Indonesian aircraft missing off Jakarta

[Setpoint99]

‘Spend the Minimum’: After Crash, Lion Air’s Safety Record Is Back in Spotlight (https://www.nytimes.com/2018/11/22/world/asia/lion-air-crash-safety-failures.html)

JAKARTA, Indonesia — The government safety inspector had spent all night at the Makassar airport, in eastern Indonesia, several years ago, poring over a Lion Air jet that had suffered a hydraulic failure. Telling airline employees that the plane was to be grounded until the problem was fixed, the inspector went back to a hotel for a quick shower.

When the inspector returned, the plane was on the runway, about to take off.

Furious, the inspector demanded that the passengers disembark. But a supervisor with Lion Air explained how the airline had gone over the inspector’s head: Federal transportation officials in Jakarta, the Indonesian capital, had given permission for takeoff, the inspector said. The plane was in the air minutes later.

[A Squared]

‘Spend the Minimum’: After Crash, Lion Air’s Safety Record Is Back in Spotlight (https://www.nytimes.com/2018/11/22/world/asia/lion-air-crash-safety-failures.html)

JAKARTA, Indonesia — The government safety inspector had spent all night at the Makassar airport, in eastern Indonesia, several years ago, poring over a Lion Air jet that had suffered a hydraulic failure. Telling airline employees that the plane was to be grounded until the problem was fixed, the inspector went back to a hotel for a quick shower.

When the inspector returned, the plane was on the runway, about to take off.

Furious, the inspector demanded that the passengers disembark. But a supervisor with Lion Air explained how the airline had gone over the inspector’s head: Federal transportation officials in Jakarta, the Indonesian capital, had given permission for takeoff, the inspector said. The plane was in the air minutes later.

I would require a lot more information and context before getting outraged. What precisely was the "hydraulic failure"? Was it something which could legally be deferred in accordance with a MEL, and the inspector was trying to force them to replace something that the aircraft could be legally dispatched without?

[DaveReidUK]

Whether or not a 'jackscrew" can be back driven depends on the thread pitch and friction ( braking ) factors. . For a simple example - a course ( large) pitch ( few threads per inch ) is often used for jacking up buildings and heavy objects and are NOT likely to be back driven ..

Correct me if I'm wrong, but the coarser the thread pitch (all other things being equal), the more likely a jackscrew is to be back driveable (the spiral ratchet screwdriver principle). Is that what you're saying?

I can't see air loads on the stab being capable of overcoming the combined braking friction in the jackscrew, gearbox and actuator unless we're talking about a previously undisclosed failure in addition to the issues already discussed.

[Concours77]

Correct me if I'm wrong, but the coarser the thread pitch (all other things being equal), the more likely a jackscrew is to be back driveable (the spiral ratchet screwdriver principle). Is that what you're saying?

I can't see air loads on the stab being capable of overcoming the combined braking friction in the jackscrew, gearbox and actuator unless we're talking about a previously undisclosed failure in addition to the issues already discussed.

I think that’s right. The mechanical advantage of the threads is sufficient to restrain the jackscrew. Add the friction of the drive motor, and even though the nut is carried in bearings, the HS stays put? Question: Is the drive always engaged?

As to programming versus mechanical upgrades, I found nothing about “software only” to establish the new MCAS system. I got thoroughly bogged down in “Onboard programmable modules”, “Line replaceable units” and its acronym LRUs.

Sistering STS with MCAS and only one trim drive? If Trim is flight critical, (the crash suggests so), where is drive redundancy? How is one drive isolated from the other(s) such that opposite inputs would (not) stall a (single) motor?

So, somebody please tell me the HS was not Stalled? Because that is just another word for “jammed”...Is there nothing worse than runaway Trim? Perhaps an HS that cannot reverse it?

STS: Speed too high, NU..... MCAS:: AoA Too High, ND.......

Question. Was the five second pause (MCAS) put in to allow “recompute”?

Did STS see the pause as a chance to NU? Hence a game of porpoise? What are the relative velocities of NU, ND? Same? NU faster?

Unknowledgeable wants to know.

[Bergerie1]

I cannot remember or find the details, but there were some incidents back in the early days of the 707 when airloads did backdrive the screw jack on the stabiliser. BOAC had one over Toronto shortly after take-off and the crew only just managed to retain control. Some posters on PPRuNe may be able to find or, perhaps, know the details.

[DaveReidUK]

I cannot remember or find the details, but there were some incidents back in the early days of the 707 when airloads did backdrive the screw jack on the stabiliser. BOAC had one over Toronto shortly after take-off and the crew only just managed to retain control. Some posters on PPRuNe may be able to find or, perhaps, know the details.

There have been a number of 707/720 accidents where the THS has been implicated, including a fractured jackscrew, a stalled actuator and a trim motor failure, but I'm not aware of any that involved a working stabilizer jackscrew being backdriven by airloads.

[jimtx]

Apparently, not all airlines or administrative bodies were caught off guard. From the Jan 2018 ANAC ODR with Training requirements - note MCAS is identified as Class B on Page 18. The stab trim cutout switch nomenclature change is mentioned on pg 19 as Class A training.

http://www.anac.gov.br/assuntos/setor-regulado/profissionais-da-aviacao-civil/avaliacao-operacional-1/Boeing_737_OE_Report_Revoriginal.pdf

Strangely, the latest FAA FSB report I could find does not have any reference to the MCAS and differs in the answer under "FLT CHAR" for a few of the Flight Controls listed. The FAA doc has "no" while the Brazilian Report has "minor". But the response for the MCAS in the Brazilian report is "no" . http://fsims.faa.gov/wdocs/fsb/b737_rev_16.pdf. It's possible rev 16 is not the latest report though.

[Gary Brown]

Fdr report from today legislators with knkt
MCAS is still trimming down automatic even though pilot push it with trimming up
tinyurl.com /Jt610-DPR



That Press Release (https://www.slideshare.net/DhaniIrawan1/presentasi-knkt-soal-pklqp-di-dpr) - " Presentation of NTSC on PK-LQP Questions in the DPR - Submission of NTSC to the V Commission - 22 November 2018 " - seems only to be as yet in Indonesian. The meat of it appears to be that the NTSC will release a preliminary report of the FDR Data on 28th November. In the press release though are quite a few charts (in the slideshow, at the top of the page) that may (or may not...)be FDR-derived.

Don't see anything directly in it about MCAS behavior on the fatal flight - but, then, my Indonesian is all-but non-existent...

[Gipsy Queen]

Correct me if I'm wrong, but the coarser the thread pitch (all other things being equal), the more likely a jackscrew is to be back driveable (the spiral ratchet screwdriver principle). Is that what you're saying?

I can't see air loads on the stab being capable of overcoming the combined braking friction in the jackscrew, gearbox and actuator unless we're talking about a previously undisclosed failure in addition to the issues already discussed.

Mr Reid, you are correct.

There is a point where a coarse pitch, usually on an Acme threaded bar, will become "non-reversible" as a function of reduction in pitch and concomitant increase of friction between the nut and the leadscrew. However, with recirculating ball systems where the leadscrew has a rounded threadform conforming to the radius of the balls, the frictional element substantially is reduced which, of course, is the purpose of having the ball race. Nevertheless, even with this system, there will be a point at which the mechanism becomes non-reversible. Hardly a definitive observation but looking at the video above, it would seem that the Boeing arrangement possibly might be sufficiently low-geared to prevent a reversed actuation.

Also, it is possible that in order to achieve optimal screwjack speed, the motor drive would be via a worm/wheel arrangement, thus making the system truly non-reversible.

[Mad (Flt) Scientist]

looks like FDR data, typical "flightscape" plot format. One plot looks like it's the previous flight (since it shows flaps being deployed and then speed dropping off on landing as you'd expect)

there's a good 20 degree AOA split throughout that flight ...

There's a bunch of trim command looking data traces too; the resolution on the plots doesn't seem quite good enough to read the parameter names (perhaps not by error)

re https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-76.html#post10317513 (https://www.pprune.org/[url=[url=[url) (post 2 above)

[SteinarN]

That Press Release (https://www.slideshare.net/DhaniIrawan1/presentasi-knkt-soal-pklqp-di-dpr) - " Presentation of NTSC on PK-LQP Questions in the DPR - Submission of NTSC to the V Commission - 22 November 2018 " - seems only to be as yet in Indonesian. The meat of it appears to be that the NTSC will release a preliminary report of the FDR Data on 28th November. In the press release though are quite a few charts (in the slideshow, at the top of the page) that may (or may not...)be FDR-derived.

Don't see anything directly in it about MCAS behavior on the fatal flight - but, then, my Indonesian is all-but non-existent...

Google translate from the press report;
14. The next investigation process: This accident is the first time this has happened in the world for B 737-8 MAX aircraft, so it is necessary to do flight simulations using engineering simulators and algorithms, especially the MCAS system and others at the Boeing facility in Seattle accident and see the impact on the plane for the damage that occurred.

[CONSO]

Correct me if I'm wrong, but the coarser the thread pitch (all other things being equal), the more likely a jackscrew is to be back driveable (the spiral ratchet screwdriver principle). Is that what you're saying?

I can't see air loads on the stab being capable of overcoming the combined braking friction in the jackscrew, gearbox and actuator unless we're talking about a previously undisclosed failure in addition to the issues already discussed.

Its MORE than just the pitch ( lead) please take the time to read this simplified explanation

https://www.linearmotiontips.com/how-to-determine-if-a-screw-will-back-drive/

and for an approximation of loads

https://www.aerospaceonline.com/doc/...actuators-0001 (https://www.aerospaceonline.com/doc/horizontal-stabilizer-trim-actuators-0001)

[climber314]

That Press Release (https://www.slideshare.net/DhaniIrawan1/presentasi-knkt-soal-pklqp-di-dpr) - " Presentation of NTSC on PK-LQP Questions in the DPR - Submission of NTSC to the V Commission - 22 November 2018 " - seems only to be as yet in Indonesian. The meat of it appears to be that the NTSC will release a preliminary report of the FDR Data on 28th November. In the press release though are quite a few charts (in the slideshow, at the top of the page) that may (or may not...)be FDR-derived.

Don't see anything directly in it about MCAS behavior on the fatal flight - but, then, my Indonesian is all-but non-existent...

Edit: NOT the accident flight! Thanks wiedehopf (https://www.pprune.org/members/433642-wiedehopf) & Luc Lion (https://www.pprune.org/members/135299-luc-lion).
Excellent translation below from Sam Asama (https://www.pprune.org/members/327159-sam-asama) as well.

Initial/TO/Climb Stab Trim Value shown is just under 7.5 followed by a period of flux with the value ultimately returning to 5.0 preceding leveling at 5,000 ft. This pre-nosedise value of 5.0 continues, increasing to approximately 6.75 with incremental stepping (upward) throughout the course of the descent to a maximum value of just over 7.5 and subsequently returning to a value of 5.0.
https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/1024x768/to_b627ec956250c17777dc0bbb6df91974646aa64c.jpg

[Rananim]

xxxxxdeleted

[Sam Asama]

My short summary of what I perceive to be the most salient points of the NTSC powerpoint presentation:

"The next steps in the investigation process will include continuing to collect information related to aircraft maintenance and flight crew training.

The AoA sensor component that was removed from the aircraft in Bali was received by the NTSC and will be inspected in the USA.
the NTSC is requesting (via the NTSB) to get more information about AOA sensors installed at DPS (Bali), which had been repaired (or perhaps supplied) by a Florida repair station.

The NTSC plans to issue a Preliminary Report on November 28, 2018, but will first share the report with the Ministry of Transportation (and/or other government agencies) and Lion Air, and the families of the victims.

Further investigation: This was the first accident in the world for a B737-8 MAX aircraft, so it will be necessary to do flight simulations using engineering simulators and algorithms, especially MCAS systems (my emphasis) and others at Boeing facilities, Seattle and reconstructing flights that have crashed (or perhaps reconstructing various crash scenarios) to see the impact damage on the aircraft.

INVESTIGATION CHALLENGES: NTSC does not have sufficient internal resources for such a large accident. (NTSC) is currently being assisted by various organisations, such as BASARNAS, BPPT, Ministry of Transportation, Pertamina, Ministry of Energy and Mineral Resources, Indonesian military, etc. The current number of NTSC investigators (10) is not enough to carry out all investigative activities for current investigations in Indonesia.

NTSC does not currently have storage facilities for some of the aircraft parts that have been designated for further evaluation. NTSC also doesn’t have adequate physical space for meeting rooms for the various teams.

Due to the amount and complexity of digital systems of B737 Max 8 aircraft (and other new aircraft types) it will take NTSC a lot of time to study and understand the aircraft systems (especially new systems) in order to analyze any problems that exist."

Sam

[Gary Brown]

There have been a number of 707/720 accidents where the THS has been implicated, including a fractured jackscrew, a stalled actuator and a trim motor failure, but I'm not aware of any that involved a working stabilizer jackscrew being backdriven by airloads.

Not of course directly (or even necessarily) implicated, but can anyone explain Item 4 on the Runaway Stab memory item list quoted below. How is that the Stab could continue "uncommanded" movement after the two cutout switches are flipped? What is it that those switches do or don't do? Is the QRF allowing for some purely mechanical "uncommanded trim" that can only be mechanically countered with the wheel (assuming noting's catastrophically broken...)?

If the Runaway Continues
3 STAB TRIM CUTOUT SWITCHES (both) - CUTOUT

If the Runaway Continues
4 STABILIZER TRIM WHEEL - GRASP and HOLD

[wiedehopf]

Initial/TO/Climb Stab Trim Value shown is just under 7.5 followed by a period of flux with the value ultimately returning to 5.0 preceding leveling at 5,000 ft. This pre-nosedise value of 5.0 continues, increasing to approximately 6.75 with incremental stepping (upward) throughout the course of the descent to a maximum value of just over 7.5 and subsequently returning to a value of 5.0.


The picture you are describing seems to be from the previous flight.
(See on the x-axis written DPS and CGK would indicate a flight from Denpasar to Jakarta, the accident flight however departed Jakarta)

So you can see the constant up and down after selecting flaps up being produced by manual flight fighting the MCAS system so to speak.

Then they switched off the trim and a couple of minutes later maybe tried to switch it back on and obviously switched it back off with manual trim for the rest of the flight.

Traces as far as i can read from top to bottom are:
BLUE: TRIMUPMANUAL
YELLOW: TRIMDOWNMANUAL (yoke switches would be my guess)

BLUE: PITCHTRIMPOSITION

GREEN: TRIMUPA (A for automatic would be my guess)
VIOLET: TRIMDOWNA

RED: STICKSHAKERLEFT
GREEN: STICKSHAKERRIGHT

RED: CCFORCE_PITCHWSLOCAL
GREEN: CCFORCE_PITCHWSFOREIGN

RED: ANGELOFATTACKINDICATEDL
GREEN: ANGELOFATTACKINDICATEDR

LIGHT GREEN: FLAPS?????POSITION

RED: COMPUTEDAIRSPEEDL
GREEN: COMPUTEDAIRSPEEDR

BLUE: ALTITUDE_101325MB_L

[Concours77]

posted by Babilu

Explanation on MCAS

Note that MCAS overrides pilot stick input...first automatic override of a pilots input to a primary flight control in their commercial design history to my knowledge.Previously all anti-stall devices merely warned and aided the pilot to recognize and recover from a stall(eg,PLI,EFS,autoslats,shakers)

That leaves either a)counter-trimming or b)selecting BOTH trim switches to CUTOUT as a way for the pilots to override MCAS triggered by false ADIRU data.
Boeings AD mandates (b) as the approved procedure but hindsight is 20/20.If the pilots dont recognize it as runaway trim due i)startle factor ii)trim is not continuous but in 9 second stages iii)false stickshaker masks trim and degrades pilots alertness then they are left with (a)

Pilots have spoken about overriding STS with main electric trim.All B737 pilots have done this.But STS uses AP stab trim motor(presumably B/U in the MAX) whilst stick trim uses main electric(presumably PRI in MAX).A pilot flying manually cant trim down and pull on the stick at the same time...not unless the override switch is in override.What if MCAS is using the same trim motor as the one actuated by stick trim?MCAS description says it uses lower trim rate at higher mach and vice versa.So it may well be using PRI motor at low altitudes and B/U at higher altitudes.In which case there is a possibility that the simultaneous command of opposing trim in the same trim motor could lead to motor stall and burnout.MCAS is trimming down using PRI motor because a/c is at low altitude and low mach.Pilot pulls on stick to no effect.Pilot then trims up using stick trim(PRI) causing clutch engagement and motor stall.Who wins?MCAS or the pilot?How many reversals can this trim motor withstand before failure?Any engineers please comment.

The underlying concept of Boeings commercial design has always been that the pilot has the final say.The input to the stick by the pilot overrides any device or warning system controlled by HAL.For Boeing to have deviated from this principle means there were serious concerns about MAX's pitch characteristics.In shooting for glory and lower fuel burn they have sacrificed their soul at the altar of greed and complacency.When the pilot pulls the houses must get smaller.....always.

Above comments do not relieve a pilot from exercising airmanship and killing ALL HS trim when the pitch control of his/her aircraft is in doubt.

Rananim:

”....Sistering STS with MCAS and only one trim drive? If Trim is flight critical, (the crash suggests so), where is drive redundancy? How is one drive isolated from the other(s) such that opposite inputs would (not) stall a (single) motor?...”

post number 1514

just sayin.

[climber314]

The picture you are describing seems to be from the previous flight.
(See on the x-axis written DPS and CGK would indicate a flight from Denpasar to Jakarta, the accident flight however departed Jakarta)

So you can see the constant up and down after selecting flaps up being produced by manual flight fighting the MCAS system so to speak.

Then they switched off the trim and a couple of minutes later maybe tried to switch it back on and obviously switched it back off with manual trim for the rest of the flight.
Oops... I had just switched from this slide.
Still interesting to note the AoA values vs. Stab Trim on the previous slide.

Edit: Slide/Graph removed and replaced with enlarged(?) image in post #1538

[DaveReidUK]

Is the QRF allowing for some purely mechanical "uncommanded trim" that can only be mechanically countered with the wheel (assuming noting's catastrophically broken...)?

The manual pitch trim on the 737 is a 100% conventional cable-and-drum arrangement that Lindbergh would probably recognise. I'm struggling to think of any possible failure mode that would result in uncommanded movement.

The "grasp and hold" action item makes use of the fact that there is a clutch in the trim actuator gearbox which ensures that manual trim inputs override any electrical inputs to the actuator from either the trim switches or the autopilot.

[Luc Lion]

@climber314,

the graph you just copied above concerns the flight Bali-Jakarta that precedes the accident flight.
The graph for the accident flight is this one:
https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/638x479/presentasi_knkt_soal_pklqp_di_dpr_7_638_1e09e82793a45baebb29 4833e5e30f5ff09a779e.jpg
You can see that, for the first part of the flight, there a mix of trim up and down commanded by the automation (I guess it means "by the STS"), with also some pilot trim inputs.
After one third of the flight, there is a regular pattern of alternating trim down from the automation with trim up from the pilot.
Until the very end where the pilot input becomes short pulses that are insufficient to counteract the automation longer pulses.

The graph from the previous flight also shows a mix of frequent pilot trim up and PA trim down, up to a point where it stops, restarts a bit later, and then stops for the rest of the flight.

[climber314]

Rananim:

”....Sistering STS with MCAS and only one trim drive? If Trim is flight critical, (the crash suggests so), where is drive redundancy? How is one drive isolated from the other(s) such that opposite inputs would (not) stall a (single) motor?...”

post number 1514

just sayin.

Is manual control not a form of redundancy? (rhetorical)

[Luc Lion]

I would be interested to check if the regular pattern starts when the flaps retraction is complete.

[climber314]

@climber314,

the graph you just copied above concerns the flight Bali-Jakarta that precedes the accident flight.
The graph for the accident flight is this one:

You can see that, for the first part of the flight, there a mix of trim up and down commanded by the automation (I guess it means "by the STS"), with also some pilot trim inputs.
After one third of the flight, there is a regular pattern of alternating trim down from the automation with trim up from the pilot.
Until the very end where the pilot input becomes short pulses that are insufficient to counteract the automation longer pulses.

The graph from the previous flight also shows a mix of frequent pilot trim up and PA trim down, up to a point where it stops, restarts a bit later, and then stops for the rest of the flight.
Agreed.... my bad on the first slide/graph.

[CONSO]

Is manual control not a form of redundancy? (rhetorical)

IF it is ONLY and completely manual. but MCAS seems to be able to override manual based on a single sensor -

[wiedehopf]

I would be interested to check if the regular pattern starts when the flaps retraction is complete.

It does.
The flap position is the light green graph 3rd or 4th from the bottom.

@climber134 would you mind posting the slide of the accident flight (your pictures are better quality than Lucs)

It's quite grizzly... it seems they never cut out the trim and stopped counteracting with trim switch inputs at the start of the dive.

Also the control column forces (labeled foreign and local) diverge when the dive starts but i don't really have an idea what that means.
(Maybe the 2nd pilot helped pull the yoke)

[climber314]

It does.

@climber134 would you mind posting the slide of the accident flight (your pictures are better quality than Lucs)



Here you go...
The slide I posted originally might not have been "enlarged" to full resolution?
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/1024x768/presentasi_knkt_soal_pklqp_di_dpr_7_1024_1__cbac43b757dd89dd a97a7368a21bbd506af6534f.jpg

[wiedehopf]

I took the freedom to add what i could read overlaid onto the slide of the FDR readout (in the hope that someone will find it useful):
(EDIT: improved annotations, used DaveReidUKs better picture as base)

https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1400x1050/fdr_accident_flight_b1075c5fb64dc5e088ebb03ec2e7bb5d755b9159 .jpg

[Luc Lion]

They were obviously aware they had a problem with the trim. I suppose that they didn't deal with it because they had a more serious problem at hand (UAS). They may have been reluctant to action the cutout switches without understanding the speed issue.
But, until the start of the descent, they were in control. I wonder what caused a change to their pitch control strategy.
A switch of PF/PM roles?
The red and green control force graph shows mostly the coupling with some limited red spikes. At the start of the descent, it's the green force that spikes.
Then, at the very end, the red prevails again.
​​​​​​

[MickG0105]

I took the freedom to add what i could read overlaid onto the slide of the FDR readout (in the hope that someone will find it useful):


Terrific work, thank you for that contribution.

Am I reading that correctly? Does that show that after the initial upset they redeployed flap during the climb out? If so, and if an MCAS operating condition is flaps up, there appear to be some nose down trim commands that look like what were presumably MCAS commands where they shouldn't be.

[Longtimer]

THE AOA PROBLEM – WHAT WE CAN DO ABOUT IT (reprinted from Curt Lewis Flight Safety Information News). (https://airlinesafety.blog/2018/11/19/the-aoa-problem-what-we-can-do-about-it/)Posted on November 19, 2018 (https://airlinesafety.blog/2018/11/19/the-aoa-problem-what-we-can-do-about-it/) by Shem Malmquist FRAeS (https://airlinesafety.blog/author/shemmalmquist/) THE AOA PROBLEM

WHAT WE CAN DO ABOUT IT



By Captain Shem Malmquist

AN FSI COMMENTARYThe following is based only on an analysis and implications of the FAA airworthiness directive (AD) issued in the wake of the accident and is not intended to be speculative on the accident itself. Other factors unknown to me may be involved.

In the wake of the October 29 Indonesian crash of a brand new Boeing 737 MAX 8 that took the lives of 189 passengers, the FAA has issued Emergency Airworthiness Directive (AD) 2018-23-51. The 737 is the most widely flown aircraft in the world, This tragedy opens an important conversation between regulators, operators and pilots. Lion Air, an experienced 737 operator, was the launch carrier last year for the 737 MAX 8 and the MAX 9 in March.

While it will take a long time to analyze the Lion Air 610 accident, the AD points out that current system architecture has created vulnerabilities. Anyone who flies modern jet aircraft, as I do, also knows that in some ways this conversation applies to every plane and every pilot. Attempts to assign blame to anyone at any point in this investigation sidesteps a much more important issue, one that is the essential to the future of ever more automated cockpits.

The FAA says its AD was “prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer[1]. This condition, if not addressed, could cause a flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain[2].”

As described in the Seattle Times, “The system called MCAS, for Maneuvering Characteristics Augmentation System, is activated when a sensor on the side of the fuselage indicates a dangerously high angle of attack (AOA), the angle between the air flow and the wing. “If the plane is in an abnormally steep turn that puts high stress on the air frame, or when its speeds fall so low it’s about to stall, MCAS will kick in and swivel the horizontal tail to push the nose of the airplane down in an effort to avert the danger”.[3]

While the Seattle Times article incorrectly implies that the system is based on speed or “high stress on the air frame, ” the system description appears to be essentially correct. Low airspeed or a higher load factor (which can occur in a steep turn or pull up from a dive) are among the possible reasons the angle of attack can approach a stall. Unlike other critical components such as air speed indicators or altimeters which have comparator systems that cross check each other for spurious indications and alert the pilot that there is a mismatch, pilots have no way to quickly determine if they are being misled by a faulty AOA sensor[4].

As with erroneous airspeed or altitude readings, the loss of the sensor itself leads to loss of secondary systems and/or can trigger other warning systems. Even on the most advanced state of the art aircraft there is no direct feedback to the pilots when the AOA sensor itself has failed. Pilots must quickly infer a faulty AOA sensor from other faults or indications.

Underlying this problem is the fact that a computer software system does not “fail” like a mechanical system. It can be incorrectly coded, or it can be incorrectly designed, but the system does not “fail” like a turbine blade that rips apart in flight. Generally, what we see is that the software was coded correctly based on the requirements provided to the people coding the software but the problem lies in the requirements and specifications provided to them.

If a certain scenario was not considered in the requirements it is unlikely to find its way into the final computer coding. The AD describes an emergency scenario where a sensor reads an erroneously high AOA and the software reacts as its designers intended. The software responds to the erroneous indication in a manner similar to the way a human might react. However, all the pilot sees is the final result. How the computer came to take an action is opaque.

This makes it very difficult to crosscheck the computer’s process model (decision making process). As Boeing and the FAA AD explain, the bad AOA sensor leads to several problems. The erroneously high indication of AOA first leads to an autopilot disconnect. The system then works to prevent a stall by adding nose-down trim.

So how does this affect the process model (mental model) for the pilots? It is standard in the Boeing aircraft that the stabilizer trim can be stopped by moving the control column in the opposite direction. Aircraft designers assume that no pilot would intentionally trim the aircraft nose up while also pushing forward on the controls to pitch the aircraft down or vice versa. However, in the case of the B-737 MAX 8 and 9 there are reports that reversing the control column (pulling back) won’t work to stop the stabilizer trim from trimming nose-down in the scenario described in the AD.

Others have discussed the rationale behind this design decision[5], but suffice to say that this would be different than what a pilot would be expecting based on previous experience on other Boeing 737 models. The erroneous AOA could trigger both an erroneous stall warning and a pitch down (due to the MCAS trimming the horizontal stabilizer).

This gets a lot more complicated when you consider how the FAA defines a stall condition for a transport category airplane (adapted from Title 14 CFR 25.201): Full stall condition – any one, or combination, of the following: – A nose-down pitch that cannot be readily arrested, which may be accompanied by an uncommanded rolling motion – Buffeting of a magnitude and severity that is a strong and effective deterrent to further increase in angle of attack – The pitch control reaches the aft stop for 2 sec and no further increase in pitch attitude occurs when the control is held full aft, which can lead to an excessive descent rate – Activation of a stall identification device (e.g., stick pusher)

As can be seen, the condition described in the AD would present at least two of the criteria. First is the “nose-down pitch that cannot be readily arrested” (because the pilots were not previously aware that the system was intentionally doing that due to the erroneous sensor) and second is the “activation of a stall identification device,” in this case, a stick shaker, also due to the same erroneous sensor. The pilot could effectively be misled as to what is actually going on by the software system.

The AD also implies that it is possible that the trim cutout switches (guarded switches that disconnect electrical power from the trim system) may not work, stating: “If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.” Pilots are often our own worst enemy, with some contending that the situation should have been obvious, the aircraft attitude was nominal and airspeed normal. Such Monday morning quarterbacking suggests hindsight bias.

The pilot placed in the middle of this situation does not have the benefit of knowing the outcome. They see the aircraft pitching down and are getting a stall warning. There has been considerable emphasis on stall recovery in the wake of the Air France 447 accident. In the aftermath of that training, pilots are being trained that a stall in a transport airplane is not always apparent nor do all stalls provide the kind of cues pilots might expect based on previous experience. Simulators are not able to fully replicate a real stall in a transport airplane, hence the training emphasizes respecting the stall warning system.

Of course this creates a new quandary. Consider a crew who incorrectly believes they are in a stall situation analogous to the Air France 447 accident, with the nose attitude at a nominal state but the actual AOA is quite high. They might try to recover by pushing over. In other words, the system is tricking the pilot into believing they might be in a non-existent deep stall. Absent any flight deck indication that the information they are relying on is wrong, it would be difficult to pass judgment on a pilot that is following their training.

Perhaps we need to consider adding a flight display alert that prominently shows an AOA failure with a mismatch AOA alert. This approach would parallel similar alerts for airspeed or altitude indication failures. Accomplishing this would be fairly straight forward. Most transport airplanes have at least two, sometimes three, AOA vanes and sensor systems.

A system such as outlined by Ossmann and Joos (2017) would be one possible solution: An advanced fault detection and diagnosis (FDD) system to monitor the triplex redundant angle of attack measurement of a commercial large transport aircraft has been presented. The FDD system incorporates signal- and model-based fault detection algorithms. Fault isolation is achieved by an individual monitoring of the three angle of attack sensors[6]. An alert would be valuable in any case. This is especially true when we consider what happened with other AOA failure events, such as occurred on the Airbus that led the system protection systems to make extreme maneuvers on Qantas 72. (https://en.wikipedia.org/wiki/Qantas_Flight_72 (http://r20.rs6.net/tn.jsp?f=0017eJDbpFAKXtaMF3k9frrIUVhLSa-2hoK3uPQ8XUwHMLvjy-OkW_ZRfHE28qmLXeqosK6LyBrEZho_cvadiDeUlnh6rA_zR_npQzKjxbmSSL mdjMJG3buqGBT5wid_4CGU0Q0tZS0PgtI-JxNGxXWKcerX5FvYfiD2vy2YA4kr11xyAz5x6qSzBJqdowvZS95az58KG5bM Rc=&c=RKGwMRtsU5ftUV_z2Y9AemblG3OQ9P40AsaGnKPrSG3-ok6rstxtgQ==&ch=8XvqsygFXdpDhzpTITFNYJs7uwD2Pn1a4AAXtRMDiC41KHEUfwIXSA==) ).

Such an alerting system would provide the pilots with the information they need to disconnect flight computers or other actions as appropriate. This should be combined with ensuring pilots understand all of the functionality of the system so they would recognize all a particular sensor failure might impact. Every flight depends on pilots to “fix” problems that designers did not anticipate, be they in aircraft design, procedures or the entire system design.

Give the pilot the information and skills to do that. Give the pilot information that the system has an erroneous input via its sensing system.

How can we prevent future problem like this? A systems approach to analysis would be a good start. Identifying the needs up front prior to writing the requirements for the software has to happen. Implementing System Theoretic Accident Models and Processes (STAMP) would likely be the best solution we have at present. The majority of current risk analysis methods (FTA, Bow-Tie, FMEA, FMECA, PRA,, HFACS, ARP 4761, MIL-STD-882 etc.) are just not up to the task for finding complex system interaction problems as has been described here.

Nor are those methods well suited to identify problems in systems that rely on humans and software. STAMP (see http://psas.scripts.mit.edu/home/ (http://r20.rs6.net/tn.jsp?f=0017eJDbpFAKXtaMF3k9frrIUVhLSa-2hoK3uPQ8XUwHMLvjy-OkW_ZRfHE28qmLXeqndxaXIAstREYBggYvceSb0zXL3L4mK8exBxkhVp_b9U e3kQLMiTumdescppDWJ7affX1NiEPI5OGj_sIYBDng_LthGmB5hTCGNaBH7b wZA9RrsvzneMsZEUrrQcCQB98&c=RKGwMRtsU5ftUV_z2Y9AemblG3OQ9P40AsaGnKPrSG3-ok6rstxtgQ==&ch=8XvqsygFXdpDhzpTITFNYJs7uwD2Pn1a4AAXtRMDiC41KHEUfwIXSA==) ) can provide a way forward.

Knowledge can keep you alive. Captain Shem Malmquist is a veteran 777 captain and accident investigator. He is coauthor of Angle of Attack: Air France 447 and The Future of Aviation Safety and teaches an online high altitude flying course with Beyond Risk Management and Flight Safety Information.

Text edited for greater clarity - Rob

[wiedehopf]

Am I reading that correctly? Does that show that after the initial upset they redeployed flap during the climb out? If so, and if an MCAS operating condition is flaps up, there appear to be some nose down trim commands that look like what were presumably MCAS commands where they shouldn't be.

Yes. But they also retracted the flaps after the stickshaker had already been going off for quite some time.

That's 2 activations of MCAS in the short interval the flaps were up. Then after that it's probably STS doing it's thing.

Also the previous flight completed their sector with the stick shaker being active basically the whole flight.

[FCeng84]

737 MCAS clarifications:

1. MCAS does not override pilot column or stabilizer trim inputs. Column controls the elevator regardless of MCAS commands. Pilot's pitch trim electric switches override MCAS stabilizer commands.
2. Activating both stabilizer cutout switches disables all electric trim. That would leave just the flight crew's manual turning of trim wheel in cockpit as the only means of moving the stabilizer.
3. MCAS uses exactly the same control path as STS. The same motor (commanded by the FCCs for autopilot stabilizer control) is used to implement both MCAS and STS commands.

[PaxBritannica]

Speaking as a paying pax, I'm seeing two issues here, and the one that matters to me is not MCAS. I'm seeing that a commercial carrier put passengers on a plane that clearly had serious technical problems.

The fact that no-one involved knew about MCAS is irrelevant. The plane wasn't behaving normally or safely. Passengers should never have been allowed near it until it had been flight-assessed by qualified staff who get paid to take a risk. Why are Lion Air still flying?

[gearlever]

How on earth FDR data made its way to the public before official release?

[climber314]

How on earth FDR data made its way to the public before official release?

PRESS RELEASE: NTSC Discloses Lion Air PK-LQP FDR Data in the DPR

https://news.detik.com/berita/4312425/knkt-beberkan-data-fdr-lion-air-pk-lqp-di-dpr
https://www.slideshare.net/DhaniIrawan1/presentasi-knkt-soal-pklqp-di-dpr

[gearlever]

Thx climber,
sounds like a whistleblower to me.

[FCeng84]

AGBagb - Activation of the both stab cutout switches should disable all electric control of the stabilizer. One can, however, imagine a failure that involves one or more electrical shorts that yields runaway stabilizer that is not arrested via the cutout switches. For that reason, the checklist has #4 suggesting that as a last effort, physically stopping the trim wheel on the flight deck will freeze the stabilizer. MCAS should be disabled via activation of the cutout switches. Short of a failure with the stabilizer electric motors that is separate from MCAS, activating both cutout switches will stop MCAS from moving the stabilizer.

[Rananim]

737 MCAS clarifications:

1. MCAS does not override pilot column or stabilizer trim inputs. Column controls the elevator regardless of MCAS commands. Pilot's pitch trim electric switches override MCAS stabilizer commands.
2. Activating both stabilizer cutout switches disables all electric trim. That would leave just the flight crew's manual turning of trim wheel in cockpit as the only means of moving the stabilizer.
3. MCAS uses exactly the same control path as STS. The same motor (commanded by the FCCs for autopilot stabilizer control) is used to implement both MCAS and STS comman

Thank you.I used the wrong wording.MCAS doesnt of course override pilot input to elevator.Rather MCAS continues to operate even if in opposition to stick input by pilot.Apologies

[CONSO]

AGBagb - Activation of the both stab cutout switches should disable all electric control of the stabilizer. One can, however, imagine a failure that involves one or more electrical shorts that yields runaway stabilizer that is not arrested via the cutout switches. For that reason, the checklist has #4 suggesting that as a last effort, physically stopping the trim wheel on the flight deck will freeze the stabilizer. MCAS should be disabled via activation of the cutout switches. Short of a failure with the stabilizer electric motors that is separate from MCAS, activating both cutout switches will stop MCAS from moving the stabilizer.

1) Can the motors stand a high rate multiple operation x minutes duty cycle without damage- lockup
2) If locked due to 1 above, can trim wheel still move stab?
3) Is there enough mechanical advantage via trim wheel to move stab from extreme position- airloads ?

[b1lanc]

Y

Also the previous flight completed their sector with the stick shaker being active basically the whole flight.

Which absolutely amazes me that the aircraft would be released for the next (fatal) segment.

[alph2z]

Am I reading that correctly? Does that show that after the initial upset they redeployed flap during the climb out? If so, and if an MCAS operating condition is flaps up, there appear to be some nose down trim commands that look like what were presumably MCAS commands where they shouldn't be.
Incredibly, it looks like it. I'm assuming that the blue spikes on the automatic-trim graph lines are due to MCAS. But, before I dare advance more ideas, we need a clarification of the 4 different lines of the manual and automatic trim inputs. Also, why does one AOA differ from the other when they eventually track each other with a constant offset; it can't be a graph offset often seen in NTSB graphs. Can someone clarify this.

[Concours77]

Incredibly, it looks like it. I'm assuming that the blue spikes on the automatic-trim graph lines are due to MCAS. But, before I dare advance more ideas, we need a clarification of the 4 different lines of the manual and automatic trim inputs. Also, why does one AOA differ from the other when they eventually track each other with a constant offset; it can't be a graph offset often seen in NTSB graphs. Can someone clarify this.

if one vane was damaged such that the vane was reading offset from its hub, the readings would be consistent, they would be deflected the same by the airstream, but one would have a bias “x” degrees offset from hub. Or, the indexing pin could be un-mated with its receptacle. Improper install.

[derjodel]

Does that show that after the initial upset they redeployed flap during the climb out?

To me it seems that retracting the flaps caused the first huge nose down trim. It could be they didn't recognise it was a trim problem (as MCAS is undocumented) and thought something's wrong with the configuration hence they redeployed the flaps. Trim is relatively stable during the 2nd flaps extension compared to the final stage of the flight, so it seems that worked. If they kept this configuration and landed, they would be ok :-(

I believe Boing is going to be facing the grand jury for this. And they should prepare themselves for a massive, in billions, payout to the families. Rightly so!

[Machinbird]

After scanning the KNKT flight data recorder graphs for the accident flight, it appears that the final loss of control coincides with a substantial increase in power.
It may be that they were attempting to raise the nose using the thrust-pitch couple, however they may have unwittingly accelerated into a speed vs trim crossover point where they no longer had sufficient nose up trim to hold the nose up.

[Luc Lion]

@CONSO,
You should read the FCOM before asking such questions.
The answers to your 3 questions are yes, yes and yes.

[CONSO]

Fit hitting shan --- WSJ

https://www.wsj.com/articles/lion-air-seeks-more-details-on-boeing-crash-1542922735

ByBen Otto,Robert Wall andAndy PasztorUpdated Nov. 22, 2018 6:22 p.m. ET JAKARTA, Indonesia—Lion Air said Thursday it would press Boeing (https://quotes.wsj.com/BA?mod=article_inline)Co. for more details about a new model 737 plane while Indonesian authorities issued their most definitive statement yet that pilots of Flight 610 were battling automated nose-down commands before last month’s fatal crash (https://www.wsj.com/articles/plane-with-188-people-on-board-crashes-off-indonesia-1540784983?mod=article_inline&mod=article_inline&mod=article_inline&mod=article_inline).The budget airline’s safety director, Daniel Putut, said he would head to the Boeing facility in the Seattle area, where the plane was built, on Nov. 30 to ask about actions the plane maker was taking to prevent a repeat of the accident. “We need to hear from Boeing,” he said.
The system activated after the flight control system believed the plane’s nose was inclined 20 degrees up from level flight. A system that vibrates the control yoke to alert the pilot about the risk of a potential stall , called a stick shaker, also activated, he said.The pilot countered the nose-down maneuver and stabilized the plane, Mr. Utomo said. The jet continued to climb before the MCAS again pushed the nose down. Information provided to lawmakers suggested repeated nose-down input by the plane’s computers -- with weaker nose-up commands from the cockpit crew -- before the 737 MAX rapidly lost altitude and crashed.

goes on . . .

[pax2908]

Stick shaker left side throughout the previous flight ... out of curiosity is it expected that you proceed to destination? I also wonder what it looked like, the flight before that.

Edited to add: and would that normally be also reported in the tech log? (Earlier in this thread, we saw entries from the tech log and I did not recall having seen stickshaker reported?)

[Rated De]

Which absolutely amazes me that the aircraft would be released for the next (fatal) segment.

Yes.
Sitting assessing the sequence of events in the sectors prior it is insightful that the aircraft kept getting pushed back at the next crew.

One posits that Boeing may well now be retaining substantial legal firepower.
This does not bode well for the manufacturer.

[DaveReidUK]

Charts extracted direct from the PDF, probably the best resolution we're going to get (sorry for the size, mods).

Bottom chart is the previous DPS-CGK flight.:
https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/1300x1000/engine_parameters_1b983dea5bf6bd1d458ca0e2d8dcba86de970db9.j pg
https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/1319x872/parameters_153f78d2e02ec7a284ba1d56b3ffafd8d11e78e0.jpg

https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/1319x873/dps_cgk_flight_2091aa89354f202454a4864a3d65719fde12672f.jpg

[phil gollin]

.

This article in The Guardian shows that there was a statement in the Indonesian Parliament ;

https://www.theguardian.com/world/2018/nov/23/lion-air-crash-pilot-fought-to-keep-plane-in-air-says-report

----------

Does anyone know how the recovery of the bodies is going ?

.

[Gary Brown]

.

This article in The Guardian shows that there was a statement in the Indonesian Parliament ;

https://www.theguardian.com/world/2018/nov/23/lion-air-crash-pilot-fought-to-keep-plane-in-air-says-report

----------

Does anyone know how the recovery of the bodies is going ?

.

Well, the Guardian article links to a pay-walled Australian article that purportedly reports on the Indonesian Parliament. And the Guardian journo clearly knows all-but-zip about this or any other aspect of aviation.

At this relatively early stage in the hard-core investigation, it's always a tad expected - and sad - that the assorted parties try and "bat the issue back over the net". The manufacturer will say, look at the airline and its procedures; the airline will say, look at the manufacturer and its procedures. Repeat. Repeat. The "truth" will as sure as eggs is eggs lie in between - almost every single sad event like this requires a lot of holes in the cheese to line up, as we should well know.

IIRC, the recent Indonesian press release (if genuine; whose FDR charts are extensively discussed above) said that the search for bodies had now been completed.

[krismiler]

Does anyone know how the recovery of the bodies is going ?


https://www.channelnewsasia.com/news/asia/indonesia-wraps-up-lion-air-crash-victim-identification-10961686

JAKARTA: Indonesia on Friday (Nov 23) wrapped up the grim task of identifying Lion Air jet crash (https://www.channelnewsasia.com/news/asia/lion-air-crash-boeing-flight-safety-investigation-faa-jt610-10932462) victims from recovered body parts, with a preliminary report on the cause of the accident that killed 189 people due next week.

The Boeing 737 Max jet - one of the world's newest and most advanced commercial planes - plunged into the Java Sea on Oct 29 shortly after taking off from capital Jakarta to Pangkal Pinang city, killing all on board.

Since then, investigators have been doing DNA testing on recovered body parts. As of Friday, 125 people have been identified after testing on human remains that filled some 200 body bags, said Arthur Tampi, head of the national police medical centre.

"We have identified 89 men and 36 women, including two foreigners, namely an Italian and an Indian national" who was the flight's captain, Tampi told reporters in Jakarta.

The identification was being called off because all the recovered remains have been tested, he added.

Budget carrier Lion Air has said it is paying a little over US$100,000 in compensation to the families of each crash victim.

The smashed jet's flight data recorder (https://www.channelnewsasia.com/news/asia/boeing-lion-air-crash-737-max-jt610-explainer-10935460) was recovered but divers are still looking for the cockpit voice recorder.

A formal preliminary report on what might have caused the crash is due Wednesda

[Luc Lion]

I read above several messages from pilots stating that the B737 can be flown with pitch trim at full nose down electric stop, although it requires considerable muscular force and the help of the other pilot.
I also note the EFS system increases forward control column force to approximately four times normal feel pressure during a stall.
Can I thus assume that the pilot testimonies above only apply to conditions where the EFS system DOES NOT kick in ?
And that the B737 does not provide enough elevator authority when the trim is at full nose down AND the EFS system is active ?

[Less Hair]

The FDR was recovered under some layer of sand from the seafloor. The CVR will likely be buried under sand as well. Not easy to pick up signals.

[LandIT]

Indonesia Parliament report might be briefly summarised as reported...
pilot fought to keep the plane in the air after it stalled and was nose-diving to the ground.
the aircraft experienced “the same obstacles” (as) on the previous day’s flight from Denpasar to Jakarta but on that occasion the pilot had managed to keep control of the plane
the pilot attempted to offset the (nosedive) action, fighting to keep it in the air
became “increasingly difficult to control the airplane”
the load on the steering wheel became too heavy for the pilot to manually control, and “then the plane drops”
the aircraft crashed into the sea at a speed of more than 400mph.
the 737 had no engine problems

I read somewhere the loads on the control column can become more than one pilot can overcome.

[etudiant]

The FDR was recovered under some layer of sand from the seafloor. The CVR will likely be buried under sand as well. Not easy to pick up signals.

Given that digital data recorders are now dirt cheap and very robust, it might be easier to just add a dozen around the airframe. That would obviate the current 'Where's Waldo' like searches for the one essential item buried in the mud.

[Fortissimo]

Given that digital data recorders are now dirt cheap and very robust, it might be easier to just add a dozen around the airframe.

They may be dirt cheap and robust but they still weigh a fair bit and take up physical space. Where in the airframe would you propose to site them, and how would you mount them? How would you get power and the various mic channels to them? And why would you go to all that cost and long-term weight penalty for a comparatively rare event? If you ask the accident investigators, they will tell you it would be better to have a second FDR than another 11 CVRs.

[lomapaseo]

Given that digital data recorders are now dirt cheap and very robust, it might be easier to just add a dozen around the airframe.

That's like adding floor lamps in your room to offset any bulbs that may burn out. In the end you would be tripping over all the wires wondering which lamp they go. I shudder to think about the same mess of wires in a plane

[Gary Brown]

Indonesia Parliament report might be briefly summarised as reported...
pilot fought to keep the plane in the air after it stalled and was nose-diving to the ground.
SNIP

[my emphasis]

I wonder if he actually said that, or meant it if he did?

[wiedehopf]

I wonder when AOA DISAGREE would have shown during this flight. Judging from the FDR data, the AOA bias already existed at lift-off, so could it have been during the takeoff roll, prior to V1?

It was previously written in this thread that the AOA DISAGREE alert only exists when the PFDs are fitted with an AOA display.

Anyway Air Data disagree errors are most likely coupled to being in the air and don't show on the takeoff run.
Or can UAS be displayed during the takeoff run? I don't know.

[xetroV]

It was previously written in this thread that the AOA DISAGREE alert only exists when the PFDs are fitted with an AOA display.
I've read large parts of the thread, but not all of it. In our NG fleet we do have an AOA DISAGREE alert, but no AOA display (except implicitly via the flight path vector).

And since a faulty AOA can mess up flight data such that an experienced crew can get overwhelmed to the extent of crashing their aircraft, I wonder why Boeing offers the AOA DISAGREE alert as a customer option in the first place. That makes as much sense to me as offering optional engine fire warning loops...

[infrequentflyer789]

That's like adding floor lamps in your room to offset any bulbs that may burn out. In the end you would be tripping over all the wires wondering which lamp they go. I shudder to think about the same mess of wires in a plane

Pretty sure that something like "mess of wires" was what I thought on seeing an aircraft wiring loom (in construction) for the first time :) Up close of course it isn't a mess, it's all neat and labelled etc., but first sight it's like a giant spaghetti monster had a multicoloured yawn, with lumps in.

But if we're doing multiple secondary flight recorders, why not go wireless? Makes retrofit feasible too - one wireless transmitter at the existing DAU, possibly some relay transmitters, and multiple receiver-CSMU units. Storage capacity and size won't be a problem - we're heading towards a terabyte on a single micro SD - crash survivability will need some work but it should be much easier to make small things survivable.

The really big question isn't can we do it, it is why? With the existing system the number of accidents where we find the aircraft but don't find the recorders really is minimal, the benefit side of the equation just isn't going to justify the costs. I do have to admit to thinking more than once that the airbus composite fins would be an excellent place for a secondary CSMU - they do seem to have a detaching, surviving and floating capability already built in.

[infrequentflyer789]

I wonder if he actually said that, or meant it if he did?

I wonder if there was a word or two lost in translation and what was meant was "after it thought it stalled". Yes, we all know the aircraft doesn't think as such, but "the aircraft thought it was stalling and therefore nose dived" is as good as you are going to get for a one-line description of this accident.

[b1lanc]

This quote from Avherald on KNKT presentation to Parliament:
" On the previous flight from Denpasar to Jakarta the same problem existed, the automatic trim inputs however did not occur. The crew must have done something preventing the MCAS system producing the nose down trim inputs."

[wiedehopf]

2 AoA probes have the same fault - the one replaced and the one fitted (unlikely, but not impossible)
Actually as far as i know the AoA probe replacement was carried out not before the accident flight but prior to the previous flight.

I have not yet seen FDR data from the flights that triggered the replacement i would assume they are uninteresting with no or minor AoA disagree otherwise they would have been in the slides)

So no there were no 2 probes with the same fault, there was just no replacement or check done on the AoA sensor after the stick shaker went off or an entire sector.

b1lanc wrote:
This quote from Avherald on KNKT presentation to Parliament:
" On the previous flight from Denpasar to Jakarta the same problem existed, the automatic trim inputs however did not occur. The crew must have done something preventing the MCAS system producing the nose down trim inputs."

To me the FDR data looks like the crew disabled electric trim with the cutout switches.
This is actually quite clear because the trace for manual electric trim and automatic electric trim show nothing while the Trim Position changes.

Actually at the start of that flight the exact same problem occured and you can see the same "fight" between the pilots using electric trim vs the MCAS system.
I'm sure it's just a unlucky choice of words over at the avherald and will most likely soon be corrected.
He probably meant that the automatic trim inputs no longer occured after the crew used the CUTOUT switches or disabled the computer system producing the MCAS trim inputs.

[DingerX]

Yes, on that previous flight, you can see the fight between manual electric and automatic trim inputs. In one 50-second stretch, the aircraft goes from 4400 to 5600 feet, back down to 4400, and up to 5600. Someone want to imagine what that would feel like?
It looks like they used the manual electric trim to fight the MCAS for another 45-50 seconds, and then hit the cut-out. You can see the MCAS makes one last nose-down command that doesn't translate into trim movement. 150 seconds later, as they're considerably higher, they try again, disabling the cutout and immediately ordering nose-up trim. MCAS gave them a whole bunch of nose-down, so they cutout again and manually cranked the desired trim.

[A Squared]

Actually as far as i know the AoA probe replacement was carried out not before the accident flight but prior to the previous flight.

Yes, that is my understanding as well, and it's not a trivial point. The page of the aircraft maintenance log for the flight prior to the accident flight has been published online. There is no mention of an AoA sensor being replaced.

[A Squared]

I do have to admit to thinking more than once that the airbus composite fins would be an excellent place for a secondary CSMU - they do seem to have a detaching, surviving and floating capability already built in.

Which sometimes activates in anticipation of the accident.

[DaveReidUK]

Yes, that is my understanding as well, and it's not a trivial point. The page of the aircraft maintenance log for the flight prior to the accident flight has been published online. There is no mention of an AoA sensor being replaced.

IIRC, the NTSC stated that there had been four previous (not necessarily consecutive) flights during which similar problems had been encountered, and that at some stage during that sequence the AoA sensor had been replaced.

[PJ2]

DingerX, this image illustrates what you're stating - STS/MCAS trims ND, manual input NU, etc.:

https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/438x449/2018_11_23_083924_mantrim_20vs_20mcas_202_m_16abaa41d126b558 58cf4c1d7b97a44fbd23199b.jpg

[DingerX]

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/145x206/previousflight_51e29eb75d5b9907e63b4f0c646f9d874cabf5b5.jpg
Or, for the previous flight, the red lines mark where the cutout comes in. In both cases, the last automatic call for ND trim occurs without corresponding trim movement. The second time, they try to give it a bit of NU trim, only to be countermanded. Cutout again, and the trim moves NU without electrics.

[CYTN]

Root cause . AOA sensor issue . So what is that ? . Wiring issue ; probe issue ; probe mounting issue ; sensor issue , analyser issue / damage ; rogue components ; position of analyser mounting . Alignment fixing issue , mount damage ; and the list goes on
What constitutes a replacement ? . A complete assembly or part of ? .
Whatever - the problem was not solved ; put a trouble shooter on board - to do what ? . Maintenance from previous flight targeted problem , trouble shoot by " the book " still a concern . Then we have the flight managment control issues , just as an addition . .. ohh hell .

[b1lanc]

IIRC, the NTSC stated that there had been four previous (not necessarily consecutive) flights during which similar problems had been encountered, and that at some stage during that sequence the AoA sensor had been replaced.

4 flights with UAS (and I guess I inferred consecutive) is what I remember - don't recall any mention of AoA disagree for the first two or at least it wasn't mentioned. Notably the FDR readouts weren't supplied (logs weren't leaked either) subsequent to those earlier flights. AoA sensor was replaced between segments 2 and 3.

From Aviationtoday.com:
" On Nov. 5, CNN published an update (https://www.cnn.com/2018/11/05/asia/lion-air-crash-plane-intact-intl/index.html) on the crash investigation from Capt. Nurcahyo Utomo of Indonesia's National Transportation Safety Committee (KNKT) noting that the FDR review also concluded that the aircraft airspeed indicator was malfunctioning on four consecutive flights prior to the crash. Utomo also indicated the pilots should have recognized the malfunction when it occurred on flight JT610."

[DType]

Don't know anything about the relevant actuator, but unless the actuator has a brake or an effective (electrical) detent, very interesting things can happen with vibration.
Which therefore suggests that the relevant actuator must have an effective brake/detent, given that any screw can be revers driven in appropriate circumstances.

[Rananim]

The most extensive over-ride capability is provided by the Embraer EMB-145, where a single push button on the yoke disables or disengages the stick pusher, the auto-pilot, and the elevator trim system. The Canadair CRJ has a toggle switch next to the captains knee that can be used to deselect the stick pusher. Since the pilot has the ultimate responsibility for the safe conduct of the flight, the ability to over-ride a malfunctioning system is of utmost importance
ALPA

The answer is to give the pilot(s) a quick means of disabling all alarms so that they can restore calm
in the cockpit and fly the plane.If an anti-stall device is actually going to independently operate flight controls (primary or auxiliary),as in the case of this MCAS,then they have to go back to the drawing board and look again at how to prevent false ADIRU data triggering these devices(no easy task obviously).It is one thing to get a false stick shaker.It is entirely another thing to get the FCC commanding operation of flight controls based on false data.
Over and out.

[DaveReidUK]

Vibration can enable a normally irreversible screw to reverse.

Absent command, the jackscrew cannot rotate....

Maybe it can, maybe it can't (my money would be on not).

But either way - what is the relevance?

Given the overwhelming evidence implicating the STS/MCAS, why are we throwing Occam's Razor out of the window and postulating an unrelated, independent mechnical failure of the actuation mechanism as a causal factor?

The MAX has the same horizontal stabilizer as the NG, and I'd bet that the actuator/gearbox/jackscrew isn't significantly different either. How many NG loss of pitch trim control incidents have there been in the last 20 years that have been attributable to actuation failure?

[Concours77]

Excellent point. See you in Tech Log?

[DaveReidUK]

4 flights with UAS (and I guess I inferred consecutive) is what I remember - don't recall any mention of AoA disagree for the first two or at least it wasn't mentioned. Notably the FDR readouts weren't supplied (logs weren't leaked either) subsequent to those earlier flights. AoA sensor was replaced between segments 2 and 3.

Your inference is indeed correct. This report (http://en.tempo.co/read/news/2018/11/06/056923176/KNKT-Lion-Air-Airspeed-Indicator-Damaged-since-3-Flights-Before) of the Nov 5th press briefing quotes the three preceding UAS events as occurring on:

Denpasar-Manado
Manado-Denpasar
Denpasar-Jakarta

which were of course consecutive.

Elsewhere it was confirmed that the AoA sensor was changed at Denpasar on October 28th.

[CONSO]

RE JACKSCREW- EG BALLSCREW - being backdriven -- PLEASE SEE MY POST 1522 this threadQuote:Originally Posted by DaveReidUK https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-post10317448.html#post10317448)Correct me if I'm wrong, but the coarser the thread pitch (all other things being equal), the more likely a jackscrew is to be back driveable (the spiral ratchet screwdriver principle). Is that what you're saying?

I can't see air loads on the stab being capable of overcoming the combined braking friction in the jackscrew, gearbox and actuator unless we're talking about a previously undisclosed failure in addition to the issues already discussed.


Its MORE than just the pitch ( lead) please take the time to read this simplified explanation

https://www.linearmotiontips.com/how...ll-back-drive/ (https://www.linearmotiontips.com/how-to-determine-if-a-screw-will-back-drive/)

and for an approximation of loads

https://www.aerospaceonline.com/doc/...actuators-0001 (https://www.aerospaceonline.com/doc/horizontal-stabilizer-trim-actuators-0001)

+++++++


Maybe it can, maybe it can't (my money would be on not).

But either way - what is the relevance?

Given the overwhelming evidence implicating the STS/MCAS, why are we throwing Occam's Razor out of the window and postulating an unrelated, independent mechnical failure of the actuation mechanism as a causal factor?

The MAX has the same horizontal stabilizer as the NG, and I'd bet that the actuator/gearbox/jackscrew isn't significantly different either. How many NG loss of pitch trim control incidents have there been in the last 20 years that have been attributable to actuation failure?

[CONSO]

Absent command, the jackscrew cannot rotate....

imo

See my 1522 this thread !

[Concours77]

Your inference is indeed correct. This report (http://en.tempo.co/read/news/2018/11/06/056923176/KNKT-Lion-Air-Airspeed-Indicator-Damaged-since-3-Flights-Before) of the Nov 5th press briefing quotes the three preceding UAS events as occurring on:

Denpasar-Manado
Manado-Denpasar
Denpasar-Jakarta

which were of course consecutive.

Elsewhere it was confirmed that the AoA sensor was changed at Denpasar on October 28th.

“changed”. r/r? R/d/r? R/r/R? Removed, reinstalled. Removed, discarded, replaced. Removed, repaired, Replaced.

On replacement with new, repaired, or same, what is required to re connect to ADIRUs?

I would assume if vane only, a new “o” ring? If inclusive of sensor, sender, is there a specific check item that tests the circuits?

Start with the simple stuff. We are at some very obscure suppositions regarding programming.

Look first to widget(s).

Or should this be in Tech?

[Concours77]

See my 1522 this thread !

Read, understood. “Limit load of actuator in the 737 = 25,000 pounds.”

At Fail? i.e. 1.5 limit?

[CONSO]

Read, understood. “Limit load of actuator in the 737 = 25,000 pounds.”

At Fail? i.e. 1.5 limit?






from this SLF - Probably 1.5 re limit load. But there may be other factors re size ( area) of MAX stabilizer compared to NG and the effects of a longer lever arm re pitch change per degree stabilizer movement. That kind of discussion is well beyond my old wheelhouse/pay grade. MY cliffs note version is that with a longer lever arm AND same size ( area) stabilizer , less stabilizer angle change ( and load ) is needed to give the same nose up/down pitch change.

[StuntPilot]

From the evidence it is clear that this accident was not caused by mechanical leadscrew problems. As soon as the AoA reaches about 20 degrees the PITCHTRIM moves down at a very constant speed, exactly following the described MCAS operation. This is consistently dealth with by the PF through regular TRIMUPMANUAL inputs after which the down trimming halts for a few seconds (the way MCAS has been stated to do). At the end these TRIMUPMANUAL inputs are of shorter duration resulting in a runaway down trim.

The PF was continuously up-trimming as required until those last trim inputs. Those were too short, perhaps because of other distractions. Although the crew was aware of the continuous need to apply up-trim they apparently did not use the auto trim cutout switches.

[infrequentflyer789]

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/145x206/previousflight_51e29eb75d5b9907e63b4f0c646f9d874cabf5b5.jpg
Or, for the previous flight, the red lines mark where the cutout comes in. In both cases, the last automatic call for ND trim occurs without corresponding trim movement. The second time, they try to give it a bit of NU trim, only to be countermanded. Cutout again, and the trim moves NU without electrics.

This is what I think too, note also that the repeated ND automatic trim starts coincident with flaps 0 (as it does on the accident flight, so MCAS) - before that the automatic is sometimes up sometimes down.

Also in the descent there is plenty of trim movement with no auto or manual (electric) signals - my guess is cutouts and manual trim using trim wheel, until after landing.

The weird thing is that the auto trim signal is pretty darn quiet through cruise and descent, suggesting that the data is acquired downstream from the cutouts, but there are two brief sets of down-trim spikes during descent. Seems odd to move the cutouts then, maybe bad data?

[notapilot15]

Given the overwhelming evidence implicating the STS/MCAS, why are we throwing Occam's Razor out of the window and postulating an unrelated, independent mechnical failure of the actuation mechanism as a causal factor?...

Distraction comes to mind.

This may be a wake up call as aviation (and the world) racing towards more automation and artificial intelligence/machine learning. Machine-1, Man-0.

[StuntPilot]

Distraction comes to mind.

This may be a wake up call as aviation (and the world) racing towards more automation and artificial intelligence/machine learning. Machine-1, Man-0.

Indeed but it is nothing new: this case reminds me very much of the Turkish crash here at EHAM (deep stall at short final, a 738 was flaring / retarding throttles mid-air after a single radio altimeter failure resulting in a zero altitude reading, this also happened on previous flights of that aircraft but was dealt with promptly, the cause of the RF problem was poorly understood).

[threemiles]

On the previous flight the stickshaker was on from flap 0 until landing. For the whole flight!! Also the IAS difference was there for the entire flight. I cannot imagine how mtc would think a simple AOA sensor change would do and release the aircraft for a revenue flight. This is try and error on a life critical fault.

[Cows getting bigger]

Not wanting to start an A vs. B argument, but the European side of the aircraft manufacturer house went, and to some extent still goes, through automation growing pains. Of course, different philosophies mean that A is using Hal as the master whilst B is more aligned to developing Robocop.

Sorry, tired ramblings but my point is that 21st century accidents are now so often down to the "What's it doing now?" scenario.

[DaveReidUK]

I would assume if vane only, a new “o” ring? If inclusive of sensor, sender, is there a specific check item that tests the circuits?

You change the whole unit (pictured here) - the ramp is not the place to start taking it apart.

https://www.youtube.com/watch?v=waYos1ftm98&t=40

Eight screws, gasket, two electrical connectors, probably less than an hour including functional checks.

I'd be fascinated to know how the unit that was removed subsequently tested on the bench. Since I'm in a betting mood, my money would be on NFF.

[b1lanc]

Somewhat under the radar and probably not related but on Nov 14th Sunwing 738M near Dulles left ADIRU failure (6 month old aircraft). Per Avherad "when the captain's instruments began to show erroneous indications. The first officer was handed control of the aircraft as his instruments and the standby instruments remained in agreement." Wonder what instruments?

[gmx]

On the previous flight the stickshaker was on from flap 0 until landing. For the whole flight!! Also the IAS difference was there for the entire flight. I cannot imagine how mtc would think a simple AOA sensor change would do and release the aircraft for a revenue flight. This is try and error on a life critical fault.
The previous crew counteracted MCAS for a while before activating the CUTOUT, in accordance with the runaway stabiliser procedure. The accident crew were also counteracting MCAS for six minutes but do not activate the CUTOUT. It seems that the bad AOA data was probably contributing to a fair amount of confusion, but knowing the previous crew had stabiliser trim issues, and then having those same issues themselves, why didn't they activate the CUTOUT ?
The airline would seem to have significant culpability but is it pretty clear case of pilot error ?

[Rated De]

Distraction comes to mind.

This may be a wake up call as aviation (and the world) racing towards more automation and artificial intelligence/machine learning. Machine-1, Man-0.

Paraphrasing Dr Earl Wiener PhD "Automation reduces workload when the workload is already low. Paradoxically, it increases workload in a cockpit when the workload is already high"

[JRBarrett]

You change the whole unit (pictured here) - the ramp is not the place to start taking it apart.

https://www.youtube.com/watch?v=waYos1ftm98&t=40

Eight screws, gasket, two electrical connectors, probably less than an hour including functional checks.

I'd be fascinated to know how the unit that was removed subsequently tested on the bench. Since I'm in a betting mood, my money would be on NFF.

As would mine...

Which raises the question: “What post-replacement functional checks are called for (in the AMM), and what functional tests were actually performed after the replacement probe was installed?”

If the AMM calls for fitting a calibrated AOA protractor to the probe and fuselage to verify correlation between probe position and transmitted AOA data, and that was not done - either because of lack of time, lack of test equipment, or lack of training, it’s a serious problem.

I would hope that Lion Air maintenance didn’t just slap on a new probe, ignoring any required correlation tests on the assumption that the original probe itself was bad.

[b1lanc]

As would mine...

Which raises the question: “What post-replacement functional checks are called for (in the AMM), and what functional tests were actually performed after the replacement probe was installed?”

If the AMM calls for fitting a calibrated AOA protractor to the probe and fuselage to verify correlation between probe position and transmitted AOA data, and that was not done - either because of lack of time, lack of test equipment, or lack of training, it’s a serious problem.

I would hope that Lion Air maintenance didn’t just slap on a new probe, ignoring any required correlation tests on the assumption that the original probe itself was bad.





I believe others are asking the same.

'Ony Soerjo Wibowo, an air safety investigator for the Indonesian government, said that on the plane’s third-to-last flight, from the eastern Indonesian city of Manado to Bali, the plane, which was delivered to Lion Air in August, had recorded no airspeed data.' (cited in NY Times)

and Mr. Ony said that part of his investigation centered on why the plane had not been grounded by Lion Air, given that it had experienced multiple airspeed problems.“This is strange,” he said in an interview on Wednesday. “We found several events that we should investigate, but they didn’t report them.”

It's not clear who 'they' is that didn't report them. But, in looking at the leaked maintenance log, sure looks like some issues were not documented by prior crews. Don't know what condition the AoA sensor that replaced the alleged offending sensor was in either - probably whatever they had in store since it's the same PN as the NG uses (see #1418).

[roundsounds]

I’ll be interested to see the factual reports on:

maintenance history regarding previous similar / related faults
What fault indications were presented to the operating crew on this flight per the FDR
what actions were completed by the crew in response to the indications
what training, both initial and recurrent, was given by the operator on UAS and runaway stabiliser

It would seem what happens behind the scenes systems wise the 737 requires the same responses from crew for both UAS and runaway stab in NG and Max variants? Whether the stab issue be an actual runaway or a response to a UAS and stall protection, the crew response would be the same for an NG or Max. How would knowledge of a system affect the crew response, the message in the FAA and Boeing docs both reinforce the existing Boeing memory item actions.

[Realbabilu]

On the previous flight the stickshaker was on from flap 0 until landing. For the whole flight!! Also the IAS difference was there for the entire flight. I cannot imagine how mtc would think a simple AOA sensor change would do and release the aircraft for a revenue flight. This is try and error on a life critical fault.

The previous DPS-CGk lion air co pilot Or pilot had got out from the cockpit to get His luggage, said the pax. One of the stewardess brought the heavy books also, seems FCOM

grid.id/amp/04966850/deretan-kejanggalan-yang-dirasakan-penumpang-jt-610-rute-denpasar-jakarta-sebelum-pesawat-lion-air-jatuh-pada-senin-pagi?page=all

[threemiles]

I’ll be interested to see the factual reports on:

maintenance history regarding previous similar / related faults
What fault indications were presented to the operating crew on this flight per the FDR
what actions were completed by the crew in response to the indications
what training, both initial and recurrent, was given by the operator on UAS and runaway stabiliser

It would seem what happens behind the scenes systems wise the 737 requires the same responses from crew for both UAS and runaway stab in NG and Max variants? Whether the stab issue be an actual runaway or a response to a UAS and stall protection, the crew response would be the same for an NG or Max. How would knowledge of a system affect the crew response, the message in the FAA and Boeing docs both reinforce the existing Boeing memory item actions.
I'll be interested to see the factual reports on
- the training records of the flight crew, especially in regard to using the trim cut out procedure
- the records about the maintenance organization and its actions and culture and how it was possible to release the plane fit to fly with IAS disagree, stick shaker on, trim runaway, after a simple vane exchange, or even worse, without any action before the last flight, as the aircraft lost its redundancy
- the log book entries by the crew flying the aircraft on the last 3 sectors, which obviously were not sufficient to address the problem to mtc and the subsequent crew, so this was mentally prepared what could happen
- the certification documents that allow a no majority capable dual sensor system to manipulate essential flight controls and leaves it to the flight crew to identify what might be wrong
​​​It seems much comes down to training, organization, leadership, documentation, culture in the airline, the FAA and Boeing.

[FCeng84]

A couple of AOA and MCAS details to consider:

1. AOA vanes measure the angle of the airflow at the location of the sensor. The fuselage distorts the flow such that the vane angle does not match the free air AOA seen by the airplane. There is a conversion from degrees of vane to degrees of body AOA. Typically one degree of vane motion corresponds to about half a degree of body AOA change. I'm not sure if the AOA data we have seen here in PPRUNE is in vane degrees or body degrees.

2. When reviewing flight data and trying to determine the status of MCAS and the cutout switches it is important to realize the following:
- MCAS has an authority limit of at most 2.5 degrees of stabilizer (less as speed/Mach increase).
- MCAS will not move the stabilizer an increment more than its authority unless it has been reset by either pilot manual stabilizer trim command or engagement followed by disengagement of the autopilot.
- MCAS would not be reset as a result of mechanical manual stabilizer trim (i.e., pilot physically turning the trim wheel by hand)

Some of the time periods where seeing no automatic nose down trim might lead one to think that the cutout switches have been activated, it could actually be the case that MCAS has already put in its allowed stabilizer motion increment and has not be reset via manual trim and therefore will not move the stabilizer any more regardless of how long the time period is.

Another possibility is that during some of the time periods where there are no automatic trim increments the crew may have been able to engage the autopilot in which case MCAS would be disabled. There would, however, likely be some automatic stabilizer trim with autopilot engaged as fuel burn would require.

With the cutout switches activated, the only means of trimming is via the mechanical trim wheel. It is likely that pilot activated trim via the wheel would not be at the same rate as electric motor trim (and might not be at a continuous, constant rate). Knowing that it might be possible to figure out which stabilizer motions were likely not via electric motor and thus must have been via pilot use of the mechanical trim wheel.

[Avionista]

Having followed this thread from the start, there are a couple of questions which have arisen in my mind.

1. Earlier in this thread it was stated that Boeing introduced the MCAS system because, without it, the B737 MAX would not meet the requirements for passenger aircraft certification in respect of longitudinal stability. If this is true, should a fully functional MCAS be a specified item in the MEL as a mandatory requirement for release of the aircraft to revenue flights? Surely, if it was mentioned in the MEL both flight crew and engineering staff at Lion Air would have asked "What's this MCAS all about?". Is it normal for a system deemed necessary for certification of an aircraft not to be referenced in the MEL?

2. The maintenance record for the previous flight states that the crew thought that the STS was working 'in reverse', which we now know was due to MCAS (a system whose existence they were unaware of at that time). The crew of the flight that crashed would have read the maintenance report before departure and also were unaware of the existence of MCAS. Is it likely they would have been predisposed/alerted to the idea that the STS might 'go rogue' and operate in reverse? After repeated manual NU trim inputs, which were negated by MCAS ND trim, do the shorter manual NU trim inputs just before the aircraft dived towards the sea suggest that the crew were beginning to think their manual NU trim inputs were the cause of their problems?

[MickG0105]

Another possibility is that during some of the time periods where there are no automatic trim increments the crew may have been able to engage the autopilot in which case MCAS would be disabled.


Could they have engaged the AP with the CAPT's stick shaker active?

[DingerX]

FCEng84: the MCAS descriptions I've seen state that 2.5 degrees is the maximum incremental change that will be commanded, with a 0.27 deg/sec movement. After each such increment, if the high-AoA condition persists, another incremental change is commanded. I didn't see any statement that manual trim "resets" the mcas. On the FDR plots, we see three trim elements: manual electric command, elevator trim position, and automatic command, which includes STS, MCAS and A/P. At some point on the previous flight, we see both command channels cease correlating to trim movement. That decoupling, rather than any lack of movement, was what I was pointing to.

[Gary Brown]

Apologies if this has been mentioned before (I can't find a direct post...). On an 737NG Ground School Slide Show (https://www.slideshare.net/theoryce/b737-ng-flight-controls) I see the following:

45. (https://image.slidesharecdn.com/flightcontrols-131003221914-phpapp01/95/b737-ng-flight-controls-45-638.jpg?cb=1443782442) Control column actuated stabilizer trim cut out switches stop operation of the main electric and autopilot trim when the control column movement opposes trim direction. i.e. If the pilot is pulling nose up nose down trim is inhibited. When the STAB TRIM override switch is positioned to OVERRIDE, electric trim can be used regardless of control column position. The control column activated cut out switches are bypassed. [my emphasis]

Anyone know whether the Max is more-or-less the same? I.e., you can have tripped the cut-out switches, but their cut-out effect can be overridden?

[BuzzBox]

1. Earlier in this thread it was stated that Boeing introduced the MCAS system because, without it, the B737 MAX would not meet the requirements for passenger aircraft certification in respect of longitudinal stability. If this is true, should a fully functional MCAS be a specified item in the MEL as a mandatory requirement for release of the aircraft to revenue flights? Surely, if it was mentioned in the MEL both flight crew and engineering staff at Lion Air would have asked "What's this MCAS all about?". Is it normal for a system deemed necessary for certification of an aircraft not to be referenced in the MEL?

The MEL only lists items that may be inoperative before dispatch, provided certain limitations and procedures are observed. It does not list items that must be serviceable. The MEL or DDG typically includes a statement that says (in bold capital letters, as below):

"ALL ITEMS WHICH ARE RELATED TO THE AIRWORTHINESS OF THE AIRCRAFT AND ARE NOT INCLUDED ON THE LIST ARE AUTOMATICALLY REQUIRED TO BE OPERATIVE".

[StuntPilot]

Apologies if this has been mentioned before (I can't find a direct post...). On an 737NG Ground School Slide Show (https://www.slideshare.net/theoryce/b737-ng-flight-controls) I see the following:

When the STAB TRIM override switch is positioned to OVERRIDE, electric trim can be used regardless of control column position. The control column activated cut out switches are bypassed. [my emphasis]

Anyone know whether the Max is more-or-less the same? I.e., you can have tripped the cut-out switches, but their cut-out effect can be overridden?

Indeed it is not quite desirable to have the aircraft trim against the pilot input. But isn't the override an emergency function to be able to fly the aircraft using the trim buttons when having a jammed elevator? In that situation the last thing you'd want is MCAS taking over the 'elevator'. So hopefully MCAS ignores STAB TRIM OVERRIDE.

[silverstrata]

Some random observations.

On the previous flight they disconnected the stab trim system, which stopped the MCAS inputs. So it is possible to use the trim cutout switches on this system. They then reinstated the trim system, to test it, got more MCAS trim inputs, and cut it out again. Sensible idea. But still had to operate the whole flight with the stick shaker going.

The next crew were more unsure about the problem - as if they had not been briefed. They appear to have focused on the stick shaker, by putting the flaps back down. Obviously wondering if the stick shaker was correct, and they were close to the stall. And the stick shaker did stop for a while, which may add to the confusion. “Are the stall warnings correct?”, they are wondering...

Then they get all these MCAS trim forward commands, which would be a bit of a mystery. And they reverse these MCAS inputs every time, until the end. Questions: Why not use the cuttout switches? Did this not seem like a real trim runnaway, because the trim started and stopped? And why at the end stop countering the MCAS trim inputs? Only they will know.

People here saying full forward trim can be countered with elevator? Sure about that? Even if this flight had a far-forward CofG? Only time I have experienced runnaway trim in the sim, the controls were getting uncontrollable as the cuttouts were operated - and we were nowhere near max forward. (Like this incident, we were doing 250 kt.)

So we come back to the Boeing design philosophy. Was there one? Or was the MCAS stitched together without any oversight. For instance:

Do Boeing really design things, so that a single sensor failure can lead to multiple problems? Was there really no way to have an AofA oversight system, that could detect a malfunctioning AofA indicator? Could they not have a comparitor system, that detected a sensor conflict and disabled MCAS? Single sensor input and actioning was ok, when it merely operated a stick-shaker - pilots can deal with that. But now the single malfunctioning sensor is operating the flight controls....! Did anyone think of the consequenses?

Do Boeing really design a stall-trim system that can operate to full-forward trim? Really? When do we EVER give full forward trim? Should not the system have operated until a certain (safe) forward limit was reached, and stopped there? Why allow MCAS so much authority over the controls?

Did Boeing ever try the system at 320 kts, instead of at the stall? MCAS may seem like a good idea, when approaching the stall, but just what might happen at 320 kts? Did they ever test that scenario? And this is not a case of 20/20 hindsight. This is what design testing is all about - testing out all the scenarios and all the possible (and seemingly impoossible) failure modes. Was this system rushed through, so the Max could compete with the A320..?

And why did Boeing think that a stall-trim system was a good idea at all? Traditionally, stall-pushers operate on the elevators, and for good reason. A traditional stick-pusher will push, but when it relents you are still in trim, and stick forces return to normal immediately. Conversely, a stall-trimmer will push you forwards, and then leave you way out of trim in the dive - making the recovery difficult. And remember, MCAS can trim you full forwards. Have you ever tried recovering from a stall, with the trim on the forward stop...??? Me neither...!!

So where is the Boeing QRH advice, for stall recovery with the trim fully forwards? How many pilots performed that exercise in the sim, on conversion to the Max? Answer - nil. And what would happen? Anyone tried it...? I’ll give it a go next time.

And finally, how much knowledge did the next pilot have, after the incident the previous day?? Aviation authorities have reduced preflights from 60 min to 45 min, without any thought to safety. And then the same aviation authoriites placed security in the way, so instead of the crewbus taking you to the aircraft in 3 minutes, it now takes 20 minutes. So preflight time at the aircraft can be reduced from 30 minutes to 10 minutes (plus 10 minutes starting).

So what briefing did the next pilot get? There would have been no Deferred Defect (HIL), as the problem the previous day was cleared - even though we all know that a cleared defect is not a cleared defect. Swapping a box has never cleared a technical problem. ‘Tested Found Serviceable’ has never cleared a technical problem. So the Tech Log is a book of half-truths and lies. Whatever happened to the days gone by, where such problems were left open, and marked ‘please report further’?

So a cursory glance at the tech log will show no problems. Did they take off, with no idea of the problems on the prievious flight? This is the problem with the new Politically Correct tech logs - they look wonderful and clean, but may conceal a host of problems. Intermittent defects are cleared, as if they have been rectified, but eveyone knows that the problem is still lurking. But you are not allowed to alert the next crew by having an open Deferred Defect - oh, no, that would be far too logical and safe - and would attract the attention of the greedy lawyers, who are just waiting to pounce on a single incorrect pen-stroke.....

Silver.

Edited Post Script. Regarding stalls, the QRH says, quote:

“Excessive ​use of pitch trim may aggravate​ the condition, or​ may​ ​result in loss of control or​ in high structural loads.​“

So why would MCAS want to put in full forward trim, if the QRH says this can lead to a loss of control....?

.

[MickG0105]

Anyone know whether the Max is more-or-less the same? I.e., you can have tripped the cut-out switches, but their cut-out effect can be overridden?

The Stabilizer Trim Override Switch and the Stab Trim PRI Cutout and Stab Trim B/U Cutout Switches accomplish two different things. The Override Switch relates to the control column actuated stabilizer trim cutout switches; these aren't manually selected, they are activated by movement of the control column such that when that movement opposes the automatic trim direction it stops the operation of the trim. It's called breakaway. When the STAB TRIM override switch is positioned to OVERRIDE, the control column actuated stabilizer trim cutout switches are disabled and electric trim can be used regardless of control column position. Just by the bye, we now know that breakaway won't interrupt MCAS (which makes sense when you know about the purpose of MCAS but which would be initially confusing if you weren't aware of MCAS).

The Stab Trim PRI Cutout and Stab Trim B/U Cutout Switches are provided to allow the autopilot and main electric trim inputs to be disconnected from the stabilizer trim motor. They essentially revert the stabiliser trim to only manual inputs via the trim wheels.

[StuntPilot]

Just by the bye, we now know that breakaway won't interrupt MCAS (which makes sense when you know about the purpose of MCAS but which would be initially confusing if you weren't aware of MCAS).


Clearly, MCAS ignores the force switches (otherwise this accident would not have happened) but in the 'override' case (jammed elevator) I think MCAS should be disabled?

[semmern]

Apologies if this has been mentioned before (I can't find a direct post...). On an 737NG Ground School Slide Show (https://www.slideshare.net/theoryce/b737-ng-flight-controls) I see the following:

45. (https://image.slidesharecdn.com/flightcontrols-131003221914-phpapp01/95/b737-ng-flight-controls-45-638.jpg?cb=1443782442) Control column actuated stabilizer trim cut out switches stop operation of the main electric and autopilot trim when the control column movement opposes trim direction. i.e. If the pilot is pulling nose up nose down trim is inhibited. When the STAB TRIM override switch is positioned to OVERRIDE, electric trim can be used regardless of control column position. The control column activated cut out switches are bypassed. [my emphasis]

Anyone know whether the Max is more-or-less the same? I.e., you can have tripped the cut-out switches, but their cut-out effect can be overridden?

Not the same switch. Stab trim CUTOUT shuts electric trim off. Stab trim OVERRIDE lets you trim in the opposite direction of stick movement.

[Rananim]

Was there really no way to have an AofA oversight system, that could detect a malfunctioning AofA indicator? Could they not have a comparitor system, that detected a sensor conflict and disabled MCAS? Single sensor input and actioning was ok, when it merely operated a stick-shaker - pilots can deal with that. But now the single malfunctioning sensor is operating the flight controls....! Did anyone think of the consequenses?

Do Boeing really design a stall-trim system that can operate to full-forward trim? Really? When do we EVER give full forward trim? Should not the system have operated until a certain (safe) forward limit was reached, and stopped there? Why allow MCAS so much authority over the controls?
Silver

Thats about it in a nutshell.That will be in the report 100%.Leaving only a)how/why the crew didnt have enough cognitive function to disengage those trim switches and b)strong focus on Lionairs maincontrol procedures and competency.Answer to (a) can only be startle factor caused by the false alarms(stick shaker).If the Birgenair crew had been able to quickly cut out the two opposing alarms(shaker vs overspeed) they would not have crashed.No doubt in my mind.Answer to (b) we've visited many times before in accident investigation....

[PEI_3721]

Re the EAD, paras g and h; ‘AOA DISAGREE’ alert (if option is fitted), presumably referring to the optional modification to display AoA on EFIS (not applicable to Lion).
When the alert shown, as would be with an abnormal AoA vane input, is the EFIS display of AoA removed, or does a potentially misleading indication remain in view without any third system to resolve the disparity?

[IcePack]

As I posted previously I wonder if something broke or forces were beyond their design limit. (Ability of the tailplane to produce sufficient down force at that speed & setting)
However, would the aircraft have been controllable if the crew had carried out the QRH (including grabbing the trim wheel) to the letter. Methinks that is where the lawsuits will end up should no other cause be found. The final report will be an education I am sure.

[Hi_Tech]

Having read through the posts and some of the observations, these are my (an old grease monkey) answers to the basic questions on Boeing aircraft and its maintenance procedures, that seems to have confused many in this thread.
Screw-jack: From the early aircraft (B707 onward and may be earlier) all screw jacks have a brake, and it is called 'No-back brake'. As the term implies, it prevents the air-load pushing the control surface in the opposite (up) direction. This brake normally has two discs, one stationary and other rotating that are kept in contact by springs and axial force of air load acting through screw-jack. The control surface is moved against this brake force. In flaps this is the commonly used brake. When flaps are lowered, the drive motor has to move it against the air-load on flap. So there is a ratchet mechanism that slips and brake is not applied. In the opposite direction the brake is active and the axial force by the air-load on screw-jack makes the two discs firmly rubbing against each other and the braking force increases. Why this brake? You have consider control (Drive tube) dis-connection. In which case the flap can move by air-load in opposite direction without a brake. What applies to flaps are also there in most stab screw-jacks with some variation.
MCAS: This aircraft model requires this for it's certification by FAA, as it has reduced pitch stability. So there is no way this can be on MEL. If something is not in MEL it automatically implies that it cannot un-serviceable. There are some MEL items that have a statement 'Must be operative'. But some aircraft MELs do not mention the mandatory items this way.
Autopilot: Some one mentioned, if the autopilot was engaged by pilot, this crash may not have happened. See Boeing's FCOM Bulletin after this crash. If there is a AoA or IAS disagreement, auto pilot disengages and cannot be re-engaged. So that is out of question.
AoA or IAS disagree, which one?: It is not like in old gen aircraft (B737 classic)where the pitot probe and static port are directly connected to the airspeed instruments. At high angle of attack of the wing the airflow near the pitot gets distorted and this affects the SPEED sensing. To correct these errors, the pitot sensed speed is modified or corrected as a function of AoA in the ADIRU. Hence if you have a very large error in the AoA sensed, there will be an error in the IAS for the same side. So this can result in both indications showing a disagree. That is only my inference from the way the system is designed to work.
Why this crash: All sort of theories are advanced in this forum. But my take is that it should not crashed at all, as it should not have left the ground in the first place! The airspeed defect has repeated 4 times, and it keeps flying? I have posted this before. Any airline worth it's salt would not let go of these defects without confirming rectification. In the airlines I have worked, after the second report of such a significant defect, the crew will refuse to accept without positive identification of defect. This is a LCC - the pressures are different. As an engineer, I would not have dared to release the aircraft without :
1. Using an air-data tester and taking the aircraft through a full range of altitude and airspeed, just to confirm instruments operate correctly. 2. Call for a test flight if I cannot be sure to have rectified the defect.
From the day one when I was certifying, one thing that was drilled into me by my seniors, was there are ordinary defects and tricky ones. Never treat two defects in the same way. Any defect in the basic T instruments and flight controls, come in this critical list. This airline has a poor maintenance management (sorry to say that). I cannot see how an aircraft that had a stick-shaker in operation through out its flight (I am assuming from what is posted here), can be released for the next flight without confirming the defect is rectified by just changing a AoA sensor.
ONCE AGAIN WE ARE SPECULATING IN THIS THREAD -THOUGH MOST OF THE POSTS ARE FROM VERY EXPERIENCED AVIATORS.

[DaveReidUK]

When the alert shown, as would be with an abnormal AoA vane input, is the EFIS display of AoA removed, or does a potentially misleading indication remain in view without any third system to resolve the disparity?

The consensus appears to be Lion Air did not have the (optional) AoA display on the PFD.

I cannot see how an aircraft that had a stick-shaker in operation through out its flight (I am assuming from what is posted here), can be released for the next flight without confirming the defect is rectified by just changing a AoA sensor.

The sequence of events was the other way round - the FDR trace that was released for the flight (Denpasar-Jakarta) during which the stick-shaker operated continuously took place after the AoA sensor had been replaced at DPS.

[gums]

Salute!

I wish to "revise and extend" my comment re: machanical failure of some type.

1) I did not count the pilot application of trim, so the real count of trim commands to the jackscrew motor is twice my estimate of 25 within 6 minutes,or less.

Did Boeing, in their wildest dreams ever test the mechanism by reversing it from full MCAS authority to manual reposiiton and then back to full MCAS authority limits 25 times in 6 minutes? Looks like the 5 second delay is clearly there after each up trim command from the pilot, then whammo! Nose down and repeat the drill. You know, "STS opposes me and I usually apply opposite trim cmd, but I do not realize this new system is fighting me and my stick shaker is telling me I am stalling but I am not."

2) From what I understand, the mechanical connection to the stab is some sort of drum requiring "x" rotations by the wheel to move the stab.
Is the "drum" connected to the jackscrew?

3) It appears that there is overlap of the STS envelope with MCAS. i.e. 10 seconds after takeoff, speed above 100 knots, 5 seconds to pause after pilot trim command, A/P off.
We see no UP trim cmds after flaps are up, but several before then. So I assume those were STS trying to provide the artifical speed stability mentioned elsewhere.
With increasing speed, STS should be commanding up trim, right? And MCAS is active with flaps up, so it sees high AoA and puts in down trim. But no up trim in the first upset at T=flaps up. Just down trim, so looks like the MCAS rules due to the high AoA, as STS should be commanding up trim as speed increases in the dive!!! I see no AoA criteria for the STS, so MCAS must rule and when/where is not in the FCOM, best I can tell.

4) If the crew is holding or moving the manual trim wheel and the "system" keeps applying trim, as the traces show, then can the trim motor overheat and jam fighting the manual command?

I'm scared, and do not unnerstan why giving "hints" to the crew that trim is required cannot be done with the exising "feel" inplementation versus moving the largest, most effective pitch control surface without notice. And then not making the new system well-known and maybe demonstrated to the crews before their first flight with the new doofer. GASP!

Gums exclaims...

[Alwaysairbus]

Is the 737 stab powered by hydraulics (in mechanical and/or electrical control ). I just dont understand the stab cut out switches.. in every other post 70's Boeing they isolate the hydraulics so irrellavent of any input the stab doesn;t move. On the 737 does the stab have manual reversion?

[wiedehopf]

@gums
4) If the crew is holding or moving the manual trim wheel and the "system" keeps applying trim, as the traces show, then can the trim motor overheat and jam fighting the manual command?


The traces for manual trim only show the manual inputs for the ELECTRIC trim via the switches on the yoke.

If you move the trim wheel manually it is only shown via the Trim position. (You can see that on the FDR readout from the previous flight where they apparently used the CUTOUT switches)

So manual trim basically has two very distinct meanings. Maybe the nomenclature is a little awkward. One would probably call the trim inputs on the yoke the electric trim. But as they are manual inputs into the electric trim system that's how the FDR trace is labeled.

As far as i understand moving the trim wheel moves a drum with steel cable on it. That steel cable runs all the way back to the tail and turns the jackscrew.
So when the electric trim is used the trim wheel is backdriven via the steel cable.
The electric trim motor is located at the jackscrew.


I'm scared, and do not unnerstan why giving "hints" to the crew that trim is required cannot be done with the exising "feel" inplementation versus moving the largest, most effective pitch control surface without notice. And then not making the new system well-known and maybe demonstrated to the crews before their first flight with the new doofer. GASP!


If an electric system was fighting for trim commands how long would you have counteracted it with switches on your yoke before using the CUTOUT switches?
My bet would be you would have gotten annoyed after less than 30 seconds and asked the copilot to trim for you with the wheel.


As someone probably also wrote when the stick shaker started going off they extended the flaps to 5 while the speed was around 300 knots.

[gums]

Salute wiede!

Thanks for the explanation, as I was sure someone else had mentioned the wheel-to- cable- to- drum-to-jackscrew implementation versus a pulley-to-stab connection.

Also, I understand that the traces only show the electrical commands, and suspected as such. Thanks for confirming.

Looking at the stab position carefully, there might be manual input just as the two control forces diverge before the dive. Maybe pilot using only left arm and other to turn the wheel. I am trying to be gentle, but I am looking at Boeing and the system design more than anything.

ADDED:
From wiede....
If an electric system was fighting for trim commands how long would you have counteracted it with switches on your yoke before using the CUTOUT switches?
My bet would be you would have gotten annoyed after less than 30 seconds and asked the copilot to trim for you with the wheel.


As another pilot said over on Tech Log, and with years flying the beast and not likeing STS, and not knowing about MCAS on my plane becasue they didn't tell me, I would have trimmed with the switches thinking it was the STS working in reverse. Does that sound like the gripe from the previous flight?

And if i finally applied all the procedures and landed, then found out about MCAS I would have been pissed!

Gums...

[DaveReidUK]

As far as i understand moving the trim wheel moves a drum with steel cable on it. That steel cable runs all the way back to the tail and turns the jackscrew.
So when the electric trim is used the trim wheel is backdriven via the steel cable.
The electric trim motor is located at the jackscrew.

Correct, except that there is also a gearbox in the loop, which takes the mechanical inputs from the cable drum and the electric actuator and produces rotation of the jackscrew:

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/448x485/boeing_737_ng_horizontal_stabilizer_trim_actuator_1a529610f3 0d47f02f150f3adb614fff457f950b.jpg

[gums]

Salute Dave!

Wow. It is obvious Dave has more than the FCOM at his disposal. e.g. How many foot-pounds torque do we need to tighten those bolts?

As some suspected, the manual cable drum does not have its own connection to the jackscrew. So a failed gearbox could be a player. The manual drum could just be spinning and not turning the big screw. Or it could be jammed.

Gums...

[DaveReidUK]

So a failed gearbox could be a player. The manual drum could just be spinning and not turning the big screw. Or it could be jammed.

Or (and my money is still on this one), it was perfectly serviceable and working as intended (in the sense of responding correctly to the inputs from the STS/MCAS).

Occam's Razor (https://en.wikipedia.org/wiki/Occam%27s_razor)

[Organfreak]

Yeah DaveReidUK, and the famous case of the Alaska MD-80 that took The Dive because of a broken jackscrew was older and the screw had been improperly serviced, whereas this plane was almost new.

Sincerely,
Master of the Obvious

[infrequentflyer789]

- MCAS has an authority limit of at most 2.5 degrees of stabilizer (less as speed/Mach increase).
- MCAS will not move the stabilizer an increment more than its authority unless it has been reset by either pilot manual stabilizer trim command or engagement followed by disengagement of the autopilot.
- MCAS would not be reset as a result of mechanical manual stabilizer trim (i.e., pilot physically turning the trim wheel by hand)


The way I (and others, see e.g. https://www.satcom.guru/2018/11/737-mcas-failure-is-option.html ) have interpreted the published/leaked MCAS descriptions is that it will limit movement to 2.5degrees in one increment, the assumption is that multiple increments are possible.

In the description:

The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.


the reset conditions are mentioned in one sentence and then the next sentence covers if "AOA condition persists" - it isn't clear that one is conditional on the other, or how long the condition has to persist for. Consensus seems to be that STS, from which MCAS appears to derive, has a restart timer.

If it is in fact the way that you describe, then all the concerns expressed publicly (from various pilots) that MCAS doesn't honour the column cutouts would be wrong - if you are correct, then if you fight MCAS with stick back you'll face at most 2.5deg adverse trim, whereas if you fight it with trim it'll fight you all the way to the stops :confused:
[ The DFDR trace doesn't help tell us which way it is, because AFAICS every down trim is countered by manual up, just not enough to keep them flying ]

And of course if you are right then Boeing thought it wasn't important to tell the pilots which way was best to counter incorrect MCAS...

[gums]

Salute!

No , infrequent.

Many pilots are not saying MCAS does not honor pilot trim cmds from the wheel. And further....

The data traces clearly show all the pilot trim cmds and they are correlated one for one with Hal stopping and waiting 5 seconds and re-applying nose down trim. The AoA rules the MCAS, not STS system.

Something different happened about 30 seconds before the dive. Power application, diversion of control forces, 4+ degrees of stab position. Would be nice to see gee and best of all, the cvr. Maybe the trim wheel has been recorded, and that could explain a few things, as well.

Gums sends...

[CONSO]

RE GUMS # 1630 and "PULLEY

."Thanks for the explanation, as I was sure someone else had mentioned the wheel-to- cable- to- drum-to-jackscrew implementation versus a pulley-to-stab connection

See my post 1500 21 Nov time 18;14 for that comment plus a youtube video on actual operation o 737 NG ballscrew ( jackscrew)

[infrequentflyer789]

Salute!

No , infrequent.

Many pilots are not saying MCAS does not honor pilot trim cmds from the wheel. And further....


Sorry, I may not have been clear, the comments I was to were about MCAS not honoring the aft column cutout switch - if you pull the yoke back far enough STS will stop trimming forward, MCAS won't. See e.g. last few paragraphs of this link: https://leehamnews.com/2018/11/14/boeings-automatic-trim-for-the-737-max-was-not-disclosed-to-the-pilots/ (I know that's not from a pilot but I'm sure I've seen similar from pilots).

Something different happened about 30 seconds before the dive.

I've seen some speculation that the traces indicate a handover of control, I don't know if that is so, but I agree - something happened.

[gums]

Salute infrequent!

O.K., I get it. No offense, and the big beef from pilots is the system doing something that you have not commanded when not in A/P. Fer chrissakes, "manual" should be as much "manual" as possible so you don't have to remember all the sub-modes and special procedures. See the AF447 endless posts.

The shaker is one example of "warning", but it doesn't move a damned thing. The "pusher" on some planes is same-o, same-o. Both are telling you to pay attention to something. I flew with both types of "alerts", and they helped if I was having a bad hair day. I also flew with two planes that had actual aoa/gee limiters, and you could pull all you wanted, but the FLCS ( flight control system) would not let you command more than it wanted, heh heh.

The STS thread over on Tech Log is very interesting, and discusses STS much more than MCAS. So Vess and Concourse are over there contributing on a new thread that goes more toward total pitch trim system(s).

Gums sends...

[PEI_3721]

Dave #1625, but that reply doesn’t answer my question (#1622) whether an AoA display is removed from EFIS with an AOA DISAGREE alert. Lion does not have the mod.

If the AoA display is not removed, then the crew will face further conflicting indications, stick shake, low speed awareness, and an erroneous EFIS AoA display; the latter being of particularly concern given all of the AoA enthusiasts in this forum - ‘AoA is the answer to stalling’. Except in this instance the indication is inaccurate - nose high, requiring a nose down pitch which could be the most unwanted action for the situation.
Yet another weak design feature (there is no third system to compare), and an aspect which again could limit the effectiveness of the abnormal drill.

[DaveReidUK]

Dave #1625, but that reply doesn’t answer my question (#1622) whether an AoA display is removed from EFIS with an AOA DISAGREE alert. Lion does not have the mod.

Ah, OK. I'd assumed it was a question specifically about the Lion Air aircraft rather than a general one.

If the latter, I don't know the answer - you might be better asking in the Tech Log forum rather than here, where it doesn't apply.

[CONSO]

For those who missed this re stab trim and how much and how long

https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/

[WillowRun 6-3]

threemiles: "seems much comes down to training, organization, leadership, documentation, culture in the airline, the FAA and Boeing."

No objection to observations that the looming lawsuit or multiple lawsuits will be big legal jam-sessions - unfortunately including unsavory as well as diligent attorneys, probably.

But some lawyers involved with aviation aren't principally interested in crash litigation, as important as that practice area may well be. Instead their legal acumen focus is on advancing the national and international legal frameworks within which aviation is conducted....which includes advocating for, and helping "the complex" create and implement, reforms ("complex" here meaning, for example, manufacturers plus regulators plus pilots and their unions plus other safety experts; one leading figure in international civil aviation yesterday referred to the "aviation ecosystem", same thing).

Yet when one sits back, unrelaxed, and contemplates what reforms might be needed and might be effective to rectify the faults in five realms listed by threemiles, in three key components of "the complex".....this is going to require a lot of very focused non-cynical (non-greed-driven) expertise. And the NTSC report (eventually) and any other official reports may well prove to escalate the....complexity here.

[neville_nobody]

A simple solution maybe for regulators to start forcing manufacturers to actually design new aircraft and not keep recylcing old type certificates.

The whole A320/737 situation especially the 737 is bordering on farcical. You wouldn't build a car or boat like that but in aviation somehow its a good idea.

[Capn Bloggs]

Have to keep the grandfathers in business...

[safetypee]

#1644: Except that MCAS does not have any ‘grandparents’. The ideas behind this ‘single-failure prone system’ may have its origins in modern aircraft with their high integrity stability enhancements based redundant architecture. Perhaps this is the shadow of grandfather designing, test and certification, and dated regulatory practice. Time to dust off James Reason’s views on organisational accidents.

Irrespective of what the Indonesian authorities identify in their investigations, the deficiencies in disseminating knowledge and crew checklists must be investigated.
I doubt that Indonesia alone would be able to pursue an investigation involving the FAA and Boeing in the US; according to Annex 13 they should, but …

The NTSB should be sufficiently independent to look at the FAA and delegated regulatory process, minimising any of criticism of an internal coverup.
An investigation would be in everyone’s interest worldwide. Without understanding where the design and certification process failed the confidence in aviation safety remains open to question, particularly for Boeing and all their aircraft types.
A separate investigation might also enhance the need for other regulators to review the integrity of their certification processes, and consider the effectiveness of the oversight of joint international approvals.
“Trust, but verify.”

[vilas]

The reason for development of MAX was purely commercial. Their biggest customer the south west airline wasn't prepared to wait for completely new aircraft and was thinking of buying the AB neo. The 737 with low engines clearance we're not in position to accommodate a larger fan so it appears they juggled with attachment positions which in turn made the aircraft unstable so had to design untried concept of MCAS and installed it through the back door. So far it was fine but now what?
https://www.google.co.in/amp/s/amp.ft.com/content/c9ebe8c4-24d7-11e0-a919-00144feab49a

[Bergerie1]

A very simple question from a very old aviator. As AoA is so important to so many automated systems in modern aircraft, why are there not three AoA vanes with a simple voting system when one gives a wrong indication? Most autoland systems work this way.

[vilas]

why are there not three AoA vanes with a simple voting system when one gives a wrong indication? It's better that way but is not cure all. Airbus has three but in Parpignan crash two rougues voted out the third only good guy.

[Bergerie1]

vilas,

Agreed, but the Perpignan case with two failures is very much less likely than only one failure

[PEI_3721]

Bergerie, #1647; a key question.
I fear the answer involves a cheap and cheerful solution to a shortfall in meeting certification requirements, particularly if late in the program, where alternative arguments for equivalent safety were unacceptable. i.e. everything from the forgotten NASA lesson ‘Faster, Better, Cheaper’, isn’t.
Therein lies the underlying assumptions about the likely outcome of an AoA failure, and particularly that a crew will both understand and manage the situation; unfortunately in parallel, the understanding and management guidance were absent.
Furthermore the discussions in this thread suggest that even with descriptions and checklists the situation which pilots might face could be beyond their capability - understanding and strength.
Thus although we have the EAD drill, significant risk exists which pilots are expected to manage.

Add to the AoA issue, my previous question about the display of AoA, an option which Lion did not have.
If the DISAGREE a message does not remove the AoA display then pilots are presented with misleading, probably hazardous information (judged by the esteem by which AoA is held by Pprune).
Add to this, the question whether the associated alerts IAS, stickshake, and erroneous low speed awareness (AoA dependent) would be apparent as soon as the AoA was in error (disagree). If not why should these be subject to the MCAS inhibit conditions for trim operation (flap up), prior to which the AoA display would be showing conflicting information?

Re 2 out of 3 sensor comparison logic, there is a debatable area between using an automated a triple system, and the alternative of using human judgement of dual comparison and then selection of the third system. If nothing else the human is directed (Comparator) to the erroneous system opposed to the confusion of many consequential system alerts.

[silverstrata]

#1644: Except that MCAS does not have any ‘grandparents’.

Oh, MCAS has many famous granparents.

... It had a 727 with rear engines, that allowed the gear to be short and the wing low.
... Then the 737 antique, with the same short gear low wing design, so the engines were shoved right up next to the wing.
... Then the classic and NG, with ever larger and more powerful engines, giving a greater pitch up moment both in their thrust, their thrust line, and their forward of CofL aerodynamic effects. Now thrust was more powerful than max elevator input, and you could go ballistic if you were not careful. (Which is why the stall recovery advice says reduce power.)
... Then the Max, with even bigger and more powerful engines delivering an even greater pitch up moment.

Houston, we have a problem - we need a system to stop the aircraft going vertical, if too much power is added at the stall. Enter MCAS, stage left, to much applause and adulation. Hurrrah....! Except the new starlet was untried and untested....

As someone here said - Ford is not producing the Mk1 Cortina, with a new engine, dashboard, and a host of bolt-on fixes, because nobody would buy it. So why is anyone buying a 1962 aircraft, with new engines, a new dashboard, and a host of bolt-on fixes??

Silver

[aterpster]

Oh, MCAS has many famous granparents.

... It had a 727 with rear engines, that allowed the gear to be short and the wing low.

What was it called on the 727?

[aeromech3]

What was it called on the 727?
"Flight Engineer" ?

[Capn Bloggs]

What was it called on the 727?
He meant that's where the short undercarriage and low wing came from... grandfathered from the 727.

[Concours77]

MCAS has the same grandparents, different DNA. What was once a primitive failsafe is now called “enhancement”?
The lineage is more direct? Engine placement makes the 727 a distant cousin, not a grandparent?

The march to economy should include added safety, not instability?

[WillowRun 6-3]

#1644: Except that MCAS does not have any ‘grandparents’. The ideas behind this ‘single-failure prone system’ may have its origins in modern aircraft with their high integrity stability enhancements based redundant architecture. Perhaps this is the shadow of grandfather designing, test and certification, and dated regulatory practice. Time to dust off James Reason’s views on organisational accidents.

Irrespective of what the Indonesian authorities identify in their investigations, the deficiencies in disseminating knowledge and crew checklists must be investigated.
I doubt that Indonesia alone would be able to pursue an investigation involving the FAA and Boeing in the US; according to Annex 13 they should, but …

The NTSB should be sufficiently independent to look at the FAA and delegated regulatory process, minimising any of criticism of an internal coverup.
An investigation would be in everyone’s interest worldwide. Without understanding where the design and certification process failed the confidence in aviation safety remains open to question, particularly for Boeing and all their aircraft types.
A separate investigation might also enhance the need for other regulators to review the integrity of their certification processes, and consider the effectiveness of the oversight of joint international approvals.
“Trust, but verify.”



The NTSB recognizes this type of need for independence - though the illustration of this comes from a recent incident which likely is less complicated than this accident (not only because it was *only* a very close call).

The chairman of the Board, in response to a question from someone in the audience at a guest lecture the chairman delivered about a year ago, stated that in its recommendations in the aftermath of the AC 759 San Francisco incident, NTSB was keenly aware of the need to protect, as well as exercise, its independence. No doubt the Annex 13 process for this accident is largely but not totally different kind of situation. (And that's without heaving irony, about Indonesia as the centre of the Annex 13 process.)

(Whether NTSB report after KSFO in fact manifested independence, and then how effective follow-ups have been (and where), is another question - possibly instructive for the tasks ahead now.)

[A0283]

There were some questions about the status of the identification process.

Official status on 23nov2018 was 90 male and 35 female for a total of 125.

Unofficial - based on both official and public data - not possible to completely verify this yet - includes 3 of 5 cabin crew, the 1 mechanic, 1 pilot (Capt). There have been at least 2 people identified from seat-rows 2-34, but zero from row14, from row13 only 1 person. If you look at the present status that I have, the least number of identifications are from rows 2-14 the CDEF seats.

Note1: I dont know the exact Lion Air cabin layout. Thought the seating total was 189, which requires 31.5 rows of seat. Rows 2-34 are mentioned in the passenger manifest/list. If row 13 and 14 are not used, we have 31 rows if 2-34 are used.
Note2: If you would only have this information (not going into detail here) you would estimate that you are dealing with a - very high speed, steep angle, banked right (or left if inverted) - impact. We will probably know by 30nov2018 if that estimate points in the right direction.

[Concours77]

There were some question on the status of the identification process.

Official status on 23nov2018 was 90 male and 35 female for a total of 125.

Unofficial - based on both official and public data - not possible to completely verify this yet - includes 3 of 5 cabin crew, the 1 mechanic, 1 pilot (Capt). There have been at least 2 people identified from seat-rows 2-34, but zero from row14, from row13 only 1 person. If you look at the present status that I have, the least number of identifications are from rows 2-14 the CDEF seats.

Notes: I dont know the exact Lion cabin layout. Thought the seating total was 189, which requires 31.5 rows of seat. Rows 2-34 are mentioned in the passenger manifest/list. If row 13 and 14 are not used, we have 31 rows if 2-34 are used.

So. Aircraft impacted starboard side “first”.

[lomapaseo]

#1644: Except that MCAS does not have any ‘grandparents’. The ideas behind this ‘single-failure prone system’ may have its origins in modern aircraft with their high integrity stability enhancements based redundant architecture. Perhaps this is the shadow of grandfather designing, test and certification, and dated regulatory practice. Time to dust off James Reason’s views on organisational accidents.

Irrespective of what the Indonesian authorities identify in their investigations, the deficiencies in disseminating knowledge and crew checklists must be investigated.
I doubt that Indonesia alone would be able to pursue an investigation involving the FAA and Boeing in the US; according to Annex 13 they should, but …

The NTSB should be sufficiently independent to look at the FAA and delegated regulatory process, minimising any of criticism of an internal coverup.
An investigation would be in everyone’s interest worldwide. Without understanding where the design and certification process failed the confidence in aviation safety remains open to question, particularly for Boeing and all their aircraft types.
A separate investigation might also enhance the need for other regulators to review the integrity of their certification processes, and consider the effectiveness of the oversight of joint international approvals.
“Trust, but verify.”



I would be concerned if the NTSB would enter into any kind of assessment regarding the adequacy of a regulatory process (e.g. reviewing "integity", and "effectiveness" ) as that is entirely delegated to the regulator body. However the burden of an impartial investigations and recommendations may simply point out the failure circumstances against any standards in the regulation as written.

[LowObservable]

Since we're talking about grandparents, here's some context:

https://www.flightglobal.com/pdfarchive/view/1966/1966%20-%200302.html

The MAX is twice as heavy and powerful as the original. (The heaviest A321 seems to be about one-third heavier than the initial standard A320.) The Flight piece describes a very simple airplane, with mostly duplex systems, that could withstand the failure of almost anything powered, short of the loss of two engines, and had no stab-aids other than a stick-shaker and a yaw damper.

Is there a limit to evolutionary development?

PS - Does anyone know if there's anything MCAS-like on the P-8A? It's based on the NG, of course, but its mission involves the sort of maneuver where MCAS would kick in, and there are conditions where the aircraft might have more of an aft cg than the commercial airplanes, given the aft weapon bay and the heavy pressurized sonobuoy launchers in the back of the cabin.

[aterpster]

He meant that's where the short undercarriage and low wing came from... grandfathered from the 727.

I don't quite follow that, seeing as the 727 didn't have wing-mounted engines. Then again, I flew them, didn't design them.

[Concours77]

“...Is there a limit to evolutionary development?...”

I would say no. So long as the evolved pilot keeps pace.....

[notapilot15]

The NTSB should be sufficiently independent to look at the FAA and delegated regulatory process, minimising any of criticism of an internal coverup.
An investigation would be in everyone’s interest worldwide. Without understanding where the design and certification process failed the confidence in aviation safety remains open to question, particularly for Boeing and all their aircraft types.
A separate investigation might also enhance the need for other regulators to review the integrity of their certification processes, and consider the effectiveness of the oversight of joint international approvals.
“Trust, but verify.”



NTSB published a scathing report on 787 battery certification process. FAA brushed aside. Same can happen here.

I am guessing the augmentation word is be the key. This is just for a smooth flight, not a critical component, 2.5 degrees stabilizer trim is not going to kill anyone. No big deal, Stamped and signed. Yours Truly.

[Concours77]

The 787 battery failed written rules posted in the Federal register. Related to “fire onboard”. Not allowed.

The fix was to “contain” fire. It still violated the rule, but the continued violation was ignored.

Only one fact Boeing will answer to, post “fire” becoming acceptable on board.....

”...We decided not to disclose the presence of MCAS. We did not wish to overwhelm the average pilot....”

Average has nothing to do with the final verdict. US jurisprudence values one pre requisite among all others.

”Non disclosure is a “species of fraud...” “

The shortest path to ruin is failing to disclose a material fact, that bears on a contract: Commercial Carriage is a contract. Every paid passage is an ironclad contract.

[Lonewolf_50]

IIRC, the NTSC stated that there had been four previous (not necessarily consecutive) flights during which similar problems had been encountered, and that at some stage during that sequence the AoA sensor had been replaced. And here we arrive at a question about the MEL, and what the requirements are for a test flight if there is a flight control problem, one that repeated, to include a safety of flight sub system, stick shaker, malfunctioning (false positives, apparently) for an extended period of time.

Also the previous flight completed their sector with the stick shaker being active basically the whole flight.
Post of interest (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-78.html#post10317818) and Another post of interest. (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-78.html#post10317754)
That's a hole or three in the Swiss cheese lining up.

A separate concern is what is an apparent glossing over of that system in the difference training, and how well trained/taught aircrews are regarding systems That Move The Flight Control Surfaces in various degraded/malfunction modes. From the contributory causes perspective, there's seems to me a (tragic) synergy between three elements of the system that are not the flying-the-aircraft piece, or even designing and building it.

1. Known failure modes, and training pertaining thereunto
2. Documentation and difference training so that pilots know how the flight controls move, and when ...
3. The MEL, how to trouble shoot and fix a problem, and then release for flight for carrying passengers.

The bellowing about how the latest 737 is somehow not a fit aircraft I'll leave to others - been watching the A vs B bun throwing on PPRuNe for a decade, and it's pointless. The vast majority of the fleet seems to take off and land without issue on a daily basis. What concerns me are pilot training, maintenance procedures, and documentation. A few pages back there was a video by a flying Captain that raises a disturbing point in parallel with some issues raised in this discussion: how thorough is the difference training, and what "this is new" stuff is covered in the simulator sessions that introduce the new version to the aircrews.

Does this vary by company? If so, why?

Similar question about maintenance procedures, and what constitutes a defect that can be "fixed later" versus "can't fly until it's fixed' versus 'can't fly till it's fixed and a maintenance test flight completed.' That third thing appears, from what I've gleaned so far, to not have been done.

For Concours77:
The "evolution" of the modern pilot still costs time and effort to train and educate on the complex system/aircraft he or she is flying. Getting off of your high horse about the 787 battery would be nice. I don't see it as relevant to a flight control malfunction.

[LookingForAJob]

I would be concerned if the NTSB would enter into any kind of assessment regarding the adequacy of a regulatory process (e.g. reviewing "integity", and "effectiveness" ) as that is entirely delegated to the regulator body. However the burden of an impartial investigations and recommendations may simply point out the failure circumstances against any standards in the regulation as written.
On the contrary, surely. The reason that an 'annex 13' investigation body should be entirely independent (of everyone and everything else) is precisely because it should be able to question any part of the system. Using your argument, there should be no assessment of the piloting process because that is delegated to the pilot in command, or of the maintenance process because responsibility for signing off the aircraft as fit to fly is delegated to the maintenance organisation, and so on).

Is there any reason that you believe that the FAA is, in some way infallible? Indeed, there are plenty of examples of accidents where regulatory oversight is identified as poor, either before or after the investigation. In some ways it surprises me that regulatory agencies are relatively rarely the focus of recommendations resulting from accident investigations.

Having worked in a regulatory agency, it was rather sobering on occasions to see how little knowledge or understanding that the regulator actually had of the organisations which it was supposed to oversee. And that was before any arguments that regulatory staff could never have cutting-edge industry competence (only the people at the sharp end, those developing new technologies could be expected to fully understand such things) and so regulators would only study and assess the adequacy of safety cases produced by manufacturers etc.(which would always be honest and complete, of course). Rather interestingly as I sit here writing this, I can't help thinking about a news story running on the BBC at the moment - albeit a different industry and well outside FAA jurisdiction - which might open some eyes to the way in which regulation can work - https://www.bbc.com/news/health-46318445.

The annex 13 type of investigation is not perfect, but it's better than many of the alternatives that some might prefer - and long may the NTSB look at the effectiveness of the FAA (and all of the local parallels as they apply), just as they look at any other part of the aviation system. That's the only way that the enviable safety performance that we see in the aviation industry will be maintained and improved.

[Concours77]

And here we arrive at a question about the MEL, and what the requirements are for a test flight if there is a flight control problem, one that repeated, to include a safety of flight sub system, stick shaker, malfunctioning (false positives, apparently) for an extended period of time.


Post of interest (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-78.html#post10317818) and Another post of interest. (https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-78.html#post10317754)
That's a hole or three in the Swiss cheese lining up.

A separate concern is what is an apparent glossing over of that system in the difference training, and how well trained/taught aircrews are regarding systems That Move The Flight Control Surfaces in various degraded/malfunction modes. From the contributory causes perspective, there's seems to me a (tragic) synergy between three elements of the system that are not the flying-the-aircraft piece, or even designing and building it.

1. Known failure modes, and training pertaining thereunto
2. Documentation and difference training so that pilots know how the flight controls move, and when ...
3. The MEL, how to trouble shoot and fix a problem, and then release for flight for carrying passengers.

The bellowing about how the latest 737 is somehow not a fit aircraft I'll leave to others - been watching the A vs B bun throwing on PPRuNe for a decade, and it's pointless. The vast majority of the fleet seems to take off and land without issue on a daily basis. What concerns me are pilot training, maintenance procedures, and documentation. A few pages back there was a video by a flying Captain that raises a disturbing point in parallel with some issues raised in this discussion: how thorough is the difference training, and what "this is new" stuff is covered in the simulator sessions that introduce the new version to the aircrews.

Does this vary by company? If so, why?

Similar question about maintenance procedures, and what constitutes a defect that can be "fixed later" versus "can't fly until it's fixed' versus 'can't fly till it's fixed and a maintenance test flight completed.' That third thing appears, from what I've gleaned so far, to not have been done.

For Concours77:
The "evolution" of the modern pilot still costs time and effort to train and educate on the complex system/aircraft he or she is flying. Getting off of your high horse about the 787 battery would be nice. I don't see it as relevant to a flight control malfunction.

Everything we say here is impacted by flagrant malpractice by the regulator. Including training, and hardware.

[Lonewolf_50]

Right, Concours77: blame the same doctor for my hernia scar as for my wife's scar from her C section.(no, I've never been treated by her OB).
Your statement is so general as to be useless, as I see it.
You can write all of the rules that you want to write; following up on that to see that the rules are carried out, or that the rules themselves cause problems, costs money. Is that your point? Just how much transparency do you expect from the Indonesian regulator?
Culture has an impact on operations. (SFO, 777, et al)

[Concours77]

Money has nothing to do with it, not from my side. FAA delegated their remit to Boeing because “We Don’t have resources to retain experts....”

Guarding the Guardians is part and parcel of any honest exchange.... your failure (refusal) to see that precludes any further discussion...

[Lonewolf_50]

Money has nothing to do with it, not from my side. FAA delegated their remit to Boeing because “We Don’t have resources to retain experts....”
My friend, I think we both recognize that Resources ~ money. ;)
The LoCo in this accident also will, if we peel the onion back a few layers, some problems about money. I am concerned that with the culture in the corporation, and the culture locally, transparency of the kind we are used to in other places will be lacking.
I hope to be utterly surprised and wrong when the final report comes out.

[Concours77]

Right, Concours77: blame the same doctor for my hernia scar as for my wife's scar from her C section.(no, I've never been treated by her OB).
Your statement is so general as to be useless, as I see it.
You can write all of the rules that you want to write; following up on that to see that the rules are carried out, or that the rules themselves cause problems, costs money. Is that your point? Just how much transparency do you expect from the Indonesian regulator?
Culture has an impact on operations. (SFO, 777, et al)

I don’t expect any transparency from Indonesian authorities... I expect unfailing vigilance from the FAA. I also expect high standards and honest dealing from Boeing. When regulations are routinely ignored, best practice succumbs to “less than”.

So I choose not to fly on the 787. Neither will I fly on the A330. My call. It is an “informed decision”. If my life depended on flying somewhere, I might fly the Dreamliner, but, again, it is MY informed decision....

LoCo and 3rd world has nothing to do with this, the discussion revolves around a blatant lapse in judgment, perhaps law, by Boeing, and feigned ignorance by FAA.

Elitist? Bet your ass. Boeing relied on a “loophole”, the FAA deserves worse condemnation. Nothing worse than a crooked cop.

[Lonewolf_50]

LoCo and 3rd world has nothing to do with this, the discussion revolves around a blatant lapse in judgment, perhaps law, by Boeing, and feigned ignorance by FAA. The decisions to keep flying paying passengers with a consistent flight control problem was a local problem. Nobody in the FAA made them do that. (For all that the FAA have some holes in their block of cheese ...) I have addressed my concerns about trouble shooting/maintenance documentation in the Tech Log thread. Back to lurk, the signal to noise ratio in this thread is unfavorable.

[silverstrata]

He meant that's where the short undercarriage and low wing came from... grandfathered from the 727.

Indeed, that was the thrust of my argument. The 727 grandfather-heritage resulted in the original 737 having slim engines tucked in close to the wing, which gave very little engine induced nose up pitch at stall. Now compare that with the huge and powerful engines on the Max, with their much greater thrust and aerodynamic pitching moments. And correct me if I am wrong - but absolutely no change to the back-end, that has to cope with those increased pitching moments.

Had the 737 been designed with fan engines from the very start, it may have aquired a different control architecture - like having a stick pusher, and a larger elevator. But when we come to designing the Max, adding a stick-pusher and new elevator to a 1967 certification might be considered a major modification, requiring complex certification issues. But just tweaking the STS system to add a nose down trim at the stall - well that is just a minor mod. Who would even notice? I mean, it is such a minor tweak that we don’t even need to put it in the F-COM or QRH.....

You see the problem....?

I don't quite follow that, seeing as the 727 didn't have wing-mounted engines..

Which is why the 727 was able to have very short legs. You don’t think anyone designed the squat little 737 de novo do you? The design and components were all inherited - and many of them originally came from the 707.

Silver

[PEI_3721]

Lonewolf #1672, as yet we do not know what trouble shooting was performed or rectification completed, save a report of a new AoA sensor.
My post #1650 raised questions about AoA malfunction indications, where some aspects could direct maintenance toward AoA and Airspeed vice trim and control. These aspect or similar would support previous pilot reports of airspeed problems and maintenance logs relating to AoA, vice an (unidentified) trim problem.
It might even be possible for an intermittent AoA fault to remain isolated from MCAS, no trim movement etc; or alternatively with trim problems, no knowledge of which AoA sensor was at fault, save detailed information linking vane side with stickshake side. Plenty of room for ambiguity, engineer-pilot liaison, weak/non existent technical-flight manual information … …

It would be interesting to know what Boeing records show of fleet wide maintenance, fault finding, or component change, in these areas. Similarly to hear of any operator problem in these areas, and how the problem was identified and rectified, presumably without grounding the aircraft.

New AoA vane manufacturer, new part number on the 737 Max ?? Just a thought.

[climber314]

Everything we say here is impacted by flagrant malpractice by the regulator. Including training, and hardware.

WRONG... I'll just come right out and spell it out for you in perfect clarity.
Wx = VMC
Primary Controls = Free & Correct
Engines = 2x Good
Pilots/CRM = ?
Mx = ?
Trim Controls = ?
Owner Factors = ?


"LoCo and 3rd world has nothing to do with this"

So you want to put all the blame on the manufacturer and/or regulators? :ugh:
Stabilizer Trim is a fraction of the above equation and even the previous crew (and perhaps the two crews before?) dispatched that problem posthaste.
What makes you think this crew would have run the "MCAS Runaway Checklist" had one existed?
THIS IS textbook Runaway Stabilizer (for which there IS a checklist) by any definition and it was NOT addressed AFAIK at this time.
I hope I'm wrong but it's not looking that way ATM.
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/704x341/stab_e257aebd74a508168b9a610260599380e239330c.jpg

Fly the plane. That's what professional pilots do IMHO.

[gums]

@ Climber
This doesn't look like classic "runaway trim".
It looks like erratic unwanted trim that I can reverse when I use the switch on the yoke, And then 5 seconds later the damned thing trims down again.
So if the trim would have continued down the instant I released that switch I would have claimed "runaway trim" and gone thru the procedure. That 5 second delay would puzzle me. Not sure about the previous flight cockpit conversation, but looks like they had a few minutes to decide on "runway trim" procedure, take action and fly to the destination.

It is a good bet that any crew following the "runaway trim" procedure right away would have made it back to the airport, just like the previous crew. But the symptoms do not seem clear, and the new MCAS may not have been briefed or flown in a sim.

Gums...

[twochai]

Indeed, the MCAS tweek is just like a stick pusher, except that instead of an instantaneous 'push' that can be easily identified and corrected by the pilot through a 'pull' on the control column, we have a stab trim that must first be identified as the problem and then cannot be countered by a manual pull - the obvious and intuitive correction.

Is this not a case of putting a digital 'band-aid' on a hydro-mechanical flight control system without much thought being given to the difference?

Sounds like a full FBW system should be mandated in this circumstance.

[climber314]

There is no "Erratic Behaviour Trim" checklist in any 737. Max or otherwise.
Checklists are a troubleshooting aid/guide and are not an answer to every conceivable issue that may arise.
Some people are inherently better at troubleshooting logic than others.
For a good example of this see the recent Southwest diversion to PHL where the PF used a checklist AND her brain when she flew her own flaps and airspeed.
You can't train for that.

[MickG0105]

You can't train for that.

I beg to differ, you can; it's called military aviation. Air Forces around the world select for and train to very high standards of competency for the very simple reason that they need to. It is however highly selective and comparatively very, very expensive.

[climber314]

I beg to differ, you can; it's called military aviation. Air Forces around the world select for and train to very high standards of competency for the very simple reason that they need to. It is however highly selective and comparatively very, very expensive.
Indeed. :ok: Point conceded with an * on highly selective.

[gmx]

With no knowledge of a system working against them during a manual flight regime, that for reasons yet to be determined, was removed from the knowledge base will have litigation specialists foaming at the mouth. Rightly so.

That said, the previous crew had dealt with it successfully despite (probably) having no idea about MCAS. They identified the issue as a runaway stabiliser and dealt with it accordingly. Even though they wrote it up as STS running reverse, it did give the airline / accident crew advanced warning of stabiliser issues on the aircraft and how to resolve them. We are of course still speculating on what briefing the accident crew received concerning the flight control issues from the previous sector and what had been done to rectify them in the interim.

[IcePack]

A lot of engineers use circuit breakers like switches. Using them to reset systems all the time. Eg I brought an A320 in with a popped fuel pump breaker. These are a no no reset until the circuit has been checked. Engineer came up whilst I was writing it up pushed the breaker back in switched on the pump for about 10 sec & then asked for the log to sign it off.
Carrying engineers for observation is great but do not let them touch anything. Air & ground are not the same in terms of consequences.

[A0283]

The 'dedicated' identification process for Lion Air 610 victims has ended on the 23rd of November. The end status is as mentioned earlier - 125 persons identified and 64 either unidentified or missing. Remains found thereafter will go through the 'general' process. The families of the unidentified and missing persons will be provided with a death certificate, and they will have the same rights as the families of those that were identified.

[threemiles]

My red highlight - This is true the pic shows that the MCAS ND trim was being recovered by NU trim which also inhibited MCAS until it ran again. This continues until just before the dive when for some reason the NU trim input is just brief inputs and insufficient to recover to normal 'level flight' trim position. MCAS runs as it has been and ND trim becomes unrecoverable. What changed for the last 5 or 6 trim switch inputs as they became blips rather than recover to level trim? Had the previous inputs been continued with we would not be having this discussion.

If the CVR is not found we will probably never know.
But there was also the AMP on board, maybe on the flight deck, maybe not, maybe to find out the root cause of the stick pusher and trim down after the AOA exchange before the flight before did not help. In that case though, what happened right after flaps up would have been expected by the crew, and not using trim cut out would have been by intention. Test flight with a full pax load, hard to believe, but ...

[WillFlyForCheese]

If the CVR is not found we will probably never know.
But there was also the AMP on board, maybe on the flight deck, maybe not, maybe to find out the root cause of the stick pusher and trim down after the AOA exchange before the flight before did not help. In that case though, what happened right after flaps up would have been expected by the crew, and not using trim cut out would have been by intention. Test flight with a full pax load, hard to believe, but ...

Excellent [possible] suggestion. it is entirely possible that they were aware of what would happen at flaps up - and were managing the trim while trying to diagnose. Then something went awry. Entirely possible explanation. CVR . . . .

[PJ2]

The CVR will be found - it is a matter of search organization, the will of all parties and patience. The search area is relatively small so it is a matter of when not if.

The CVR's importance to the investigation and to consequences for all parties cannot be overstated. So funding such a search will not be an issue.

AF447's wreckage & both recorders were found after two years of searching under ~3000m of water and after some repair work both yielded their data. The higher forward speed here presents different 'trajectories" of the parts than AF447 but we assume that these are search experts and that there is lots of oversight.

They're not even at the 30-day mark yet.

Since it hasn't been mentioned yet with regarding to sensors, computer voting-systems trying to mimic "decidability", redundancies in mission-critical / single-point-of-failure systems and the impossibility of getting it right 100% of the time with only 3 sensors, (Perpignan), two documents from Leslie Lamport and one from Kevin Driscoll are worth the time and effort:

Reaching Agreement in the Presence of Faults - Leslie Lamport (https://lamport.azurewebsites.net/pubs/reaching.pdf)
The Byzantine Generals Problem - Leslie Lamport (https://lamport.azurewebsites.net/pubs/byz.pdf)
Byzantine Fault Tolerance, from Theory to Reality - Kevin Driscoll (https://www.cs.indiana.edu/classes/p545/post/lec/fault-tolerance/Driscoll-Hall-Sivencrona-Xumsteg-03.pdf)

From Driscoll:
What You Thought Could Never Happen
In English, the phrase “one in a million” is popularly used to describe the highly improbable. The ratio itself is difficult to comprehend. The easiest way to give it reason is to equate it to real-world expectations. For example, the probability of winning the U.K. National Lottery is around one in fourteen million; the probability of getting struck by lightning in the U.S. is around one in six hundred thousand [1]. It is not safe to rely on intuition for reasoning about unfathomably small probabilities (for example, the 1-in-1,000,000,000 maximum failure probability for critical aerospace systems, (usually expressed as 10-9 hrs).

It is problematic in two ways: (1) real-world parallels are beyond typical human experience and comprehension; (2) faults that are not recognized, such as Byzantine faults, are incorrectly assumed to occur with zero or very low probability. The lack of recognition causes additional issues in that it allows the manifestation of such faults to pass unnoticed or be otherwise misclassified, reinforcing the misconception of low probability of occurrence.

The lack of recognition leads to repeating the “Legionnaire’s Disease” phenomenon. After its “discovery” in 1976, a search of medical records found that the disease had seldom occurred for many decades. The lack of shared knowledge and the disease’s rarity made each occurrence appear to be unique. Only after 1976 was it realized that all these “unique” occurrences had a common cause. Similarly, an observation of a Byzantine failure will not be recognized as being an instance of a known class of failure by those who are not intimately familiar with Byzantine failures. The intent of this paper is to redress this situation. Drawing from the authors’ experiences with Byzantine failures in real-world systems, this paper shows that Byzantine problems are real, have nasty properties, and are likely to increase in frequency with emerging technology trends. Some of the myths with respect to the containment of Byzantine faults are dispelled and suitable mitigation strategies and architectures are discussed.

[climber314]

Some interesting commentary and quotes in this article with highlights as follows:

“There are so many questions it’s sort of hard to put in one short statement,” said Roger Cox, a retired investigator with the U.S. National Transportation Safety Board and a former airline pilot.

“I would be very interested in knowing why one crew was able to cope with this stick shaker and trim anomaly, and why the next crew could not,” Cox said. “And I’d want to know why Lion Air could not or would not repair the problem.”

Cox cautioned that the flight data doesn’t tell the complete story. A cockpit recorder, which would help indicate what pilots were thinking about the malfunctions, hasn’t been recovered yet. And while the situation of conflicting instruments and alarms could have been confusing, he said he’d seen “a lot worse” in other investigations.

It’s reasonable to ask why the pilots didn’t shut off the trim system during the roughly 10 minutes they were assessing the plane’s behavior, he said. A decades-old emergency procedure teaches pilots to flip two switches to cut power to the motor that was pushing the nose down.

Even more vexing is why the plane exhibited the same malfunctions it had on the previous flight after it was supposedly repaired overnight. On a flight from Bali to Jakarta on Oct. 28, the plane’s stick shaker on the captain’s side of the plane was active for almost all of the roughly 90-minute flight and the angle of attack readings had the same errors, the data shows.

“Number one, why did the previous crew continue that flight?” Cox said. “Number two, did they or did they not make an appropriate write-up? The third question is how come you signed this thing off” to fly the next day.

https://www.bloombergquint.com/business/lion-air-pilots-battled-confusing-malfunctions-before-crashing#gs.WE5NkUQ

[Rated De]

“Number one, why did the previous crew continue that flight?” Cox said. “Number two, did they or did they not make an appropriate write-up? The third question is how come you signed this thing off” to fly the next day.

https://www.bloombergquint.com/busin...ing#gs.WE5NkUQ (https://www.bloombergquint.com/business/lion-air-pilots-battled-confusing-malfunctions-before-crashing#gs.WE5NkUQ)

We are aware that as the 'airline business' became more a business and less an airline.
The slowed but continued march towards a financial reason (hence cost) for everything eventually brings with it consequences..
Captain Sullenberger, recites a story he read in an aviation magazine which sums it up.

The retiring airline Captain reflecting on his career stated "We used to be selected and assessed on our judgement. Now we are selected and assessed on our (corporate) compliance."

'Commercial pressures' and all that....

[India Four Two]

A question about manual trimming.

Years ago, I had a jumpseat ride in a 732 and more recently, I had some time in an NG Level D simulator, so I’m aware how quickly (and noisily) the trim wheels rotate, when trimming is done via the control column switch.

If the stabilizer is at the maximum nose-down position, how many turns and how much time does it take to manually restore the stabilizer to a typical position for trimmed cruise flight?

[MickG0105]

A question about manual trimming.
...
If the stabilizer is at the maximum nose-down postition, how many turns and how much time does it take to manually restore the stabilizer to a typical position for trimmed cruise flight?

50 rotations would be required to manually trim back to 5.0 units of trim from the full nose down position (0 units). Time to accomplish that would be dependent on the effort required.
The NG FCOM notes:
The effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions.
The NG FCTM notes:
Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming.

With full nose down trim and full nose up elevator at 300 knots at 5000 feet you'd expect that there would be a significant air load on the stabiliser.

[CONSO]

50 rotations would be required to manually trim back to 5.0 units of trim from the full nose down position (0 units). Time to accomplish that would be dependent on the effort required.
The NG FCOM notes:

The NG FCTM notes:


With full nose down trim and full nose up elevator at 300 knots at 5000 feet you'd expect that there would be a significant air load on the stabiliser.

AND AT 5000 FT and 300 plus mph and at least a 45 degree dive angle- they would have perhaps 20 to 30 seconds to impact. IF ( big assumed IF ) they trimmed to nose up in 10 seconds, IMO its doubtful the resultant flight path would have
avoided impact.

And thats without a WTF startle factor . .

[birdspeed]

Perhaps, the sudden dive can be explained by a loss of elevator effectiveness. I speculate that they exceeded the breakout force on the control wheels. Suddenly they would lose a good percentage of elevator control and the aircraft would bunt over. The sudden shock/negative g stopped their sustained NU trimming allowing the MCAS to apply full ND!

The FDR trace seems to show a difference of control force just before the dive.

[ROW_BOT]

We are aware that as the 'airline business' became more a business and less an airline.
The slowed but continued march towards a financial reason (hence cost) for everything eventually brings with it consequences..
Captain Sullenberger, recites a story he read in an aviation magazine which sums it up.

The retiring airline Captain reflecting on his career stated "We used to be selected and assessed on our judgement. Now we are selected and assessed on our (corporate) compliance."

'Commercial pressures' and all that....

Indeed - but it’s even more true for Flight Ops Management, who have become the Bean Counters enforcers.

i recently had one such fool encourage me to operate unsafely with the comment that “a ship that stays in harbour is safe, but that’s not what ships are for”.

Now think about that mentality in terms of this Lion Air flight and you’ll understand why all those people are dead.

[Rated De]

Indeed - but it’s even more true for Flight Ops Management, who have become the Bean Counters enforcers.

i recently had one such fool encourage me to operate unsafely with the comment that “a ship that stays in harbour is safe, but that’s not what ships are for”.

Now think about that mentality in terms of this Lion Air flight and you’ll understand why all those people are dead.


That is precisely the inference.

[Derfred]

Which is why I posted this a week ago:

The only thing that has been released in the media is the Boeing AD regarding MCAS. It hasn’t been concluded that MCAS was the primary cause of the accident, however, given the publication of the AD, it has been the main subject of conjecture on this forum as a “contributing factor” (thank you lakedude).
Most accidents prove to have several “contributing factors”, and I’m sure this will be one of them.

I would suggest that the eventual analysis will include other contributing factors, including the quality of maintenance (given the evidence of the previous 3 sectors), and the quality of training (given that this event should have been survivable if indeed it was only an air data problem).

I don’t work for Boeing, but given the track record of this operator, I am really surprised at the outburst against Boeing on this thread. Boeing is not in charge of maintenance standards or training standards at customer airlines. If you want to buy a ticket to fly on a low cost airline, you carry a risk. Until the planes start crashing, low cost operators will continue to reduce standards. Eventually they will reach a point where the planes start crashing, and tragically, people will die. I will leave it to the community to decide when that point has been reached.

[bsieker]

Which is why I posted this a week ago:I don’t work for Boeing, but given the track record of this operator, I am really surprised at the outburst against Boeing on this thread. Boeing is not in charge of maintenance standards or training standards at customer airlines. If you want to buy a ticket to fly on a low cost airline, you carry a risk. Until the planes start crashing, low cost operators will continue to reduce standards. Eventually they will reach a point where the planes start crashing, and tragically, people will die. I will leave it to the community to decide when that point has been reached.
True, maintenance and operations will most likely be found to be causal factors in this one, but so will the possible lack of adequate briefing for a new system and also the engineering design of said system, including the (possible lack of appropriate) hazard assessment for possible failure modes including the handling of erroneous input data. System engineers cannot simply say "our system always works perfectly given correct input data." Designing the system to expect and handle totally wrong, missing, delayed, corrupted, slightly wrong and all sorts of other less-than-perfect input data is part of due diligence. This includes estimates of the probability of such wrong data, and thorough analyses of what could possibly go wrong in the worst case.

This was supposed to be a system to prevent accidents, but it is quite clear that in this case it was a causal factor of an accident. It is hard, or maybe impossible to say how many accidents it has prevented (plausibly: none). Given the law of small numbers one cannot yet say that the MAX would be better off without the system altogether, and some system was also arguably required to fulfill certification criteria for longitudinal stability. Such systems have a long tradition, often in the form of stick pushers, to mitigate adverse aerodynamic effects. Using hardware already available is a "cheap" solution, compared to the complexities of an actual pusher, but in terms of certification, "just good enough" is good enough.

And despite your protestations, Boeing does have a word to say about maintenance standards and training standards at an airline wishing to operate their hardware.

Bernd

[Derfred]

Partly agreed, and probably Boeing needs to accept some culpability with MCAS redundancy/fault tolerance, but with good maintenance and training it’s likely this thread wouldn’t exist.

Unlike many posters here, I seriously doubt that a crew that couldn’t handle this event would have behaved any differently if an MCAS description had been included in the B737MAX FCOM. I suspect that this aircraft did not crash due to lack of pilot system knowledge regarding MCAS.

Is it a coincidence that a low cost carrier such as this one was the first to discover that MCAS+AOA FAULT+PILOT FAULT= CRASH?

Of course, they didn’t discover it at first, they had to keep putting the aircraft up there with different pilots until they found pilots who couldn’t handle it.

Despite a report not yet being published, the information available indicates that the aircraft had a fault which thankfully, due to good pilots, returned to earth safely. The airline returned the aircraft to the air not once but three times with the fault not verified to be resolved. The pilots of flight number 4 were not able to fly it back safely. You can point at Boeing for system design, but you can’t point at them for this sequence of events. This would not happen in any decent airline.

And despite your protestations, Boeing does have a word to say about maintenance standards and training standards at an airline wishing to operate their hardware.
Not to the the extent that prevents a low-cost carrier from operating a poorly maintained jet with a poorly trained crew. That is not Boeing’s job. That role rests with the Airline and the local regulatory authority .

I maintain my point.

[glad rag]

Which was?

Did Boeing include the operation of the suspect systems in the manuals available to the crew of the accident aircraft?

[Derfred]

Which was?
Did Boeing include the operation of the suspect systems in the manuals available to the crew of the accident aircraft?

I thought I made my opinion on that subject clear: (edit: I did edit my post, you may have responded before this, sorry)

Unlike many posters here, I seriously doubt that a crew that couldn’t handle this event would have behaved any differently if an MCAS description had been included in the B737MAX FCOM. I suspect that this aircraft did not crash due to lack of pilot system knowledge regarding MCAS.

[Ian W]

This was supposed to be a system to prevent accidents, but it is quite clear that in this case it was a causal factor of an accident. It is hard, or maybe impossible to say how many accidents it has prevented (plausibly: none). Given the law of small numbers one cannot yet say that the MAX would be better off without the system altogether, and some system was also arguably required to fulfill certification criteria for longitudinal stability. Such systems have a long tradition, often in the form of stick pushers, to mitigate adverse aerodynamic effects. Using hardware already available is a "cheap" solution, compared to the complexities of an actual pusher, but in terms of certification, "just good enough" is good enough.
Bernd

I don't think that you can say that anymore than you can say that the ADIRUs that gave UAS indications due to the same AOA vane fault and caused the FMS to remain unengaged were a causal factor., Had the crew cut off the stab trim when it repeatedly re-trimmed ND for them - this crash would not have happened. The causal factor if any was the AOA disagree that was allowed to propagate errors through the system, all errors that could be and were handled by the crews on the previous flights. If there was a reasonableness check of AOA using other non-pressure instrument indications then a grossly misreading AOA vane could be identified and disabled. The organizational fault is that an aircraft with a fault that repeats over several fights should be grounded for a full maintenance check and then given a test flight without pax by a crew that have been fully briefed on the fault and symptoms and self briefed on the actions to be taken if those symptoms recur.

[bsieker]

This would not happen in any decent airline.
Perhaps. But it is much better to have an aircraft where this cannot happen at any airline.

There are always multiple factors, and if either of them can be fixed, it reduces the total risk of a similar accident. Saying, "Oh, the system was ok, a good pilot and a could airline would not have had any problems" is not helpful. Neither is saying "There was a flight crew who could handle it, so just these bad pilots couldn't."

There are two points to make:

I seem to recall that on the first flight with divergent AoA values, the Flight Control Computer operated the MCAS based on the correct AoA sensor, so there was no problem for the pilots (except the stick shaker: continuing with that is also a very ... interesting decision), whereas on the accident flight, the MCAS used the faulty AoA sensor so continued to trim nose-down. It did not do so on the previous flight. So yes, in this case the airline not rectifying the problem was a causal factor, but it is just as credible that this could have happened on the first flight on which the fault appeared, and then the airline would have no part in this.
Pilots without exceptional skills must be able to handle an aircraft with a single technical fault. That is a certification requirement, which one may argue was violated by this design.


Cheers,
Bernd

[lomapaseo]

And despite your protestations, Boeing does have a word to say about maintenance standards and training standards at an airline wishing to operate their hardware.

agree BTDT.
but not as a pre-review process, which is a regulator function (unless requested), but data based afterwards they have a duty to warn

[wiedehopf]

I seem to recall that on the first flight with divergent AoA values, the Flight Control Computer operated the MCAS based on the correct AoA sensor, so there was no problem for the pilots (except the stick shaker: continuing with that is also a very ... interesting decision), whereas on the accident flight, the MCAS used the faulty AoA sensor so continued to trim nose-down. It did not do so on the previous flight. So yes, in this case the airline not rectifying the problem was a causal factor, but it is just as credible that this could have happened on the first flight on which the fault appeared, and then the airline would have no part in this

That's not true. Look at the FDR, it is quite clear MCAS operated on the previous flight.
They used the cutout and trim wheel:

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/809x655/screenshot_from_2018_11_27_16_29_08_407febdde334f324826be059 4fa720444b2e2a76.png
https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/861x467/screenshot_from_2018_11_27_16_30_51_87eb5004dc10c6f75cdf3e55 44ceafb7db43659c.png


As we are unsure of the MCAS system architecture it seems the other FCC being active doesn't mean MCAS only triggers for one of the FCCs when one AoA is high.
Also didn't i read somewhere both FCCs get both AoA values as an input?

The 2 flights before that were not plagued by the incorrect AoA but some other problem, at least that's how i read the various news reports.
(Edit: There are no news reports to that effect my memory tricked me. But looking at the FR24 data and the altitude excursion MCAS produced on the last two flights it is reasonable to assume that an AoA problem that severe did not exist on the flights before the sensor replacement)
The vastly wrong AoA value was most likely introduced due to the replacement of the AoA sensor in Denpasar.
(Be it due to a defective / wrong part or some unbelievable hackery no one knows)


If you want to look at the FDR graphs yourself please check out the pdf in the attachment:

[PEI_3721]

infrequentflyer789, #1637. Interesting; very useful descriptions and analysis in the link at #1634, and to other web pages. Also from Tech Log discussion.
These points address previous questions re the EFIS display of erroneous AoA (if fitted), possibly misleading low speed awareness, and obviously stick shake, all before MCAS became active. (Hazards and mind-shaping problems before MCAS cycles the trim).

The suppositions about flap selection are pertinent. If the crew were managing the false stick shake (low airspeed indication from takeoff onwards), then the subsequent flap cycle could be a logical response to the additional MCAS trimming.

Later supposition is reasonable based on the systems descriptions and MCAS logic. With the trim issue apparently under control, but still cycling, the focus of fault finding may have reverted to stick shake and low speed awareness - UAS (was that written up in previous tech-log entries). This may have involved change of control and concluding a misidentified stall (cf reversed AF 447 mentality) thus thrust addition, allowing the nose to lower and speed increase, before the trim, stick force, increasing airspeed prevented recovery.

The views on dual architecture (link) are similarly interesting. IIRC in the THY accident the aircraft did not have the FCC software mod which would have disconnected the AP AT with RA Failure (other aircraft did), no RA disagree alert due to lack of dual architecture.
Perhaps a similar design issue with a single AoA input to FCC / MCAS, in what is an essentially dual aircraft.

previous link https://www.satcom.guru/2018/11/first-look-at-jt610-flight-data.html

[Derfred]

The 2 flights before that were not plagued by the incorrect AoA but some other problem, at least that's how i read the various news reports.


I don’t share your memory. I have not seen any reports from the 2 flights before.

I’m sure the investigators are looking at those flights, but so far, no leaks to my knowledge.

There is a big question of course, due to the knowledge that an AoA vane was swapped out during the transit between flights 2 and 3 (if we can number them 1-4, 4 being the accident flight).

That AoA vane was swapped out for a reason, but we don’t exactly know the reason. It is reasonable to assume it was swapped out as a troubleshooting attempt from a pilot report of an air data problem from the incoming flight, Now this is where it gets interesting, and this is where we need information that we simply don’t have.

So, I try to keep my comments relevant to Professional Pilots.

Technical discussions can be carried on in the Tech Log forum, and there is one regarding MCAS.

[Derfred]

Later supposition is reasonable based on the systems descriptions and MCAS logic. With the trim issue apparently under control, but still cycling, the focus of fault finding may have reverted to stick shake and low speed awareness - UAS (was that written up in previous tech-log entries). This may have involved change of control and concluding a misidentified stall (cf reversed AF 447 mentality) thus thrust addition, allowing the nose to lower and speed increase, before the trim, stick force, increasing airspeed prevented recovery.

This crew wasn’t doing UAS, that’s clear from the data.

But change of control is certainly one hypothetical, which could explain the sudden plunge after maintaining control for several minutes... eg one pilot says “handing over, I need to find the circuit breaker for this stick shaker....” - if so it would sound disturbingly like the Air Asia Indonesia fatality.

[b1lanc]

I don’t share your memory. I have not seen any reports from the 2 flights before.

Source Reuters and many other media outlets Nov. 5th
"Safety Committee (KNKT) said on Monday an airspeed indicator of a Boeing Co. 737 MAX plane that crashed last week killing all 189 people on board was damaged for its last four flights.The damage was revealed after data had been downloaded from the plane's flight data recorder, KNKT chief Soerjanto Tjahjono told reporters, adding that it was asking Boeing and U.S. authorities what action to take to prevent similar problems on this type of plane around the world."

[Airbubba]

The New York Times has posted this update on the crash:

Black Box Data Reveals Pilots’ Struggle to Regain Control of Doomed JetBy James Glanz (https://www.nytimes.com/by/james-glanz), Muktita Suhartono and Hannah Beech (https://www.nytimes.com/by/hannah-beech)
Nov. 27, 2018

Data from the jetliner that crashed into the Java Sea last month shows the pilots fought to save the plane almost from the moment it took off, as the Boeing 737’s nose was repeatedly forced down, apparently by an automatic system receiving incorrect sensor readings.

The information from the flight data recorder, contained in a preliminary report prepared by Indonesian crash investigators and scheduled to be released Wednesday, documents a fatal tug-of-war between man and machine, with the plane’s nose forced dangerously downward more than two dozen times during the 11-minute flight. The pilots managed to pull the nose back up over and over until finally losing control, leaving the plane, Lion Air Flight 610, to plummet into the ocean at 450 miles per hour, killing all 189 people on board.

The data from the so-called black box is consistent with the theory that investigators have been most focused on: that a computerized system Boeing installed on its latest generation of 737 to prevent the plane’s nose from getting too high and causing a stall instead forced the nose down because of incorrect information it was receiving from sensors on the fuselage.

Details of the black box data were contained in a briefing for the Indonesian Parliament and were first disclosed publicly in the Indonesian media. The data was subsequently posted and analyzed in a blog post (https://www.satcom.guru/2018/11/first-look-at-jt610-flight-data.html) by Peter Lemme, a satellite communications expert and former Boeing engineer.

Despite Boeing’s insistence that the proper procedures were in the handbook, also called the emergency checklist, pilots have said since the accident that Boeing had not been clear about one potentially vital difference between the system on the new 737s and the older models. In the older versions, pilots could help address the problem of the nose being forced down improperly — a situation known as “runaway stabilizer trim” — by pulling back on the control column in front of them, the pilots say.

In the latest 737 generation, called the Max, that measure does not work, they said, citing information they have received since the crash. The pilots on Lion Air Flight 610 appear to have forcefully pulled back on their control columns to no avail, before the final dive, according to the information from the flight data recorder.

Capt. Dennis Tajer, spokesman for the American Airlines pilot union and a 737 pilot, said he could not comment on any aspect of the investigation. But, he said, “in the previous model of the 737, pulling back on the control column, Boeing says will stop a stabilizer runaway.”

Information provided to American Airlines from Boeing since the crash, Captain Tajer said, “specifically says that pulling back on the control column in the Max will not stop the runaway if M.C.A.S. is triggered. That is an important difference to know.”

The futile struggle by the pilots to regain control can be seen in colorful jagged lines in graphs contained in the report to the Indonesian Parliament, documenting the seesaw motion of the nose as the system pushed it down at least two dozen before the plane’s fatal nose-dive.

From the moment Flight 610 took off just after dawn from the airport in Jakarta, the Indonesian capital, the Max 8 jet was recording errant data from one of the two angle-of-attack sensors on the nose of the plane that records the pitch at which a plane is climbing or descending.

https://www.nytimes.com/2018/11/27/world/asia/indonesia-lion-air-crash-.html

[Rated De]

Capt. Dennis Tajer, spokesman for the American Airlines pilot union and a 737 pilot, said he could not comment on any aspect of the investigation. But, he said, “in the previous model of the 737, pulling back on the control column, Boeing says will stop a stabilizer runaway.” Information provided to American Airlines from Boeing since the crash, Captain Tajer said, “specifically says that pulling back on the control column in the Max will not stop the runaway if M.C.A.S. is triggered. That is an important difference to know.”

Would seem a little simplistic to let the manufacturer off the hook just yet.

[threemiles]

I still wonder how the MCAS trim down logic was certified based on a single AOA input. Even if this has a reason that is buried somewhere between FAA and Boeing, there are plenty of other sensors/data available that could help the MCAS computer to determine it shall better not trim down, like pitch, roll, radio height, gps vertical rate, ground speed, you name it.

We build autonomously driving cars with amazing intelligence identifying objects and doing some kind of plausbile action. But we cannot program a simple logic for a commercial aircraft that carries 200 people that says: when pitch is normal AND there is no excessive bank AND at 5000 ft radio height AND at 300 kts ground speed, this MCAS system better does not push, but presents a caution about implausible sensor data? No, we can't, because of certification grandfather rights thinking. Just touch what's absolutely necessary.

This fits perfectly into the picture that an AOA disagree indicator is sold as an option, i.e. Boeing tries making money by upselling a safety feature, and the FAA grants them doing so.

​​​​A trim runaway is always a serious incident. Just saying, there is the pilot as a backup, he just needs to run the memory items and all is good, is too easy. This thinking is out of time. The age of analog heros is over, we live in a digital world. Hundreds of complex rules of ANDs and ORs and IFs on a digital flight deck are overwhelming human beings. The digital system must help itself, at least to some extent.

[Zeffy]

Lion Air pilots struggled against Boeing’s 737 MAX flight-control system, black box data shows (https://www.seattletimes.com/business/boeing-aerospace/black-box-data-reveals-lion-air-pilots-struggle-against-boeings-737-max-flight-control-system/)

[emphasis mine]

...The data shows that after this cycle repeated 21 times, the captain ceded control to the first officer and MCAS then pushed the nose down twice more, this time without a pilot response.
After a few more cycles of this struggle, with the horizontal tail now close to the limit of its movement, the captain resumed control and pulled back on the control column with high force.
It was too late. The plane dived into the sea at more than 500 miles per hour.

[threemiles]

One other thought: MCAS is active with flaps up only. The pilots cycled the flaps after the first couple of MCAS trim downs for a reason. There was the perception that the trim downs started when flaps were up. So, they found out some kind of logic. If the system logic had been known to them (Flaps up, MCAS on - Flaps dn, MCAS off), i.e. if they had been informed or trained to understand the MCAS system, they most probably would have associated this logic with MCAS, then set flaps and return.

[SLFstu]

I don’t share your memory. I have not seen any reports from the 2 flights before.
I’m sure the investigators are looking at those flights, but so far, no leaks to my knowledge.
I have a recollection that at an early media conference investigators said for the sector into Denpassar the pilots had no airspeed data showing the whole flight.
We more or less know what happened after that flight landed.

[Loose rivets]

wiedhopf #1703

https://www.pprune.org/attachments/rumours-news/5533d1543333192-indonesian-aircraft-missing-off-jakarta-lionair_b38m_pk-lqp_jakarta_181029_knkt_data.pdf


Following a period of high fuel low there seems to be a varied median followed by a burst and later by a huge flow at time of final ascent. Given the new engine power and position, my guess is the pitch up would have been more than expected - just adding another stress factor to those last seconds.

The metered reduction of the flow trace after the peak is difficult to understand.
.
.

[slacktide]

Re: number of previous flights with UAS:

It would be excellent if people would provide documented sources, rather than fallible memory and conjecture. This took all of 5 seconds to find on Google news.

https://www.theguardian.com/world/2018/nov/06/lion-air-crash-black-boxes-reveal-plane-had-airspeed-problems-on-last-four-flights

The head of Indonesia’s National Transportation Safety Committee (KNKT) , Soerjanto Tjahjono, told reporters the Boeing 737 Max plane had suffered similar problems on its last four routes, according to information downloaded from its flight data recorder.

“When we opened the black box, yes indeed the technical problem was the airspeed or the speed of the plane,” Tjahjono said.

“Data from the black box showed that the two flights before Denpasar-Jakarta also experienced the same problem,” he said.

“In the black box there were four flights that experienced problems with the airspeed indicator.”

[CONSO]

Would seem a little simplistic to let the manufacturer off the hook just yet.

But pulling back and or using electric trim did APPEAR to stop runaway - for 5 to 10 seconds - thus adding to the confusion...

[Rated De]

But pulling back and or using electric trim did APPEAR to stop runaway - for 5 to 10 seconds - thus adding to the confusion...

Yes that appears the point.
Not knowing this system was embedded in the aircraft's architecture is one thing. Given the crew may have expected a possible airspeed disagree, it is plausible that they never knew what was at play.
It is very easy to sit there like that idiot Bryon Bailey did and blame a crew.
Imagine a crew working their darnedest to save an aircraft that did its level best to kill everybody, and never knowing what the problem was, nor the system causing it, for the manufacturer and the regulator deemed it not necessary to tell them.

[gmx]

Yes that appears the point.
Not knowing this system was embedded in the aircraft's architecture is one thing. Given the crew may have expected a possible airspeed disagree, it is plausible that they never knew what was at play.
It is very easy to sit there like that idiot Bryon Bailey did and blame a crew.
Imagine a crew working their darnedest to save an aircraft that did its level best to kill everybody, and never knowing what the problem was, nor the system causing it, for the manufacturer and the regulator deemed it not necessary to tell them.
Previous crew encountered same problem and dealt with it safely. Th accident crew had the benefit of that experience (from the write up). They also battled the trim for 6 minutes clearly understanding they had a trim runaway. Why they didn't hit the CUTOUT and why after six minutes they could no longer successfully counteract it, is unknown.

Although I read an article that said they swapped to copilot control immediately preceding the dive.

[slacktide]

That would be a newspaper that probably got its data from hear. Possibly. Allegedly.

No. That was a direct quote from the head of Indonesia’s National Transportation Safety Committee, and was reported by numerous other news organizations. I’m sure you can find the press conferece taped online somewhere ass well.

I get the feeling the Airspeed indications were fine according to one log analysis.

Also, no. Look closer. There is a slight offset between the pilot and co-pilot’s computed airspeed. Refer to page 7 of the report, the traces labeled “COMPUTEDAIRSPEEEDLFDR” and “RFDR”

http://avherald.com/files/lionair_b38m_pk-lqp_jakarta_181029_knkt_data.pdf

This is one of the expected and published effects of a bad AOA sensor on a 737. The ADIRU uses the angle of attack as one of the inputs to correct the raw indicated airspeed (as directly sensed at the pitot and static ports) for installation and position error, so that it can be used as computed airspeed and dislayed on the PFD.

The pilot and co-pilot’s air data systems and indications are independent. The computed airspeeds are monitored. If there is more than a certain difference beteen the pilot and co-pilot’s airspeed, and you will get the “IAS DISAGREE” message on the PFD. Which is what the head of the KNKT says occured on at least four different flights of this aircraft.

[SteinarN]

Preliminary report is out.

http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf

Some quick observations from the report:
From the report on side 12 it shows CC communicating "normally" with the tower just 19 seconds before end of recording/impact with sea. CC stated they could not determine speed nor altitude as all three instruments was indicating different values, this was 45 seconds before impact. Also at 56 seconds before impact the CC made a request due to weather, might they have been in non-visual conditions during the final dive? Truly horryfying reading.

[Rated De]

Previous crew encountered same problem and dealt with it safely. Th accident crew had the benefit of that experience (from the write up). They also battled the trim for 6 minutes clearly understanding they had a trim runaway. Why they didn't hit the CUTOUT and why after six minutes they could no longer successfully counteract it, is unknown.

Although I read an article that said they swapped to copilot control immediately preceding the dive.

There were only two pilots that knew precisely what they expected and what was ultimately encountered. Unfortunately, they cannot speak for themselves.
It is presumptuous to suggest they knew of, diagnosed correctly or indeed understood that the likely root cause of their predicament was the MCAS, which from all reports pilots did not know was there.

The pilot and co-pilot’s air data systems and indications are independent. The computed airspeeds are monitored. If there is more than a certain difference between the pilot and co-pilot’s airspeed, and you will get the “IAS DISAGREE” message on the PFD. Which is what the head of the KNKT says occured on at least four different flights of this aircraft.

No pilot (with few notable exceptions) will not fight to save the aircraft. These poor souls did the best they could do. They may well have expected an IASDISAGREE. They may have briefed for it, they may even have had the QRH at hand. No one knows definitively.
What is insidious is the Boeing statement, justifying the lack of information on the MCAS stating that (paraphrased) 'in normal operations the pilots would not know of its existence'.

[George Glass]

Boeing is going to cop a lot of flak over this event but the fact remains that
- The aircraft shouldnt have been dispatched in the first place , and probably wouldnt have been anywhere in the US , Europe or Australia etc.
- Disconnecting both stab. trim motors , as per the check-list , would have stopped the event cold.
-Subsequent Airspeed Disagree events etc. were resolvable by flying attitude and thrust and following the checklist.
Its an analogue aircraft,not fly by wire. Digital add-ons are nice to have,not must have.
Pilots are not backup.
Pilots are the first and last back-stop.
Disconnect and fly the the aircraft.

[Gary Brown]

The Preliminary Report (78 pages) linked to above (http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf) is a very slow download this morning. And many press reports of it are - imho - based on the press releases accompanying it, not the text itself. So, here's the Synopsis section of the English version of the original document (p. vii), followed by the Safety Recommendations (p.27). [NB the translation to English is a tad odd - rushed? - in places]

SYNOPSIS
On 28 October 2018, a Boeing 737-8 (MAX) aircraft registered PK-LQP was being operated by PT. Lion Mentari Airlines (Lion Air) as a scheduled passenger flight from I Gusti Ngurah Rai International Airport (WADD), Denpasar to Jakarta as LNI043. During pre-flight check, the PIC discussed with the engineer of the maintenance actions that had been performed including replacement of the AoA sensor and had been tested accordingly.
The aircraft departed at 1420 UTC (2220 LT) at night time, the DFDR showed the stick shaker activated during the rotation and remained active throughout the flight. About 400 feet, the PIC noticed on the PFD the IAS DISAGREE warning appeared. The PIC handed over control to the SIC and cross checked the PFDs with the standby instrument and determined that the left PFD had the problem. The PIC noticed the aircraft was automatically trimming AND. The PIC moved the STAB TRIM switches to CUT OUT and the SIC continued the flight with manual trim without auto-pilot until the end of the flight.
The PIC declared “PAN PAN” to the Denpasar Approach controller due to instrument failure and requested to maintain runway heading. The PIC performed three Non-Normal Checklists and none contained the instruction “Plan to land at the nearest suitable airport”.
The remainder of the flight was uneventful and the aircraft landed Jakarta about 1556 UTC. After parking, the PIC informed the engineer about the aircraft problem and entered IAS and ALT Disagree and FEEL DIFF PRESS problem on the AFML.
The engineer performed flushing the left Pitot Air Data Module (ADM) and static ADM to rectify the IAS and ALT disagree followed by operation test on ground and found satisfied. The Feel Differential Pressure was rectified by performed cleaned electrical connector plug of elevator feel computer. The test on ground found the problem had been solved.
At 2320 UTC, (0620 on 29 October 2018 LT), the aircraft departed from Jakarta with intended destination of Pangkal Pinang. The DFDR recorded a difference between left and right AoA of about 20° and continued until the end of recording. During rotation the left control column stick shaker activated and continued for most of the flight.
During the flight the SIC asked the controller to confirm the altitude of the aircraft and later also asked the speed as shown on the controller radar display. The SIC reported experienced „flight control problem‟.
After the flaps retracted, the DFDR recorded automatic AND trim active followed by flight crew commanded ANU trim. The automatic AND trim stopped when the flaps extended. When the flaps retracted to 0, the automatic AND trim and flight crew commanded ANU trim began again and continued for the remainder of the flight. At 23:31:54 UTC, the DFDR stopped recording.
Until the publishing of this Preliminary Report, the CVR has not been recovered, the search for CVR is continuing. The investigation will perform several tests including the test of the AoA sensor and the aircraft simulator exercises in the Boeing engineering simulator. The investigation has received the QAR data for flight for analysis.
The investigation involved the NTSB of the United States of America as State of design and State of manufacturer, the TSIB of Singapore and the ATSB of Australia as State provide assistant that assigned accredited representatives according to ICAO Annex 13.

______________

4 SAFETY RECOMMENDATIONS
The KNKT acknowledges the safety actions taken by Lion Air and considered that the safety actions were relevant to improve safety, however there still safety issue remain to be considered. Therefore, the KNKT issued safety recommendations to address safety issues identified in this report.
4.1 Lion Air Lion AirLion Air
04.O-2018-35.1
Refer to the CASR Part 91.7 Civil Aircraft Airworthiness and the Operation Manual part A subchapter 1.4.2, the pilot in command shall discontinue the flight when un-airworthy mechanical, electrical, or structural conditions occur.
The flight from Denpasar to Jakarta experienced stick shaker activation during the takeoff rotation and remained active throughout the flight. This condition is considered as un-airworthy condition and the flight shall not be continued.
KNKT recommend ensuring the implementation of the Operation Manual part A subchapter 1.4.2 in order to improve the safety culture and to enable the pilot to make proper decision to continue the flight.
04.O-2018-35.2
According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adult, one child and two infants. The voyage report showed that the number of flight attendant on board was six flight attendants. This indicated that the weight and balance sheet did not contain actual information.
KNKT recommend ensuring all the operation documents are properly filled and documented.

__________________END

[bsieker]

Boeing is going to cop a lot of flak over this event but the fact remains that
- The aircraft shouldnt have been dispatched in the first place , and probably wouldnt have been anywhere in the US , Europe or Australia etc.

Possibly true, but largely irrelevant, because this could as well have happened on the first flight with the AoA problem.


- Disconnecting both stab. trim motors , as per the check-list , would have stopped the event cold.

There was no checklist for "unexpected MCAS trim", only for runaway trim, which in this case was not applicable, since the MCAS trim inputs could be stopped by pilot trim inputs. That is not runaway. Only Boeing's document and the subsequent EAD made the connection between this behaviour and the "runaway trim" checklist. Which is why using the wording "existing checklist" by Boeing is disingenuous. It's a weasel-word trying to imply that the pilots should have used the checklist, although it was not applicable before now.


Its an analogue aircraft,not fly by wire. Digital add-ons are nice to have,not must have.

That very much depends on how the "analogue" aircraft behaves without digital add-ons. It is likely that, because of the larger engine nacelles, it would have failed certification criteria for longitudinal static stability, so some system was required to restore that stability.


Pilots are the first and last back-stop.
Disconnect and fly the the aircraft.
We don't know if or when they could have diagnosed the problem, not being informed about MCAS at all. Criticising pilot action with our hindsight of what went on is not helpful. It is important to take the "inside view" and try to imagine what they knew, what they saw and heard and what they could have deduced from that in the available time, with a high workload. Which is usually not very much. Even recreating this in the simulator is very different because you already know what is going to happen.

Cheers,
Bernd

[Gary Brown]

SNIP

There was no checklist for "unexpected MCAS trim", only for runaway trim, which in this case was not applicable, since the MCAS trim inputs could be stopped by pilot trim inputs. That is not runaway. Only Boeing's document and the subsequent EAD made the connection between this behaviour and the "runaway trim" checklist. Which is why using the wording "existing checklist" by Boeing is disingenuous. It's a weasel-word trying to imply that the pilots should have used the checklist, although it was not applicable before now.
SNIP

Cheers,
Bernd

From the Synopsis (quoted above) of today's Interim Report, about the previous flight:

The PIC noticed the aircraft was automatically trimming AND. The PIC moved the STAB TRIM switches to CUT OUT and the SIC continued the flight with manual trim without auto-pilot until the end of the flight.

[Alanwsg]

'The register' has an article on the report, the comment section is interesting as well!
https://www.theregister.co.uk/2018/11/27/boeing_737_max_mcas_lion_air/

[aterpster]

No pilot (with few notable exceptions) will not fight to save the aircraft. These poor souls did the best they could do. '.
A simple disconnect of the two electric trim switches would have saved the day. Those switches have been around since the first 737 rolled out of barn circa 1965. Common to 707 and 727.

[judebrad]

Indeed, that is what the previous crew did.
"The PIC moved the STAB TRIM switches to CUT OUT and the SIC continued the flight with manual trim without auto-pilot until the end of the flight. "

[Cows getting bigger]

Would it be fair to say that the previous crew worked an issue whilst not understanding the nature of the issue? In other words, they thought they had a trim runaway and flicked the stab trim switches. Luck rather than judgement?

[Semreh]

A simple disconnect of the two electric trim switches would have saved the day. Those switches have been around since the first 737 rolled out of barn circa 1965. Common to 707 and 727.

Obvious with 20/20 hindsight*. As is the obvious point that the co-pilot ceasing to pull back on the sidestick in AF477 would have helped. There is usually a reason why people do not do what is obvious with 20/20 hindsight, and simply using a large can of pilot-error coloured paint is not a good explanation. The evidence of the FDR appears consistent with the pilots not having a clear and accurate mental model to explain the behaviour of the aircraft, and therefore acting to the best of their ability according to their flawed model didn't solve the experienced problem. Lack of knowledge about the MCAS trim process may have contributed to their confusion. This could be down to poor training, lack of information from the manufacturer, or it not being the first thing on their minds in a high workload environment when they are doing the best (in their belief) to aviate. There's no pause button in real life to allow you to stop and have a leisurely think about what is happening.

*Actually we do not know what mechanical or software failure caused the symptoms the pilots were attempting to ameliorate, and it is supposition that disconnecting the electric trim switches would have resolved the problem. If the systems were working as we expect, your statement is probably true, but what we know is that the aircraft was not behaving as the pilots expected, with some guesswork about the root cause.

[Rated De]

Would it be fair to say that the previous crew worked an issue whilst not understanding the nature of the issue? In other words, they thought they had a trim runaway and flicked the stab trim switches. Luck rather than judgement?

Precisely.

Given the CVR has not been recovered the only two people that definitively know exactly what transpired cannot defend themselves, is it not wiser to resist the arrogance afforded by 100% hindsight and wait for the CVR to be found?
Thank you Semreh, far more eloquently put.

[Station Zero]

What I noted from the reported is that the PIC of the flight from DPS-CGK picked up the automatic trim inputs nose down and also stated that by the third trim input the control column became too heavy for the SIC. Fortunately, a decision was made at that point to cut off the electric trim which probably saved the aircraft.

Could unfortunately the crew of the incident flight realised what they needed to do but by the fourth/fifth trim input, but it was already too late as the control forces were such that both had to compensate by holding on to the column with neither of them wanting to/or being able to let go of the column as that's all that was keeping the nose up to reach for the trim cut out switches.

I have been thinking further about what possibly caused the increase forces, as aerodynamic forces should not really be felt even on a 737 through the column unless the hyds are off, so could the Elevator Feel Shift that occurs when a stall is detected (I believe based on AOA input to the SMYD) be the cause of the increase of column forces, as this applies forces to the feel and centering unit to resist elevator up movement which could have effectively compounded the situation.

[infrequentflyer789]

I have been thinking further about what possibly caused the increase forces, as aerodynamic forces should not really be felt even on a 737 through the column unless the hyds are off, so could the Elevator Feel Shift that occurs when a stall is detected (I believe based on AOA input to the SMYD) be the cause of the increase of column forces, as this applies forces to the feel and centering unit to resist elevator up movement which could have effectively compounded the situation.

The way I read the diagrams, each SMYD feeds one side stick shaker motor, but same signal from either SMYD will trigger EFSM. So the expectation would be that if stick shaker is going off, even on only one side, EFSM will also kick in, and yes that would mean increase in column forces.

[BristolScout]

I'm long retired and I wouldn't dream of second guessing the inquiry but I can't help thinking that too many present day pilots are indoctrinated to fly the aircraft through the system. Fine as far as it goes but, if the system is malfunctioning, how long does it take to disconnect and use pitch/power to restore straight and level?

[infrequentflyer789]

The Preliminary Report (78 pages) linked to above (http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf) is a very slow download this morning.

NTSC site seems to be down, probably overloaded, for a few hours now.

However, ASN have a copy at https://reports.aviation-safety.net/2018/20181029-0_B38M_PK-LQP_PRELIMINARY.pdf which seems to be responding fine.

Initial glance through suggests no new technical information on MCAS and no FDR info beyond what we've already seen from the press release.

[DaveReidUK]

There's no explicit mention of the flying spanner in the Preliminary Report, suggesting that he/she was not on the flight in any kind of pre-assigned troubleshooting role.

[gearlever]

There's no explicit mention of the flying spanner in the Preliminary Report, suggesting that he/she was not on the flight in any kind of pre-assigned troubleshooting role.

Yep.
Strange IMHO.

[xetroV]

I have been thinking further about what possibly caused the increase forces, as aerodynamic forces should not really be felt even on a 737 through the column unless the hyds are off, so could the Elevator Feel Shift that occurs when a stall is detected (I believe based on AOA input to the SMYD) be the cause of the increase of column forces, as this applies forces to the feel and centering unit to resist elevator up movement which could have effectively compounded the situation.

That's what I would expect as well, based on what I've heard happened some time ago on a 737NG aircraft. In that occurrence a damaged AoA vane resulted in erroneous airspeed indications, continuous stick-shaker, a FEEL DIFF PRESSURE warning and abnormally heavy control forces (especially noticeable during the flare). It certainly seems possible that in this Lion Air accident higher control columns due to FEEL DIFF PRESSURE compounded the situation caused by the automatic mistrim.

[wiedehopf]

The maintenance log from the new report seems interesting, so i'll just post it here as pictures.
https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/694x522/screenshot_from_2018_11_28_13_29_25_117ff81a1759dee02026d6c4 17361ce9e39ef33d.png
https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/633x645/screenshot_from_2018_11_28_13_29_53_5e6950530553739017bf49c4 45497f7bf730fe59.png
https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/668x679/screenshot_from_2018_11_28_13_29_58_32d5ad4dad6795c8fdb17aaa 1f57fe87c071c090.png
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/624x289/screenshot_from_2018_11_28_13_30_03_f7e72da8bbeca00e4ecaa5dd 9bca5481d8e92c8f.png

[threemiles]

Would it be fair to say that the previous crew worked an issue whilst not understanding the nature of the issue? In other words, they thought they had a trim runaway and flicked the stab trim switches. Luck rather than judgement?

A trim runaway is not taught to come in intervals. I guess you a right, probably pure luck.

You see the tech log from the previous flight, it says:
"IAS and ALT Disagree shown after take off","Performed flushing Left Pitot Air Data Module (ADM) and static ADM. Operation test on ground found satisfied."
"feel diff press light illuminate","performed cleaned electrical connector plug of elevator feel computer carried out. test on ground found OK"
There is nothing said about a trim or stab runaway or STS issue (the comment about STS trimming wrong was made to an IT system that you did not have access to before the flight)
You are mentally prepared for an IAS and ALT disagree, but somehow you expect it had been fixed.
You are not mentally prepared for a trim system to push the nose down on its own.
You pull, stick shaker goes off on rotation.
You get IAS disagree.
You remember the tech log saying ALT DISAGREE, your co asks ATC. They tell you you are at 900 feet. This seems to be in line to what you see.
You are somehow comfortable with the speed, you retract the flaps at 2000 feet.
You see the trim wheels spinning nose down in increments. This is the unexpected. You are surprised.
You pull and from your NG experience you expect the trim to stop, it does not, it keeps trimming.
You think trim down makes sense somehow to fight the stick shaker. But you have not heard of a 737 system that does that.
You think it is better to set flaps again.
Stick shaker remains. Does not make sense to you. But trim stops.
You are fixed on speed. You are uncertain which is the correct speed, left or right or stby. (The report suggests from the ATC tape that all three speed indications were different).
You are confused, you order flaps up again, you are concerned about speed.
Trim spins down again in intervals, you never heard of a 737 doing that before.
You think it is not a runaway stab, it is not STS, it does not stop when I pull, it is something different. But what?
You are fixed on not becoming too slow and stall and not too fast and break the plane.
You trim up, the plane trims down ...
You do not trust any indication in front of you.
You ask PNF to ask ATC about ground speed.
ATC tells you are at 322 kts, you are at 5000 feet. You think that's damned fast and not far away from 320 KIAS, damned fast,
You are fixed it is an UAS issue.
You have never heard of an automatic trim down function in intervals.

[patplan]

The maintenance log from the new report seems interesting, so i'll just post it here as pictures.
[note: I can't include pictures with url's on my reply just yet...] Please refer to post# 1740 by wiedehopf above...


It does start to sound more and more like the Sunwing's Max8 incident on 14th November 2018... Here from Flightglobal(dot)comSunwing 737 Max suffers spurious indication incidentCanadian investigators have disclosed that engineers replaced an air data computer on a Sunwing Airlines Boeing 737 Max 8 after the crew received spurious indications from the aircraft’s instruments.

The aircraft (C-GMXB) is less than six months old, having been delivered to Sunwing at the end of May.

It had been operating to Toronto from Punta Cana, in the Dominican Republic, when the incident occurred on 14 November.

Transportation Safety Board of Canada says the aircraft had been cruising at 35,000ft when the crew received “erroneous” indications on the captain’s side.

The first officer’s instruments, and the standby indicators, were functioning normally and the first officer took control of the aircraft.

It descended to 25,000ft as a precaution, in order to clear instrument meteorological conditions, but – as it passed 28,000ft – the weather radar and collision-avoidance system both failed. The aircraft was some 50nm north-west of Washington DC at the time.

The crew transmitted a ‘pan pan’ urgency call. The safety board says a left-side inertial reference system fault light also illuminated.

Investigators state that the flight proceeded to Toronto and landed without further incident, with no injuries among the 182 occupants.

Sunwing’s maintenance service replaced the left-side air data inertial reference unit (ADIRU) before returning the aircraft to operation.

[oversteer]

re. the maint log, I see lots of busywork and resetting things, but nothing to actually trace and fix a problem. Is that unfair, or is that typical in aircraft maintenance?

[FrequentSLF]

Just a SLF...
I read the whole thread and the report, and in the interim report there is no mention of MCAS....
just 2 cents from a reader

[gearlever]

Just a SLF...
I read the whole thread and the report, and in the interim report there is no mention of MACS....
just 2 cents from a reader

On board engineer also not mentioned....

[patplan]

There's no explicit mention of the flying spanner in the Preliminary Report, suggesting that he/she was not on the flight in any kind of pre-assigned troubleshooting role.
According to someone knowledgeable from the other forum, it's a common practice in Indonesia to send MX to the outpost.
Here's the full quote:
"In Indonesia, an onboard mechanic/engineer is nothing related to an aircraft having problems from the previous flight. They're there to release the aircraft should the aircraft develop a problem that can be deferred, should that problem occur at an outstation. Placing engineers at outstations can be more expensive than the loss of revenue from 1 seat plus flight pay, because aviation in Indonesia is very Jakarta-centric. Place someone at an outstation and the company has to fork out money for his accommodation and outstation pay, plus transportation to go back and forth to Jakarta or nearest maintenance base, and get a back up person. And you can't just get any engineer certified/rated on the type at an outstation to do stuff for you, the guy has to be approved on the type AND approved by the DGCA to do work for your airline. Now, Outstation based 3rd party contractors can be very expensive because of that. The same happens with dispatchers, and loadsheeters, it's not uncommon in Indonesia to see an engineer and a dispatcher onboard to outstations. Moves by the industry to make the use of certified 3rd party contractors and to make such a thing cheaper was effectively blocked by the previous transport minister in the aftermath of the Air Asia crash in end of 2014, because he seems to believe that safety should be expensive. Heck, he banned the use of centralized dispatch and tried to ban the use of approved weather information in computerized flight plans and dispatch briefs 'because they're not from the national weather bureau', despite the national weather bureau were giving out the same exact information and source as those within the airline dispatch briefs!"

[Station Zero]

re. the maint log, I see lots of busywork and resetting things, but nothing to actually trace and fix a problem. Is that unfair, or is that typical in aircraft maintenance?

It looks like that first flight when there was NCD on the Capt side a reset and test was done, FIM/TSM is followed. Pretty normal for a first occurence.

2nd flight they also had NCD on the Capt side but also picked up an issue with the AOA sensor. Again a reset was done fault cleared. Still faily common practice. Also perhaps a heads up was given to Bali to be ready for an AOA probe change.

3rd flight again NCD fault on on Capt side. Fault with AOA sensor reconfirmed and replaced. Following replacement aircraft released as tests passed. Still following fairly normal troubleshooting process.

4th flight IAS/ALT disagree reported, FIM/TSM consulted. Flush performed. Slightly different defect. Possibly engineer considered it unrelated to NCD on the previous flights.

Whats missing in these logs are stall warning reports going off and unknown trim commands. If its in the tech log the entries must be answered but telling engineers or putting it in a follow up report is no good. Doesn’t highlight the problem. Good example most airlines now don’t even have licensed engineers meet aircraft. So that message/conversation supposedly had by the crew on arrival of the fourth flight may have not even reached the engineer who did the work.

Simple, if it happens put it in the tech log... anywhere else there’s a risk it will get missed or forgotten. To flight crew from an engineer one of my pet hates is every once and a while you’ll get a post flight brief (when you get the chance to have one) and then find the defect discussed not in the log, should simply not happen.

[Ian W]

Quote:Would it be fair to say that the previous crew worked an issue whilst not understanding the nature of the issue? In other words, they thought they had a trim runaway and flicked the stab trim switches. Luck rather than judgement?A trim runaway is not taught to come in intervals. I guess you a right, probably pure luck.

I didn't realize that parsing words was one of the memory items. <<thinks> "The trim keeps on trimming nose down, but if I trim nose up it stops. But that cannot be a trim runaway as runaway means continuous and it is stopping every now time I trim back - therefore I will ignore the nose down trim and just pull harder... " Is that really how flight crew have been taught to think?

I would have thought that the response would be something along the lines of the successful previous flight. <<Thinks>> "Trim seems to have something wrong with it it keeps trying to trim down even though it stops when I trim nose up - CUT OFF trim switches OFF - that's better now to solve the other issues".

[gearlever]

I didn't realize that parsing words was one of the memory items. <<thinks> "The trim keeps on trimming nose down, but if I trim nose up it stops. But that cannot be a trim runaway as runaway means continuous and it is stopping every now time I trim back - therefore I will ignore the nose down trim and just pull harder...

The inaptly term "trim runaway" and its associated procedere is obviously used to blame the crew.

[DaveReidUK]

The maintenance log from the new report seems interesting, so i'll just post it here as pictures.

It's probably worth pointing out that in between the first (Tianjin-Manado) and second (Denpasar-Manado) flights whose logs are reproduced in the report, the aircraft actually flew three additional sectors (MDC-DPS-LOP-DPS).

In other words the first reported issue occurred seven sectors prior to the accident flight.

[bsieker]

That confuses me. When the PIC transferred control to the SIC SURELY the runaway trim should have stopped as the SIC's controls would be using the input from the correct AoA sensor ?

Why did it continue ?

.

This confuses me. The 737 (all versions) has direct mechanical flight controls (hydraulically assisted). They have no provision for "using" air data of any kind, except for the strength of the artificial feel system, which depends on airspeed (measured by an independent system.)

Even in the fly-by-wire A320 the flight control computers don't really care who makes the inputs. All computers evaluate inputs from both sticks and air data from all available sensors (indirectly via the ADIRUs).

The MCAS is also completely independent of pilot inputs (except trim inputs, but that only inhibits it for 5 seconds), and no system (except possibly force sensors at the control columns themselves) "knows" which pilot is making inputs. Sometimes both do, especially in cases of a badly mis-trimmed aircraft.

Bernd

[MickG0105]

From the Synopsis (quoted above) of today's Interim Report, about the previous flight:

The PIC noticed the aircraft was automatically trimming AND. The PIC moved the STAB TRIM switches to CUT OUT and the SIC continued the flight with manual trim without auto-pilot until the end of the flight.

​​​​​​And here's a good example of the problem with relying on synopses, executive, summaries and the like; sometimes they leave really important stuff out.

In the body of the report between 'The PIC noticed that as soon the SIC stopped trim input, the aircraft was automatically trimming aircraft nose down (AND).' and '... the PIC moved the STAB TRIM switches to CUT OUT.' there is, inter alia, this line;

After three automatic AND trim occurrences, the SIC commented that the control column was too heavy to hold back. (My bolding)

If you look at the version of FDR data presented to the Indonesian parliament (but curiously not in the preliminary report) it details control column force measurements. At the onset of JT43's MCAS event the control column forces rise rapidly to around 85 (out of 100) of whatever the units of measure are (can someone comment on that parameter and the units of measure?). In normal flight the forces bounce around in the 5 - 15 range so I'm assuming that 85 is, well, attention grabbing. For JT610, until the terminal 90 seconds or so, the forces never get above 50 units and tend to bounce around the 25 mark. I suspect that it was the control column forces that prompted the STAB TRIM switches being moved to CUT OUT on JT43, something that probably didn't occur on JT610 until the terminal (too late) phase.

It is one of a couple of differentiating factors that you can put down to JT43's decision to maintain their climb while dealing with their problem and JT610's decision to level off at 5,000 feet to deal with theirs. I strongly suspect that the latter was part of a briefed plan to deal with a possible UAS on take-off. I don't think that it is happenstance that JT610 '... requested approval to the TE controller “to some holding point”' as well as advising '... the TE controller that the intended altitude was 5,000 feet.' and that they re-retracted flap at 5,000 feet. There is level flight pitch and power data for holding, flaps up at 5,000 feet in the Flight With Unreliable Airspeed tables. In fact, 5,000 feet is the lowest altitude for which there is data for level flight.

[aterpster]

Precisely.

Given the CVR has not been recovered the only two people that definitively know exactly what transpired cannot defend themselves, is it not wiser to resist the arrogance afforded by 100% hindsight and wait for the CVR to be found?
Thank you Semreh, far more eloquently put.
By that reasoning a conclusion and probable cause is not possible without recovery of a readable CVR.

[FiveGirlKit]

There's no explicit mention of the flying spanner in the Preliminary Report, suggesting that he/she was not on the flight in any kind of pre-assigned troubleshooting role.

Maybe this was the engineer, logged as a crew member....

The Preliminary Report (78 pages) linked to above (http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf) is a very slow download this morning. ........

4 SAFETY RECOMMENDATIONS
The KNKT acknowledges the safety actions taken by Lion Air and considered that the safety actions were relevant to improve safety, however there still safety issue remain to be considered. Therefore, the KNKT issued safety recommendations to address safety issues identified in this report.
4.1 Lion Air Lion AirLion Air
04.O-2018-35.1
Refer to the CASR Part 91.7 Civil Aircraft Airworthiness and the Operation Manual part A subchapter 1.4.2, the pilot in command shall discontinue the flight when un-airworthy mechanical, electrical, or structural conditions occur.
The flight from Denpasar to Jakarta experienced stick shaker activation during the takeoff rotation and remained active throughout the flight. This condition is considered as un-airworthy condition and the flight shall not be continued.
KNKT recommend ensuring the implementation of the Operation Manual part A subchapter 1.4.2 in order to improve the safety culture and to enable the pilot to make proper decision to continue the flight.
04.O-2018-35.2
According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adult, one child and two infants. The voyage report showed that the number of flight attendant on board was six flight attendants. This indicated that the weight and balance sheet did not contain actual information.
KNKT recommend ensuring all the operation documents are properly filled and documented.

[climber314]

It is very unusual for Boeing to comment on this report given the investigation is ongoing?

https://www.flightglobal.com/news/articles/boeing-posts-detailed-response-to-jt610-preliminary-453970/

[Stone69]

I'm long retired and although I flew earlier models of the 737, I'm certainly not in the loop with this version. I have not had a chance to go through the full report. I read in one of the posts that the speed was 300+ kts and unless I've missed previous comments about this I'm surprised no one appears to have observed on this..... with a flight control problem the problems are greatly increased with so much speed and I would have thought they would have slowed to a more manageable speed. I know there was a lot going on and the numerous warnings going non-stop can be very distracting, but reduced IAS would have greatly reduced the control forces that they needed to use . I do understand that they were getting stall warnings and I would presume the stick shaker was active, but setting a thrust that would give a speed for arguments sake of 250 or so might have bought them more time and a better resolution to this might have been achieved....

[MickG0105]

It is very unusual for Boeing to comment on this report given the investigation is ongoing?

https://www.flightglobal.com/news/articles/boeing-posts-detailed-response-to-jt610-preliminary-453970/

Yes, it might have something to do with Boeing having just had their worst three week's trading in probably the past decade. In the two weeks from the FAA's release of their emergency AD on 7 November their share price was down about 14.5 per cent and they lost over $31B in market capitalisation. That sort of thing tends to galvanise Boards.

They've recovered some of that over the past three days to be down around 12.7 per cent since the 7th.

[FiveGirlKit]

The Preliminary Report (78 pages) linked to above (http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf) is a very slow download this morning. And many press reports of it are - imho - based on the press releases accompanying it, not the text itself. So, here's the Synopsis section of the English version of the original document (p. vii), followed by the Safety Recommendations (p.27). .......

4 SAFETY RECOMMENDATIONS
The KNKT acknowledges the safety actions taken by Lion Air and considered that the safety actions were relevant to improve safety, however there still safety issue remain to be considered. Therefore, the KNKT issued safety recommendations to address safety issues identified in this report.
4.1 Lion Air Lion AirLion Air
04.O-2018-35.1
Refer to the CASR Part 91.7 Civil Aircraft Airworthiness and the Operation Manual part A subchapter 1.4.2, the pilot in command shall discontinue the flight when un-airworthy mechanical, electrical, or structural conditions occur.
The flight from Denpasar to Jakarta experienced stick shaker activation during the takeoff rotation and remained active throughout the flight. This condition is considered as un-airworthy condition and the flight shall not be continued.
KNKT recommend ensuring the implementation of the Operation Manual part A subchapter 1.4.2 in order to improve the safety culture and to enable the pilot to make proper decision to continue the flight.
.......


What a strange recommendation. Leaving aside the fact that this aircraft flew multiple sectors with similar defects and whether this should have resulted in diversions or not, how can any pilot make a proper decision to continue on a flight based on this guidance? As the flight crew cannot measure 'airworthiness', then any mechanical, electrical or structural condition on the aircraft will lead to a diversion. Genny tripped off? => divert; lightning strike? => divert; UAS? => divert

Surely that is what the QRH is for - if it tells the crew to 'land as soon as possible' then Boeing consider the airworthiness is at stake. If the QRH leads to the condition being manageable, then why question the airworthiness?

[PEI_3721]

Re Boeing Comment, Flight Global, #1753
A somewhat disingenuous response from Boeing, typical of an attempt to downplay the validity of a formal report and offload responsibility to operators and crew (cf 737 AMS report Annex B).

The comments about AoA vanes are irrelevant, because even with the changed part the problem remained. Are there differences between new and refurbished parts? Does the Max use a different version? Do operators know?

Boeing introduces MCAS into the situation as though it were a known feature. Then refers to the runaway trim drill as though this advice should have been ‘deduced’ as relating to MCAS, but that information was only published after the accident.
Pilots did not know about MCAS; did the engineers, is there any specific trouble shooting guide for multiple disagree messages and trim problems, and relating this to MCAS?
There is no reference to a tech fault log for ‘MCAS FAULT’ as there are for Speed Trim, or Mach Trim; does such a parameter exist?

[hans brinker]

What a strange recommendation. Leaving aside the fact that this aircraft flew multiple sectors with similar defects and whether this should have resulted in diversions or not, how can any pilot make a proper decision to continue on a flight based on this guidance? As the flight crew cannot measure 'airworthiness', then any mechanical, electrical or structural condition on the aircraft will lead to a diversion. Genny tripped off? => divert; lightning strike? => divert; UAS? => divert

Surely that is what the QRH is for - if it tells the crew to 'land as soon as possible' then Boeing consider the airworthiness is at stake. If the QRH leads to the condition being manageable, then why question the airworthiness?

I don't want to be that guy that said "that would never happen to me", I just hope I would be able to handle the problem. As a flight crew you should be trained/have experience to "measure airworthiness" in cases where there is no direct guidance from the QRH. Lightning strike but all electronics remained online and all systems still work: continue, Gen tripped off but I have 2 or 3 more: continue, or only one remaining for night flight without close diversion airport: divert, UAS with stick shaker and un-commanded trim inputs: DIVERT. Just last week I heard a B737 declare an emergency due to airspeed disagree, and divert back, luckily there was nothing in the news so I can assume they landed without problems, but to continue with the stick shaker going of IMHO isn't good (yes, that crew did a great job saving the plane, but I do feel they made it harder for the next crew by not grounding the airplane and continuing).

[climber314]

I'm long retired and although I flew earlier models of the 737, I'm certainly not in the loop with this version. I have not had a chance to go through the full report. I read in one of the posts that the speed was 300+ kts and unless I've missed previous comments about this I'm surprised no one appears to have observed on this..... with a flight control problem the problems are greatly increased with so much speed and I would have thought they would have slowed to a more manageable speed. I know there was a lot going on and the numerous warnings going non-stop can be very distracting, but reduced IAS would have greatly reduced the control forces that they needed to use . I do understand that they were getting stall warnings and I would presume the stick shaker was active, but setting a thrust that would give a speed for arguments sake of 250 or so might have bought them more time and a better resolution to this might have been achieved....

That would be the logical thing to do. Recognizing that repeated uncommanded trim movements occurring in a regular pattern are indeed "continuous" would be another. Both actions would require logical thinking and what we used to call "flying by the seat of one's pants." Reading this thread it appears these concepts have died in favor of computers and checklists.

Is "it wasn't done because there's no checklist for it" a valid defense strategy? It appears Boeing's "Legal Eagles" are chomping at the bit to test that line in court with a long line of expert witnesses. First in that line will be the surviving Lion Air crew that took the appropriate action on the previous flight(s). The depositions would make compelling reading and something we are unlikely to ever see if the case even gets that far.

Once cockpit control is ceded to the realm of 1's and 0's, pilots become obsolete. Be careful what you wish (advocate) for.