波音的教训

holycow

; f5 X8 {' y* R& w, o+ f2 o" i! l- T
我觉得波音在MCAS上犯糊涂的一点是对这玩意的定位模糊了，或者说evolve了。本来就是要做一个在飞行包线的特定范围内改善操纵性能的系统，Maneuvering Characteristics Augmentation System, 说明开始的时候波音完全清楚这玩意要达到什么目的：在飞行包线的大攻角范围内抵消MAX额外的抬头倾向。
0 ?& X- ?; y! Y1 H) |/ b
如果就按这个做下去，input只要给一次，退出条件也清晰，根本不需要考虑飞行员超控以后怎么办，我就是给你把飞行特性调到跟NG一样，你正常拉杆在NG上不失速在MAX上也不会失速；乱拉杆在NG上会失速到MAX照样失速。
" o. F  g& j& E% i: x+ d
/ ?, ^, X4 t7 i) f7 N) ^不知道什么时候开始把它做成了一个stall prevention system, 这才扯出来飞行员超控以后怎么办，系统无限多次给输入，导致权限无穷高这种事。而且照着Maneuvering Characteristics Augmentation的原始设计去做，肯定不能满足stall prevention的安全要求。

攻角传感器两个信号互相校验Vs一路信号输入这个我是这样看的：
7 s0 g1 d( R: e; b3 X( z
) {9 W9 h0 ^$ a. P两个信号校验，MCAS不启动的概率是两个传感器任意一个失效的概率，这种情况下会失速
: M2 |( f: V1 j* j. M. y一路信号独裁，MCAS误启动的概率是这个传感器失效的概率，这种情况下会俯冲
9 i5 T$ X4 F& X: L5 p' D
波音算了一下，选了第二方案
% N5 E, p2 _3 S' _3 ]1 r" h
再一点，"对飞行员透明"的这个想定，不光现在事后诸葛亮来看是错的，当初就应该知道是错的。整个的逻辑就是“有了MCAS，MAX和NG的飞行特性就一样了”，然后推出"MCAS是对飞行员透明的"。问题是没有考虑failure mode，MCAS失效的情况下，MAX和NG的飞行特性是不一样的，想到这一点完全不需要预见到类似狮航和埃塞航空难的先见之明。

holycow

晨枫 发表于 2019-3-16 18:22
4 a8 `) O1 g# E这叫scope creep，很危险的东西，不知不觉就超过了原来的安全界限，另一种温水煮青蛙 ...

当年做MAX之前波音民机部的头就说这个项目的第一要点就是要严控scope creep

holycow

马鹿 发表于 2019-3-16 19:05
0 n" W; S) l5 W  }. f  S7 e你提到failure mode, 我有点好奇了这传感器的问题, 系统的FMEA咋通过的

9 T3 m0 U5 G8 r4 v7 r所以这次很明显FAA的certification process 出问题了

holycow

今天西雅图时报的报道，Wow, just wow

https://www.seattletimes.com/bus ... the-lion-air-crash/

holycow

晨枫 发表于 2019-3-17 11:18
哇！好多信息是已知的，但这个上报0.6度实际2.5度太离谱了，这上法庭的时候，根本毫无辩解余地啊！

" @8 K: N$ f  M0 {4 L0 y还好 ...

% I& h- ^* V) \/ S+ I

Thoughts on Seattle Times article published Sunday morning Seattle time
8 `6 d# K7 A- C
This article is generally well written and seems quite accurate. One point of clarification is that early on in the 737MAX development it was thought that MCAS would only be needed at particularly high Mach numbers. For those conditions the prediction was that the original 0.6 degrees of MCAS stabilizer authority would be sufficient. That proved to be pretty close to the case during flight testing and the final MCAS increment size for cruise and higher Mach numbers is very close to 0.6 deg. Later on it was determined that MCAS would also be needed at lower Mach numbers. With that extension of MCAS came the MCAS authority vs. Mach number schedule that is in the current design. The high Mach end of that schedule is approximately 0.6 degrees. Only with Mach Number less than 0.4 is the MCAS authority 2.5 degrees. The larger authority at lower Mach numbers is needed as the effectiveness of the horizontal stabilizer is less at lower speed. It is quite common that flight control functions are given higher authority at lower airspeed and less authority at airspeed increases.

1. 这个解释了scope creep的一部分原因
0 H" Q+ E+ d/ s2. 解释了包子那本看起来自相矛盾的波音手册是怎么来的：一部分是改变以前的文字，一部分是更改以后的说明
3. Now if part of the fix is to limit stab trim, what about low mach scenario where that degree of trim was considered necessary?

holycow

晨枫 发表于 2019-3-17 16:16
4 H4 O9 U" U: v赞！这就说得通了！但看来在low mach number的时候，也还是需要限制一下，但怎么在control authority不足 ...

+ `& ^- d' \9 Q, E, Z- J) z
" Q* U/ M, Z) A上面那个Boeing insider的帖子只说后来决定低速时也要MCAS，没说为什么。昨晚WSJ关于司法部调查波音的新闻里有这么一段：
- X0 m1 x7 D, b

But as the en­gi­neer­ing ef­fort and flight tests pro­gressed, ac­cord­ing to in­dus­try and FAA of­fi­cials fa­mil­iar with the process, the Boe­ing team saw the same fea­ture as a po­ten­tially im­por­tant safety net for a dif­fer­ent haz­ard high­lighted in pre­vi­ous crashes: lower-al­ti­tude stalls in which star­tled pi­lots mis­tak­enly pulled back on the con­trols and some­times crashed air­craft. FAA of­fi­cials also rec­og­nized the po­ten­tial ben­e­fits and ap­proved the sys­tem as part of the over­all MAX ap­proval.

5 A' z; A# B! J! R. a如果属实，纯属有些人聪明过头。这也解释了为什么fix要restrict authority, 突然间又不担心低速了