We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Boeing 737MAX: Automated Crashes

00:00

Formale Metadaten

Titel
Boeing 737MAX: Automated Crashes
Untertitel
Causes and Lessons perhaps learnt
Alternativer Titel
Boeing 737MAX: Automated Crashes. Underestimating the dangers of designing a protection system
Serientitel
Anzahl der Teile
254
Autor
Lizenz
CC-Namensnennung 4.0 International:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
Identifikatoren
Herausgeber
Erscheinungsjahr
Sprache

Inhaltliche Metadaten

Fachgebiet
Genre
Abstract
Everybody knows about the Boeing 737 MAX crashes and the type's continued grounding. I will try to give some technical background information on the causes of the crash, technical, sociological and organisational, covering pilot proficiency, botched maintenance, system design and risk assessment, as well as a deeply flawed certification processes. On the surface of it, the accidents to two aircraft of the same type (Boeing 737 MAX), which eventually led to the suspension of airworthiness of the type, was caused by faulty data from one of the angle-of-attack sensors. This in turn led to automatic nose-down trim movements, which could not be countered effectively by the flight crew. Eventually, in both cases, the aircraft became uncontrollable and entered a steep accelerated dive into terrain, killing all people on board on impact. In the course of the investigation, a new type of flight assistance system known as the Maneuvering Characteristics Augmentation System (MCAS) came to light. It was intended to bring the flight characteristics of the latest (and fourth) generation of Boeing's best-selling 737 airliner, the "MAX", in line with certification criteria. The issue that the system was designed to address was relatively mild. A little software routine was added to an existing computer to add nose-down trim in situations of higher angles of attack, to counteract the nose-up aerodynamic moment of the new, much larger, and forward-mounted engine nacelles. Apparently the risk assessment for this system was not commensurate with its possible effects on aircraft behaviour and subsequently a very odd (to a safety engineer's eyes) system design was chosen, using a single non-redundant sensor input to initiate movement of the horizontal stabiliser, the largest and most powerful flight control surface. At extreme deflections, the effects of this flight control surface cannot be overcome by the primary flight controls (elevators) or the manual actuation of the trim system. In consequence, the aircraft enters an accelerated nose-down dive, which further increases the control forces required to overcome its effects. Finally I will take a look at certification processes where a large part of the work and evaluation is not performed by an independent authority (FAA, EASA, ...) but by the manufacturer, and in many cases is then simply signed off by the certification authority. In a deviation from common practice in the past, EASA has announced that it may not follow the FAA (re-) certification, but will require additional analyses and evidence. China, which was the first country to ground the "MAX", will also not simply adopt the FAA paperwork.
Schlagwörter
SystemzusammenbruchMultiplikationsoperatorBitrateRootkitPhysikalischer EffektTypentheorieModelltheorieAutomatische HandlungsplanungDruckverlaufNeunzehnsinc-FunktionComputeranimationJSONVorlesung/Konferenz
Lokales MinimumAnalysisErweiterte Realität <Informatik>SystemprogrammierungDigitale PhotographieIterationGruppenoperationFontDigitales ZertifikatErweiterte Realität <Informatik>AnalysisCharakteristisches PolynomLokales MinimumRechenschieberPhysikalischer EffektIterationSystemprogrammierungMultiplikationsoperatorDifferenteDivergente ReiheOrdnung <Mathematik>Vorlesung/KonferenzComputeranimation
Lokales MinimumOrdnung <Mathematik>Divergente ReiheSystem FMultiplikationsoperatorFreier LadungsträgerFahne <Mathematik>Dienst <Informatik>GeradeVorlesung/Konferenz
KontrollstrukturWort <Informatik>Elektronisches ForumDigitales ZertifikatSystemprogrammierungBitLokales MinimumGamecontrollerQuick-SortMultiplikationsoperatorAutorisierungFlächentheorieWort <Informatik>Pi <Zahl>Vorlesung/KonferenzComputeranimation
AblaufverfolgungSystemzusammenbruchDatenloggerSoftwarewartungZahlenbereichDatensatzGeradeVorlesung/Konferenz
TypentheoriePhysikalischer EffektMereologieBitDatenloggerDatensatzAblaufverfolgungHalbleiterspeicherSpeicherabzugÄhnlichkeitsgeometrieVorlesung/Konferenz
Lokales MinimumGeradeDurchmesserNP-hartes ProblemMomentenproblemBitFamilie <Mathematik>AnalogieschlussKlassische PhysikCulling <Computergraphik>ModelltheorieComputeranimation
TelekommunikationAusnahmebehandlungGenerator <Informatik>Einfache GenauigkeitNeuroinformatikSingularität <Mathematik>DigitalisierungAutorisierungGamecontrollerVorlesung/Konferenz
Lokales MinimumGeradeDurchmesserNP-hartes ProblemMultiplikationsoperatorTypentheorieAuswahlaxiomOrdnung <Mathematik>Globale OptimierungWinkelComputeranimation
Generator <Informatik>SoftwareentwicklerAutomatische HandlungsplanungTypentheorieMultiplikationsoperatorEnergiedichteVorlesung/Konferenz
AnalysisModallogikFaktor <Algebra>SoftwaretestGraphAnalysisSoftwaretestVerzweigendes ProgrammInformatikTeilbarkeitPhysikalischer EffektModallogikTopologieGraphEreignishorizontGrenzschichtablösungDifferenteGerichteter GraphSoundverarbeitungComputeranimation
Patch <Software>Lokales MinimumMAPGamecontrollerForcingMultiplikationTeilbarkeitGrenzschichtablösungDifferenteMultiplikationsoperatorPhysikalischer EffektAblaufverfolgungDatenloggerBitGeradeMinimumDisplacement MappingOrdnung <Mathematik>Vorlesung/KonferenzComputeranimation
ZweiCASE <Informatik>GamecontrollerSystemprogrammierungPhasenumwandlungTypentheorieThumbnailForcingMultiplikationsoperatorNeuroinformatikTermGeradeOrtsoperatorResultanteVorlesung/KonferenzComputeranimation
Patch <Software>Lokales MinimumEin-AusgabeSystemprogrammierungMomentenproblemGamecontrollerGeradeEin-AusgabeOrtsoperatorFlächentheorieForcingStabilitätstheorie <Logik>SystemprogrammierungModelltheorieBitStreaming <Kommunikationstechnik>GraphVersionsverwaltungWort <Informatik>MultiplikationsoperatorTermSprachsyntheseAdditionFlächeninhaltGravitationModallogikAnströmwinkelComputeranimationVorlesung/Konferenz
Lokales MinimumVersionsverwaltungSoftwareAnströmwinkelTypentheorieZellularer AutomatForcingMomentenproblemGamecontrollerGravitationDigitales ZertifikatAdditionWinkelVersionsverwaltungTypentheoriePhasenumwandlungNichtlinearer OperatorWellenpaketDifferenteGeradeSoftwareAnströmwinkelLokales MinimumFlächeninhaltTopologieVorlesung/KonferenzComputeranimation
MathematikStrömungsrichtungWort <Informatik>Digitales ZertifikatEinhüllendeOrtsoperatorProjektive EbeneAdditionLokales MinimumGeradeDienst <Informatik>NormalvektorAlgorithmische ProgrammierspracheForcingFlächeninhaltGasströmungVorlesung/Konferenz
CodeStabilitätstheorie <Logik>KraftReibungswärmeKontrollstrukturMittelwertZweiKnoten <Statik>ForcingKurvenanpassungAlgorithmische ProgrammierspracheDigitales ZertifikatMetrisches SystemRechenwerkPunktComputeranimationVorlesung/Konferenz
CodeStabilitätstheorie <Logik>ReibungswärmeKraftKontrollstrukturMittelwertSoftwareEin-AusgabeLastMachsches PrinzipWinkelPatch <Software>Lokales MinimumKnoten <Statik>ZweiVollständiger VerbandAusnahmebehandlungDigitales ZertifikatUmsetzung <Informatik>Ganze FunktionUmwandlungsenthalpieKonfigurationsraumParametersystemSoftware EngineeringWinkelLeistung <Physik>NeuroinformatikSoftwareMathematikDynamisches SystemSichtenkonzeptPunktTypentheorieComputeranimationVorlesung/Konferenz
Ein-AusgabeGruppoidATMPunktSichtenkonzeptSoftware EngineeringNeuroinformatikMereologieAdditionAlgorithmusRelationentheorieErweiterte Realität <Informatik>AnströmwinkelSoftwareEin-AusgabeSystemprogrammierungCharakteristisches PolynomVersionsverwaltungMultiplikationsoperatorRechter WinkelGamecontrollerVorlesung/KonferenzComputeranimation
MultiplikationsoperatorRechter WinkelAbstimmung <Frequenz>Zentrische StreckungDatenloggerAnströmwinkelSoftwareRichtungWinkelSchwellwertverfahrenGraphMinimalgradGeradeVersionsverwaltungNeuroinformatikBitVorlesung/KonferenzComputeranimation
AnalysisTermVektorpotenzialKategorie <Mathematik>SoundverarbeitungFunktion <Mathematik>Rationale ZahlTotal <Mathematik>Turing-TestGanze FunktionSystemprogrammierungGruppoidMatrizenrechnungVersionsverwaltungSoftwareGamecontrollerDigitales ZertifikatKomplex <Algebra>SoundverarbeitungMatrizenrechnungGrenzschichtablösungBitGrößenordnungGeradeSystemprogrammierungMultiplikationsoperatorOrdnung <Mathematik>Data MiningDifferenteMetrisches SystemVorlesung/KonferenzComputeranimation
WidgetSystemprogrammierungKontrollstrukturATMAnalysisBeanspruchungTermVektorpotenzialKategorie <Mathematik>SoundverarbeitungFunktion <Mathematik>WahrscheinlichkeitsverteilungEreignishorizontGrenzschichtablösungPerspektiveHasard <Digitaltechnik>UmwandlungsenthalpieATMRegulator <Mathematik>SystemprogrammierungDigitales ZertifikatSchaltnetzMereologieAnalysisEinfache GenauigkeitGamecontrollerOrdnungsreduktionVorlesung/KonferenzComputeranimation
ATMAnalysisInverser LimesGruppoidEreignishorizontBeanspruchungVerkehrsinformationVersionsverwaltungRechenschieberWhiteboardOpen SourceVerschlingungKatastrophentheorieMetropolitan area networkOffene MengeEreignishorizontAnalysisStabilitätstheorie <Logik>SystemprogrammierungRichtungVorlesung/KonferenzComputeranimation
ATMAnalysisInverser LimesGruppoidEreignishorizontBeanspruchungStabilitätstheorie <Logik>Inverser LimesVHDSLSystemprogrammierungMinimalgradVierzigSoundverarbeitungPunktAutorisierungVerkehrsinformationBeanspruchungCharakteristisches PolynomDifferenzkernMenütechnikVorlesung/KonferenzComputeranimation
AnalysisSoundverarbeitungSystemprogrammierungPhysikalischer EffektForcingMinimalgradAggregatzustandVierzigZustandsmaschineVorlesung/Konferenz
ZustandsmaschineSystemprogrammierungAggregatzustandOffice-PaketTermVersionsverwaltungDruckverlaufDatenverwaltungComputeranimationTechnische ZeichnungVorlesung/Konferenz
Lokales MinimumSchnelltasteIdeal <Mathematik>VektorpotenzialDualitätstheorieVersionsverwaltungDruckverlaufDigitales ZertifikatVersionsverwaltungPrototypingDatenverwaltungSchnelltasteGruppenoperationMetropolitan area networkTypentheorieXMLComputeranimation
VerschiebungsoperatorSystemprogrammierungVersionsverwaltungDigitales ZertifikatAutorisierungSelbstrepräsentationVorzeichen <Mathematik>MAPAnalysisSystemverwaltungDatenstrukturVorlesung/KonferenzComputeranimation
VerschiebungsoperatorSystemprogrammierungGeradeVersionsverwaltungDatenverwaltungVerkehrsinformationSelbstrepräsentationMAPVorlesung/KonferenzComputeranimation
WidgetKraftPatch <Software>Lokales MinimumUltraviolett-PhotoelektronenspektroskopieDigitale PhotographieNeuroinformatikDigitales ZertifikatVersionsverwaltungTeilbarkeitGamecontrollerDienst <Informatik>Lokales MinimumVorlesung/KonferenzComputeranimation
Lokales MinimumWidgetKraftPatch <Software>ForcingCASE <Informatik>SystemprogrammierungPhasenumwandlungVideokonferenzSpielkonsoleStabilitätstheorie <Logik>DatenloggerAutomatische IndexierungTermGamecontrollerOrtsoperatorNormalvektorVorlesung/KonferenzComputeranimation
DatenloggerForcingSystemprogrammierungOrtsoperatorMultiplikationsoperatorPhysikalische TheorieWiederkehrender ZustandGamecontrollerVorlesung/Konferenz
ChecklisteKontrollstrukturEuler-WinkelDedekind-SchnittSystemprogrammierungTermNormalvektorARM <Computerarchitektur>SimulationComputersimulationAlgorithmische ProgrammierspracheStabilitätstheorie <Logik>KonditionszahlRechter WinkelSystemprogrammierungBitWellenpaketVorlesung/KonferenzComputeranimation
KontrollstrukturRippen <Informatik>BitSystemprogrammierungStabilitätstheorie <Logik>VerschiebungsoperatorElektronische PublikationVorlesung/KonferenzComputeranimation
KontrollstrukturGamecontrollerPerspektiveGasströmungMAPWinkelVorlesung/KonferenzComputeranimation
TypentheorieUnrundheitVorlesung/KonferenzComputeranimation
WhiteboardDigitales ZertifikatDienst <Informatik>EnergiedichteDichte <Physik>Web SiteWhiteboardVierzigGamecontrollerVorlesung/KonferenzComputeranimation
Turing-TestSystemprogrammierungZellularer AutomatKontrollstrukturOperations ResearchDigitales ZertifikatKonditionszahlFlächeninhaltSystemprogrammierungDruckverlaufMultiplikationsoperatorZellularer AutomatPunktResultanteGrößenordnungQuaderInformationsspeicherungMeterVorlesung/KonferenzComputeranimation
KonstanteMinimumMeterMultiplikationsoperatorInternetworkingRoutingVorlesung/KonferenzComputeranimation
FehlermeldungStandardabweichungBitrateModelltheorieAnalysisCodeCASE <Informatik>Digitales ZertifikatMereologieInternetworkingAutomatische HandlungsplanungBereichsschätzungMAPFormale SpracheZahlenbereichSoftwaretestSoftwareEntscheidungstheorieProgrammSystemprogrammierungGüte der AnpassungNeuroinformatikLesen <Datenverarbeitung>PunktQuellcodeForcingLokales MinimumBeobachtungsstudieSystemzusammenbruchRootkitSichtenkonzeptPhysikalischer EffektAutorisierungGraphDatenverwaltungMathematikHoneywell-HoldingOrdnung <Mathematik>AnströmwinkelKonditionszahlProzess <Informatik>ProgrammfehlerMultiplikationsoperatorRechter WinkelUmwandlungsenthalpieFormale GrammatikOrtsoperatorMaßerweiterungAlgorithmusDeskriptive StatistikReelle ZahlVersionsverwaltungComputerarchitekturArithmetisches MittelTeilmengeImplementierungGrenzschichtablösungHydrostatikDeterminanteFreier LadungsträgerEnergiedichteSoundverarbeitungWinkelAggregatzustandNichtlinearer OperatorQuick-SortQuaderMomentenproblemEinfacher RingFokalpunktOpen SourceProgrammierungInverser LimesDivisionWarteschlangeSehne <Geometrie>SprachsyntheseVorlesung/Konferenz
GraphAnalysisGruppoidWidgetMomentenproblemLokales MinimumVersionsverwaltungSoftwareAnströmwinkelTypentheorieTeilbarkeitGraphRootkitPhysikalischer EffektKonfiguration <Informatik>ModelltheorieWinkelVersionsverwaltungGüte der AnpassungAdditionAutorisierungDigitales ZertifikatMultiplikationsoperatorLokales MinimumSystemprogrammierungMathematikZahlenbereichNeuroinformatikSicherungskopieQuaderRechenwerkInertialsystemIndexberechnungComputeranimationVorlesung/Konferenz
SoftwarewartungZahlenbereichCASE <Informatik>AutorisierungGamecontrollerProzessautomationGarbentheorieLokales MinimumSoftwareVerkehrsinformationUnrundheitBitAutomatische HandlungsplanungFlächentheorieBus <Informatik>Einfach zusammenhängender RaumStandardabweichungNeuroinformatikPhysikalische TheorieDigitales ZertifikatEin-AusgabeWeb logPhysikalismusServerSystemprogrammierungGeradeSiedepunktModelltheorieVersionsverwaltungVorlesung/Konferenz
Vorlesung/KonferenzComputeranimation
Transkript: Englisch(automatisch erzeugt)
Mr. Bernd Zieke will speak about the crashes and what led to the crashes of the most recent 737 model. He is a flight safety, he's an engineer and he also worked on flight safety and he analyzed plane crashes for a lot of time and a long time.
And you have to keep in mind that this 737, although multiple models have been built, can be flown. All models can be flown with the same type rating since 1967, which is one of the many root causes of the issues that led to the disaster that killed 346 people.
Let's listen to Bernd and he'll enlighten us what else went wrong. Yes, thank you very much for the introduction. I see there are not quite as many people as with the Edward Snowden talk, but I'm not disappointed.
Aviation safety has always been very important to me and I've done a lot of work on it and I'm happy to share my passion with so many of you. Thank you. So here's basically the outline of what I'm going to talk about. It's the Boeing 737 MAX, or 737 as some may say.
I will briefly talk about the accidents, what we knew at the beginning, what went wrong and then what came to light later on. I will show our causal analysis method that we used very shortly, very briefly and the analysis, an overview of the analysis that I did of these accidents.
Then talk about the infamous MCAS system, the maneuvering characteristics augmentation system, as it's called by its full name. Then I'll talk about certification, how aircraft certification works in the United States. It's very similar in Europe, although there are some differences, but I'm not going to talk about European details in this talk.
So it's mostly about the FAA and aircraft certification across the pond. Some other things and an outlook, how it is going to go on with the Boeing 737 MAX. We currently don't know exactly what's going to happen, but we'll see.
And if we have time, there are a few bonus slides later on. So the Boeing 737 MAX, the star of the show as you may say. It's the fourth iteration, as the Herald already indicated, of the world's best selling airliner.
I think I looked it up just recently. I think there are almost 15,000 orders that have been for the 737 of all the series. The original, the classic, the NG and now the MAX. And the MAX itself is the fastest selling airliner of all time. So within months it had literally thousands of orders.
It has now almost 5,000 orders, the 737 MAX. And all the airlines in the world are waiting for the grounding to be lifted so they can receive and fly the aircraft. So the first accident was last year. It was a Lion Air Indonesian flag carrier.
Actually I think the second or third largest Boeing 737 MAX customer in the world with a couple hundred, 250 or something aircraft. And it crashed relatively shortly after it entered service. And so we heard some strange things in the news and on the forums
that deal with aviation safety. It seems that there had been uncommanded nose down trim. So the tail plane is moved by an electric motor and it forces the nose of the aircraft down.
The pilot can counter that movement with some switches on his control column. And apparently the stick shaker was active during the flight and there were difficulties in controlling the aircraft. We didn't know at the time exactly what it was. And then for the first time the abbreviation MCAS surfaced.
And even 737 pilots, even 737 MAX pilots, at least some of them said they'd never heard of it. It was a mystery. We later found that actually in some documentation it was very briefly mentioned that such a system existed but not exactly why it was there. And I guess Boeing knew and the certification authorities,
as it turned out, sort of knew a bit of the story but not the whole story. But especially people in the West, in the US and in other countries said these are just poorly trained third world pilots and we expect that.
And they weren't completely wrong. Lion Air has a particularly bad safety record and it wasn't unknown to aviation safety investigators. There have been a number of crashes with Lion Air. So in the beginning we thought, okay, maybe it's a fluke, it's a one-off or maybe it's caused by poor maintenance or bad pilots or whatever.
So several people on the other hand already began worrying because some flight data recorder traces became public and there were some very strange things which we will see shortly. And then only a few months later the second aircraft of exactly the same type and the same variant Boeing 737 MAX 8
also crashed. And you can see maybe on the picture on the left it left a rather big crater. It really dove into the earth quite fast. It turned out I think about between seven and eight hundred kilometers per hour. So really fast.
And not much was left. I think the biggest parts were about this size I guess. So all small pieces of debris and the engine cores which are a bit bigger. And from that as well, flight data recorder traces became public.
The recorders had survived, at least the memory in them were readable. So we finally found out something and found some similarities, some rather disturbing similarities. We'll come to that in a moment but I'll talk a little bit about the Boeing 737 family in general.
So there were four, as I said, models. There was the original which had narrow engines under the wings. Not a lot of room between the ground and the engines but it looked quite normal. You could say it was one of the first short haul airliners
with underslung engines under the wings. Then new high bypass turbofan engines entered the market which were much more fuel efficient. We're talking about maybe some 15 to 20 percent lower fuel consumption so it was a big deal. And the Boeing 737 was re-engined and became known as the classic.
Big engines but still mostly analog mechanical instruments. And it was basically the same as the original instead that it had some bigger engines. They had to shape the cowling a little differently to accommodate the bigger engines but more or less it worked for a while. And then as airlines demanded more modern avionics
so the cockpit electronics in aircraft the next generation was conceived. It also got a new wing, new winglets which again saved a lot of fuel. It had basically the same engines except that the engines now were also computer controlled
by what we call FADEC Full Authority Digital Engine Control. And Boeing said well that's probably going to be the last one and in the next few years we're going to develop an all new short and medium haul single aisle aircraft which will be all new and super efficient
and super cheap to operate all the promises that manufacturers always make. In the meantime Airbus was becoming a major player with the A320 it was overall a much more modern aircraft it had digital fly-by-wire it always had digitally controlled engines
it had much higher ground clearance so it was no problem to accommodate the larger engines in the A320 and Airbus then announced that it was going to re-engine the A320 and for the A320 that was the first time it got new engines for a long time you had the choice of two types of engines for the A320
and then they said we're going to install these new super efficient engines which brought with it another optimization of fuel consumption it was another 15% fuel saved per mile travelled something on the order of that so it was a huge improvement again and many Airbus customers
immediately ordered the so called A320neo and some Boeing customers also thought well this one is going to consume so much less fuel that we might consider switching to Airbus even though it's a major hassle if you have a fleet entirely consisting of Boeing aircraft if you then switch to Airbus
it's a huge hassle and nobody really wants that unless they are really forced to but the promised fuel savings were so big that companies actually considered this and lots of them and so Boeing said we need something very quickly preferably within two years I think so very that's for airline development
that's very very quickly and they said well scrap all the plans about the new small airline are we going to change the 737 again and now the new engines were going to be bigger again and so actually there was no ground clearance to move them in the same way as on the
NG so they had to modify the landing gear to mount the engines even further forward and higher and the engines were bigger but the engines were on the whole they were very good new development the same type of engines that you could get for the new Airbus
by CFM International and so they decided to make the Boeing 737 fourth generation and called it the Max so when we analyze accidents we use a causal analysis method called YB-Cause Analysis and we have some counterfactual
test which determines if something is a cause or something else we call it a necessary causal factor and it's very simple A is a causal factor of B if you can say had A not happened then B would not have happened either so you need to show for everything that there is a causal relationship
and that all the factors that you have found are actually sufficient to cause the other event you can probably not read everything of it but it's not really important this is a simplified graph and I will show the relevant details later and this is the analysis that I made of these accidents and you can see it's not a simple tree
as computer scientists many of you are familiar with trees and this is just a directed graph and it can have branches and so on and so some things are causal influence causal factor of several different things so some of the factors actually have an influence on multiple levels
for example the airspeed influences the control forces and it also influences the time the crew had to recover the aircraft before impact with the ground so these are some of the things that I will look at in a bit more detail
so here's one of them uncommanded nose down trim so what happened apparently on these accident flights was that you can see it in the flight data recorder traces I don't know can you see the mouse pointer? here there's the blue line and that is labeled
trim manual and there's the orange line that is labeled trim automatic and if they have a displacement to the bottom that means that the aircraft is being trimmed nose down which means in order to continue to fly level you have to pull the control column with more force
towards you and what you can see is in the beginning there are a few trim movements and on this type they are expected, it has an automatic trim system for some phases of flight which trims the aircraft to keep it flying stable and then after a while it started doing
many automatic nose down trim movements each of these lasts almost 10 seconds and there's a pause between them and in every case the pilots counter the nose down trim movement with the nose up trim movement on the control yoke there are switches that you operate with your thumb and you can trim the
aircraft that way and change the control forces and cause the aircraft nose to go up or down so for a very long time this went on the computer trimmed the aircraft nose down the pilots trimmed the aircraft nose up and so on until at the very end you can see that the trim, the nose up
trim movements that the pilots made become shorter and shorter and this line here it says pitch trim position that is the resulting position of the trim control surface which is the entire horizontal stabilizer on the aircraft and it moves down and it doesn't really go up anymore because the pilot inputs become very
short and that means the control forces to keep the aircraft flying level become extremely high and in the end it became uncontrollable and crashed as you can see here so the pilots for various reasons which I will highlight later the pilots were unable to trim the aircraft manually and the nose down
trim persisted and the aircraft crashed and this is only the graph of one of the accidents but the other one is very similar and so that's what we see there is a known system which was already known before on the Boeing 737 I think it's available on all the old versions as well
which is called the speed trim system which in some circumstances trims the aircraft automatically but the inputs that we see the automatic trim inputs don't really fit the so called speed trim system and so for the first time we hear the word AMCAS and we'll talk a bit
more about what made the Boeing 737 different from all the previous models and that is the bigger engines as I said the engines were much bigger and to achieve the necessary ground clearance they had to be mounted further forward and
they are also a lot bigger which means at higher angles of attack when the aircraft is flying against the stream of the oncoming air at a higher angle these engine cells produce additional lift in front of the center of gravity which creates a pitch up moment and the certification criteria are quite strict in that
and say exactly what the forces on the control on the flight controls must be to be certified and due to the bigger engines there were some phases or some angles of attack at which these certification criteria
were no longer met and so it was decided to introduce a small piece of software which would just introduce a small trim movement to bring it in line with certification criteria again and one of the reasons this was done was probably so the aircraft could retain the
same type certificate as was mentioned in the introduction so pilots can change within one airline between the aircraft between the 737 NG and the 737 MAX they have the same type certificate there is a very brief differences training but they can switch even in line operations between the aircraft from day to day
and another reason no other changes were made Boeing could for example have made a longer main landing gear to create additional ground clearance to move the engines in a more traditional position that would have probably made it more
aerodynamically in line with certification criteria I hesitate to say the word to make it more stable because even as it is the Boeing 737 MAX is not inherently aerodynamically unstable if all these electronic gimmicks fail it will just fly like an airplane and is probably in the normal flight envelope
easily controllable but to make big mechanical changes would have delayed the project a lot and would have required recertification and what instead could be done with the airframe essentially the same the certification could be what is known as grandfathered so
it doesn't need to fulfill all the current criteria of certification because the aircraft has been certified and has been proven in service and so only some of the modifications need to be recertified which is much easier and much cheaper and much quicker
so this is one of the certification criteria that must be fulfilled even though I have removed some of the additional stuff that doesn't really add anything useful it's still rather complicated it's a procedure that you have to do where you slow down one knot per second
and the stick forces need to increase with every knot of speed that you lose and things like that and it says stick force versus speed curve may not be less than one pound for each six knots it's quite interesting if you look at the European certification criteria is that they
took this exact paragraph and just translated the US units into metric units but really calculated the new values so the European certification have now very strange values like I don't know 11.79 kilometres per hour per second or something
like that it's really strange so you can see where it comes from but they said we can't have knots even though the entire world except Russia and China basically flies in knots even Western Europe but the criteria in the certification specification need to be in kilometres per hour well I would have thought you would even
if you do the conversion you would use metres per second but it used kilometres per hour for whatever reason so due to the aerodynamic changes that were made the MAX did not quite fulfil the criteria to the letter so something had to be done and as I said
mechanical redesign was out of the question because it would have taken too long, would have been too expensive and maybe would have broken the type certificate commonality so they introduced just this little additional software in a computer that also existed already and so it measures angle of attack, it measures air
speed and a few other parameters flap configuration for example and then it applies nose down, pitch trim as it sees fit but it has a rather interesting design from a software engineering point of view can you read that? the idea is that there are flight control computers
and one part of this flight control computer, one additional piece of software is called the AMCAS, the manoeuvring characteristics augmentation system and the flight control computer actually gets input from both angle of attack sensors it has two, one on each side for redundancy but the AMCAS algorithm
only uses one of them at least in the old version and in the new version it will probably use both if it ever gets recertificated and then if that angle of attack sensor senses a value that is too high then it introduces nose down trim and it may switch
between flights, between the left and the right sensor but at any given time for any given flight it only ever uses one so what could possibly go wrong? and here we can see what went wrong, it's the same graph as before and I may direct your
attention to this red line that says angle of attack indicated left and the green line which says angle of attack indicated right so that is the data that the computer got from the angle of attack sensors, both are recorded in the data recorder but only one is evaluated by the AMCAS and you can see, here's the scale
on the right, you can see that the one is indicating relatively normally around zero a bit above zero, which is to be expected during takeoff and climb and the red value is about 20 degrees higher and of course that is above the
threshold at which the AMCAS activates so it activates and apparently in the old version of the software there were no sanity checks, no cross checks with other air data values like airspeed and altitude or other things and it would be relatively easy to do, not quite trivial, you have to get it right in these kinds of things
which influence flight controls but nothing too fancy but apparently that was also not done, so the AMCAS became active so how could it happen? and it's still to me a bit of a mystery how it
could actually get so far that it could be certified with this kind of system and the severity of each failure, the possible consequences have to be evaluated and the certification criteria specify five severities catastrophic, hazardous, major, minor
and no safety effect and that doesn't have to be analyzed any further but for catastrophic failures you have to do a very very complex risk assessment and see what you can do and what needs to be done to bring it in line to make it either mitigate the consequences or
make it so extremely improbable that it is not expected to happen so here are the probabilities with which the certification criteria deal and it's two orders of magnitude, there are usually two orders of magnitude between them, it's from a probability of 1 times 10 to the minus
5 per hour to 1 times 10 to the minus 9 per operating hour and this is the risk matrix many of you are probably familiar with those and it basically says if something is major then it may not happen with a probability of probable and if it's catastrophic
the only probability that is allowed for that is extremely improbable which is less than once in a billion flight hours and to put that into perspective the fleets with the most flight hours to date I think are in the low hundreds of millions of flight hours combined
so we're still even for the 737 or the A320 we're still quite far away from a billion flight hours so you might have expected perhaps one of these events because statistical distribution being what it is the one event might happen
of course but certainly not two in less than two years and quite obviously the severity of these failures was catastrophic I think there's no there's no discussion about that and here's the
relevant part actually about flight controls and the certification criteria which was clearly violated it says the airplane must be shown to be capable of continued safe flight for any single failure without further qualification any single system that can break must not make the plane un-flyable
or any combination of failures not shown to be extremely improbable and extremely improbable is these 10 to the minus 9 per hour and this hazard assessment must be performed for all systems of course and severity must be assigned to all these and
the unintended AMCAS activation was classified as major and let's briefly look at that what's major? A reduction in capability, maybe some injuries major damage, so nothing you can just shrug off but certainly not an accident with hundreds of dead
so and therefore there are some regulations which say which kind of kinds of specific analysis you have to do for the various categories and for major no big failure modes and defects analysis, FMAA was required
and these are all findings from the Indonesian investigation board and they're all in the report that is publicly downloadable in the final version of the slides I'll probably put some of the sources and links in there so you can read it for yourselves, it's quite eye opening
so only a very small failure failure analysis was made comparatively small, it probably took a few man hours but not as extensive as it should have been for the event had it been correctly classified as catastrophic and some of the things that could
happen were not at all considered, such as large stabilizer deflection so continued trim movement in the same direction or a repeated activation of the MCAS system because apparently the only design of the MCAS system that the FAA saw
was limited to a 0.6 degree deflection at high speeds and to one single activation only and that was changed and it is still unclear how that could happen it was changed to multiple activations even at high speed and each
activation could move the stabilizer as much as almost 2.5 degrees and there was no limit to how often it could activate and what was also not considered was the effect of the flight characteristics caused by large movements of the stabilizer
or movement of the stabilizer to the limit of the MCAS authority the MCAS doesn't have authority to move the stabilizer all the way to the mechanical stop but only a bit short of that much more than the manual electric trim is capable of trimming the airplane on the aircraft you can always trim back
with the manual electric trim switches on the yoke but you cannot trim it nose down as far as the MCAS can so that's quite interesting that that was not considered what was also not considered at least it wasn't in the report apparently that the Indonesian agency had seen
was that flight crew workload increases dramatically if you have to pull on the yoke continuously with about let's say a force equivalent to 40 kilograms or 50 kilograms continuously otherwise if you let go you're going to go into a very steep nose dive and at the
low altitude that they were they would not have been able to recover the aircraft and in fact they weren't what was also not considered was an AOA sensor failure in the way that we have seen it in these two accidents although apparently they those had different causes the effect
for the MCAS was the same that one of the sensors showed a value that was about 22 and a half degrees too high and that was not considered in the analysis of the MCAS system so I hope that is readable that is a simplified state machine of the MCAS system and what we can see
is that it can indeed activate repeatedly but only if the pilot uses the manual electric trim in between it will go into a dormant state if the pilot trims manually with the hand wheel or if the pilot doesn't use the trim at all it will go
dormant after a single activation and stay that way until electric trim is used so that's the basic upshot of this state machine so when the pilot thinks he is doing something to counter the MCAS he is actually making it worse but this isn't
documented in any pilot documentation anywhere it will probably be in the next way if it is still working like that but so far it wasn't so Boeing was under a lot of pressure to try to sell a new more fuel efficient version of their 737
and so I can't say for sure how it was internally between the FAA and Boeing but it's not unreasonable to assume that they were under a lot of pressure from management to accelerate certification and possibly take shortcuts I can't make any accusations here
but it looks that not all is well in the certification department between Boeing and the Federal Aviation Authority so originally the idea of course is the manufacturer builds the aircraft analyzes everything documents everything and the FAA checks all the documentation
and maybe even looks at original data and maybe even looks at the physical pieces that are being made for the prototype and approves or rejects the documentation there is already a potential conflict that is not there in most other countries because they have
separate agencies but the FAA has a dual mandate it is supposed to promote aviation to make it more efficient but also to ensure aviation safety and there may be conflicts of interest I think so here's what the certification has
been up until not quite sure 10, 15 years ago so the FAA, the actual government agency the admin aviation authority appoints a designated engineering representative the DER is employed and
paid by Boeing but is accountable only to the FAA and the DER checks and documents everything that is being done there's usually more than one but for simplicity's sake let's say the DER then reports
the findings and all the documentation all the low level engineering and analysis documentation that has been done to the FAA and the FAA signs off on that or asks questions and visits the company and looks at things and makes audits and everything like that and so that usually has been working
more or less and has certainly improved the overall safety of airliners that have been built in the last decades and this is the new version and so the person is now not called DER but is called AR the authorized
representative is still employed and paid by Boeing that hasn't changed but is appointed by Boeing management and reports to Boeing management and the Boeing management compiles a report and sends that to the FAA and the FAA then signs off on the report they hopefully at least
read it but they don't have all the low level engineering details readily available and only rarely speak to the actual engineers so anyone seeing a problem here? Well you have to say that
most aircraft that are being built have been built in the last years aren't really terrible the 787 is a new aircraft the 777 has been one of the safest aircraft around at least looking at the flight hours that it has accumulated
so it's not all bad but there's potential for for real really bad screw ups I guess there's another factor maybe that I've briefly mentioned is that the Boeing 737 even in its latest version is not computer controlled it's not fly
by wire although it has some computers as we have seen that can move some control surfaces but mostly it really looks like that I think that's an actual photo from a 737 it has some corrosion on it so it's probably not an older version but it's basically the same which is also why the grandfathering certification still
works so it's all cables and pulleys and even if both hydraulic systems fail so yes it is hydraulically assisted the flight controls but if both hydraulic systems fail with the combined forces of both pilots you can still fly it and you can still land it that usually works
except when it doesn't and the cases where it doesn't work are when the aircraft is going very fast and has a very high stabilizer deflection and this is from a video some of you may have seen that it's from Mentor pilot and he has actually tested that in a full
flight simulator which represents realistic forces on all flight controls including the trim wheel you can see in the center console under the thrust levers there are these two shiny black wheels and they are the trim wheels you can move them manually in all phases of flight to trim the
aircraft if electric trim is not available. The normal trim system would not do this okay it would require manual trim to get it away from this that's fine, all fine trim it backward, trim it backward as you can so now he's trying to trim it nose up again after he has manually trimmed it
nose down because the normal electric trim system cannot trim it so far nose down they have to do it manually and now he's trying to trim it back nose up from a position which is known from the flight data recorder that it was in in the accident flights and he's trying to trim it manually because some people said
turn off the electric trim the electric trim system and trim it manually that will always work and they are trying to do that and it has representative forces to the real aircraft and you can see that the pilot on the left
the captain can't even help him in theory both could turn the crank at the same time they have a handle on both sides because he has to hold the control column with all his force so he can't let go, he must hold it with both arms otherwise it would go into a nose dive
immediately and this is the physical situation with which the pilots were confronted in the accident flights and he now says press the red button in the simulator so end the simulation because it's clear that they are going to crash
so there's another thing that came that came up after the accident and 737 pilot said oh it's just a runaway trim runaway stabilizer trim there's a procedure for that and just do the procedure and you'll be fine well, runaway stabilizer trim is one of the emergency
procedures that is trained at Infinitum right, that's something that every 737 pilot is aware of because there are some conditions under which the trim motor always gets electric current and doesn't stop running that just happens occasionally, not very often but occasionally and every pilot
is primed to recognize the symptoms saying oh this is runaway runaway stabilizer and you turn off the electric motors for the stabilizer trim and trim manually and that'll work but if you look at what are the actual symptoms of runaway stabilizer it says uncommanded stabilizer
trim movement occurs continuously and AMCAS movement isn't continuously AMCAS trim movement is more like the speed trim system which occurs intermittently and then stops and then trims again for a bit and then stops again so most pilots wouldn't recognize this as a runaway trim because the symptoms are very different
the circumstances are different so I guess some pilots might have recognized that there's something going on with the trim that is not right and will have turned it off but some didn't even though they all know about runaway stabilizer
and yeah that's the second file that I have so that's the sound the stick shaker makes on a Boeing 737 and now imagine flying with that sound
all the while shaking the control column violently flying with that going on for an hour and that's what the crew on the previous flight did they flew the entire flight of about an hour with the stick shaker going I mean that's quite interesting because the stick shaker says your wing is about to stall
right but on the other hand they knew they were flying level they were flying fast enough everything was fine the aircraft wasn't about to stall because it was going fast so from an aerodynamics perspective of course they could fly the airplane because they knew it was nowhere near a stall
but still I think in most countries and most airlines they would have just turned around and landed again and saying the aircraft is broken please fix it something is wrong but yeah so the stick shakers are activated by the angle of attack on each side and but the sticks
are mechanically coupled so both of them will shake with activation from either side so is it going to fly again? it's still somewhat of an open question but I suspect that it will because it's it's hard to imagine that letting these 460 airplanes or something like that that have been built
sometimes sitting around on employee parking lots like here just letting them be scrapped or whatever I don't know almost 5,000 have been ordered as I said neither airlines nor Boeing will be happy but it's not quite
clear, it's not yet being certified again so it's still un-air-worthy so there's another little thing certification issues with new Boeing aircraft reminded me of this, have you ever seen that?
so battery exhaust, which aircraft has a battery exhaust? I mean, what do you do with that? does anybody know? yeah, of course, some know Boeing 787 Dreamliner less than two years after introduction or after entry into service actually had two major
battery fires they have two big lithium ion batteries lithium lithium cobalt, I think I'm not sure the one that burns the brightest really because they wanted the energy density really and that wasn't available in other packages
if they had used nickel cadmium batteries instead they would have been like 40 kilograms heavier for two batteries that's almost a passenger so, yeah, they were on-board fires and if you ask pilots what's your worst fear of something happening in flight, they'll say
flight control failure and fire so you don't want to have a fire in the air, absolutely not and one of the fires was actually in flight with passengers on board one was on the ground shortly after disembarking and the lithium ion batteries, because they are
unusual and novel features as it's called, have special certification conditions, because they are not covered by the original certification criteria and it says here safe cell temperatures and pressures must be maintained during any foreseeable condition and during any failure of the charging system not shown to be extremely
extremely remote sorry and extremely remote is actually two orders of magnitude more frequent than extremely improbable extremely remote is only less than once every 10 million flight hours but I think the combined flight hours for the 787 at that time were
not quite sure maybe a few hundred thousand at most so and it also happened two times that was not really not really fun and then it says no explosive toxic gases emitted as a result of any failure may accumulate in hazardous quantities within the airplane
I think they've neatly solved the third point by putting the battery in a stainless steel box, really thick walls maybe, I don't know, 8 millimetres or something like that and piping them to this hole in the bottom of the aircraft so the gases cannot accumulate in the
aircraft, obviously so, yes, and with that, I'm at the end of my talk and there's now, I think, quite some time for questions thank you
extremely punctual, I have to say thank you for this interesting talk we do have the opportunity for quite some questions and a healthy discussion please come to the microphones that we have distributed through the hall and while you queue up behind them do we have a question from the internet already?
Do you signal Angel? Is your microphone working? Do you think extensive software tests could have solved the situation? Software tests, in this case perhaps, yes, although software
tests are really a problematic thing because to test software to these extreme reliabilities required you really have to test them for a very, very, very very long time indeed so to achieve some confidence say of 99% that a failure will not occur in, say 10 million hours, you'll have to test it for
45 million hours, really and you have to test it with the exact conditions that will occur in flight and apparently nobody thought of an angle of attack failure angle of attack sensor failure so maybe testing wouldn't have done a lot in this case Thank you, microphone
number 4 Yes, thank you for the talk I have a question concerning grounding so what is your view that the FAA waited so long until they finally grounded the aircraft a week after I think the Chinese started with grounding Yes, that's a good point and I think it's an absolute disgrace that they waited so long
even after the first crash they made an internal study and it was reported in the news some weeks ago and estimated that during the lifetime of the 737 MAX probably around 15 aircraft would crash, so say every 2-3 years one of them would crash and they still didn't ground it and waited until 4 days after
the second accident, yes it's a shame really Thank you, microphone number 7 please Thank you for your talk I have a question regarding the design decision to only use one AOA sensor so I've read that Boeing used the AMCA system before
on a military aircraft and that used both sensors, so why was the decision made to downgrade? Yeah, that's a good question I'm not aware of that military system, if that was really exactly the same but if that's the case yes, that makes it even stranger that they chose to use only one in this case yes, thank you
Okay, microphone number 2 please Yeah, thank you for your talk so how do you actually test these requirements in practice how do you determine in practice if something is likely to fail every 10 to the minus 9 as opposed to every 10 to the minus 8
No, that's obviously practically completely impossible, why you can't as I said, if you want to have reasonable confidence that it's really the error rate is really so low, you'd have to test it for 4.5 billion hours in operation, which is just impossible what instead is done there are some
industry standards for aviation that is D0178 currently in revision C and that says if you have software that if it fails may have consequences of this severity then you have to use these very strict very formal methods for developing the software like doing very strict and formal requirements
analysis specification in a formal language preferably and if possible and some companies actually do that formally prove your source code correct and in some languages that can be done but it's very it's a lot of effort and that's how
this should be done, and this software obviously should have been developed to the highest level according to D0178 which is level A, and quite obviously it wasn't Thank you, Signal Angel please, the next question from the internet You talk focused mostly on Ncast but someone noted that the plane
was actually designed for engines below the wings and already in the NG model so the one before, already had problems with the wing mounts and engine mounts Do you think there will be mechanical problems with the MAX2? I'm not sure there were really mechanical problems there were aerodynamic problems and apparently well I'm sure they have tested the NG to the same standards
to the same certification standards because obviously there were aerodynamic changes even with the NG and the NG apparently still fulfilled the formal criteria of the certification there are some acceptable means of compliance and quite specific descriptions how you test these stick forces versus air speed and as far as I know
the NG just fulfilled them and the MAX just didn't so for the MAX something was required although even the classic which basically had the same engines as the NG, even the classic had some problems there and that's where the speed trim system was introduced and yeah, so it has a similar system
and actually the AMCAS is just another little algorithm in the computer because it also does the speed trim system Please stay seated and buckle up until we have reached our parking position No, we are still in the Q&A phase, please stay seated and please be quiet so we can enjoy all of this talk and if you have to have to leave then
be super quiet right now it's way too loud in here Please, the next question from microphone number 1 So considering lessons learned from this accident, has the FAA already changed the certification process or are they about to change it or what about other agencies worldwide? The FAA
is probably going to move very slow and I'm not aware of any specific changes yet but I haven't looked into too much detail in that. Other certification agencies work somewhat different and at least the EASA in Europe and the Chinese authorities have already indicated that in this case they are not going to follow the
FAA certification but going to do their own and until now it was usually the case that if the FAA certified the airplane everybody else in the world just took that certification and said what the FAA did is probably fine and vice versa when the EASA certified a Boeing airplane then the FAA would also certify it and that is probably
changing now Thank you, microphone number 3 So, hi Thank you for this talk Two questions please Were you part of an official investigation or is this your own analysis of the facts? And the other one, I heard something
about the software being outsourced to India Can you comment on that please? The first one, no this is my own private analysis I have been doing accident analysis for a living for a while but not for any official agency but always for private customers
and about outsourcing to India, I'm not quite sure about that, I've read something like that what I've read is that it was produced by Honeywell I think, I may be wrong about that but I think it was Honeywell and who the actual programmers were sitting if it's done properly according to
the methodologies prescribed by DO-178 and fulfilling all those requirements then where the programmers sit is actually not that important and I don't want it to write Indian programmers and I think if it's done according to specification
and analyzed with static code analysis and everything else vis-a-vis the specification then that would also be fine I guess but the problem is not so much really in the implementation but in the design of the system, in the architecture Thank you Microphone number 5 please
Hello I may got your presentation wrong but for me the real root cause of the problem is the competition and high deadline from the management so the question for you is is there any
suggestions from you that the process could be I don't know maybe changed in order to in order to avoid the bugs in the in the software and have the mission critical systems saved
Yeah so we don't normally just talk about the cause or the root cause but there are always several causes basically you can say depending on where you stop with the graph where is it where you stop with the graph all the leaves all the leaves in the graph are root causes
and but I've stopped relatively early and not gone into any more detail on that but yeah the competition between Airbus and Boeing obviously was a big factor in this and I don't suppose you suggest that we abolish competition in the market but what needs to be changed I think is the way
certification is done and that requires the FAA reasserting its authority much more and that will probably require a lot more personnel with a good engineering background and maybe that will require the FAA paying better wages so I don't know because
currently probably all the good engineers will go to Boeing instead of the FAA but the FAA dearly needs engineering expertise and lots of it Thank you, the next question we hear from microphone number 4 Hi, thank you for the talk I've heard that there is or I've heard, I've read that there's a version
of the 737 MAX 8 that did allow for a third AOA sensor to be present that served as a backup for either sensors but that this was a paid option and I have not found confirmation of this, do you know anything about this? No, I'm not aware of that as a paid
option there was something about an optional feature that was called a safety feature but I can't exactly remember what that was, maybe it was an angle of attack indicator in the cockpit that is available as an option I think for the 737 for most models
because the sensor is there anyway as for a third AOA sensor I'd be surprised if that was an option because that is a major change and requires a major change to all the system layout then you'd need an additional ADATA inertial reference unit which is a big computer box in the aircraft of which there are only two
and that would have taken a long long time in addition to develop so I'm skeptical about that third angle of attack sensor at least I've not heard of it Thank you Signal Engine, do we have more from the internet? Please one quick one If you need a
quick one, would you ever fly with a 737 Max again if it was ever cleared again? I was expecting that question and actually I don't have an answer yet for that and that maybe would depend on on how I see the FAA and the AZA doing the certification I've seen
some people saying that the 737 Max should never be recertified I think that it will be and I'll look at it in some detail seeing how the FAA develops and how the AZA is handling it and then maybe yes Great, okay
in that case we would take one more very short question from microphone number five Do you know why the important AOA sensor failed to give the correct values? There are some theories about that but I haven't investigated that in any more detail now There were some stories that in the case of the Indonesian
the Lion Air that it was actually mounted or reassembled incorrectly that would explain why there was a constant offset It may also have been somebody calculated that it was actually exactly, if you look at the raw data that is being delivered on the bus
there was exactly one flipped bit which is also a possibility but I don't really know but there were some implications in the report maybe I have to read that section again from the Indonesian authorities about substandard maintenance as it's euphemistically called Okay, we have two more minutes so I will take another question
from microphone number one I would have expected that modern aircraft would have some plug, physical plug hermetic one that would disconnect any automated system Isn't something that exists in our plans today? No, and especially modern
aircraft can't just disconnect the automatics because if you look at modern fly-by-wire aircraft there is no connection between the flight controls and the control surfaces there is only a computer and the flight controls that the pilots handle are only inputs to the computer and there is no direct connection that is true for every Airbus since the A320
for every Boeing since the 777 so the 777 and the 787 are totally 100% fly-by-wire well, I think 95% because there is one control surface that is directly connected and one spoiler on each side but basically there is no way and so you have to make sure
that the flight control software is developed to the highest possible standards because you can't turn it off because everything that's let me put it this way on the fly-by-wire aircraft only the computer can control the flight control surfaces so
just hope that it's good Think about that when you next enter a plane and also please give a big round of applause for our speaker Brian Zieker Thank you