PDA

View Full Version : Indonesian aircraft missing off Jakarta


Pages : 1 2 3 [4] 5 6 7 8 9

Concours77
7th Nov 2018, 17:14
Jesus. So while you are fighting the other symptoms of UAS, the plane is quietly trying to kill you.

Airbus. same. Only reversing trim is done manually, and wheel must be held to retain new position. If one lets go the wheel, the aircraft reloads, and tries to kill again.

mross
7th Nov 2018, 17:30
Boing should fit three alpha vanes as they do pitot tubes.

ImbracableCrunk
7th Nov 2018, 17:44
It might work, but if the airplane is actively fighting your efforts to keep it in stable flight via uncontrollable erratic trim inputs, you might be reluctant to believe that engaging the A/P in any mode would help, and you might be right.

I thought the issue with the trim was related to manual flight.

AGBagb
7th Nov 2018, 17:49
Originally Posted by Water pilot https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-39.html#post10304599)Jesus. So while you are fighting the other symptoms of UAS, the plane is quietly trying to kill you.
Airbus. same. Only reversing trim is done manually, and wheel must be held to retain new position. If one lets go the wheel, the aircraft reloads, and tries to kill again.

I thought this had come up earlier in the thread, but now can't find it...

Is the auto-trim-in-manual-flight issue dealt with in the memory / QRHs for assorted UAS events? Or is it a separate memory / QRH procedure?

The Ancient Geek
7th Nov 2018, 17:51
The big question for me is why did they crash when they or others managed to recover from previous cases. Had this crew been on the previous problem flights ?.
This suggests that the problem was more difficult with either extra symptoms or maybe less time/altitude available to recover.
The devil is in the detail. Could a crew with normal skills and experience have been expected to cope in this case, I have my doubts.

A Squared
7th Nov 2018, 17:57
I thought the issue with the trim was related to manual flight.

I'm not certain. my understanding of how the STS and related magic all works is imperfect at best. If it all switches off completely as soon as the A/P is engaged and the airplane knows it is no longer being flown manually, then yeah, that might help. On the other hand, AFAIK, the autopilot must have still have some means to trim the stabilizer, so if the erratic AoA is causing the pitch trim problems through those circuits/systems, then engaging the A/P might not make the problem go away.

Longtimer
7th Nov 2018, 18:03
On Nov 7th 2018 Boeing issued an Operations Manual Bulletin (OMB) to all Boeing 737 MAX Operators stating that the investigation into the crash of PK-LQP found one of the Angle of Attack Sensors had provided incorrect readings, which could cause the aircraft's trim system to uncommandedly trim nose down in order to avoid a stall during manual flight. The OMB directs "operators to existing flight crew procedures to address circumstances where there is erroneous input from an AOA sensor." The OMB reiterates the Stabilizer Runaway non-normal checklist.

The flight Crew Operations Manual Bulletin TBC-19 reads:

The Indonesian National Transportation Safety Committee has indicated that Lion Air flight 610 experienced erroneous AOA data. Boeing would like to call attention to an AOA failure condition that can occur during manual flight only.

This bulletin directs flight crews to existing procedures to address this condition. In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.

Additionally, pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:

- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- Inability to engage autopilot.
- Automatic disengagement of autopilot.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the AOA indicator option is installed)
- FEEL DIFF PRESS light.

In the event an uncommanded nose down stabilizer trim is experienced on the 737-8 /-9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.

rideforever
7th Nov 2018, 18:06
Boeing would like to call attention to an AOA failure condition that can occur during manual flight only.
So ... you cannot use manual flight when a loss of control occurs ?
Wow, nice recommendation.
How much is the train again ?

Denti
7th Nov 2018, 18:12
Except that the author of the quoted post took pains to stress that both airspeed and groundspeed values are affected by unreliable AoA, in fact GS was mentioned twice in that context:

I look forward to learning how so.
Quite honestly, i would have loved to do so as well. Back then neither the safety department, nor the technical pilot, nor the internal investigation (it never went to outside investigation) nor the boeing technical pilots that had a look themselves could explain it coherently to me. Since then i have moved to another type and the company in question has vanished, after they got rid of their boeing fleet to begin with. So i don't see that it will be ever really explained, but it happened to quite a few of our planes after a boeing advised AoA retrofit with a different type that was then prone to freeze in a position.

A Squared
7th Nov 2018, 18:12
Now that we have AOA in the spotlight, and reports of indicators issue on other Lion 737 Maxx, what could be the cause?

My understanding is that the reports of “issues” are not on other Lion aircraft - but multiple flights of the same aircraft.



It was earlier reported that Lion had identified potentially similar defects on other 737 max aircraft in their fleet. (https://www.perthnow.com.au/travel/lion-air-crash-indonesia-finds-faults-in-two-other-boeing-737-max-jets-after-crash-ng-d1f56b3db0817db6986c4a47f53d21e6) in addition to the other occurrences of UAS problems on the accident airplane.

FullWings
7th Nov 2018, 18:17
Is the auto-trim-in-manual-flight issue dealt with in the memory / QRHs for assorted UAS events? Or is it a separate memory / QRH procedure?
I don’t have a 737 QRH in front of me but I suspect that one would be something like “Runaway Stabiliser” and the other “Airspeed Unreliable”.

I am having increasing sympathy for the situation the crew found themselves in: symptoms of UAS (biased by AML entries from previous flights) but with an effective trim runaway thrown in for good measure and all at low level before there was a chance to get a “feel” for the aircraft. I also suspect that there might have been the odd (false) warning or two going off, just to add to the confusion. :confused:

KenV
7th Nov 2018, 18:37
Autopilot may not have been available; the bulletin saying STS may continue to trim nose-down to prevent a stall condition during manual flight.
No. STS is not an auto trim system. Indeed it normally functions opposite to trim. And no it is not designed to "prevent a stall condition."

LaissezPasser
7th Nov 2018, 18:37
All the SE Asian TV stations now blaming a faulty AOA sensor for the accident.

Just to clarify, SE Asian TV stations are reporting that both Boeing and Indonesia's National Transportation Safety Committee (KNKT) are saying that faulty AoA signals were involved in JT610. The media aren't coming up with this on their own. From Boeing:
The Indonesian National Transportation Safety Committee has indicated that Lion Air flight 610 experienced erroneous input from one of its AOA (Angle of Attack) sensors.

Lonewolf_50
7th Nov 2018, 18:40
The bulletin refers to an already existent procedure.
Company Training: questions need to be answered
Company Maintenance: why was this gripe not fault isolated and fixed?
The description of how to deal with trim versus STS, and the need to turn off a particular system using the cut out switch looks like something that should have been practiced in the sim ... but how often?
From Boeing:
In the event an uncommanded nose down stabilizer trim is experienced on the 737-8 /-9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight. From this, I understand that one can turn it off. If one does not turn it off, one will be fighting it all the way to the next landing. (Do I understand that correctly?)

phil gollin
7th Nov 2018, 18:40
.

The Boeing Bulletin speaks of the problem when there is ONE AOA sensor fault, I was under the impression that there were two sensors ?

IF SO, surely the system should flag up the different readings and not just choose one to follow right or wrong ?

.

lomapaseo
7th Nov 2018, 18:53
There is definitely some gamesmanship in the terminology in these technical issues. I remember years ago the company claimed it had a flameout on an engine and the manufacturer said that the engine made an uncommanded transition to a low RPM sub-idle condition. I presume a lot of this is from the legal department.

Not at all

It is simply engineering terms which define the actual problem in terms that support corrective actions.

Too often slang definitions creep into the news to facilitate baseline communication with the public. In my view the engineer who designed and certifies the product owns the definitions against the design assumptions

Examples of areas that most confuse the issue are Buzz words , like fire, thermal damage, rapid oxidation.and where they apply as well as flame-out, surge, stall, seizure and where they apply.

of course anything that is uncommanded worries me from the get-go :)

KenV
7th Nov 2018, 19:04
From Boeing: From this, I understand that one can turn it off. If one does not turn it off, one will be fighting it all the way to the next landing. (Do I understand that correctly?)That is correct. If for some reason the electric trim system runs away, it can be cut off. Once cut off one can use the manual trim wheels to manually trim the aircraft. The aircraft remains perfectly controllable. Further, even with a trim that has runaway to the mechanical limit of the system, the aircraft remains perfectly controllable. It's just that control column forces might be high and you might want the other pilot to assist you in overcoming the adverse column forces to lessen fatigue.

KenV
7th Nov 2018, 19:10
There is definitely some gamesmanship in the terminology in these technical issues. I remember years ago the company claimed it had a flameout on an engine and the manufacturer said that the engine made an uncommanded transition to a low RPM sub-idle condition. I presume a lot of this is from the legal department.Sorry, no. There is a vast difference technically between a flame out and uncommanded low RPM condition. Vast. To the pilot the results are largely the same, but to the engineer trying to understand the problem and develop a fix, the difference is not only vast, it is critical. It has less than nothing to do with gamesmanship and nothing to do with lawyers.

Smott999
7th Nov 2018, 19:21
...up thread we had a great review of STS which indicated that it had many of its “own” inputs, including pitots on the stabilizer leading edge, hydraulic pressure A v B comparisons, also required AP OFF, low weight, aft C/G, 10secs post liftoff, 5 secs after release of trim switches....virtually a separate system.

Does this Boeing bulletin show that the AoA and ADR are in fact also inputs to the STS?

Apologies if I (mere SLF) am mis-interpreting....but it sounds as if once the AP is disengaged, the STS was then available to act on the stabilizer. And the STS was taking ADR info sent from (apparently faulty ) AoA data. Thus pushing nose-down. And perhaps loading the yoke make it harder to pull up.

From what I can find on prior posts (and online Boeing tech info) it did not seem that STS took AoA data as an input. But does it?

All info appreciated! Thanks for a great forum.

wiedehopf
7th Nov 2018, 20:03
Direct link for larger picture: https://pbs.twimg.com/media/DrbMs-VVsAA9NgB.jpg:large
Bulletin in picture form on twitter:

https://twitter.com/theaircurrent/status/1060259878315278336

Lonewolf_50
7th Nov 2018, 20:15
To emphasize the procedures in the Runaway Stabilizer Non-Normal Checklist.
The bulletin establishes what looks like a very clear point: a Stabilizer can runaway, and there is a checklist for this malfunction.

Is the case of this aircraft (with AoA malfunction and the Runaway Stab malfunction) a compound emergency (by definition) or is this (Runaway Stabilizer) a predictable malfunction if an AoA sensor fails?
If the latter, how is this taught and practiced in the sim?
My motive for asking the question in this way is my experience in pilot and crew training, emergency procedures training and with that latter bit how one best uses simulator training to teach and train pilots and crews.

Ian W
7th Nov 2018, 20:23
The bulletin establishes what looks like a very clear point: a Stabilizer can runaway, and there is a checklist for this malfunction.

Is the case of this aircraft (with AoA malfunction and the Runaway Stab malfunction) a compound emergency (by definition) or is this (Runaway Stabilizer) a predictable malfunction if an AoA sensor fails?
If the latter, how is this taught and practiced in the sim?
My motive for asking the question in this way is my experience in pilot and crew training, emergency procedures training and with that latter bit how one best uses simulator training to teach and train pilots and crews.

Perhaps it is being picky, but a trim that operates until overridden by pilot input, waits a few seconds and does it again is not 'runaway' as it can be prevented and most pilots would operate the STAB TRIM CUTOUTs after the second or third time.

A rather confusing issue is that while the other erroneous outputs and stick shaking seem to be limited to 'the affected side' - but the stab trim obviously is for both pilots. Therefore, the previous flights must have operated the STAB TRIM CUTOUTs as the FO on the previous flight flew the aircraft manually for the remainder of the flight. None of this was passed on to the subsequent crew as 'we had an AOA problem?'

Clandestino
7th Nov 2018, 20:30
The description of how to deal with trim versus STS, and the need to turn off a particular system using the cut out switch looks like something that should have been practiced in the sim ... but how often?Probably depending on the local CAA and company; personally I've done it on initial and then at least once every three years.

From Boeing: From this, I understand that one can turn it off. If one does not turn it off, one will be fighting it all the way to the next landing. (Do I understand that correctly?)Nope. As it was mentioned already a few times here: after disabling electrical trim, manual trim handle(s) can be pulled out of trim wheel and stab handcranked into desired position. Not overly difficult, at least in sim.

A Squared
7th Nov 2018, 20:38
From what I can find on prior posts (and online Boeing tech info) it did not seem that STS took AoA data as an input. But does it?




Well ... I don't know, but Boeing seems to believe that faulty AoA data can cause the STS to behave erratically, so it kind of seems that AOA data, or a derivative thereof, must be input somehow.

Airbubba
7th Nov 2018, 20:40
To the pilot the results are largely the same, but to the engineer trying to understand the problem and develop a fix, the difference is not only vast, it is critical.

Thanks, I'm obviously just a pilot and yes, when the motor quits, it's about the same to me. I'll figure out how to get it back on the runway and let you geniuses on the ground figure out how to fix it.

Kinda like 'that feller isn't embezzling, he's merely repurposing funds without proper authorization' I suppose.

The runway stab trim checklist on the Boeings has been about the same for decades now and it does have you disconnect the autopilot, turn off the stab trim switches and grab the trim wheel in that order until you find something that works to stop the runaway. Is that still the drill on the 737-8?

b1lanc
7th Nov 2018, 20:44
It was earlier reported that Lion had identified potentially similar defects on other 737 max aircraft in their fleet. (https://www.perthnow.com.au/travel/lion-air-crash-indonesia-finds-faults-in-two-other-boeing-737-max-jets-after-crash-ng-d1f56b3db0817db6986c4a47f53d21e6) in addition to the other occurrences of UAS problems on the accident airplane.

If true begs the question - only Lion? Seems to me this could be a fleet-wide issue. A lot of max delivered, how are others addressing the potential?
The occurrence aircraft suffered an uncommanded nose down event on the prior flight but the crew was able to recover and continue the flight at a lower altitude (source AVH).

Denti
7th Nov 2018, 20:45
No. STS is not an auto trim system. Indeed it normally functions opposite to trim. And no it is not designed to "prevent a stall condition."
I do agree on the first part, but even on the NG the second part is simply wrong, as Boeing themselves write in their FCOM that approaching a stall the STS will trim forward to make it harder to get into the stall. It cannot prevent a stall if the pilot really wants to reach that of course, it just makes it a lot harder.

Try to fly it slowly into a stall and don't manually trim, and you will notice the activity of the STS trimming nearly continuously forward in the approach.

Rananim
7th Nov 2018, 20:46
The STS(which btw I agree is not technically an anti-stall device but we can view it as such as it will indeed trim down if you do approach a real stall in manual flight) would be disabled by selecting only the AP STAB trim cutout switch to CUTOUT.Boeing use bulletins to get vital information out immediately.The reminder to do the RUNAWAY STABILIZER NNC covers this runaway STS..They may refine procedures checklists later...or may not.This is probably what the commander of the previous flight did...he saw unwanted trim and he disabled both trims..fair enough.That wasnt the time or place to work out why/how he was getting unwanted trim...he just needed to disable all trim.He can trim the stabilizer manually once the trouble-shooting has ended.
RUNAWAY STABILIZER NNC...in the Boeing,unlike the Airbus where it is quiet,the trim wheel makes a lot of noise.That noise(if its continuous and not momentary) is actually the first and best indication of a runaway stabilizer,well before the out of trim condition develops.The pilot disengages automation and if it still continues he puts both trim switches to cutout.If that doesnt do it,the other pilot grasps and holds the flying pilots trim wheel.The point being is the pilot has good aural and tactile warnings of a runaway.However,in a UAS with stick shaker operating,those warnings may be diluted...and lets not forget this was an AP trim motor "runaway"(slower,quieter.more insidious)
Re manual vs auto flight...I think this is just a case of lost in translation.Boeing confirm that STS trim occurs in manual flight only and that it will trim to the stops(as the AMM quite clearly says it will) unless disabled.The AMM also says very clearly that the AUTOPILOT will trim it to the stops regardless of which AP you engage providing the FCC controlling the stab trim signal is being fed corrupt ADIRU data ...so theyre saying use manual flight which is what the UAS checklist calls for anyway.

JPJP
7th Nov 2018, 20:48
No. STS is not an auto trim system. Indeed it normally functions opposite to trim. And no it is not designed to "prevent a stall condition."

Hey Ken,

You're correct that the STS is not associated with the Stab Trim Autoflight circuit of the Stabilizer trim system. STS is only a function of the Stab Trim Main circuit (the pilots manual flight side of the stab trim) The other side is the autopilots (Stab Trim Autoflight). Hence, the reason why there are two cutout switches under Stab Trim Cutout.

However; The STS is designed to prevent a stall condition. Three components work together as the aircraft approach the stall - The STS, The SMYD (Stall Management Yaw Damper) and the EFS (Elevator Feel Shift). As the aircraft reaches high angles of attack they work together.

As you said, the STS is only active in manual flight, and in this case may have worked against them.

Cheers

Longtimer
7th Nov 2018, 22:10
Can be viewed at: http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/%24FILE/2018-23-51_Emergency.pdf

Concours77
7th Nov 2018, 22:27
Can be viewed at: http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/%24FILE/2018-23-51_Emergency.pdf

It is inconceivable this system was not challenged during test with loss of/compromised AoA, to elicit this very behaviour.

Inconceivable, but clearly they did not know. Because if they knew, and the system was approved, somebody got some splainin’ to do.

FAA:
This AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. We are issuing this AD to address this potential resulting nose-down trim, which could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain....

Erm, other than that, what’s for supper...?

gums
7th Nov 2018, 22:47
Salute!

Thank you, Coucourse.

That sums it up.

And we were told there were no cosmic computer crapola connected to the trim and the feel and the.....

Then we find that a slew of sensor inputs that included AoA were melded together and massaged and then a signal went to the feel system, and when A/P engaged, to the stab trim system.

Hh well, I move to the Tech Log due to Mod deletions of my posts concerning AoA, stability, static stability, etc.

Gums....

kiwi grey
7th Nov 2018, 22:59
[snip]
FAA:
This AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer.

So, if just one of the two AOA sensors is badly out of whack, the aircraft will repeatedly try to kill everyone on board?
Holy Moley :ooh:

Smott999
7th Nov 2018, 23:10
So, if just one of the two AOA sensors is badly out of whack, the aircraft will repeatedly try to kill everyone on board?
Holy Moley :ooh:

is this new to the MAX?

Lord Farringdon
7th Nov 2018, 23:26
It is inconceivable this system was not challenged during test with loss of/compromised AoA, to elicit this very behaviour.

Inconceivable, but clearly they did not know. Because if they knew, and the system was approved, somebody got some splainin’ to do.

FAA:
This AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. We are issuing this AD to address this potential resulting nose-down trim, which could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain....

Erm, other than that, what’s for supper...?



So does open up another possible explanation for the Fly Dubai Rostov on Don crew? I think the interim report was suggesting over enthusiastic use of the stab trim by the PF with fatigue coupled with the rather inplausible 'I forgot I was still holding the trim switch' type of argument. So easy to blame a fatigued crew eh? Like shooting ducks in a barrel.!!.

Organfreak
7th Nov 2018, 23:33
I thought I'd read that the two pilots were pulling/pushing at the same time in that accident?

CONSO
7th Nov 2018, 23:43
SEATTLE TIMES RE FAA AND BOEING

https://www.seattletimes.com/business/boeing-aerospace/faa-follows-boeings-737-safety-alert-with-an-emergency-directive/FAA follows Boeing’s 737 safety alert with an emergency directiveOriginally published November 7, 2018 at 2:47 pm Updated November 7, 2018 at 3:36 pm
The FAA said its directive addresses the potential impacts of false information coming from a sensor on the plane's exterior.https://static.seattletimes.com/wp-content/uploads/2014/10/DominicGates_web-100x100.jpg (https://www.seattletimes.com/author/dominic-gates)By Dominic Gates (https://www.seattletimes.com/author/dominic-gates/)Seattle Times aerospace reporterFollowing Boeing’s safety alert (https://www.seattletimes.com/business/boeing-aerospace/boeing-to-warn-737-max-operators-of-a-potential-instrument-failure-that-could-cause-the-jet-to-nose-dive/) Tuesday evening in response to the Lion Air 737 MAX crash in Indonesia (https://www.seattletimes.com/business/boeing-aerospace/search-for-cause-of-deadly-737-lion-air-crash-begins/), the FAA on Wednesday issued an Emergency Airworthiness Directive, effective immediately, mandating that airlines must update pilot procedures according to the instructions in the alert.The FAA said its directive addresses the potential effects of false information coming from a sensor on the plane’s exterior that reports the plane’s “angle of attack” (AOA), which is the angle between the wing and the flow of air the jet is moving through.This key data point is fed into the flight computer along with the temperature and air speed. These three metrics affect one another and are used by various systems that control the airplane’s flight.

GOES ON ..

infrequentflyer789
7th Nov 2018, 23:48
So, once again, for Denti, yes it's surprising that AoA affects groundspeed and I'd be interested to have that explained.

Not Denti, but I've been scratching my head on this too. I cannot see how AOA could be used for groundspeed except maybe possibly some kind of correction for gyro drift but then surely that's what the accelerometers are for.

Nevertheless, there is a tendency in engineering (I'd say particularly in software, but that may just be because that's what I've done most of) to "improve" by adding complexity and to use every piece of input data just because you can, which is great until some inputs are garbage, which then cascades to all outputs... Normally ADIRU is considered as two halves, more or less independent (think you can switch off the air data half on the 'buses and the inertial half stays on - and groundspeed comes from inertial), but there are connections between the two, and at the end of the day it's a box with a bunch of inputs including AOA and a bunch of outputs including groundspeed, so someone may have found a way to introduce a dependency.

I went looking for details out of interest, I didn't find anything but then one link lead to another and I stumbled across an FAA notice about loss of GPS signal leading to loss of yaw damper and stall warning system fail (among other issues). Just let that sink in for a minute, stall warning dependent on having GPS signal! :eek: :ugh:

Maybe it's just me, but that notice made me a believer - if someone can design and build and get certified an aircraft where stall warning is dependent on having a GPS signal, then I have no problem believing someone managed to get the groundspeed display to depend on AOA.

Smott999
7th Nov 2018, 23:52
SEATTLE TIMES RE FAA AND BOEING

https://www.seattletimes.com/business/boeing-aerospace/faa-follows-boeings-737-safety-alert-with-an-emergency-directive/FAA follows Boeing’s 737 safety alert with an emergency directiveOriginally published November 7, 2018 at 2:47 pm Updated November 7, 2018 at 3:36 pm


GOES ON ..

so what is different about MAX v NG?

Concours77
7th Nov 2018, 23:59
It used to be “pencil whipping” on the shop floor, which amounted to fraud, and caused a flight attendant to be lost in Hawaii.

Remember. Now it just occurs in plain sight, no attempt to hide, or even explain. Airframer say jump, FAA say: “How High?”

Trust, But verify. Unless it’s too expensive? Not the first time a system was untested while carrying passengers.

Boeing did the same thing with Yuasa batteries. The fleet was grounded, but not by Boeing

mates rates
8th Nov 2018, 00:13
Runaway stabilizer is a memory drill,at least on the NG.It is considered time critical and therefore should be done from memory.It appears in this case there may have been a failure to recognize the REAL problem given the information that the crew hopefully would have been aware of from the previous tech. log entries regarding an airspeed unreliable problem.They may have been completely side tracked in their thought processes once airborne.

Concours77
8th Nov 2018, 00:17
Runaway stabilizer is a memory drill,at least on the NG.It is considered time critical and therefore should be done from memory.It appears in this case there may have been a failure to recognize the REAL problem given the information that the crew hopefully would have been aware of from the previous tech. log entries regarding an airspeed unreliable problem.They may have been completely side tracked in their thought processes once airborne.



NO. Boeing, as we know, left the pertinent data out of the AFM. This is NOT on the crew.

This was not a UAS. The flight deck is not the place for engineering the systems, that is done in design. Hopefully.

NOT Unreliable air speed. Unreliable kit, Boeing admits this in the AD letter. Please read it.

I know, modify the walk around. “Get a ladder, check AOA vane is “free and correct...”
Simples.

Rated De
8th Nov 2018, 00:35
Runaway stabilizer is a memory drill,at least on the NG.It is considered time critical and therefore should be done from memory.It appears in this case there may have been a failure to recognize the REAL problem given the information that the crew hopefully would have been aware of from the previous tech. log entries regarding an airspeed unreliable problem.They may have been completely side tracked in their thought processes once airborne.

We now have a situation in which the crew were predisposed to an understanding that an 'unreliable airspeed' issue had arisen on previous flights. It now appears that as you correctly allude to, the crew were led unawares into a checklist and remedy that DID NOT address the underlying issue. The Boeing 'fix' was not an immediete grounding and rectification but rather now 'recommend' a crew ignore the cacophony of noise, stick shakers, aural alerts and instead go to another checklist. In the heat of the battle, remembering which is which is not only difficult but is crap. The distraction from a cascade of warnings mostly spurious is a dangerous precedent.

There once was a time where a prudent Boeing would have grounded the fleet, rectified the problem.
That Boeing is long gone.
Infected by the requirements of a capital market and 'commercial returns' the smart money men have focus on the BA NYSE price and personal financial incentive. it is worth considering that Boeing were perhaps well aware of the issue.



Remember. Now it just occurs in plain sight, no attempt to hide, or even explain. Airframer say jump, FAA say: “How High?”
Trust, But verify. Unless it’s too expensive? Not the first time a system was untested while carrying passengers.

Regulatory capture plain and simple.

Lord Farringdon
8th Nov 2018, 01:49
I thought I'd read that the two pilots were pulling/pushing at the same time in that accident?

Dont want to mess this Rostov -on -Don thing with this thread except to say we are being asked to believe they flew a perfectly serviceable aircraft into the ground while one of them held the stab trim for 12 secs. Yeah right, like these guys do that all the time!!

To get back to the accident at hand, what would have happened to this LA Max if this problem had occurred immediately after take off or like the Rostov accident, on a go around? I suspect they wouldn't have had time to execute a recovery let alone establish they were experiencing air data issues from an AoA sensor. It would look awfully similar to RoD. If I was an airline with orders for MAX right now, I'd be a little apprehensive.

lomapaseo
8th Nov 2018, 02:20
This appear to be a knowledge issue as well as a training issue.

I fail to see a causal factor being design or certification related.

The corrective action addresses the shortcoming

It does little good to wave the blame flag.

CONSO
8th Nov 2018, 03:00
so what is different about MAX v NG?

Although is not sufficient information yet available to be certain what caused the crash, investigators’ attention is focused on that system, which can move the jet’s horizontal tail to pitch the nose up or down.John Cox, a former pilot and chief executive of aviation consultancy Safety Operating Systems, said that although a version of this automated system has been on the 737 since the first ones were built in 1967, only on the MAX is this particular sensor able to trigger uncommanded movements of the jet’s horizontal tail.
The above is from an update on this site

https://www.seattletimes.com/business/boeing-aerospace/faa-follows-boeings-737-safety-alert-with-an-emergency-directive/

hans brinker
8th Nov 2018, 03:40
That is correct. If for some reason the electric trim system runs away, it can be cut off. Once cut off one can use the manual trim wheels to manually trim the aircraft. The aircraft remains perfectly controllable. Further, even with a trim that has runaway to the mechanical limit of the system, the aircraft remains perfectly controllable. It's just that control column forces might be high and you might want the other pilot to assist you in overcoming the adverse column forces to lessen fatigue.

Probably unrelated to this accident but deserves a rebuttal:
There have been several instances where the stabilizer ended up at the stops and the elevator lacked authority to maintain attitude. At least one A320 crashed because the crew kept pushing to capture the glideslope from above and ran the trim all the way out. As far as I know the B737 manual states that during stall recovery with high engine power full nose down elevator might not be enough and reminds the crew to use aircraft nose down trim.

RatherBeFlying
8th Nov 2018, 04:00
Have the AoA sensors been positioned differently in the MAX where they are more vulnerable to damage from an air bridge or other ground equipment?

Has the supplier been changed, perhaps to a more easily damaged version?

I suspect that Lion Air has been operating other 737s without this problem; so why now on the MAX:confused:

With the possible exception of Rostov on the Don, the STS/AoA system has been operating safely for a near half century.

I am reminded of a Greek military airman on night watch who used pitot tubes for chinups. Fortunately the damage was discovered on the ground:\

giggitygiggity
8th Nov 2018, 04:30
This appear to be a knowledge issue as well as a training issue.

I fail to see a causal factor being design or certification related.

The corrective action addresses the shortcoming

It does little good to wave the blame flag.

Agreed, unfortunately with the added bonus of making every spun-out argument against the Airbus Flight Augmentation; moot.

So seat of your pants can kill you just as easily as a lot of fancy computers. Genuinely, I think - in 2018 - you're probably safer in an Airbus during indicating problems because the Airbus guys have had unreliable airspeed, UPRT and OEB48 drummed into them ad nauseam, that... - now, i'll end up eating my own words here - ...that they should be on top of their game knowledge wise to deal with this sort of issue. Perhaps this training on the Boeing is yet to catch up?

I speak as an Airbus captain who experiences something to do with UPRT/UAS in every six months, that the company would have pretty good ground to stand on should i cock one of these events up on the line. I can't see how they could drive the training home any better than they currently do.

JulioLS
8th Nov 2018, 06:25
Can someone explain to me why anyone in their right mind would design a system whereby information from one sensor (in this case, the AoA sensor) corrupts the information coming from other independent systems (airspeed, altitude, and indeed even seemingly groundspeed)?

The equivalent in a car would be to allow the external temperature sensor to mess with the speedometer reading and the fuel gauge reading. Oh, and also allowing it to floor the throttle!!!

If airspeed and altitude readings remain unaffected, the pilot is surely going to have a much better view of what the plane is doing and what has gone wrong.

Derfred
8th Nov 2018, 07:04
Despite the outcry from some posters above in the light of the Boeing bulletin and FAA directive, the fact remains that existing procedures should have brought this aircraft safely back to ground.

The bulletin and the AD both say this.

It appears that maintenance and training are the major contributors to this tragic accident.

Maintenance: a maintenance culture that allows an aircraft to fly 4 successive sectors with a known issue affecting air data is completely unacceptable, and it certainly wouldn’t happen in any airline with a proper attitude towards maintenance and safety.

Training: given the above was allowed to occur, a well trained crew should still have been able to handle it. In the absence of well trained crew, an accident was simply a matter of time.

There is no such thing as pilot-error in an airline, only a poor training system which allows poorly trained pilots to operate.

Less Hair
8th Nov 2018, 08:08
Is the MAX somehow more tricky in stall behavior that it needs more protection from coming close to one?

Volume
8th Nov 2018, 08:08
And without going into detail, the correction from AoA for the static pressure is minimal (other corrections like ground effect, reverse thrust etc are more pronounced and still small).
It is not so much the amount of error, it is the computers detecting that there is a failure and therefore switching off certain functions, leaving the pilots with an unclear situation which they have to understand and to handle manually. Or even worse, it may trigger the computers to start certain functions, leaving the pilots even more surprised.

The stabilizer is an immense “secondary” flight control surface.
In normal transport aircraft operation I tend to understand it even as the primary pitch control. Looking at a typical flight, the ammount of elevator position changes is probably less than the ammount of stabilizer trim changes.
You can not fly a typical jet transport without intensively using the stabilizer trim, you could probably fly it without using the elevator and just using the stabilizer trim. It is an accepted backup system for the elevator (e.g. on A320, A330/340 in case of total FBW failure)
The elevator is for maneuvres, the stabilizer trim is for all long term pitch changes.

There have been several instances where the stabilizer ended up at the stops and the elevator lacked authority to maintain attitude.
Yes, sthe stabilizer trim is much more powerful than the elevator, hence you may end at the end stops of the elevator before you have the desired pitch change if the stabilizer is trimmed wrongly for the situation you are in.

It is a somehow inevitable for most modern aircraft flying over a wide speed range, having a sophisticated high lift system, powerful engines mounted above or below C/G and being optimized for low drag. You would need a much larger stabilizer and more powerful elevator hydraulics to prevent this situation, or an all flying stabilizer like on the L1011.

Once again unfortunately there is a lot of different longitundinal trim systems (especially in smaller aircraft, but also for example on the BAe 146 which does not have a stabilizer trim), which prevents pilots to be trained consistently when learning to fly. Hence there is no consistent policy how to use trim, it is type specific which does not help. Also the amount and type of autotrim is differing significantly between aircraft types, as already mentioned for the STS, which actually is the opposite of "normal" autotrim und just usd as an "automatic in manual flight".
I seriously doubt that all pilots have a full understanding of the longitudinal trim system of their aircraft.

Capn Bloggs
8th Nov 2018, 08:08
Despite the outcry from some posters above in the light of the Boeing bulletin and FAA directive, the fact remains that existing procedures should have brought this aircraft safely back to ground.
That is provided that the "correct" scenario is identified by the crew. Is there a warning in the UA procedure to monitor the stab to ensure it isn't running away?

Given the normal operation of the STS, pilots could be excused for thinking stab trim motion was "normal", especially given everything that was going on...

Looking at a typical flight, the ammount of elevator position changes is probably less than the ammount of stabilizer trim changes.
If you have trimmed for a speed and configuration, then you shouldn't need to trim again and again. Don't fly it on the trim. If you're using the trim more than the elevator, you're doing something fundamentally wrong.

ExSp33db1rd
8th Nov 2018, 08:17
FAA:
This AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. We are issuing this AD to address this potential resulting nose-down trim, which could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain....

........do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT

Early 707 training .... Capt. simulated a runaway stabiliser, nose down, student grabbed the wheel to stop rotation, called for switches to be cut off, and then for the circuit breakers on the overhead panel to be pulled, all in accordance with the drill of the era. The aircraft had set off down of course, and having correctly completed the drill, the Trg. Capt. called for the systems to be re-instated, but pulling back on the control column to reduce the descent, created so much "G" that the Flt. Eng. couldn't raise his hands far enough above his head to reach the circuit breakers. In the end, both pilots pulling, assisted by the Flt. Eng. placing his feet on the instrument panel and grabbing both control columns to assist the heaving they pulled out about 1200 ft above the water, having started around 5.000 ft. Sound familiar ? Maybe the CVR will confirm.

CurtainTwitcher
8th Nov 2018, 08:54
Interesting and highly plausible scenario ExSp33db1rd.
Just to be clear, your thinking would be that the trim had run all the way forward, the crew were holding full backstick, THEN realised they need to used the stab trim cutout switches? In your scenario the aircraft would now have full nose down trim and no electric pitch trim. Their only option left was the manual pitch trim, but you can't wind that quickly enough to recover with a high rate of descent from 5000'.

Have I got your thinking correct based on the previous incident?

ZFT
8th Nov 2018, 10:11
Despite the outcry from some posters above in the light of the Boeing bulletin and FAA directive, the fact remains that existing procedures should have brought this aircraft safely back to ground.

The bulletin and the AD both say this.

It appears that maintenance and training are the major contributors to this tragic accident.

Maintenance: a maintenance culture that allows an aircraft to fly 4 successive sectors with a known issue affecting air data is completely unacceptable, and it certainly wouldn’t happen in any airline with a proper attitude towards maintenance and safety.

Training: given the above was allowed to occur, a well trained crew should still have been able to handle it. In the absence of well trained crew, an accident was simply a matter of time.

There is no such thing as pilot-error in an airline, only a poor training system which allows poorly trained pilots to operate.

With the Max being the first 737 simulator data pack delivered to the TDMs as binaries I'm wondering whether anomalies with the AoA vane and associated systems are within the MDD as the operators no longer have any ability to pick and choose nor introduce malfunctions into their training programs. The OEM decides.

Just a thought as I have no knowledge of the Max data pack

Volume
8th Nov 2018, 10:36
If you have trimmed for a speed and configuration, then you shouldn't need to trim again and again. Don't fly it on the trim. If you're using the trim more than the elevator, you're doing something fundamentally wrong.
This is what I meant speaking of unharmonized training. I experienced different flight instructors with different policies. Even my examiner had another opinion, and criticised that I did not use trim intensively enough... He obviously loved to fly on the trim.
Basically if you have to do the same elevator correction again and again, you should better use the trim...
Even if you have trimmed for a speed and configuration you are burning fuel and therefore need to apply corrections from time to time, unless the autopilot does this for you. These corrections should be done by trim.

In modern aircraft trim is less and less used by the pilots actively, autotrim has widely replaced it. Another skill eroding...

Interesting and highly plausible scenario ExSp33db1rd.
Maybe already too complex, maybe you do not even need g forces...
If it takes the force of 4 hands on the wheels to prevent the aircraft from nosediving, which hand do you use to operate the trim cutout switches ?

Capn Bloggs
8th Nov 2018, 10:47
Even if you have trimmed for a speed and configuration you are burning fuel and therefore need to apply corrections from time to time, unless the autopilot does this for you. These corrections should be done by trim.
Rubbish. Try flying level during an instrument approach, or down the ILS, on the trim. You shouldn't do it and the autopilot definitely doesn't do it. If a consistent force is required on the control column, the aeroplane is out of trim. Trim the force out, then fly it with the elevator. Tell that examiner that he is wrong. And depending on who you believe, his technique is exactly what caused the Rostov prang.

In modern aircraft trim is less and less used by the pilots actively, autotrim has widely replaced it. Another skill eroding...
My understanding is that Boeings don't have autotrim (737 STS not withstanding); they are speed-stable (the FBW adding inputs to make it so).

flightleader
8th Nov 2018, 11:39
The SB covers 737 -8/-9, isn’t that include the NG and why everyone keep saying it is for MAX?

Flutter speed
8th Nov 2018, 11:43
Can someone explain to me why anyone in their right mind would design a system whereby information from one sensor (in this case, the AoA sensor) corrupts the information coming from other independent systems (airspeed, altitude, and indeed even seemingly groundspeed)?

The equivalent in a car would be to allow the external temperature sensor to mess with the speedometer reading and the fuel gauge reading. Oh, and also allowing it to floor the throttle!!!

If airspeed and altitude readings remain unaffected, the pilot is surely going to have a much better view of what the plane is doing and what has gone wrong.

As I mentioned in another post, the AoA data is used to calibrate the measured static pressure and therefore not fully independent as in your example. As such there is a direct link between AoA sensor data and airspeed / altitude. However, this calibration is small and a miscompare between the two AoA sensors is unlikely to invalidate airspeed (though as said, it may influence the displayed airspeed and trigger a disagree between IAS in extreme scenario's).

What it may cause is the Air Data Computer informing other systems of this AoA disagree, and other systems acting on this. I.e., a flight augmentation system, which heavily depends on AoA for e.g. envelope protection, would most likely switch to a degraded mode and inform the pilots of this. Depending on the aircraft the auto pilot may disconnect as well. So while there are effects and a possible increased workload for the pilots, there is no reason think that a broken AoA sensor presents invalid airspeed and altitude as well.

Interestingly, as far as I know the failure of one or both AoA sensors is not often part of the simulator training curriculum (pilots, please correct me if I am wrong). At least not to the extent that unreliable airspeed is trained these days (in part because of the AF447 accident, which put more emphasis on this in the simulator).

Flutter speed
8th Nov 2018, 11:45
The SB covers 737 -8/-9, isn’t that include the NG and why everyone keep saying it is for MAX?

-8 and -9 are MAX subtypes. -800 and -900 are NG.

Flutter speed
8th Nov 2018, 11:54
With the Max being the first 737 simulator data pack delivered to the TDMs as binaries I'm wondering whether anomalies with the AoA vane and associated systems are within the MDD as the operators no longer have any ability to pick and choose nor introduce malfunctions into their training programs. The OEM decides.

Just a thought as I have no knowledge of the Max data pack

For people not familiar with the abbreviations:

MDD is Malfunction Description Document (describing all malfunctions which can be inserted on the device)
TDM is Training Device Manufacturer

To my knowledge, Airbus simulator data package does also not include nor describe AoA sensor malfunctions and what the training effects should be.

Looking in this (http://www.737ng.co.uk/737-800%20Quick%20Reference%20Handbook%20%28QRH%29.pdf) 737 QRH, there is no instruction for pilots on affected systems when AoA disagrees and what actions to take, neither STS or autopilot is mentioned. Could be an outdated one [edit: it IS an outdated one, 2009 and NG only].

bsieker
8th Nov 2018, 12:15
Can be viewed at: http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/%24FILE/2018-23-51_Emergency.pdf

EASA has adopted/re-published the FAA EAD without change:
https://ad.easa.europa.eu/ad/US-2018-23-51

I guess that means it applies to European operators, as well.


Bernd

OVER THE TOP
8th Nov 2018, 12:17
Is it conceivable that if both pilots were making a coordinated maximum effort to control the runaway stabiliser trim, a miscoordination of simultaneous push and pull in a highly stressful situation could have triggered the Elevator Control Column Overide Mechanism? This would cause an immediate and significant reduction in elevator authority and increased control forces greater than those experienced in manual reversion.

A Squared
8th Nov 2018, 12:33
As I mentioned in another post, the AoA data is used to calibrate the measured static pressure and therefore not fully independent as in your example. As such there is a direct link between AoA sensor data and airspeed / altitude. However, this calibration is small and a miscompare between the two AoA sensors is unlikely to invalidate airspeed (though as said, it may influence the displayed airspeed and trigger a disagree between IAS in extreme scenario's).


So, for a 737, what would be the largest difference between IAS, uncorrected for AoA, and CAS, within the range of AoA that could be reasonably expected in flight? The large airplanes I've flown didn't correct IAS for AoA, and without looking them up, I don't recall that the airspeed calibration charts having a correction larger than 5 ish knots. Seems if it came down to a choice between an IAS that differed from CAS about 5 kt at low airspeeds/high AoA and no usable airspeed indication at all if the AoA fails, I know what I'd prefer. Especially if my takeoff and landing charts were referenced to IAS, whcih makes CAS a relatively uninteresting number. (except in cruise, where IAS and CAS are usually fairly close anyway)

4runner
8th Nov 2018, 12:59
So, for a 737, what would be the largest difference between IAS, uncorrected for AoA, and CAS, within the range of AoA that could be reasonably expected in flight? The large airplanes I've flown didn't correct IAS for AoA, and without looking them up, I don't recall that the airspeed calibration charts having a correction larger than 5 ish knots. Seems if it came down to a choice between an IAS that differed from CAS about 5 kt at low airspeeds/high AoA and no usable airspeed indication at all if the AoA fails, I know what I'd prefer. Especially if my takeoff and landing charts were referenced to IAS, whcih makes CAS a relatively uninteresting number. (except in cruise, where IAS and CAS are usually fairly close anyway)

what? Filler...

Centaurus
8th Nov 2018, 14:13
Here is another point of view. There is evidence the aircraft was diving steeply before impact with the water. Regardless what caused the stabilizer to have moved fully forward, there is no doubt the pilots would have been trying to pull out of the dive by pulling hard on the elevator. Extreme air loads caused by high speed would have been working against them. The significant forward position of the stabilizer would be in direct opposition to the elevator position during the attempted recovery; thereby severely limiting the effectiveness of the elevator.

Under the heading Manual Stabilizer Trim, (Boeing 737 FCTM Non Normal Section), the following advice is offered:

"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming."

To relieve airloads, the crew must momentarily release all backward pressure on the elevator then rapidly wind the stabilizer trim backwards manually or electrically. In turn, this allows more effective elevator control. In other words, a yo-yo manoeuvre. The crew needed to react instantly and correctly to relieve air loads in this manner. Unfortunately, the Lion Air crew did not have the altitude to successfully recover before impact.

Flutter speed
8th Nov 2018, 14:20
So, for a 737, what would be the largest difference between IAS, uncorrected for AoA, and CAS, within the range of AoA that could be reasonably expected in flight? The large airplanes I've flown didn't correct IAS for AoA, and without looking them up, I don't recall that the airspeed calibration charts having a correction larger than 5 ish knots. Seems if it came down to a choice between an IAS that differed from CAS about 5 kt at low airspeeds/high AoA and no usable airspeed indication at all if the AoA fails, I know what I'd prefer. Especially if my takeoff and landing charts were referenced to IAS, whcih makes CAS a relatively uninteresting number. (except in cruise, where IAS and CAS are usually fairly close anyway)

Just ran some numbers, in very general terms, depending on sensor position and factors like Mach number, in extreme cases... expect up to 5kts difference. Probably enough to trigger an IAS and ALT disagree on a modern airliner. For a plane flying at moderate speed the difference will be more towards 2kts.

KenV
8th Nov 2018, 14:30
Probably unrelated to this accident but deserves a rebuttal:...As far as I know the B737 manual states that during stall recovery with high engine power full nose down elevator might not be enough and reminds the crew to use aircraft nose down trim.I agree this note in the manual is likely not related to this accident. All the data available indicates the accident aircraft was well above stall airspeed for the pressure altitude they were operating in and thus there was plenty of elevator authority available.

Volume
8th Nov 2018, 14:41
the failure of one or both AoA sensors is not often part of the simulator training curriculum
Probably because the effect of such a failure can vary significantly, hence it is not a simple scenario with a clear procedure to train in the sim.
AoA is not directly indicated, AoA is not directly used by the pilot during normal or ermengy procedures.
AoA failure is implicitly trained as some of the failures which can be caused by AoA failure are trained.

If you only have 2 AoA, failure of one or failure of both should not make much difference, if both do no longer agree, yo do not know which one is faulty, so you have to assume both have failed.
We even already had the case that 2 out of 3 did fail (freeze at a safe value), so the computers decided that they must be correct, and the single different one (indicating an unsafe value) must be at fault...

Longtimer
8th Nov 2018, 14:43
Angle-of-attack sensor replaced before 737 Max crash

08 November, 2018
SOURCE: Flight Dashboard
BY: Firdaus Hashim
Singapore

Indonesia's National Transportation Safety Committee says an angle-of-attack sensor on the ill-fated Lion Air Boeing 737 Max 8 had been replaced a day before it crashed.

The committee says the sensor was replaced in Denpasar on 28 October, after pilots reported issues with the airspeed indicator.It adds that this was related to the faulty airspeed indication, which was first raised at a 5 November press conference by NTSC chief Soerjanto Tjahjono.

After the replacement, however, pilots that flew a Denpasar-Jakarta flight still found a 20° difference on the left-hand angle-of-attack sensor. During this flight, the pilots implemented "a number of procedures" to rectify the issues, and the jet subsequently landed in Jakarta safely.

The sensor that was removed in Denpasar has since been sent to NTSC offices in Jakarta, before being transferred to Boeing's headquarters in Chicago for further investigation. Investigators plan to reconstruct the flight and study the faults related to the sensor using Boeing's engineering simulator in Seattle.

Interviews have also been conducted with the pilots and cabin crews that operated PK-LQP prior to the crash, as well as technicians that maintained the jet in Denpasar, Jakarta, and Manado.

The NTSC adds that, based on issues faced by pilots on the Denpasar-Jakarta flight, it has recommended that Boeing notify 737 Max operators of the potential issues they could face with the sensors.

NTSC investigators and officials from Boeing and General Electric have identified some of the wreckage recovered from the seabed. These include the left CFM International Leap-1B engine, the right-hand main landing-gear, a tail section, aircraft sections 43, 44, 46 and 48, a cockpit oxygen bottle, a left-hand passenger door, and a wing-tip.

Boeing issued a operations manual bulletin on 6 November, directing operators to “existing flight crew procedures" to address circumstances involving erroneous angle-of-attack sensor information.

Indonesia's national search and rescue agency Basarnas has extended its mission to 10 November

glad rag
8th Nov 2018, 15:07
So, the plot thickens???

The original Airspeed Issue that then [eventually] led to a AOA sensor change that in fact was obscurating the original Airspeed Issue that was still there but in replacing the AOA sensor they introduced ANOTHER fault into the aircrafts indication and flight control system[s]?

None of which was reproducible on the ground....???

What a CF.

A Squared
8th Nov 2018, 15:19
So, the plot thickens.

The original Airspeed Issue that then [eventually] led to a AOA sensor change that in fact was obscurating the original Airspeed Issue that was still there but in replacing the AOA sensor they introduced ANOTHER fault into the aircrafts indication and flight control system[s]?

I'm not sure that is correct. The Airplane was written up for "IAS or ALT disagree shown after takeoff" and "Feel Diff Press LT ILL" (Feel Differential Pressure Light Illuminated, I think) If I've followed the technical discussion correctly (and I may not have) , both of those may have been caused by bad AoA data, and there may never have been an actual problem with the Airspeed.

threemiles
8th Nov 2018, 15:28
If data from one of two AOA sensors are bad there shall be no correcting nose up or down trim as the system cannot know which is the faulty sensor. If this behaviour was certified it is time to review the certification documents.

As it appears there is no guarantee that the pilots can timely recover from the upset when at low altitude this aircraft type should be grounded.

The emergency AD is a joke.

Smott999
8th Nov 2018, 15:30
Can the FDR show if the ND trim was driven by STS vs pilots manual input?
If Rostov is to be believed I guess No, hence the fantastic notion that a pilot trimmed Down for 12 seconds on GA at 3,000 ft.

Anyway seems perhaps Boeings really can kill pilots. Maxes at least.

glad rag
8th Nov 2018, 15:35
I'm not sure that is correct. The Airplane was written up for "IAS or ALT disagree shown after takeoff" and "Feel Diff Press LT ILL" (Feel Differential Pressure Light Illuminated, I think) If I've followed the technical discussion correctly (and I may not have) , both of those may have been caused by bad AoA data, and there may never have been an actual problem with the Airspeed.


Okay.

The actual circumstances beforehand will, most likely, be detailed in the report when it appears.

Tragic turn of events.

KenV
8th Nov 2018, 16:16
Probably unrelated to this accident but deserves a rebuttal....As far as I know the B737 manual states that during stall recovery with high engine power full nose down elevator might not be enough and reminds the crew to use aircraft nose down trim.Agreed, this is unrelated to this accident. All the available data indicate the accident aircraft was well above 1G stall for the pressure altitude and thus they had plenty of elevator authority. Further, that same data does not indicate the engines were at a "high power" setting.

DaveReidUK
8th Nov 2018, 16:16
The sensor that was removed in Denpasar has since been sent to NTSC offices in Jakarta, before being transferred to Boeing's headquarters in Chicago for further investigation. Investigators plan to reconstruct the flight and study the faults related to the sensor using Boeing's engineering simulator in Seattle.

I'm not sure that is correct. The Airplane was written up for "IAS or ALT disagree shown after takeoff" and "Feel Diff Press LT ILL" (Feel Differential Pressure Light Illuminated, I think) If I've followed the technical discussion correctly (and I may not have) , both of those may have been caused by bad AoA data, and there may never have been an actual problem with the Airspeed.

I would be very surprised if any fault is found with the removed sensor, given that its replacement clearly didn't rectify the issue.

Flutter speed
8th Nov 2018, 16:19
A trim runaway condition should be quite identifiable on a 737, these clunky trim wheels leave no misunderstanding of the direction and speed of trim at least. However, if the AOA disagree warning was triggered, and this also triggered a IAS disagree warning, it might have been difficult for the pilots to see the causal relation. If they would think that airspeed was unreliable and trusted AOA somehow more (despite the inevitable message), and the pilots would think that indeed they were approaching a high alfa condition, it would explain why they didn't intervene in the nose down trim by selecting the cutout switches.

Really hope the voice recorder will be found.

lomapaseo
8th Nov 2018, 16:40
If data from one of two AOA sensors are bad there shall be no correcting nose up or down trim as the system cannot know which is the faulty sensor. If this behaviour was certified it is time to review the certification documents.

As it appears there is no guarantee that the pilots can timely recover from the upset when at low altitude this aircraft type should be grounded.

The emergency AD is a joke.

Nobody is offering a guarantee nor can other aircraft models meet such a requirement without a pilot backup. We are still dependent on the knowledge, training and performance of the air crew.to mitigate system failure conditions in-flight.

The AD addresses this and the expectation is that it will be employed and the fleets (of many other manufacturers) will benefit by this "lesson learned"

A Squared
8th Nov 2018, 16:44
I would be very surprised if any fault is found with the removed sensor, given that its replacement clearly didn't rectify the issue.

Perhaps that is true, I'll just point out that I said "bad AoA data" not "Faulty AoA sensor" ;)

Hi_Tech
8th Nov 2018, 16:48
I just cannot believe that one faulty AOA sensor can make the aircraft trim nose down. There has to be more protection in the system design for this not to happen.
In the B777 which I am familiar with, each of the two ADIRUs (Air Data Inertial reference unit) receive both AOA inputs (There are two AOA sensors on most aircraft, same config on B737 also). This is compared with 'Calculated AOA' and a mid value is used. This is the redundancy built in the system on B777. Also each of the AOA sensor has two outputs, feed into two different computational channels. See the redundancy. There are actually 4 signals from two AOA sensors.
The full text from the B777 AMM is as below.
AOA Redundancy Management
The AOA redundancy management logic uses a modified midvalue selection.
The modified mid-value selection chooses the mid-value of these three AOA values:
* Left corrected AOA
* Right corrected AOA
* Calculated AOA.
The AOA redundancy management logic receives inputs from the inertial and air data systems to calculate the calculated AOA.

Has any one in this forum have access to B737 MAX AMM (Pages from AMM Chap 34-20-00) and if you can post the same system info for B737 MAX redudancy management of AOA signals.
I am just curious, and hope it does not bore other users.

mross
8th Nov 2018, 16:50
Why does a faulty AoA sensor trigger a 'Feel Diff Press'? It does not seem to be an informative message, especially when there is no hydraulic system failure.

And why does an aircraft have three pitots (so that one can be 'voted out') but only two alpha vanes?

gums
8th Nov 2018, 17:13
Salute!

Good poop, Hi Tech. And I agree.

I just cannot believe that one faulty AOA sensor can make the aircraft trim nose down. There has to be more protection in the system design for this not to happen.

The voting logic described for the 777 is comforting to me, next time I fly in one of those beasts.

My FBW experience involved a quad computer design, but used only three processors until one failed. Great debate over "middle value" versus "average", but finally the decision was "most benign" value. So that was the data used for gains and total movement and AoA/gee protection. Only problem with that was failure detection, because a subtle failure could result a static data value, which is not a good deal for some maneuvers or changing speed/pitch/roll etc.

Gums sends...

Hi_Tech
8th Nov 2018, 17:14
Why does a faulty AoA sensor trigger a 'Feel Diff Press'? It does not seem to be an informative message, especially when there is no hydraulic system failure.

And why does an aircraft have three pitots (so that one can be 'voted out') but only two alpha vanes?

The Feel computer has two channels and they independently regulate the two different HYD source pressures to do the job in this sytem. If there is a difference in he two channels metered HYD pressure above a set value (I think it is 25%, I cannot recollect), you get an 'Elev Feel Warning'. That is so in B747. So I will assume it is same in B737. A faulty AOA sensor can make the Elev Feel Computer malfunction also.
Hope that makes sense?

NiclasB
8th Nov 2018, 17:23
Just ran some numbers, in very general terms, depending on sensor position and factors like Mach number, in extreme cases... expect up to 5kts difference. Probably enough to trigger an IAS and ALT disagree on a modern airliner. For a plane flying at moderate speed the difference will be more towards 2kts.
So, let's see if I have gotten this right...? To improve the CAS estimate by an insignificant(?) 2-5kts, a vulnerability was introduced that could have a SINGLE sensor trigger a UAS, which by the QRH would have the pilots fly manually, in which case their life will be made a mess by the SAME sensor...?
As a mere PPL-I, I cannot fathom this. What am I missing?
As a daytime teacher of software engineers, I am beginning to suspect that this design decision, if confirmed true, will ever so sadly be useful in my teaching, together with the Apollo 1 fire and the Ariane 501 explosion... :{

SLFinAZ
8th Nov 2018, 17:23
I've got a fairly basic question, my understanding is that a fundamental concept in aircraft design is that a control surface should never be able to be neutralized let alone over ridden by it's trim tab(s). Yet from some of what I've read on this thread it seems that that it's actually possible with the 737 for the force of the trim tab to exceed the capability of the main control surface?? That makes no sense to me at all...

DaveReidUK
8th Nov 2018, 17:53
I've got a fairly basic question, my understanding is that a fundamental concept in aircraft design is that a control surface should never be able to be neutralized let alone over ridden by it's trim tab(s). Yet from some of what I've read on this thread it seems that that it's actually possible with the 737 for the force of the trim tab to exceed the capability of the main control surface?? That makes no sense to me at all...

Trimmable Horizontal Stabiliser (https://www.skybrary.aero/index.php/Trimmable_Horizontal_Stabiliser)

alf5071h
8th Nov 2018, 17:56
The technical, design, and certification aspects emerging from this accident are similar to other high profile accidents.
A ‘first-pass’ evaluation avoiding blinding thoughts of error, identifies that the ‘initiating’ factors were technical malfunctions (also AF447, Swedish CRJ, 737 AMS). Subsequently, ‘enabling’ factors which determine if the event was recoverable or not, depend on the assumptions relating to awareness, knowledge, and human intervention.

It would be interesting to understand how the design Failure Mode Effect Analysis (FMEA) dealt with an erroneous AoA input. What was assumed about the overall system integrity, failure frequency, and obviously the effect. And for the latter, what human contribution was assumed in mitigation.

From the AD, it appears that there is now concern about awareness and meaning of the multiple alerts and range of instruments / systems affected; the difficulty for the crew to make sense of the overall situation. If there is a specific checklist, is it dependent on situation, context, or that crew performance would alway be adequate?

In certification, what was assumed about input systems, normal or failed, not requiring ‘significant pilot strength, awareness, or attention’ (or similar judgemental text more often divorced from operational context)?

In airworthiness, how many previous sensor failures, consequential events; what analysis was made / tracked. What was assumed in this process, assembling isolated features requiring in-depth system knowledge to foresee and circumvent an accident?

In mitigation, will the AD information and check list be enough to counter the adverse effects as above; is this also an assumption that crews will now manage all future encounters, in all foreseeable circumstances, in every context? Or is this still a judgement, a short-term gamble ?

Semreh
8th Nov 2018, 18:26
Trimmable Horizontal Stabiliser

Your link has an onwards link to a very thought provoking article published June 2013: "Do you really understand how your trim works?"- Captain Alex Fisher

I'm not allowed to post URLs, but I hope a friendly moderator will review it and do the necessary magic.

hotel tango tango papa sierra ://www.skybrary.aero/bookshelf/books/2627.pdf

jimtx
8th Nov 2018, 19:14
Here is another point of view. There is evidence the aircraft was diving steeply before impact with the water. Regardless what caused the stabilizer to have moved fully forward, there is no doubt the pilots would have been trying to pull out of the dive by pulling hard on the elevator. Extreme air loads caused by high speed would have been working against them. The significant forward position of the stabilizer would be in direct opposition to the elevator position during the attempted recovery; thereby severely limiting the effectiveness of the elevator.

Under the heading Manual Stabilizer Trim, (Boeing 737 FCTM Non Normal Section), the following advice is offered:

"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming."

To relieve airloads, the crew must momentarily release all backward pressure on the elevator then rapidly wind the stabilizer trim backwards manually or electrically. In turn, this allows more effective elevator control. In other words, a yo-yo manoeuvre. The crew needed to react instantly and correctly to relieve air loads in this manner. Unfortunately, the Lion Air crew did not have the altitude to successfully recover before impact.

I saw this once in a 727 simulator a long time ago. I was FE and the exercise was not runaway trim but somehow the crew got trimmed for fast speed and couldn't get any response with back elevator until they relieved back elevator pressure and then they could trim. My memory is hazy but if you are hand flying and the trim runs for 10 seconds wouldn't sometime in that period the opposite elevator input cause the stab trim brake to engage?

rideforever
8th Nov 2018, 19:28
I can only see more and more such incidents occurring.
The telemetry including stick-shaking that the pilots get is mostly interpreted meaning that you do not feel the plane itself in your hands, but a computer has decided what to tell you, and so you .... really are up against it.
In order to correctly comprehend the situation, you have to engage the subconscious animal (who understands physical reality), and integrate it with your conscious mind's training of normal functioning of the instruments, and add to that .... your behind the scenes understanding of how the computer works in x number of situations that you have been warned about. And you have to integrate these three systems of consciousness, into a correct response in a number of seconds whilst the aircraft is falling into the sea.
The chances that you can do that are very slim.
Sullenberger, when he saved his place, reverted to the subconscious animal (who feels physical reality) and had had deep training in the military, he then cut off any routes that had a low chance of success, and was left with a single option, that his well trained animal executed.
Within himself, he reverted to one reliable well trained system.
And it would be best for pilots if they could in such a situation, cut the s***, and revert to basic operation in seconds.
I believe that trying to "solve" the problem is the problem, far too complex.
Probably what the airlines will eventually do is teach pilots a handful of typical loc situations with workarounds.
But I don't think pilots will anymore be able to understand what is happening in a new loc situation.
They will simply try to relate the new loc situation to one of the dozen they have learnt about, if they get a match then they have a workaround, if not .... there is no answer.
Of course if you were raised on a farm, you might have the idea to pull the circuit breakers and fly it like a cropduster, but you will never been trained to do that because it goes against the future cost savings of the airlines, and frankly you would have to be a very unusual kind of person to do that.
In any case, a lifeboat (emergency procedure) is only a lifeboat if it is well maintained and used regularly, otherwise you may as well not have one.
In fact on the previous 4 runs the flight had problems, but they kept going and thought they would solve it in the air. And the maintenance crew thought changing the sensor would fix things - but did they take the plane up to see if it did. It's not good.
There is a lot of financial pressure and insincerity to be frank.

If I was a pilot, in such a situation, I would
(a) try to relate it to a known issue or workaround, if not
(b) 45 seconds limit to comprehend the new situation, if not
(c) pull the circuit breakers and fly it manually ... on this aircraft some system are not fully manual so know that as well, and this must be trained so you have certainty about it.

... but the airline would be unlikely to train you for (c) because it smells of panic.

krismiler
8th Nov 2018, 19:36
Back in 2008 there was a very similar incident with a Qantas A330, except in that event the Pilots regained control and managed to land.

https://www.atsb.gov.au/publications/investigation_reports/2008/aair/ao-2008-070/

hans brinker
8th Nov 2018, 19:40
I've got a fairly basic question, my understanding is that a fundamental concept in aircraft design is that a control surface should never be able to be neutralized let alone over ridden by it's trim tab(s). Yet from some of what I've read on this thread it seems that that it's actually possible with the 737 for the force of the trim tab to exceed the capability of the main control surface?? That makes no sense to me at all...

ELI5YO:
Someone else already gave you the wiki page. On most "newer' big aircraft there is a moving horizontal stabilizer. If you trim, or the auto-trim works, it sets the movable horizontal stabilizer so that you don't have to push or pull on the elevator. there is no trim tab. The stabilizer is a lot bigger than the elevator, so if something goes wrong with the setting of the stabilizer, like a runaway trim due to an air data/aoa failure it could overpower the capabilty of the elevator/pilot input. Normally the emergency checklist would direct you to do something to switch the auto-trim off and regain manual control (on the B737 elevator cutout switches).

FIRESYSOK
8th Nov 2018, 20:13
If the PM is actioning the QRH and doesn’t realize that the forward-moving trim wheel is NOT being moved by the PF, I can see a situation developing whereby a breakdown in communication could lead to a massive out-of-trim condition with the PF waiting for some sort of QRH-led solution to be forthcoming.

I can see this scenario happening...quite easily...and quickly. Many are pontificating the need to cut out the stabiliser trim and run the stab trim runaway items...that’s easy to say in an armchair when not faced with multiple, confusing sensory inputs.

The idea that this STS system can continue in action after faulty AOA-data driven miscompares, is odd. IMO

MartinAOA
8th Nov 2018, 20:39
Maybe it is me getting grouchy in my old age, but the whole salute, sends, opines and such really takes away from the message....
People like Gums can afford it ;) :Interview with Lt. Col. Pat "Gums" McAdoo (Ret) (http://www.f-16.net/interviews_article28.html)

BTW, thank you for your service, Gums!

A Squared
8th Nov 2018, 20:49
For less than $1500 a GA pilot can buy a portable EFIS giving GPS Artificial Horizon, GPS Groundspeed, GPS Vertical Speed and GPS Track with a 4 hour rechargeable battery.
Yet new commercial aircraft are still produced with standby instruments fed from a pitot-static system and a standby compass with a compass card...WHY?
All of the accidents over the years caused by blocked or faulty pitot probes/static source/instruments could have been prevented by GPS instruments totally independent of any aircraft system.
Instead of one standby instrument(s) on the Captain's side, each pilot could have standby instruments for minimal cost.


You understand that the current prevailing understanding of the accident is that a trim system on the airplane was introducing pitch changes that the pilots weren't able to overcome, right? Rhetorical question, it seems not.

gums
8th Nov 2018, 20:51
@hans

No problem, man. I can take it, as my call sign was assigned to me and I did not choose it.

I opine when not having reams of data, testimony or having been the principal pilot in the incident. So will continue to designate opinion and theory versus asserting facts or lecturing the newbies and non-pilots, as some here do. We have the Tech Log for education as well as opinion and theories.

I have never told a poster “if you had read.......”. I have never brought up the ethnic or religious background of a crew in an accident, and I will bet I have taught more pilots to fly from more countries than you! So there! I got personal, but back to analysis and opinion and experience in these matters to hope we have no more like this one.

out,

JPJP
8th Nov 2018, 21:15
After the replacement, however, pilots that flew a Denpasar-Jakarta flight still found a 20° difference on the left-hand angle-of-attack sensor. During this flight, the pilots implemented "a number of procedures" to rectify the issues, and the jet subsequently landed in Jakarta safely.

I found the underlined quote from the article curious. Either they have an AOA Indicator on the PFD, or they were able to get into the Maintenance side of the FMS, or a maintenance person on the flight deck plugged into the Mx port. An AOA Indicator is an option and it does read up to a maximum value of + 21 degrees. That would seem to be an extreme value to see inflight after the aircraft was just returned to service (‘fixed’).

sAx_R54
8th Nov 2018, 21:31
Except that the author of the quoted post took pains to stress that both airspeed and groundspeed values are affected by unreliable AoA, in fact GS was mentioned twice in that context:



I look forward to learning how so.

Would have thought thus far you have learned plenty!

DaveReidUK
8th Nov 2018, 21:45
Would have thought thus far you have learned plenty!

On the contrary, I still need to learn the art of the pithy one-liner. :O

Vessbot
8th Nov 2018, 21:51
The circumstances around this discussion are making me feel glad for the trim cutout buttons being on the yokes on my plane instead of somewhere else you have to reach....

JLWSanDiego
8th Nov 2018, 22:04
Any information on the search for the CVR?

MickG0105
8th Nov 2018, 22:05
A trim runaway condition should be quite identifiable on a 737, these clunky trim wheels leave no misunderstanding of the direction and speed of trim at least. However, if the AOA disagree warning was triggered, ...

I've inferred from the emergency AD that the AOA DISAGREE alert is an optional rather than standard item on the Max. I suspect that PK-LQP probably wasn't fitted with one.

sAx_R54
8th Nov 2018, 22:12
Despite the outcry from some posters above in the light of the Boeing bulletin and FAA directive, the fact remains that existing procedures should have brought this aircraft safely back to ground.

The bulletin and the AD both say this.

It appears that maintenance and training are the major contributors to this tragic accident.

Maintenance: a maintenance culture that allows an aircraft to fly 4 successive sectors with a known issue affecting air data is completely unacceptable, and it certainly wouldn’t happen in any airline with a proper attitude towards maintenance and safety.

Training: given the above was allowed to occur, a well trained crew should still have been able to handle it. In the absence of well trained crew, an accident was simply a matter of time.

There is no such thing as pilot-error in an airline, only a poor training system which allows poorly trained pilots to operate.

It must take remarkable fortitude to ignore what has now appeared in plain sight, suggesting the previous sectors were somewhat operational beta-tests of an inherent and unknown programming defect. What is completely unacceptable is that this was not exposed in the commissioning flight tests!

GarageYears
8th Nov 2018, 22:19
I keep seeing references to "training" and a procedure for runaway trim, both of which are obviously real things, and training for runaway trim is also real.

However, training for the particular failure suspected here may NOT be possible, at least not in any MAX simulator.

The current breed of simulators for the majority of 'new' aircraft are built around a "binary" supplied by the aircraft manufacturer, which is now part of the data package.

The binary is essentially the aircraft avionics software and any other systems models, packaged for use in a realtime computing architecture. The malfunction list for the data package is fixed and is intended to include any of the anticipated failures that the crew may experience.

Adding a specific malfunction is something that requires the binary to be updated.

Sitting here, I don't have access to the list of supported failures included with the current release MAX binary, but my strong suspicion is there is no malfunction support for AOA sensor failure (or stuck or similar), meaning any crew encountering this would have no possibility of seeing this exact failure and problem cascade in the simulator. Maybe some with better access to a MAX sim can confirm?

- GY

DaveReidUK
8th Nov 2018, 22:27
It must take remarkable fortitude to ignore what has now appeared in plain sight, suggesting the previous sectors were somewhat operational beta-tests of an inherent and unknown programming defect. What is completely unacceptable is that this was not exposed in the commissioning flight tests!

Yes, that the same defect apparently persisted through four consecutive sectors, and successive crews were in effect testing the outcome of failed rectification attempts, is inexcusable.

That said, an "inherent and unknown programming defect" (in any software environment, not just aerospace) by definition requires a specific, unforeseen combination of factors (possibly including other defects) in order to trigger it. It's entirely possible that the required combination of factors never emerged during the certification process.

If there had been precursors to this issue, while we might not have heard about them prior to the crash, they would undoubtedly have emerged in the last 10 days. AFAIK, none have.

LaissezPasser
8th Nov 2018, 22:37
I found the underlined quote from the article curious. Either they have an AOA Indicator on the PFD, or they were able to get into the Maintenance side of the FMS, or a maintenance person on the flight deck plugged into the Mx port. An AOA Indicator is an option and it does read up to a maximum value of + 21 degrees. That would seem to be an extreme value to see inflight after the aircraft was just returned to service (‘fixed’).

Since this has been a point of interest from the outset, I asked a journalist friend who's covering this story in Jakarta for a major US paper: Did Lion purchase the cockpit AoA indicator option for the PFD?
His reply was: "[T]here was no standalone AoA indicator in the cockpit" on JT610.
So perhaps prior to the incident flight, as JPJP suggests, "they were able to get into the Maintenance side of the FMS, or a maintenance person on the flight deck plugged into the Mx port." That seems like a valid inference if the information in the flightglobal article is correct.
This isn't my contact's first time covering an Indonesian air disaster, and he's got a very good track record. So take this data point for what it's worth.

CONSO
8th Nov 2018, 22:46
Whatever happened to the ol ' three sensors, at least two of three to agree concept for data to be used ?

Capn Bloggs
9th Nov 2018, 00:18
I agree this note in the manual is likely not related to this accident. All the data available indicates the accident aircraft was well above stall airspeed for the pressure altitude they were operating in and thus there was plenty of elevator authority available.
I would surmise that with full nose down stab, there is no way any nose-up elevator input would overcome it at normal speeds. The faster you go, the worse it would become. Probably why this aeroplane crashed the way it did. Or do you think the crew just let the nose drop while being occupied with something else?

Agreed, this is unrelated to this accident. All the available data indicate the accident aircraft was well above 1G stall for the pressure altitude and thus they had plenty of elevator authority. Further, that same data does not indicate the engines were at a "high power" setting.
I don't know about your aeroplane, but if I set mine up at low level with the clean UA config power setting, the thing will shortly be going like a rocket.

aterpster
9th Nov 2018, 01:47
The circumstances around this discussion are making me feel glad for the trim cutout buttons being on the yokes on my plane instead of somewhere else you have to reach....
Not a problem for a properly trained crew. For the captain it is close to his right hand and drilled into him in training. For the F/O who has the yoke in his right hand, his left hand is close by to the cutout switch.

This has been working on thousands of 707s, 727s, and 737s, for eons.

Lord Farringdon
9th Nov 2018, 02:01
@hans

No problem, man. I can take it, as my call sign was assigned to me and I did not choose it.

I opine when not having reams of data, testimony or having been the principle pilot in the incident. So will continue to designate opinion and theory versus asserting facts or lecturing the newbies and non-pilots, as some here do. We have the Tech Log for education as well as opinion and theories.

I have never told a poster “if you had read.......”. I have never brought up the ethnic or religious background of a crew in an accident, and I will bet I have taught more pilots to fly from more countries than you! So there! I got personal, but back to analysis and opinion and experience in these matters to hope we have no more like this one.

out,







Haha! I'm confirming a kill right there Gums. Maintenance have been authorized to record it on the side of your Viper!

b1lanc
9th Nov 2018, 02:24
Yes, that the same defect apparently persisted through four consecutive sectors, and successive crews were in effect testing the outcome of failed rectification attempts, is inexcusable.

That said, an "inherent and unknown programming defect" (in any software environment, not just aerospace) by definition requires a specific, unforeseen combination of factors (possibly including other defects) in order to trigger it. It's entirely possible that the required combination of factors never emerged during the certification process.

If there had been precursors to this issue, while we might not have heard about them prior to the crash, they would undoubtedly have emerged in the last 10 days. AFAIK, none have.

Thank you for some sanity! Late 70's our organization reviewed Airbus testing procedures for FBW SW under development. I'm going purely on dated memory here, but as I recall AB contracted out 3 separate test beds in three countries, none of whom knew of the other's existence, to independenly test FBW software. Each were expected to develop their own test procedures. We reviewed the test results and the rationale for their strategy (not for AB but for an independent program). AB expected that each location would find different 'bugs'. It didn't turn out that way. Well over 90% were identical findings with very little if any (I don't remember any at least) unique critical FBW bugs discovered. That is not the result that they expected.

There were also early and persistent concerns of deep stall potential with the F-16 at high AoA (unrelated to FBW). So I'll ask this question. Did Boeing put in some additional 'safeguards' to prevent a potential reoccurence of AF 447?

Vessbot
9th Nov 2018, 02:47
Not a problem for a properly trained crew. For the captain it is close to his right hand and drilled into him in training. For the F/O who has the yoke in his right hand, his left hand is close by to the cutout switch.

This has been working on thousands of 707s, 727s, and 737s, for eons.

In the possible scenario where it suddenly takes 4 hands to hold the nose up (like what is being speculated here) it would certainly still be a problem.

jimtx
9th Nov 2018, 03:33
I’m still wondering about the stab trim brake and if it is still in the 737NG.

edmundronald
9th Nov 2018, 03:55
In the possible scenario where it suddenly takes 4 hands to hold the nose up (like what is being speculated here) it would certainly still be a problem.


There seems to be a reluctance in the industry to realistically quantify the expectation that a crew will be able to follow a recovery procedure.
Human failures whether due to cognitive overload, lack of training, too many sectors, or baby cried last night, are holes in the Swiss cheese exactly like mechanical faults.

The mechanical failures are quantified, while in some strange way maybe connected to liability and legal engineering, crew ability is expected to be perfect.
And if the pointy end can't cut faultless on that day, too bad, they won't make it - nor will the paying freight in the cylindrical end.
But the fact that there was a procedure, however improbable that it can work outside the sim, negates liability. Beancounters happy.

I don't think that the industry is only recruiting clones of Sully.
And btw Sully dealt with a clear mechanical failure, he didn't need to psychoanalyze and then lobotomize HAL in real time.

If real pilots can't RELIABLY deal with dangerously misbehaving automation then maybe the automation needs improving.
Someone over there where they make rules and profits, should be forced to accept that real pilots fly planes.

And the way to make things improve - in the US system - is by attaching liability to a process which only the best or luckiest can follow.

Edmund

gums
9th Nov 2018, 04:45
Where y'at, Edmund? Hans can figure that greeting out, maybe.

The following is not 100% directed to the Lion crash, but at Edmund's views.

Some great points, and some of us here talked a lot about the AF447 sequence of events and the procedures and many other aspects of that sad story. One thing that seemed to come up over and over was the confusing reversion of control laws. See the thread for more disussion.

My personal view was the 'bus folks tried too hard to preserve "nice" features of the prime control laws as each reversion layer came to be required. So the system did not go from highly automated and protective mode to a basic "manual" set of control laws. In other words, something resembling "hand flying". We pilots should not have to memorize and obey 5 layers of control laws and such when things go awry. A backup law and maybe one more with zero "help" from Hal could be a realistic approach. But to see a buncha layers, go see the Airbus sequence.

/opinion/ Unless your plane is a pure FBW, unstable design such as I flew, then it seems to me we should have some means to quickly and effectively revert to a pure "hand flying" machine if it passes all the agency certification requirements. Otherwise, go as far as you can, but no intermediate steps as we saw in AF447. /opinion off/

Gums...

threemiles
9th Nov 2018, 05:42
Yes, that the same defect apparently persisted through four consecutive sectors, and successive crews were in effect testing the outcome of failed rectification attempts, is inexcusable.

That said, an "inherent and unknown programming defect" (in any software environment, not just aerospace) by definition requires a specific, unforeseen combination of factors (possibly including other defects) in order to trigger it. It's entirely possible that the required combination of factors never emerged during the certification process.

If there had been precursors to this issue, while we might not have heard about them prior to the crash, they would undoubtedly have emerged in the last 10 days. AFAIK, none have.

This is nonsens. Certification is a desktop exercise. You go through the aircraft systems schematics and make a risk analysis about what if then. It is not about trying to let something emerge.

CYTN
9th Nov 2018, 05:48
KNKT states AoA sensor replaced on 28TH Oct prior to JT43 flight to Jakarta . but that flight still had issues . So was the sensor probe not the core issue . Could it have been an issue with the mounting . Or something else beyond this . Could the sensor that was replaced be a different part type to the origional . Just asking those of better understanding .

Icarus2001
9th Nov 2018, 05:54
There were also early and persistent concerns of deep stall potential with the F-16 at high AoA (unrelated to FBW). So I'll ask this question. Did Boeing put in some additional 'safeguards' to prevent a potential reoccurence of AF 447?

How is Airbus FBW and associated "laws" relevant to discussion about a Boeing 737 crash?

threemiles
9th Nov 2018, 05:56
Thank you for some sanity! Late 70's our organization reviewed Airbus testing procedures for FBW SW under development. I'm going purely on dated memory here, but as I recall AB contracted out 3 separate test beds in three countries, none of whom knew of the other's existence, to independenly test FBW software. Each were expected to develop their own test procedures. We reviewed the test results and the rationale for their strategy (not for AB but for an independent program). AB expected that each location would find different 'bugs'. It didn't turn out that way. Well over 90% were identical findings with very little if any (I don't remember any at least) unique critical FBW bugs discovered. That is not the result that they expected.

There were also early and persistent concerns of deep stall potential with the F-16 at high AoA (unrelated to FBW). So I'll ask this question. Did Boeing put in some additional 'safeguards' to prevent a potential reoccurence of AF 447?

This software scenario is not applicable in this case. This is an aircraft systems design issue as simple as: two out of two sensors show different data. This has nothing to do with software. It is a conceptional issue. Anything in an aircraft that is able to drive primary control elements should never be able to be triggered by a non-majority vote. This is simple basics.

It is also very surprising that an AOA difference display is on the list of options only. This is a pure up-selling concept to make more profit. It has nothing to do with incremental costs during manufacturing.

The whole "the aircraft design is safe", "the manufacturer did a good job", "well trained pilots would have recovered", "maintenance did a bad job", "third world habits" is arrogant and very biased to say the least. This accident happened in the aviation world of FAA certification processes that cost taxpayers and aircraft buyers millions.

MeLuvUlongtime
9th Nov 2018, 05:57
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/534x741/screen_shot_2018_11_09_at_1_54_42_pm_6e78e3d4529ba9586622ee1 833ae270368e336c3.png
https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/548x734/screen_shot_2018_11_09_at_1_55_07_pm_38365be5e043746c535e2df 50076210fddb8ba2f.png

Icarus2001
9th Nov 2018, 06:14
Perhaps I am missing something here as this technical discussion is quite esoteric but Boeing advise ...."failure condition that can occur during manual flight only." The bolding from Boeing.

So all this discussion around pilots being under skilled and not being able to sort out an issue after disconnected the AP becomes even more interesting as the FCOM bulletin suggests that if the AP was flying the issue would have been resolved? Perhaps there is more significant information to come, perhaps once the FDR information has been released. At this stage it is about PR departments getting in with their version to bias the discussion to suit corporate aims.

threemiles
9th Nov 2018, 06:17
How can "Automatic disengagement of autopilot" be an effect from AOA disagree, if the failure condition "can occur during manual flight only"?

threemiles
9th Nov 2018, 06:19
Perhaps I am missing something here as this technical discussion is quite esoteric but Boeing advise ...."failure condition that can occur during manual flight only." The bolding from Boeing.

So all this discussion around pilots being under skilled and not being able to sort out an issue after disconnected the AP becomes even more interesting as the FCOM bulletin suggests that if the AP was flying the issue would have been resolved? Perhaps there is more significant information to come. perhaps once the FDR information has been released. At this stage it is about PR departments getting in with their version to bias the discussion to suit corporate aims.

The failure condition evolved in manual flight right after take-off. The bulletin states: "Inability to engage AP"

Icarus2001
9th Nov 2018, 06:43
The failure condition evolved in manual flight right after take-off. How do you know this ? Or are you just surmising from the FR data?

AlexGG
9th Nov 2018, 06:44
How can "Automatic disengagement of autopilot" be an effect from AOA disagree, if the failure condition "can occur during manual flight only"?

When you fly on autopilot. AoA disagree causes autopilot to disengage. It won't engage back so you are now in manual flight only. Then, stab trim runs away in manual flight only.

Bleve
9th Nov 2018, 06:57
Ever since AF447, 'IAS Disagree' has been front and centre of emergency training. Quite possibly on this flight the AOA issue generated an IAS Disagree message and the crew (quite reasonably) carried out the IAS Disagree checklist. The first step of which is to disconnect the autopilot and fly manually. Now the door is open for the uncommanded stab trim problem to rear it's ugly head.

Bergerie1
9th Nov 2018, 07:07
Bleve,

And my belief is that when the crew started to fly manually they might well have found themselves having to cope with the 'yo-yo' manoeuvres described by Centaurus in a previous post (I quote him in italics below) while perhaps also being distracted by multiple warnings as described in the recent Boeing bulletin.

"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming."

To relieve airloads, the crew must momentarily release all backward pressure on the elevator then rapidly wind the stabilizer trim backwards manually or electrically. In turn, this allows more effective elevator control. In other words, a yo-yo manoeuvre. The crew needed to react instantly and correctly to relieve air loads in this manner. Unfortunately, the Lion Air crew did not have the altitude to successfully recover before impact.

If that was the case, I wonder how well many of us would have coped in that situation.

ChicoG
9th Nov 2018, 07:12
KNKT states AoA sensor replaced on 28TH Oct prior to JT43 flight to Jakarta . but that flight still had issues . So was the sensor probe not the core issue . Could it have been an issue with the mounting . Or something else beyond this . Could the sensor that was replaced be a different part type to the origional . Just asking those of better understanding .

https://www.havocscope.com/tag/counterfeit-aircraft-parts/

DaveReidUK
9th Nov 2018, 07:31
This is nonsense. Certification is a desktop exercise. You go through the aircraft systems schematics and make a risk analysis about what if then. It is not about trying to let something emerge.

You're not making sense. No, of course it isn't about that. By definition you can't "try to let something emerge" if you don't know it exists.

But it happens. If you're suggesting, as you seem to be, that certification doesn't involve flight testing, that's clearly nonsense.

Flight Test Guide for Certification of Transport Category Airplanes - FAA (https://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.information/documentID/1033309)

bsieker
9th Nov 2018, 07:50
I can only see more and more such incidents occurring.
[...] you have to engage the subconscious animal (who understands physical reality)

[...]

Sullenberger, when he saved his place, reverted to the subconscious animal (who feels physical reality)


The "animal" in humans does quite definitively NOT understand or feel the physical reality of three-dimensional flight. Not even close.

I recommend this report by the ATSB (https://www.atsb.gov.au/media/29971/b20070063.pdf) about spatial disorientation to learn about the many ways the animal mind will get it thoroughly and dangerously (and often fatally) wrong. We are not birds (and even they will get it wrong, they just don' make the news).


If I was a pilot, in such a situation, I would
[...]


No you wouldn't.


Bernd

CYTN
9th Nov 2018, 07:51
Again , I am just curious . If they replaced a sensor should this show up on the maintenance log ? , I cannot see it . I see fushing and testing but no reference to a replacement part . Also my point as regards fitting a different part type , I was not specifically hinting at a copy but rather using a similar part that may be considered an acceptable replacement if the exact matched part was unavailable at the time .

A Squared
9th Nov 2018, 08:17
Again , I am just curious . If they replaced a sensor should this show up on the maintenance log ? , I cannot see it . I see fushing and testing but no reference to a replacement part . Also my point as regards fitting a different part type , I was not specifically hinting at a copy but rather using a similar part that may be considered an acceptable replacement if the exact matched part was unavailable at the time .

Agree. I don't see anything on the aircraft log that indicates a part was replaced. It seems like I recently read that the AoA sensor was replaced on flight prior to flight immediately before the accident flight.

Edit: Now I'm scratching my head. I was trying to verify where I read that the AoA sensor wasn't replaced on the DPS-CGK flight shown on the log page, but on a prior flight, and it seems I read it in a post you made.

KNKT states AoA sensor replaced on 28TH Oct prior to JT43 flight to Jakarta . but that flight still had issues . So was the sensor probe not the core issue . Could it have been an issue with the mounting . Or something else beyond this . Could the sensor that was replaced be a different part type to the origional . Just asking those of better understanding .

AGBagb
9th Nov 2018, 08:20
Ever since AF447, 'IAS Disagree' has been front and centre of emergency training. Quite possibly on this flight the AOA issue generated an IAS Disagree message and the crew (quite reasonably) carried out the IAS Disagree checklist. The first step of which is to disconnect the autopilot and fly manually. Now the door is open for the uncommanded stab trim problem to rear it's ugly head.

At assorted points in this thread we've wondered whether the Memory/QRF section for an IAS Disagree included an alert about the StabTrim issue, or whether it's in a separate Memory/QRF section. What I've seen so far suggests that the Runaway StabTrim in Manual Flight issue is NOT mentioned in the IAS Disagree section - but I've not really seen the QRF for this exact model of 737. Anyone?

DaveReidUK
9th Nov 2018, 08:45
Agree. I don't see anything on the aircraft log that indicates a part was replaced. It seems like I recently read that the AoA sensor was replaced on flight prior to flight immediately before the accident flight.

Edit: Now I'm scratching my head. I was trying to verify where I read that the AoA sensor wasn't replaced on the DPS-CGK flight shown on the log page, but on a prior flight, and it seems I read it in a post you made.

The AoA sensor was reportedly replaced at Denpasar on 28th October during the 12 hours that the aircraft was on the ground there. That action would be recorded on the tech log for the Manado-Denpasar sector, either as an action taken in response to a snag raised by the crew on that flight or as a maintenance entry.

AFAIK, we haven't seen the tech log for that sector, only that for the subsequent Denpasar-Jakarta sector. So the log page where the AoA replacement is recorded isn't in the public domain, nor should we necessarily expect it to be.

CurtainTwitcher
9th Nov 2018, 08:47
So a plausible scenario for the crew faced based on the Boeing Bulletin is:

At or soon after rotate, so message like "IAS disagree", possibly other messages and warnings, possibly even stick shaker.
Manually flying so no autopilot to drop out.
As they are manually flying, and trimming, the runaway stabilizer fault is masked and dealing with the unreliable airspeed.
Probably running the unreliable airspeed memory items
After not trimming for 5 seconds, STS trims nose down, PF counteracts with nose up pitch and trimmed, runaway trim is masked for 5 seconds.
As they are solving the UA checklist, speed is increasing, air loads on horizontal stabilzer increase.
A series of sequences of manual trim, 5 sec delay, then runaway stab, manual pitch up and trim, ratcheting down the stabilizer, pilots compensate with
Eventually the speed increases and air load becomes so large, that both pilots are unable to overcome the nose down stabilizer trim all the way forward becoming unrecoverable as there is a further rapid increase in speed.

Basically in this type of scenario, the crew are confronted with an intermittent runaway stabilizer in addition to a UA. This intermittency is a difficult problem to nut out in the cacophony of noise and confusion of an unreliable airspeed scenario. Ironically, it may be possible they may of actually had three valid IAS indications, in close agreement, further heightening the confusion.

birdspeed
9th Nov 2018, 08:53
Perhaps, it would be a good idea to put ‘stab cutout’ into the memory items for the UAS checklist on the Max.

mross
9th Nov 2018, 08:54
The Feel computer has two channels and they independently regulate the two different HYD source pressures to do the job in this sytem. If there is a difference in he two channels metered HYD pressure above a set value (I think it is 25%, I cannot recollect), you get an 'Elev Feel Warning'. That is so in B747. So I will assume it is same in B737. A faulty AOA sensor can make the Elev Feel Computer malfunction also.
Hope that makes sense?
Feel Diff Press

But there was no report of hydraulic pressure falling. So could the Feel Diff Press have illuminated due to elevator pitot disagree? The disagree, itself, triggered by a faulty alpha vane?

Lord Farringdon
9th Nov 2018, 08:57
How can "Automatic disengagement of autopilot" be an effect from AOA disagree, if the failure condition "can occur during manual flight only"?

The bulletin highlights nose down stabilizer trim due to erroneous AOA in manual flight only. That's what the bulletin is about. But it also mentions some other things that erroneous AoA can be responsible for including disengaging the AP. Logically, I take that as meaning that erroneous AoA effects can occur in any control condition one of which may be when in AP mode. Erroneous AoA affects both flight control regimes, but as a result of AoA erroneous data, nose down stabilizer trim will only occur in manual flight. Happy to be corrected by anybody who knows more about these things than I do.

A Squared
9th Nov 2018, 08:58
The AoA sensor was reportedly replaced at Denpasar on 28th October during the 12 hours that the aircraft was on the ground there. That action would be recorded on the tech log for the Manado-Denpasar sector, either as an action taken in response to a snag raised by the crew on that flight or as a maintenance entry.

AFAIK, we haven't seen the tech log for that sector, only that for the subsequent Denpasar-Jakarta sector. So the log page where the AoA replacement is recorded isn't in the public domain, nor should we necessarily expect it to be.

Agree with all that. the "scratching my head" was about CYTN asking a question to which he appears to have supplied the answer in a prior post. No matter, at least it clarified in my mind when the AoA sensor was replaced.

FullWings
9th Nov 2018, 09:24
At assorted points in this thread we've wondered whether the Memory/QRF section for an IAS Disagree included an alert about the StabTrim issue, or whether it's in a separate Memory/QRF section. What I've seen so far suggests that the Runaway StabTrim in Manual Flight issue is NOT mentioned in the IAS Disagree section - but I've not really seen the QRF for this exact model of 737. Anyone?
A good question.

Imagining what the crew might have been be faced with on takeoff, it looks like at some point they probably had the symptoms of UAS: differing airspeed indications including warnings of the same. The AML entries for the previous flight(s) would have been a factor in the diagnosis, as was the limited time available to reach an initial conclusion and do something about it. Would you expect the aircraft to be exactly in trim? Not really as you don’t know for sure what your airspeed actually is. Are there indications of anything else that might be wrong that needs to be addressed *right now*, considering the workload already present? Well, there are some clues but it would take a lot of dot-joining and spare capacity.

To me, the killer is that, in general, the trigger for isolating the stabiliser in most aircraft is a warning that the stabiliser is out-of-control and/or the pilot detecting continuous stabiliser motion. It is likely that *neither* of these triggers was present because a) the system was working as designed (no warning) and b) the stabiliser motion was likely intermittent and reversible and with UAS you’d be expecting varying trim loads until you reached a steady state.

This is total speculation but looking at it from a HF perspective, I suspect that the primary task of controlling the airframe was challenging enough that they didn’t get very far along the road of analysing the problem before it overcame them...

Clandestino
9th Nov 2018, 09:50
In the possible scenario where it suddenly takes 4 hands to hold the nose up (like what is being speculated here) it would certainly still be a problem.

I really can't imagine anyone, anywhere designing the synthetic feel system that requires four hands to hold the nose up and than having it certified. Running out of pitch authority is another matter.

We pilots should not have to memorize and obey 5 layers of control laws and such when things go awry. A backup law and maybe one more with zero "help" from Hal could be a realistic approach. But to see a buncha layers, go see the Airbus sequence.So, when your LEF folded, did you consider the intricacies of the Viper's aerodynamics and FBW or you just countered the unwanted roll? Airbus is just the same. Control gains and effects may vary but if the attitude doesn't follow pılot's inputs it's not just FBW that got shot.

Unless your plane is a pure FBW, unstable design such as I flew, then it seems to me we should have some means to quickly and effectively revert to a pure "hand flying" machine if it passes all the agency certification requirements.Well, that is exactly the issue: the oh-so-pilot-friendly-and-simple-and-manual 737 doesn't pass pitch stability certification criteria without constant supervision and intervention of STS HAL.

Mac the Knife
9th Nov 2018, 10:46
"...the oh-so-pilot-friendly-and-simple-and-manual 737 doesn't pass pitch stability certification criteria without constant supervision and intervention of STS HAL...".

Then it isn't simple and it isn't manual.

Very glad that I am not a pilot and obliged to operate a machine with so many possible unclear reversion states.

Mac

CYTN
9th Nov 2018, 10:52
DaveReid Uk ; A Squared .
Thanks for clearing that up for me .
So New sensor is fitted after they land at Denpasar and logged against that flight JT775 .
They then make flight Denpasar to Jakarta flight JT 43 and there is control issues again apparently associated with the same ( changed out sensor ) so they troubleshoot by the 'book' and purge out and test the new sensor , ( why purge out a brand new sensor ) ? - cause the book says that is procedure - Then they clean up some canon plug and test ( again book procedure ? ) . Then access and do a compartment inspection . ( book ? ) . Log detail in maintenance log for flight JT43 and sign off .
But the issue is not clear cut fixed and alarm bells are sounding so they dispatch a teckie on the fatal flight to monitor and further troubleshoot .
Would the Flight Crew be aware of the new fitted sensor and the fact that it had not corrected the issue or would he only be made aware of the tech log and fixes taken for JT43 flight .
Again I would expect that all tech logs for the aircraft would be put up on a server for maintenance to access at least .
Why would they authorise aircraft clearance to fly when the problem never went away after fitting the new sensor .
Mind Boggling. No wonder what happend ocurred coupled with the other control issues . Poor People .

DaveReidUK
9th Nov 2018, 11:34
They then make flight Denpasar to Jakarta flight JT 43 and there is control issues again apparently associated with the same ( changed out sensor ) so they troubleshoot by the 'book' and purge out and test the new sensor , ( why purge out a brand new sensor ) ? - cause the book says that is procedure

No, there is no explicit reference in the log for the DPS-CGK flight to an identified AoA sensor issue during the flight, nor any mention of it in the recorded rectification action, which only refers to the pitot and static Air Data Modules and the Elevator Feel Computer.

Union Jack
9th Nov 2018, 11:49
People like Gums can afford it ;) :Interview with Lt. Col. Pat "Gums" McAdoo (Ret) (http://www.f-16.net/interviews_article28.html)

BTW, thank you for your service, Gums!

....and thank you, Hans Brinker, for the unintended consequence of highlighting Gums's outstanding record!

Jack appreciates.....

Snyggapa
9th Nov 2018, 12:23
Extract from the Aeroperu Boeing 757 CVR 1996 crash with static vents blocked (English translation)
https://web.archive.org/web/20030427083626/http:/www.avweb.com/news/safety/183038-1.html
One wonders if the Lion Air crew found themselves in the same state of confusion. Sensory overload can overwhelm rational actions every time.

Reading that transcript it is terrifying. You can almost feel the panic on the flight deck, and once one of the crew panics / becomes fixated on a certain aspect the other seems to have little chance of holding it together. Apart from all of the cockpit warnings going off, their attention is constantly being drawn to whatever the other crew is highlighting as being wrong at that moment. I don't envy anyone in that situation.

alf5071h
9th Nov 2018, 13:32
edmund #876, gums, :ok:
“ … reluctance in the industry to realistically quantify the expectation that a crew will be able to follow a recovery procedure.”
Not only the reluctance, the inability to quantify due to the inherent unpredictable human condition, because activity is heavily biased perception - the event at the time, etc, etc.

The industry increasingly appears to favour using a model of how technology works, or should work, (tech / certification), but when events show otherwise then instead of updating the model and changing the system the industry looks to ‘change the human’ - to match (mitigate) the errant tech model with more training.
We cannot expect pilots to manage technical failures in real time which are difficult to define in design or check in certification, or those which exceed the certification requirements (25.1302).

The interim procedure (AD) is full of assumptions. The background information frames the situation explaining the need for a new drill based on encountering an un-commanded nose down change of trim - education, training, simulation, (would a simulation show all of the other distracting features, or just a change in trim).

However, the inflight reality in manual flight (flaps up ?), the PF (failed side) could be more concerned by the stick shaker and speed indications, and distracting system alerts. Detecting a trim malfunction depends on a change in stick force (perhaps initially relating this to elevator opposed to trim). Potential for confusion, selecting an inappropriate drill / recovery action, etc, …

Conversely if the failure is on the PNF side, then further confusion - “what are you doing” CRM communication - totally different situations depending on displayed information, (no stick force), may choose unrelated checklist - UAS; incorrect mindset, difficult to change. (Similar to the Swedish CRJ)
Add surprise and continuing startle effect because of the apparent inability to control the aircraft or that the initial action did not work - where next …
The AD like the tech system is based on the same model; it assumes that the pilot will manage. (an assumption also seen in AF447, 20+ preceding events, AMS 737, ‘there is a drill for that’ - at higher altitudes)
………………

Oh, … and without AoA failure, inadvertently approaching a stall, - stick shake, low seed awareness, change in stick force (STS), misdiagnosed as a trim malfunction (salience of recent events), might a crew ‘inadvertently’ pull up, disconnect trim, etc, stalling the aircraft.
Little consideration of the human condition, their limitations in performance related to understanding of the situation; how we make sense of situations, in real time; AD - an assumption too far.

GarageYears
9th Nov 2018, 14:10
Perhaps I am missing something here as this technical discussion is quite esoteric but Boeing advise ...."failure condition that can occur during manual flight only." The bolding from Boeing.

So all this discussion around pilots being under skilled and not being able to sort out an issue after disconnected the AP becomes even more interesting as the FCOM bulletin suggests that if the AP was flying the issue would have been resolved? Perhaps there is more significant information to come, perhaps once the FDR information has been released. At this stage it is about PR departments getting in with their version to bias the discussion to suit corporate aims.

And

How can "Automatic disengagement of autopilot" be an effect from AOA disagree, if the failure condition "can occur during manual flight only"?

I'm a little bothered here. I truly believe most here are smart and understand systems analysis at least enough to comprehend what the Boeing AD is telling us here, but the statements above have me frowning. Is this really so confusing?

Boeing states that a failure of an AOA sensor can cause the AP to kick off or not be select-able in the first place if the AOA was already iffy. So let's assume that happened here. The crew took off things seemed fine, but once in the air they either engaged the AP which then dropped out, or were unable to engage the AP due to AOA disagreement. So no automatics. The AD is referring to stabilizer trim under control of the flight control computer, which with an iffy AOA input will cause nose down trim to be applied in increments lasting up to 10 seconds, while in manual flight.

They HAVE TO BE in manual because the very condition the AD refers to disables the autopilot.

So, no more "if only they turned on the AP", right?

- GY

Volume
9th Nov 2018, 14:12
the oh-so-pilot-friendly-and-simple-and-manual 737 doesn't pass pitch stability certification criteria
Maybe the 737-100 did pass the criteria of the 60s... At least for gliders I definitely know that the required stick forces were increased in the late 70s, so the earlier ones had significantly lower stick force gradients than current types. Same may be true for transport aircraft, so maybe boeing added this feature for the NG... Maybe even voluntarily, to meet the latest standards.

Why would they authorise aircraft clearance to fly when the problem never went away after fitting the new sensor .
Well, the just learned during flight that the problem was not solved... Normal for issues not reproducible on ground. You troubleshoot per the manual and see whether the problem is solved during the next flight.

threemiles
9th Nov 2018, 14:31
You're not making sense. No, of course it isn't about that. By definition you can't "try to let something emerge" if you don't know it exists.

But it happens. If you're suggesting, as you seem to be, that certification doesn't involve flight testing, that's clearly nonsense.

Flight Test Guide for Certification of Transport Category Airplanes - FAA (https://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.information/documentID/1033309)

We are not on the same page here. You are talking about flight tests, which verify a design . I am talking about certification of an aircraft system. These are two different baskets. This accident is related to an aircraft system, most likely ATA 22 in conjunction with ATA 27. It is the first and most important task of certification of a new design that you find out what COULD happen and what you possibly don't know and have never seen before. There are very structured approaches and tools to do this.

But in reality 90% of the preparation work for certification is done by the OEMs. Today's systems are much too complex that a FAA or EASA task force can review and understand entire new technology system designs without any help. Help in this business is also about liability and tends to be biased. Not mentioning the enormous time pressure to get the first delivery out and cash in.

Been there, done that for 25 years.

threemiles
9th Nov 2018, 14:37
And



I'm a little bothered here. I truly believe most here are smart and understand systems analysis at least enough to comprehend what the Boeing AD is telling us here, but the statements above have me frowning. Is this really so confusing?

Boeing states that a failure of an AOA sensor can cause the AP to kick off or not be select-able in the first place if the AOA was already iffy. So let's assume that happened here. The crew took off things seemed fine, but once in the air they either engaged the AP which then dropped out, or were unable to engage the AP due to AOA disagreement. So no automatics. The AD is referring to stabilizer trim under control of the flight control computer, which with an iffy AOA input will cause nose down trim to be applied in increments lasting up to 10 seconds, while in manual flight.

They HAVE TO BE in manual because the very condition the AD refers to disables the autopilot.

So, no more "if only they turned on the AP", right?

- GY

You should not be bothered. Language in aviation in general, SBs and ADs in particular, is safety critical and should be clear, not contradictory and unambigious. This sentence MAY mean what you say, but it needs interpretation and twice thinking about it. This is bad and typical for lawyers. Boeing should know how to do better.

bsieker
9th Nov 2018, 15:04
You should not be bothered. Language in aviation in general, SBs and ADs in particular, is safety critical and should be clear, not contradictory and unambigious. This sentence MAY mean what you say, but it needs interpretation and twice thinking about it. This is bad and typical for lawyers. Boeing should know how to do better.

We should keep in mind that this is an Emergency Airworthiness Directive. The point here is to get what is perceived to be critical information out to the operators as fast as possible. In the course of doing so they make sure that the contents are correct and pertinent, but it may err on the side of caution. There may not have been time to verify that it is always true that the autopilot disconnects in all conditions leading to the autotrim continuing to trim nose-down, so it says that it may disengage or cannot be engaged, and "autopilot off" is part of the procedure. There is nothing very unusual about this E-AD.

And to those complaing that they are trying to fix the human to conform to the defective machine, again this is a temporary measure, it contains some element of CYA, but it is also probably the best that can be done on a few days' notice.

After a thorough investigation, a technical fix may follow, but this takes a long time in the aviation industry to make sure that the fix actually improves overall safety, and not just fixes this particular instance of a problem, while exacerbating other problems (such as weakening the stall-"prevention" function of the nose-down trim when air data is accurate or when the higher-reading AoA input is actually correct and stall is impending.)

What worries me a bit more is the sentence
[...] set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?


Bernd

hans brinker
9th Nov 2018, 18:33
....and thank you, Hans Brinker, for the unintended consequence of highlighting Gums's outstanding record!

Jack appreciates.....
What I (quite unsuccessfully apparently) tried to say was that gums use of the words opines/salute/suggest took away (for ME) from his opinion, not that his opinion took anything from the thread. I think part of the Dutch way of talking is always be direct to the point of impolite, so that doesn't help....

Organfreak
9th Nov 2018, 18:48
Hans Brinker, I've been reading Gums' posts for years, and it's just a part of having a personality on the group, which is otherwise difficult. It's all part of the "fun" here.

JulioLS
9th Nov 2018, 18:53
These things are always multi-factorial... You can blame the mechanics for not fixing the problem.... You can blame the pilots for not following the right procedure.... But really there is only one party here to blame. And that is Boeing.....

They designed a crazy system, as if the AoA sensor is god and the pilot is stupid.... So no matter what the pilot does (apart from turning the damn thing off), the system will repeatedly drive you into the sea.....

Yes you can blame the mechanics. Yes you can blame the pilots. But at the end if the day, it is Boeing that thinks the AoA sensor has more authority than the pilot......... And that, in my book, is pretty bloody stupid......

alph2z
9th Nov 2018, 18:53
... What worries me a bit more is the sentence

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?

Bernd

On the cockpit panel probably these are not circuit breakers but rather switches. The switches on the CUTOUT control panel send a signal to the Trim computer in the electronics bay and then to HS horizontal stabilizer electronics and motors. Any hardware and software failures between the CUTOFF switch and the HS may cause the problem. They probably don't have all the facts yet and are very cautious. The HS TRIM circuit breaker is probably hard to find and pull during an emergency.

But, them having to hold the trim wheel is scary; especially during an emergency where the problem is not fully known !

JulioLS
9th Nov 2018, 19:06
So a plausible scenario for the crew faced based on the Boeing Bulletin is:

At or soon after rotate, so message like "IAS disagree", possibly other messages and warnings, possibly even stick shaker.
Manually flying so no autopilot to drop out.
As they are manually flying, and trimming, the runaway stabilizer fault is masked and dealing with the unreliable airspeed.
Probably running the unreliable airspeed memory items
After not trimming for 5 seconds, STS trims nose down, PF counteracts with nose up pitch and trimmed, runaway trim is masked for 5 seconds.
As they are solving the UA checklist, speed is increasing, air loads on horizontal stabilzer increase.
A series of sequences of manual trim, 5 sec delay, then runaway stab, manual pitch up and trim, ratcheting down the stabilizer, pilots compensate with
Eventually the speed increases and air load becomes so large, that both pilots are unable to overcome the nose down stabilizer trim all the way forward becoming unrecoverable as there is a further rapid increase in speed.

Basically in this type of scenario, the crew are confronted with an intermittent runaway stabilizer in addition to a UA. This intermittency is a difficult problem to nut out in the cacophony of noise and confusion of an unreliable airspeed scenario. Ironically, it may be possible they may of actually had three valid IAS indications, in close agreement, further heightening the confusion.

This is pretty much the scenario that I imagine... pilots to busy with UA and UAS to notice the runaway h stab till its too late. Elevators are never going to win against the h stab at the stop.....

JulioLS
9th Nov 2018, 19:10
On the cockpit panel probably these are not circuit breakers but rather switches. The switches on the CUTOUT control panel send a signal to the Trim computer in the electronics bay and then to HS horizontal stabilizer electronics and motors. Any hardware and software failures between the CUTOFF switch and the HS may cause the problem. They probably don't have all the facts yet and are very cautious. The HS TRIM circuit breaker is probably hard to find and pull during an emergency.

But, them saying to hold the trim wheel is scary !

All Boeing pilots should bring a walking stick... to shove in the trim wheel when the h stab goes runaway!!!

CaptainMongo
9th Nov 2018, 19:10
Bleve,

And my belief is that when the crew started to fly manually they might well have found themselves having to cope with the 'yo-yo' manoeuvres described by Centaurus in a previous post (I quote him in italics below) while perhaps also being distracted by multiple warnings as described in the recent Boeing bulletin.

"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming."

To relieve airloads, the crew must momentarily release all backward pressure on the elevator then rapidly wind the stabilizer trim backwards manually or electrically. In turn, this allows more effective elevator control. In other words, a yo-yo manoeuvre. The crew needed to react instantly and correctly to relieve air loads in this manner. Unfortunately, the Lion Air crew did not have the altitude to successfully recover before impact.

If that was the case, I wonder how well many of us would have coped in that situation.


and with the trim rolling forward in 10 second increments, could not have the stab finally reached a point where it applied a force downward which the elevator could no longer counter act?

WillFlyForCheese
9th Nov 2018, 19:11
So - we have the same aircraft exhibit what appears to be the same problem on 4 separate flights - within a few days of each other. On each of the other flights - the folks in the pointy end were able to successfully control the aircraft. Why and how? What was different about this flight on this day that made whatever happened result in a different outcome? It will be interesting to hear what the pilots on the previous flights have to say about what was going on - unless they find the CVR (seems odd it's not been found yet) - those folks might be the best source of info on what they were experiencing.

Aside from all of that - I am still in amazement that the airline left this aircraft in service given the problems on the prior 3 legs.

Has anyone seen comments from the pilots of JT43?

phil gollin
9th Nov 2018, 19:31
.

Normally by this time in a crash thread someone chirps up and says - well I had some time in a simulator today and ..........

No one done that yet ?

(Also, I agree about the lack of CVR yet)

.

QDM360
9th Nov 2018, 19:46
I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?

There could be other defects. Like a short circuit/loose wire which accidentally powers the electric trim motor. Or an incorrectly installed wiring. One never knows what could happen. That's why, when everything else fails, you can still grab and hold the trim wheels as a last resort.

GarageYears
9th Nov 2018, 20:21
.

Normally by this time in a crash thread someone chirps up and says - well I had some time in a simulator today and ..........

No one done that yet ?

(Also, I agree about the lack of CVR yet)

.

I've tried to point out that with the MAX, all Level D FFS simulators will be using a binary supplied by Boeing that encapsulates pretty much the entire simulation - this binary is essentially the rehosted avionics, flight control computers, AP, and models for all the systems and flight characteristics AND importantly provides all the supported malfunctions that the instructor/lesson plan system has available.

This malfunction list will include malfunctions that have traditionally been used for this aircraft type, and whatever new ones Boeing deemed useful//required.

However, it seems (based on the Boeing E-AD) that the insidious uses of AOA in the flight control computer and subsequent trim behavior when the AOA signal goes wonky was not something anyone really saw coming. My bet is any flight sim out there doesn't provide an AOA 'wonky' malfunction, and hence would be unable to replicate this crash. Maybe I'm wrong, but the way current generation flight simulators are put together relies almost wholly on the aircraft manufacturer for things like this now.

- GY

Ian W
9th Nov 2018, 20:31
edmund #876, gums, :ok:
“ … reluctance in the industry to realistically quantify the expectation that a crew will be able to follow a recovery procedure.”
Not only the reluctance, the inability to quantify due to the inherent unpredictable human condition, because activity is heavily biased perception - the event at the time, etc, etc.

The industry increasingly appears to favour using a model of how technology works, or should work, (tech / certification), but when events show otherwise then instead of updating the model and changing the system the industry looks to ‘change the human’ - to match (mitigate) the errant tech model with more training.
We cannot expect pilots to manage technical failures in real time which are difficult to define in design or check in certification, or those which exceed the certification requirements (25.1302).

The interim procedure (AD) is full of assumptions. The background information frames the situation explaining the need for a new drill based on encountering an un-commanded nose down change of trim - education, training, simulation, (would a simulation show all of the other distracting features, or just a change in trim).

However, the inflight reality in manual flight (flaps up ?), the PF (failed side) could be more concerned by the stick shaker and speed indications, and distracting system alerts. Detecting a trim malfunction depends on a change in stick force (perhaps initially relating this to elevator opposed to trim). Potential for confusion, selecting an inappropriate drill / recovery action, etc, …

Conversely if the failure is on the PNF side, then further confusion - “what are you doing” CRM communication - totally different situations depending on displayed information, (no stick force), may choose unrelated checklist - UAS; incorrect mindset, difficult to change. (Similar to the Swedish CRJ)
Add surprise and continuing startle effect because of the apparent inability to control the aircraft or that the initial action did not work - where next …
The AD like the tech system is based on the same model; it assumes that the pilot will manage. (an assumption also seen in AF447, 20+ preceding events, AMS 737, ‘there is a drill for that’ - at higher altitudes)
………………

Oh, … and without AoA failure, inadvertently approaching a stall, - stick shake, low seed awareness, change in stick force (STS), misdiagnosed as a trim malfunction (salience of recent events), might a crew ‘inadvertently’ pull up, disconnect trim, etc, stalling the aircraft.
Little consideration of the human condition, their limitations in performance related to understanding of the situation; how we make sense of situations, in real time; AD - an assumption too far.


It is necessary to go back to the principle of FMC/FMS and avionics design. There are pilots on board and the FMC/FMS avionics is intended to make their life simpler. There is a significant cost in coding to deal with every potential error. So the design principle is that the automatics will be coded to field the basic well understood errors however as soon as it becomes complicated, - the 'otherwise case' - in the last resort the automatics hand the bag of bolts to the crew. The crew are expected to carry out the fault finding and correction using a set of checklists and if all else fails, their own innate capabilities as pilots to recover from the 'otherwise case'.

If the AD is considered in this light it is right along the line of the design principle. FMC cannot cope with differing angle of attack indications so passes bag of bolts to pilot. The pilots in this instance were not able to fly out of the problem. So the AD emphasizes the correct checks and operations to be used if this otherwise case occurs again. If the design principles are changed (and they are slowly changing) eventually the 'otherwise cases' the automatics cannot handle become extremely unlikely; and perhaps pilots will not be needed as the automatics will not drop out.

Smott999
9th Nov 2018, 20:47
Correct me if I am wrong, but the pilot should "know" the manual flight is not fully activated until you pull the cutouts for the stabilisers.
And so when reverting to manual that includes switching off the stabilisers (and whatever else).
As for holding the stabiliser wheel by hand, you should practice that, and during peacetime, so you are fully confident.

Auroperu 603 : pilots had restored control earlier on ... but then they tried to reengaged the AP ... why ?
Because they were trying to "fix" the problems in the air, rather than landing the plane.
Same thing with Lion Air, they wanted to fix their technical problems whilst in the air with passengers on board.

Thinking off the cuff :
If you hang a necklace around the sunvisors, that gives you a plumb line.
And if you throttle the engines independently can give you a sense of whether they are functioning properly and trust the throttle indicators.
Altitude : there seems to a radio altitude in some aircraft; ATC altitude might actually be originating from your own system's telemetry have to be sure if it is independent

Pilots May have thought STS was automatically disabled due to their increased speed. If what has been posted here is correct, prior versions had various activation triggers amongst which was low speed. Not higher speed, which they had invoked.
The MAX (it seems) is now adding AoA Disagree as a trigger. Did pilots know this ?

Is it Possible the pilots thought, given their increased speed, HAL would not mess w their stabilizer?

Yet another reason why what was actually happening was not something they imagined?

sSquares
9th Nov 2018, 20:51
It is necessary to go back to the principle of FMC/FMS and avionics design. There are pilots on board and the FMC/FMS avionics is intended to make their life simpler. There is a significant cost in coding to deal with every potential error. So the design principle is that the automatics will be coded to field the basic well understood errors however as soon as it becomes complicated, - the 'otherwise case' - in the last resort the automatics hand the bag of bolts to the crew. The crew are expected to carry out the fault finding and correction using a set of checklists and if all else fails, their own innate capabilities as pilots to recover from the 'otherwise case'.
If the AD is considered in this light it is right along the line of the design principle. FMC cannot cope with differing angle of attack indications so passes bag of bolts to pilot. The pilots in this instance were not able to fly out of the problem. So the AD emphasizes the correct checks and operations to be used if this otherwise case occurs again. If the design principles are changed (and they are slowly changing) eventually the 'otherwise cases' the automatics cannot handle become extremely unlikely; and perhaps pilots will not be needed as the automatics will not drop out.

​​​​​​It is becoming clear that the avionics should hand a plane to the pilot in a stable and best possible state to fly. For each FL, this should be possible. FL should be simple to determine from multiple sources.

The focus should be to stabilise the situation and to give the pointy end the maximum time to fly the thing in the state that it is in.

Giving the thing to the pilots in a dynamic state, with a known outcome of self-destruction is madness.

Vessbot
9th Nov 2018, 20:59
​​​​​​It is becoming clear that the avionics should hand a plane to the pilot in a stable and best possible state to fly. For each FL, this should be possible. FL should be simple to determine from multiple sources.

The focus should be to stabilise the situation and to give the pointy end the maximum time to fly the thing in the state that it is in.

Giving the thing to the pilots in a dynamic state, with a know outcome of self-destruction is madness.
That's a self-defeating argument. The reason the avionics are handing the plane to the pilot is because they're unable to maintain that control by themselves. If they had enough ability to fly the plane, they wouldn't be handing it to the crew in the first place.

Smott999
9th Nov 2018, 21:16
That's a self-defeating argument. The reason the avionics are handing the plane to the pilot is because they're unable to maintain that control by themselves. If they had enough ability to fly the plane, they wouldn't be handing it to the crew in the first place.

China 6 is a good example of that. AP did it’s best w slowly increasing control surface (rudder IIRC) inputs until it gave up.
Handing over the plane to the pilots in a sharply descending right turn which they did not immediately recover from.

bud leon
9th Nov 2018, 21:17
That's a self-defeating argument. The reason the avionics are handing the plane to the pilot is because they're unable to maintain that control by themselves. If they had enough ability to fly the plane, they wouldn't be handing it to the crew in the first place.

Unless I'm mistaken there are two recurring themes being repeated here which are (1) that the technology is fatally flawed and/or (2) most contemporary pilots are incompetent. Neither is true. Incidents like this are rare. It's too easy to call out Lion Air's relatively poor safety record and it's more than somewhat Luddite to be suspicious of automation. Despite the very low frequency of incidents, many of you seem to myopically think we are living in some kind of crisis of aviation, possibly because this forum focusses on incidents. The stats don't tell that story.

There is a lot to be learned from this incident, but please stop the drama because it's irrational and unscientific.

infrequentflyer789
9th Nov 2018, 21:23
We should keep in mind that this is an Emergency Airworthiness Directive. The point here is to get what is perceived to be critical information out to the operators as fast as possible.

True, but comparing the original Boeing notice (see e.g. post #882) with the EAD the language seems (to me at least) to have become more unclear. The original wording on other symptoms of bad AOA is in the "background information" section and prefixed with "Additionally, pilots are reminded that [...]" - in the EAD this bit is stuffed into the middle of the operating instructions issued by Boeing.

What worries me a bit more is the sentence
[...] set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?


Even more interestingly, that sentence does not appear in the original Boeing notice. You have to wonder if it has come from Boeing at all. I think it might have come from twisting the following Boeing words (which don't appear in the EAD): [...] unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT

If so then the original Boeing wording is clear that the pilot must counter previous trim inputs and set the switches to cutout, but it doesn't imply that the system can still trim against you after it's cutout.

sAx_R54
9th Nov 2018, 22:00
Yes, that the same defect apparently persisted through four consecutive sectors, and successive crews were in effect testing the outcome of failed rectification attempts, is inexcusable.

That said, an "inherent and unknown programming defect" (in any software environment, not just aerospace) by definition requires a specific, unforeseen combination of factors (possibly including other defects) in order to trigger it. It's entirely possible that the required combination of factors never emerged during the certification process.

If there had been precursors to this issue, while we might not have heard about them prior to the crash, they would undoubtedly have emerged in the last 10 days. AFAIK, none have.
Failed rectification attempts of hardware yes, in attempt to solve a problem that appears to be deeply hidden within the product systems design or 'likely to exist or develop in other products of the same type design', as the AD seems to suggest.

SLFinAZ
9th Nov 2018, 22:00
Unless I'm mistaken there are two recurring themes being repeated here which are (1) that the technology is fatally flawed and/or (2) most contemporary pilots are incompetent. Neither is true. Incidents like this are rare. It's too easy to call out Lion Air's relatively poor safety record and it's more than somewhat Luddite to be suspicious of automation. Despite the very low frequency of incidents, many of you seem to myopically think we are living in some kind of crisis of aviation, possibly because this forum focusses on incidents. The stats don't tell that story.

There is a lot to be learned from this incident, but please stop the drama because it's irrational and unscientific.

Actually this is exceptionally rational, but your correct in that it's not a clear cut case of either pilot skill or automation. To the best of my admitted limited knowledge this is the 1st incident I can recall where a single plane had significant issues across multiple consecutive flights and remained in service and suffered a catastrophic event. So it's really an economic and cultural issue, possibly specific to Lion Air or potentially more wide spread. I realize that planes are routinely dispatched with degraded capabilities but from what I have read here it would seem that many of those who work in the pointy end have expressed dismay (or am I wrong) that the plane was cleared given the nature of the ongoing issues. Once the problem persisted in spite of the swap out how could you "sign off" for a revenue flight? Beyond that I have a lingering suspicion that if/when the CVR is found that the interaction between the engineer/technician and the flight crew might be integral to the accident. From everything I've read here this would already be a very difficult scenario and the addition of a 3rd voice might have added to the confusion, created doubt or distraction that contributed to the end result.

sAx_R54
9th Nov 2018, 22:15
The whole "the aircraft design is safe", "the manufacturer did a good job", "well trained pilots would have recovered", "maintenance did a bad job", "third world habits" is arrogant and very biased to say the least. This accident happened in the aviation world of FAA certification processes that cost taxpayers and aircraft buyers millions.

Could not have been better stated!

LEOCh
9th Nov 2018, 22:46
Two questions I think are still unclear:

Through what pathway did the faulty AoA sensor feed bad data to the trim stabiliser?
People are discussing the STS as a possibility, but AoA is not a direct input to this system. Instead from the AD it seems that a single AoA failure can contaminate the CAS at the ADIRU and generate airspeed disagree even with no faults in the pitot/static system. Under this scenario the STS could continue to operate, trimming the stab down in response to faulty low CAS. However, it seems unlikely that this would present as stabiliser runaway to the stop, as even with faulty AoA data it shouldn't be able to revise CAS that much (CAS is primarily based on the presumably working pitot/static). If this was the case, this would be a known problem with NGs as well as MAX, with single AoA failures in the past would leading to similar problems (which doesn't seem to be the case). Which leads to:

Does the MAX use AoA data in any way differently to the NG?
If the use of AoA sensor data hasn't changed from the NG then this accident must truly be a black swan event, with some other secondary malfunction to the AoA fault interacting to give the trim runaway. This is a pretty terrible combination with the elevator feel system (which is directly acting on AoA data), a faulty high alpha value will trigger stall protection and make it much harder to pull against the faulty automatic down trim, probably with the extra burden of simultaneous stick shaker.

The confusing fact the AoA sensor failure seems to only announce itself by it's flow-on effects on other systems (IAS DISAGREE, FEEL DIFF PRESS) seemed to affect not only the crew but maintenance, who after replacing the AoA sensor and still getting problems (suggesting the AoA failure is not in the outer sensor module), returned to hopefully trying maintenance items on the ports and checking the connectors on the feel computer.

tdracer
9th Nov 2018, 22:54
To the best of my admitted limited knowledge this is the 1st incident I can recall where a single plane had significant issues across multiple consecutive flights and remained in service and suffered a catastrophic event. So it's really an economic and cultural issue, possibly specific to Lion Air or potentially more wide spread. I realize that planes are routinely dispatched with degraded capabilities but from what I have read here it would seem that many of those who work in the pointy end have expressed dismay (or am I wrong) that the plane was cleared given the nature of the ongoing issues. Once the problem persisted in spite of the swap out how could you "sign off" for a revenue flight?
Assuming the problem was "intermittent", troubleshooting becomes very, very difficult and the Maintenance Manual/Fault Isolation Manual are not always a lot of help. Anyone who's a backyard mechanic can appreciate how frustrating it can be to find a problem that only occurs when you're driving 60 miles per hour - but not every time you drive 60 miles per hour.
I became a big hero to a particular operator many years ago when, after looking at some DFDR data, I figured out that their recurrent FADEC problem they'd be trying to solve for a month was occurring when the leading edge devices were retracted. I told them to go look at the wire bundles in the vicinity of the leading edge actuators and they found the chaffed bundle problem the next day.
I wouldn't be too quick to condemn maintenance because they struggled to correct an intermittent fault.

alf5071h
9th Nov 2018, 22:58
Ian W #926, you may have overlooked the stage that actions only follow understanding (with a few startling exceptions).

My concern with the AD, and your view, is that these assume that the crew have an adequate understanding for ‘the case’.
The dominant cue, or initially the more likely one for this failure appears to be stick force. This is only available to the PF. There is no annunciation.
In order to confirm the specific failure there are a series of ‘ands’ to add to the ‘if then’ sequence, any one of which could divert thoughts to alternative situations and actions.

The better design principle is that all failures should be annunciated, and also provide adequate guidance towards understanding, i.e. AoA Comparator in isolation directs attention to the AoA, but in this instance the problem is trim. Similarly for Alt, Speed, Feel, disagreement, none helps to identify trim except in combination, which is a effortful mental task in a situation where time is critical.

slacktide
9th Nov 2018, 23:06
The answer is definitely not what you suggest, which, at the risk of sounding like a broken record, does not give you attitude information!

Probably the best way to demonstrate this to non-aviators is the old video of Bob Hoover performing a barrel roll with a glass of refreshing iced tea on the glareshield. Even though the aircraft is clearly inverted, Bob maintains coordinated flight, and the tea in the glass remains level.

Bob then one-ups himself by POURING a glass of tea while performing a barrel roll. Even though the aircraft is inverted, the stream of tea always flows toward the floor of the aircraft.

https://www.youtube.com/watch?v=V9pvG_ZSnCc

dragon6172
9th Nov 2018, 23:07
Pilots May have thought STS was automatically disabled due to their increased speed. If what has been posted here is correct, prior versions had various activation triggers amongst which was low speed. Not higher speed, which they had invoked.
The MAX (it seems) is now adding AoA Disagree as a trigger. Did pilots know this ?

Is it Possible the pilots thought, given their increased speed, HAL would not mess w their stabilizer?

Yet another reason why what was actually happening was not something they imagined?


STS is active from 100 KIAS to Mach 0.68. Would have to be really booking it at 5000 feet to be near the speed for STS to not be active.

Organfreak
9th Nov 2018, 23:26
Assuming the problem was "intermittent", troubleshooting becomes very, very difficult and the Maintenance Manual/Fault Isolation Manual are not always a lot of help. Anyone who's a backyard mechanic can appreciate how frustrating it can be to find a problem that only occurs when you're driving 60 miles per hour - but not every time you drive 60 miles per hour. [snip]
I wouldn't be too quick to condemn maintenance because they struggled to correct an intermittent fault.

Howdy, neighbor! (West of Tacoma). B-b-but, in hindsight, shouldn't they have pulled this plane from service? As SLF, I don't wanna gamble.

SLFinAZ
10th Nov 2018, 00:04
Assuming the problem was "intermittent", troubleshooting becomes very, very difficult and the Maintenance Manual/Fault Isolation Manual are not always a lot of help. Anyone who's a backyard mechanic can appreciate how frustrating it can be to find a problem that only occurs when you're driving 60 miles per hour - but not every time you drive 60 miles per hour.
I became a big hero to a particular operator many years ago when, after looking at some DFDR data, I figured out that their recurrent FADEC problem they'd be trying to solve for a month was occurring when the leading edge devices were retracted. I told them to go look at the wire bundles in the vicinity of the leading edge actuators and they found the chaffed bundle problem the next day.
I wouldn't be too quick to condemn maintenance because they struggled to correct an intermittent fault.

Thanks for your insight, but if you have a recurring (so not intermittent) issue with a critical flight control system/component would you "troubleshoot" on a revenue flight. The only clearly different variable across the 4 flight segments (that I'm aware of) is the presence of the engineer (in the cockpit?)...

GarageYears
10th Nov 2018, 01:07
“Does the MAX use AoA data in any way differently to the NG?
If the use of AoA sensor data hasn't changed from the NG then this accident must truly be a black swan event”

Based on the Boeing and subsequent FAA Emergency AD, which very specifically identifies the 737-8 and -9, I think we can assume the MAX is different.

- GY

BuzzBox
10th Nov 2018, 01:30
“Does the MAX use AoA data in any way differently to the NG?

According to John Cox:

...although a version of this automated system has been on the 737 since the first ones were built in 1967, only on the MAX is this particular sensor able to trigger uncommanded movements of the jet’s horizontal tail.

Scrutiny of Lion Air crash turns to automated systems that command Boeing 737 pitch (https://www.seattletimes.com/business/boeing-aerospace/faa-follows-boeings-737-safety-alert-with-an-emergency-directive/)

CurtainTwitcher
10th Nov 2018, 01:41
If the use of AoA sensor data hasn't changed from the NG then this accident must truly be a black swan event”

Based on the Boeing and subsequent FAA Emergency AD, which very specifically identifies the 737-8 and -9, I think we can assume the MAX is different.

The corollary is also true, as it appears to be specific to the MAX -8 & -9 (due to STS system design changes), it is therefore not a black swan. There appear to only be around 220 MAX units in service, this new STS modification has not a not stood the test of time, ie the Lindy Effect (An Expert Called Lindy (https://medium.com/incerto/an-expert-called-lindy-fdb30f146eaf)by N N Taleb, Black Swan series author).

tdracer
10th Nov 2018, 03:08
Thanks for your insight, but if you have a recurring (so not intermittent) issue with a critical flight control system/component would you "troubleshoot" on a revenue flight. The only clearly different variable across the 4 flight segments (that I'm aware of) is the presence of the engineer (in the cockpit?)...

Yes, in a perfect world, they should have (as a minimum) done a check flight to see if they had fixed the problem before performing a revenue flight. But in the real world, taking an aircraft out of service is a big deal (especially if they don't have a ready spare), and a check flight is expensive. Just speculating here, but maintenance may well have made such a request but were overruled by management, (and no one wants to tell management they're not sure if they did the job correctly).

Rananim
10th Nov 2018, 03:14
Lots of emotive responses and "opines"........
The Boeing 737,on balance,is a remarkably safe design.
Manufacturers cant be praised one day for a stick shaker helping a pilot identify a stall and the next day be blamed for that same stick
shaker causing confusion and masking if its input is false..One accepts the good with the bad.Its an imperfect world.
Anti-stall and speed stability devices are desirable and mandatory for certification.They require inputs.These inputs are dependent on the
reliability of the pitot static system.That system is not invulnerable.Checklists,procedures and a pilots airmanship will overcome a UAS event.
The level of airmanship in pilots,like training and experience,is very variable.Nothing is guaranteed though.Highly competent crews can and do make mistakes.The human species is entirely fallible.
Manual raw data flying skills are at an all time low in the industry.Many pilots are highly automation dependent.This is a worrying trend and needs
addressing.
Many airlines prescribe more automation dependence via SOPs and mistakenly see more automation as a panacea for incidents/accidents.
Note that all Lionair B737s are fitted with Honeywells RAAS.An automated system to remind pilots of how to fly an airplane.....does it make sense to you??When they invent something like that,you know somethings wrong in the system.Some pilots perhaps who have logged 5000 hours on type on line may have manipulated the flight controls manually for 50 of those 5000 hours.No wonder then they need RAAS and FDs and AT and AP.This oversight can cause problems during non-normals when proficiency in manual flight will become the difference between life and death."If I hear I will forget,If I see I will remember,if I do I will understand"(Confucius)
Lionair maintenance failed to rectify a very high priority glitch in 4 consecutive attempts.After the 1st failed attempt to repair the glitch,the plane should have been grounded and subject to a test flight before further revenue flight.Lionair maintenance will be looked at very closely to be sure.If you think you can save money/time in maintenance,try having an accident....you may find that soon you dont have a fleet to maintain.
STS is poorly understood and seen as a nuisance by some pilots.Its not.Its required by certification and serves a valid purpose
FCC A controls both STS and AP stab trim on 1st flight of the day.FCC A gets data from Left ADIRU.If that data is corrupt,you will get unwanted incorrect trim.
STS trimming using bad data will trim to the stops if the pilot does not intervene.
Startle factor can occur if crews are insufficiently trained/experienced...this will lead to mental capacity overload and panic....repeated attempts to engage the AP are a sign of panic in UAS.
The STS trims using the quieter slower AP stab trim motor.Its not a runaway technically as its intermittent.If aural/tactile warnings,like stick shaker,are operating the crews ability to focus and THINK(never mind intuit) will be effected.They will pull on the stick and use main electrical trim to trim up,both of which will override but not disable the STS.They will think they are in control but as soon as they stop,the STS trim down returns.
The Boeing AD addresses this by an emergency order to KILL ALL TRIM by putting both stab trim cutout switches to cutout(RUNAWAY STABILIZER NNC).If they make it a recall item,then the pilots no longer have to think do they.......thats about where we are in aviation these days....Pay to fly,tick the boxes instructors,no pilots at board level,automation dependance gone awry,B777 pilots that cant land on a clear day in SFO without a glideslope signal.....yep,that just about sums up where we are......Rananim sends or opines....whatever the hell that means

Winemaker
10th Nov 2018, 03:24
I am SLF. I have read this entire thread. I am a science driven person. I am extremely interested in aviation. Please correct me if I'm wrong.

What I don't understand is that in a UAS event the pilot should fly attitude and N1 per the QRH; this will assure the airplane won't just fall from the sky and gives the pilots time to regroup and analyze the situation. If the pilots are flying attitude they won't be concerned with AoA will they? If the trim system keeps trying to change the attitude every ten seconds why would the pilots not shut if off and then trim manually if necessary? Is trim of the aircraft that important in this situation? Is this a training issue in that it seems the most important part, keeping the plane flying, has become secondary? On a personal note before I get hammered, I used to race single seat formula cars and never panicked even while going off the road after brake failure at high speed, so I do know some things about exposure and brain function, at least my own.

Lonewolf_50
10th Nov 2018, 03:34
@winemaker: it would appear that low cost airlines (or a number of them) do just enough training to get by the regulators' requirements. The difference between currency, and recency, and proficiency is lost on the profit driven philosophy of a low cost airline's management and ownership. So while your point on pitch and power certainly fits how I was trained to fly, how pilots are trained, kept current, and retain proficiency (across their entire area of responsibility) in the year 2018 is not a fixed value. It varies with corporate culture, among other things. There isn't a single standard ... and more's the pity.

gums
10th Nov 2018, 03:39
c'mon, Rana....... tell us how you really feel or opine or assert or whatever. We can handle it.

As a pilot, my worst fear is when the plane does something I didn't command or ask it to do. And to do it at a critical phase of flight.

This "discovery" that a poor AoA input to one or more subsystems can result in runaway trim is scary beyond belief. Especially when it only occurs when flying without the A/P engaged. You know, the so-called hand flying or manual flying exercise that many of we geriatric folks talk about.

My feeling is all the technical aspects about static stability and Boeing's efforts to help with trim and feel and so forth would be better discussed over on the Tech Log as we did with AF447.

Meanwhile we wait for news and maybe another bulletin from Boeing or the U.S. and other country aviation agencies.

out,

ZFT
10th Nov 2018, 04:08
@winemaker: it would appear that low cost airlines (or a number of them) do just enough training to get by the regulators' requirements. The difference between currency, and recency, and proficiency is lost on the profit driven philosophy of a low cost airline's management and ownership. So while your point on pitch and power certainly fits how I was trained to fly, how pilots are trained, kept current, and retain proficiency (across their entire area of responsibility) in the year 2018 is not a fixed value. It varies with corporate culture, among other things. There isn't a single standard ... and more's the pity.

It's a pity you added the words low cost to your post because otherwise IMHO it is spot on! Standards should be determined and enforced by the regulators. Globally, they fail dismally.

olasek
10th Nov 2018, 05:01
Is this a training issue in that it seems the most important part, keeping the plane flying, has become secondary?
Per your logic world should be perfect and every pilot should always respond in a most efficient way. But we live in a different world, we live in a world in which a professional pilot with paying passengers is capable of taking off from wrong runway or even a taxiway, or landing on a wrong runway, in other words big errors are possible in a perfectly well functioning aircraft so it should be of no surprise to you that when things no longer go 'perfect' - even bigger errors can ensue.

tdracer
10th Nov 2018, 05:06
It's a pity you added the words low cost to your post because otherwise IMHO it is spot on! Standards should be determined and enforced by the regulators. Globally, they fail dismally.
Oh, come on now - if "Globally, they fail dismally", how do you explain the simple fact that commercial aviation has never been safer? With the growth in commercial aviation, if we had the same accident rate now that they had in the 1970s, we'd be having a major accident at least once a week. Heck, even the Indonesian accident rate - as poor as it is compared to most of the world, is still better than what was considered good 50 years ago. I regularly visit Indonesia, and I still consider flying there to be safer than taking a bus or boat.
Sure, we need to know what happened, and why, and make changes to ensure it doesn't happen again. That's the way the industry works (and why it's gotten so much better than it was even 20 years ago). But don't loose track of how far we've come.

BTW gums, ignore the critics. Most of us know who you are, value your inputs and piloting accomplishments, and don't mind you being slightly eccentric (you've earned it).

Winemaker
10th Nov 2018, 05:38
Per your logic world should be perfect and every pilot should always respond in a most efficient way.

Didn't say perfect, just asking where situational awareness overcomes reliance on stuff. Is it too much for us SLF to expect the pilots who have our lives in their hands to start asking themselves if maybe they are just repeating things with no new result? When the same actions don't change the results training might suggest an alternate path. I understand the overload that might take place, but still, point the plane at the right angle and give it the right power. Is this too much to ask?

ZFT
10th Nov 2018, 05:42
Oh, come on now - if "Globally, they fail dismally", how do you explain the simple fact that commercial aviation has never been safer? With the growth in commercial aviation, if we had the same accident rate now that they had in the 1970s, we'd be having a major accident at least once a week. Heck, even the Indonesian accident rate - as poor as it is compared to most of the world, is still better than what was considered good 50 years ago. I regularly visit Indonesia, and I still consider flying there to be safer than taking a bus or boat.
Sure, we need to know what happened, and why, and make changes to ensure it doesn't happen again. That's the way the industry works (and why it's gotten so much better than it was even 20 years ago). But don't loose track of how far we've come.

BTW gums, ignore the critics. Most of us know who you are, value your inputs and piloting accomplishments, and don't mind you being slightly eccentric (you've earned it).

tdracer

No argument from me.

Aviation today is incredibly safe just about everywhere and this is testament to just about every facet involved.

My comment referred to the great variation in applied standards, that are (or are not) enforced, even with the major regulators and I stand by my comment that "Globally they fail miserably"

GarageYears
10th Nov 2018, 06:15
I can’t seem to copy paste but above the post questions why safety has apparently improved so drastically...

Maybe the automatics, etc - those things that seem to be so maligned - are the reason? Certainly blind trust in them is flawed, but in the 99.9% of cases everyone goes home happy and we hear nothing more. But the tiny percentage of times, when something really unusual happens and the crew get it wrong (whether unknowingly or just missing something) we want to tear into the very systems that worked so well the rest of the time.

My bet is the automatics are far more beneficial than the edge cases where things go wrong. The important but painful point is statistic are sometimes brutal. Yes, any crash is terrible, but those that didn’t happen are just as important.

A conundrum.

-GY

Golden Rivit
10th Nov 2018, 06:20
28:20 into the video,
https://www.youtube.com/watch?v=WfNBmZy1Yuc

armchairpilot94116
10th Nov 2018, 07:27
If aviation today is indeed safer not because we have pilots but in spite of us having pilots. And the machines can be made better but the pilots cannot....then the day comes sooner when there will be no pilots. Because pilots will have by then lost mastery of their art while also losing full control of their aircraft by design of the aircraft makers.

For they have been judged by regulators and plane makers to be the weakest link.

CurtainTwitcher
10th Nov 2018, 08:21
If aviation today is indeed safer not because we have pilots humans but in spite of us having pilots humans.
...For they [HUMANS] have been judged by regulators and plane makers to be the weakest link.
And who will program the machines? The problem will be shifted from the flight deck to the software development cubical. Humans are deeply flawed decision makers, machines cannot construct themselves, so we are stuck with a strange amalgam of the two.

AGBagb
10th Nov 2018, 11:37
Meanwhile we wait for news and maybe another bulletin from Boeing or the U.S. and other country aviation agencies.

out,

BTW, do we know whether the Boeing Bulletin was based on the early results from the recovered FDR, or are they based on details of the previous incidents with this a/c and/or this type?

wiedehopf
10th Nov 2018, 11:43
BTW, do we know whether the Boeing Bulletin was based on the early results from the recovered FDR, or are they based on details of the previous incidents with this a/c and/or this type?
See this press release from Boeing:
https://boeing.mediaroom.com/news-releases-statements?item=130327
Excerpt:


Boeing is providing support and technical assistance to the Indonesian National Transportation Safety Committee and other government authorities responsible for the investigation into Lion Air flight 610.



The Indonesian National Transportation Safety Committee has indicated that Lion Air flight 610 experienced erroneous input from one of its AOA (Angle of Attack) sensors.



Whenever appropriate, Boeing, as part of its usual processes, issues bulletins or makes recommendations regarding the operation of its aircraft.



On November 6, 2018, Boeing issued an Operations Manual Bulletin (OMB) directing operators to existing flight crew procedures to address circumstances where there is erroneous input from an AOA sensor.


So that sounds to me like they released the Bulletin due to recovered FDR data.

Discorde
10th Nov 2018, 12:02
Two excerpts from From 'How Airliners Fly' by Julien Evans:

The debate continues, as it has done for the last few decades, as to the degree to which pilots should allow the ever more capable automatic systems to take control. Should the aircraft be allowed to fly themselves with minimal pilot input in order to maximise precision and efficiency? But will this policy reduce basic piloting skills, which might be demanded when the automatic systems malfunction, or when circumstances arise which are beyond their capabilities? The human mind brings to the flight deck the element which machines and computers lack - judgement.

Will pilots be able to fly their aircraft without the assistance of autopilots and autothrottles when necessary if they never get the chance to practise these skills during normal operation? A related factor is that a pilot whose job is merely to watch the aircraft fly itself is unlikely to be as well motivated as one who can get their hands on the controls now and then. Designers of aircraft and airline managers must address the issue of how much and under what conditions pilots should be allowed, or indeed encouraged, to fly their aircraft manually. It is likely that compared to a mere aircraft monitor, a skilled, motivated pilot will always make a greater overall contribution to flight safety.

AGBagb
10th Nov 2018, 14:24
I would expect that Boeing would be *extremely* reluctant to draw technical conclusions that specific from an ATC conversation, whcih by nature would be fairly ambiguous about what exactly the problem was at a technical level. I haven't seen a transcript, but I'd be extremely surprised if it contains: "Pan Pan Pan, Lion XXX experiencing control difficulties due to Speed Trim System receiving bad Angle of Attack data!!!!!!!"

Agreed! But I should have added that Boeing etc will (I hope) have looked at the previous problem flights and their crews. It's at least possible that a picture from previous flights of UAS following an AoA error, compounded by unexpected, strong STS movements following the switch to Manual Flight (if the previous crews reported this), coupled with this being consistent with the rather abrupt upset the existing data shows the crashed plane suffered after alerting ATC to a UAS problem, all might lead to an advisory bulletin - which says, be aware that there's a Runaway STS QRF too - being issued independent of the FDR data. Anyway, we shall see..... I'm just a bit cautious of 100% concluding - from the Bulletin wording - that Boeing have the FDR data in front of them yet.

sAx_R54
10th Nov 2018, 14:25
And if the pilots really did say that, it would be a pretty strong indication that it was not the problem -- the outcome of the flight suggests that the pilots hadn't correctly identified the problem, whatever it was.

The current outcome is suggesting that the pilots were never likely to solve the problem(s) they were experiencing, as the systems augmentation was working contrary to their training expectations, suggesting a fundamental difference in systems design philosophy/control architecture between 737NG and 737MAX variants.

krismiler
10th Nov 2018, 14:25
The Boeing philosophy is to have the pilot fly the aircraft where as Airbus want the automation to do it. Regardless of which manufacture's aircraft you are flying, the pilot needs to be able to deal with control system malfunctions. Engine fire/failure is regularly practiced and tested, as are RTOs and TCAS, perhaps stick and rudder ability needs to be looked at as well. Accidents such as this one highlight a lack of basic flying skills which is sadly becoming more common as pilots move straight from basic training onto highly automated aircraft.

Everything is fine as long as the automatics behave themselves and nothing occurs which isn't covered in the manuals, though in this case it seems it was covered by a laid down procedure.

This could have been prevented if any one link in the accident chain had been broken, failures in equipment, maintenance and flight crew all coincided and the chain held.

GarageYears
10th Nov 2018, 15:07
The Boeing philosophy is to have the pilot fly the aircraft where as Airbus want the automation to do it. Regardless of which manufacture's aircraft you are flying, the pilot needs to be able to deal with control system malfunctions. Engine fire/failure is regularly practiced and tested, as are RTOs and TCAS, perhaps stick and rudder ability needs to be looked at as well. Accidents such as this one highlight a lack of basic flying skills which is sadly becoming more common as pilots move straight from basic training onto highly automated aircraft.

Everything is fine as long as the automatics behave themselves and nothing occurs which isn't covered in the manuals, though in this case it seems it was covered by a laid down procedure.

This could have been prevented if any one link in the accident chain had been broken, failures in equipment, maintenance and flight crew all coincided and the chain held.

Except the cause of the trim behavior (AOA sensor invalid) in this case wasn’t understood to affect the STS, or even that this was an AOA sensor related issue. The use of AOA within the STS system is a ‘new’ feature for the MAX, and I’m pretty sure this exact malfunction isn’t even available on any flight sim currently, leaving the crew facing an array of failures (no AP, UAS indications, stick-shaker) and the trim system surreptitiously winding on nose down trim.

The armchair coach pretty much always wins the game, but even with clear hindsight I don’t believe anyone had pinned the exact cause of the crash prior to the Boeing AD.

All I can say is it was a good job the FDR was found, because that was what let the cat out the bag with respect to this being AOA sensor related and linked to the STS.

- GY

LaissezPasser
10th Nov 2018, 17:38
unless they find the CVR (seems odd it's not been found yet)

If I may, here's an update on the CVR search:
CVR No Longer Transmitting Signals
SATURDAY, 10 NOVEMBER, 2018, 21:16 WIB
TEMPO.CO, Jakarta - The National Search and Rescue Agency (Basarnas) announced that it has officially stopped its search for the remaining victims of the Lion Air flight JT 610 that crashed at Tanjung Karawang.
However, the search for the airplane’s missing cockpit voice recorder (CVR) will continue until an undetermined time. “We will search for it up to a one-kilometer radius,” said the head of the National Transportation Safety Commission (KNKT), Soerjanto Tjahjonoat JICT II, North Jakarta, on November 10.
The search for the missing CVR is hampered by the fact that unlike the week before, this device is no longer transmitting signals to the search team. “The ping signal can no longer be heard now,” said Soerjanto.
However, the recovery team is set to utilize an ROV equipped with the needed features to search for the missing CVR that is believed to be buried under the seabed. “The device that we prepared is able to detect objects buried 4-meters under the bottom of the ocean,” he explained.
The ROV itself, according to Soerjanto, was lent by a foreign country that happened to be docking in East Java and is currently on its way to Jakarta and will be operated in the Lion Air flight JT 610 recovery operation next week.

Lonewolf_50
10th Nov 2018, 17:47
It's a pity you added the words low cost to your post because otherwise IMHO it is spot on! Standards should be determined and enforced by the regulators. Globally, they fail dismally. OK, I'll accept that correction.
FWIW, I have a number of close friends who fly with American major airlines (we all share a military background, and some of us were in training squadrons together as instructors).
While they are not all that pleased with the training opportunities, versus box checking, I get the idea that they each have a corporate culture where training is a bit more than a box check. But maybe that's getting worse, not better, as time goes on.

@Golden Rivit: thanks for the link, nice refresher. I note that the training film is dated in 1997.

mross
10th Nov 2018, 18:23
If only the warning to the pilots had been "AoA disagree - A/P off, STS off" or something precise and useful. And Feel Diff Press should NOT alarm.

Gysbreght
10th Nov 2018, 18:28
According to the FAA Emergency AD, an erroneous Angle of Attack (AOA) input, among other symptoms, can result in indications of:

IAS DISAGREE alert.

ALT DISAGREE alert.

I'm wondering why an erroneous Angle of Attack (AOA) input would cause those alerts. Is it because the pitot-static position error corrections require an AoA input?

Secondly, I wonder what really occured on previous flights. Was it really an UAS situation or were above alerts incorrectly diagnosed as a pitot-static system problem?

Organfreak
10th Nov 2018, 18:55
If only the warning to the pilots had been "AoA disagree - A/P off, STS off" or something precise and useful. And Feel Diff Press should NOT alarm.

:D :ok: :8

wiedehopf
10th Nov 2018, 18:55
According to the FAA Emergency AD, an erroneous Angle of Attack (AOA) input, among other symptoms, can result in indications of:

IAS DISAGREE alert.

ALT DISAGREE alert.

I'm wondering why an erroneous Angle of Attack (AOA) input would cause those alerts. Is it because the pitot-static position error corrections require an AoA input?


If you read the thread carefully you will come across this post:

From my own experience on the NG a wrong AoA input will result in UAS, unreliable altitude, vertical speed, wind information and ground speed display. It is a basic correction factor into the ADIRU that does effect all resulting air data related information and surprisingly the non air data related information of ground speed as well. It might be different in the MAX, but somehow i doubt it. As different airflow over the fuselage results in huge position error values for static and pitot tube values, the AoA vane corrects those very different position errors, therefore a wrong AoA indication will result in a completely unreliable air data set.

Then there is also this comment.


Flutter speed
8th Nov 2018, 15:20
"So, for a 737, what would be the largest difference between IAS, uncorrected for AoA, and CAS, within the range of AoA that could be reasonably expected in flight? The large airplanes I've flown didn't correct IAS for AoA, and without looking them up, I don't recall that the airspeed calibration charts having a correction larger than 5 ish knots. Seems if it came down to a choice between an IAS that differed from CAS about 5 kt at low airspeeds/high AoA and no usable airspeed indication at all if the AoA fails, I know what I'd prefer. Especially if my takeoff and landing charts were referenced to IAS, whcih makes CAS a relatively uninteresting number. (except in cruise, where IAS and CAS are usually fairly close anyway) "

Just ran some numbers, in very general terms, depending on sensor position and factors like Mach number, in extreme cases... expect up to 5kts difference. Probably enough to trigger an IAS and ALT disagree on a modern airliner. For a plane flying at moderate speed the difference will be more towards 2kts.



The archive version of this forum can be searched a little bit better with CTRL-F
https://www.pprune.org/archive/index.php/t-614857-p-4.html

In case you want to dig around the thread some more.

Concours77
10th Nov 2018, 19:07
Ref: above post by Garage Years: “...All I can say is it was a good job the FDR was found, because that was what let the cat out the bag with respect to this being AOA sensor related and linked to the STS....”

Perrhaps not the time or place. Didn’t flight safety used to be pro-active? The fact that Mx didn’t suss the issue four times might not reflect on the shop.

Again, any “new system” makes it incumbent upon the airframer to fully test and fully disclose performance of the added function, No?

if the AoA issue re: intermittent trim input was unknown to Boeing, fair enough. I fail to see how it is possible that such an issue could have remained a mystery in a fully comprehensive testing program.

It takes an emergency bulletin to apprise Mx of the issue? Given enough time, I promise an aircrew could have Sussed and rectified the abnormal. Unfortunate that given unlimited time, the airframe builder remained in the dark? This aircraft should not have been released to flight. Even given the wrong problem was addressed in the shop, it remained unrepaired. Inexcusable.

speed2height
10th Nov 2018, 19:15
A pilot who understands the relationship between AoA, Speed and G will quickly recognise a faulty AoA indication. This is not something you can teach in a simulator and in my opinion must form the basis of all UPRT.


Best thing I have heard for a while. 100% agree

A Squared
10th Nov 2018, 19:25
When pilots go to "manual" do they routinely also disable the STS, and if not why not ?

That depends on what you mean by "go to manual". If you mean, just disengaging autopilot and hand flying in a normal situation, No. As I understand it (not a 737 pilot) the STS is there specifically for when the airplane is being hand flown, than is has no function when the autopilot is engaged.

wiedehopf
10th Nov 2018, 19:38
Secondly, I wonder what really occured on previous flights. Was it really an UAS situation or were above alerts incorrectly diagnosed as a pitot-static system problem?


Looking at the altitude profile the accident and previous flight there is this sudden descent.
That fits with a high reading AoA sensor leading to stick shaker activation followed by a pitch down by the pilot.
Also the automatic trim down would have activated.

Now i've been told before on this thread only the AoA can trigger the stick shaker which makes not much sense to me (the posts were deleted anyway).
My understanding is the combination of AoA and airspeed leads to stick shaker activation.
If someone wants to explain the exact stick shaker logic on the 737-8 please feel free i would be curious :)

Anyway the plane displayed IAS disagree with the stick shaker activating on the captains side. They continued the previous flight using the instrumentation on the right hand side.

The AoA sensor was replaced according to KNKT, see this quote from avherald:
On Nov 8th 2018 the KNKT reported an angle of attack sensor had been replaced on Oct 28th 2018 following the flight JT-775 from Manado to Denpasar (the aircraft completed the subsequent flight JT-43 to Jakarta and suffered the crash the next flight JT-610). The aircraft subsequently flew to Jakarta, the crew however reported there were still problems. The search for the CVR is hampered by thick mud.

So maybe they introduced the AoA problem by replacing the sensor or they made it worse, the sensor that came off the airplane is at Boeing being tested.
It's also possible that the plane already had an underlying pitot-static issue that was not fixed.
Or somehow the input logic receiving the AoA data was flawed and replacing the sensor did nothing.

Without more facts the answer to your question is mostly just: Outside the investigation no one can say for sure at the moment.

rideforever
10th Nov 2018, 21:21
Putting an engineer on board the final flight means .... that they may have been accustomed to fixing / testing serious issues on passenger full planes, and his presence may have complicated the situation by either the pilots trying to activate the fault in order that the engineer can see the problem, or that the engineer used any arising faults as an opportunity to do some diagnosis rather than let the pilots recover.
Well it's 100% insane. Once you "put the engineer on board", your intentions are clear.

Concours77
10th Nov 2018, 21:31
Putting an engineer on board the final flight means .... that they may have been accustomed to fixing / testing serious issues on passenger full planes, and his presence may have complicated the situation by either the pilots trying to activate the fault in order that the engineer can see the problem, or that the engineer used any arising faults as an opportunity to do some diagnosis rather than let the pilots recover.
Well it's 100% insane. Once you "put the engineer on board", your intentions are clear.

Withoit question. Trouble shooting a serious problem is the domain of flight test, NOT commercial carriage. This is not on Boeing. Except to the extent that it was initiated by the “mystery”, which is on Boeing.

Halfnut
11th Nov 2018, 00:00
10737 MAX8 Emergency Airworthiness Directive (https://www.alliedpilots.org/News/ID/6449/737-MAX8-Emergency-Airworthiness-Directive)
posted on November 10, 2018 09:22737 MAX8 Emergency Airworthiness DirectiveThe recently released Emergency Airworthiness Directive (http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf) directs pilots how to deal with a known issue, but it does nothing to address the systems issues with the AOA system, which may be the causal system in the Lion Air accident. This is significant. The positive takeaway is that we are advised, as pilots, that once we recognize the issue, we can stop the negative impacts by taking the trim system out of the loop.

At the heart of this investigation is the MCAS system (description from Boeing):

MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aislestand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

This is the first description you, as 737 pilots, have seen. It is not in the AA 737 Flight Manual Part 2, nor is there a description in the Boeing FCOM. It will be soon.

APA Safety recommends that you familiarize yourselves thoroughly with the information provided by CA XXXXXXX, 737 Fleet Captain, and the AA 737 fleet team. We have been working closely with CA XXXXXXX to get you accurate information as quickly as it becomes available. The AA 737 fleet team has placed this information in CCIs to 737 pilots, in bulletins, and in changes to flight documents.

At the present time, we have found no instances of AOA anomalies with our 737 MAX8 aircraft. That is positive news, but it is no assurance that the system will not fail. It is mechanical and software-driven. That is why pilots are at the controls.

Awareness is the key with all safety issues. You are aware this anomaly may occur and there is a mitigation procedure. No different than should you experience an engine failure.

As we continue to receive details, we will provide them in emails only to the 737 group. We chose to send this initial email to all pilots because it is a subject that is generating a great deal of interest.

Should you have questions, please do not hesitate to email or call us here at APA Safety: XXX-XXX-XXXX.

Captain XXXXXXX
DFW 737I
APA Safety Committee Chairman

LEOCh
11th Nov 2018, 01:57
10
MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aislestand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.


Wow, thanks for posting. This appears to be the missing puzzle piece, a new MAX system apparently unknown outside of Boeing which directly links AoA to the stab for improved stall protection (when sensors are working). I can't see how MCAS can be retained in the present form, with a single high alpha AoA sensor failure now capable of failing the MCAS to inappropriate downtrim as well as providing a set of additional cascading alarming failures (primarily UAS) to reduce the pilot's chances of recognising the problem in time and deactivating trim. I do still wonder whether the STS did not contribute to the accident at all, or whether in UAS it made things worse by adding inappropriate trim input to the MCAS's.

Bleve
11th Nov 2018, 02:04
Thanks Halfnut for sharing that email. As the email states: '... it is a subject that is generating a great deal of interest ...'. By sharing outside the email's target audience, you have helped immensely with our understanding of what may have happened and more importantly you have allowed us to be better prepared if something similar happens again in the future. Thank you.

shamrock7seal
11th Nov 2018, 03:34
Rideforever & Concours777: engineers are carried for a number of reasons the main one being in case of a lack of engineering support at the outstation in this case a small regional airport which probably didn't have a line maintenance agreement in place. This is very common especially for rapidly growing LCC's that haven't had time to get it done. Not a sign that they wanted to troubleshoot something in the air at all.

Lonewolf_50
11th Nov 2018, 04:20
hum posted this A pilot who understands the relationship between AoA, Speed and G will quickly recognise a faulty AoA indication. This is not something you can teach in a simulator and in my opinion must form the basis of all UPRT. to which you responded Best thing I have heard for a while. 100% agree Where there is an AoA indication to see, that point being made is well made. This thread has been moving with good pace, so I may have missed the post that shows the Lion Air 737's being equipped with an AoA gage for the pilot to see, and thus recognise a faulty AoA indication. I'll check the tech log thread as well

Organfreak
11th Nov 2018, 04:29
to which you responded Where there is an AoA indication to see, that point being made is well made. This thread has been moving with good pace, so I may have missed the post that shows the Lion Air 737's being equipped with an AoA gage for the pilot to see, and thus recognise a faulty AoA indication. I'll check the tech log thread as well

Read somewhere that it was not so-equipped.

CurtainTwitcher
11th Nov 2018, 06:14
One line of thinking is that the crew did end up using the cutout switches at some point, however, by this point it had been trimmed nose down (due AoA fault operating the MCAS). Now the electric trim is unavailable with significant nose down trim, the only option left is manual trim (very slow) or to reduce IAS the air-load Speed increased to the point where the elevator could not overcome the trim.

Given the undocumented MCAS system and an unannunciated AoA fault, whilst dealing with an unreliable airspeed, it is highly unlikely that many pilots would have the insight or knowledge to understand the need to reduce speed (and how do you know what to set, the only guidance in the checklist is two attitude / thrust combinations depending upon the flap configuration), or recover with manual pitch trim from 5000'.

A very interesting simulator experiment would be to do a series of progressively more nose down trims, setting the UA QRH attitude & thrust and seeing if there is a speed or nose trim position that becomes unrecoverable using the elevator alone with the stab trim switches in cutout.

The more official and semi-official documentation and information that is starting to come out (ie the APA MCAS) suggests it's not looking good for Boeing.

JPJP
11th Nov 2018, 06:23
I can't see how MCAS can be retained in the present form

Hilarious. Not kidding - that made me laugh. Like the batteries that burned uncontrollably ? Then they put a box around them.

I do still wonder whether the STS did not contribute to the accident at all, or whether in UAS it made things worse by adding inappropriate trim input to the MCAS's.

Since at least one very large pilot group (+ 12,000) had no idea that MCAS even existed; one wonders if it’s a bastardized STS that Boeing augmented and renamed, then wasn’t ‘effectively emphasized’.

hum
11th Nov 2018, 08:14
to which you responded Where there is an AoA indication to see, that point being made is well made. This thread has been moving with good pace, so I may have missed the post that shows the Lion Air 737's being equipped with an AoA gage for the pilot to see, and thus recognise a faulty AoA indication. I'll check the tech log thread as well

Strangely my original posts have been deleted... I cannot imagine what the PPrune police objected to!

I was making a general point, AoA is fundamental to everything we do as pilots, We must insist that - especially in aircraft where it is measured and used to influence systems - it is displayed to pilots. We must also fundamentally change our philosophy whereby there is an obsession with speed alone from day 1 of flight training, Lift (=G) varies with both speed AND AoA.

When, as it seems in this tragic case, an important sensor gives an erroneous value, and assuming that value is displayed (which it was not apparently) a trained pilot will quickly separate truth from lies.

DaveReidUK
11th Nov 2018, 09:12
Rideforever & Concours777: engineers are carried for a number of reasons the main one being in case of a lack of engineering support at the outstation in this case a small regional airport which probably didn't have a line maintenance agreement in place. This is very common especially for rapidly growing LCC's that haven't had time to get it done. Not a sign that they wanted to troubleshoot something in the air at all.

Lion Air did indeed state that the presence of the flying spanner on the flight was not connected with the recurring technical issues (though they didn't admit at the time that there had in fact been a sequence of events).

That statement may or may not be true.

The CVR, if and when it's found, may shed some light on what role, if any, the engineer had on the flight.

Concours77
11th Nov 2018, 10:51
Maybe now is the time to repost one of mine that was deleted. A Flight Critical System was not referenced in the AFM, and the system turns out to be reliant on one only AoA vane. On vane failure, PF side is affected, PNF’s is not. Upon failure, one pilot has an emergency, PNF’s “does not”. Creates confusion to say the least: “What are you doing!”

Without AoA display there is no ability to cross reference. Without knowledge of the system, aircrew is challenged by similarity to UAS.

There has been one fatal accident seemingly related to this lack of included description in the Flight Manual.

FAA has issued an ESB AD to mitigate this lack of system inclusion in the Flight manual. On its face, it appears this will solve the ongoing threat to flight safety.

Will it? There is no reason to believe it will not. Whatever reliabilitty issues there were, (sole source of data driving activity of system), the resolution seems appropriate, and sufficient. Reliability aside, The system can now be mitigated on failure due this add to the AFM.

Questions. How can a flight critical system be fitted to an aircraft such that the operator is not completely informed of its existence and functionality? Can the design be improved and the system modified? To be determined, and Probably not...

AGBagb
11th Nov 2018, 11:24
From the FAA EMERGENCY AIRWORTHINESS DIRECTIVE:

Runaway Stabilizer
In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual....


But from the Boeing MCAS documentation quoted above:

MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aislestand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude.

Some horrible confusion right there about what Commanded means or does not mean..... and Runaway too.

Gysbreght
11th Nov 2018, 11:57
The function of the system somewhat euphemistically named MCAS (Maneuvering Characteristics Augmentation System) is similar to that of a stickpusher. Apparently the airplane needs it to comply with certification requirements.

A Squared
11th Nov 2018, 11:58
Reading the letter pasted by Halfnut above my understanding is:

1. ) The Maneuvering Characteristics Augmentation System (MCAS) is a system that is distinct from the Speed Trim System (STS) and not merely an alternate name for the STS.

2.) The 737 MAX has a system whcih makes significant adjustments to the flight control system, whcih change the way the airplane flies, and Boeing provided no information on this system in operating manuals or related literature (at least to flight operations departments) .

Is this incorrect or inaccurate?

alf5071h
11th Nov 2018, 12:14
From #978, operator system description and actions.
“… as pilots, that once we recognize the issue, we can stop the negative impacts by taking the trim system out of the loop.”
Recognition is paramount.

A pedantic Point; most of the discussion is about trim, whereas the device is an augmentation system which interfaces with trim as the output.
Questions for clarity; does the trim-wheel move when the MCAS is active? Is it a serial or parallel design ?
If no movement, then in piloting terms MCAS has no meaningful visual relationship with the conventional use of trim; thus the critical action is to take MCAS out of the loop not trim per se.

It is difficult to recognise the situation without first experiencing the out-of-trim force (in simulation, are simulators so equipped ?), and with demonstration, to understand the combinations of associated alerts, both visual and audio, so as not to confuse this specific situation with any other involving individual input failures.

There was no prior description provided for pilots. How about engineering / maintenance, or at least in a reasonable guide for troubleshooting.
Was the FAA aware; their flight ops, training, airworthiness (monitoring previous events), certification ?

Learning for safety; which was the initiating event; which were enabling factors - ‘holes in the cheese’
Regrettably this event has great learning potential for the industry; if only …

“...no matter how hard they try, humans can never be expected to out perform the system which bounds and constrains them. Organisational flaws will, sooner or later, defeat individual human performance.”

“Responsibility lies with those who could act but do not, it lies with those who could learn but do not and for those who evaluate it can add to their capacity to make interventions which might make all our lives the safer.”
Phillip Capper – ‘Systems safety in the wake of the cave creek disaster.’

Smott999
11th Nov 2018, 12:41
That a critical control feature has apparently been undocumented/unavailable to the pilots flying the MAX.
As a long time software engineer to make these types of changes without notice to users is...not good. And my users were merely people sitting at desks, not flying planes.

I have to wonder about liability for Boeing here.

Smott999
11th Nov 2018, 13:15
Does not show the article. Only a News archive.
...perhaps only available to members?
Also a google search cannot find a thing. So I guess this emergency directive is....secret? At least to the general public?

Concours77
11th Nov 2018, 13:19
That a critical control feature has apparently been undocumented/unavailable to the pilots flying the MAX.
As a long time software engineer to make these types of changes without notice to users is...not good. And my users were merely people sitting at desks, not flying planes.

I have to wonder about liability for Boeing here.


From the “Boeing Media Room”.....

“On November 6, 2018, Boeing issued an Operations Manual Bulletin (OMB) directing operators to existing flight crew procedures to address circumstances where there is erroneous input from an AOA sensor. “

Exceot for two things, the first being there is no AoA display. Second, the crew must first understand that the “existing procedures” ALSO apply to MCAS FAULT...

Trying to conflate “existing procedures” with no published link to the faulty system is dishonest and misleading.

Concours77
11th Nov 2018, 13:28
The function of the system somewhat euphemistically named MCAS (Maneuvering Characteristics Augmentation System) is similar to that of a stickpusher. Apparently the airplane needs it to comply with certification requirements.

I posted that earlier. Deleted. It is analogous to a stickpusher, but is “stickpusher light”. Sneaky input from TRIM had a material part to play in AF447.

”Partial and mysterious TRIM input in manual flight”. Close to the deck, without trained response to fault.

Liability? Boy Howdy.

rideforever
11th Nov 2018, 13:29
Same pilots for all 4 sectors ?

Smott999
11th Nov 2018, 13:30
it’s like they said “hey follow existing procedures” and then a couple days later it’s “oh here’s something related that we never published “

that cant be good

Concours77
11th Nov 2018, 13:34
[QUOTE=Smott999;10308100]it’s like they said “hey follow existing procedures” and then a couple days later it’s “oh here’s something related that we never published “

that cant be good
/QUOTE

It’s damning, and the lawyers who wrote it know exactly what is wrong with that statement. They also know almost all people will believe it exonerates Boeing. It won’t it digs them in deeper.

The AD is self explanatory.

A Squared
11th Nov 2018, 13:48
Same pilots for all 4 sectors ?

The names reported in the media for the crew of the accident flight are different than the crew names written on the tech log from the previous flight. No idea about the other sectors.

mross
11th Nov 2018, 15:07
As far as I am concerned, this crash is mostly (80%) down to Boeing.... They put in some more software crap (but didn't put it in the manual), they supplied the faulty AoA sensor. And the software that allowed the faulty input to mess up a whole lot of other stuff.... How this plane got certified god only knows (though others have suggested the possible reason).....

But the alpha vane was replaced, so it probably wasn't the fault unless both new and old were defective. Maybe the real fault was 'downstream' of the alpha vane?

Dr Jay
11th Nov 2018, 15:24
But the alpha vane was replaced, so it probably wasn't the fault unless both new and old were defective. Maybe the real fault was 'downstream' of the alpha vane?

Probably. But a less likely possibility is that replacement solved one problem but was not done correctly and created a larger one.

Why were the previous 3 flights recoverable but not this one ?

And with all the planes out there flying hundreds if not thousands of flights daily fitted with the same systems, why was this plane so far the only one exhibiting the anomaly ?

Smott999
11th Nov 2018, 15:39
Also as an engineer , with only 2 AoAs, I’d be reluctant to make any decision based on a disagree. Perhaps a “large” disagree, but in any case, without a majority vote, asking HAL for nose-down Trim seems scary.

Concours77
11th Nov 2018, 15:40
The AD states AoA disagree plus (in concert with) other “faults”. The key problem is that appropriate data that should have been in the Manual was missing.

One of these faults is “unable to disengage autopilot”. Which is interesting, because the mystery problem occurs only in manual flight.

in any case, the AD refers to “erroneous” AoA data. As two discrete installed systems, Independence of data sources instead of sampled together, seems an odd approach.

It may be Boeing’s idea to keep them discrete so a simple change of command would likely solve the MCAS issue. However, handing off a corrupted flight path might be worse.

SLFstu
11th Nov 2018, 15:47
Does not show the article. Only a News archive.
...perhaps only available to members?
Also a google search cannot find a thing. So I guess this emergency directive is....secret? At least to the general public?
Halfnut's post (link: https://www.pprune.org/showpost.php?p=10307740&postcount=978) which included *completely new information* sourced from Boeing about the MCAS system was quoting a slightly redacted memo from the APA safety committee that was intended only for AA pilots.
Another leaked document? Dayum.

A Squared
11th Nov 2018, 16:16
Does not show the article. Only a News archive.
...perhaps only available to members?
Also a google search cannot find a thing. So I guess this emergency directive is....secret? At least to the general public?

The Emergency Airworthiness Directive is available on the FAA's website. The APA letter posted by Halfnut contains a link to that Airworthiness Directive.

sAx_R54
11th Nov 2018, 16:30
10737 MAX8 Emergency Airworthiness Directive (https://www.alliedpilots.org/News/ID/6449/737-MAX8-Emergency-Airworthiness-Directive)
posted on November 10, 2018 09:22737 MAX8 Emergency Airworthiness DirectiveThe recently released Emergency Airworthiness Directive (http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf) directs pilots how to deal with a known issue, but it does nothing to address the systems issues with the AOA system, which may be the causal system in the Lion Air accident. This is significant. The positive takeaway is that we are advised, as pilots, that once we recognize the issue, we can stop the negative impacts by taking the trim system out of the loop.

At the heart of this investigation is the MCAS system (description from Boeing):

MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aislestand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

This is the first description you, as 737 pilots, have seen. It is not in the AA 737 Flight Manual Part 2, nor is there a description in the Boeing FCOM. It will be soon.


Captain XXXXXXX
DFW 737I
APA Safety Committee Chairman

Unbelievable!

sAx_R54
11th Nov 2018, 16:41
Reading the letter pasted by Halfnut above my understanding is:

1. ) The Maneuvering Characteristics Augmentation System (MCAS) is a system that is distinct from the Speed Trim System (STS) and not merely an alternate name for the STS.

2.) The 737 MAX has a system whcih makes significant adjustments to the flight control system, whcih change the way the airplane flies, and Boeing provided no information on this system in operating manuals or related literature (at least to flight operations departments) .

Is this incorrect or inaccurate?

Time no doubt will tell, but if correct no greater example of gross coporate negligence considering the fundamental change to the previously understood design and control!