people to begin with. In other words, implementing this idea correctly does not substantially save on costs compared to just bringing whole new computers in, because in any case changing the system in any substantial way (and this is pretty substantial change in how the plane behaves) necessitates a lot of work to make sure the whole thing will still work as intended and not suddenly decide to bash itself into the runway and explode. Its not like they couldn't have run their existing software on new computers, they just would have had to do a re-analysis/re-work on par with implementing this other idea correctly instead.

There isn't really any way of knowing if your idea would have worked perfectly and saved a lot of peoples lives, or simply would have been perhaps somewhat less failure prone but otherwise still killed roughly the same number of people before the jets then get grounded anyways. The only way to figure that out would be working at Boeing so you have access to all of the information on the design, doing a detailed analysis of the whole system with a bunch of other engineers to figure out what it would probably do, or alternatively just saying yolo and trying it and seeing what happens (as they did with the original MCAS system).

[Cthulhu]

I think you are missing my point more or less entirely. The design was put slightly off balance by the off-center engines (as they were moved forward of the intended position), otherwise the design can take the load just fine. The issue is entirely the fact that they did a bad job of dealing with the trim issues caused by the messed up center of mass. All of their issues here were caused by their half assed solution to that, not the fact that the plane was 'overburdened'.

You are also missing my point. The problem is the combination of intentional corner-cuttings, followed by deliberate misinformation in order to protect their profit margins. On top of that, the FAA even helped them out, instead of stopping it.
If they'd fix up the airframe, then there would be no need for the MCAS. On the other hand, if they simply admitted the fact that the airframe is off balance, that the MCAS is there to help correct possible issues of nose lifting, and they'd make the MCAS less invasive/better balanced, then the crashes could be prevented.
The pilots did not even know of the MCAS or were able to override its interference! Additional sensors or more redundancy could've decreased the chances of a catastrophe, but they would not solve the main issue.

[QuakeIV]

I'm not sure what point I'm missing, I did point out that they screwed themselves by not doing the required work to make this retrofit work properly. I think that falls under corner cutting. As far as I am aware the FAA didn't really do anything to enable them to do this other than behave complacently (IE slacking off on their jobs).

Had some kind of reliable auto-trim functionality been implemented (instead of the crap they actually pushed out) then nobody would have ever noticed MCAS and it would have continued to behave like a normal fly by wire plane. I feel the need to point out it already is fly by wire and the pilots dont actually have direct control over the thing in any case, the computer is doing a lot of work to take their inputs and produce the desired result. This could have just been an added layer to that, rather than a murderous disaster.

[Cthulhu]

I'm not sure what point I'm missing, I did point out that they screwed themselves by not doing the required work to make this retrofit work properly. I think that falls under corner cutting. As far as I am aware the FAA didn't really do anything to enable them to do this other than behave complacently (IE slacking off on their jobs).

Had some kind of reliable auto-trim functionality been implemented (instead of the crap they actually pushed out) then nobody would have ever noticed MCAS and it would have continued to behave like a normal fly by wire plane. I feel the need to point out it already is fly by wire and the pilots dont actually have direct control over the thing in any case, the computer is doing a lot of work to take their inputs and produce the desired result. This could have just been an added layer to that, rather than a murderous disaster.

Well, the MCAS was deliberately omitted from the manuals:

Boeing considered MCAS part of the flight control system, and elected to not describe it in the flight manual or in training materials, based on the fundamental design philosophy of retaining commonality with the 737NG. Minimizing the functional differences between the Boeing 737 MAX and Next Generation aircraft variants allowed both variants to share the same type rating. Thus, airlines can save money by employing and training one pool of pilots to fly both variants of the Boeing 737 interchangeably.

The FAA obviously knew of that, yet they went along with it, despite the fact that the MCAS can intervene without pilot input. I wonder why. Or maybe not, Boeing may have kept the FAA in the dark. But are they really that stupid?
Normally, the pilots needed to know what the fly-by-wire system operates by. They also should be the ones ultimately in control.
This led to two things:
1. "Something" would intervene with the steering, without the pilot's knowledge of what it is, what it does, or what that's even based on.
2. Even if the pilot realized that something seemed fishy, he can't switch it off!

The sensor issue merely triggered this bomb.

[QuakeIV]

You don't understand how planes work.

Airliner pilots are not directly connected to the flight control surfaces in any way, have not been for many years, and are not even in direct control of those surfaces (although in the case of a stable airframe, the plane will generally behave somewhat similarly to as if they were). The yoke is no longer some hydraulic system that directly controls actuators in the wings and tail, it is sending signals to the computer which then decides how to move the control surfaces. This, among other things, allows the plane to fly a lot more smoothly (you might notice during turbulence the control surfaces moving minutely with the sway of the wings, this is a computer doing that, not the pilot), and also (generally) more safely. Among other things, the computer will be auditing your decisions and will potentially either yell at you or outright refuse to do something, because normally that system is designed in such a manner as to prevent you from destroying the plane. Modern airliners in fact spend the majority of the time in autopilot and are nearly fully autonomous at this point. Many are even capable of taking off and landing totally automatically (which the military has been doing for decades now with UAVs), although this is not yet considered standard practice. Your notion that 'the pilots should always be in control' would in general be a step backwards in safety, which has consistently improved over the years in large part due to better flight control systems.

In a fly by wire plane, part of that overall flight control system involves mathematical models that calculate control surface deflections, given current pilot input. This can potentially factor in the current pitch, roll, yaw, altitude, current static air pressure, airspeed, equivalent airspeed, angle of attack, or any other given measured characteristic. Its usually fairly simplistic for conventional stable airframes like 737 because they already naturally tend to fly in a fairly reasonable manner and you don't actually need to work all that hard to figure out what the control surface deflections should be. In the past, planes had to be this way so that people could manage the task of controlling them directly, though today that is no longer necessary. However, that being said, it is not at all uncommon for aircraft to factor in angle of attack measurements in order to push the plane into a desired configuration. The notion that the new 737 max version would have a more complex flight control system that factored in angle of attack to deal with the pitch issues the new engines introduced is by this point a normal concept, and had it been done correctly it would have worked fine. It is not at all normal to go into the details of the fly by wire system to the pilots. You teach them the control scheme of the plane, and then you (ideally) make sure that said plane will actually work correctly and not fly itself into the ground.

The actual problem was not at all in line with the take on the news that 'MCAS was snatching control away from the pilots', that idea was come up with by entertainers who are experts in making people angry so that they will be more engaged with the content being produced. It may have felt as if it was snatched away to the pilots, but the fact of the matter is they were never directly in control to begin with. The reason for the disasters here was fact that the implementation of the flight control system was done seriously wrongly, was not behaving as it should have, and was literally flying the plane into the ground under certain circumstances.

e: I would personally go so far as to say the design was so bad that we should possibly reconsider whether these people should even still be allowed to build airplanes.

e2: I am kindof hoping to at least express a less inaccurate take than what this guy is expressing, I'm mostly concerned at the really severe misunderstanding he seems to be propagating.

[inxsi]

I am only a layperson who followed some of the MCAS issues. I had forgotten about the Boeing downgrading the possible consequences of failures in MCAS - and had stopped following the story before the notion that the plane could have been certified the way that they wanted it to be without MCAS had come out. I wonder if Boeing did not want to do that due to concerns about retraining pilots or if Boeing thought MCAS was needed for the certification to be grandfathered.

Not to excuse Boeing, but I've always wondered if Boeing convinced themselves that pilots would be able to correct for any issue with MCAS without understanding the system. The pilots on at least one of the flights did so successfully and one of the crashed plane dealt with the MCAS failure for some time before flying into the ground. While MCAS as implemented should not have been allowed and did not alert the pilot to any failures, there was an argument that it could be handled as any automatic trim failure - by deactivating the automatic trim system and using manual trim to adjust the plane as needed (which had some issues with how rapidly MCAS could put the plane out of trim and the difficulty if not impossibility of retrimming manually if there was not enough altitude available to do so).

QuakeIV has a point that the pilots stopped being directly connected to the flight control surfaces in any way many years ago. As to whether this is more safe is debated among pilots since they are required to learn how to monitor the automation to ensure that it is performing as expected, which requires understanding of the increasingly complex system, while also retaining the piloting skills to fly when needed. Part of monitoring the system is to know how the plane will handle different inputs under different conditions (and flight control laws)- see Air France Flight 447 on the importance of knowing how the different flight control laws work and knowing which one the plane is operating under. Maybe QuakeIV meant this to be covered under the control scheme of the plane, but to my mind it is much more involved.

[QuakeIV]

Hadn't heard of that crash before now, basically read about it just prior to posting. The article seems to indicate that the pilots didn't necessarily know that the flight controls stop enforcing angle of attack restrictions past a certain altitude and that the investigators reckoned that contributed to them eventually stalling and failing to recover.

I don't know enough about pilot training to really say whether that would normally have been part of that or not. I am inclined to guess however and claim that its more likely that they were taught at what altitude the plane stops enforcing angle of attack, for instance, rather than going through all of airbus' control laws modes individually.

[Cthulhu]

Thanks for the detailed explanation, it's even better than the Wiki or the various articles. Still, wouldn't the MCAS intervention be utterly counterintuitive? The pilots should know what the fly-by-wire system does, but they had no knowledge of the MCAS at all.

I'm no expert, but it kind of irked me that the whole MCAS matter was omitted from the manuals due to financial interests, that's all.

[inxsi]

From my understanding, MCAS (as it was implemented) was totally counterintuitive in practice, at least when it was failing since the trim would run a bit every few seconds. I am not sure how noticeable a proper implementation would have been. As implemented, my understanding is that pilots were able to see the trim adjustments it was making so they could have turned off the automatic trim or used the powered trim to constantly retrim the plane. Neither is ideal since both increase the workload on the pilots, so it is probably a failure in the engineering of the plane - I didn't get as much out of the discussions I read on the philosophy of engineering as opposed to pilots dealing with the practicalities of it. Agreed that Boeing totally caved to financial interests, between wanting it grandfathered in and wanting the selling point (some of which may have been pressured by the airlines) of minimal retraining.

For Flight 447, I should have read over it a bit more. I did not remember how much went wrong after the auto-pilot kicked off (and AoA protection was lost) due to the pitot tubes icing over and the plane being nosed up. Only the initial part is really about the change in flight mode based on the instruments available.

[QuakeIV]

In general I maintain that Boeing did indeed cave to financial interests, but did so with respect to how they designed the system, rather than with respect to what they included in the training/manual. They did indeed want to avoid expanding the training, in particular they wanted commonality with past 737 training. However, had the system been done properly (and in general terms followed what they claimed to be doing), they would have had actual commonality, and in the broad strokes the design should have worked. In fact it did work, when the single angle of attack sensor was performing correctly.

Had the FAA guys looked closer at the new architecture, they probably could have figured out the single point of failure issue. They were in my opinion led astray by both misleading information from Boeing, and also probably a general lack of concern due to a sense of faith in them as a commercial aerospace company (though this situation seems to have more or less totally erased Boeing's good reputation there).

[spacewhale]

https://www.youtube.com/watch?v=kz165f1g8-E

3d Printed Rockets, definitely cool. Wonder how many of these bad boys they could print out in parallel?

[Dan Wyatt]

Not for now, the 3D tech will be useful in space or in extraterrestrial environments.

[Krulle]

Had the FAA guys looked closer at the new architecture, they probably could have figured out the single point of failure issue. They were in my opinion led astray by both misleading information from Boeing, and also probably a general lack of concern due to a sense of faith in them as a commercial aerospace company (though this situation seems to have more or less totally erased Boeing's good reputation there).

It also erased a lot of goodwill with the European authorities regarding acknowledgement of approvals by the FAA.
The EASA now performs secondary checks of anything the FAA approved. And due to Boeing's political influence, Boeing aircraft are now checked more thoroughly whereas they were previously waved through once the FAA stamped their approval.
The question is, will this have repercussions for Airbus' approvals in the US, and how long will the EASA be able to do this with their funding?
(Currently not much in the checking pipeline, hence they have the capacity, but this may change again, especially with their budget under pressure - "BrExit".)

Again a point where saving money for certification (and checking) authorities did cost a lot...
We should ask ourselves if we really want ever "less" government, as this is the obvious result of such decisions.

I do agree though, finding a balance between "not overblown" and "not enough" public supervision is a very hard thing to do.