Quote:
Originally Posted by sandeepmohan This sounds a bit scary. You as a pilot, are relying on certain information reported by a sensor, which you are sure to be right and it isn't. We now have a solution where it reports if the sensor is relaying wrong information so we can act upon it which is all good.
It now feels like, wherever a sensor is located and feeding the pilot and co pilot critical information about the plane, there needs to be another check point to confirm that the information being sent is right or wrong. Sounds like a bit of re engineering or re visiting software code, now that everything runs on software that governs hardware.
In a situation where you as a pilot are dealing with a plane falling out of the sky, several lives at stake, your brain already in panic mode wondering what to do, you now have to question the instrument you rely on. Boeing better sort this out soon. |
Many sensors on airplanes are duplicated. And the computers verify signals and outputs and in many cases figure out which sensor data to use/trust.
So the emphasis is standardising trouble shooting through specific routines, or NNC non normal check list. If a certain condition occurs, you run through the NNC, check and perform accordingly, mend the problem or stabilise the situation so you can continue.
Putting this in the context of this discussion:
Quote:
pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:
- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- Inability to engage autopilot.
- Automatic disengagement of autopilot.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the AOA indicator option is installed)
- FEEL DIFF PRESS light.
In the event an uncommanded nose down stabilizer trim is experienced on the 737 - 8 / - 9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.
|
So if a pilot encounters the above indications/effects, he/she must execute the runaway Stabilizer NNC. That would ensure the system gets disabled properly. That the MCAS system and the AoA were at the heart of it is really that not relevant.
Fact is that with a faulty sensor, just about any sensor, you will either get an alarm annunciation or some other tell tale something is wrong. You get your NNC out and start working the check list. Nothing else, flying and especially troubleshooting whilst in flight is primary running the appropriate NNC. The thinking of what such an alarm annunciation really means, what caused it, has already been done on the ground by the designers.
Irrespective of the sensor being faulty or not, you still need to act prudent. Which means running the NNC, verifying the problem is gone, or contained and move on if it has not. But once you have an alarm, you can never assume it is just the sensor. You need to establish/verify that first. You have to act as if the sensor is ok.
A good example are the various switches and sensors that provide signals to the pilot about the gear being down and locked in place. You get three green lights in the cockpit if it is down and locked as it is a called. On a modern jet there is actually a whole lot of sensors/switches and software logic involved, even though all that is visible to the pilot are three lights, going from amber to green.
It is not uncommon for some of these switches/sensors to break (they are out there in the open, so they lead a hard life, wind, rain, snow etc).
If the pilot doesn’t get three green lights during approach, he/she will go around, execute the NNC (which involves different checks and different methods of lowering the gear). If he/she still doesn’t get the three green lights, they will land, but take all the precaution as if the gear isn’t properly down and locked. They will probably talk to the tower and make a few low passes so observers can have a look at the gear. But that would just be a visual clue. If they can’t get the lights to go green, they will need to land as if the gear is not probably down and locked. Another procedure for that.
If they are lucky it is, and it becomes just another routine landing. With lots of fire engines in high pursuit thundering along the runway. Maybe foam on the runway. If there was a problem with the gear, everything possible to ensure the best outcome will have been done.
So the NNC are designed to verify/mend/disable/bypass any component, be it a sensor (e.g. AoA) or a system (e.g. MCAS).
Obviously, it is not fool proof. Nothing is.
As I mentioned earlier, it will be interesting to see if Boeing in the end does decide to amend their Operating manual, training, certification etc.
Jeroen