Ethiopian airliner down in Africa

[yanrair]

[QUOTE=Tunkurman;10425639]Have you seen this 737 runaway stabilizer training on YouTube? OMG when that stab wheel is running there is not much time to react. Very scary. Look at the first officer trainee's reaction when the warning signals turn on and the plane dips. After seeing this I am so sad to see that these easy to access STAB TRIM switches could have saved both planes.

www.youtube.com/watch?v=3pPRuFHR1co

Thanks Tunkurman. Sort of proves what I have been saying all along. Notice that within 12 seconds the stabiliser is disabled by STAB OFF switches. The runaway STAB drill which is a memory checklist says
Condition "STAB TRIM RUNS CONTINUOUSLY" but if you note in this video, if is off after 12 seconds and before the plane can even begin to become unstable. The guys did not even spill their coffee and the remainder of the flight was very calm.
The word "CONTINUOUSLY" has always meant to me and I am sure thousands of 737 pilots to mean running in a manner not expected because in normal use it just moves in small increments either up or down. The moment it runs for more than a few seconds, that is a runaway.
If we are to start analysing every word in the Boeing QRH for its hidden meaning then the whole thing becomes a farce. During training we are shown that a stabiliser running is a very dangerous situation that needs instant memory action. It is this training that instills the knowledge of how to react - not a single word in a checklist.
There is a difference in the Lion Air in that there may have been stick shaker activity as well but multiple failures are a fact of life when flying and then QRH makes this very clear. "This document does not cover multiple failures.........." which must be dealt with by airmanship. No document could ever cover multiple failures.
Yanrair.

[yanrair]

BOEING QRH ADVICE ON NON NORMAL CHECKLISTS
Non–Normal Checklist Operation

Non–normal checklists start with steps to correct the situation. If needed, information for planning the rest of the flight is included. When special items are needed to configure the airplane for landing, the items are included in the Deferred Items section of the checklist. Flight patterns for some non–normal situations are located in the Maneuvers chapter and show the sequence of configuration changes.

While every attempt is made to supply needed non–normal checklists, it is not possible to develop checklists for all conceivable situations. In some smoke, fire or fumes situations, the flight crew may need to move between the Smoke, Fire or Fumes checklist and the Smoke or Fumes Removal checklist. In some multiple failure situations, the flight crew may need to combine the elements of more than one checklist. In all situations, the captain must assess the situation and use good judgment to determine the safest course of action.

[Cows getting bigger]

yanrair, you're really not getting it. By your line of argument, everything should be flying again in the morning, no changes and life moves on - "Nothing to see here". So, when the next crew creates another smoking hole are we just going to roll-out 'airmanship' again or are we going to do the SENSIBLE thing and identify/remove/mitigate the risk?

[Ian W]

[QUOTE=Tunkurman;10425639]Have you seen this 737 runaway stabilizer training on YouTube? OMG when that stab wheel is running there is not much time to react. Very scary. Look at the first officer trainee's reaction when the warning signals turn on and the plane dips. After seeing this I am so sad to see that these easy to access STAB TRIM switches could have saved both planes.

www.youtube.com/watch?v=3pPRuFHR1co

Thanks Tunkurman. Sort of proves what I have been saying all along. Notice that within 12 seconds the stabiliser is disabled by STAB OFF switches. The runaway STAB drill which is a memory checklist says
Condition "STAB TRIM RUNS CONTINUOUSLY" but if you note in this video, if is off after 12 seconds and before the plane can even begin to become unstable. The guys did not even spill their coffee and the remainder of the flight was very calm.
The word "CONTINUOUSLY" has always meant to me and I am sure thousands of 737 pilots to mean running in a manner not expected because in normal use it just moves in small increments either up or down. The moment it runs for more than a few seconds, that is a runaway.
If we are to start analysing every word in the Boeing QRH for its hidden meaning then the whole thing becomes a farce. During training we are shown that a stabiliser running is a very dangerous situation that needs instant memory action. It is this training that instills the knowledge of how to react - not a single word in a checklist.
There is a difference in the Lion Air in that there may have been stick shaker activity as well but multiple failures are a fact of life when flying and then QRH makes this very clear. "This document does not cover multiple failures.........." which must be dealt with by airmanship. No document could ever cover multiple failures.
Yanrair.

So to sum up. In the same situation with a Stab Trim repeatedly trimming nose down, you would NOT switch off the Stab Trim at the cut out switches because the NNC says 'continuous' and this is 'repeated' - really?

[TriStar_drvr]

Yea, so that's going to work, so at point of rotation, we get a vane split, and MCAS will still do its stuff while the crew are fumbling for the checklist.
But hey, we're Boeing and we've given you guys a little light.
From what others before have described, its still a sub-system reliant on its on-side sensor only, with no automatic cut out if the off-side sensor is in disagreement.

Ttfn
No. At rotation flaps would be extended. MCAS does not engage with the flaps extended.

[slfsteve]

But an AoA indicator will continue to be an option:

Doomed Boeing jets lacked 2 safety features that company only sold as extras

From the above article:
That's like BMW (other manufacturers are available) saying your car is the safest in class, you have 10 airbags installed but its £1000 to connect them up and use them. Surely the negative publicity and 300 people that have lost their lives should be more than enough to convince them to fit them.

[kaikohe76]

I think, we have gone far to far down the road of automation & the idea that the computer knows better than the Flight Crew.
As helpful as automatics & computerised technology etc are in aviation & other modes of transport, often the decision making & more importantly, the ability to carry out any subsequent action, is taken away from the Flight Crew.
The buck stops with the Pilots, give them the final authority & ability to `fly the aeroplane.

[BobM2]

Salute!
My fear is that some lurking here will think that we lost two planes and 300 passengers because incompetent crews did not simply turn off two switches within seconds of raising flaps at normal altitude and speed with the stall warning system telling them they were stalling and their airspeed was FUBAR.

Gums...

Why would a competent crew raise the flaps & try to continue the flight with a continuous stick shaker? Once the startle factor subsides & you realize the airplane is flying normally, just return & land. You could try adding more flap if it would make you feel better about stall margin. A little common sense goes a long way & MCAS never is activated.

[SLF3]

The fundamental problem is the location of the engines relative to the wings, not MCAS.

And the ethics of a once great company that thought a band aid (MCAS) on an open wound was OK.

And a regulator that abrogated it’s responsibility.

it will take more than a software patch and a little light to convince me the Max is safe.

What other design features did they self certify that should have been stillborn?

[Chronus]

March 21, 2019 / 8:34 AM / Updated an hour agoBoeing to add extra safety alarm in 737 MAX jets: FT(Reuters) - Boeing Co will install an extra safety alarm in the cockpits of all its 737 MAX aircraft after intense criticism in the wake of two fatal crashes, the Financial Times reported on Thursday.The planemaker will include a warning light in the new 737 Max planes and retrofit all existing ones, according to the report.The light will tell pilots if two key sensors do not agree, the FT reported, citing a person familiar with the situation.

Boeing did not immediately respond to a request for comment.

Shares of the company were down about 1 percent at $372.49 in morning trade

I wonder whether they might also thought about retrofitting potties in all the seats but decided on more woopsie noises instead.

[JLWSanDiego]

The fundamental problem is the location of the engines relative to the wings, not MCAS.

And the ethics of a once great company that thought a band aid (MCAS) on an open wound was OK.

And a regulator that abrogated it’s responsibility.

it will take more than a software patch and a little light to convince me the Max is safe.

What other design features did they self certify that should have been stillborn?
I'll be happy to get on it as soon as they release it and won't miss the company of the likes like you and others that believe this was an intentional act on Boeings part.

[Rated De]

I'll be happy to get on it as soon as they release it and won't miss the company of the likes like you and others that believe this was an intentional act on Boeings part.

It was not a single overt act. The genesis of this issue is more fundamentally systemic and that is the point to which the poster alluded.

Normalisation of deviance is an incremental and slow process.

The MCAS relationship to this systemic multiple failure is the symptom. How we as an industry, as a society with supposed regulatory checks and balances got here is the point.

That is why Diane Vaughan's book is such an insight into systemic issues.
If only it were so blatant and simple to characterise the evolution of process as intentional.

[atakacs]

But an AoA indicator will continue to be an option

This is nothing short of baffling. It would seem to be an extremely useful instrument to have in any aircraft. And given the current context around the 737MAX not to make a free upgrade is... well word really fail me

[OldnGrounded]

. . .you and others that believe this was an intentional act on Boeings part.

I don't think anyone believes that Boeing is intentionally crashing airplanes. OTOH, the implementation of MCAS (and its apparent increase in authority, late in the game), and the failure to document it or even to tell airlines and crews about it, were certainly intentional acts. And the fairly-obvious intent was to get the MAX flying without making the customers bear the cost burden of significant training.

It will probably be quite safe to fly the MAX aircraft again, once it's released -- especially because that's not likely to happen without a deep dive into the circumstances and decisions that led to the current situation and until the FAA, the DOT inspector general, the FBI and the relevant federal grand jury, international regulators and the airlines all sign off. And until pax are willing to board, of course.

[BobM2]

The fundamental problem is the location of the engines relative to the wings, not MCAS.

And the ethics of a once great company that thought a band aid (MCAS) on an open wound was OK.

And a regulator that abrogated it’s responsibility.


Well, let's see, the BAC 111 & DC-9, probably VC-10 & many other designs had some sort of stick pusher or mechanism to improve behavior at or near the stall. Were they equally unsafe designs? The Brits even required a stick pusher on 727 for a period of time, but later removed the requirement. Was it unsafe with or without the pusher? If one of these pushers activated at rotation due to malfunction, wouldn't that be a potentially worse failure than MCAS which does nothing until flaps are retracted at a decent height. The big point is flaps should never be retracted with a continuous stick shaker going off. The last thing you want is to remove your high lift devices. Just maintain configuration & return to land. I am sure Boeing never envisioned a crew cleaning up & trying to complete the flight with a continuous stick shaker.

[VFR Only Please]

Ignorant question: What is the practical use of a "disagree light"?? I suppose it means watch your workload increase as you continually assess your pitch attitude vis-à-vis the airflow in an aircraft with a natural tendency to pitch up markedly when power is applied.

Wouldn't it be smarter to have THREE AoA indicators (same principle as three attitude indicators) and have the system stick with the two that are agreeing?

[jagema]

Ignorant question: What is the practical use of a "disagree light"?? I suppose it means watch your workload increase as you continually assess your pitch attitude vis-à-vis the airflow in an aircraft with a natural tendency to pitch up markedly when power is applied.

Wouldn't it be smarter to have THREE AoA indicators (same principle as three attitude indicators) and have the system stick with the two that are agreeing?

The use is to know that something is up with the*sensor*itself, and to be especially skeptical of the output from other flight computers that factor in its data (ADIRU).*
The problem with adding more indicators (3, 4, 5...?) is that sometimes 2 of them get erroneous data and 1 is left with correct and it gets voted out (AF447).
There is no perfect system.

To others saying why not add the AoA indicator, in the B737 you could actually just use the difference between the FPV and the pitch angle to figure out your AoA if you wanted to (assuming, again, the data input into these is valid).

[BrandonSoMD]

This is nothing short of baffling. It would seem to be an extremely useful instrument to have in any aircraft.
Well, for most pilots in a commercial setting, AOA by itself means nothing.

For a military or airshow pilot who maneuvers to rather excessive AOAs regularly, or uses AOA as a primary reference for carrier landing, it makes a lot of sense to show some flavor of AOA. For example, nearly all Navy carrier aircraft are standardized to show something like15 units AOA in a properly configured approach, and something around 30 units AOA at stall. But there is no consistent units-to-degrees mapping, because the pilot doesn't care about absolutes; he just wants to know how close he is to some practical limit.

But for commercial pilots, AOA is relatively meaningless. In fact, it generally introduces needless concerns. What AOA is correct in a given setting: that's hugely dependent on a ton of factors. Which one (left or right) are you showing? How soon during takeoff roll should they come alive; with zero airspeed they can be at crazy values without any concern. They can be slightly different for various valid aerodynamic reasons (sideslip or roll rate). The only time you really care about AOA is when the two (or three or whatever) sensors dramatically disagree, or when they remain at excessive (very low or very high) values when they should not. That's all fairly easy to automatically check, if the FMC is programmed to do so.

WHY the FMC wasn't programmed to do so is a useful discussion. But showing the AOA to most pilots won't make things any better or safer. Principle #1 of human interface: only show what is important.

[Alchad]

I’ve agonised for a couple of days whether to post this question because having read all the posts on both this and the Lion Air thread, I’m very aware of the understandable annoyance the professional pilots and qualified aircraft industry types on this forum feel when posters are too lazy to read or even search for answers to a question which has been asked perhaps several times before, or ask dumb questions. But, as explained below, I’m very puzzled, I don’t think my question has been asked so I’ll risk being flamed.

It seems to be accepted that there are such similarities between the Indonesian and the Ethiopian crashes that – I suspect – a lot of people are assuming the cause of the accidents will also be similar. However, one difference between the two crashes which doesn’t appear to have aroused all that much speculation, at least as far as I can determine, is the fact that the Ethiopian 737 only managed to get to perhaps 1000 feet (according to Flightradar24), whereas the Indonesian 737 appeared to achieve 5000 feet and the pilots consciously settled for that altitude.

This is where my non- aircraft background becomes apparent and the reason for my question; which is basically what caused ET 302 to be unable to get above 1000 feet? My simplistic flying control knowledge can think of only two things which might be possible causes. (Ignoring engine problems as the Flightradar 24 data indicated airspeed was increasing throughout the flight). One problem could be with the flaps which are extended to give extra lift on take-off, so presumably not having them extended fully, or to the extent required – particularly at an airport with the elevation of Addis – would make the aircraft really struggle. But this is really very basic and surely would have been recognised very quickly and remedied. The only reason I suggest it is that flaps not extended is supposedly a parameter for MCAS to function.

The other reason for inability to gain altitude would be for the stabiliser to be trimmed in a way for it to be forcing the nose down – supposedly the faulty AoA/MCAS scenario which is suggested caused the Indonesian 737 crash. An argument against this being the cause is that it has been said in posts on this forum, but without actual proof as far as I have seen, that there is a low altitude limit below which MCAS does not operate. If 1000 feet is classed as low altitude, I don’t know what is.

This brings me to a point which was raised on this thread a long while back as to whether a coding error could have been made when the altitude limit (if it existswas coded into MCAS, and which would only be manifest at a high altitude airport like Addis (eg ASL used instead of AGL). Pretty basic error IF it was I know, but I’m reminded of the Mars Climate Orbiter fiasco in 1999

“A NASA review board found that the problem was in the software controlling the orbiter's thrusters. The software calculated the force the thrusters needed to exert in pounds of force. A separate piece of software took in the data assuming it was in the metric unit: newtons."

Again, apologies for probably dumb questions and a lack of knowledge which probably has eyebrows raised and heads shaken in disbelief, but I would appreciate it if anyone could be bothered to answer, or preferably offer more soundly based reasons.

Regards

[73qanda]

Thanks Brandon,
Am I correct in thinking that the Navy displays ‘units’ instead of degrees in order to create an appropriate scale?

[iwalkedaway]

Story presently being circulated by a body calling itself 'Patriots in America' - though whether that reflects upon the story itself, I am uncertain:

https://news.yahoo.com/pilot-hitched-ride-saved-doomed-053511780.html

iwalkedaway

[gums]

Salute!

As some have pointed out,
The big point is flaps should never be retracted with a continuous stick shaker going off. The last thing you want is to remove your high lift devices. Just maintain configuration & return to land. I am sure Boeing never envisioned a crew cleaning up & trying to complete the flight with a continuous stick shaker.

Yet the previous Lion flight did exactly that. Worse, they didn't log that or say what they did to maintain control - turning off the stab motor power and trimming with that wheel. They were "saved" by a thrid party who wasn't fighting 40 pounds of column and a vibrating yoke and going thru the stall and unreliable speed procedures. Manual trim on the yoke worked, so no big deal at first, other than the same dive that the next flight had when the flaps were retracted. Dunno why they retracted the flaps if that is the beginning of the NCC, but somehow the MCAS activated.

Gums...

[Organfreak]

Story presently being circulated by a body calling itself 'Patriots in America' - though whether that reflects upon the story itself, I am uncertain:

https://news.yahoo.com/pilot-hitched-ride-saved-doomed-053511780.html

iwalkedaway

Not new, previously discussed.

[BrandonSoMD]

Am I correct in thinking that the Navy displays ‘units’ instead of degrees in order to create an appropriate scale?
Yes. Because actual degrees of AOA really is meaningless, unless you're a "boffin" interested in things like measuring the field of view from the design eye position (more nose-up means less view), or for extreme cases the off-boresight capabilities of a missile attached to a launch rail, or things like that.

Admittedly off-topic for this MCAS problem, but still maybe of interest to some: Because a carrier-landing aircraft must land within a very narrow (~2 degree) range of angles relative to the flight deck to maximize its chances of capturing the arresting cable, and to make certain it's at an appropriate speed for not breaking itself or the cable, AOA is incredibly critical for carrier operations. However, the pilot still doesn't care what the actual values are. He needs an easy-to-remember, easy-to-read, and eminently predictable value as reference. So to provide nice round numbers to look at on displays, and to memorize for safety, all Naval aircraft AOAs are usually remapped to units with a rather arbitrary scale. And it varies with configuration; flap position, for example, significantly changes actual aerodynamic AOA at a given airspeed, but the airplane still has to land at the same nose-to-deck relative angle. So that remapping is variable. And it's typically indexed to 15 (plus or minus) for convenience and memorization. There may be simultaneously four or more different airplane types on a carrier (F-18E/F, F-18G, EA-6B, C-2, E-2, T-45, JSF), but all the pilots know "15 units" is the default landing AOA, more or less. The landing signals officer (LSO) handles all the types in a given day, and can't be bothered to remember 12.5 deg for this one, and 9.3 for that one, and.... Just make them all 15ish.

Similarly, the stall AOA varies with configuration and weight and other things... but keeping mental track of stall speed variations with weight and configuration is beyond the brainpower available. So it is also convenient to map stall speed to a fixed number - 30 units becomes convenient. And for a fighter pilot, stall AOA is incredibly important, because in a combat situation he may touch or even exceed that angle routinely (and safely).

At the low end, near-zero AOA in units generally corresponds to zero lift. Not really relevant much of the time, except during combat maximum pushovers, but still a useful metric.

Thus, the pilot always knows with a glance where he lies on the stall/landing/zero-lift continuum. It may have nothing to do with the actual AOA in degrees, but to his brain, that matters not at all.

To bring it back to MCAS and 737, adding true AOA - or even units AOA - to the flight deck of a commercial airliner is sort of irrelevant. They should NEVER approach stall; they better not be doing zero-lift pushovers; they don't have any extreme limits on AOA for touchdown or liftoff (other than perhaps avoiding tailstrike - but for that, pitch angle is the relevant data, not AOA.

Thus, from my point of view, adding AOA to commercial aircraft displays is "interesting but irrelevant." I challenge any pilot to tell me whether 12.3 degrees (for example) is meaningful by itself. It is only interesting if you also know that stall at your current weight and flap and gear setting is 19.7 deg, and the minimum load factor happens to be at 4.8 degrees, and if you also have the other AOA unit's value to compare to make sure they both agree within a reasonable limit. But making sense of all that data is just distraction from the real task of flying, and has no practical value. The only data you really need is the stall speed indication on the zipper, which does all that thinking for you.

[patplan]

More confirmation had came out. The dead head pilot indeed had prevented the plane from a possible crash on its penultimate flight.


Indonesian officials confirm presence of guest pilot who reportedly saved Lion Air plane day before its fatal crash

...Indonesian investigators on Thursday confirmed the presence in the cockpit of an off-duty pilot reported to have saved a troubled Lion Air flight the day before the same plane crashed on Oct. 29...
...“The third pilot, who has not been identified, was qualified to fly Max 8s and was deadheading aboard the Oct. 28 flight from Bali’s Denpasar airport to Jakarta,” said Soerjanto Tjahjono, the head of Indonesia’s National Transportation Safety Committee, referring to the practice of company employees traveling free of charge. “The aircraft encountered the same problems that appear to have caused it to crash a day later.”...
==========

- https://www.washingtonpost.com/world/asia_pacific/indonesian-officials-say-guest-captain-helped-steer-lion-air-plane-the-day-before-its-fatal-crash/2019/03/21/a268f0be-4bc3-11e9-b871-978e5c757325_story.html?noredirect=on&utm_term=.c1dd3c7c811c

[edmundronald]

Ok, so we're supposed to believe that the speeded-up certification process of the Max just let ONE bug through.
Or rather, the industry agrees that the best way to search for more bugs is to pull the grounding order, put pilots and SLF in a bunch of planes, and fix whatever happens next.

No wonder the rich refuse to fly commercial.

Edmund

[PaxBritannica]

I can't see that a quick fix for MCAS is going to reassure the travelling public, ie me. If MCAS was a bodge, how many other bodges were found acceptable? If this was the only place in the design where engineers were asked to take a 'small' risk, I suspect whispers would have gotten around long before the plane flew. Therefore, it's likely that it was just one of many other design 'solutions' where the idea of tolerable risk was normalised.

No software patch will fix systemic management hubris.

[PJ2]

Salute!
-----------------------------------------
I am trying to follow the ROE for our forum, but it's getting hard. I do not mean to diminish the length and breadth of experience that many pilots here have contributed to the discussion. But somethimes I get a little testy.

My fear is that some lurking here will think that we lost two planes and 300 passengers because incompetent crews did not simply turn off two switches within seconds of raising flaps at normal altitude and speed with the stall warning system telling them they were stalling and their airspeed was FUBAR.

The primary contributing factor to loss of control in the Lion crash and likely the Ethiopian one ,is gonna be the MCAS and its implementatio without fairly documenting it for the crews and not considering its activation at a corner of the envelope it was not intended for.

Gums...
Plus 1, gums

[WingNut60]

Current comment from Mr G Thomas quoting Greg Feith :

“However, the disturbing reality is that it took a pilot who was not in command of the flight, and just an observer, to tell the captain and first officer (who were supposedly trained, qualified, and experienced in the operation of the Boeing 737 MAX) what the issue was that resulted in the nose of the airplane pitching down (uncommanded pitch trim input also known as a “runaway trim”),” he said.
“The fact that the pilots who were in command of the flight and had access to the flight controls did not recognise nor properly respond to the “runaway trim” event is a testament of a more systemic problem within Lion Air.”
There are four failures that will cause a runaway trim on a standard 737 and five on a MAX version with the new background software to help the pilots fly the plane.It was not this software that caused the crashes, rather faulty sensors feeding it incorrect data. “
The flight crews’ failure to understand the issue and implement the proper corrective actions (which are memory items) is a symptom of a more serious problem and a likely explanation for the loss of the airplane if the accident crew reacted in the same manner – confused, panicked and hoping to find the answer in book rather than reverting to what they would have learned in training,” Mr Feith said.
On the Ethiopian crash, Mr Feith said that it was “also of interest that it took the Ethiopian investigative team five days to find a place to have the FDR and CVR data downloaded and converted to a medium that could be used by investigators to determine the initiating event that led the pilots to lose control of the airplane.”

If the quote is accurate then Mssrs Feith and Thomas should get on very well together.

[ivor toolbox]

No. At rotation flaps would be extended. MCAS does not engage with the flaps extended.

​​​​​​.. .and so.. our game crew retract the flaps, cos they are approaching Vfe in the aircraft config but the light is on? What happens next?
How the heck they ever got this through part 14cfr chapter 25 certification reliant on only 1 sensor?

Seems to me, in the rush to fix one certification issue, someone forgot the rest.

Ttfn

[601]

I have flown with AoA indicators on various corporate jets.
I found them extremely useful as a conformation for approach and departure speeds.
Why they are not standard on larger jets is puzzling.

If MCAS was a bodge, how many other bodges were found acceptable
Stick pushers, stick shakers, Stall Avoidance System on SA227 aircraft, etc..

[BobM2]

I can't see that a quick fix for MCAS is going to reassure the travelling public, ie me. If MCAS was a bodge, how many other bodges were found acceptable? If this was the only place in the design where engineers were asked to take a 'small' risk, I suspect whispers would have gotten around long before the plane flew. Therefore, it's likely that it was just one of many other design 'solutions' where the idea of tolerable risk was normalised.

No software patch will fix systemic management hubris.
It is amazing the amount of Boeing bashing on this forum. Boeing has made tens of thousands of safe & efficient airliners for more than half a century & that's why there are more Boeings than anything else. Every airplane design is a compromise that needs to be tweaked in one way or another to meet certification requirements. This process takes many months & involves much actual test flying. The much maligned MCAS was a tweak to meet an obscure certification requirement that was probably never going to be encountered in the life of the airplane. A lot of effort over decades has gone into making the aircraft as safe & foolproof in operation as possible. But, how do you design for an airline that flies an aircraft for three days with unreliable airspeed, maintenance that then compounds the problem with a bad AOA installation, & flight crews that still try to complete the flight with a continuous stick shaker? We don't know yet about Ethiopian, but if it was the same malfunction after all the warnings & publicity worldwide from Lion Air, then that is the height of incompetence.

[edmundronald]

Salute!
---snip---
I am trying to follow the ROE for our forum, but it's getting hard. I do not mean to diminish the length and breadth of experience that many pilots here have contributed to the discussion. But somethimes I get a little testy.

My fear is that some lurking here will think that we lost two planes and 300 passengers because incompetent crews did not simply turn off two switches within seconds of raising flaps at normal altitude and speed with the stall warning system telling them they were stalling and their airspeed was FUBAR.

The primary contributing factor to loss of control in the Lion crash and likely the Ethiopian one ,is gonna be the MCAS and its implementatio without fairly documenting it for the crews and not considering its activation at a corner of the envelope it was not intended for.

Gums...

Gums,

Mostly everyone here who is *not* a pilot realizes that the rushed certification of the Max is the real issue.

AFAIK nobody except Boeing lawyers and maybe the families is going to lay the blame on those pilots. Anyone, pilot or not, who reads the details of MCAS spooling up time and again in those cockpits thinks "there but for the grace of God go I".

But there is one interesting question though which is why those who survived such MCAS incidents prior to the Lion Air crash did not document them and raise a stink. Was it because they thought they had made an operational mistake?

Edmund

[frankpgh]

Running through TiVo tonight I came across the Air Disaster documentary on QF72. It's an A330 but at a high-level there is a lot in common with these recent tragedies.

https://www.smithsonianchannel.com/shows/air-disasters/free-fall/802/3467449

[krismiler]

I can’t see any foreign regulatory authority allowing the Max into its airspace without an extensive modification of the stall avoidance system and an in-depth training program for Pilots and engineers. A separate type rating covering the Max, rather than relying on a current B737 rating is a real possibility. A new type certificate might also be on the cards as well.

After two disasters, no authority is going to sign off on a solution unless it’s iron clad and well in excess of what’s required, a software update isn’t going to be enough. No pilot will be flying a Max until he’s demonstrated proficiency in dealing with any possible MCAS failures a simulator.

[HarryMann]

It is amazing the amount of Boeing bashing on this forum. Boeing has made tens of thousands of safe & efficient airliners for more than half a century & that's why there are more Boeings than anything else. Every airplane design is a compromise that needs to be tweaked in one way or another to meet certification requirements. This process takes many months & involves much actual test flying. The much maligned MCAS was a tweak to meet an obscure certification requirement that was probably never going to be encountered in the life of the airplane. A lot of effort over decades has gone into making the aircraft as safe & foolproof in operation as possible. But, how do you design for an airline that flies an aircraft for three days with unreliable airspeed, maintenance that then compounds the problem with a bad AOA installation, & flight crews that still try to complete the flight with a continuous stick shaker? We don't know yet about Ethiopian, but if it was the same malfunction after all the warnings & publicity worldwide from Lion Air, then that is the height of incompetence.

Yes, though that Bob is why you as a manufacturer should Tell them what the heck you've done to the stab trim circuit... which it sounds ominously like was poorly or undocumented. Nor we are told, was much if anything made of it as a 'difference' feature in any training (?).

I've a rare option Ford Focus Ghia without ABS brakes, which i hate (ABS that is)...
When I maybe have to buy one with ABS I'd hope the Driver's Handbook actually mentioned the fact !

[RUTUS]

It seems to be accepted that there are such similarities between the Indonesian and the Ethiopian crashes that – I suspect – a lot of people are assuming the cause of the accidents will also be similar. However, one difference between the two crashes which doesn’t appear to have aroused all that much speculation, at least as far as I can determine, is the fact that the Ethiopian 737 only managed to get to perhaps 1000 feet (according to Flightradar24), whereas the Indonesian 737 appeared to achieve 5000 feet and the pilots consciously settled for that altitude.

This is where my non- aircraft background becomes apparent and the reason for my question; which is basically what caused ET 302 to be unable to get above 1000 feet?

Minimum flap retraction altitude for B737 is 400 ft so possible MCAS-activation at low altitude.

Also there seems to be an assumption that the MCAS would bug them continuously after that unless they switched trim off. In the LionAir crash prel report a difference of 20 deg throughout the flight and stick shaker active for most of the rest of the flight. I e there seems to be a systematic error in one of the AoA sensors that would only activate shaker when they flew with an actual AoA above a certain level. Same would then hold true for MCAS-activation.

With just the "right" systematic error in one of the AoA-sensors ET302 could have been perfectly trimmable flying at constant altitude with AoA below the threshold. As soon as they tried to ascend increasing true AoA to proper MCAS-activation angle minus systematic offset they would have been "pushed down" but could have trimmed out again. So they are in a "perfectly good airplane" as long as they zoom along at breakneck speeds at a constant altitude above sea level. If ground level (above sea level) increases they would be destined to meet with terra firma sooner or later...unless they used the elevator...and got hammered by MCAS again.

And for the complaints about their speeding: Thrust reduction? No go. You'd sink unless you increased AoA above the threshold...and got hammered again.´´´´´´´

[BobM2]

Gums,


But there is one interesting question though which is why those who survived such MCAS incidents prior to the Lion Air crash did not document them and raise a stink. Was it because they thought they had made an operational mistake?

Edmund
Nobody has reported a MCAS event prior to Lion Air. Where did you get such a story?

[b1lanc]

I can't see that a quick fix for MCAS is going to reassure the travelling public, ie me. If MCAS was a bodge, how many other bodges were found acceptable? If this was the only place in the design where engineers were asked to take a 'small' risk, I suspect whispers would have gotten around long before the plane flew. Therefore, it's likely that it was just one of many other design 'solutions' where the idea of tolerable risk was normalised.

No software patch will fix systemic management hubris.

Really? Do you think a crew will board then? As has been posted in many topics, most pax have no clue what aircraft type they are flying on. They fly by the dollar. If the crew boards, so will the pax.

[BobM2]

Yes, though that Bob is why you as a manufacturer should Tell them what the heck you've done to the stab trim circuit... which it sounds ominously like was poorly or undocumented. Nor we are told, was much if anything made of it as a 'difference' feature in any training (?).

You're right, Harry, Boeing should have told the crews. "If you're out doing flaps up stalls in your MAX, you will get an intervention from MCAS. Also, if you get a continuous stick shaker on take off rotation & are stupid enough to accelerate, clean up the flaps, & try to continue the flight with the stick shaker, you MAY get a repeated intervention from MCAS 'cause it thinks the airplane is stalling".

[pilot9250]

Suppose MCAS becomes unavailable during flight e.g. due to Stab trim deactivation. The MAX’s flight characteristics in approach to stall scenarios proved not certifiable without MCAS as a fix. I’d like to ask the ones in the know (FcEng and others) how critical the loss of MCAS in flight would be in real life. For example, encountering a flight upset with approach to stall, how easily can this be recovered without MCAS? How was the risk of such an event assessed? Was it demonstrated in test flights? Why was it determined there would be no need to train flight crews on the simulator for the changed handling outside the certification parameters?

In a previous post I assumed such a scenario to be critcal, but perhaps it isn’t? Thanking you in advance for shedding light on this issue.

I have asked this before but in a different way.

Is there any recorded valid activation of MCAS?

Is it even possible that we have a tick box implementation for certification purposes that has achieved nothing other than promote accidents?

[Rananim]

But, how do you design for an airline that flies an aircraft for three days with unreliable airspeed, maintenance that then compounds the problem with a bad AOA installation, & flight crews that still try to complete the flight with a continuous stick shaker? We don't know yet about Ethiopian, but if it was the same malfunction after all the warnings & publicity worldwide from Lion Air, then that is the height of incompetence.

Hard not to concur.A lot of Boeing bashing going on here.
Life isnt black and white like that.
Its not all Boeings fault.Its not all the pilots fault for not cutting out those 2 switches.
I think it was mentioned by FCENG84 that designers design safe
in the knowledge that airline pilots have a minimum standard
of airmanship and that line engineers know their job and
follow the MEL.Lionair's reputation is not a good one.
And frankly speaking,neither is Ethiopian.So its a difficult.situation
to analyse.Do I think either accident could have
happened in Southwest?No,I do not.

Boeing obviously considered the consequences of a faulty
sensor and its effect on MCAS prior certification.They knew
this would occur at flap retraction at low altitude and would result
in stick shaker,unreliable airspeed and considerable and
unexpected nose down trim all at once.They decided
that this failure scenario was one step shy of "catastrophic".
and that a crew would cope.Maybe they under-rated the
effect of the stick shaker on the pilots ability to react in the
correct manner.Those shakers can scramble your brain
and degrade reaction time and pilot response.They can cause
startle factor which I know is sometimes derided as an
excuse for poor airmanship.But it can happen and it can affect
quite a few crews.
Whats not okay is if they deliberately downgraded it below
"catastrophic" to rush certification and avoid further analysis
and fine-tuning of the design.If they genuinely miscalculated
the effect of unwanted MCAS at low altitude and so designed
it to work off one sensor only,then its just an error.
However,if they downgraded it below "catastrophic" to rush
certification then it was a cynical decision and thats negligence.

[OldnGrounded]

Boeing obviously considered the consequences of a faulty
sensor and its effect on MCAS prior certification.They knew
this would occur at flap retraction at low altitude and would result
in stick shaker,unreliable airspeed and considerable and
unexpected nose down trim all at once.

It's not obvious to me that Boeing considered those possible consequences and it's not at all clear that any or every failure of an AoA sensor -- or another fault in raw data or processing upon which MCAS activation is dependent -- would result in identical systems behaviors, always in a single phase of flight. In fact, with all due respect, I seriously doubt whether either of those assumptions is defensible.

[BobM2]

Boeing obviously considered the consequences of a faulty
sensor and its effect on MCAS prior certification.They knew
this would occur at flap retraction at low altitude and would result
in stick shaker,unreliable airspeed and considerable and
unexpected nose down trim all at once.
Rananim, a faulty AOA that would activate MCAS would produce a continuous stick shaker at rotation, not on flap retract. Why would any right-thinking pilot ever attempt to retract flaps & continue the flight with an active stick shaker, even if unaware that MCAS exists?

[andihce]

SLF here, but with a background in experimental physics dealing with personnel and equipment safety in large-scale, hazardous experimental situations.

Assuming that both 737 MAX crashes were the result (in large part) of faulty AOA probe data, then we already know, from sad experimental evidence, that relying on one probe is unacceptable. With 2 hull losses in N (? - not a terribly large number) flights of this aircraft, the reliability statistics are hardly at the flight-safety-critical level.

Having an "AOA disagree" warning or AOA readouts for pilots is not necessarily going to help. I suggest that as a minimum, with only two AOA probes (and that should be the minimum number), that MCAS should shut itself down in an AOA disagree situation (with notification to the pilots). The principle here is "primum non nocere". The aircraft is not going to have an upset just because MCAS is not there on these rare occasions.

Furthermore, if AOA data is going to be used in this way (possibly killing people if it is wrong), further sanity checks should be applied to the probe data (e.g., AOA pre-rotation on take-off, consistency with inertial and other air data, whatever).

MCAS as currently implemented seems like a horrid kluge to a non-pilot, but I'm inclined to believe, from what I've read here, that with better engineering (and not too drastic a change) the 737 MAX could be restored to safe service.

[Rananim]

Rananim, a faulty AOA that would activate MCAS would produce a continuous stick shaker at rotation, not on flap retract. Why would any right-thinking pilot ever attempt to retract flaps & continue the flight with an active stick shaker, even if unaware that MCAS exists?
BobM2
Yes you are of course correct but that doesnt alter the fact that crews who
elect to retract flaps and climb to MSA as per SOP would face
all 3 concurrently with flaps up.You assert that no crew would retract
flaps and climb to MSA to perform checklists and I hope you
are right.I agree with not retracting flaps and just landing from circuit height
but I dont assume thats what all crews would do,especially
if unfamiliar with MCAS.

[BobM2]

BobM2
Yes you are of course correct but that doesnt alter the fact that crews who
elect to retract flaps and climb to MSA as per SOP would face
all 3 concurrently with flaps up.You assert that no crew would retract
flaps and climb to MSA to perform checklists and I hope you
are right.I agree with not retracting flaps and just landing from circuit height
but I dont assume thats what all crews would do,especially
if unfamiliar with MCAS.
You are right. At least 2 crews, maybe 3 did accelerate, clean up, & got into a worse mess. These occurrences were all in good weather with long runways immediately available. There was no need to climb to an MSA, but you could if you felt a need to troubleshoot or read checklists. The main thing is don't change the take-off configuration as long as the airplane is flying normally. You are not paid or qualified to be a test pilot, especially with passengers on board.

[pilot9250]

You are right. At least 2 crews, maybe 3 did accelerate, clean up, & got into a worse mess. These occurrences were all in good weather with long runways immediately available. There was no need to climb to an MSA, but you could if you felt a need to troubleshoot or read checklists. The main thing is don't change the take-off configuration as long as the airplane is flying normally. You are not paid or qualified to be a test pilot, especially with passengers on board.

What we can only conclude as a design flaw requires recurring RTO above Vr?

Wrong focus.

[runner1021]

You are right. At least 2 crews, maybe 3 did accelerate, clean up, & got into a worse mess. These occurrences were all in good weather with long runways immediately available. There was no need to climb to an MSA, but you could if you felt a need to troubleshoot or read checklists. The main thing is don't change the take-off configuration as long as the airplane is flying normally. You are not paid or qualified to be a test pilot, especially with passengers on board.
In regards to cleaning up and accelerating, if one is dealing with stall indications and unreliable airspeed on climb out, the natural tendency would be to ensure you've got sufficient airspeed. Speed is life, in most cases. It would appear, unfortunately, that this was not one of those cases.

[dinbangkok]

Hard not to concur.A lot of Boeing bashing going on here.
Life isnt black and white like that.
Its not all Boeings fault.Its not all the pilots fault for not cutting out those 2 switches.
I think it was mentioned by FCENG84 that designers design safe
in the knowledge that airline pilots have a minimum standard
of airmanship and that line engineers know their job and
follow the MEL.Lionair's reputation is not a good one.
And frankly speaking,neither is Ethiopian.So its a difficult.situation
to analyse.Do I think either accident could have
happened in Southwest?No,I do not.

Boeing obviously considered the consequences of a faulty
sensor and its effect on MCAS prior certification.They knew
this would occur at flap retraction at low altitude and would result
in stick shaker,unreliable airspeed and considerable and
unexpected nose down trim all at once.They decided
that this failure scenario was one step shy of "catastrophic".
and that a crew would cope.Maybe they under-rated the
effect of the stick shaker on the pilots ability to react in the
correct manner.Those shakers can scramble your brain
and degrade reaction time and pilot response.They can cause
startle factor which I know is sometimes derided as an
excuse for poor airmanship.But it can happen and it can affect
quite a few crews.
Whats not okay is if they deliberately downgraded it below
"catastrophic" to rush certification and avoid further analysis
and fine-tuning of the design.If they genuinely miscalculated
the effect of unwanted MCAS at low altitude and so designed
it to work off one sensor only,then its just an error.
However,if they downgraded it below "catastrophic" to rush
certification then it was a cynical decision and thats negligence.

Regardless of whether you're a pilot or not, surely the question that needs to be answered is simple: How is it remotely OK for Boeing (or any other manufacturer), to sell a passenger aircraft that needs software to correct an aerodynamic imbalance in the design of the aircraft (prone to pitching up)?

[SteinarN]

Well, for most pilots in a commercial setting, AOA by itself means nothing.

For a military or airshow pilot who maneuvers to rather excessive AOAs regularly, or uses AOA as a primary reference for carrier landing, it makes a lot of sense to show some flavor of AOA. For example, nearly all Navy carrier aircraft are standardized to show something like15 units AOA in a properly configured approach, and something around 30 units AOA at stall. But there is no consistent units-to-degrees mapping, because the pilot doesn't care about absolutes; he just wants to know how close he is to some practical limit.

But for commercial pilots, AOA is relatively meaningless. In fact, it generally introduces needless concerns. What AOA is correct in a given setting: that's hugely dependent on a ton of factors. Which one (left or right) are you showing? How soon during takeoff roll should they come alive; with zero airspeed they can be at crazy values without any concern. They can be slightly different for various valid aerodynamic reasons (sideslip or roll rate). The only time you really care about AOA is when the two (or three or whatever) sensors dramatically disagree, or when they remain at excessive (very low or very high) values when they should not. That's all fairly easy to automatically check, if the FMC is programmed to do so.

WHY the FMC wasn't programmed to do so is a useful discussion. But showing the AOA to most pilots won't make things any better or safer. Principle #1 of human interface: only show what is important.

Well, for most pilots, and in a normal flying mode you are correct. But we are talking about when somethings going haywire.When you are not sure what the aircraft is doing, you might not be sure if you actually are stalling, you might not be sure about your airspeed. And we could go one step further for the more competent pilots, you wonder why just ONE stick shaker has activated, you wonder what the heck is the reason for the stabilizer trimming like crazy all the time, you wonder what is the reason for the IA showing different values on the left vs right display, and possibly reasons for other fault messages/warnings.

In such a scenario a displayed value of the AoA would in my opinion be VERY helpfull for the pilots in order to figure out what is really going on with the aircraft and what it's performance is.

[Mike Flynn]

Reuters latest on Boeing cancelled orders

JAKARTA (Reuters) - National carrier Garuda Indonesia has sent a letter to Boeing Co asking to cancel an order for 49 737 MAX 8 narrowbody jets, Garuda Chief Financial Officer Fuad Rizal said on Friday.

The airline could switch the order, valued at $6 billion at list prices, to other Boeing models, Rizal told Reuters. He said negotiations with Boeing were ongoing and Airbus SE jets were not under consideration.

Garuda is the first airline to publicly confirm plans to cancel an order for the troubled jets after the second crash of a 737 MAX 8, which killed 157 people in Ethiopia last week.

Indonesian rival Lion Air has been reconsidering its orders since one of its 737 MAX jets crashed in October.

Garuda CEO Ari Askhara told Reuters on Friday that customers had lost trust in the 737 MAX 8.

The airline has only one in its fleet at present.

“They have been relooking at their fleet plan anyway so this is an opportunity to make some changes that otherwise may be difficult to do,” CAPA Center for Aviation Chief Analyst Brendan Sobie said.

Askhara said last week it was possible it would cancel the order for 20 of the jets, with a final decision depending on what the U.S. Federal Aviation Administration does after the Ethiopian crash.

He told Reuters before the crash that the airline had decided to reduce the Boeing 737 MAX order from 49 by swapping some to widebody Boeing models.

Boeing declined to comment on customer discussions.

[Rated De]

Minimum flap retraction altitude for B737 is 400 ft so possible MCAS-activation at low altitude.

This.

High AOA (sensor fault) is the first condition
Manual flight (is the second condition)

Taught to clean up and find altitude, clear the MSA is what all pilots are taught to do.
Induce another failure, like an engine failure at V1, at 400' commence the drills, up go the flaps.

3. Flaps are up (Third condition is met)

MCAS activates. Now things get sporting. Quite possibly a procedure trained for by pilots worldwide was just complicated and made more difficult by doing what all pilots do with a sub system bought into the mix that has a single point of failure a solitary AOA sensor.
That is bad process.

[ChicoG]

Reuters latest on Boeing cancelled orders

Lion Air are very displeased with Boeing and they have another 187 to come.

[ChicoG]

Regardless of whether you're a pilot or not, surely the question that needs to be answered is simple: How is it remotely OK for Boeing (or any other manufacturer), to sell a passenger aircraft that needs software to correct an aerodynamic imbalance in the design of the aircraft (prone to pitching up)?

And then make alarms an "optional extra"!

[Chesty Morgan]

Rananim, a faulty AOA that would activate MCAS would produce a continuous stick shaker at rotation, not on flap retract. Why would any right-thinking pilot ever attempt to retract flaps & continue the flight with an active stick shaker, even if unaware that MCAS exists?
Do we know when the fault in the AoA system occured?

[FCeng84]

Regardless of whether you're a pilot or not, surely the question that needs to be answered is simple: How is it remotely OK for Boeing (or any other manufacturer), to sell a passenger aircraft that needs software to correct an aerodynamic imbalance in the design of the aircraft (prone to pitching up)?

There are several exhibits of this out in the market: 777, 787, and soon to come 777X. These models all have full FBW systems that enable the bare airframe to have aerodynamic characteristics that with out any control system functionality at all would not be certifiable. The motivation is that these models have been able to design in improved performance because they have been able to take advantage of control system functions to yield certifiable handling qualities. The key, of course, is that the availability and reliability including any failure mode effects must be acceptable. Certification requirements cover all aspects of this.

[SteinarN]

Chilling reading by Bjørn at Leeham explaining that the elevator blow back problem - which our excellent Fceng84 explained in details a few pages ago - might have been a significant contributory cause for both of these crashes.

I know all about blowback problems of elevators. It was the most dangerous shortcoming of the fighter I flew, the SAAB J35 Draken. Even more dangerous than its famous “Super stall”, a Pugachev Cobra like deep stall behavior the aircraft would only exit from if you “rock it out” of the stall (more on this some other time). While “Super stall” is scary, Blowback is deadly.

What could have been done?
The only remedy to the blowback induced dive would have been a full nose up trim application, for a long time (throttles to idle and air brake would also have helped). But the reaction to trim is slow and the aircraft was now heading for earth. The reflex is not to trim but to pull for all there is, by both pilots, you have seconds to stop the dive. It didn’t help. If this is confirmed as the scenario for the end of both JT610 and ET302 I wonder why the danger of flying to fast at low altitude, while sorting out a raiding MCAS, was not communicated when the MCAS Airworthiness Directive was released after the JT610 crash. MCAS forcing the stabilator to full nose down should not have doomed JT610 or ET302. Their applied speed margins did. The JT610 crew knew nothing about MCAS and a potential blowback problem. The ET302 crew knew about the MCAS problem but not about the danger of flying to fast while sorting MCAS.

I have checked with longtime pilots of the 737. They have not heard of a Blowback problem when flying at elevated speeds at low altitude.

And before MCAS there was no reason to, it was beyond normal flying practice. But the JT610 investigators saw what can happen when you run into the MCAS rodeo. Why didn’t they warn to keep speeds within normal speed range?


Bjørn at Leeham (https://leehamnews.com/2019/03/22/bjorns-corner-the-ethiopian-airlines-flight-302-crash-part-2/)

[PEI_3721]

Do we know when the fault in the AoA system occured?
When, see FDR analysis. Stick shake a function of WoW or Ralt.
But where did the fault occur, and why did the AoA value ‘fail’ up .
https://www.pprune.org/10424987-post298.html

[Mark in CA]

Washington Post reporting on FAA complaints years ago about allegedly flawed training programs and poor safety procedures at Ethiopian Airlines.

Ethiopian pilots raised safety concerns years before fatal crash, records show (https://goo.gl/rDxpKn)

One pilot said the airline didn’t “have the infrastructure” to support the fleet of Boeing and Airbus jets it ordered, and alleged the airline had a “fear-based” management culture in which “safety is being sacrificed for expansion and profit margin.” The pilot also accused the airline of failing to update pilot manuals and leaving out certain checklists designed to help pilots respond to “non-normal” situations. Another pilot criticized Ethiopian regulators for maintaining lax standards with respect to crew flight and rest time. The FAA’s data does not identify the pilots by name.

[fgrieu]

Do I get it correctly that "blowback" of the elevator would be a situation when the actuators for the elevator are not powerful enough to overcome the aerodynamic forces on the elevator, due to high speed (and perhaps an already high angle)?

Is there any indication that a 737 elevator (with nominally working actuators) can be in this situation in some flight regime?

[PEI_3721]

Do I get it correctly that "blowback" of the elevator would be a situation when the actuators for the elevator are not powerful enough to overcome the aerodynamic forces on the elevator, due to high speed (and perhaps an already high angle)?
Is there any indication that a 737 elevator (with nominally working actuators) can be in this situation in some flight regime?

See, related: https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html

and https://www.pprune.org/tech-log/619675-b737-runaway-stabilizer-nnc.html

[Uplinker]

.

[It is amazing the amount of Boeing bashing on this forum. Boeing has made tens of thousands of safe & efficient airliners for more than half a century & that's why there are more Boeings than anything else.]

They pushed the MAX too far, a quick band aid to counter the neo.

A software fix to counter an unstable platform...

tale of the tape...why is MCAS required for certification?

In my humble opinion, they should have started again with the 73 about the time of the -300/-400 and completely redesigned it. As it stands, they seem to have cobbled together systems as they became available or desirable and bolted them where they could find space. (The “computer fuel summing unit” - can’t remember its exact name - is fixed outboard above the F/Os head - why not in the avionics bay?). The F/Os seat cannot be moved vary far back because of the C/B rack behind it. The elevator feel unit has its own pitot probes each side of the fin.

I only have experience of the -300/-400, but that aircraft is a mish-mash of mechanical and electronic devices, seemingly not properly integrated, but just about working. The ‘Classic’ autopilot does not trim ailerons or rudder, so when you take out the autopliot you often have to spend a mile or so on short finals getting the thing trimmed. The Cockpits of the -300/-400 look as if they were “designed” by firing a shotgun at a blank panel, and fitting the instruments and indicators whereever there was a handy hole. Generators have to be manually switched on to the buses. Later models without the round generator dials, still use the old panels with the cut-outs for the round dials rather than making a new panel....how cheap is that?

It seems to me that as each new requirement or problem came along, instead of doing a redesign, Boeing developed a standalone fix or widgit to solve the problem - but they don’t appear to have always thought it through in terms of the way the whole aircraft works, or how the pilots would interface with it.

As to why the 73 is so popular, I think South West have a lot to do with that, (they are also indirectly partly responsible for the arrested development of the 73). I have been told that Boeing also have some very creative fleet purchasing schemes for airlines.

As to MCAS, instead of affecting the THS trim, why not simply have it modify the elevator feel at hiigh AoA - which is, after all, the problem caused by the engine nacelles. Or insert a gentle down input to the elevators? But not the trim. Secondly, why have only one AoA probe, or even two? For such a critical device, why not have five?

[hum]

the stall AOA varies with configuration and weight and other things...

I agree stall AoA varies with configuration, Mach # and others however, I don’t think that, given all other values constant, weight changes AoA. Ie, a wing stops being a wing at the stall AoA, regardless of how much lift is demanded..

I also agree that simply introducing an AoA indication in the cockpit of an airliner will not benefit crews without some education. However, AoA is a fundamental parameter, if it is displayed and obviously in error (deduced by crew education) then it could assist in fault finding. One of the key parts of UPRT (being introduced as mandatory in Europe for all new CommerciL licence training from Dec 2019) is AoA & G awareness. I believe it would be of huge benefit if commercial aircraft had AoA displayed and pilots were educated in its interpretation from day 1 of flying training. P

[Volume]

There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource.
There needs to be an FMEA which understands the Pilot as being part of the system !
There is extensive FMEA/SSA work done for development and certification of aircraft, but it focusses on the physical systems and makes some simplistic/philosophical assumptions for the pilots. We need to better understand the Pilot as one System out of many which need to work together in an aircraft, which can fail in various ways, can recieve wrong data, can misinterpret things, can follow an inappropriate algorithm (=SOP) etc. Just because the system "pilot" may react sometimes in an unpredictable way is no reason to not include it in the analysis.

We have learned a lot about human factors in the last 20 years, but aircraft design still uses the same man-machine-interfaces like 50 years ago. Some >30 year old design (Airbus A320) is "modern" compared to many other aircraft still being built...

[groundbum]

I've just done a search on pprune for MCAS and the first mention of the phrase at all was December 2018 when news of the Lion Air crash investigation got out. So for a group of several thousand professional fairly nosey/inquisitive bunch of pilots worldwide there hadn't been a sniff of anybody coming across MCAS in some obscure manual and asking what is was. Says it all really.

G

[bsieker]

Regardless of whether you're a pilot or not, surely the question that needs to be answered is simple: How is it remotely OK for Boeing (or any other manufacturer), to sell a passenger aircraft that needs software to correct an aerodynamic imbalance in the design of the aircraft (prone to pitching up)?

By the same reasoning why it was ok in earlier (think 707) models to include an analogue electronic device that does almost exactly the same thing, to bring the 707 in line with the same certification requirement.

Why would it not be ok? All fly-by-wire airliners, i. e. practically all that were developed since the late 1980s, cannot demonstrate unassisted control forces, because it is all artificial. That is even true for fully conventionally controlled aircraft such as the 747. Even the Comet (which predates the 707) had no aerodynamically created control forces, but fully powered flight control surfaces and only a spring-loaded artificial feel system.

Bernd

[Ian W]

Ok, so we're supposed to believe that the speeded-up certification process of the Max just let ONE bug through.
Or rather, the industry agrees that the best way to search for more bugs is to pull the grounding order, put pilots and SLF in a bunch of planes, and fix whatever happens next.

No wonder the rich refuse to fly commercial.

Edmund

Actually, the rich may not fly commercial but they fly the same aircraft both A and B sell versions of their airliners that have been fitted out as business jets. See Boeing Business Jets (https://en.wikipedia.org/wiki/Boeing_Business_Jet)


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/299x240/300px_boeing_27s_commercial_aircraft_in_bbj_livery_79aebfbc1 7521e943791d0ace9b17b29491e639a.jpg
From wikipedia
I have no doubt that there are already 737Max Business Jets.

[edmundronald]

By the same reasoning why it was ok in earlier (think 707) models to include an analogue electronic device that does almost exactly the same thing, to bring the 707 in line with the same certification requirement.

Why would it not be ok? All fly-by-wire airliners, i. e. practically all that were developed since the late 1980s, cannot demonstrate unassisted control forces, because it is all artificial. That is even true for fully conventionally controlled aircraft such as the 747. Even the Comet (which predates the 707) had no aerodynamically created control forces, but fully powered flight control surfaces and only a spring-loaded artificial feel system.

Bernd

Nobody is saying FBW is bad, it works fine for Airbus! But if a plane is FBW it should be certified as FBW, which means the failure modes of necessary sensors, control algorithms and servos get carefully analysed by a third party for design weaknesses like a single point sensor failure. Which is where the US process failed with the Max 8 failed egregiously.


Edmund

[twistedenginestarter]

Regardless of whether you're a pilot or not, surely the question that needs to be answered is simple: How is it remotely OK for Boeing (or any other manufacturer), to sell a passenger aircraft that needs software to correct an aerodynamic imbalance in the design of the aircraft (prone to pitching up)?

I was trained to fly over 50 years ago. That involved the Trident. It had a yaw damper - a computer system to counter the basic instability of the aeroplane. Aircraft that require computers are nothing new.

Several people have implied it's perfectly OK for fighters to be unstable but not airliners. I simply can't see the logic in this.

The ironic thing is Airbus take the opposite view - for the most part they take the model that the computers should be involved in all manoeuvring actions. As we know, a similar clash between computers and pilots on an A320 ( XL888T) caused a crash but everybody seems to accuse Boeing of inventing this kind of scenario.

It's a curious situation. There are lots of dodgy things about the Lion crash. The Ethiopian event has not yet - to my knowledge - been definitely attributed to an MCAS malfunction. I think we can all agree it would have been better if pilots had briefed about the potential failure behaviour of MCAS but this might simply have been an oversight on the part of Boeing rather than something cynical.

[HarryMann]

Even the Comet (which predates the 707) had no aerodynamically created control forces, but fully powered flight control surfaces and only a spring-loaded artificial feel system.

Bernd
Edmund

Well, yes, but with a Q-Pot as well, giving increasing force with dynamic pressure.

[Ian W]

SLF here, but with a background in experimental physics dealing with personnel and equipment safety in large-scale, hazardous experimental situations.

Assuming that both 737 MAX crashes were the result (in large part) of faulty AOA probe data, then we already know, from sad experimental evidence, that relying on one probe is unacceptable. With 2 hull losses in N (? - not a terribly large number) flights of this aircraft, the reliability statistics are hardly at the flight-safety-critical level.

Having an "AOA disagree" warning or AOA readouts for pilots is not necessarily going to help. I suggest that as a minimum, with only two AOA probes (and that should be the minimum number), that MCAS should shut itself down in an AOA disagree situation (with notification to the pilots). The principle here is "primum non nocere". The aircraft is not going to have an upset just because MCAS is not there on these rare occasions.

Furthermore, if AOA data is going to be used in this way (possibly killing people if it is wrong), further sanity checks should be applied to the probe data (e.g., AOA pre-rotation on take-off, consistency with inertial and other air data, whatever).

MCAS as currently implemented seems like a horrid kluge to a non-pilot, but I'm inclined to believe, from what I've read here, that with better engineering (and not too drastic a change) the 737 MAX could be restored to safe service.

I worked in fault-tolerant computing for some time and any single point of failure was something to be avoided at all costs. However, along come the mathematicians who say what is (a) the probability of an AoA failure? What is (b) the probability of a crew not being able to switch off a Stab Trim that is trimming against them - what probability do we have to meet. (c) if (a) * (b) is smaller than (c) -extremely improbable- then you meet the requirement. This type of reasoning is common.
Now that it is apparent that crews are not able to cope with some things unless well trained AND airlines are unwilling to pay for the training. I would expect that first officers are about to be automated out (is flying with HAL any worse than flying with a 25hour MPL?) and in some cases aircraft will become autonomous. Note that MCAS was only there because there was a regulatory concern that human pilots could mishandle the aircraft as the control column loads got lighter. MCAS does not operate with the autopilot controlling the aircraft as that is no safety concern.

Several articles in the media and statements by President Trump are that aircraft are too complicated. So are aircraft getting too complicated to fly? Or should that be that aircraft are getting too complicated for humans to fly?
In a world where there are unmanned jet aircraft operating from carriers and doing air-to-air refueling, flying a 737 is seen (rightly or wrongly) as a simple task to automate - yes even a Cat II landing in an on the limits blustery cross wind to a wet runway.

And before people ask: Yes I would fly as pax in an autonomous aircraft.

[bsieker]

Well, yes, but with a Q-Pot as well, giving increasing force with dynamic pressure.

Sure, the point was, all of it was artificial even that early. So why get all worked up about one small system that does the same thing now? That it was perhaps not done and analysed as diligently as it should have is one matter, but the idea of enhancing control forces artificially is literally as old as jet airliners. Perhaps older, I haven't looked into piston-powered airliners in any more detail.

Bernd

P.S. my post is gone, I wonder why it was deemed irrelevant or bad or inappropriate or whatever. But I guess I'll never know. Just because I don't have an ATPL I cannot talk about certification criteria and risk assessment?

[bsieker]

I was trained to fly over 50 years ago. That involved the Trident. It had a yaw damper - a computer system to counter the basic instability of the aeroplane. Aircraft that require computers are nothing new.

Sure. All swept wing airliners are susceptible to dutch rolls and require yaw dampers. The 707 had one in all models.


Several people have implied it's perfectly OK for fighters to be unstable but not airliners. I simply can't see the logic in this.

In case you really are serious:

For fighters, maneuverability is supremely important, and maximum maneuverability can only be obtained with relaxed aerodynamic stability. That additional safety layer has been dispensed with in fighters to increase their effectiveness as machines of war. Military transport aircraft are as stable as civil airliners. Airliners might be made a bit more efficient by relaxed stability, but that tradeoff is not appropriate when carrying passengers for whom being killed is not part of the everyday risk.

The fighters, as flown by the pilots, are completely stable, it's just all computer-assisted. Unlike airliners, most modern fighter jets would literally break apart (depending on the speed) and fall out of the sky should all flight control computers fail (as would the B2, but the reason is the stealth-shape, which is much easier to obtain with relaxed stability). So if anything you'd want them to be more reliable than in aerodynamically stable transport aircraft (civil or otherwise).


The ironic thing is Airbus take the opposite view - for the most part they take the model that the computers should be involved in all manoeuvring actions. As we know, a similar clash between computers and pilots on an A320 ( XL888T) caused a crash but everybody seems to accuse Boeing of inventing this kind of scenario.


You seem to have missed that all Boeing airliners (and Embraer, and Bombardier) since and including the 777 have been 100% fly-by-wire. It isn't an Airbus thing. I also don't know why you would call it "ironic".

Also, the XL Airways Crash in Perpignan was very different. Yes, two faulty AoA sensors were a causal factor, but it crashed because the pilots deliberately stalled it at very low altitude, testing the protection system which they blindly believed would save them, but which wasn't working because of the frozen AoA sensors. It was overreliance on automation (and also poor planning and execution of flight tests), but it has nothing to do with computers fighting against humans or any such nonsense. Quite the opposite. It crashed because the computers were not able to save the pilots from themselves. Which a perfectly fine airplane would have done.

Bernd

[aterpster]

In a world where there are unmanned jet aircraft operating from carriers and doing air-to-air refueling, flying a 737 is seen (rightly or wrongly) as a simple task to automate - yes even a Cat II landing in an on the limits blustery cross wind to a wet runway.

How about a squall line extending 1,000 miles across the intended flight track?

[efatnas]

I read a lot of Airbus Boeing finger pointing but I think in both one needs to understand the systems to fly. As hopefully everybody understands now how to disconnect the horizontal stab from it’s muscle I rest my case. It looks like basic understanding of airplane fundamentals still goes a long way even today and both crews should have never flown the airplane without it, assuming the Ethiopian plane had the same problem as the Lion air of course.

[HarryMann]

I read a lot of Airbus Boeing finger pointing but I think in both one needs to understand the systems to fly. As hopefully everybody understands now how to disconnect the horizontal stab from it’s muscle I rest my case. It looks like basic understanding of airplane fundamentals still goes a long way even today and both crews should have never flown the airplane without it, assuming the Ethiopian plane had the same problem as the Lion air of course.



That's fine efatnas, providing you know that those airplane fundamentals have changed... aren't we being told that communication and documentation from Boeing on MCAS was lacking or certainly insufficient .. considering this system messed in a previously unheard of way with the stabiliser trim ?

[Fortissimo]

You're right, Harry, Boeing should have told the crews. "If you're out doing flaps up stalls in your MAX, you will get an intervention from MCAS. Also, if you get a continuous stick shaker on take off rotation & are stupid enough to accelerate, clean up the flaps, & try to continue the flight with the stick shaker, you MAY get a repeated intervention from MCAS 'cause it thinks the airplane is stalling".

The second sentence here is only true if Boeing had realised that this could be the outcome of a single AOA source failure. If they had that knowledge and did nothing about it, then the courts will no doubt take that into account in due course because the failure to communicate it or manage the risk would indeed be seen as cynical. Please don't construe this as Boeing bashing - that would be as unhelpful as trying to shift responsibility to the perceived shortcomings of the two operators concerned. Play the ball rather than the man.

Regardless of what manufacturer or operator is involved, the question for me is whether the fault tree analysis (or whatever process was used) and the subsequent sentencing of risk regarding 'system X' during its design and checkout provided sufficient evidence to the regulator that system X was safe to be fielded. And IF the regulator falls into the trap of regulatory capture (still to be determined...) or does not have the necessary resources to satisfy itself that the manufacturer's claims are accurate, then the regulator could and should be held to account. In a safety-critical environment it should never be possible for a manufacturer in any country to mark its own homework.

If you would like an example of how this situation can occur anywhere, take a look at the airworthiness failure that killed 14 UK servicemen in Afghanistan in 2006 - you can read the lawyer's analysis of the process failings here (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/229037/1025.pdf)

[Ian W]

How about a squall line extending 1,000 miles across the intended flight track?

The FOC/Command Center/Network Manager would deal with that in the same way it currently does. If the UA was flying completely autonomously, then that kind of major weather system would be one of the use cases that it was designed to meet. There is research in hand with Decision Support Tools to provide just that kind of assistance to self-dispatching operators. Aircraft these days fly in a sea of usually discarded/disregarded information.

[WHBM]

As we know, a similar clash between computers and pilots on an A320 ( XL888T) caused a crash but everybody seems to accuse Boeing of inventing this kind of scenario. The Perpignan accident was brought about by testing to the stall an aircraft which had been standing long term at end of lease, and then had major maintenance work done - at 2,000 feet. And the AOA detectors being tested did not work. Quite why they were practicing a stall at a height you wouldn't even attempt in a Cessna on a PPL skill test is not apparent. It's like the Habsheim incident, playing about at a ludicrously low altitude. Let's call it an Andy Hill moment. Except that for these ones they then tried to stick it on the automation.

[yanrair]

Originally Posted by twistedenginestarter https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10426624.html#post10426624)
I was trained to fly over 50 years ago. That involved the Trident. It had a yaw damper - a computer system to counter the basic instability of the aeroplane. Aircraft that require computers are nothing new.
Yes indeed Twisted! But there is a massive difference between " needing" an augmentation system like a yaw damper or even MCAS (see below) , and having one to improve the handling. Yaw dampers and Stick pushers and perhaps even MCAS and things like that are usually put in to make the plane fly better in certain situations, but they are often not required for flight. To find out your consult the MEL (Min Equipment List) for the plane and see if it is allowed or not.
There are literally hundreds of systems and items on every plane that you are allowed to fly without depending on circumstances.

On most Boeings the yaw damper is fitted but not required. Even the 707 right up to the 747. You can dispatch with no yaw damper and continue to fly if it fails in flight. It just makes flying a bit easier if is working.
Don't know if MCAS is permitted by then 737-MAX MEL/DDM (permitted dispatch items) and that will come out. I wouldn't be surprised if it is permitted to be unserviceable at dispatch (prior to flight) if it is considered an enhancement rather than essential.

Can any MAX pilot out t here state whether the MEL covers MCAS please?

Yanrair

[Ian W]

That's fine efatnas, providing you know that those airplane fundamentals have changed... aren't we being told that communication and documentation from Boeing on MCAS was lacking or certainly insufficient .. considering this system messed in a previously unheard of way with the stabiliser trim ?

It would appear that consideration was given to this area and that the people involved believed that a qualified 737 pilot would disconnect Stab Trim if it was persistently trimming the aircraft in an unwelcome way. They certainly didn't expect pilots with trim repeatedly going more nose down to just fight it when the Stab trim Cut Out switches have been in the same place and are known by all qualified pilots. From the thread above pilots seem to have been trained that the _only_ time the Stab Trim Cut Out switches are used is for a runaway trim defined and demonstrated in simulators as a continual trimming in one direction. This appears to have been totally unexpected. Luckily for one set of pax a Batik jump seater did not have this limited view of the Cut Out switches utility. So perhaps it is only a subset of qualified 737 pilots that would let the aircraft trim them into the ground.

Just think if Boeing had suggested with the launch of the max that the NNC for 'Runaway Trim' was altered to 'Runaway or Repeated Trim'. The semantic specialists would have use the Cut Out switches and this thread would not be here.

[TowerDog]

“Just Fly The Airplane” AOPA article:

https://www.aopa.org/news-and-media/all-news/2019/march/20/congressman-concerned-about-foreign-pilot-training?utm_source=epilot&utm_medium=email&utm_content=tts&utm_campaign=190321epilot

[bsieker]

Now that it is apparent that crews are not able to cope with some things unless well trained AND airlines are unwilling to pay for the training.

Then the regulator has to make more and better training mandatory.

I would expect that first officers are about to be automated out (is flying with HAL any worse than flying with a 25hour MPL?) and in some cases aircraft will become autonomous.

No, not any time soon. The manufacturers and the regulators know that computers are not anywhere near ready for this.

Note that MCAS was only there because there was a regulatory concern that human pilots could mishandle the aircraft as the control column loads got lighter. MCAS does not operate with the autopilot controlling the aircraft as that is no safety concern.

Exactly. And these requirements for human pilots are still there because the automation can handle even less than humans. The great big question are the unknown unknowns, with which humans can deal most of the time, but computers not. Because these are the things the engineers could not have thought of.

And before people ask: Yes I would fly as pax in an autonomous aircraft.

"You're braver than I thought."

I don't think you've been paying much attention to (a) the abysmal state of autonomous system development. The short form is: even (or rather: especially) the best experts in the field (the safety engineering field, i. e., not the deep learning hubris field) don't know how to assure safety for those to any reasonable degree. We have no clue. To quote a presenter on a recent international system safety conference:


Developers: "Our autonomous system is 99% reliable!"
Safety Engineer: "Great! That's two nines. Only seven more to go!"


... and (b) the number of times human pilots or operators take over and continue on an uneventful flight when a small snag appears and the automation throws in the towel. Because those cases don't make the news. Only when the flight has an eventful ending, as in the cases of the Hudson ditching and BA Flight 38.

Bernd

[olster]

That article is a complete load of rubbish. There is another article, even worse written by another American expert. The consensus is that all non American pilots are inexperienced and simply flying the plane solves the problem. Also, the second article goes on to say that the control column stab trim cut out is inhibited by MCAS but conveniently and lazily omits to mention that Boeing never gave any info to pilots how MCAS functions and ergo they would not know. Apparently there have been no incidents of MCAS malfunctioning in continental North America, anecdotally untrue. The inference that superior American piloting skills would have saved the day is objectionable and untrue. I have flown globally on 737s with American pilots and they are as good or the converse as any other nationality. I am fed up with reading drivel from presumably vested interests. This will be my only post on this matter. RIP to those on Ethiopian and Lionair.

olster, 10,000 hours cap / instructor etc on B737 variants if anyone is interested.

[yanrair]

Could not agree more IanW. Once we get into semantics it is game over for safety.
eg " I was beaten by the attacker continuously for 10 minutes". Doesn't matter whether the attacker paused for breath every now and again to beat me harder, it was still a continuous beating for 10 minutes and that is how for the last 40 years I have understood STAB activity that is not as expected or undesirable. If it moves and you don't know why OFF she goes. You can always turn it back on if you like.

[infrequentflyer789]

Can any MAX pilot out t here state whether the MEL covers MCAS please?

Yanrair

Not the former but I can give you an answer for the latter - check FAA Master MEL here: http://fsims.faa.gov/wdocs/mmel/b-737-8_rev%200.pdf

I can't find any mention of MCAS or anything that might be MCAS renamed. Speed trim you can go without, mach trim, yaw damper, but not MCAS.

[JRBarrett]

The second sentence here is only true if Boeing had realised that this could be the outcome of a single AOA source failure. If they had that knowledge and did nothing about it, then the courts will no doubt take that into account in due course because the failure to communicate it or manage the risk would indeed be seen as cynical. Please don't construe this as Boeing bashing - that would be as unhelpful as trying to shift responsibility to the perceived shortcomings of the two operators concerned. Play the ball rather than the man.


I am at a loss to understand how Boeing engineers could not/did not foresee the dangers in their original implementation of MCAS. Any aircraft manufacturer is certainly aware that sensors can fail, and when a safety-critical system can be activated based on sensor inputs, that there need to be provisions for sanity checking of the sensor data.

The Gulfstream IV, designed in the late 1980’s, has a stall warning and protection system called the “Stall Barrier”. A stick shaker that activates when sensed alpha is approaching the stall regime, and a stick pusher that activates when alpha increases even further. The pusher is required due to the dangers of deep stall in a t-tailed aircraft.

But - the stall computer does have provisions to anticipate sensor failure. The shaker can activate based on a high alpha reading from only one of the two AOA sensors, but the pusher will not activate unless BOTH AOA sensors are in agreement.

The stall warning system on the (relatively ancient) CRJ-200 is even more conservative when it comes to sensor-data sanity checking. The CRJ stall warning computer monitors the position of both AOA vanes. If there is any significant disagreement as to position, the stall warning system will deactivate with “STALL FAIL” amber CAS warning to alert the crew. In addition, the stall warning computer monitors airspeed from no fewer than FOUR discrete sources: the left and right primary air data computers, and two additional Mach/airspeed transducers. If any one of the four airspeed data sources differs from the other three by more than a few knots, the stall warning system will again vote itself out of service with the same “STALL FAIL” CAS message.

I assume that Bombardier engineers figured it was better to deactivate the stall warning system (after alerting the flight crew), than to have a situation where a false stall warning might be issued due to faulty air data when no stall actually exists.

This in an aircraft that first entered service over 20 years ago.

Though MCAS is not a stall warning/stall protection system per se, if it activates at the wrong point in the flight envelope, the results can be disastrous as the two crashes prove. Yet, unlike the conservative engineering principles shown by Gulfstream and Bombardier engineers, Boeing chose to make the system dependent on a single sensor - with no apparent thought as to the negative consequences that could ensue if that single sensor provided incorrect data. Even more appalling is the fact that in the original design, the MCAS would repeatedly reset and reactivate, winding in more and more nose-down trim, with no apparent knowledge of the current position of the HSTAB, or the number of previous activations.

These issues are allegedly addressed in the software update for the MCAS system, but how could such a flawed design have ever passed muster in the first place?

[Smythe]

From the article regarding ASRS:

Below are all of the reports I could find that are related to possible runaway-trim problems with the new 737 Max

https://www.theatlantic.com/notes/2019/03/heres-what-was-on-the-record-about-problems-with-the-737-max/584791/?utm_medium=offsite&utm_source=yahoo&utm_campaign=yahoo-non-hosted&yptr=yahoo

also:
The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

[yanrair]

That article is a complete load of rubbish. There is another article, even worse written by another American expert. The consensus is that all non American pilots are inexperienced and simply flying the plane solves the problem. Also, the second article goes on to say that the control column stab trim cut out is inhibited by MCAS but conveniently and lazily omits to mention that Boeing never gave any info to pilots how MCAS functions and ergo they would not know. Apparently there have been no incidents of MCAS malfunctioning in continental North America, anecdotally untrue. The inference that superior American piloting skills would have saved the day is objectionable and untrue. I have flown globally on 737s with American pilots and they are as good or the converse as any other nationality. I am fed up with reading drivel from presumably vested interests. This will be my only post on this matter. RIP to those on Ethiopian and Lionair.

olster, 10,000 hours cap / instructor etc on B737 variants if anyone is interested.
RIP indeed Olster. It is so very sad. I respect your views.
You don't address the core issue which is that stick and rudder skills still work today and that had they been employed- and we do not have the full picture - the plane may have been perfectly flyable. Certainly I have seen nothing to suggest otherwise - that the plane was somehow doomed. I notice that many skirt around this one, by talking about automation. If the computer isn't doing what it should, and the pilot should know that, then OFF it goes. If you CAN switch it off of course, And on the MAX you can.
I don't think that anyone is suggesting ethnic or racist in the comments about the excellent safety record of USA, and indeed Europe - and yes - other places too.
It is just that the facts speak for themselves in terms of accident rates world wide and they are not "anecdotal" at all. Certain countries and certain airlines have poorer outcomes than others. And as training changes and improves these standards change too.
This is a good source
https://aviation-safety.net/database/country/country.php?id=N

[benpp]

I would like to know why Boeing didn't install the "optional" AoA sensor fail light after Lion Air. Oh right - they're $80,000 each. Saved a penny!

I'd also like to know why any pilot who flew the Max didn't know about the MCAS (and knew immediately how to identify a failed AoA) after Lion Air.

It's not just one failure - it's a layer cake of failure.

I am at a loss to understand how Boeing engineers could not/did not foresee the dangers in their original implementation of MCAS.

These issues are allegedly addressed in the software update for the MCAS system, but how could such a flawed design have ever passed muster in the first place?

[Towhee]

"Standard Boeing 737 Max Planes Are Not Equipped with A So-Called Angle of Attack Indicator"

This and another safety feature only available as expensive "options."

https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html

[BrandonSoMD]

I agree stall AoA varies with configuration, Mach # and others however, I don’t think that, given all other values constant, weight changes AoA. Ie, a wing stops being a wing at the stall AoA, regardless of how much lift is demanded..
Well, it's true that stall AOA doesn't change with weight - but the AOA *required* for a given airspeed absolutely changes with weight - more than any other variable other than flap setting. (I am a senior flight test and simulator test engineer and do this stuff regularly. I think I can speak definitively.)

The aero equation for lift is this: Lift = 1/2 * Coefficient of Lift * density * speed^2 * Wing Area.
- In level non-turning flight, lift must equal weight.
- In turning or accelerated flight, lift must equal weight * load factor.
- Coefficient of lift is (in most wing designs) a nearly linear function of AOA, up until stall.
- Moving flaps/slats changes the coefficient of lift curve, so different values of CL-AOA exist for different configurations.

Therefore, AOA changes approximately linear with weight for a given speed. You need a fairly complex set of tables to know the expected AOA for all possible configurations, but the exact relationship is extremely clear.

This is why I assert that the average pilot will never be able to say "that indicated AOA is exactly correct ." With some experience, he can certainly say "I'm used to seeing this approximate AOA for a configured approach at this fuel weight." He can also certainly say "Wow, that AOA value is off-the-chart wrong." I think you're just adding to the mental complexity of flying without benefiting the average pilot.

On the other hand, the FMC can compute the expected AOA value from internal charts; it already knows the gross weight (as entered by the aircrew during nav mission planning); it knows the flap configuration and gear configuration. It would need either load factor (g's) (which is probably doesn't have) or angle of bank (which it does have), assuming you're not flying an airshow and doing big pushovers/pullups. It should then be able to figure an approximate expected AOA, and compare the measured AOA, and pop up an alert if there is a big (and sustained) mismatch. (You don't want to flag brief mismatches, because turbulence would trigger it, and it will never be correct below flying speeds like taxi or rollout.) So there's plenty of ways to use the onboard computing power more wisely than it is being used now, without burdening the pilot with basically irrelevant information.
I also agree that simply introducing an AoA indication in the cockpit of an airliner will not benefit crews without some education. However, AoA is a fundamental parameter, if it is displayed and obviously in error (deduced by crew education) then it could assist in fault finding. One of the key parts of UPRT (being introduced as mandatory in Europe for all new CommerciL licence training from Dec 2019) is AoA & G awareness. I believe it would be of huge benefit if commercial aircraft had AoA displayed and pilots were educated in its interpretation from day 1 of flying training.
True enough - but if a third-world flight crew has trouble with other basic skills, would showing them raw AOA really benefit them?

I suppose a good compromise is don't show AOA unless there's a miscompare - then (along with a very obvious miscompare notification) show the left AND right values right next to each other, not cross-cockpit.

[yanrair]

No, it's a terrible article because its only conclusion is "these pilots were idiots! I would have flown the airplane no problem!".

That is not only unhelpful, it is counter-productive in trying to make aviation safer.
s
It should by now be obvious that crews cannot be expected to handle this every time, and a system that relies on 100% human performance in case of a small technical malfunction simply is not acceptable.

Bernd

Bernd. By "every time" we are talking about a rare event but one that did happen. "Every time" a pilot suffers and engine failure on takeoff at V1 - a rare event, he is expected to handle it 100%. That is all we are saying really. Once again it is important to re-state that we don't know what happened on these two flights in any great detail and we await the full reports. What I have tried to do here in the last few days is explain how a 737 is capable of being flown in most all circumstances (not necessarily this exact one) and how it differs from pretty much any other modern plane in that computers are not at its heart. When the report is complete my guess is that there will be multiple factors at play which all contributed to a chain of events - as is so often the case. I will confess that I did not read the full article and will do so now to see where there is a suggestion that "some pilots are idiots" - I didn't pick that up first time around. My apologies.
Cheers
Y

[gums]

Salute!
Can any MAX pilot out t here state whether the MEL covers MCAS please?

There ain't no piece of equipment for MCAS!!! GASP!

For the nth time, it is a software module in the FCC on one of the two cards there. Just like the EFS and now the SYDM boxes have migrated.
Computer chips and lines of code have replaced all the ropes, levers, pulleys and cables so many here brag about. And maybe too many here and in the media think there's a switch or ckt breaker for MCAS. There ain't. It's like a runaway aileron actuator. You can turn it off by disabling the hydraulic system, but what else do you loose?

And speaking of what else you loose, a great example of not turning off the main supply for auto power steering and brakes happened with ruwaway throttle. The fatal accident might have, and should, have been prevented by using what was available and not turning off the motor supplying the power steering function. A well known auto magazine reporter duplicated the malfunction and simply pressed hard on the power braking pedal. It took a half a mile, but he maintained control and once he got real slow he could turn off the motor and maintain enough control to stop. Brakes were shot, but he was alive.

To be fair, I am not sure exactly what I would have done in the first two minutes of the 610 scenario. I would not have thought the trim system was my main problem. If my wheel electric switch kept working, I would have kept going and prolly slowed down once flaps were up. Hell, I could look around, feel the airframe and was pretty sure the shaker was a malfunction. I would deal with that pesky trim later. After another minute of dueling with the trim I would be pretty sure the system was FUBAR and turned off the power to the motor before looking up any more procedures. Plane is flying O.K. on 75% power or whatever, and I can crank that trim wheel 50 times to get back to what we need for hands off controls.

I have only had two or three peacetime "problems" just after takeoff, and the jet was not completely out of control. For those who haven't seen it, this one was the worst.


https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/333x240/rightwing_jpg_original_262502be18880a45b4bd0a2ba5abbf42937c2 578.jpg
Surprise!


Gums sends...

[IcePack]

Gums is right, too many "pilots" think their aeroplane is made up of bits as per the pilots tech manual. The tech manual is written to explain how the system works, rather than actually what is there.
To explain:
some time ago I would regularly fall out with one of our trainers on the simulator. He would insist that the electrical system was made up of bus bars as in a lump of metal with things attached. In fact the mythical bus bar depicted in the training manual did not exist per say. The components (things) were attached to the electrical system via their own feeds and those feeds were controlled by system logic giving the impression of being attached to a bus bar. This meant that the logic was/is perfectly capable of isolating individual faults and or resetting other components(things).

This should be made clear during ground school, in that the aeroplane manufacturer knows their aeroplane. This means if the QRH calls for a resets without caveats, the pilot should do as per the QRH and NOT try to outthink the system. I know this goes against the grain for those used to the "old" way of doing things but design has moved on.

[yanrair]

Reference the news article that I referred to, I did not finish reading it and realise now it contains some comments about "foreign" pilots. That is so far from my own position that I can only apologise for providing the link to the article. Having spent most of my life flying with and training pilots from all over the world I could not agree with that contention. This issue has nothing to do with foreign pilots - foreign to whom? USA in this case I think he means. I am a foreigner to someone from China I guess.
The quality of pilots has nothing to do with their ethnicity. I wish to make that very clear. The quality of pilots from anywhere is down mainly to the way they are trained and regulated.
Yanrair

[bsieker]

Bernd. By "every time" we are talking about a rare event but one that did happen. "Every time" a pilot suffers and engine failure on takeoff at V1 - a rare event, he is expected to handle it 100%. That is all we are saying really. Once again it is important to re-state that we don't know what happened on these two flights in any great detail and we await the full reports. What I have tried to do here in the last few days is explain how a 737 is capable of being flown in most all circumstances (not necessarily this exact one) and how it differs from pretty much any other modern plane in that computers are not at its heart. When the report is complete my guess is that there will be multiple factors at play which all contributed to a chain of events - as is so often the case. I will confess that I did not read the full article and will do so now to see where there is a suggestion that "some pilots are idiots" - I didn't pick that up first time around. My apologies.
Cheers
Y

Someone used an interesting word the other day to describe how erroneous MCAS activation is different from an engine failure at v1. The latter is immediately obvious, it is trained for ad nauseam, and it is briefed before every takeoff. Terefore this is an item where we can and must expect near 100% performance. But the former is "insidious". It is not nearly as clear-cut, since other system will repeatedly trim the airplane as well, and a racket of other warnings and noises is also going on. It isn't one (sometimes literal) bang like an engine failure, and you are also not primed for it, because it is not briefed every time. And it is also not acceptable because there are ways to do it better! Rejected takeoff is dictated by raw, high-kinetic-energy physics, and not a lot can be done to get around that.

But most importantly, we know now that not all pilots will handle it well, and to say that only third-world pilots will ever get it wrong is "holier-than-thou"-hubris and no better than "Rep. Sam Graves (R-Mo.)" in the AOPA article.
(EDIT: just read your reply, and don't want to imply that you said or meant anything like that.)

As to "pilots are idiots", I was paraphrasing. What he said a couple of times, though, was "why didn't they simply do x?", which can only be said with hindsight (knowing the actual outcome, and only now knowing the correct solution), and is also arrogant, condescending and serves no purpose other than to feel smugly superiour.

Bernd

[bsieker]

True enough - but if a third-world flight crew has trouble with other basic skills, would showing them raw AOA really benefit them?

I suppose a good compromise is don't show AOA unless there's a miscompare - then (along with a very obvious miscompare notification) show the left AND right values right next to each other, not cross-cockpit.


I could hardly agree more, although it is also not limited to third-world pilots. I still contend that the AF447 pilots would not have benefited from an AoA indicator, either. I detailed that in another post which got deleted. It boils down to "none of the available instruments made any sense, why would they have believed an additional one, which would have shown an unbelievable value (40°) anyway."

Bernd

[CoffeTime]

You are correct is stating that there is no "piece of equipment for MCAS" on the B-737 -8/9 MEL Rev. 1 dated 01/17/2018 (MMEL Ref. fsims.faa.gov) for MCAS, either under ATA 22 or 27. However, MMELs do cover many "distributed" FUNCTIONS. (As you describe alternatively as "migrated".) Even though there is not a single "box" or "piece of equipment", there can be MEL relief if specified, given that applicable (M) & (O) items are complied with. MCAS would likely qualify as distributed FUNCTION.

[MurphyWasRight]

This should be made clear during ground school, in that the aeroplane manufacturer knows their aeroplane. This means if the QRH calls for a resets without caveats, the pilot should do as per the QRH and NOT try to outthink the system. I know this goes against the grain for those used to the "old" way of doing things but design has moved on.

This brings up an interesting point: If it is -not- in the QRH what then?

Reports suggest that the Lion air crews (both flights) might have been trying to find a match for their situation in the QRH and other manuals. The third pilot on first flight ultimately suggested the trim motor cutouts, not clear if this was before or after he got the large book from his carry on.

One theory is that some crews are trained/held to tight observance of SOP and any actions outside of those are strongly discouraged. This is good as long as the SOP can cover every eventuality, which of course they cannot.

Is it possible the Lion air accident crew did not follow the trim runaway procedure since it was not an exact match for what they were seeing and/or were afraid of consequences if they did and it was later deemed to be not following SOP?

Could this fear have influenced how the prior crew wrote up the incident?

Point being that system knowledge can be vital for undocumented cases, in addition to knowing the procedures understanding what they do and possible side effects is important since it allows problem solving in situations -not- in QRH or other sources.

In the Lion air MCAS case knowing for sure that the cutout switches would work -and- confidence that they could manage the aircraft after they were used might have saved the day.

Really too early to extend to Ethiopian case since not known (to public at least) how similar the cause(s) were.

[Murexway]

But most importantly, we know now that not all pilots will handle it well, and to say that only third-world pilots will ever get it wrong is "holier-than-thou"-hubris.... Well, we can't expect ANY pilots to handle it well, if their differences training was limited to a one-hour session on an iPad that didn't even mention MCAS.

[Rated De]

A little Occam's razor:

Automation is simply nowhere near good enough to replace well trained, remunerated, rested and motivated pilots.

That the incessant cost cutting preferred by both airline management and manufacturers alike is flawed.

[voyageur9]

A little Occam's razor:

Automation is simply nowhere near good enough to replace well trained, remunerated, rested and motivated pilots.

That the incessant cost cutting preferred by both airline management and manufacturers alike is flawed.

Ockham might opine: Automation is good enough to replace average, insufficiently-trained, underpaid, overworked and thus no-longer-motivated pilots. The latter seem increasingly to outnumber the former.

Which is why pilots will soon (probably sooner than they expect) go the way of elevator operators. That may be sad in vaguely nostalgic fashion but will decrease seat costs, ticket prices and fatalities per million flights.

[Sailvi767]

Rananim, a faulty AOA that would activate MCAS would produce a continuous stick shaker at rotation, not on flap retract. Why would any right-thinking pilot ever attempt to retract flaps & continue the flight with an active stick shaker, even if unaware that MCAS exists?

That one is esay, you cross check the 3 airspeed indicators, thrust, performance and attitude to determine if the stickshaker is real or false.

[BobM2]

What we can only conclude as a design flaw requires recurring RTO above Vr?

Wrong focus.
No, not wrong focus. Nobody is advocating RTO above Vr unless unlimited runway is available. A faulty AOA could give a stick shaker on take-off rotation in any airplane whether it has MCAS or not. The point I am trying to make is if the airplane is climbing & accelerating normally & stick shaker is on one side only, it is an AOA failure & not a valid stall warning. The correct response to this is to return & land the airplane. Get it fixed! You don't accelerate, clean up the flaps & try to continue the flight with an active stick shaker as Lion Air did on two occasions, only one of which was successful (barely).

[fdr]

Yup. From that same data source (and wishing vbulletin did tables):
737 NG: >20 years, >7000 built*, 20 hull losses, 591 dead
737 MAX: <3 years, ~350 built, 2 hull losses, 346 dead
So, if it's the crews or the airlines and not a problem with the plane, how do you explain the (order of magnitude at least) difference in crash rate?

On the surface that is an interesting observation, however it is the result of working with unequal population sizes and looking at temporal processes. Safety of a system is judged by exceptional events, losses in aviation. overall, historically loss rate has loosely followed a curve similar to long term average costs in economics, a broad U shape. initially there is a potential elevated risk from unknowns in a new system (airline, aircraft, route, operation etc..) which is mitigated by the control loop of the system. After an extended period of time new factors will come into play, which may elevate risk, loss of corporate knowledge, structural fatigue, ageing effects, apathy etc. these are also affected by the overall system response which should improve over time, and it does to an extent, SSID, SMS etc, but the underlying issues are non linear, and the system response is also non linear. Responses hardly ever are exactly correct and without new risks and unintended consequences.

Pretty much, systems are non linear. Estimates based on largely different samples are only correct in say QA sampling, and even then it comes with interesting maths due to uncertainties.

The NG didn't make headlines on safety with its introduction, however there were considerable fatalities from the start for various issues, and the fatality rate then reduced. The losses occurred in the noise of other events, and did not raise eyebrows. in more recent time, we continue to see over runs, loss of control, and similar crew related matters increase on the NG. The A320 started with a lousy run of losses, most due to knowledge issues with the crew related to the automation functions. the A320 loss rate continued to be managed, but there are still wild card events that occur to this day, including loss of control, CFIT and other odd events.

Both of the airlines involved with the most recent events have considerable track records with accidents, all of them raising questions on system integrity. For the regions that they operate in, at least in Africa, ET is one of the better performers. In Indonesia, safety records are always of concern, and JT has had its share of events and losses, which given its size of operation is probably not far from the average in the country. Indonesia like Africa has elevated operational risk factors, that even if comparative operational standards exist would probably lead to more incidents of the type that are most common there, overruns and offs of the runway. Loss of control events have occurred with various aircraft types in the region, for a multitude of reasons, crew turning off the attitude platforms, severe weather encounters...

The question on the Max is why did apparently trained crew not recognise and action a simple procedure in the events. Stab cut out has been fitted since the 40's, when stabs were the solution to high speed flight trim changes. Cutout is not a new device, nor is the problem of uncommanded stabiliser trim changes. So with the Max, what is the reason the crew didn't recognise the need to do a simple action to save the day? The concurrent stall warning would appear to have had a strong influence on the cognitive capabilities of the crew on the day. The revised event information of the JT aircrafts prior flight suggest that on the day that crew also needed additional input to successfully undertake corrective action. The CVR info on JT610 starts to suggest that the crew did attempt to manage the event in a calm manner, but with that process, the hand over of the flying duties from the capt to the copilot had a down side, the captain had been responding to the uncommanded trim, the copilot was not successful in doing the same and the flight path was promptly affected. It is indeed unfortunate that the captain following CRM best practice training principles takes action that appears to have had severe consequences. If the captain had recognised the trim problem consciously, cutout would have been an appropriate action. The copilot was handed an aircraft with the problem, and it is quite possible (unknown at the moment) that the captains successful reactions to the trim problem were subconscious, and that it was being managed so was not communicated at the time of the transfer to the copilot. That point is going to need consideration for any real longterm improvement in problem cueing, where the comprehension of the crew of the actual status is critical. Crew SA is paramount, and what appears to be 3 cases so far had problems in this area.

I don't think that these operators are unique in the issue of SA at all.

[patplan]

---snipped--
Would you really let trim carry on monotonically trim down 2.5 units every 5secs and not switch it off? l can only assume that you would. It is really immaterial why the trim was operating it could be a now dead rodent chewing through an electric cable, you just want the trim to stop and two switches that have been there forever allow you to do that. I am sure that Boeing is aghast that their NNCs for trim runaway were being read in such a contracts lawyer fashion. Perhaps they should review the semantics of all memory items and NNCs/checklists and any training that reinforces those limiting semantics.

The Lion Air crews DID NOT KNOW how many units or even how long this goblin would trim. They didn't even have 10 seconds to observe the trim wheel amidst all the warning. To them, what happened to AC was exactly like what was reported/read in the pre-flight briefing: "STS running the wrong direction due to speed difference". As reported on the Lion Air's A-SHOR:https://i.ibb.co/p2xXC3T/a-shor.png (https://ibb.co/0qcJPfL)


The conflicting data's [ALL INDICATORS were out of whack - previous flight at least the SIC's indicators were still valid, but not this one], perhaps observing the surrounding, rummaging through the QRH, communicating with the ATC, etc..., were all conspiring to overload their mental faculties and sensory perception. And, to top things off, they didn't have the luxury of having a dead head sitting on the jump seat helping to observe and analyze what's going on.

On the preliminary report, CAPT and/or FO of the previous flight apparently had failed to mention the stick-shaker condition and the NNC for runaway trim they'd performed to overcome what thought to be the STS trim going the wrong way. The last few facts are very much what makes the hole in the Swiss cheese lined up.

[RatherBeFlying]

I'm thinking that the JT610 P1 retrimmed completely from each MCAS excursion, but P2 did not allowing the nose down trim excursions from MCAS to accumulate while P1 was head down in the manual - which had no information on MCAS.

​​​​​​Will the CVR, once released, show whether P1 communicated to P2 what P1 was doing with trim before handing over control?

Remember also that stick shaker was adding workload.

We now know that a faulty AoA will both trigger shaker and MCAS once at a safe height where flaps are normally retracted and more thorough diagnosis of the situation can begin, but then they were handed a new problem.

​​​​​

[RUTUS]

How about the NNCs in all 737s for Runaway Trim? oh of course it is not 'runaway' as it is only repeated (reads from dictionary) nose down trim, so I will let the Stab Trim fly me into the ground rather than switch it off.

Would you really let trim carry on monotonically trim down 2.5 units every 5secs and not switch it off? l can only assume that you would. It is really immaterial why the trim was operating it could be a now dead rodent chewing through an electric cable, you just want the trim to stop and two switches that have been there forever allow you to do that. I am sure that Boeing is aghast that their NNCs for trim runaway were being read in such a contracts lawyer fashion. Perhaps they should review the semantics of all memory items and NNCs/checklists and any training that reinforces those limiting semantics.


Yes recognizing the trim issue is the heart of the matter. That was exactly my point. You cannot make this into "switch off the AP and fly the plane"-scenario. A pilot with poor manual flying skills but being able to identify the issue does much better than a skilled flier who isn't able to identify the issue.

It doesn't help you to switch off AP and AT and stabilize things by flying "power and pitch". You can't because you don't achieve a stable pitch.

So hence my real point, the challenge: Show me that up until six months ago anyone suggested making "stab trim cutout" part of a "disengage auto and fly the plane" if you don't have a clue what the issue is.

The "should they have been able to catch on to the trim issue?" discussion has been done ad nauseam. In my personal opinion the only way to hypothetically get the truth there would be if you could find 20 average pilots who had been in coma for the last six months and put them through a surprise sim scenario replicating an actual MCAS-misfire.
Then we would know how the average pilot would have done.What people with all the facts are now convinced they would have done is not relevant evidence to me.

I bet that if you asked the average px if they were confident that they'd get a life jacket on in case of a water landing landing the vast majority would say yes. They've seen the briefing a gazzillion times. How hard can it be?

Yet we know how many out of a 150 px in the "Sully flight" actually managed to put on a life jacket properly waist strap and all. Was it a three digit number? Was it a two digit number?

[Loose rivets]

Having read every post since the first crash I'm at a loss as to how we're not, for the most part, progressing logical thought.

To see this 'Why didn't they fly the plane'. chanted out again and again is beyond offensive. The congressman has "been in contact with . . ." etc., etc. I'm sure he would have handled the MAX like a Warbird, and saved the day.

For the first time in many, many years on PPRuNe, I'm allowing myself to really bristle at some of the posts.

There are so many factors coming out of the woodwork. The Seattle Times was the first to spell out some of the home truths. The technical article today left me astonished. The rear switch (in the column) removed, and the function of the left and right Stabilizer cut out switches changed in the MAX. ??? Have I missed these points? Are they not correct? They're major factors.

'gums' has a lot of experience and his considered thoughts today about being in the hot seat for those first moments says a lot. Mostly, the problem was NOT bloody obvious, it was, insidious - proceeding in a gradual, subtle way, but with very harmful effects. A word I chose carefully in one of my earlier posts.

[patplan]

I'm thinking that the JT610 P1 retrimmed completely from each MCAS excursion, but P2 did not allowing the nose down trim excursions from MCAS to accumulate while P1 was head down in the manual - which had no information on MCAS.

​​​​​​Will the CVR, once released, show whether P1 communicated to P2 what P1 was doing with trim before handing over control?

Remember also that stick shaker was adding workload.

We now know that a faulty AoA will both trigger shaker and MCAS once at a safe height where flaps are normally retracted and more thorough diagnosis of the situation can begin, but then they were handed a new problem.

​​​​​https://i.ibb.co/1XfyyH1/pk-lqp-part-data.jpg (https://ibb.co/JpR66XV)The LEFT/CAPT shaker was triggered immediately, IAS/ALT disagreed as well. Meanwhile, MCAS trim was activated after the AC was flap up.

[gums]

Salute!

Apparently the Chuck Yeager cadre here lives on....
So today we see other examples:
That one is esay [sic], you cross check the 3 airspeed indicators, thrust, performance and attitude to determine if the stickshaker is real or false.
errrr, sir? What's with the airspeed and altitude warning lights ? "No problem, pilgrim, I can tell our speed is O.K. by how fast the trees are going by and the ground ain't getting a lot bigger"

stick shaker is on one side only, it is an AOA failure & not a valid stall warning.
errrr, sir, my stick ain't shakling, therefore, it must not be a valid stall warning, right.? I guess the airspeed and altitude and feel difference lights must also be false, ya think? "trust me, dweeb, I know a stall when I feel one"

Beam me up.

Gums sends...

[TowerDog]

Having read every post since the first crash I'm at a loss as to how we're not, for the most part, progressing logical thought.

To see this 'Why didn't they fly the plane'. chanted out again and again is beyond offensive. The congressman has "been in contact with . . ." etc., etc. I'm sure he would have handled the MAX like a Warbird, and saved the day.

For the first time in many, many years on PPRuNe, I'm allowing myself to really bristle at some of the posts.

There are so many factors coming out of the woodwork. The Seattle Times was the first to spell out some of the home truths. The technical article today left me astonished. The rear switch (in the column) removed, and the function of the left and right Stabilizer cut out switches changed in the MAX. ??? Have I missed these points? Are they not correct? They're major factors.

'gums' has a lot of experience and his considered thoughts today about being in the hot seat for those first moments says a lot. Mostly, the problem was NOT bloody obvious, it was, insidious - proceeding in a gradual, subtle way, but with very harmful effects. A word I chose carefully in one of my earlier posts.

Scratching my head now: If the cause of these two accidents was an MCAS event due to a faulty sensor, then the solution would be to click off those two Stab Trim Cutoff switches, then fly the airplane, make a landing, then go to the hotel and have a beer.
I have been practicing the Stab Trim-Run away on Boeing’s in various simulators for over 30 years and I would Hopefully remember these 2 switches if it happened in real life.
If this is beyond what is to expected of airline pilots these days, then I will take the train.:sad:

[deltafox44]

[LEFT]Alchad, #2365,
there is merit in your linked reference. https://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html#more
It's said that angle of attack disagree was 22°5 (at least on Lion Air). But the AoA vane does not directly measure angle of attack, but angle of airflow around the fuselage, which is higher - about twice the angle of attack - due to aerodynamics around a long body

That means the error at the Angle of Airflow vane was not 22°5 but about 45°, which correspond to the angle between AoA screws.

[Towhee]

"Much like tapping the brake pedal in a car to disengage cruise control, a sharp tug on the controls of older models of Boeing Co’s 737 used to shut off an automatic trim system that keeps the plane flying level, giving the pilot control.

But Boeing disabled the “yoke jerk” function when it brought out the 737 MAX, the latest version of its top-selling jet - and many pilots were unaware of the change, aviation experts told Reuters....

...pilots would have needed to know that MCAS existed, that it had unusual power to force the plane down and that “a hard pull on the yoke” would no longer turn off the automatic trim that uses MCAS, John Hansman, an aeronautics professor at MIT, said in an interview.

“That wasn’t clear to the pilots flying the airplane,” Hansman said. “The training material was not clear on that.”"


https://www.reuters.com/article/us-ethiopia-airplane-controls-explainer/change-to-737-max-controls-may-have-imperiled-planes-experts-say-idUSKCN1R322M

[Loose rivets]

Towhee:

So it seems that rear switch in the pole has been removed on the MAX.

That is a major difference. I wonder if it was mentioned in the few minutes of conversion notes.

TowerDog:

......If the cause of these two accidents was an MCAS event due to a faulty sensor, then the solution would be to click off those two Stab Trim Cutoff switches, then fly the airplane, make a landing, then go to the hotel and have a beer.

Well, that's the point. If. As in, If you know it's happening.

First and foremost: it's not a stab trim runaway in the usual sense. The inputs, resets and then re-datumizing is quite, quite different. Plus you're in a chaotic condition before 1000' and flaps up.

Remember, you observe the STS running on a daily basis, and the MCAS actions are so intermittent and subtle that you don't know there's something inputting into the Horizontal Stabilizer from that source. You're not going to be able to diagnose what's happening while under stress - especially if you've never been told there's a software system that's taking this mysterious action.
.
.
.

[lomapaseo]

It's said that angle of attack disagree was 22°5 (at least on Lion Air). But the AoA vane does not directly measure angle of attack, but angle of airflow around the fuselage, which is higher - about twice the angle of attack - due to aerodynamics around a long body

That means the error at the Angle of Airflow vane was not 22°5 but about 45°, which correspond to the angle between AoA screws.

I don't believe I really get this point. It sounds OK if indeed the airflow was not parallel with the fuselage at some locations. But why wouldn't the streamline effects be well known beforehand from wind tunnel testing and the AOA vanes located at a point where the lines are truly parallel?

[GroundGeek]

That means the error at the Angle of Airflow vane was not 22°5 but about 45°, which correspond to the angle between AoA screws.

Are you suggesting the AOA sensor was installed 45° from the proper angle? Is that even possible? (No keyway or other locating method?)

[Loose rivets]

So what's being said is, the AoA vane hub is rotated in error by one screw-hole place?

For it to be able to be so misaligned seems impossible - for the main casting to not be designed D shaped, or have a flat edge would be deeply worrying. But it is a compelling scenario since the output error is so consistent.

I'd personally discounted damage to the vane after the second crash, and would be mystified if it were to be a mechanical problem since the vanes are so strong. They look frail, but they're anything but.
.
.
.

[artee]

So what's being said is, the AoA vane hub is rotated in error by one screw-hole place?

For it to be able to be so misaligned seems impossible - for the main casting to not be designed D shaped, or have a flat edge would be deeply worrying.

I think that it's been established elsewhere on the thread/s that there are lugs or something that means that they can only be installed in the correct orientation - but tdracer has said that he has seen them carefully machined off so that they can in fact be incorrectly fitted...

[Loose rivets]

The only reason I can think of for doing that would be for one unit to be able to fit a new aircraft. Hmmm . . . now let me think.

'We could make those NG vanes fit the MAX if we shaved the lug a little.'

[Smythe]

Since it has not been disclosed the conditions and settings where the engine nacelles provide extra lift and nose up the ac (if/when MCAS kicks in)...an AoA sensor is meaningless.

The UT AoA sensors have an offset bolt pattern to insure correct installation.

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/320x229/k0ntbm_9f27c8e102564e540cdd94f9aa2649945e7fa95e.jpg

[WingNut60]

Does this help

OPERATIONAL USEOF ANGLE OF ATTACK (http://www.boeing.com/commercial/aeromagazine/aero_12/aoa.pdf)

[wonkazoo]

A nuance that I have not seen stated here previously, one well worth considering as people go back and forth arguing over whether or not the pilots should have saved the day:

MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.

I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.

I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.

We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??

If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??

That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.

We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.

What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.

What we cannot argue is that Boeing and the regulatory system produced a safe airplane.

Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.

The surprising thing isn’t that it happened, it’s that it took so long to happen.

Regards-
dce

[CurtainTwitcher]

There is a Boeing document made around year 2000 regarding how Boeing defines AOA I cannot post the link but the cover sheet label is
" operational use of angle of attack on modern commercial airplanes "

Aero 10 Flight operations
John cashman director
brian d kelley technical fellow

can be downloaded as a pdf or viewed in html
Here is your link: OPERATIONAL USE OF ANGLE OF ATTACK (http://www.boeing.com/commercial/aeromagazine/aero_12/aoa.pdf) (pdf)

[WingNut60]

Since it has not been disclosed the conditions and settings where the engine nacelles provide extra lift and nose up the ac (if/when MCAS kicks in)...an AoA sensor is meaningless.

The UT AoA sensors have an offset bolt pattern to insure correct installation.



What about positioning of the internal sensors? Are they indexed for location?
Can you take the units apart?

[Smythe]

Yes, the sensor vane is integral to the internals.
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/688x253/737_aoa_sensor_5023a6add37d47dbd171b88056da37d9066ff84f_73d8 ecc6544307579f691cf4ec86727a3b961581.jpg

It is indexed, according to the individual aircraft angle of attack of the wing to fuselage angle. I believe that if you consider the fuselage horizontal or at 0, the wing chord line is at an angle of 2.5 degrees on the 737?

What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?

[WingNut60]

Here is your link: OPERATIONAL USE OF ANGLE OF ATTACK (http://www.boeing.com/commercial/aeromagazine/aero_12/aoa.pdf) (pdf)

Metadata indicates that this document was created and last edited in Sept 2009.

[CurtainTwitcher]

Metadata indicates that this document was created and last edited in Sept 2009.
OK, there is an archive.org version of the document from < 2004 Version OPERATIONAL USE OF ANGLE OF ATTACK (https://web.archive.org/web/20040929004331/http://www.boeing.com/commercial/aeromagazine/aero_12/aoa.pdf)

[FCeng84]

Several times over the last few days, people have reached the conclusion that with full nose down trim on the stabilizer, there is not enough elevator authority to overcome the trim condition. This Reuters article repeats that idea. I just searched my manual, and in the section on loss of electric trim, the statement is made that:
"NOTE: Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position." Is that difference in control available due to blowdown on the elevator at high speed, or some other reason, or simply not true?

I believe that manual statement refers to the design criteria that continued safe flight and landing must be possible with the horizontal stabilizer frozen in any normally encountered position. The key here is “normally encountered”. This statement does not imply that it will be possible to safely land after running the stabilizer all the way to one end of its travel. Another key part of being able to safely return and land is not accelerating and cleaning up flaps with a frozen stabilizer.

[runner1021]

Another key part of being able to safely return and land is not accelerating and cleaning up flaps with a frozen stabilizer.
A shame Boeing didn't include such warnings in the event of MCAS driving the stab nose down.

Oh wait, Boeing didn't even admit the existence of MCAS.

[jimjim1]

For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA valueshttps://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html#more

The full post contains quite a few comments which I think will generate a few talking points.

From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"

Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

- At least one AoA sensor was changed immediately before penultimate flight. Presumably there was a percieved AoA sensor issue.
"replaced angle of attack sensor"

- Captain side AoA sensor showed 22 degree error for entirity of penultimate flight.

- Captain side AoA sensor showed 22 degree error for entirity of crash flight.

Perhaps the AoA sensor was not faulty and the issue lay elsewhere and was not correctly repaired?

I like** the idea of an encoding error. (**like the idea as an explanation for the observed symptoms - I don't like it that there was a crash - added in the hope of deflecting the present preposterous pprune pedants)

I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.

The sensor is an analog device and there will be an A to D converter at some stage.

A bad bit within the AD converter data path seems a distinct possibility.

[jimtx]

A nuance that I have not seen stated here previously, one well worth considering as people go back and forth arguing over whether or not the pilots should have saved the day:

MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.

I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.

I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.

We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??

If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??

That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.

We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.

What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.

What we cannot argue is that Boeing and the regulatory system produced a safe airplane.

Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.

The surprising thing isn’t that it happened, it’s that it took so long to happen.

Regards-
dce

I don’t think MCAS was clandestine. The Brazilian certifying authority listed it as a training difference in their OER where a Boeing chief technical pilot was listed as one of the authors or such. I still do not know how GOL addressed the required training for their Max pilots but they grounded their fleet after the second accident so they probably were not confident that whatever training they implemented was sufficient. The FAA and other certifying authorities must have know about MCAS but bought the company line about info overload.

[CurtainTwitcher]

From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"

Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf (https://www.pprune.org/www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf)


Your link didn't work for me (cutting and pasting the URL does, but clicking directly doesn't), this one should: PRELIMINARY KNKT.18.10.35.04 Aircraft Accident Investigation Report PT. Lion Mentari Airlines Boeing 737-8 (MAX); PK-LQP Tanjung Karawang, West Java Republic of Indonesia 29 October 2018 (https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf)

[mosquito88]

A nuance that I have not seen stated here previously, one well worth considering as people go back and forth arguing over whether or not the pilots should have saved the day:

MCAS introduced a single point of failure that without pilot intervention in a highly specific way results 100 percent of the time in the aircraft flying itself into the ground. Either the pilot nails the answer to the question while all hell is breaking loose and g-loads are all over the place (about a system which they had no awareness existed), and they do it within a very very short period of time, or the airplane will 100 percent fly itself into the ground. Straight into the ground BTW.

I cannot recall any other instance of a single point of failure system or sensor (or any system for that matter) on a commercial airplane which places the airplane in a state where the only chance for survival is a single action by the pilot, without which the airplane will crash. Once the AOA failed in Indonesia the airplane was essentially trying to fly itself into the ground. The Capt. kept that from happening for a bit, then it succeeded when he handed the airplane to the FO to grab the book and look for an answer that was not in fact there.

I can recall tons of technical issues that resulted in incidents and accidents, in fact I’ve survived a few on my own, but none where the failure of a single sensor meant that a perfectly good airplane was literally trying to kill everyone on board.

We can go round and round about whether or not the flight crew should have been able to aviate their way out of the circumstance they found themselves in, but if the penalty for failure to act quickly enough and perfectly enough on any given in-flight issue on a single sensor and a system about which you knew nothing was immediate death for you and your passengers would you still choose to fly?? Are you that certain of your perfection in the air??

If you knew that there might be a system on your airplane that you knew nothing about and that had the power to command the airplane to try to kill you, would you fly in that airplane, or god forbid take command of it with a couple hundred people in your care??

That is exactly what Boeing did to every MAX crew that flew the airplane. And whether with ill-intent or not they did it knowingly and deliberately. We don’t know them now, but Boeing is filled with smart people. Someone(s) knew exactly what Boeing was doing putting MCAS into service in the clandestine way they did, and I presume it was done that way for an (as yet unknown) reason. Those people will speak up at some point, or I hope they will anyway because it was no accident that MCAS anonymously arrived in the MAX without flight crews being made aware of its presence.

We can argue that the Lion Air crews who successfully survived an otherwise fatal experience should have alerted the airline, and we can argue a ton of other things too.

What we cannot argue, for one moment, is that the regulatory system that allowed Boeing to self-certify safety of the 737 MAX functioned as intended.

What we cannot argue is that Boeing and the regulatory system produced a safe airplane.

Quite to the contrary they produced an airplane that with the right type of single sensor failure would immediately try to kill everyone on board, with only the immediate and correct intervention of the pilots, who had no idea that the system trying to kill them even existed, to prevent that outcome.

The surprising thing isn’t that it happened, it’s that it took so long to happen.

Regards-
dce


Perfectly put.
Reliance on a single sensor driving a system that was not known to the crew and that could take over command of the aircraft is sheer madness (not to mention extreme negligence).

[Jetman346]

Great video to aid understanding

https://m.youtube.com/watch?v=xixM_cwSLcQ

wayne

[patplan]

From preliminary report.
"PRELIMINARY
KNKT.18.10.35.04"

Copy here for now -
www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf (https://www.pprune.org/www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf)


- At least one AoA sensor was changed immediately before penultimate flight. Presumably there was a percieved AoA sensor issue.
"replaced angle of attack sensor"

- Captain side AoA sensor showed 22 degree error for entirity of penultimate flight.

- Captain side AoA sensor showed 22 degree error for entirity of crash flight.

Perhaps the AoA sensor was not faulty and the issue lay elsewhere and was not correctly repaired?

I like** the idea of an encoding error. (**like the idea as an explanation for the observed symptoms - I don't like it that there was a crash - added in the hope of deflecting the present preposterous pprune pedants)

I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.

The sensor is an analog device and there will be an A to D converter at some stage.

A bad bit within the AD converter data path seems a distinct possibility.

It's somewhere inside the system, perhaps, as you suggested, it's in the AD converter. The replaced AOA vane had been sent to Florida by Indonesian Investigator for analysis and diagnostic. It will be interesting if it turns out there's nothing wrong with the vane.
..Found on pp. 7/8/9 of NTSC's Preliminary Report
https://i.ibb.co/Cbd0kTw/combo1c.png (https://ibb.co/N9hY8HF)
https://i.ibb.co/X2jCvtd/combo2z.png (https://imgbb.com/)
https://i.ibb.co/Zfhjpw6/fourthp.png (https://imgbb.com/)
Looking back to that AC and its symptoms, problems seemed to have revolved around the same area the whole time, albeit it had gotten progressively worse up until that fateful flight when ALL indicators found completely unreliable.

[FCeng84]

Perfectly put.
Reliance on a single sensor driving a system that was not known to the crew and that could take over command of the aircraft is sheer madness (not to mention extreme negligence).

Beyond that it is clearly a violation of the FARs for a system to have a failure mode arrived at by (1) any combination of failures whose probability is greater that 1x10E-9 or (2) any single failure that results in a catestrophic hazard level.

While in hindsight it may be found to be otherwise, I am certain that both Boeing and FAA determined that the hazard level associated with an AOA sensor signal failed high on a 737MAX was not catestrophic. As I have mentioned in previous posts I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.

[rog747]

My pal yesterday took photos at TFS (Tenerife South) showing the grounded TUI UK Max 8 (G-TUMH) and also another Max 8 belonging to Norwegian Air both of which were stranded when the flight ban was imposed leaving them unable to fly back to their respective bases.
Guess that no EU dispensations were granted for ferry flights.

[efatnas]

I am by no means an expert on electronics. The most modern plane I ever got to feed my desires on is a B767. Back in the airforce, way back then I as the Mil Spec 1553 was new couldn’t believe what it can do. That thing is like a Volkswagen now. Over the years I had the plaesure to talk and fly with a few Boeing test pilots. Their logic about the data buses is that it can get so complicated, they don’t want you to dick with the logic. They can’t possibly provide documentation for every single possibility that might arise because of the bus interaction with stuff. They expect the training departments to be capable of teaching their pilots enough about the airplanes to deal with scenarios like being able to turn things off. Now I flew a B727 as Captain for about 10 years in cargo and their wasn’t a taining event without a trim runaway or freight shift scenario. The cutout switches had some status. Since I fly the 76 I have not done a single such events which does malke me wonder.

[HarryMann]

I don't believe I really get this point. It sounds OK if indeed the airflow was not parallel with the fuselage at some locations. But why wouldn't the streamline effects be well known beforehand from wind tunnel testing and the AOA vanes located at a point where the lines are truly parallel?

That defintely is not practical or even achievable. All that matters is the calibration is reasonably linear and of reasonable magnitude... wouldn't have thought AoA is double freestream values around nose though!

[73qanda]

FCeng84 or anyone more knowledgeable than me can you explain any relationship between the Feel diff press defect ( written up on the Lion Air aircraft) and the AOA vane?
My thoughts were that Feel Diff Press meant either a hyd system failure or the elevator pitot was in trouble.
Cheers

[Uplinker]

....................I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.


I also don’t blame either crew - not having witnessed the exact situations, it is difficult to say they should have done x or y.

Having said that, I think that SIM training needs to adapt. For 18 years of commercial airline SIM details, I have been given engine failures on take-off. Then a single engine approach to a go around and then a landing. Once airborne again, we are given a systems failure such as hydraulic or electrical failure, or maybe fire or depressurisation and emergency descent. None of this is particularly difficult: a few memory actions, some memory drills, then work through the ECAM, EICAS or QRH

I can only recall having seen unreliable speed or disagreeing sensors or ADI disagrees on a handful of occasions, but they can be very insidious and dangerous. I think that much more emphasis now needs to be applied to computer faults and sensor failures in today’s electronically enhanced aircraft* . More scenarios should include information conflicts which lead to the requirement to revert to Pitch + Power = Performance to recover the aircraft.

Arguably, if a lot more emphasis had been placed on experiencing and practising cockpit information conflicts, and getting used to constantly checking and confirming that pitch, power and control inputs were appropriate; a great many accidents, such as AF447, the SFO 777, and the Swedish CRJ, several poorly flown or crashed go-arounds etc, in recent years could have been rescued by the crews.

* e.g. FBW, Boeing MCAS.

[airman1900]

From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:

FAA Reviews Enhanced MAX Flight-Test Data

Guy Norris Los Angeles

Boeing has completed a key certification flight test of enhanced 737 MAX flight-control computer software, marking a major step toward returning the grounded fleet to service.

The test flight, conducted using the first 737-7 variant of the MAX, validated a set of updates to the Maneuvering Characteristics Augmentation System (MCAS) flight control law as well as improved pilot displays. Although the changes are part of a set of upgrades developed in the aftermath of the Lion Air Flight 610 accident in 2018, they are also expected to address a similar set of control problems implicated in the crash of Ethiopian Airlines Flight 302 this month.

Boeing says it has been “working closely with the FAA on development, planning and certification of the software enhancement, and it will be deployed across the 737 MAX fleet in the coming weeks.” It adds, “The update also incorporates feedback received from our customers.” The FAA is expected to mandate the enhancement with an airworthiness directive at the end of March.

Although the company will not comment on the current status of flight tests, or say whether they have concluded, Boeing Chairman and CEO Dennis Muilenburg says: “[W]hile investigators continue to work to establish definitive conclusions, Boeing is finalizing its development of a previously announced software update and pilot-training revision that will address the MCAS flight control law’s behavior in response to erroneous sensor inputs.”

The software upgrade package, known as the EDFCS (enhanced digital flight control system), significantly modifies the MCAS that was introduced on the MAX to match aircraft-handling characteristics with those of the 737 Next Generation and decrease pitch-up tendency at elevated angles of attack. The MCAS changes are focused on three areas: improving activation logic, enhancing angle-of-attack (AOA) inputs and limiting stabilizer-command authority.

Boeing says the changes are designed to increase overall system redundancy, limit stabilizer trim commands in response to an erroneous AOA reading and retain elevator authority by limiting the degree of stabilizer command. The company is not yet detailing how the changes are being implemented. For example, Boeing has not clarified whether the AOA changes include adding more sensors or, as is considered more likely, revising the MCAS architecture to enable data from both the AOA vanes in the current configuration to be fed into both flight control computers.

A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system. Under the original design, the MCAS trims the aircraft nose down by moving the horizontal stabilizer up at 0.27 deg./sec. for 9.2 sec., stops for 5 sec., then trims nose down again for 9.2 sec., and continues to do so until the trim reaches the stabilizer travel limit or the crew intervenes. Boeing says that, as before, the crew will retain the capability to override the flight control law using either electric or manual trim, or by following the existing runaway stabilizer procedure and using the cutout switches as reinforced in the Operations Manual Bulletin issued on Nov. 6, 2018.

The enhanced software was demonstrated for the FAA on March 12, the day after the Civil Aviation Administration of China announced the first in a wave of 737 MAX groundings around the world; the FAA followed suit on March 13. Aviation Week was told that the software upgrade certification load, dubbed P12.1, was flown on the first 737-7 developmental aircraft, 1E001.

The greater part of the 1-hr. 20-min. test flight was flown at medium altitude between 13,500 and 17,350 ft. in a racetrack pattern over southwest Washington state. According to data from the flight-tracking website Flightradar24, the crew performed a series of high AOA maneuvers to validate the performance of the revised MCAS. These included at least six conducted during initial ascent, followed by descents from 17,000 to around 14,250 ft., during which speed dropped from more than 330 kt. to less than 180 kt.

The aircraft was then flown to 17,350 ft. and 265 kt. before pitching steeply nose down and recovering at around 15,900 ft. and 295 kt. The maneuver was repeated at a slower speed, before a further test point was conducted during which the 737 descended steeply from around 15,550 ft. to 13,500 while speed increased from 180 kt. to almost 270 kt. Two further steep descents and recoveries were then performed before the aircraft leveled off and returned to Seattle for landing.

Along with the MCAS changes, Boeing also is updating training requirements and flight-crew manuals. The company declines to comment on reports in The Wall Street Journal that Boeing and the FAA have struggled to agree on the extent of some of these changes, particularly regarding the revised training procedure. Alterations are planned for the Airplane Flight Manual and Flight Crew Operations Manual, as well as new notes for the speed trim fail checklist in the Quick Reference Handbook. Other changes are being made to the Airplane Maintenance Manual and the Interactive Fault Isolation Manual.

Boeing has outlined updated training documents to advise pilots of the changes as well, but according to the Journal, the FAA has pushed for more extensive training, including a self-guided computer-based instruction course.

[Derfred]

...
To be fair, I am not sure exactly what I would have done in the first two minutes of the 610 scenario. I would not have thought the trim system was my main problem. If my wheel electric switch kept working, I would have kept going and prolly slowed down once flaps were up. ...

I know you aren’t a 737 pilot, but this is prolly what an appropriately trained 737 pilot would have done:

First problem: Stick shaker on rotate: fly the aircraft, probably reducing pitch attitude initially, but not into the ground. Assessing performance would quickly identify nuisance stick shaker. Hold an appropriate pitch attitude while moving onto second problem.

Second problem: IAS disagree. Apply Airspeed Unreliable memory items. Autopilot/Autothrottle/Flight-Directors OFF. Set pitch and thrust 10deg/80% N1. Fly the aircraft to a safe altitude and hold that pitch and thrust until completing the checklist by reference to the QRH, which would have had them identify the correct IAS indicator (no.2) and engage autopilot B, and return to land.

If they’ had done this, the flaps would never have come up, MCAS would never have activated, and we probably still wouldn’t even know it exists!

[GordonR_Cape]

airman1900

A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system.


I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.

[lomapaseo]

Beyond that it is clearly a violation of the FARs for a system to have a failure mode arrived at by (1) any combination of failures whose probability is greater that 1x10E-9 or (2) any single failure that results in a catestrophic hazard level.

While in hindsight it may be found to be otherwise, I am certain that both Boeing and FAA determined that the hazard level associated with an AOA sensor signal failed high on a 737MAX was not catestrophic. As I have mentioned in previous posts I think this all comes down to assumptions regarding pilot actions given this failure and the sum total of its effects. I am not singling out the crew as solely responsible for the Lion Air accident. We need to focus on the assumptions. As for the Ethiopian accident that is the intended focus of this thread, we simply do not yet have the data necessary to determine if any of this MCAS and errant AOA signal discussion actually applies.

No argument with your analysis but;

The so called system safety e.g. "any combination of failures whose probability is greater that 1x10E-9" may not be specified when a more specific rule has been applied via another part of the regulations.

I think it would be best that we confine our discussions around the actual rulings by the FAA that permitted this control logic.

[patplan]

airman1900



I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.
Yupe, if the reporter was right [doubt it...], it would be another infinite loop to the end of jackscrew...

[JRBarrett]

Yes, the sensor vane is integral to the internals.
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/688x253/737_aoa_sensor_5023a6add37d47dbd171b88056da37d9066ff84f_73d8 ecc6544307579f691cf4ec86727a3b961581.jpg

It is indexed, according to the individual aircraft angle of attack of the wing to fuselage angle. I believe that if you consider the fuselage horizontal or at 0, the wing chord line is at an angle of 2.5 degrees on the 737?

What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?

Internal sensors can measure pitch angle and acceleration, but that would be of no use for AOA. The AOA sensor measures the angle between the relative wind and the fuselage, and that can only be achieved by a sensor attached externally and exposed to the air stream.

As a maintenance engineer, I have never worked on any model of the 737, but in my career I have had occasion to change AOA vanes several times on various aircraft models. Only once was the change-out caused by a malfunction of the actual position transducer. The more common malfunction is a failure of the anti-ice heater.

In any case, I have never seen any AOA vane model that did not have either a guide pin, or an offset bolt pattern that would make it physically impossible to install it in the wrong orientation.

The actual position is typically measured in one of two ways. On smaller business jets which have DC electrical systems, the AOA transducer will consist of a precision potentiometer that outputs a variable DC voltage corresponding to position. On larger aircraft with AC electrical systems, the AOA transducer will consist of a RVDT transformer which outputs an AC waveform with position corresponding to the amplitude and phase of the output waveform.

https://en.m.wikipedia.org/wiki/Rotary_variable_differential_transformer

In any case, the raw position data is an analog signal. At some point downstream, the analog signal will be digitized by an AD (analog-to-digital) converter.

The analysis by “Satcom Guru” is intriguing. He has found that the digital representation of AOA in the 737 is expressed as a 26 bit binary word, and if the 26th bit becomes incorrectly set (goes from binary zero to binary 1), it will correspond to an AOA of exactly 22 degrees, which is what the FDR on the Lion Air flight recorded for the left AOA sensor. It remains to be seen if this was also the case on the Ethiopian flight for one of the two sensors.

I strongly suspect that there was nothing wrong with the AOA sensor on LionAir - but rather some kind of intermittent hardware or software fault in the downstream conversion of the position data from analog to digital. If this also happened on Ethiopian, then the cause of this possible data corruption is going to have to be found and corrected on the Max in addition to any changes made to the MCAS system.

[bill fly]

Well, if that’s true (by airman1900 above) it’s a combination of fixes, which many here have advocated.
Better would have been a system which doesn’t affect the elevator trim at all. But that’s the 737, even the auto land on the 300 required a massive stabiliser up input at 400 feet to enable the flare. If you then had an engine failure, the subsequent (manual) go around required mucho stick forward to avoid a huge pitch up.
having got away with that and had it certified, I guess Boeing thought they could fix just about everything via trim...
edited to remove italic...

[Discorde]

As I've posted before in threads relating to false stick-shaker and overspeed warnings: it's worth knowing in advance which CBs protect these warning systems so they can be isolated if required, which will remove the noise distractions while problem solving is underway. For B757/767:

Aural warning: B16 & H35
Stick-shaker: C11 & J21

This assumes of course that these CBs are not also protecting other vital circuits.

[WHBM]

From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:
Appears almost totally written by the Boeing PR department.

[VicMel]

VicMel - I really appreciate your thoughtful response. I sense that overall you and I are on the same page. Please allow me to provide a few inputs on your points:

C) MCAS is implemented within the FCC within the same software that controls other automatic stabilizer control functions such as offload when A/P is engaged and STS. This code already required to be designed to high standards.
Conclusion a) We may need to rely less on critical crew action, but there must be some base level that can be counted upon. I suggest at least:
- RTO for engine out below V1
- Pull for takeoff somewhere near Vr
- Gear and flap management and coordination with associated speeds throughout flight
- Comply with ATC guidance
- Ability to navigate to destination
- Ability to capture and follow glideslope and localizer to runway and command landing flare
- Recognize unstable approach and execute go-around
- Sorry for the length of this list. My point is that there are many pilot actions we count on to maintain safe operation
Conclusion b) I fully agree and suggest adding that if the inputs are garbage the system should be robust enough to maintain safety.

Thanks for your detailed response with all of your valid comments. As you say, I believe we, and many other posters are “on the same page”.

I fully agree with your comment regarding crew action “there must be some base level that can be counted upon”. The upside of human unpredictability is the ‘magic’ of intuition, i.e. being able to think ‘outside the box’ (literally in aviation terms). This is why a pilot will always be needed on an aircraft with passengers. The point I was trying to get across is I believe aviation authorities must stipulate that if a supplier is using crew actions as part of his probabilistic safety case, then a Human Factors assessment has to be carried out. This would produce a figure for the probability of achieving whatever task the crew are supposed to do. This figure then has to go into the fault tree(s) to show the aircraft meets its acceptable safety criteria.

As software is my specialty, I would like to expand more on the software criticality issue, please pardon me if I am stating the obvious. This issue is in regard to MCAS in particular, but also other systems that are considered to be not safety critical, such as Air Data Systems. You are right to say about MCAS software, “This code already required to be designed to high standards”. However, there is a huge difference between the DO-178C software certification standard Level A (catastrophic failure, potentially loss of aircraft) and Level C (major failure, potentially minor injuries to passengers). I would expect all Level C software to be produced to a high standard, but Level A obviously has to be at a very significantly higher standard. There is a huge cost saving that can be made if the software can be justified as not needing to be at Level A; some estimates suggest Level A is at least 2 to 3 times more expensive to produce than Level C. The main 3 factors leading to this increased cost are:-
a) independence of verification; which needs additional team(s) of engineers
b) quality of process; e.g. using Ada rather than C, code analysis tools and (most importantly) specialist software engineers with lots of wide ranging experience on real time, safety critical systems.
c) complexity of software; there is a saying ‘system safety lies within the software’, meaning software has to be added to basic functionality to ensure the system meets its prescribed safety requirements. For example the hardware engineer may determine that triplex sensors are needed to ensure hardware integrity, but then the system engineer has to determine how the software is to handle the 3 inputs to produce a ‘safe to use’ output. This might be a ‘vote’ or an average or using historical readings to determine best integrity. And if the triplex sensors are vulnerable to ‘common mode failure’, the team might decide a different technology sensor has to be used, or to use other system’s data in order to provide a temporary reversion mode.

Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

[Alchad]

Thanks for your detailed response with all of your valid comments. As you say, I believe we, and many other posters are “on the same page”.

Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

If I were a betting man, I would put a few pounds on this suggestion. Failure of the AoA sensor seems to being clutched at like the proverbial man and a straw, but I've yet to see anything which confirms this. Let's hope Boeing are also pouring over the code with a very fine toothcomb.

Peter Lemme (Satcom Guru) has also commented on the AoA versus software issue.

(I've posted this previously but it adds context to repost here.)

Ethiopian ET302 similarities to Lion Air JT610Reports from Ethiopian investigators have implicated the same Angle of Attack (AoA) sensor malfunction that was observed on Lion Air. Lion Air captain AoA sensor read about 22 degrees higher than the First Officer AoA sensor (a large bias error). Initial assessment of Lion Air AoA failure modes did not reveal any obvious electrical malfunction that could create the bias. The simplest explanation was that the AoA vane had been bent, causing a gross aerodynamic offset in the readings. If ET302 encountered the exact same offset, with the likelihood of it being bent exactly the same way not being conceivable, some other factor must be in play. For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA values (all other bits would match). Is it possible that the ARINC 429 word is getting corrupted (software defect)? If the ET302 offset was something like 20 or 24, this theory falls apart.

Full post

https://www.satcom.guru/2019/03/ethi...lion.html#more (https://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html#more)

[OldnGrounded]

From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:

". . . Boeing says the changes are designed to increase overall system redundancy, limit stabilizer trim commands in response to an erroneous AOA reading and retain elevator authority by limiting the degree of stabilizer command."


This appears to quote material from Boeing. It also seems to support the understanding that MCAS, as originally implemented, had authority to command stab trim positions beyond points where elevator inputs could override.

[Smythe]

Aero-12:

The center of gravity (CG) also affects the lift that the wing must produce. As the CG moves forward, the nose-down moment increases because of the airplane weight and wing lift (fig. 5) (http://www.boeing.com/commercial/aeromagazine/aero_12/attack_fig5.html). Therefore, the downforce on the horizontal tail required to trim is increased. This means that the wing must provide enough lift to compensate for the download on the tail in addition to the weight of the airplane. Note that the AOA of stall is not changed, but the lift required of the wing is greater, and therefore the stall speed is increased.

https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/360x452/attack_fig5_ace6fc637899fd0fc2684a58efe863c39b92a0f8.jpg

[BlueMax56]

NY Times today: Boeing was "Go, Go, Go to beat Airbus with 737 Max
(can't post the URL yet but worth reading)

[FCeng84]

So in other words, you are saying that, "Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position" doesn't mean "regardless of stabilizer position"; it means "any NORMALLY ENCOUNTERED position." I think I'm going to have to go back to English class, I guess.

Consider the situation of the airplane being loaded to its aft CG limit but the stabilizer trimmed full nose up or the opposite of forward CG with full nose down stabilizer. In either of these cases the elevator will be overwhelmed - particularly at high speed. Why do you suppose runaway stabilizer memory item to shut down stabilizer power is so critical and practiced so often?

[FCeng84]

airman1900



I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.

Hopefully Boeing will make the details of the MCAS modification clearer soon. MCAS in its original implementation would run again in the presence of AOA failed high following any amount of pilot pitch trim command. One can envision a modification to require that the pilot have run the trim back nose up at least a certain amount before allowing MCAS to go again. Or how about requiring that AOA drop low after having been high before allowing MCAS to go again. There are lots of things that could be done to provide additional interlocks. I am certain that we will learn that simply blipping trim with the revised logic will not trigger MCAS to reset to the point of running in another full increment of airplane nose down stabilizer motion.

[MemberBerry]

FCeng84 or anyone more knowledgeable than me can you explain any relationship between the Feel diff press defect ( written up on the Lion Air aircraft) and the AOA vane?
My thoughts were that Feel Diff Press meant either a hyd system failure or the elevator pitot was in trouble.
Cheers

Incorrect AoA data can cause the aircraft to "believe" it's in a stall situation, when it is not.

As a result it can increase the feel pressure to 4 times the normal pressure, to make it harder to pull the control column and bring the aircraft deeper into the stall.

[GordonR_Cape]

Hopefully Boeing will make the details of the MCAS modification clearer soon. MCAS in its original implementation would run again in the presence of AOA failed high following any amount of pilot pitch trim command. One can envision a modification to require that the pilot have run the trim back nose up at least a certain amount before allowing MCAS to go again. Or how about requiring that AOA drop low after having been high before allowing MCAS to go again. There are lots of things that could be done to provide additional interlocks. I am certain that we will learn that simply blipping trim with the revised logic will not trigger MCAS to reset to the point of running in another full increment of airplane nose down stabilizer motion.

From a programming point of view, having a system remember its previous state, and respond differently, creates all kinds of complexity. I would never want to go down that route, but can't see simple ways of avoiding the threat of multiple false MCAS activation, while still catering for repeated stalls.

Knowledge of the actual value of the trim stabiliser would be interesting, but I have not seen any mention of that as an input parameter.

[FlexibleResponse]

JRBarrett
The analysis by “Satcom Guru” is intriguing. He has found that the digital representation of AOA in the 737 is expressed as a 26 bit binary word, and if the 26th bit becomes incorrectly set (goes from binary zero to binary 1), it will correspond to an AOA of exactly 22 degrees, which is what the FDR on the Lion Air flight recorded for the left AOA sensor.

I strongly suspect that there was nothing wrong with the AOA sensor on LionAir - but rather some kind of intermittent hardware or software fault in the downstream conversion of the position data from analog to digital. If this also happened on Ethiopian, then the cause of this possible data corruption is going to have to be found and corrected on the Max in addition to any changes made to the MCAS system.
VicMel
Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

Alchad
If I were a betting man, I would put a few pounds on this suggestion. Failure of the AoA sensor seems to being clutched at like the proverbial man and a straw, but I've yet to see anything which confirms this. Let's hope Boeing are also pouring over the code with a very fine toothcomb.

Peter Lemme (Satcom Guru) has also commented on the AoA versus software issue.

The replacement of the identified "faulty AOA" sensor with another AOA sensor immediately before the Lion Air crash did not prevent the same "faulty AOA" sensor signal from reoccurring.

And why was the AOA faulty signal accompanied by similtaneous altitude, airspeed disagree indications along with PCU fault?

I agree that this all seems to be pointing at faulty sensor signal conditioning or processing in the air data computer software.

[Smythe]

Here you go Blue Max

Go,Go,Go... (https://www.nytimes.com/2019/03/23/business/boeing-737-max-crash.html)

[Smythe]

All these known issues with AoA sensors....from Boeing themselves Aero-12:

Stall warning devices have been mounted on the wing, but most modern commercial jet airplanes have movable leading edges that would interfere with such an installation. Most have the sensor located on the fuselage, far ahead of the wing, reducing the effect of changes in lift and configuration. Nearer to the nose of the airplane, the airflow is relatively clean and the boundary layer is thin, minimizing the required probe height.

Even at the nose, many factors can affect the relationship between the local AOA and true wing AOA (fig. 9) (http://www.boeing.com/commercial/aeromagazine/aero_12/attack_fig9.html). The angle of airflow around the nose is not the same as at the wing.

Also, the sensitivity to changes in AOA is greater, so a 1-deg change in true wing AOA causes a local flow change at the nose of 1.5 to 2 deg.

The trailing-edge flap position has an influence on a typical AOA sensor calibration, as has landing gear position (in particular, that of the nose landing gear doors).

Mach number affects the flow around the nose and therefore changes the sensor calibration.

https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/360x543/attack_aoaanderrors_73812036e0ef355610ee85163eb4893fe5f1a9eb .jpg

Pitching the airplane can cause erroneous readings at the sensor. While the nose is pitching up (as in a turn), the local flow angle is reduced, causing the reading to be too low. Although the sensors are placed to minimize the effect of sideslip, it is not eliminated and can be quite significant at sideslip angles that may occur on short final approaches or with an engine out.

Even variations in the contour of the skin near the sensor can subtly affect the local flow angle. Many of these design challenges also affect pitot and static port installation and accuracy.

The sensor itself has potential for error. The combination of installation error, zero bias, and aerodynamic inaccuracy can total 0.5 deg or more. Contamination or damage can also affect the sensors accuracy.

For the most part, the effects discussed above can be compensated for and, depending on the airplane, many have been.

It should be noted, however, that each correction has its own inherent uncertainty and can also cause erroneous readings if the input data is incorrect.

[airman1900]

NYT article:Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 Max

Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 Max
By David Gelles, Natalie Kitroeff, Jack Nicas and Rebecca R. Ruiz

Boeing faced an unthinkable defection in the spring of 2011. American Airlines, an exclusive Boeing customer for more than a decade, was ready to place an order for hundreds of new, fuel-efficient jets from the world’s other major aircraft manufacturer, Airbus.

The chief executive of American called Boeing’s leader, W. James McNerney Jr., to say a deal was close. If Boeing wanted the business, it would need to move aggressively, the airline executive, Gerard Arpey, told Mr. McNerney.

To win over American, Boeing ditched the idea of developing a new passenger plane, which would take a decade. Instead, it decided to update its workhorse 737, promising the plane would be done in six years.

The 737 Max was born roughly three months later.

The competitive pressure to build the jet — which permeated the entire design and development — now threatens the reputation and profits of Boeing, after two deadly crashes of the 737 Max in less than five months. Prosecutors and regulators are investigating whether the effort to design, produce and certify the Max was rushed, leading Boeing to miss crucial safety risks and to underplay the need for pilot training.

While investigators are still trying to determine the cause of the crash in Ethiopia this month and one in Indonesia in October, they are focused on a newly installed piece of software designed to avoid stalls. The software was meant to compensate for bigger, more fuel-efficient engines and ensure the plane flew the same way as an earlier version.

Months behind Airbus, Boeing had to play catch-up. The pace of the work on the 737 Max was frenetic, according to current and former employees who spoke with The New York Times. Some spoke on the condition of anonymity because of the sensitivity of the matter.

Engineers were pushed to submit technical drawings and designs at roughly double the normal pace, former employees said. Facing tight deadlines and strict budgets, managers quickly pulled workers from other departments when someone left the Max project. Although the project had been hectic, current and former employees said they had finished it feeling confident in the safety of the plane.

The specter of Boeing’s chief rival was constant. Airbus had been delivering more jets than Boeing for several years. And losing the American account would have been gutting, costing the manufacturer billions in lost sales and potentially thousands of jobs.

“They weren’t going to stand by and let Airbus steal market share,” said Mike Renzelmann, an engineer who retired in 2016 from Boeing’s flight control team on the 737 Max.

The successful end of a 2014 test flight of the Airbus A320neo. When Airbus announced plans for the plane in 2010, a Boeing executive told employees that it posed no threat.

Dismissing a Rival

Boeing didn’t seem bothered at first by the A320neo, the fuel-efficient plane that Airbus announced in 2010.

At a meeting in January of the next year, James F. Albaugh, the chief executive of Boeing’s commercial airplanes division, told employees that Airbus would probably go over budget creating a plane that carriers didn’t really want, according to a recording of the meeting reviewed by The Times.

Mr. Albaugh boasted that carriers were already paying more for Boeing’s single-aisle jet than the Airbus version. He didn’t see the need to strike now — Boeing could wait until the end of the decade to produce a new plane from scratch, the executive said.
“I don’t think we need to get too spun up over the fact that they’re making some sales,” he said.

For decades, Airbus was barely on Boeing’s radar. A consortium started in 1970 by several European countries, it was slow to compete globally. Boeing, founded in 1916, dominated the passenger-jet market with its 737 midsize jet and the 747 jumbo jet.

Then came John Leahy, an American who rose through the ranks to become the chief Airbus salesman in 1994. Mr. Leahy was relentless. Once, the chief executive of an airline got sick just as a deal was about to close. Mr. Leahy traveled to the man’s house, and the executive signed the papers while wearing his bathrobe.

“Boeing thought we were a flash in the pan,” Mr. Leahy said in an interview. “But I thought there was no reason we couldn’t have 50 percent of the market.”

Mr. Leahy scored a major coup in 1999 when JetBlue decided to launch with a fleet composed entirely of Airbus A320s. In the years that followed, more low-cost carriers around the world, like easyJet, placed big orders, too.

Airbus had pulled ahead of Boeing by 2005. “Boeing has struggled with the development work needed to take the company into the 21st century,” Tim Clark, president of Emirates, the Dubai airline, said that year. Airbus, he said, “has been braver, more brazen.”

In 2008, Airbus delivered 483 airplanes, while Boeing delivered just 375. Three years later at the Paris Air Show, Airbus took orders for 730 aircraft, worth some $72.2 billion, with its new fuel-efficient version dominating.

“Boeing was just completely arrogant in dismissing the viability of the A320,” said Scott Hamilton, managing director of the Leeham Company, an aviation consulting firm.

As American considered placing its largest-ever aircraft order exclusively with Airbus in the spring of 2011, executives at the carrier initially didn’t believe Boeing thought that the threat was real, according to a person involved with the discussions, who spoke on the condition of anonymity.

Airbus had a team camped out in a suite at the Ritz-Carlton in Dallas, near American’s headquarters. Mr. Leahy traveled to Dallas and dined with the American chief, Mr. Arpey, at the Mansion on Turtle Creek, a five-star hotel. Boeing visited less frequently, according to several people involved in the sales process.

With American pondering which planes to buy, Boeing made a business decision. A former senior Boeing official said the company opted to build the Max because it would be far quicker, easier and cheaper than starting from scratch, and would provide almost as much fuel savings for airlines.

Eventually, American decided to make deals with both Boeing and Airbus, buying hundreds of jets from each. Mr. Arpey called Mr. McNerney again, this time reading from a script to carefully calibrate his words. First, he congratulated the Boeing chief on the deal, according to the person with knowledge of the discussions. Then he broke the news that American would also place an order with Airbus.

'Intense Pressure Cooker'

Inside Boeing, the race was on. Roughly six months after the project’s launch, engineers were already documenting the differences between the Max and its predecessor, meaning they already had preliminary designs for the Max — a fast turnaround, according to an engineer who worked on the project.

“The timeline was extremely compressed,” the engineer said. “It was go, go, go.”

One former designer on the team working on flight controls for the Max said the group had at times produced 16 technical drawings a week, double the normal rate. “They basically said, ‘We need something now,’” the designer said.

A technician who assembles wiring on the Max said that in the first months of development, rushed designers were delivering sloppy blueprints to him. He was told that the instructions for the wiring would be cleaned up later in the process, he said.

His internal assembly designs for the Max, he said, still include omissions today, like not specifying which tools to use to install a certain wire, a situation that could lead to a faulty connection. Normally such blueprints include intricate instructions.

Despite the intense atmosphere, current and former employees said, they felt during the project that Boeing’s internal quality checks ensured the aircraft was safe.

In a statement, Boeing said: “The Max program launched in 2011. It was offered to customers in September 2012. Firm configuration of the airplane was achieved in July 2013. The first completed 737 Max 8 rolled out of the Renton factory in November 2015.”

The company added, “A multiyear process could hardly be considered rushed.”

At the heart of Boeing’s push was a focus on creating a plane that was essentially the same as earlier 737 models, important for getting the jet certified quickly. It would also help limit the training that pilots would need, cutting down costs for airlines.

Rick Ludtke, an engineer who helped design the 737 Max cockpit and spent 19 years at Boeing, said the company had set a ground rule for engineers: Limit changes to hopefully avert a requirement that pilots spend time training in a flight simulator before flying the Max.

“Any designs we created could not drive any new training that required a simulator,” Mr. Ludtke said. “That was a first.”

When upgrading the cockpit with a digital display, he said, his team wanted to redesign the layout of information to give pilots more data that were easier to read. But that might have required new pilot training.

So instead, they simply recreated the decades-old gauges on the screen. “We just went from an analog presentation to a digital presentation,” Mr. Ludtke said. “There was so much opportunity to make big jumps, but the training differences held us back.”

“This program was a much more intense pressure cooker than I’ve ever been in,” he added. “The company was trying to avoid costs and trying to contain the level of change. They wanted the minimum change to simplify the training differences, minimum change to reduce costs, and to get it done quickly.”

Boeing said in a statement that the 2011 decision to build the Max had beaten out other options, including developing a new airplane.

“The decision had to offer the best value to customers, including operating economics as well as timing, which was clearly a strong factor,” the company said. “Safety is our highest priority as we design, build and support our airplanes.”

A Cascade of Changes

Months before Boeing’s announcement of the Max, the commercial airplanes executive, Mr. Albaugh, critiqued the decision by Airbus to refit the A320 with bigger engines, which could alter the aerodynamics and require big changes to the plane.

“It’s going to be a design change that will ripple through the airplane,” Mr. Albaugh said in the meeting with employees.

“I think they’ll find it more challenging than they think it will be,” he told them. “When they get done, they’ll have an airplane that might be as good as the Next Generation 737,” a plane that Boeing had launched in 1997.

But a main selling point of the new A320 was its fuel-efficient engines. To match Airbus, Boeing needed to mount the Max with its own larger and powerful new engines.

Just as Mr. Albaugh had predicted for Airbus, the decision created a cascade of changes. The bigger engines altered the aerodynamics of the plane, making it more likely to pitch up in some circumstances.

To offset that possibility, Boeing added the new software in the Max, known as MCAS, which would automatically push the nose down if it sensed the plane pointing up at a dangerous angle. The goal was to avoid a stall. Because the system was supposed to work in the background, Boeing believed it didn’t need to brief pilots on it, and regulators agreed. Pilots weren’t required to train in simulators.

The push for automation was a philosophical shift for Boeing, which for decades wanted to keep pilots in control of the planes as much as possible. Airbus, by comparison, tended to embrace technology, putting computers in control. Pilots who preferred the American manufacturer even had a saying: “If it’s not Boeing, I’m not going.”

The new software system is now a focus of investigators who are trying to determine what went wrong in the Ethiopian Airlines crash and the Lion Air tragedy in Indonesia. A leading theory in the Lion Air crash is that the system was receiving bad data from a faulty sensor, triggering an unrecoverable nose dive. All 737 Max jets around the world are grounded, and Boeing has given no estimate of when they might return to flight.

In Renton, Wash., where the 737 Max is produced in a 1.1-million-square-foot plant, the mere possibility that Boeing engineering contributed to the crashes has cast a pall over the factory. After the Lion Air crash, Boeing offered trauma counseling to engineers who had worked on the plane.

“People in my group are devastated by this,” said Mr. Renzelmann, the former Boeing technical engineer. “It’s a heavy burden.”

In a statement, Boeing’s chief executive, Dennis A. Muilenburg, said he had spent time in Renton recently and “saw firsthand the pride our people feel in their work and the pain we’re all experiencing in light of these tragedies.”

Boeing is working on an update to MCAS software. The company was meeting with carriers over the weekend to discuss the update, which is expected to roll out by April. It also intends to make a previously optional safety indicator in its cockpit standard in new Max jets.

The business is increasingly under pressure as airlines reconsider their orders and ask for compensation. But work in Renton is continuing apace.

Boeing now makes a record 52 Maxes a month, and aims to reach 57 by April. As fuselages and plane skeletons continued to chug into the factory by train this past week, crews worked around the clock to make thousands more.

A version of this article appears in print on March 24, 2019, on Page A1 of the New York edition with the headline: A Jet Born of a Frantic Race to Outdo a Rival.

[MemberBerry]

@RUTUS, Since there are no other electrical connections in that diagram, the logical conclusion is that indeed on the NG any kind of automatic trim changes can be disabled by the AP cutout switch, and also by the column cutout switch connected in series with it.

I can't find a similar diagram for the MAX, but I remember reading that the cutout system has been redesigned. For example the two cutout switches have been renamed, from MAIN ELECT and AUTO PILOT, to PRI and B/U (primary and backup).

And, if I remember correctly, those two switches don't longer have independent functionality on the MAX, because they are connected together in series. If one of them gets stuck or fails shorted, the other can act a backup for it, so on the MAX both manual cutout switches would disable any kind of electric trim, manual or automatic.

I don't have further details about that, and I wouldn't want to speculate about exactly how it works on the MAX in combination with the column cutout switches, but this has been discussed previously in the Lion Air thread, you may try to look there for more details.

[BobM2]

The replacement of the identified "faulty AOA" sensor with another AOA sensor immediately before the Lion Air crash did not prevent the same "faulty AOA" sensor signal from reoccurring.
And why was the AOA faulty signal accompanied by similtaneous altitude, airspeed disagree indications along with PCU fault?

There has been no mention of an AOA failure prior to its replacement on the evening prior to the crash. It was apparently replaced as trouble-shooting in response to repeated write-ups of Capt unreliable airspeed & altitude. This did not correct the unreliable airspeed & altitude, but rather introduced an additional failure on the last two flights.

[Loose rivets]

RUTUS. I fear that so much is being ripped out of this thread that the loss of continuity makes some posts meaningless.

I posted mentioning a previous link that stated that the rear (hidden) switch in each column had been removed from the MAX. If true, and it seems to be, it is a major change, inasmuch as a quick tug against a nose-down trim would not have remotely the same effect.

The changes to the two emergency cut out switches, mentioned again above, are extraordinarily misleading - if not covered in MAX conversion training.

[deltafox44]

What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?
Airflow is horizontal only in level flight ! not in climb or descent :ooh:

[airman1900]

WSJ: Boeing Plans Fixes to Make 737 MAX Stall-Prevention Feature Easier for Pilots to Control
Subtitled: Federal Aviation Administration officials have tentatively approved sweeping software and pilot-training changes

Boeing Plans Fixes to Make 737 MAX Stall-Prevention Feature Easier for Pilots to Control

Federal Aviation Administration officials have tentatively approved sweeping software and pilot-training changes

By Andy Pasztor and Andrew Tangel

U.S. air-safety regulators have tentatively approved sweeping software and pilot-training changes for Boeing Co.’s BA -2.83% grounded 737 MAX jets, aimed at fixing problems with a suspect flight-control system, according to internal government documents and people familiar with the details.

The extensive revisions, these industry and government officials said, will make the automated stall-prevention feature, called MCAS, less aggressive and more controllable by pilots.

They also said the enhanced training, relying on self-guided interactive instruction on laptops, highlights information about when the system engages and how pilots can shut it off.

The changes amount to a reversal from major design and engineering principles Boeing relied on when it developed the stall-prevention system, which is suspected of causing the fatal dive that killed 189 people on board a Lion Air 737 MAX in Indonesia last October. A team of international crash investigators also is looking into whether a similar problem led to the crash of an Ethiopian Airlines plane less than five months later.

The Federal Aviation Administration has said it was working with Boeing to develop and install a revised MCAS system based on lessons learned from the Lion Air tragedy, but the extent of the changes goes beyond what some industry officials expected. An FAA spokesman declined to comment on specifics of the pending changes.

Accident investigators have said the Lion Air plane got erroneous information from one sensor that caused the stall-prevention system to misfire, repeatedly pushing the nose of the plane and ending at the maximum downward angle even though the pilots were resisting. Authorities have said they see clear similarities between that accident and the Ethiopian crash on March 10.

The modifications, officials said, create a gentler stall-prevention feature, redesigned so it won’t overpower other cockpit commands or misfire based on faulty readings from a single sensor. It is devised to automatically push the nose down only once—for no longer than 10 seconds—if the aircraft is in danger of stalling and losing lift.

The changes have been tentatively approved by FAA officials, the people familiar with the details said, subject to final ground-simulator checks and flight tests. They could be rolled out to airlines’ 737 MAX jets in the next few weeks.

A Boeing official said the new MAX software could still go through revisions, and the timing of formal approval from the FAA and foreign regulators remains fluid.

Even after the changes are fully implemented in the U.S., air-safety regulators in Canada and the EU are poised to conduct their own evaluation of the new software as well as how the FAA initially certified the plane to carry passengers. Those reviews could take months, according to safety experts.

Among other changes, the revised software would rely on two “angle of attack” sensors, rather than one, to measure the upward or downward angle of the wings and nose in flight. If two sensors send data differing by five degrees or more, MCAS wouldn’t activate at all, according to the officials briefed on the tentative changes.

The cockpit crew on the Lion Air flight struggled against MCAS—using manual nose-up commands some two dozen times—before losing control and plunging into the Java Sea at more than 500 miles an hour. The interim accident report revealed a constant 20-degree difference between signals from the sensor on the captain’s side and those from the co-pilot’s-side sensor.

On Saturday, Boeing said it has been “working diligently and in close cooperation with the FAA on the software update,” adding that the company is “taking a comprehensive and careful approach to design, develop and test the software that will ultimately lead to certification” by regulators.

During the investigations of the two crashes, Boeing and the FAA have faced criticism from pilot groups, airlines, politicians and airlines for alleged lapses in the original MCAS design—and for failing to adequately inform aviators.

About a dozen pilots from U.S. and international carriers are getting previews this weekend of the changes in the works, as well as related manuals and training, according to the Boeing official. "We want their feedback,” this official said. “It’s a dialogue.”

The group engaging in this weekend’s preview of the changes includes pilots from U.S. MAX operators: Southwest Airlines Co. , American Airlines Group Inc. and United Continental Holdings Inc., a person familiar with the matter said. On Wednesday, this person added, a larger group of more than 100 pilots from a broad cross section of MAX operators are due at Boeing’s 737 factory in Renton, Wash., for a similar session.

Investigators in the Lion Air crash said faulty data transmitted from a single sensor caused the MCAS system to assume the plane was in danger of stalling. The warnings began during takeoff and continued for much of the roughly 11-minute flight, apparently confusing the pilots and creating a cascade of related warning signals.

Under the new design, warning devices will alert crews if there is a problem with sensors before takeoff or in flight, people familiar with the redesign said.

They said automated commands to move a flight-control surface on the tail, called a horizontal stabilizer, can be counteracted by pilot commands.

The changes will be standard on all 737 MAX aircraft, for which Boeing has roughly 5,000 orders.

A draft FAA document spelling out the training revisions shows pilots now will be specifically informed about “MCAS activation thresholds,” “flight crew alerts” and how to turn off the system by flipping a single switch. Such details weren’t highlighted in earlier manuals or training materials circulated byBoeing.

FAA officials have determined the handing qualities of 737 MAX jets will be close enough to earlier 737 models that pilots won’t need additional training in ground-based simulators, which is expensive for airlines and disruptive to their schedules.
— Alison Sider and Robert Wall contributed to this article.

Write to Andy Pasztor at [email protected] and Andrew Tangel at [email protected]

[jimjim1]

I doubt very much it was a transmission/reception error on the BUS since that almost certainly has CRC error detection.


This is not correct. The error detection is a simple parity bit and so a bus error is not vanishingly unlikely.

ARINC 429 is pretty crude in the age of the interwebby:)

[RatherBeFlying]

Two holes in the cheese:

​​​​Control surface position can be displayed on many ECAMs, along with flaps, spoilers, gear, etc. But where are trims shown besides on the wheel and knobs?

It may really help to show trim positions on the ECAM - and what is moving it when in motion: MAN, AP, STS, MCAS.

It might have helped the AF447 crew, especially if control stick/wheel disagree was displayed. But that would cost money and certification effort to develop.

A repeating theme in many posts is the expense, and consequential dearth, of sim sessions to explore the corners of the envelope. Crews are being trained to minimum standards because sims, and performance data in the corners of the envelope, cost money.

Now we see an imperative to develop new designs in a way that minimises, or even better eliminates, sim time.

The MBAs have succeeded at pinching carloads of pennies – but airframes are now outwitting the crews.

[BobM2]

I posted mentioning a previous link that stated that the rear (hidden) switch in each column had been removed from the MAX. If true, and it seems to be, it is a major change, inasmuch as a quick tug against a nose-down trim would not have remotely the same effect.

The changes to the two emergency cut out switches, mentioned again above, are extraordinarily misleading - if not covered in MAX conversion training.
The switches are still there & work as always, but do not stop MCAS.

[EDML]

The switches are still there & work as always, but do not stop MCAS.

... and they can‘t because that would make the MCAS useless. MCAS is there to change the stick force at high AoA values. To maintain a high AoA at decreasing speed (w/o retrimming) you will need to pull pretty hard. That is exactly the situation where the trim inhibit switches are activated. If they would stop the MCAS it would never be activated in the desired part of the flight envelope.

[edmundronald]

After Go!Go!Go! and bad process in design and certification, the rush now is to create a quickfix and use lobbying to push the planes back into the air without an extensive check and recertification.

This may not be smart: the losses during an extensive safety recheck would be painful but bearable. The effect of another "incident" might push Boeing heavily into the red.

It may be useful to blame "foreign pilot" error for every crash, but in the end mostly every plane flown outside the US is flown by a "foreign pilot", and foreign certification authorities might be more eager than the FAA to pursue the issue of certification of the Max after design changes from the previous 737 types.

Edmund

[HdwJunkieSLF]

Perfectly put.
Reliance on a single sensor driving a system that was not known to the crew and that could take over command of the aircraft is sheer madness (not to mention extreme negligence).

the last word of your post will be the crux of the coming legal battle. If found Negligent, there is no shield for a professional engineer (licensed).

[LandIT]

A key modification to limiting stabilizer commands is a revision that allows only one trim application for each new trigger of the MCAS system. Under the original design, the MCAS trims the aircraft nose down by moving the horizontal stabilizer up at 0.27 deg./sec. for 9.2 sec., stops for 5 sec., then trims nose down again for 9.2 sec., and continues to do so until the trim reaches the stabilizer travel limit or the crew intervenes. Boeing says that, as before, the crew will retain the capability to override the flight control law using either electric or manual trim, or by following the existing runaway stabilizer procedure and using the cutout switches as reinforced in the Operations Manual Bulletin issued on Nov. 6, 2018.

The enhanced software was demonstrated for the FAA on March 12, the day after the Civil Aviation Administration of China announced the first in a wave of 737 MAX groundings around the world; the FAA followed suit on March 13. Aviation Week was told that the software upgrade certification load, dubbed P12.1, was flown on the first 737-7 developmental aircraft, 1E001.

The greater part of the 1-hr. 20-min. test flight was flown at medium altitude between 13,500 and 17,350 ft. in a racetrack pattern over southwest Washington state. According to data from the flight-tracking website Flightradar24, the crew performed a series of high AOA maneuvers to validate the performance of the revised MCAS. These included at least six conducted during initial ascent, followed by descents from 17,000 to around 14,250 ft., during which speed dropped from more than 330 kt. to less than 180 kt.

The aircraft was then flown to 17,350 ft. and 265 kt. before pitching steeply nose down and recovering at around 15,900 ft. and 295 kt. The maneuver was repeated at a slower speed, before a further test point was conducted during which the 737 descended steeply from around 15,550 ft. to 13,500 while speed increased from 180 kt. to almost 270 kt. Two further steep descents and recoveries were then performed before the aircraft leveled off and returned to Seattle for landing.

Those were great test flights at higher altitudes. I read into the figures some steep descents of maybe 2000 ft even when the pilots presumably knew what to expect. I wonder if Boeing test pilots would like to do a test flight at about 1000ft or even 3000ft above ground (like ET302 or JT610 accidents) in the jump seat while some line pilots, who have not been told what the exercise is, are in the hot seats? Or is the new MCAS disabled until more than say 5000ft above ground? Also for what parameters will the repetitive trimming be restricted. And what will the authority limits of the trim units be and whether different at different speeds and altitudes. If MCAS disables itself for erroneous sensor input, if its moved trim then will it re-trim to a "neutral" or expect the pilots to break out the handles on the trim wheels?

It will be interesting to see the full details of the new MCAS.

[derjodel]

Airflow is horizontal only in level flight ! not in climb or descent :ooh:

If by horizontal you mean at AoA ~ 0 degrees, that is very, very incorrect :=

[mosquito88]

Could someone familiar with the AoA vane and MCAS tell me what would happen if a bird strike jammed the vane in either an up or down condition?
Can the system detect a damaged sensor and if not, what would happen?

[CurtainTwitcher]

Could someone familiar with the AoA vane and MCAS tell me what would happen if a bird strike jammed the vane in either an up or down condition?
Can the system detect a damaged sensor and if not, what would happen?
In its certified form or yet to be released updated version? No one really knows, but I believe the PPRuNE brains trust would say something along the lines "it depends".

There would be many different failure scenario's, the AoA reported value could be frozen at its last known good position, it could detect the failure and report no value, and many other possibilities in between (erratic oscillations etc). The next question is the software side, and how much error checking and validation it does and how gracefully it handles anticipated failure modes.

Generally, the opinion (and Boeings own failure analysis) of the MCAS software is assumes the pilot will handle any system input error and disable the system via the stab trim via the cutout switches. This turned out to be a heroic assumption...

Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system (https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/)
System failed on a single sensor (https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/)
The bottom line of Boeing’s System Safety Analysis with regard to MCAS was that, in normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.

In the case of an extreme maneuver, specifically when the plane is in a banked descending spiral, an activation of MCAS was classified as a “hazardous failure,” meaning that it could cause serious or fatal injuries to a small number of passengers. That’s still one level below a “catastrophic failure,” which represents the loss of the plane with multiple fatalities.

[jantar99]

I just wonder why B737 (and B767 recently) nosedive into the ground every so often? Can't remember Airbuses nosediving recently.

B737 CL September 14, 2008 Perm - roll and nosedive just before approach
B737 CL November 17, 2013 Kazan - nosedive after GA
B737 NG March 19, 2016 Rostov - nosedive on final or after GA
B737 MAX October 29, 2018 Jakarta - nosedive after TO
B737 MAX March 10, 2019 Addis-Abeba - nosedive after TO

B767 23rd Feb 2019 Texas - nosedive just before approach

[EDLB]

This is not correct. The error detection is a simple parity bit and so a bus error is not vanishingly unlikely.

ARINC 429 is pretty crude in the age of the interwebby:)
Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.

[donotdespisethesnake]

That information is not hard to find https://en.wikipedia.org/wiki/ARINC_429

There is a lot of 1970s stuff in aviation, that should not be a surprise.

[Herod]

I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.

[jantar99]

I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.

To my understanding. There is a requirement of smth like 'linear pull': in the MAX, as the plane approaches stall, either pitch force on the stick, or force increment on the stick to pitch up, decreases and that's a big, uncertifiable drawback.

[Interflug]

WSJ:
U.S. air-safety regulators ... said the enhanced training, relying on self-guided interactive instruction on laptops, ...

Alright. The regulatory governmental body thinks, the cheapest possible means, ‘self-guided interactive instruction on laptops’ is actual training. Or better, even ENHANCED training. You can’t make this sh** up. No damn expensive instructors or simulators necessary. Is this still a safety minded world? Is everybody insane now? More catastrophies in the making. You can read it right there.

[Euclideanplane]

I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.

The reason for MCAS was stated by a previous poster. It is needed for purpose of certification. I reproduce the entire paragraph § 25.173, since I have not seen it in full in the thread.

AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

§ 25.173 Static longitudinal stability.

Under the conditions specified in § 25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or V FC /M FC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.

The item that describes the specific details is § 25.175 Demonstration of static longitudinal stability.

[GordonR_Cape]

To my understanding. There is a requirement of smth like 'linear pull': in the MAX, as the plane approaches stall, either pitch force on the stick, or force increment on the stick to pitch up, decreases and that's a big, uncertifiable drawback.

I have read and understood all the certification requirements that led to MCAS. Can someone explain to a non-pilot: In what common circumstances would (edit badly worded question) the pilot of an aircraft actually want to raise the nose (end-edit) close to the stall angle, while flying with flaps up? High altitude turbulence avoidance or maneuvering? Tight turns at high bank angle?

[RickNRoll]

The reason for MCAS was stated by a previous poster. It is needed for purpose of certification. I reproduce the entire paragraph § 25.173, since I have not seen it in full in the thread.

AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

§ 25.173 Static longitudinal stability.

Under the conditions specified in § 25.175, the characteristics of the elevator control forces (including friction) must be as follows:
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or V FC /M FC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.

The item that describes the specific details is § 25.175 Demonstration of static longitudinal stability.

It also allowed Boeing to claim that all that was need to transition to the Max was a short video presentation.
https://edition.cnn.com/2019/03/22/us/max-8-boeing-self-administered-courses-lion-air-ethiopian-airlines-intl/index.html

[EDLB]

High order bit correction is mostly used in noisy transmission neworks, such as phones and satellites. If you have interference on the data lines in your brand new aircraft, then there are much more serious things to worry about.

Thats valid only if there is no fault in the harness, connection and in all receiving devices. With a single parity bit for 32 bits it’s as good as no protection at all. What if your data line signal noise level becomes marginal because of one failed receiver or a harness problem? You will process false data which are still valid and look as good data. In automotive CAN for example there is a more robust CRC protection and the same as your above argument for the system can be made. Troubleshooting of intermittent problems is much easier if you can get a fault statistic in the devices and you have a robust method to detect communication errors.

[Grummaniser]

Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.



It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.

[Cows getting bigger]

As has been repeatedly pointed out , it is not an unstable airplane.

Err, the reason for the inclusion of MCAS is to address a certification issue regarding static stability. The issue is wholly to do with reduced static stability which appears to be erring towards static neutrality. In other words, in certification terms, without MCAS the aircraft is not stable enough.

[FGD135]

This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
Actually, with the thrust line higher than previous versions, and the jet outlet further forward, the pitch-up on thrust increase will be less.

But, the MCAS is not there for the pitch-up. It is there to improve the handling qualities at high angles of attack. What Boeing were after was a steadily increasing nose-down stick force as the alpha increased.

Can someone explain to a non-pilot: In what common circumstances would an aircraft actually need to pitch up close to the stall angle, while flying with flaps up? High altitude turbulence avoidance or maneuvering? Tight turns at high bank angle?There is no circumstance where the aircraft would need to pitch up when close to the stall angle. Such behaviour is considered undesirable. The MAX has a tendency for this, hence the MCAS system to "tame" it.

[edmundronald]

Possible data corruption opens a real can of worms.

If there really was a data transmission error, and Boeing designed in a single point of failure with no serious data integrity checking on the digital transmission (each packet with a serial number and with a CRC so none can get lost or corrupted), and no software filtering to see whether values make sense,and restore sanity, it would be literally unbelievable. (You can do that in a lab, not in a transportation machine). But then ALL of the DIGITAL avionics on this plane will be similar, and the whole type becomes suspect, and in fact will need at least a fundamental software refactoring with a bunch of software crosschecks and filtering on all sensors that feed into mission-critical automation - it's not at all obvious that MCAS is the only such novelty on this plane, there may be more stuff hidden away.

I may not be the most competent engineer in the world but I have a Master's in Electronics/Telecoms and a PhD. This is my professional opinion. Feel free to call me incompetent but there needs to be an adult in the room. I am sure there are a bunch of pilots out there who are engineers and can chime in.


Edmund

It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.

[SteinarN]

Err, the reason for the inclusion of MCAS is to address a certification issue regarding static stability. The issue is wholly to do with reduced static stability which appears to be erring towards static neutrality. In other words, in certification terms, without MCAS the aircraft is not stable enough.

It would have been really interesting to know what the stability margin actually is at high AoA. If the full 2,5 deg stabilizer travel really is needed to give the Max a sufficient positive stability/stick force gradient when going from about 10 deg AoA up to about 14 deg AoA, it would seem that a large part of the positive stability in this region is lost without MCAS?

[EDLB]

It doesn't take a double bit error to lose one bit of data - somewhere in the system between the RDVT fixed to the AoA vane and the bus, is an analogue to digital converter chip (or array of them) which will not itself be creating any error checking. The error checking will be added further downstream (quite possibly by the chip next to the A-D). A fault in the actual A-D chip could produce single bit errors which could only be identified by duplicating the A-D process.
In automotive acceleration pedals the duplicate sensor (potentiometer and/or magnetic angle sensor) and duplicate A/D conversion is standard. But all that effort would be mute if the communication channel is not error protected. So at least there is a robust CRC or even duplicate signalling channels.

As far as I understand in the AoA sensor and data bus neither is done so at any point errornous data could be created.
That would not even muster for an automotive acceleration pedal let alone more safety critical systems like brakes.

The only chance I see that that passes any functional safety analysis is at least two independent sensor data, and if they differ then either a safe system state is commanded or if this can’t be achieved, then a third input data (like in this case from the inertial system generated) will be needed.

[Capn Bloggs]

Where I disagree is with Boeing. "Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position" is both a false statement, and extremely misleading.
Read it in the context of the QRH item it's in. Boeing is talking about LANDING, not flying at Vmo. It might be misleading to deskjockeys, but it makes sense to me.

[zzuf]

For those keen on quoting the longitudinal static stability requirements of FAR 25.175, Should note that the device in question is MCAS, ie manoeuvre, not static.
It is clear from the early descriptions of the MCAS it was about stick forces during manoeuvre when approaching the flaps up stall.
I suggest you look closely at the approach to the stall requirements of FAR 25.203(a). The STS system looks after any static stability problems.
The problem is in interpretation of these certification standards.
Many years ago stick force lightening, on the stall approach, was accepted by the FAA, provided the stall characteristics were otherwise found to be compliant The British ARB had a different view at the time. Hence stick nudgers were required in some British certificated aircraft which were not required in FAA certiicated aircraft.
It now seems any tendency towards stick force lightening is unacceptable to the FAA. I haven't looked recently but don't think the written rule (concerning longitudinal control approaching the stall) has actually changed from CAR 4B circa 1953.
At no stage during this thread has there been any force value given to the extent of the manoeuvre stability non-compliance of the B737 MAX 8. Don't forget that as little as 1lbf would be a non-compliance and would require a "fix".

[Loose rivets]

Herod:
I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.

Further to jantar99's answer, there is a huge difference between the rotation caused by thrust, and the aerodynamic flight of the cowling. Having said this, it's hard to visualise this rotational force's causal airflow only being derived from the pre-stalling greatly increased AoA. But I can think of no other reason than that which jantar99 described. It's almost a parachute effect when you consider the vertical vector alone.

I can see the need to counter it, and do it automatically, but I suppose Boeing thought it would not come into play in the real world and the prime reason for MCAS was the technicality of certification. No need to mention it to anybody.

It's hard to believe there was a time when the same type, IIRC, 727, needed a stick push on one side of the Atlantic, but not the other.
.
.
.

[FGD135]

If there really was a data transmission error, and Boeing designed in a single point of failure with no serious data integrity checking on the digital transmission (each packet with a serial number and with a CRC so none can get lost or corrupted), and no software filtering to see whether values make sense,and restore sanity, it would be literally unbelievable. (You can do that in a lab, not in a transportation machine).Don't know about the data protocol(s), edmundronald, but can tell you that both Boeing and Airbus flight computers act on unfiltered data.

Take the incident of QF72, for example. Airbus A330, 7 October, 2008. During cruise, the angle of attack data suddenly indicated a very high value. The computer suddenly thought the plane was stalled and pushed the nose down. Passengers and Flight Attendants were thrown into the ceiling and there were several serious injuries.

There was a single spike in the data. That the readings immediately before were normal was not checked for. That the aircraft could have pitched from normal cruise AoA up to and beyond the stalling AoA instantly was not checked for. And if that wasn't amateurish enough, there was then the flight computers, thinking that a sudden pitch down whilst going at 450 knots was a good idea.

[Derfred]

... But that’s the 737, even the auto land on the 300 required a massive stabiliser up input at 400 feet to enable the flare.

It’s off topic, but I don’t think that’s the reason for the nose up pitch trim at 400RA.

I think the reason is to allow the aircraft to pitch up gently rather than crashing onto the runway in the event of a autoland flare failure (given that it is only dual autopilot) if there is no pilot input after autopilot dropout during the flare.

And it’s not a massive trim input, it’s a small trim input easily handled by a pilot.

[JRBarrett]

Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.




It may not be a case where the Arinc 429 data label is being corrupted in transit (which would be detected by the CRC check). More likely that the A/D converter that receives the analog AC voltage from the AOA vane is, under certain circumstances, generating an incorrect binary representation of the voltage.

Every modern aircraft contains multiple A/D converters for various system parameters. For instance, all of the engine data originates as analog signals. The N1 and N2 sensors on the engine produce a pulsed waveform whose frequency varies with the rotational speed of the spools. The EGT probes directly generate a DC voltage which is proportional to measured temperature. The oil pressure transducer resistance varies with pressure, which also produces a variable DC output voltage. The fuel flow transducer produces an AC sine wave the frequency of which is proportional to flow rate.

All of these analog signals have to be converted to digital values to drive the displays in the flight deck, and to supply other systems like the FMS.

I have seen many cases of A/D converter failures causing loss of engine indications. If I had a squawk that there was no oil pressure reading, I would suspect the transducer on the engine, but if the squawk related to a loss of N1 or N2, I would suspect the A/D conversion, because the engine-mounted speed transducers are so simple and rugged in design that failure would be almost impossible.

USUALLY if an A/D converter fails, it will simply produce no output at all. But, I have seen two instances where the conversion did not fail outright, but resulted in garbage data. In one case, an aircraft was showing exactly half the expected fuel flow rate at any given power setting. This could very well be a case of failure of one specific binary bit in the digital representation of the analog fuel flow transducer voltage. In another case, An aircraft was showing 50 psi oil pressure when the engine was completely shut down, and the pressure rolled backwards to zero when the engine was running.

Both of these instances were caused by a “one-off” failure of the DAU (data acquisition unit), which was permanently corrected by installing a replacement DAU. In both cases, the faulty DAU had been in service for many years.

But if the false AOA reading in the two Max incidents was indeed caused by an incorrect A/D conversion, it is a more serious problem. Both aircraft were almost brand new. If the FDR readout from the Ethiopian flight also shows an exact 22 degree AOA reading on one side, it points to an inherent latent software or hardware bug in the AOA A/D channel that could very well happen again on other aircraft.

I’m sure that Boeing engineers will be looking very closely at the AOA system on the Max in addition to their modifications to MCAS.

[MungoP]

Way back at the beginning of this thread I asked the following question of someone QUALIFIED to give me a definitive answer, maybe it was too early to be asking the question so now I'll post it again and please only respond if you ARE qualified to answer, that's to say have experience with the 737 MAX systems in the real world.

We have no ideas beyond some possibly educated guess-work as to what happened here but I do have a question that can be answered by someone with the relevant experience. As a 10,000 + hr career pilot I'm not exactly a newbie but have not had any experience with the latest sophisticated systems being introduced on modern aircraft.
Q. Is there something preventing pilots of these aircraft from simply hitting an autopilot 'disconnect' button, and then getting on with flying manually ? Not suggesting that this is relevant to this accident.

So, what I'm asking is, does modern technology prevent/resist/over-ride a pilot from flying an aircraft in the most basic sense once the autopilot system has been disconnected ? And I say again: I'm not suggesting that this is relevant to this particular accident.



https://www.pprune.org/images/statusicon/user_offline.gif https://www.pprune.org/images/buttons/report.gif (https://www.pprune.org/report.php?p=10412182)

[EDLB]

So, what I'm asking is, does modern technology prevent/resist/over-ride a pilot from flying an aircraft in the most basic sense once the autopilot system has been disconnected ? And I say again: I'm not suggesting that this is relevant to this particular accident.



https://www.pprune.org/images/statusicon/user_offline.gif https://www.pprune.org/images/buttons/report.gif (https://www.pprune.org/report.php?p=10412182)

Read the Lion air preliminary report. The AP was not engaged during the flight. The MCAS system was interfering with the manual flight and kept for the most time triming nose down. The only thing that would have saved them where the trim cut out switches they did not switch off.

[FrequentSLF]

Don't know about the data protocol(s), edmundronald, but can tell you that both Boeing and Airbus flight computers act on unfiltered data.

Take the incident of QF72, for example. Airbus A330, 7 October, 2008. During cruise, the angle of attack data suddenly indicated a very high value. The computer suddenly thought the plane was stalled and pushed the nose down. Passengers and Flight Attendants were thrown into the ceiling and there were several serious injuries.

There was a single spike in the data. That the readings immediately before were normal was not checked for. That the aircraft could have pitched from normal cruise AoA up to and beyond the stalling AoA instantly was not checked for. And if that wasn't amateurish enough, there was then the flight computers, thinking that a sudden pitch down whilst going at 450 knots was a good idea.
There was not a single spike..from the report
Although the FCPC algorithm for processing AOA data was generally very effective, it could not manage a scenario where there were multiple spikes in AOA from one ADIRU that were 1.2 seconds apart. The occurrence was the only known example where this design limitation led to a pitch-down command in over 28 million flight hours on A330/A340 aircraft, and the aircraft manufacturer subsequently redesigned the AOA algorithm to prevent the same type of accident from occurring again.

[deltafox44]

If by horizontal you mean at AoA ~ 0 degrees, that is very, very incorrect :=
No.

I meant that airflow being equal and opposite to aircraft speed vector cannot be assumed as 'horizontal' as suggested in the post I was replying to, which thought AoA could be measured by inertial systems.

[JRBarrett]

will they be looking closely at this, whilst MAXs are back in revenue service having had the software fix rushed in?

Scary. G

I would certainly hope so. I don’t know if Boeing has been provided with any of the FDR data from the Ethiopian flight as of yet which might show a similar AOA error as experienced in the first incident.

I don’t know how the AOA sensor data is processed in a 737 specifically, or what differences may exist in the processing between an NG and a Max. I doubt that the AOA position comes off of the sensors in digital form - typically it is either a variable DC voltage or variable AC waveform, with conversion to digital at some point downstream.

[alf5071h]

MungoP, #2491

Q. Is there something preventing pilots of these aircraft from simply hitting an autopilot 'disconnect' button, and then getting on with flying manually ?

A. Being able to understand the situation which requires alternative action.

Thus for this accident (not autopilot related), how and when might the crew have identified the situation, linking control difficulties with trim - and the drill; given that the preceding situation (flaps down) which appeared to be related to erroneous airspeed / air data - stick shake, low speed awareness, ‘ASI and Alt disagree’ cautions.

An opposing view, seen throughout this thread, is the powerful effect of hindsight bias, and other human behaviours such as finding patterns where there are none, selecting data which confirms one’s existing thoughts.
The tendency is to ask ‘why didn't they’; yet the answer applies equally to the many people in design, regulation, training, and operations over several months, and to a crew who had to identify cause and solution in a few minutes of flight, without supporting information, relevant knowledge or experience.

Technology does not prevent us from flying, in most cases it helps; the difficulty is with our thinking about technology - designer or regular, and ourselves.

[deltafox44]

Can you verify this? This would be very crude early 1970th technology and with a Haming distance of 1 only protect against single bit failures. A two bit failure would create the next valid data. And there is no guarantee that any interference will only disturb 1 bit. Equaly likely is, that a sequence of bits are disturbed.
I still wonder where the 20 degrees constant offset in the Lion Air AOA sensor came from. See preliminary report. That’s not a stuck sensor.
If the Ethiopian will show a similar offset then there is another problem burried in their flight control system.

The 20 degrees offset shown by the graphs are between "angle of attack indicated left" and "angle of attack indicated right". If "angle of attack indicated" means the AoA value that would be indicated in the AoA display (optional), the offset between AoA sensors would be 1,5 to 2 times more (according to Boeing document linked above) thus closer to 40° than 20°.

[Smythe]

Airflow is horizontal only in level flight ! not in climb or descent :ooh:
If by horizontal you mean at AoA ~ 0 degrees, that is very, very incorrect

The quoted "airflow is horizontal", was in ref to the AoA vane, whatever it reads, is measuring the airflow, and is the basis for the AoA of the wings.
In my context, "horizontal" is relative. Much the same as indicated airspeed and the jetsteam and of course, groundspeed.

It is of course, mounted to the fuselage, so there is already the inherent offset to the angle of attack of the wings vs the fuselage.

[deltafox44]

It would have been really interesting to know what the stability margin actually is at high AoA. If the full 2,5 deg stabilizer travel really is needed to give the Max a sufficient positive stability/stick force gradient when going from about 10 deg AoA up to about 14 deg AoA, it would seem that a large part of the positive stability in this region is lost without MCAS?
also, I would be surprised if with, when MCAS has been activated for what it is intended to do (increase stability), having moved the stabilizer 2.5° from its previous position, it lets the plane return by itself at the previous trimmed speed as it should by this rule :
The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed

[GordonR_Cape]

also, I would be surprised if with, when MCAS has been activated for what it is intended to do (increase stability), having moved the stabilizer 2.5° from its previous position, it lets the plane return by itself at the previous trimmed speed as it should by this rule :

Quite true! I mentioned earlier (from a programming perspective) that the more rules and constraints are included in an algorithm, the harder it is to implement, and the more likely the outcome will be either a deadlock, infinite loop, or violation one of the constraints.

[Sailvi767]

Could someone familiar with the AoA vane and MCAS tell me what would happen if a bird strike jammed the vane in either an up or down condition?
Can the system detect a damaged sensor and if not, what would happen?

Much like any modern aircraft you would lose several protections systems and perhaps be presented some bad data. Pilots would then be required to apply some knowledge and fly the aircraft.

[bill fly]

It’s off topic, but I don’t think that’s the reason for the nose up pitch trim at 400RA.

I think the reason is to allow the aircraft to pitch up gently rather than crashing onto the runway in the event of a autoland flare failure (given that it is only dual autopilot) if there is no pilot input after autopilot dropout during the flare.

And it’s not a massive trim input, it’s a small trim input easily handled by a pilot.

Hi derfred,
The reason for mentioning it was to illustrate the way Boeing is willing to mess with trim to achieve certification.
By the way a No flare situation doesn’t allow you to let the aircraft somehow land - that’s a go around.
And as for the input being easily handled, it causes one more distracting problem as mentioned in my post, in a subsequent manual single engined go around.
The auto land itself was very sketchy too - nothing like the smooth MD-80 performance - which was achieved without heavy handed trim inputs.

[mosquito88]

Thanks. "It depends" sounds right!
Then again, the vane could be sticky, e.g. dirt in the bearings, and give correct readings one moment and incorrect ones the next.

[lancs]

From a programming point of view, having a system remember its previous state, and respond differently, creates all kinds of complexity. I would never want to go down that route


Finite state automaton. Very standard software engineering concept. There's a large read across to the Airbus modes of operation....

[FCeng84]

also, I would be surprised if with, when MCAS has been activated for what it is intended to do (increase stability), having moved the stabilizer 2.5° from its previous position, it lets the plane return by itself at the previous trimmed speed as it should by this rule :

As expected given the Lion Air accident, most of the focus on MCAS has been on how it behaves with the AOA signal it is using failed high. When MCAS has proper AOA data it meets the noted static stability requirements. It does this by removing the airplane nose down stabilizer increment it put in at high AOA with an equal amount of airplane nose up stabilizer once AOA has dropped below the MCAS activation AOA threshold. This full sequence of offsetting stabilizer motions leaves the stabilizer very close to where it started and thus the airplane has returned to just about the same trim speed. If during this sequence the crew provides any pitch trim commands MCAS stops its action and resets ready to go again if subsequent high AOA is sensed.

[601]

what it is intended to do (increase stability)

Isn't the intention of the MCAS is to increase the feel the to the pilot on elevators as the AoA is increased as required by the FARs.
It does not make the aircraft more stable.

[jwamm]

NYT 3/23/19 "Go,go,go" article, quoted in post #2338 cites a Boeing technician assembling the Max:
" A technician who assembles wiring on the Max said that in the first months of development, rushed designers were delivering sloppy blueprints to him. He was told that the instructions for the wiring would be cleaned up later in the process, he said.
His internal assembly designs for the Max, he said, still include omissions today, like not specifying which tools to use to install a certain wire, a situation that could lead to a faulty connection. Normally such blueprints include intricate instructions."

Generally, such observations would not seem to boost confidence in the Max. More specifically, it would be interesting to know if any of these omissions in the MAX assembly designs which "could lead to a faulty connection" involve circuitry carrying the AOA sensor data.

[yanrair]

I stopped reading this thread a long time ago, but can someone explain a point to an old, retired 737 driver? All 737s pitch up with the application of power; it's a consequence of the design. This one will pitch up more than most; again a consequence of the design. If the crew are made aware of this, is it really beyond the power of the human mind to be ready and correct the pitch? In other words, no need for this system at all.
Hi Herod
I agree with you. 5 years ago post Amsterdam I think with Turkish Airlines 737 stall and hull loss on the approach - the stall procedure was changed from the usual
FULL POWER PITCH DOWN RECOVER - since you were a 737 jockey and even back to the Wright Brothers.
to
PITCH DOWN / POWER AS REQUIRED / RECOVER.
We spent a year of more retraining all pilots to do this new recovery . Reason - to ensure that the engine pitch up moment with newer more powerful engines was not going to prevent the nose down break stall which is the heart of the recovery procedure. The only thing I can think of that might be different on the MAX is that the natural down pitch which all designers seek and regulators look for might be too weak. And they thought it needed augmentation. Now I don't know from what I have gleaned from this forum if this is an aerodynamic issue or simply the bigger engines causing an upward pitching moment - the last thing you want in a stall. I suspect the former. The latter can be fixed by not applying too much power too soon as per current 737-800.
So the logic behind MCAS, how it works, and so forth are still not fully understood - at least not by me. I await the outcome of the investigations as we all should with interest and an open mind.
Cheers
Yanrair

It does look as if a system designed to simply improve the handling in a stall and assist the pilot may have malfunctioned and applied multiple recoveries due to a stuck AOA SENSOR. But we don't know that yet do we?
All I have tried to say in this short piece how real stalls on real 737/757/767/747 airplanes and simulators, stalling routines that I have flown and observed many times - this is how it was done. And stall recovery was a really easy manoeuvre which worked every time.

[FlexibleResponse]

There has been no mention of an AOA failure prior to its replacement on the evening prior to the crash. It was apparently replaced as trouble-shooting in response to repeated write-ups of Capt unreliable airspeed & altitude. This did not correct the unreliable airspeed & altitude, but rather introduced an additional failure on the last two flights.

Apparently, Ground Maintenance BITE testing showed that a faulty signal was received from the L AOA.

Satcom Guru (selected quotes)
"Prior to JT043, the AoA on the Captain (left) side had issues and was replaced. First, AOA signal fail was fixed by reset of the ADIRU. ADIRU is a combination of the Air Data Computer and the Inertial Reference Unit."

"On the next flight, AOA signal out of range is displayed and again ADIRU is saying AOA Signal Fail."

"The issues encountered in ET302 AoA vane must be taken into account with these two vanes apparently on Lion Air that malfunctioned. Is it a problem with the vanes or is it a problem in the data processing? What needs to be fixed? Was this just a string of bad luck and coincidence?"

Satcom Guru's post refers:
https://www.satcom.guru/2019/03/taking-next-steps-while-awaiting-on.html

[yanrair]

Way back at the beginning of this thread I asked the following question of someone QUALIFIED to give me a definitive answer, maybe it was too early to be asking the question so now I'll post it again and please only respond if you ARE qualified to answer, that's to say have experience with the 737 MAX systems in the real world.

We have no ideas beyond some possibly educated guess-work as to what happened here but I do have a question that can be answered by someone with the relevant experience. As a 10,000 + hr career pilot I'm not exactly a newbie but have not had any experience with the latest sophisticated systems being introduced on modern aircraft.
Q. Is there something preventing pilots of these aircraft from simply hitting an autopilot 'disconnect' button, and then getting on with flying manually ? Not suggesting that this is relevant to this accident.

So, what I'm asking is, does modern technology prevent/resist/over-ride a pilot from flying an aircraft in the most basic sense once the autopilot system has been disconnected ? And I say again: I'm not suggesting that this is relevant to this particular accident.



https://www.pprune.org/images/statusicon/user_offline.gif https://www.pprune.org/images/buttons/report.gif (https://www.pprune.org/report.php?p=10412182)
Dear Mungo P. Nothing to prevent STAB SWITCHES OFF Indeed the previous day from what we read they were turned off. Alas the subsequent crew did not do so.
As for Ethiopian - they issued a statement that all their pilots were aware of the Lion Air crash and the corrective action recommended by Boeing; So that remains a mystery I believe unless anyone else has anything new on that point please?

[FCeng84]

MungoP, #2491

Q. Is there something preventing pilots of these aircraft from simply hitting an autopilot 'disconnect' button, and then getting on with flying manually ?

A. Being able to understand the situation which requires alternative action.

Thus for this accident (not autopilot related), how and when might the crew have identified the situation, linking control difficulties with trim - and the drill; given that the preceding situation (flaps down) which appeared to be related to erroneous airspeed / air data - stick shake, low speed awareness, ‘ASI and Alt disagree’ cautions.

An opposing view, seen throughout this thread, is the powerful effect of hindsight bias, and other human behaviours such as finding patterns where there are none, selecting data which confirms one’s existing thoughts.
The tendency is to ask ‘why didn't they’; yet the answer applies equally to the many people in design, regulation, training, and operations over several months, and to a crew who had to identify cause and solution in a few minutes of flight, without supporting information, relevant knowledge or experience.

Technology does not prevent us from flying, in most cases it helps; the difficulty is with our thinking about technology - designer or regular, and ourselves.

Please indulge my adding a few comments. Today’s commercial aviation has embraced use of automation to enable optimization for performance. This has led to configurations that do not have certifiable handling characteristics without at least a minimum level of computer augmentation. On these airplanes there is no way for pilots to select complete manual. The higher level automation provided for workload relief can be turned off but not the lowest level of automation required to provide acceptable handling qualities.

[FCeng84]

Isn't the intention of the MCAS is to increase the feel the to the pilot on elevators as the AoA is increased as required by the FARs.
It does not make the aircraft more stable.

This depends on what you call stability. If stability is the tendency to pitch back down in response to having pitched up, MCAS can be viewed as increasing pitch stability

[Smythe]

Isn't the intention of the MCAS is to increase the feel the to the pilot on elevators as the AoA is increased as required by the FARs.

No, MCAS overides controls and creates it own downward pitch when the pitch up gets close to stall.

In certain conditions, with the engines mounted so far forward and upward on the wing, the engine nacelles at certain angles of attack, create lift, pitching the nose up to stall.

MCAS automatically brings the node back down.

[FCeng84]

No, MCAS overides controls and creates it own downward pitch when the pitch up gets close to stall.

In certain conditions, with the engines mounted so far forward and upward on the wing, the engine nacelles at certain angles of attack, create lift, pitching the nose up to stall.

MCAS automatically brings the node back down.

I must take issue with the statement that "MCAS overides controls". MCAS commands the horizontal stabilizer but does not override pilot commands to that or any surface. At any time that MCAS commands are moving the stabilizer, pilot intervention via the wheel mounted pitch trim switches will override MCAS.

[Lena.Kiev]

https://www.nytimes.com/2019/03/24/business/boeing-737-pilots-simulators.html

At the 737 Max Factory, Pilots Simulate New Boeing Software

By David Gelles
March 24, 2019

Pilots from several airlines met with Boeing executives in Renton, Wash., on Saturday to discuss proposed changes to the 737 Max, two of which have crashed in recent months.

The meeting on Saturday, with about a dozen pilots and trainers, was part of Boeing’s effort to manage the crisis set off by the crash of Lion Air Flight 610 in October and the crash of Ethiopian Airlines Flight 302 under similar circumstances this month. Boeing and people briefed on the meeting confirmed it.

In addition to reviewing proposed modifications to new anti-stall software and cockpit displays, pilots from five airlines strapped into flight simulators to see how they would have handled the situation that is believed to have brought down Lion Air Flight 610 in Indonesia, according to two people briefed on the meeting.

In each case, the pilots using the simulators were able to land the plane safely.

Saturday’s session included representatives from American Airlines, Southwest Airlines and United Airlines — the three American carriers that fly the Max — as well as from two non-U.S. airlines, Copa Airlines and Fly Dubai. The group did not include representatives from Ethiopian Airlines, Lion Air or the large Chinese carriers that fly the 737 Max.

On Wednesday in Renton, where the 737 Max is assembled, Boeing will host a group of 200 pilots and officials from almost all the carriers that currently fly the Max or have ordered the jets. As on Saturday, Boeing plans to describe the proposed changes to the software, and review what new training procedures may be needed before airlines can once again fly the Max, which is grounded worldwide.

“This is part of our ongoing effort to share more details about our plan for supporting the safe return of the 737 Max to commercial service,” Boeing said in a statement. “We had a productive session this past Saturday and plan to reach all current and many future Max operators and their home regulators.”

While Boeing continues to work on a software fix, American Airlines said it would extend its cancellations through April 24. American canceled nearly 90 of its roughly 6,700 flights a day because of the Max grounding.

International authorities and domestic regulators including the Federal Aviation Administration will have to sign off before the Max can fly again.

On Saturday, pilots from the five airlines simulated flights with the software as it was originally written, as well as with the proposed updates.

A leading theory is that the Lion Air flight crashed because the anti-stall software received erroneous data, forcing the plane into a nose-dive. The Ethiopian Airlines flight also crashed after an erratic takeoff.

In simulations using the current software, pilots were able to disable the anti-stall software using existing procedures, and land the airplane safely.

The simulations using the updated software required less intervention by the pilots.

The software, known as MCAS, is designed to push the nose of the plane down if it detects the plane pointing up at a dangerous angle that might induce a stall. To determine when it is needed, the software takes data from two so-called angle of attack sensors on the side of the plane, which measure whether the fuselage is pointing up or down.

But when it was originally designed, the software only responded to data from one sensor at a time.

Preliminary plans for a proposed update will change the software in several substantial ways, according to the people familiar with the meeting. It will take data from both angle of attack sensors, instead of just one.

If the difference between the two sensors is more than 5 degrees, the software will be disabled.

Instead of allowing the software to push the nose down multiple times, it will limit the number of instances it can attempt to push the nose down, and limit the duration of that intervention to 10 seconds.

On Sunday, Boeing also issued a statement on the equipment used to measure and display the plane’s angle of attack.

The New York Times reported on Thursday, that two of these indicators were sold as options.

Boeing previously charged extra for two features in the cockpit: the angle of attack indicator, which showed pilots the readings from the angle of attack sensors; and the disagree light, which notified pilots if the readings from the two sensors were at odds with one another.

Boeing will now make the disagree light standard in all new 737 Max planes, and will provide the indicator free of charge for customers who want it.

“All primary flight information required to safely and efficiently operate the 737 Max is included on the baseline primary flight display,” Boeing said. “All 737 Max airplanes display this data in a way that is consistent with pilot training and the fundamental instrument scan pattern that pilots are trained to use.”

The F.A.A. does not currently require pilots to to train on simulators that replicate all the features of the Max, and may not change that stance. But it is possible that even if the F.A.A. does not requires simulator training, other international regulators may do so.

“We’ve been working diligently and in close cooperation with the F.A.A. on the software update,” Boeing said in its statement. “We are taking a comprehensive and careful approach to design, develop and test the software that will ultimately lead to certification.”

https://amp.cnn.com/cnn/2019/03/24/politics/boeing-software-737-max/index.html

Boeing testing software changes to 737 MAX planes

By David Shortell, Evan Perez and Gregory Wallace, CNN

Updated 10:17 PM EDT, Sun March 24, 2019

Seattle (CNN) Pilots from the three American carriers that fly Boeing 737 MAX planes tested software changes developed by Boeing to a key stabilization system on Saturday, a person briefed on the tests said.

The changes are intended to decrease the chances of triggering the Maneuvering Characteristics Augmentation System, or MCAS, which is believed to have played a role in the Lion Air crash in October.

The Federal Aviation Administration has said there are similarities between that crash and a second 737 MAX crash earlier this month in Ethiopia.

Pilots and training officials from Southwest Airlines, American Airlines and United Airlines met with Boeing officials Saturday to review the software changes in the Seattle area, where the model is assembled, according to multiple airline sources.

At the gathering, pilots from the three American carriers, plus two smaller non-US airlines, ran simulated flights designed to mimic the situation that brought down the Lion Air flight in Indonesia last year, using the current and updated software, according to the person briefed on the session.

Each pilot using the flight simulator landed the plane safely, the person said.

In the simulations with the current MCAS software, the test pilots used existing procedures to disable the system, while test flights using the new software required less intervention from the pilots, the person said.

Saturday's test flights were first reported by the New York Times.

The updated software designed by Boeing uses input from two sensors on the nose of the plane, instead of one, and is designed to not trigger the MCAS system repeatedly, which is believed to have pitched the Lion Air plane's nose down so sharply that the pilots' attempts to regain control were futile.

In a statement Sunday, Boeing called the meeting a "productive session" and said that they had invited more than 200 pilots and technicians, as well as regulators, to an informational session at the company's production facility in Renton, Washington, on Wednesday.

"This is part of our ongoing effort to share more details about our plan for supporting the safe return of the 737 MAX to commercial service," Boeing said.

"We had a productive session this past Saturday and plan to reach all current and many future MAX operators and their home regulators. At the same time, we continue to work closely with our customers and regulators on software and training updates for the 737 MAX," Boeing said.

The FAA, which is part of this effort to test the new software, declined to comment.

One source familiar with the tests said the FAA is expected to receive the software early in the week.

But the FAA is not expected to allow the dozens of 737 MAX planes it grounded back into the air until it learns more about the causes of the Ethiopian Air crash, the source said.

Data from the flight data and cockpit voice recorders is being analyzed in Ethiopia.

US air carriers would like to see the plane return to the sky. American, which has 24 MAX aircraft in its fleet, and Southwest, which has 34, agree with union statements that their pilots are trained well enough to deal with the incidents that the Lion Air pilots encountered.

American alone is canceling dozens of flights a day as a result of the grounding of the MAX aircraft.

On Sunday, the airline said in a statement that the cancellations would continue through April 24, resulting in 90 flights grounded every day.

[GordonR_Cape]

Lena.Kiev

https://www.nytimes.com/2019/03/24/business/boeing-737-pilots-simulators.html


Boeing showed a few pilots how a functioning MCAS operates, and how the trim cutouts work. I assume they did not show AOA disagree, stick shaker and stall warning at the same time? Does anyone feel reassured by this demonstration, given all the issues discussed in this thread?

Edit: My apologies for missing that detail in the article.

[KRUSTY 34]

Lena.Kiev



Boeing showed a few pilots how a functioning MCAS operates, and how the trim cutouts work. I assume they did not show AOA disagree, stick shaker and stall warning at the same time? Does anyone feel reassured by this demonstration, given all the issues discussed in this thread?

Talk about Smoke and Mirrors!

[73qanda]

Smoke and mirrors alright. A bunch of training Captains who have been briefed and have been researching the scenario for ten days and know it is about to occur landed safely? What a surprise. It’s pretty low to publish it in those words in my mind.

[WHBM]

Boeing will now make the disagree light standard in all new 737 Max planes, and will provide the indicator free of charge for customers who want it.

“All primary flight information required to safely and efficiently operate the 737 Max is included on the baseline primary flight display,” Boeing said. “All 737 Max airplanes display this data in a way that is consistent with pilot training and the fundamental instrument scan pattern that pilots are trained to use.”
If everything required was already fitted, why the change to include extra instruments ?

And likewise, if all for safety and efficiency was already included, the stockholders of the US airlines who spent not inconsequential sums on buyig these extra options will presumably ask their board why money was "squandered" on extra frippery.

Someone at Seattle really needs to tell the seemingly totally disconnected PR-corporate media managers in Chicago a home truth or two.

[yanrair]

Lena.Kiev



Boeing showed a few pilots how a functioning MCAS operates, and how the trim cutouts work. I assume they did not show AOA disagree, stick shaker and stall warning at the same time? Does anyone feel reassured by this demonstration, given all the issues discussed in this thread?

Dear Gordon
i would hope that the simulations that were run included all the failures experienced by Lionair. If not pretty worthless My guess is that they did include all faults. I’ve done loads of these deja vue replication flights and we always look for that sort of unrealistic replication. The pilots from the third party airlines present want a safe outcome and are not going to approve a botched pantomime of a demo. Yes they do know it’s coming up and are ready. So you approach it from the point of view “Things that now lie in the past, once lay in the future” so you try to see it through the eyes of a regular line pilot who might be on day 5 and of average skill.
Hope that helps?
Yanrair

[yanrair]

And of course how else can you test the scenario at headquarters on Boeing Sims without pilots who have studied the crash in minute detail and are fully expecting it?
All pilots world wide are pretty aware by now. It’s like tying to find a clean jury. Actually you can.
You. Introduce the failure on a regular sim session with a crew who think they are doing something completely different and are not training captains. We do it all the time on sim checks. Then you see how they cope.

[Australopithecus]

Boeing is going to hoist itself on its own petard. By previously maintaining that a falsely triggered MCAS event posed no serious risk they pegged out their position. Now they are trotting out well-briefed and coached training pilots to fly their new software and hopefully sing hosannas thereto. A typically venomous tort lawyer will have a field day with the logical disconnect between those two positions.

Either an aircraft is safe when flown by the lowest common denominator crew or it isn’t. And then what?

[73qanda]

Introduce the failure on a regular sim session with a crew who think they are doing something completely different and are not training captains. We do it all the time on sim checks. Then you see how they cope.

But that’s not what they did.....might have been too embarrassing.

[SRMman]

Looking beyond the technical fix that Boeing say they are close to completing, what interests me is the global reaction to this fix from airworthiness authorities. It seems likely that the FAA will approve the modification – presumably they are very much in the loop – but what about outside the US? We know at least EASA and the Canadian TCCA have said they will want to independently certify the fix, and possibly go deeper? Are other authorities likely to follow suit? Also one wonders when this process would start; immediately after Boeing release the mod, after the preliminary Ethiopian Airlines crash Report or even the final Lion Air and Ethiopian reports?

And then of course there is the timescale for such approvals or certifications to be implemented; how long would it take, not forgetting the pressure that will be on them from the affected Airlines. Assuming the US 737 Max fleet gets the go ahead and embodies the software update would we see 737 Max’s flying there but still grounded outside the US, maybe for months. One can imagine the American public’s unease at flying on the aircraft, knowing it is still grounded elsewhere.

Lastly, and the worst case scenario for Boeing, what if non-US authorities fail to certify the fix. It seems to me very unwise of Boeing/FAA to permit flying to commence in the US, knowing that other airworthiness authorities haven’t completed their own certification.

[Ian W]

Lena.Kiev



Boeing showed a few pilots how a functioning MCAS operates, and how the trim cutouts work. I assume they did not show AOA disagree, stick shaker and stall warning at the same time? Does anyone feel reassured by this demonstration, given all the issues discussed in this thread?

What a lot of strange responses. From the article above (my highlights)

At the gathering, pilots from the three American carriers, plus two smaller non-US airlines, ran simulated flights designed to mimic the situation that brought down the Lion Air flight in Indonesia last year, using the current and updated software, according to the person briefed on the session.

That seems to mean they would have had AoA disagree and that would give all the symptoms of stick shaker etc. The 'simulators' are not training simulators they are engineering test simulators with actual operational avionics. What would you expect Boeing to do? They had said that the problem with MCAS and AoA disagree could be handled by running the runaway trim NNC. So they had pilots in the simulators with the same effects show that it was correct and that the runaway trim NNC with Stab Trim cut out switched to off, stopped MCAS. Then repeat with new software and show problems do not occur and/or have become easier to solve.

They have a lot of confidence rebuilding to do. It would seem there is a lot of hostility too.

[Ian W]

Introduce the failure on a regular sim session with a crew who think they are doing something completely different and are not training captains. We do it all the time on sim checks. Then you see how they cope.

But that’s not what they did.....might have been too embarrassing.

Who would it have been embarrassing for?

[groundbum]

Two crashes bad. Third crash - jail time for all involved. And I would mean top to bottom at Boeing and the FAA.

So lemme see. Boeing rushed some software in in a rush, in a couple of years due to the NEO threat. Now they've rushed some more software in, in a few months, and this is somehow better? Have they even started to write test plans for all the interactions with other systems? Started to look at the AD converters? Perhaps the Boeing board would like to spend next week strapped in a MAX cabin doing high speed touch and go's in Africa with the greenest crew from Ethiopian Airlines/Lionair, people with 50 hours each on type and a messed up sleep pattern on a plane fixed by the greenest mechanics going with airline bosses yelling to keep the schedule going regardless? Is the USAF/USN letting this new software go onto their 737 derivatives?

G

[Loose rivets]

Started to look at the AD converters?

I find the A to D fault giving just over 20 degrees error such a compelling hypothesis that I'm deeply concerned when all I hear is Boeing rewriting MCAS code and recommending training.

With such an error lurking, it won't matter how many AoA vanes are replaced, or how gently the fault now manifests itself. It will still be a fault.

I'm worrying about nothing. Boeing can't be that blinkered . . . can they?

[wheelsright]

Fairly obviously, it will be very difficult for the FAA to certify a fix without first having a review of the FDR of the Ethiopian flight. Further difficulties are likely because other authorities may not approve certification without independent assessments of the "fixes". The only solution will be considerably more transparency from the FAA and the Boeing. Public opinion is the final arbiter for the future of the the MAX aircraft and perhaps even Boeing itself.

Having read the contributions, there is still considerable controversy about how the AOA/MCAS/Automation systems actually operates in ALL circumstances. While it seems the intention that MCAS is triggered in manual flight without flaps; it is not absolutely clear what are all the circumstances that it may maintain authority. Certainly, autopilot would appear to be disabled, and even if it were not, it may be affected by AOA errors. It is also not clear that a flap condition totally disables MCAS in all circumstances. There are also discrepancies over the left/right authority and the left and right seat controls and feedback. Above all it is fairly clear that the automated controls are inappropriately attempting to force a nose down condition that must be "rescued" by pilots. It is also not clear that there is enough time available to pilots to rescue that erroneous condition.

[BlueMax56]

Update From WSJ this morning:
Ethiopian Airlines’ chief executive said a stall-prevention system on Boeing’s 737 MAX appears to have been activated on a jet that crashed earlier this month—the first time an aviation official familiar with the flight has specifically said that the system could have been switched on during the accident.
Mr. Gebremariam didn’t detail how he had made his determination about MCAS. He doesn’t have access to the precise detail from the data and voice recording devices, but he has listened to recorded radio communications between the cockpit of the flight and the tower at Addis Ababa airport, from which the flight departed on March 10.
“To the best of our knowledge,” MCAS was activated on the flight, Mr. Gebremariam said in the interview, adding though that he wanted to wait for the investigation for conclusive evidence.

[hec7or]

“yanrair”
regular line pilot who might be on day 5 and of average skill.

you know that many companies roster more than 5 days, don’t you.

and
multiple warnings

you have the answer right there

[MurphyWasRight]

And of course how else can you test the scenario at headquarters on Boeing Sims without pilots who have studied the crash in minute detail and are fully expecting it?
All pilots world wide are pretty aware by now. It’s like tying to find a clean jury. Actually you can.
You. Introduce the failure on a regular sim session with a crew who think they are doing something completely different and are not training captains. We do it all the time on sim checks. Then you see how they cope.


Even better try it on a 737NG (Not MAX) crew expecting unreliable air speed or similar fault and see what happens. Just mimic the (existing) MCAS actions using the trim.

This would match what Lion air pilots were faced with, before MCAS was 'discovered' behaviour was claimed to match 737NG.

[Water pilot]

That has got to be one of the most lame PR exercises that I have ever seen and betrays a lack of an engineering mindset at America's premiere aerospace company. Congratulations, Boeing, you have proven that any competent pilot could have flown your faulty aircraft before the fix, any competent pilot can fly your aircraft after the fix, so Joe Passenger should have no worries at all about pilot skill and pay when boarding Economy Airlines -- who happen to be your target customer for the Max!

If you can't reproduce the problem, then you don't know what the problem is. I would feel more comfortable if the story were that these elite pilots had a really hard time recovering the aircraft before the fix, and after the fix all was good.

[Chas2019]

Two crashes bad. Third crash - jail time for all involved. And I would mean top to bottom at Boeing and the FAA.

So lemme see. Boeing rushed some software in in a rush, in a couple of years due to the NEO threat. Now they've rushed some more software in, in a few months, and this is somehow better? Have they even started to write test plans for all the interactions with other systems? Started to look at the AD converters? Perhaps the Boeing board would like to spend next week strapped in a MAX cabin doing high speed touch and go's in Africa with the greenest crew from Ethiopian Airlines/Lionair, people with 50 hours each on type and a messed up sleep pattern on a plane fixed by the greenest mechanics going with airline bosses yelling to keep the schedule going regardless? Is the USAF/USN letting this new software go onto their 737 derivatives?

G
To me I suspect they rushed this plane into production because of Airbus competition and got caught with a faulty product. Its too bad the company did not think through it all and now...? What they lost in terms of product confidence, trust in Boeing and the FAA cannot be bought back,

[ATC Watcher]

Perhaps the Boeing board would like to spend next week strapped in a MAX cabin doing high speed touch and go's in Africa with the greenest crew from Ethiopian Airlines/Lionair, people with 50 hours each on type and a messed up sleep pattern on a plane fixed by the greenest mechanics going with airline bosses yelling to keep the schedule going regardless?

Good one :E, but if only half of what we read here turns out to be correct , they might have to do something like this to restore confidence in the flying public..

[RatherBeFlying]

At present there are very few sims capable of demonstrating MCAS.

A CAA might justifiably require MAX8 crews be presented Lion and/or Ethiopian scenarios on an MCAS capable sim.

[safetypee]

Why would any operator need to experience a Lion MCAS event if the purpose of the ‘fix’ is to prevent such a failure, or at least its severity.