Severe Stabilizer Mistrim - Pitch Upset - Challenger 300 N300ER - One Fatality

A Bombardier Challenger 300, N300ER, encountered an upset when the flight crew disconnected the autopilot while suffering from a nose-up mistrim situation. The mistrim was the result from a failure of the autopilot stabilizer trim control. The upset resulted in a roller coaster exceeding +4g and -2g, eventually brought under control by the flight crew. Tragically, a passenger was fatally injured in the upset.

The flight crew made several mistakes unrelated to the upset. They also apparently disregarded the caution alerting them to the mistrim. The NTSB preliminary report provides an account of the accident. The final report will provide analysis and probable cause. This post goes through the preliminary report and offers some additional commentary and excerpts from an operation manual of the same type aircraft.

Satshow 2023 Tuesday - The Exhibit Hall is Open!

Satshow 2023 is a gathering of service providers, equipment suppliers, technology wizards and a reunion of the many people involved in satellite communication. Held once again in the Washington Convention Center, the show runs four days long: Monday dedicated to lectures and an exhibit hall open Tuesday through Thursday, with speakers continuing alongside. 

Engineer Week - 2023

I was asked to speak to a group of engineers today. Here were the questions I was asked and my talking points. What did I miss?

Long Live the 747

I have a fondness for the 747-400.

Goodbye Twitter - Where to go now?

I have deleted my account on Twitter (satcom_guru).

While I cannot support the platform, I am anxious to support the community that I have grown so fond of.  This is my list of who I enjoyed from hearing from, learned from, or inspired me to jump into a new rabbit hole. This post will be updated frequently.

I intend to stay here on this site, but may also post occasionally at LinkedIn. 

SJ182 A Sequence to Tragedy

On 9 January 2021, a Boeing 737-500 aircraft, registration PK-CLC, was on a scheduled domestic flight, from Soekarno-Hatta International Airport (WIII), Jakarta, to Supadio International Airport (WIOO), Pontianak. PT Sriwijaya Air flight SJ182 crashed into the sea about five minutes later, with all 62 lives lost in the tragedy. Weather conditions for the mid-afternoon flight were not considered a factor.

The Captain was the pilot flying (PF). The 54 year old Captain had nearly 18,000 flight hours, over 9,000 in the 737. The 34 year old First Officer, pilot managing (PM), had over 5,000 flight hours, virtually all on the 737.

KNKT, Komite Nasional Keselamatan Transportasi is the Indonesia Independent Investigation Authority also known as National Transportation Safety Committee / NTSC) released the final accident report on 10 Nov 2022.

Elon Musk Starlink Update MWC2021

Elon Musk joined the Mobile Wireless Congress for a thirty-minute keynote address. His online presentation did not reveal much new information about Starlink but did provide confirmation and consistency from other remarks and with regulatory filings available to the public. 

737 MAX Timeline and Links

Black: satcom.guru

Blue: FAA

Gray: Other

Red: Accident or Accident Report

Sriwijaya Air flight SJ182

Sriwijaya Air flight SJ182 crashed shortly after take off from Jakarta on 9 January 2021. The flight, operated by 737-500 registered PK-CLC, departed at 07:36 UTC (14:36 local time). The last ADS-B signal from the aircraft was received by Flightradar24 at 07:40 UTC (flightradar24.com).

(airplane attitude not representative as shown)

The airplane appears to be destroyed on impact with all 62 lives lost. 

Sorrow for the victims and for those that loved them.

Mid-Value Select (MVS): Goldilocks in the House of MCAS

Angle of Attack (AoA) is measured on the 737MAX using two AoA vanes, one installed on the left side of the airplane and the other on the right side. While each AoA vane is calibrated and precise, inferring AoA directly overlooks local aerodynamic factors that can cause the sensor reading to diverge from the desired value, notably with sideslip. A tolerance exists from what the AoA vane senses and the expected value. The question arises, how to manage AoA sensor tolerances or undesired behavior to maximize availability of desired functionality, while limiting exposure to undesired hazards?

I know it when I see it

video of the entire presentation.

FANS - 25 year Anniversary

Future Air Navigation System (FANS) was first certificated in 1995. Boeing proposed a Type Certificate Amendment for remote certification on a QANTAS 747-400 (VH-OJQ), flying out of Sydney, Australia. The first official in-service flight with FANS departed Sydney on 22 June 1995. A memorable date, as ARINC 622 was the breakthrough specification that set aside ATN subnetworking and allowed ACARS to be utilized, for immediate and lasting benefit.

Elon Musk Keynote - Satellite 2020

Elon Musk delivered the keynote at Satellite 2020. These were my notes with some comments.

• innovation is insufficient
• the sign of success is not going bankrupt
• focus on achieving something soon, if the schedule is wrong, the design is wrong
• the bigger the rocket the more affordable the service
• learning is inherently accessible to everyone

The Third-Generation of Broadband Aeronautical Satellite Communications

As a new decade arrives, broadband aeronautical satellite communications are moving into a third generation. Multiple modems and multi-beam antennas are creating a multi-dimensional interface challenge that only fiber optic cables can support, which will lower the weight along with expanding the horizons.

Additional Modem Unit

Flawed Assumptions Pave a Path to Disaster

When MCAS (Maneuvering Characteristics Augmentation System) was implicated after Lion Air JT610 plunged into the sea, tragically taking 189 lives, the spotlights converged on the malfunction of a single Angle of Attack (AoA) vane. My first thoughts were that Boeing had some how overlooked this scenario or viewed it as inconsequential, based on blind faith that no matter what, the pilot would remain vigilant taking correct and timely action as the safety backstop. I could not wrap my head on how repeated applications of MCAS did not create unlimited authority in malfunction which would create a HAZARDOUS hazard.

Boeing had declared MCAS malfunction a MAJOR hazard.

JT610 Final Report

Why wasn't an MCAS malfunction treated as HAZARDOUS, which would have mandated a dual-channel, fail-safe design?

The answer lies in a number of buckets, which overflow beyond just MCAS:

• a desire to justify design rather than direct safety
• over-use of a convenient test condition restriction
• blind reliance on unproven pilot response
• misunderstanding the ramifications from removing an under-appreciated safety interlock
• ignoring escalation from the combination of persistent hazards
• incorrectly applying a convenient probabilistic factor to dodge the obvious conclusion
• overlooking the ramifications from extending Speed Trim to provide Stall Identification

AEEC Ku/Ka Satcom Subcommittee - Sep 2019 Meeting Report

The SAE-ITC AEEC Ku/Ka Satcom Subcommittee met at the Boeing Integrated Aircraft Systems Lab (IASL) for three days of deliberations revolving around aeronautical satellite communications.

Topics discussed included:

• Smaller form-factor antenna
• Thermal management of solid-state antennas
• Replaceable/Multiple Modems
• Standard Ka/Ku-band Antenna
• Enhanced Terminal Security
• Enhanced Network Security
• IF/RF over Fiber (modem to antenna)
• Baseband over Fiber (modem to antenna)
• Additional radios under the radome

737 AoA and Redundancy

The undetected failure of one Angle of Attack (AoA) sensor can spawn a host of flight deck effects on the Boeing 737. AoA malfunction is the root stimulus that triggered the events that unfolded on Lion Air JT610 and Ethiopian ET302. The challenge is to decrease the likelihood of undetected malfunction while retaining acceptable loss of function. The simplest and most effective strategy is to boost the ability to recognize a failed AoA sensor without reference to any other AoA sensor. The most complex solution would be to install or to derive additional AoA readings and which can still result in malfunction.

Postcards from Destination Moon: The Apollo 11 Mission

The Museum of Flight hosting of the Smithsonian Apollo 11 Exhibition, along with many notable additions, is drawing to a close. With the fifty year anniversary to celebrate, I visited the show along with my wife and youngest son. My wife and I were both eleven when Apollo 11 flew its historic mission. I was living Fort Lauderdale, looking longingly (and without reward) to the north whenever a rocket was launched.  The mission was certainly an inspiration to me then, but frankly, I am more and more impressed as time goes by. The dedication and willingness to take great risks, the methodical engineering coupled with pushing scientific breakthroughs as required, the clean sheet approach to the unknown number of challenges; truly a great example of what a society can accomplish if it chooses to. And we chose to!

Connecting the Dots: From Command to Action

The 737 stabilizer trim system evolved from its 707 roots with the introduction of the NG, when separate Main and Autopilot Actuators were combined into a single stabilizer actuator, retaining two electrical interfaces. The basic tenants were: 

1. Manual trim (by trim wheel) has highest priority
2. Electric trim has second priority
3. Autopilot trim has lowest priority
4. Significant column aft movement shall inhibit airplane nose down trim commands
5. Significant column fwd movement shall inhibit electric airplane nose up trim commands
6. Two cutout switches are used together to remove both Electric and Autopilot trim commands
7. Stabilizer travel shall be limited to the same point during airplane nose up motion
8. Stabilizer travel shall be limited using to an intermediate point while flaps up, using electric trim 
1. to limit the nose down runaway mistrim
9. Stabilizer travel shall be limited using autopilot airplane trim nose down to the flaps down limit
1. autopilot "in command" stab trim objective is to maximize elevator authority
1. Stab Trim fail indicator provided if trim ineffective
2. NG FCC speed trim schedule was extended to stall speeds, to facilitate stall recovery
1. Speed Trim fail indicator if command does not match monitor command
10. Fast Electric trim speed is selected when flaps-not-up
11. FCC fast trim speed is commanded by FCC based on flaps down

The 737 MAX revised the pitch trim system to accommodate MCAS. MCAS intruded upon the long-held stabilizer control logic because it was designed to command with nose down stab trim even while the column is significantly pulled back (aft column cutout). MCAS design includes an override feature to allow FCC airplane nose down stab trim to continue in the presence of opposing column movement (tenant 4, above).  MCAS also tripled the trim rate, increasing the mistrim in any runaway scenario.

Movable Stabilizer

Swept-wing airplanes inevitably suffer from pitch-up near stall, due to the tendency for their wing tips to stall before the wing root. This same effect is compounded by compressibility effects when nearing stall at high altitude (which brings high Mach number into play).

The fuselage itself can contribute to pitch-up at high angles of attack. An example of that can be related to the 737MAX engine nacelles (or pods).

Gen. Chuck Yeager credited the trimmable stabilizer as the key technology for dealing with Mach Tuck, or shifting the lift aft with supersonic speeds causing a pitch down. While Mach Tuck is managed separately, the principal objective with a trimmable stabilizer is to minimize drag along with maximizing the elevator for whatever flight condition or center of gravity.

The following discussion is based largely on the writing of D. P. Davies, Handling the Big Jets, third edition. I have copied in some of his figures in the discussion. Anyone interested in these matters is highly encouraged to obtain and read his book, it is amazing.

Various regulatory factors are listed at the end.

737 Pitch Trim Incidents

REVISED TO INCLUDE OTHER EVENTS => 23 JUNE 2019

Pitch trim is an abstract term to represent the ability to reduce column forces by moving the stabilizer and elevator. This post will dwell on stabilizer trim reported difficulties.

All airplanes provide at least two means to trim the stabilizer, mostly using two seperate actuators motors. Starting with the NG, the Boeing 737 relies on only one electric trim actuator, with manual wheel trim as the backup. There is no documented 737 accident as a result of stabilizer/pitch trim malfunction or failure (prior to JT610 and ET302).

With sparse reporting to draw from, it can be surmised that a stabilizer runaway or failure occurs about once a month, with a jam about once a year (world-wide).  Just plugging this into a spreadsheet yields the failure rate for runaway, loss of function and jam.  I am just assuming about 5,000 737 during the time frame for the failures accounted for, and looking ahead with a larger fleet size.

Ethiopian ET302 encountered high opposing forces due to the mistrim; it has been assumed that the ET302 actuator was not jammed, and there has been no concern raised that the ET302 clutch would have oppressively opposed trimming manually, on top of the aero loads.

The Beat Goes On

On Wed, May 15, House Transportation and Infrastructure Committee, Aviation Subcommittee convened a Hearing with the NTSB and FAA regarding 737 MAX airworthiness.  Information was provided, that which was new, still confusing, important, repeated, wrong, left out, and offensive.

What happened on ET302?

The preliminary report for ET302 reveals many details, but not enough to know exactly every and all aspects. The following is a look at what can be learned.

Trim Cutout with Severe Out-of-Trim Stabilizer can be difficult to recover

The Wall Street Journal reports that the crew on ET302 used the stabilizer trim cutout switches in response to MCAS commands, but appeared to be unable to raise the nose. They then released the cutout switches to use electric trim, but encountered MCAS commands again without recovering.

One possible explanation is that the loads on the jackscrew due to the severe stabilizer nose down out-of-trim situation were too great for the pilot to overcome using the trim wheel with folding handle. The pilots restored electric trim as a means to trim.

Boeing published a technique in the past that discussed this issue and the need to release the column briefly in a series of "roller coaster" or "yo yo" maneuvers, by cranking in stabilizer trim alternatively with large column commands.

This is in a 737NG Flight Crew Ops Manual

This is in the 737NG training manual:

Manual Stabilizer TrimIf manual stabilizer trim is necessary, ensure both stabilizer trim cutout switches are in CUTOUT prior to extending the manual trim wheel handles.Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually.Anticipate the trim changes required for the approach. Configure the airplane early in the approach. When reaching the landing configuration, maintain as constant a trim setting as possible. If a go-around is required, anticipate the trim changes as airspeed increases.

This is in a 737 QRH (Ref 9.15)

This is from the Airworthiness Directive. It seems quite pertinent to emphasize using the electric trim to get the stabilizer near to an in-trim condition before hitting the cutout switch.

REVISED 11:40pm 3 Apr - Added discussion at end regarding cutout switch change

REVISED 7:43pm 4 April - Adjusted the Stab Nose Down trim representation to be zero lift

REVISED 9:20am 5 Apr - Added Stab Nose Down trim at Autopilot travel limit

AoA Vane must have Failed, the Boeing Fix is In, Senate Grills FAA

New information confirms that MAX is similar to the NG, that the AoA analog interface is connected to two different computers, the Stall Management Yaw Damper (SMYD) and Air Data Inertial Reference Unit ADIRU) (which supplies the Flight Control Computer (FCC)). The SMYD uses AoA for Stall Warning and is evident by activation of Stick Shaker. FCC hosts MCAS, and if AoA from ADIRU too high it can trigger MCAS. The significance is that both SMYD and FCC responded to AoA large bias on JT043/JT610, and therefore, the AoA sensor must have been producing that erroneous output. The AoA sensor is what failed.

Boeing has confirmed that AoA disagree Alert will become basic, that AoA disagree will inhibit MCAS from triggering, and that MCAS cannot issue more than one trim command without AoA recovery. 

The Senate grilled FAA acting Administrator Dan Elwell over excessive delegations and allowing Boeing to sell "safety critical items". Elwell stumbled on some key points, notably describing the 737 MAX as Fly-By-Wire and that the aft column cutout switch can stop MCAS trim commands.

Both Boeing and the FAA continue to insist that MCAS "runaway" is easy to detect and simple to respond to, but neither of these claims align with observations.

How Did MCAS Get Here and What Hurdles Remain?

The Seattle Times reported that the development of MCAS was limited to features that would not jeopardize differences training, including any new warning light.

“A single point of failure is an absolute no-no,” said one former Boeing engineer who worked on the MAX"

"Rick Ludtke, a former Boeing engineer who worked on designing the interfaces on the MAX’s flight deck, said managers mandated that any differences from the previous 737 had to be small enough that they wouldn’t trigger the need for pilots to undergo new simulator training."

"He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off. And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table." 

"Matt Menza, a former Boeing pilot who worked on the MAX, said that during flight testing of planes ready for delivery, he wasn’t aware of any events that indicated a problem with the stall warning or the MCAS system. But he said an ideal system would have been built on two angle-of-attack probes, so that a single bad value wouldn’t cause problems. Menza and two other pilots who have worked on the MAX said they were unaware that the system used only one AOA probe."

REVISED 27 March 10am - ADDED AC120-53B FSB discussion

Taking the Next Steps while Awaiting on the Preliminary Report from ET302

Little new information has been released offering any specific detail on the events regarding ET302, except vague statements of similarities to JT610. It has been reported that a flight observer on JT043 identified the stabilizer cutout as a corrective measure. Further, it has been reported that the crew on JT610 were calm and methodical in trying to identify the source of their difficulty, and that control was lost shortly after the First Officer took over. This last point confirmed my thoughts from examining the flight data back in November, where it looked like the column forces had been transferred just prior to the final MCAS trim commands.

Ethiopian ET302 similarities to Lion Air JT610

Reports from Ethiopian investigators have implicated the same Angle of Attack (AoA) sensor malfunction that was observed on Lion Air. Lion Air captain AoA sensor read about 22 degrees higher than the First Officer AoA sensor (a large bias error). Initial assessment of Lion Air AoA failure modes did not reveal any obvious electrical malfunction that could create the bias. The simplest explanation was that the AoA vane had been bent, causing a gross aerodynamic offset in the readings. If ET302 encountered the exact same offset, with the likelihood of it being bent exactly the same way not being conceivable, some other factor must be in play. For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA values (all other bits would match).  Is it possible that the ARINC 429 word is getting corrupted (software defect)?  If the ET302 offset was something like 20 or 24, this theory falls apart.

With this in mind, what are the issues left to restore 737 MAX airworthiness?

What have we learned this week?

The crash of Ethiopian ET302 brought a tragic beginning to what must be one of the worst weeks in aviation, ending with the grounding of the Boeing 737 MAX. What does Lion Air JT043 and JT610 teach us? Did we, as an industry do everything we should after JT610? Accusations of impropriety levied at Boeing and the FAA seemingly are always on the ready. Adding to the week was an update on Atlas 5Y3591 which at first seemed to be one thing, but with a slight wording change thankfully seems to be another altogether.

Comparing Ethiopian ET302 to Lion Air JT043, JT610

Did Ethiopian ET302 succumb to the same situation as Lion Air JT610? The FDR and CVR data is being processed as I write this, with a public release in some form expected by Monday March 18. Aviation authorities have grounded the Boeing 737 Max before receiving a report from this recorder data. The only information to the public is from commercial ADS-B data brokers, notably Flightradar24.com, whose recording is incomplete. Aireon has shared space-based ADS-B data with several parties, but not to the public. Canada and the US make reference to the Aireon data as a factor in their assessment, with the claim that there were sufficient similarities to be concerned.

Atlas Air 5Y3591 Dove because of Nose-Down Elevator Command

The NTSB has revealed that Atlas Air 767 Freighter flight 5Y3591 dove based on nose-down elevator command. The nose was pushed over 49 degrees nose down. The engines were brought up to full thrust. There was no stall warning that preceding these actions. The dive reached 430 knots before impacting. Pitch attitude rose from -49 deg. to -20 deg. in the dive.

Exploring Rain Fade in an Extreme Rain Fall Zone

Rain Fade is a factor with Ku-band and Ka-band satellite communications.  Rainfall rate is measured in mm/hour. The occurrence of significant Rain Fade events is scaled by the rainfall rate and its duration. Generally these events are transient as the rain cloud moves through. The path of interest is only the line from the satcom terminal to the servicing satellite. Only while the rain cloud is in the way do problems occur.

Panama is in a very severe rainfall rate region and will create frequent issues with Ka band service operating below about 15,000 feet. Ku should operate through these scenarios with less disruption. It is prominent in the region along with the Brazilian rain forests and significant as a hub airport. 

5Y3591 Stabilizer Trim Actuator appears to be Nose Down

When KHOU took a video tour of the collected wreckage, they included a frame of the stabilizer trim actuator (the jackscrew).

Limiting RF exposure to Humans in Close Proximity to Satellite Transmitters

Satellite radios produce powerful Radio Frequency (RF) emissions. A method is provided for limiting the RF exposure to humans that are in close proximity to satellite transmitter antennas by establishing radial keep-out zones.

More Questions Raised for Atlas 5Y3591 Loss of Control

Atlas 767 flight 5Y3951 was descending for 3,000 feet when it appears to have briefly leveled off at 6,200 feet, before nosing over and plunging to the ground.

NTSB Brief Atlas 5Y3591 Sun 4pm CST

NTSB chairman Sumwalt has seen video of the last five seconds to the impact of Atlas 5Y3591 and confirms it was in a steep, wings-level dive and made no visible attempt to pull up. The debris field is approximately 200 yards long by 100 yards wide in a NW orientation, consistent with the aircraft steep trajectory and high speed. The steep descent began with light to heavy rain in the area, from about 6,000 feet at 240 knots airspeed. There was no communication from the flight crew after their routine approach. They were descending from 18,000 feet for 3.000 feet when the event occurred. 

Atlas Air 767 Flight 5Y3591 Plunges from 6,000 Feet

Three Atlas Air crew members tragically perished when their 26 year-old Boeing 767 plunged from about 6,000 feet in about 10 seconds. The freighter had departed from Miami and was on approach to Houston (IAH). The crew made no radio call, and there was no warning or indication of difficulty prior to the pitch over.

Stopping Distance

Runway factors change the normal stopping distance of a Boeing 737-700. 

• A 10 knot tailwind adds about 21% to the stopping distance
• A wet runway adds about 15% to the stopping distance
• Standing water can more than double stopping distance.

Southwest WN278 overran the KBUR (Bob Hope, Burbank, BUR) runway 08. The Boeing 737-700 rolled into the Engineered Material Arrest System (EMAS) that had been installed as a result of another Southwest 737-300 which overran the same runway in March 2000. This was the second airplane to be fortunate for arrestment by that particular EMAS installation.

Lateral approach path shows a correction right-to-left on short final, which may have led to running off the left side of the runway. The last recorded speed of 49 knots at the runway end, after a normal arrival point, and expected touchdown point (assuming appropriate landing weight), leaves standing water/hydroplaning as the most likely overrun villain. There is no data to confirm the reason for lack of deceleration and control; only data to show it did not (which is evident in its final resting position). The nose-gear entered the EMAS probably traveling between 35 and 40 knots.

Aviation safety initiatives demand improvements to limit recurrence of the same factors that cause an accident or injury. While two Southwest 737s have overrun the same runway, this time EMAS brought the Southwest airliner to a rapid stop without significant injury.

Angle of Attack Vane Failure Modes

Lion Air JT610 Captain's angle of attack (AoA) measurement was about 20 degrees higher that the First Officer's AoA. The excessively high AoA value caused considerable flight deck effects, which may have been a principal factor in the catastrophe. Electrical and mechanical malfunction characteristics of the AoA transmitter are matched against observations. The most likely failure is mechanical in nature, influenced by air pressure, and fully internal to the AoA transmitter.

UTC Aerospace Systems (Rosemount) Model 0861 AoA Transmitter

First Look at JT610 Flight Data

Partial release of flight data from JT610 (h/t to Don Thompson). In short summary, the left Angle of Attack (AoA) vane was substantially offset from the right vane from taxi out. The left stick shaker activated on liftoff and stayed on for most of the accident flight. MCAS trimmed nose down when flaps were up. In a deadly game of tag, the Pilot stopped MCAS by manual trim nose up, but MCAS would start again five seconds later.  In each excursion, the stabilizer was held roughly in trim. There are 26 occurrences of MCAS trim down, pilot trim up.

It may have been the point when the captain transferred control to the first officer that MCAS was successful in two successive cycles, trimming the stabilizer nose down over four units without opposition.

The captain seems to have taken control back in the end, and pulls the column hard aft. MCAS is able to trim yet another one unit nose down before the captain stops it, but there is no subsequent  significant command to trim stabilizer nose up. The airplane dive exceeded 450 knots by the point of impact.

The prior flight showed similar behavior. But on that flight, the flight crew appear to have quickly cutout the electric trim altogether, and completed the flight trimming the stabilizer with the wheel.

Search for the CVR continues.

737 FCC Pitch Axis Augmentation - Command Integrity Mandate for Dual Channel, Fail-Safe

A line is drawn between primary flight controls that the pilot handles directly through control column, rudder pedal, and stabilizer trim; and automatic control, such as the autopilot, which manages the same surfaces through computer command. 

The Yaw Damper is an example of an automatic flight control system added to the airplane to augment flight characteristics. The Yaw Damper operates regardless whether pilot manual flight control or automatic flight control.

FCC Pitch Axis augmentation (Mach Trim, Speed Trim, and MCAS) commands may be based on a single sensor input. These commands should be checked against a calculation based on a second sensor set before becoming valid. A software update to the FCC may provide support for a dual channel mandate.

737 MCAS - Failure is an Option

The 737MAX introduced a new feature, Maneuvering Characteristics Augmentation System (MCAS). MCAS commands the stabilizer to trim down (only while flaps are up) in steps.  From reports, the aft column cutout switch is disabled while MCAS is active.  MCAS commands nose down trim at 0.27 deg/sec for about 10 seconds at a time. It then pauses briefly (duration not known, but presumed five seconds).  The time history of a fabricated scenario, starting at a stabilizer position of 8 units, shows it would take about 55 seconds to reach the nose-down limit. Starting at a more nose down position takes less time, e.g from 4 degrees about 35 seconds).

MCAS Commanded Stabilizer Trim Without Stopping

Stabilizer Trim

LionAir JT610 plunged into the sea from what may have been the result of runaway stabilizer trim.  The details are not released, but the FAA has issued an Airworthiness Directive drawing attention to the recovery from such an event.  What is stabilizer trim and why would it runaway?

http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf

Coverage Along a Route - Europe

Airlines flying routes connecting European airports fly far enough north to limit satellite elevation to less than 45 degrees. Installing a Ku/Ka band satellite antenna in the Airbus-nominated position for A320 series creates a blockage from the tail (shadowing) that can extend more than 30 degrees in elevation and about 4 degrees wide. This combination can lead to loss of service when the airplane is flying directly away from the servicing satellite. The problem is made worse by using satellites that are not well situated.

Close Calls Coming (TG679) and Going (IX611)

ADS-B OUT data broadcast coupled with machine learning can create a great enhancement to aviation safety. Flight Operations Quality Assurance (FOQA) was conceived as an anonymous means to reveal unsafe trends. The post-flight evidence would guide training and awareness, not personal vendetta. With ADS-B, the alerting can be done in real-time; the trends recognized as they are occurring.

IX611 Takeoff normal (A) and accident (X)

Using True Time Delay to Increase Instantaneous Bandwidth in a Phased Array Antenna

The progression towards High Throughput Satellites is enabled by frequency reuse using larger and larger bandwidth signals.  Bandwidths exceeding 100 Mhz are commonplace, with 250 MHz and larger bandwidths evident. A phased-array antenna belies the concept of using phase control to form a beam (or inherently, steer the beam electronically.) 

APEX 2018 Midway Report

APEX EXPO 2018 got started a day earlier than I expected.  My report from the first two days looking at VR headsets, satcom partnerships and agreements, seeking profit, and emerging technology.

Panasonic adds Inmarsat GX to the Routing Table

Panasonic and Inmarsat have jointly announced an agreement to work together.

• Panasonic will offer Inmarsat as their exclusive Ka-band satcom supplier
• Panasonic will continue to operate and grow their Ku-band network 
• Inmarsat will be able to bundle in Panasonic IFE and support as a part of their offerings
• Panasonic and Inmarsat will jointly develop a new Inmarsat GX terminal

"Customer airlines will be able to select a product that represents the best that Inmarsat and the best that Panasonic offer together" declared Ian Dawkins, Panasonic Senior VP of Network Operations. "This is far more than a simple reseller agreement." 

Aviation Cybersecurity 101

Thanks to Woodrow Bellamy III and Mark Holmes for inviting me to present at the Global Connected Aircraft Summit 2018.

Here is my slide deck (with notes). I have revised and added a slide to address how an iPad can host type B EFB messages.

Lion Air PK-LOO JT-892 Departed runway after touchdown

Joining final approach very late may have contributed to a Boeing 737-800 departing the runway 27 at GTO/WAMG Gorontalo Jalaluddin Airport in Indonesia at about 18:35:30L (10:35:30Z).

Seamless Air Alliance - Who Owns the Customer?

Delta, Airbus, OneWeb, Sprint, Airtel, and Gogo announced the formation of the Seamless Air Alliance.  

Equipment, certification, satellite coverage, billing and overall service is included as a one-stop offering.

A participating airline picks parts from a catalog, installs per a cookie-cutter, turns it on, and the passengers connect to the Internet.

Malfunction in an Aero Ku/Ka-band Satcom System

Ku/Ka-band Satcom Systems offer no safety functions. 

No failure of the satcom system should create an unsafe effect.

Users of the satcom system do so at their own peril, as they would with any Internet access provider.

Discovery of cybersecurity vulnerabilities should emphasize rapid response to close the threat and a cooperative approach to sharing information privately, with an agreement to share enough information publicly to raise awareness of best practices.

Details and a checklist in the following paper.

PP792 Mark 2 Satcom Advanced Features

PP792 defines the form and fit characteristics of the Mark II Aviation Ku-band and Ka-band Satellite Communication (satcom) System, intended for installation in all types of commercial air transport aircraft. The satcom system described in PP792 represents the next evolution from the Mark I system defined in ARINC Characteristic 791, Part 1.

Significant advancements include:

• Single, standard installation, no customization, fully interchangeable
• Smaller: no KRFU, Virtual APM
• Lighter: smaller connectors, fewer wires, no hyper-critical wiring, coax, or waveguide
• Flexible lug pattern accommodates two apertures, each up to 42"
• High power supply (2000 Watts) for large, solid-state, phased-array antennas
• Integrated Position, Attitude and Heading sensor
• High performance IF interface supporting NGSO networks

Is there Gold on Virgin America?

It’s like walking into a night club.

10 Years Later - Still Standardizing Aero Ku/Ka Satcom

With a two hour telecon in Jan 2008, the SAE/ITC AEEC Ku/Ka-band Satcom Subcommittee started to work together.  What ever happened?

10 years and 122 gatherings later, we are still at it!  Here we are today @ThinKom_Inc.

Regulating Radiated Emissions

https://transition.fcc.gov/Bureaus/Engineering_Technology/Documents/bulletins/oet56/oet56e4.pdf

Equipment installed on aircraft must be designed and tested to be compatible with other equipment and with the airborne environment.  Notably, radio frequency (RF) radiated emissions from one system may disrupt other aircraft systems such as radio receivers or present hazards to human health.

Project Paper 792 - Dec 2017 Update

Project Paper 792 System

Flat-Panel antennas, particularly those with embedded amplifiers, provide the only pathway from an effective 18" aperture from a typical multi-gimbal antenna to as much as a 42" aperture.   The first of these new antennas is the Gogo 2Ku made by ThinKom.

Project Paper 792 provides the form and fit of these second-generation satcom systems building on the baseline from ARINC 791 part 1 and using a common functional definition using ARINC 791 part 2 and Project Paper 848.

Comparing Antenna Performance

While it is possible to get 2x as marketing touts, the ThinKom (2Ku) antenna achieves about 1.5 times the spectral efficiency as a competing 2-axis antenna along typical routes. The ThinKom antenna may perform even better in the tropics, where the elevation angles may be highest.

The ThinKom antenna can operate without any performance reduction due to skew angles that may be encountered in the tropic regions, unlike a 2-axis antenna which may suffer severe degradation.

Theoretically, these same benefits await other flat-panel antennas.  Practically, no other antenna has  made public, legitimate claim to a design matching instantaneous bandwidth, efficiency, robustness, and scan loss, in the same size package.  VICTS weakness is cost, weight, form-factor; all of which electronic phased array may have advantage. 

Defense in Depth

Defense-in-Depth is a security concept that applies successive barriers to unauthorized access.  Aeronautical communication includes a Commercial-off-the-Shelf (COTS) layer, a Network layer, and an Application layer.

Space Shuttle Approach and Landing Test Program

Robert (Bob) Montgomery participated in the Space Shuttle Approach and Landing Test program, conducted by NASA Dryden at Edwards in 1977.  A Boeing Aerodynamicist, Bob conducted wind tunnel test to develop the control modifications as a result of carrying the Space Shuttle, and devised procedures so it could be safely separated.

Google Loon - Floating Nest of Radio Technologies

Google is deploying a High Altitude Platform System (HAPS) in the form of balloons that float around 20 km in altitude above a service area.  Representative link budgets for both the LTE service and the air-ground unlicensed feeder link show that one balloon can deliver about 10 Mbps uplink and 20-25 Mbps downlink, on average, to LTE subscribers in an 80 km coverage area.

Managing Network Security and QoS: PP848

Air Transport Airplanes are faced with a monumental challenge to upgrade and embrace modern IP radio networks.  Network security has risen mightily to challenge designers, mire down operations, and yet struggles to achieve its goal.  Bandwidth management - Quality of Service - is done piece-meal, blind to real priority and performance goals.  What will bring this all together?

“Otto”, your new First Officer

Will air transport airplanes carrying many people for commercial purposes move to fully autonomous, no human pilot onboard? 

The First Officer will turn into “Otto”, a built-in feature of the next generation air transport airplane, and that the Captain is here to stay.   This is a logical progression from four to three (no Navigator) to two (no Flight Engineer) to one (no First Officer.)

Antenna Performance along an Airline Route

Aircraft fly from a departure airport to a destination airport along a route that is ideally a great circle connecting the two airports.  Weather and other aircraft traffic, along with other considerations, can lead an airplane across a range of territory when flying the route from day to day.

Airplanes inherently favor flying wings-level while not maneuvering (as opposed to a slip.)  This leads to greatest passenger satisfaction and can avoid troubling issues with fluids.  As a result, the orientation of the airplane changes with respect to satellites operating along the geostationary orbit (GSO). The relative orientation between satellite and antenna leads to beam steering (azimuth, elevation, polarization skew) commands and also has an influence upon the airplane antenna performance.

Skew angle and Elevation angle from various satellite positions, flying Los Angeles to Sao Paulo, Multi-gimbal antenna

Choosing an Airline Wireless Internet Service Provider (WISP)

Airlines have been providing passengers radio communication services at their seat since 1937. 

In 2017, airline passengers yearn for free and compelling Wi-Fi Internet access. What should an airline consider when choosing an inflight Wireless Internet Service Provider (WISP)?

Spectral Efficiency - The Fitness of Wireless Communication

Spectral efficiency –the effective data rate that can be achieved from a given slice of spectrum. 

Designing B-47 Maneuvers

The B-47 was the first swept-wing bomber. Boeing aerodynamicist Robert (Bob) Montgomery stopped by Pease AFB and briefed emerging maneuvers possible with the B-47.

PP792 draft 1 released: Second-generation Ku/Ka-band Aero Satcom Terminals

PP792 Satcom System