Originally Posted by
bill fly
This is probably the most informative and best researched information to appear in this sorry matter.
Apart from one small confusing paragraph about the AoA on the instrument panel it is a valuable contribution - possibly more so than the accident reports will prove to be.
Perhaps the most significant lesson to be taken from the article is the assumption that within three seconds, pilots will recognise and deal with a trim runaway. That may be the case taken as a single failure but in the context of the cockpit environment in this case of MCAS activation, where the crew was already trying to deal with a rogue stall warning, in an after takeoff phase etc., it was just one more item on a loaded list and three seconds was not enough for recognition and action. Meantime the controls get heavier and MCAS repeats...
The cause of all this chaos was the same - the AoA failure. It didn’t just set off MCAS - it set off multiple spurious warnings. It did this on three known occasions and only when a third pilot was available could the situation be partially defused. That took more than three seconds too...
So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.
As for the company culture, others are already commenting on that aspect.
The ST story is a road map to what happened, and is the starting point for the rectification of the system that existed at that time. The 3 seconds is that noted in 25.255(a), irrespective of the opinion of that regulation being directly or indirectly related to the problem, it is the only part of the rules that gives guidance on compliance for an out of trim case, whether taht cause is by the pilots thumb as zzuf has maintained it pertains to.... The further concern on the lack of robustness of the regulatory requirement is that 25.255 requires a demonstration using a mis trim for the time, 3 seconds, at the rate applicable to the airspeed that the aircraft is at, and MCAS drilled a big hole in the middle of that assumption, it had a greater rate and authority than was envisaged with the drafting of 25.255, which did indeed arise from early jet upsets from the pilot incorrect input as much as runaway trim systems. 25.255 needs to be reinforced, and that then raises the matter of all manual trim systems being inherently compromised without special training, the matter recognised in this forum at least from the old timers experience, lost in the march of time.
3 seconds
OK, for a reject we expect the crews to react promptly, however, all up there is considerable delay for recognition, cognition and physical initiation of the response. Crews often do react promptly to the canned, pre-primed decision making and process that is routinely briefed in full before each takeoff, including a run through of the exact actions that the crew will undertake. Even so, as often as not, the crew do not respond as briefed, and the decisions occur over a longer period of time than was envisaged, and, in testament to the ingenuity of humans, the response is quite often not as briefed and trained, it is a solution determined on the day, under the stress of the moment. The DER of runways all around the world are littered with evidence of the occasions where human variability comes into play (as well as how often the performance information and analysis is flawed).
Crew response within 3 seconds for a runaway trim is inadequate. The crews in the cruise are not set up poised to hit the cutouts; crew activity routinely takes half of the crew out of the direct loop dealing with other matters beyond the flying of the aircraft, and the remaining pilot whether 200 hours or 20,000 hours is not sitting on a hair trigger response to intervene on the runaway.
Crew response to a fire warning takes an inordinate amount of time, and oddly, it takes longer in the real world events than it does in the simulator. In the real world, on the number of debriefs post such events, looking at what the crew actually did vs the QRH procedure, the crew often rationalise that the warning is false, and that they have taken a process that is different to the QRH to ensure that they do not respond to an false warning. That is admirable in saving on fire bottle squibs, refills and possible engine shop visits, but it is not what the procedure is designed to be followed. This variation is observed in punitive corporate cultures, where one would expect that compliance with the procedure would be iron clad, yet it is not, the crews act to ensure their heads do not rise above managements parapet. Relevance to runaway trim, MCAS etc?, well, 25.255 intimates a 3 second response time, and the probability is that you will routinely exceed that by a large margin. You will also see crew response by other means, such as elevator input, which is often the immediate response to an autopilot attitude error, contrary to the standard procedure in most systems. Variability of crew response needs to be considered to a greater extent, unless the training is explicit in demonstrating the need for timely response, and that the response is simple, and reliable. At present, the MMEL permits the despatch of a Max with one yoke trim switch inoperative, any operator should consider the impact of the other sides pilot being in the galley or head and what the impact would be to the response time... or simply amend the MEL to preclude despatch with any yoke trim switch inoperative.
The Max can be flown safely today with awareness; the crew training however is necessary to make that reliably the outcome, and the architecture of the system needs to come into compliance with 25.671 and 672 as far as unmistakeable warning of a SAS system failure. Respectfully, all B737 operators should consider reviewing the out of trim case disregarding MCAS, and ascertain whether training to ensure crew can recover manual trim operation can occur in the event of a severe out of trim case. Regulators need to be involved in ascertaining whether the inherent weakness that exists in that area is acceptable or not; personally, I think that it needs to be incorporated into training matrices promptly for the peace of mind of the public, the confidence in the system and in and of the pilots who operate these aircraft every day. The training overhead to accomplish the defence from this issue is not onerous, and it is at least as rational a use of FFS time as flying warm and fuzzy CRM vignettes which can be done as or more effectively in a cardboard bomber, FBS, FTD, or PC with a generic sim program. FFS, notwithstanding the limitations of the slip between QTG accepted aero-model dynamics and the real world, and the issues pertaining to the edge of envelope are worthwhile assets to the industry that are squandered by the lack of common sense in training requirements to achieve the training objectives.
It is quite possible that the industry will be better for the painful experience that it has just gone through. Faith in the OEM however is further eroded by their continued litany of lapses of judgement and questionable ethics that appear to be systemic; every few years a new saga erupts onto the public stage, and the OEM vows to cure their ethical lapses, it is time to get serious about doing so, and perhaps they can start by reflecting on their response to their QA staff that they acted so disgracefully against on the NG ring frame saga. Show some spine, and make your company what it needs to be, not what it has devolved into.