Originally Posted by
DaveReidUK
On first look, the report is reminiscent of a missive by Sir Humphrey, of "Yes, Minister". There is some careful wording that results in a generally favourable view, all is well in the realm... That doesn't appear to be consistent with the holes in the ground.
Page 35, a description of MCAS is included, which is the final problematic variant, not what was presented. It was a surprise to the test teams what it had been morphed into. That alters the complexion of effectiveness of the processes. That change occurring was a process failure for various reasons, what was expected to be certified was not what existed.
MCAS was designed to augment flaps-up manoeuvring characteristics by providing enhanced control column force gradient. In simple terms, MCAS was designed to increase the airplane nose-down pitching moment and resulting aft column force when it detects the aircraft may be in danger of stalling. It was designed to operate only during manual flight and activate only during an abnormally high angle of attack.
The FAA reviewed the MCAS function as part of the review of the flight control system in the detailed certification plans. Intended system activation was limited to rare, non-normal, highangle-of-attack flight conditions in manual flight mode. Boeing’s analysis considered the effect of an erroneous MCAS activation throughout the flight envelope. The system hazard was assessed as less than that associated with a runaway horizontal stabilizer condition, which is a required training event. This analysis asked the question: is the human likely to be able to complete the procedure effectively? FAA and Boeing both conducted flight tests with the system fully functional and with the system inoperative. The FAA found that Boeing demonstrated compliance using accepted methods and accounted for stated assumptions, and therefore, with the information and experience before it at the time, the FAA concluded that additional training and procedures were not needed as a result of MCAS implementation.
I would suggest that these paragraphs don't pass muster to the situation that occurred. If they are actually correct, then the aircraft certification was non compliant as the fault mode is not annunciated, 25.203 and 25.672 appear to remain problematic to the MCAS as built.
Blaming the crew for being the global outcome of their training programs and what is acceptable to ICAO, doesn't fix the shambles. There is hubris in assumption of superiority on recent history, stuff comes around and bites, liek driving a serviceable B763F into the bayou, dropping a 738 off piste into the local river, and the northern neighbours trying to snag the tail of 3 jets on the taxiway at KSFO, or dumping 40 toms of wide cut over the local school grounds. Europe has had it's days where there is scuffing of the shoe in the dust, like a 744 in the lagoon at Tahiti, various others parked off in the rough, and 447 highlighting the issue that there but for the grace of god go a whole bunch of operators. We appear to have an observer bias that is close to hubris. As I have said before, the very best pilot I have ever known was from Ethiopia. The best helicopter instructors were from Japan, the best applied CRM was from a Russian pilot ex Aeroflot.
The report is disappointing, and does a disservice to all, even TBC and the FAA, as well as the dearly departed.
The average pilot is exactly that,
AVERAGE. They are not Yeagers or Armstrongs, or Eric Moody nor can they be reasonably expected to be. The internal emails that show how hard the OEM pushed to stop the operator from having specific training appears incongruous to complaints that foreign crew were inadequately trained... that sticks in the throat.
§ 25.203 Stall characteristics.
§ 25.203 Stall characteristics.(a) It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the
airplane is stalled.
No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls.
(b) For level wing stalls, the roll occurring between the stall and the completion of the recovery may not exceed approximately 20 degrees.
(c) For turning flight stalls, the action of the
airplane after the stall may not be so violent or extreme as to make it difficult, with normal piloting skill, to effect a prompt recovery and to regain control of the
airplane. The maximum bank angle that occurs during the recovery may not exceed -
(1) Approximately 60 degrees in the original direction of the turn, or 30 degrees in the opposite direction, for deceleration rates up to 1 knot per second; and
(2) Approximately 90 degrees in the original direction of the turn, or 60 degrees in the opposite direction, for deceleration rates in excess of 1 knot per second.
§ 25.672 Stability augmentation and automatic and power-operated systems.
§ 25.672 Stability augmentation and automatic and power-operated systems.If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with
§ 25.671 and the following:
(a)
A warning which is clearly distinguishable to the pilot under expected flight conditions without requiring his attention must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system which could result in an unsafe condition if the pilot were not aware of the failure.
Warning systems must not activate the control systems.
(b)
The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures of the type specified in § 25.671(c) without requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.
(c)
It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system -
(1)
The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;
(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and
airplane configurations) which is described in the
Airplane Flight Manual; and
(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.