Ethiopian airliner down in Africa

[yanrair]

Two crashes bad. Third crash - jail time for all involved. And I would mean top to bottom at Boeing and the FAA.

So lemme see. Boeing rushed some software in in a rush, in a couple of years due to the NEO threat. Now they've rushed some more software in, in a few months, and this is somehow better? Have they even started to write test plans for all the interactions with other systems? Started to look at the AD converters? Perhaps the Boeing board would like to spend next week strapped in a MAX cabin doing high speed touch and go's in Africa with the greenest crew from Ethiopian Airlines/Lionair, people with 50 hours each on type and a messed up sleep pattern on a plane fixed by the greenest mechanics going with airline bosses yelling to keep the schedule going regardless? Is the USAF/USN letting this new software go onto their 737 derivatives?

G
Where are you going with this Groundbum!! If you are suggesting that Boeing or Airbus have to make planes that can be flown "doing high speed touch and go's in Africa with the greenest crew from XXX Airlines/AN other Airlines, people with 50 hours each on type and a messed up sleep pattern on a plane fixed by the greenest mechanics going with airline bosses yelling to keep the schedule going- regardless?", then who are you blaming? Clearly the airlines are responsible in this case and I would not want to fly with an airline like that. There are many like this and they are listed here and I would not fly with them.
https://ec.europa.eu/transport/modes/air/safety/air-ban/search_en
However I think you have to expect the manufacturer to make planes intended to be flown by competent pilots who can deal with most anything that comes along, as it does daily, and sometimes extraordinary events ( BA 747 quadruple engine failure; Hudson; 767 Gimli Airfield; BA 777 Heathrow; hundreds of others that are out there). And we expect National Authorities to regulate their airlines properly and the airlines to manage them properly so that the scenario you describe should not occur. It is why we should have highly trained pilots and two of them.
I feel that there is a lot of discomfort among some on this forum to accept that pilots need to know what they are doing and to stay ahead of the plane. A plane is not a play station, much as some would like it to be, and I for one believe that to try and make it into one is a bad move.
A superior pilot is one who uses his superior judgement to ensure he never has to exercise his superior skill!! I am not sure that should be changed.

Cheers
Y

[BobM2]

Very well said, YANRAIR. There are probably a few more that should be added to the Ban List

[MemberBerry]

I feel that there is a lot of discomfort among some on this forum to accept that pilots need to know what they are doing and to stay ahead of the plane.

I feel there is also discomfort among some others on this forum to accept that even pilots that "know what they are doing" might not have been able to save the Lion Air or the Ethiopian flights.

My discomfort is with the constant claims that a "competent pilot" would have identified and solved the problem immediately, and the insinuations that the crews from those two flights "didn't know what they were doing".

Until we get the final reports from the investigating teams, it's the other way around: WE don't know exactly what those crews were doing.

I'm not saying those pilots didn't make mistakes, it's quite possible they did, after all it was a stressful and confusing situation. It would actually be surprising if they did everything perfectly.

But so far I didn't see any evidence suggesting a training deficit of those pilots, compared to pilots from other airlines. If that's true, it means it is not impossible this could have happened to pilots from US or European airlines. There are even some people that claimed it couldn't have happened to European and US crews, because of their better training. I think we don't have enough evidence, and it's way to early for such claims.

[bsieker]

That has got to be one of the most lame PR exercises that I have ever seen and betrays a lack of an engineering mindset at America's premiere aerospace company. ...

"Lack of engineering mindset." Yes.

Even the first sentence struck me: "pilots from different airlines met with Boeing executives" ...,

Boeing executives. Not Boeing engineers. :{

Bernd

[Organfreak]

"Lack of engineering mindset." Yes.

Even the first sentence struck me: "pilots from different airlines met with Boeing executives" ...,

Boeing executives. Not Boeing engineers. :{

Bernd

I think that tells us that Boeing considers this to be, first and foremost, a PR problem, not an engineering one. I grew up with Boeing in my backyard but now I am disgusted. When they bought MD and took onboard a bunch of MD executives, their fatal dive began at that moment. :uhoh:

[bsieker]

Why would any operator need to experience a Lion MCAS event if the purpose of the ‘fix’ is to prevent such a failure, or at least its severity.

It is a futile, and ultimately embarrassing and revealing attempt to show to the world that "the airplane was perfectly safe before, but to cater to idiot third-world pilots, which we didn't even invite, we make it even safer!"
:yuk:

No, this isn't my opinion, this is how the lame excuse for a news article in the NYT reads to me.

Bernd

[clearedtocross]

Thank you, MemberBerry, how very true!

[bsieker]

Until we get the final reports from the investigating teams, it's the other way around: WE don't know exactly what those crews were doing.

I'm not saying those pilots didn't make mistakes, it's quite possible they did, after all it was a stressful and confusing situation. It would actually be surprising if they did everything perfectly.

But so far I didn't see any evidence suggesting a training deficit of those pilots, compared to pilots from other airlines. If that's true, it means it is not impossible this could have happened to pilots from US or European airlines. There are even some people that claimed it couldn't have happened to European and US crews, because of their better training. I think we don't have enough evidence, and it's way to early for such claims.

I think that point of view is exactly right. More importantly even than to know what those flight crews were doing is to make a useful theory of why they did what they did. After we figured out what they did, which should be relatively straightforward from the recordings.

The very few cases of suicide notwithstanding, it is practically always the case that to professional operators suffering an accident (pilots, ship captains, train drivers, excavator operators, chemical plant engineers, ...) what they were doing made sense at the time. Only with hindsight does it seem obvious that it was wrong, and once we know the "correct" solution it seems impossible to miss. But we cannot really evaluate the situation they were in at the time.

I hope Professor Dekker won't mind if I use a small picture from his highly recommended book The Field Guide to Understanding "Human Error" (quotes original) to illustrate:

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/480x204/mishap_001s_c2207b2918e3547e83fb4b0f9f95bc8bb72a8040.jpg
(2009 Sidney Dekker)


Bernd

[kenish]

Question for the pros from a private pilot (and sorry if this was answered in the thread and I didn't see it):

How often do flight crews experience a stall warning (stick shaker, aural warning, etc) in normal Part 121 flying? I would guess it's very rare.

[repulo]

Question for the pros from a private pilot (and sorry if this was answered in the thread and I didn't see it):

How often do flight crews experience a stall warning (stick shaker, aural warning, etc) in normal Part 121 flying? I would guess it's very rare.


Never.

In the EASA environment it should be trained regularly during the OPC/ProfCheck in the SIM.

[BobM2]

How often do flight crews experience a stall warning (stick shaker, aural warning, etc) in normal Part 121 flying? I would guess it's very rare.
Frequently, every 6 months in simulator sessions, never in line flying.

[island_airphoto]

Question for the pros from a private pilot (and sorry if this was answered in the thread and I didn't see it):

How often do flight crews experience a stall warning (stick shaker, aural warning, etc) in normal Part 121 flying? I would guess it's very rare.

Even in a C-172 I would not normally have any stall buffeting or warnings going on with paying passengers. They tend not to like it ;) If you are a recent PPL, stalls seem like so much of your recent training it might seem odd you can not stall any airplanes for months or years if you don't want to, checkrides of various types excepted.

[island_airphoto]

https://www.aopa.org/news-and-media/all-news/2019/march/21/aopa-safety-expert-weighs-in-on-boeing-crisis
>>
When the Lion Air crash of a Boeing 737 MAX 8 revealed the existence of a flight control system operating in the background, which Boeing and the FAA had not revealed when the MAX 8 was introduced, pilots felt betrayed, as if Boeing had secretly abandoned its guiding design principle and lost faith in pilot skills. In actuality, Boeing’s trust in pilot skills likely buoyed a system design and roll-out strategy that appears to be at the root of two recent MAX 8 crashes. Boeing’s critical mistake may be in assuming a worldwide standard of pilot competency that doesn’t exist.
>>
I ran across this today. One theory is that of course American pilots are good enough to deal with runaway trim, so Boeing figured no big deal :rolleyes:

[FCeng84]

https://www.aopa.org/news-and-media/all-news/2019/march/21/aopa-safety-expert-weighs-in-on-boeing-crisis
>>
When the Lion Air crash of a Boeing 737 MAX 8 revealed the existence of a flight control system operating in the background, which Boeing and the FAA had not revealed when the MAX 8 was introduced, pilots felt betrayed, as if Boeing had secretly abandoned its guiding design principle and lost faith in pilot skills. In actuality, Boeing’s trust in pilot skills likely buoyed a system design and roll-out strategy that appears to be at the root of two recent MAX 8 crashes. Boeing’s critical mistake may be in assuming a worldwide standard of pilot competency that doesn’t exist.
>>
I ran across this today. One theory is that of course American pilots are good enough to deal with runaway trim, so Boeing figured no big deal :rolleyes:

Here we are 15 days and 2500+ posts into a thread about an accident for which we have not yet seen the FDR info nor heard anything about the crew conversations from the CVR and we are already saying that system design and roll-out strategy appears to be at the root of that accident?! We need that data before any sense of the root cause can be put forth as anything other then conjecture. Without the Lion Air accident we would at this point have no idea what brought the Ethiopian 737MAX down. As a result of having had the Lion Air accident many people seem to assume that the Ethiopian event was a repeat.

Can anyone with direct knowledge of what the Ethiopian FDR reveals describe specifically how and why then think this accident is similar to the Lion Air accident in a manner that would point to "system design and roll-out strategy" as having played a role?

[PJ2]

I think that point of view is exactly right. More importantly even than to know what those flight crews were doing is to make a useful theory of why they did what they did. After we figured out what they did, which should be relatively straightforward from the recordings.

The very few cases of suicide notwithstanding, it is practically always the case that to professional operators suffering an accident (pilots, ship captains, train drivers, excavator operators, chemical plant engineers, ...) what they were doing made sense at the time. Only with hindsight does it seem obvious that it was wrong, and once we know the "correct" solution it seems impossible to miss. But we cannot really evaluate the situation they were in at the time.

I hope Professor Dekker won't mind if I use a small picture from his highly recommended book The Field Guide to Understanding "Human Error" (quotes original) to illustrate:

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/480x204/mishap_001s_c2207b2918e3547e83fb4b0f9f95bc8bb72a8040.jpg
(2009 Sidney Dekker)
Bernd
Hi Bernd;
I'm sure Professor Dekker won't mind a bit!

As you'd know, he also states, "What (you think) should've happened cannot explain people's behaviour", (The Field Guide to Understanding "Human Error" - Dekker, Ashgate, 2006). In fact, rather than possessing pilot licences, this specific book among all of Dekker's excellent works should be required reading as a condition of PPRuNe participation! ;-) https://www.pprune.org/images/infopop/icons/icon7.gif

BTW, I fully agree with you regarding your views on AoA. AoA is for downstream equipment to use. Even though it appears to be obvious, I don't think AoA is the magic bullet some make it out to be and I don't think the case has been demonstrated for it's inclusion in an already-crowded PFD. In fact, there are no saves on record that occurred as a result of pilots knowing their AoA.

The question is, why did two AoA sensors, the one from the flight previous to the accident flight, and, (after having been changed), the accident flight AoA sensor have the same, identical incorrect AoA value? I've looked in the AMM - the installation is "keyed" so an incorrect install is unlikely, and the test procedures are thorough. Even if, hypothetically, not done, I am informed that these sensors are rarely wrong. Also, while poor operation of the loading bridge can possibly damage the left AoA, all such instances have been caught on the walkaround. (For those who don't know the aircraft, the AoA sensor is well forward of the L1 door).

PJ2

[SquintyMagoo]

Why would any operator need to experience a Lion MCAS event if the purpose of the ‘fix’ is to prevent such a failure, or at least its severity.


There's no evidence that MCAS was implemented to prevent any failure which befell Lion Air. That is, no one has yet suggested the Lion Air crash was caused by a stall, which is what MCAS was designed to prevent.

[BobM2]

The question is, why did two AoA sensors, the one from the flight previous to the accident flight, and, (after having been changed), the accident flight AoA sensor have the same, identical incorrect AoA value?

PJ2
You need to reread the preliminary report on JT610. The left AOA sensor was replaced prior to JT043 on the evening prior to the crash. Despite its malfunction on that flight, it was neither written up nor replaced prior to JT610 the next day.

[yanrair]

Here we are 15 days and 2500+ posts into a thread about an accident for which we have not yet seen the FDR info nor heard anything about the crew conversations from the CVR and we are already saying that system design and roll-out strategy appears to be at the root of that accident?! We need that data before any sense of the root cause can be put forth as anything other then conjecture. Without the Lion Air accident we would at this point have no idea what brought the Ethiopian 737MAX down. As a result of having had the Lion Air accident many people seem to assume that the Ethiopian event was a repeat.

Can anyone with direct knowledge of what the Ethiopian FDR reveals describe specifically how and why then think this accident is similar to the Lion Air accident in a manner that would point to "system design and roll-out strategy" as having played a role?
Hi there FCeng
I realise that this thread is called Ethiopian ....... etc but it seems to be really about both accidents.
As far as I know nobody has that information other than the French BEA and presumably the Ethiopian authority. Assuming the recorders were not damaged. And nothing has been revealed so far. We don't know if the failure modes were the same or what the crew response was. Do we? Like you I am keen to know.
It seems a long delay between getting the FDR to France and the release of any data.
Has it been suggested somewhere here that we know what happened to Ethiopian? The Lion Air prelim. report is out and I thought that we were discussing that one in some detail, since we know a lot of what happened. And the rest about Ethiopian speculation?
The way aviation stays safe is for us to learn from every incident, find out what happened immediately and ensure that everyone knows how to avoid that particular trap next time. So, we have the flight the day previous to the Lion Air crash, , which may have provided valuable lessons perhaps. We shall see. There may, I say may since all flights of the Max since it came into service have live Flight Data Recording which would l am pretty sure throw up and previous examples of this sort of failure mode. Or MOR pilot reports of similar events. It would be very sad if others had experienced the same events, successfully dealt with them however difficult, and not passed on that knowledge into the gene pool.
Ethiopian did have some knowledge because they issued a notice to all their pilots referring to Lion Air and the Boeing advice. But the failure mode may have been completely different could it not?
If you read through some of the 2500 odd posts , a lot of them are cut and paste from Internet, Newspaper " sources" and other media feeds. Some of the commentary is first class but it can be hard for readers sometimes to sort through it. And then some things have been fully discussed days or weeks ago, only to resurface because we have not had time to read the whole 2500 posts. That is the nature of these forums.
But I have learned a lot over the last few days about the functioning of these systems, regulatory oversight, and probably most important, how many different views there are out there. All valuable. Except Boeing bashing in my view. The historic accident rate for Boeing is very low and pretty much the same as Airbus.
Let us all hope that the reports will reveal what happened in full detail and permit the 737 Max back where it belongs. With any shortcomings in any system, human or mechanical or electronic sorted out.

[yanrair]

Frequently, every 6 months in simulator sessions, never in line flying.
I can think of quite a few including a 747 at XXX stalling in the holding pattern 7000 feet, and good stall recovery but, very close call with planes below. I will look for others but I think there are many.
Turkish at AMS comes to mind right away
Cheers
Y

[VicMel]

They have a lot of confidence rebuilding to do. It would seem there is a lot of hostility too.

Boeing first needs to get over the first high hurdle of gaining confidence in MCAS. As a former aviation safety assessor, I find it incredulous that even if Boeing had decided the MCAS software was only DO-183C Level C (when the evidence now shows it should have been Level A), there was still no-one in their organisation (from QA to coders) who pointed out having software directly control the stabiliser based on the use of only one sensor is a very bad idea! Perhaps someone did and they were told (in no uncertain terms), ‘the pilot will cope’. Perhaps ‘someone’ suggested it might be a good idea if MCAS was disabled when GPWS was active or altitude was less than, say 500 feet, but was ignored. I have little confidence in the robustness of the MCAS software to the extent that I think it could now be a ‘prime suspect’. The probability of the same hardware failing on three different flights, especially as on JT043 no fault was found, seems to me unlikely. The MCAS software might not have been thoroughly scrutinised and tested for possible software self corruption, overflows, processor overload, never ending loops, interrupts clashing etc, etc. It could be that a large value of AoA caused a value overflow in the software leading to arbitrary behaviour of the MCAS. However, whatever the root cause of the failure turns out to be, the problem still remains that a non Level A software package can control the stabiliser. Regardless of whatever patch(s) are introduced, at some time in the future there is an unacceptable probability that a bug could emerge causing the MCAS to continually demand a ‘nose down’.

[BobM2]

I can think of quite a few including a 747 at XXX stalling in the holding pattern 7000 feet, and good stall recovery but, very close call with planes below. I will look for others but I think there are many.
Turkish at AMS comes to mind right away
Cheers
Y
Sure, AF447 & China 747 at high altitude, Asiana on short final at SFO, competent aviators NEVER!

[yanrair]

I feel there is also discomfort among some others on this forum to accept that even pilots that "know what they are doing" might not have been able to save the Lion Air or the Ethiopian flights.

My discomfort is with the constant claims that a "competent pilot" would have identified and solved the problem immediately, and the insinuations that the crews from those two flights "didn't know what they were doing".

Until we get the final reports from the investigating teams, it's the other way around: WE don't know exactly what those crews were doing.

I'm not saying those pilots didn't make mistakes, it's quite possible they did, after all it was a stressful and confusing situation. It would actually be surprising if they did everything perfectly.

But so far I didn't see any evidence suggesting a training deficit of those pilots, compared to pilots from other airlines. If that's true, it means it is not impossible this could have happened to pilots from US or European airlines. There are even some people that claimed it couldn't have happened to European and US crews, because of their better training. I think we don't have enough evidence, and it's way to early for such claims.

Yes indeed. I have seen such commentary. It is premature and totally unproven. What I have said, I think, is that a runaway STAB whether continuous or intermittent (stop/start but always nose down) is containable - from a purely piloting / mechanical / aerodynamic point of view. If it is noticed it can be stopped. STAB OFF switches.
That is a fact, and it happened the day before. And of course the recent Boeing simulator sessions with line pilots at Seattle showed that they all stopped it. But of course, they knew what to expect, didn't they. But they were 737-max airline pilots and not Boeing test pilots.
Y

[yanrair]

Thanks for that reminder Bob. It is late and I am too tired to start Googling. The point here is that these things happen a lot more than people think and normally, the pilot can manage it.
Y

[zoigberg]

Sure, AF447 & China 747 at high altitude, Asiana on short final at SFO, competent aviators NEVER!

I would add Thomsonfly Bournemouth. A company that prides itself on the training and quality of their pilots but this one was very close to a hull loss following a thoroughly mismanaged stall event.

[BobM2]

Most people are not aware of the international rules & protocols governing investigations of air transport accidents. The assigned lead investigating agency of a particular accident is the only one who can make public comment on the details of that investigation. In the case of ET302, the lead agency is Ethiopian Civil Aviation Authority. Any public comment concerning findings of the investigation must come only from them. Any of the other participants, Ethiopian Airlines, Boeing, FAA, NTSB, BEA, CFM, etc, who violates this rule will be immediately barred from further participation. So if some of the statements made by participants such as FAA or Boeing seem rather vague, that is the reason. A preliminary report is supposed to be issued within 30 days, which was done by Indonesia for the Lion Air crash.
The Ethiopian Airlines CEO was just quoted on TV news as saying a preliminary report should be out either this week or next, so stay tuned.

[Water pilot]

Can anyone with direct knowledge of what the Ethiopian FDR reveals describe specifically how and why then think this accident is similar to the Lion Air accident in a manner that would point to "system design and roll-out strategy" as having played a role?
It is quite possible that MCAS had nothing to do with either accident, but the existence of this poorly designed feature does point to a flawed "system design and roll-out strategy." I have debugged complex systems (both software and electrical) and quite frequently the close review of the system reveals design faults that unfortunately turn out not to have anything much to do with the actual problem that you were tasked to fix. MCAS is glaringly bad, the question that pilots and passengers should ask is "what else don't we know about?" That something else might be the real culprit.

For all we know, something else is going on -- I do not like the reports of data corruption that threw fault codes, attempted to be fixed by "cleaning the connectors." Random data presented to software can expose all sorts of bugs, including in the recording systems that we are using to try to analyze this situation. I worked with a former Boeing programmer (not on avionics) and his code was not exactly fault tolerant with respect to bad network packets; hardware/software engineers seem to have a mindset that precludes the possibility of bad data being presented to their code.

[Bangkokian]

It is quite possible that MCAS had nothing to do with either accident, but the existence of this poorly designed feature does point to a flawed "system design and roll-out strategy." I have debugged complex systems (both software and electrical) and quite frequently the close review of the system reveals design faults that unfortunately turn out not to have anything much to do with the actual problem that you were tasked to fix. MCAS is glaringly bad, the question that pilots and passengers should ask is "what else don't we know about?" That something else might be the real culprit.

For all we know, something else is going on -- I do not like the reports of data corruption that threw fault codes, attempted to be fixed by "cleaning the connectors." Random data presented to software can expose all sorts of bugs, including in the recording systems that we are using to try to analyze this situation. I worked with a former Boeing programmer (not on avionics) and his code was not exactly fault tolerant with respect to bad network packets; hardware/software engineers seem to have a mindset that precludes the possibility of bad data being presented to their code.

This is spoken like someone who understands the interaction between hardware and software. It's exactly what I wondered, as well. Sure, maybe it's as simple as altering the sensor inputs, but the input itself, wherever it comes from, has to be trusted all the time. If input is suspect, then output is too, and that's a cause for concern.

[patplan]

You need to reread the preliminary report on JT610. The left AOA sensor was replaced prior to JT043 on the evening prior to the crash. Despite its malfunction on that flight, it was neither written up nor replaced prior to JT610 the next day.

The MX in CGK didn't suspect the newly replaced vane to be the caused.https://i.ibb.co/KNShp0C/combo1c.png (https://ibb.co/4s3tnmB)
https://i.ibb.co/TMBp6y3/combo2z.png (https://imgbb.com/)
https://i.ibb.co/NWQZGy7/fourthp.png (https://imgbb.com/)
The MX from the previous sector in DPS had suspected the CAPT's AOA vane had been the culprit, so he replaced that L Vane. Yet on its next flight, the SAME problem occured again with even more "flavors". Therefore, the MX in CGK surmised the AOA vane wasn't the problem - the problem must've lied elsewhere. He instead flushed the pitot and fixed other stuff which he thought to be correlated with what the CAPT wrote on the AFML.

[wiedehopf]

The MX from the previous sector in DPS had suspected the CAPT's AOA vane had been the culprit, so he replaced that L Vane. Yet on its next flight, the SAME problem occured again with even more "flavors". Therefore, the MX in CGK surmised the AOA vane wasn't the problem - the problem must've lied elsewhere. He instead flushed the pitot and fixed other stuff which he thought to be correlated with what the CAPT wrote on the AFML.

I wouldn't call it the same problem. The problem before was the AoA signal intermittently being missing, causing the loss of air data on the captains side.
After the AoA replacement the problem was a constant offset, i would call that a different error.

Anyway it wasn't two AoA vanes with the constant offset.
It could be that neither AoA vane is at fault and maybe just the installation triggered another problem causing the constant offset.

[patplan]

I wouldn't call it the same problem. The problem before was the AoA signal intermittently being missing, causing the loss of air data on the captains side.
After the AoA replacement the problem was a constant offset, i would call that a different error.

Anyway it wasn't two AoA vanes with the constant offset.
It could be that neither AoA vane is at fault and maybe just the installation triggered another problem causing the constant offset.

To compound the problem even more, the CAPT/FO of JT-043 didn't report the "stick shaker", or the fact that they had to perform the NNC for "runaway stabilizer". The MX had no idea about those "very serious" occurrences. The holes in the cheese started to line up...

[BobM2]

To compound the problem even more, the CAPT/FO of JT-043 didn't report the "stick shaker", or the fact that they had to perform the NNC for "runaway stabilizer". The MX had no idea about those "very serious" occurrences. The holes in the cheese started to line up...
The crew of 610 the next morning also had no clue...until they rotated on take-off

[GarageYears]

What if the AOA issue w/JT610 turns out to be a maintenance induced fault?

What if ET302 is unrelated to MCAS?

What if the lack of FDR/CVR info from ET302 is solely due to the Ethiopian authorities covering their arse...?

This doesn’t excuse Boeing from the problems with the MCAS implementation, but something is becoming increasingly odd about the lack of info related to ET302. Could someone be trying to make the holes in the cheese line up artificially, since the real answer is one of systematic problems within a country’s aviation authority and whether the crew in question should have been in that cockpit at all?

Idle thoughts maybe?

- GY

[WingNut60]

What if the lack of FDR/CVR info from ET302 is solely due to the Ethiopian authorities covering their arse...?
........

That may or may not be a factor.

But the Ethiopian authorities are under no obligation to say anything for 30 days, certainly not to release data just so arm-chair experts can make their own analysis.
And they as sure as heck are not going to say anything until they themselves are reasoanably sure that what they are about to say is accurate and correct.

[jimtx]

Yes indeed. I have seen such commentary. It is premature and totally unproven. What I have said, I think, is that a runaway STAB whether continuous or intermittent (stop/start but always nose down) is containable - from a purely piloting / mechanical / aerodynamic point of view. If it is noticed it can be stopped. STAB OFF switches.
That is a fact, and it happened the day before. And of course the recent Boeing simulator sessions with line pilots at Seattle showed that they all stopped it. But of course, they knew what to expect, didn't they. But they were 737-max airline pilots and not Boeing test pilots.
Y

Let’s back off competent pilots knowing to cutoff stab trim. Let’s focus on a couple at LionAir that trimmed when their commanded attitude required it. And one who didn’t trim. Why didn’t he trim. Not much real hand flying experience?

[patplan]

Let’s back off competent pilots knowing to cutoff stab trim. Let’s focus on a couple at LionAir that trimmed when their commanded attitude required it. And one who didn’t trim. Why didn’t he trim. Not much real hand flying experience?

A little background on CAPT and FO, refer to pp.4-5 Preliminary Accident Investigation Report:

1.5.1 Pilot in Command
Age:31 years
Nationality:India
Date of joining company:25 April 2011
License:ATPL
Date of issue:28 July 2016
Aircraft type rating:Boeing 737
Instrument rating validity:31 May 2019
Medical certificate:First Class
Last of medical:5 October 2018
Validity:5 April 2019
Medical limitation:Pilot shall wear corrective lenses
Last line check:19 January 2018
Last proficiency check:7 October 2018

Flying experience
Total hours:6,028 hours 45 minutes
Total on type: 5,176 hours
Last 90 days: 148 hours 15 minutes
Last 30 days: 81 hours 55 minutes
Last 7 days:15 hours 45 minutes
This flight:about 11 minutes



1.5.2 Second in Command
Age:41 years
Nationality:Indonesia
Date of joining company:31 October 2011
License:CPL
Date of issue:15 May 1997
Aircraft type rating:Boeing 737
Instrument rating validity:31 August 2019
Medical certificate:First Class
Last of medical:28 September 2019
Validity:28 March 2019
Medical limitation:Pilot shall possess glasses that correct for near vision
Last line check:4 July 2017
Last proficiency check:25 August 2018

Flying experience
Total hours:5,174 hours 30 minutes
Total on type:4,286 hours
Last 90 days:187 hours 50 minutes
Last 30 days:32 hours 55 minutes
Last 7 days:20 hours 20 minutes
This flight:About 11 minutes

[Capt Kremin]

What if the Ethiopian Airlines CEO is inappropriately involved in the investigation?

Why is this guy giving updates on when a preliminary, or ANY update will be released? What does he know that no-one else seems to know and why?

Update (https://www.reuters.com/article/us-ethiopia-airplane-ceo/ethiopian-airlines-ceo-says-preliminary-crash-report-may-be-this-week-or-next-idUSKCN1R625O?feedType=RSS&feedName=newsOne)

[WingNut60]

Not sure I'd count 'maybe this week or next' as an update.
30 days is up on 9th April anyway.

[Capn Bloggs]

Why is this guy giving updates on when a preliminary, or ANY update will be released? What does he know that no-one else seems to know and why?
I think you're getting a bit paranoid there Kremlin. He might have simply asked the chief investigator "when's your prelim report coming out?" and just relaying the answer. The expected date of the report isn't an "update" IMO.

[Geeek]

I wouldn't call it the same problem. The problem before was the AoA signal intermittently being missing, causing the loss of air data on the captains side.
After the AoA replacement the problem was a constant offset, i would call that a different error.

Anyway it wasn't two AoA vanes with the constant offset.
It could be that neither AoA vane is at fault and maybe just the installation triggered another problem causing the constant offset.

Could it be there was some calibration process that was overlooked?
Is the AOA sensor manufactured to output a standard analog voltage output at a given angle of deflection (so, you don't need calibration),
Or does each new installation of AOA sensor installed and then the system is calibrated to interpret the AOA voltage?

Any maintenance engineers here to confirm the steps taken?

[Capt Kremin]

I think you're getting a bit paranoid there Kremlin. He might have simply asked the chief investigator "when's your prelim report coming out?" and just relaying the answer. The expected date of the report isn't an "update" IMO.

The CEO of the airline that had the accident has a massive conflict of interest and shouldn't be allowed to have any part in the publication of a report apart from supplying information to the Investigators. I'm not the first to question this.

How does he know this?

Tewolde (https://arstechnica.com/information-technology/2019/03/ethiopian-airlines-ceo-boeing-flight-system-may-have-triggered-crash/)

[Capt Kremin]

Finally we may get some answers.

Data released. (https://abcnews.go.com/Politics/ethiopian-boeing-737-max-plane-black-box-data/story?id=61934395)

[bsieker]

Finally we may get some answers.

Data released. (https://abcnews.go.com/Politics/ethiopian-boeing-737-max-plane-black-box-data/story?id=61934395)

It hasn't been released. It has been shared with the other participants to the investigation, as stipulated by ICAO Annex 13.

It also won't speed up the public release of the data, because only the Ethiopian agency leading the investigation can do that.


Bernd

[EDLB]

The CEO of the airline that had the accident has a massive conflict of interest and shouldn't be allowed to have any part in the publication of a report apart from supplying information to the Investigators.

The same is true for any party that has hide in the game. That would be Boeing and the FAA, both face FBI criminal investigation so far.

I think Ethopian airlines did wan’t to make sure that nobody tampers with the evidence, so they took the FDR and CVR for read out to the BEA. You can be sure that Boeing, FAA and NTSB was notified early on the data since they have persons at the BEA for this investigation. So far we have heard nothing to the contrary that lots of similarities exist between the Lion air and Ethopian air accident. If it was a completely different cause Boeing would have spread long rumours, since they have the most hide in the game and loose money by the millions a day. Both were almost brand new airplanes so maintainance issues are not that likely.

[George Glass]

Um...EDLB, have you seen the posts on the maintenance records on the Lion Air flight? The media pile-on on Boeing may not work out the way people think.

[EDLB]

Um...EDLB, have you seen the posts on the maintenance records on the Lion Air flight? The media pile-on on Boeing may not work out the way people think.
Yes I have. The plane was not airworthy and they tried with cleaning connectors and changing one AoA vane. But the problem was still there and the last crew did not use the trim cutout switches. Which still leaves open, what was the cause.
With that up to now unknown failure the overwhelming MCAS trim authority came to light.

And a few month later the next MAX stuck in the ground with similar erratic altitude pattern.

[scouse104]

Yes indeed. I have seen such commentary. It is premature and totally unproven. What I have said, I think, is that a runaway STAB whether continuous or intermittent (stop/start but always nose down) is containable - from a purely piloting / mechanical / aerodynamic point of view. If it is noticed it can be stopped. STAB OFF switches.
That is a fact, and it happened the day before. And of course the recent Boeing simulator sessions with line pilots at Seattle showed that they all stopped it. But of course, they knew what to expect, didn't they. But they were 737-max airline pilots and not Boeing test pilots.
Y

Purley from an investigative point of view and not as a pilot. If the prev flight used the stab cut out switches who and when would they be returned to the normal setting? Would a record of this switch change be made?

If they had been reset by maintenace or the pilots of the final flight might this not have been a clie something else was going on?

[PEI_3721]

EDLB, #2572
You could consider alternative explanations. Consider that the problem was not directly apparent to maintenance, only the electronic tag that there had been a fault - see #2552.
The systems were were reset and tested, the aircraft was serviceable.
Even after an AoA probe change the aircraft systems still indicated fully serviceable.


Would the software view - ‘bits’, check sum error (?), A to D conversation (?), apply to the following:-

Why the AoA value failed high - both Lion flights, Ethiopian assumed based on outcome.

That the offset could be reset with aircraft power-down, or WoW alternate switching, or Maintenance system self-test (explanations for having the maintenance log recording a fault, but none clearly identifiable by engineers or flight crew before the next flight.)

Would such a ‘failure’ be a random, probabilistic occurrence - just chance, or require an external disturbance - elect spike (FDR AoA error seen during taxi - generator switching? Lion FDRs indeterminate, Ethiopian unknown.)

https://www.pprune.org/rumours-news/618252-boeing-737-max-software-fixes-due-lion-air-crash-delayed-20.html#post10429320

Add to the above; why apparently did the fault only apply to the left side (wait for Ethiopian FDR) - also ref reset, WoW alternating, maint tests, in the questions above,

[patplan]

The 40-second which could've made or broken the Lion Air PK-LQP...
..In Test of Boeing Jet, Pilots Had 40 Seconds to Fix Error

March 25, 2019
During flight simulations recreating the problems with the doomed Lion Air plane, pilots discovered that they had less than 40 seconds to override an automated system on Boeing's new jets and avert disaster.

The pilots tested a crisis situation similar to what investigators suspect went wrong in the Lion Air crash in Indonesia last fall. In the tests, a single sensor failed, triggering software designed to help prevent a stall.

Once that happened, the pilots had just moments to disengage the system and avoid an unrecoverable nose dive of the Boeing 737 Max, according to two people involved in the testing in recent days. Although the investigations are continuing, the automated system, known as MCAS, is a focus of authorities trying to determine what went wrong in the Lion Air disaster in October and the Ethiopian Airlines crash of the same Boeing model this month.

The software, as originally designed and explained, left little room for error. Those involved in the testing hadn't fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.

Compounding the flaws, pilots received limited training about the system before the first crash. During the final minutes, the captain of the Lion Air flight flipped through a technical manual trying to figure out what was happening.

In a tacit acknowledgment of the system's problems, Boeing is expected to propose a software update that would give pilots more control over the system and make it less likely to trigger erroneously, according to three people, who spoke on the condition of anonymity to describe the private meetings.

There are common procedures in place to counteract MCAS, as currently designed. If the system starts pushing the plane's nose down, pilots can reverse the movement via a switch at their thumb, a typical reaction in that situation. In doing so, they can potentially extend the 40-second window, giving them more time to avoid a crash.

To fully neutralize the system, pilots would need to flip two more switches. That would shut off the electricity to a motor that allows the system to push the plane toward the ground. Then the pilots would need to crank a wheel to correct whatever problems had emerged.

The pilots, in the simulations, followed such procedures to successfully shut off the system and land safely. But they did so with a far better understanding of how it worked and prior knowledge that it would be triggered -- benefits that the pilots of the fatal 737 Max crashes did not have.

If pilots don't act hastily enough, attempts to disable the system can be too late. In the Lion Air crash, pilots used the thumb switch more than two dozen times to try to override the system. The system kept engaging nonetheless, most likely because of bad readings from a sensor, until the plane crashed into the Java Sea, killing all 189 people on board.

John Cox, an aviation safety consultant and a former 737 pilot, said pilots are highly likely to use the thumb switch to extend the 40-second window to several minutes. But that may still not be enough time to diagnose and solve the problem, especially if the pilots, like the Lion Air crew, were not informed of the system.

"There is a limited window to solve this problem, and this crew didn't even know that this system existed," he said......

In the current design, the system engages for 10 seconds at a time, with five-second pauses in between. Under conditions similar to the Lion Air flight, three engagements over just 40 seconds, including pauses, would send the plane into an unrecoverable dive, the two people involved in the testing said.

That conclusion agreed with a separate analysis by the American Airlines pilots' union, which examined available data about the system, said Michael Michaelis, the union's top safety official.

One of the people involved in the training said MCAS was surprisingly powerful once tested in the simulator. Another person found the system controllable because it was expected. Before the Lion Air crash, Boeing and regulators agreed that pilots didn't need to be alerted to the new system, and training was minimal.

At least some of the simulator flights happened on Saturday in Renton, Wash., where the 737 Max is built. Pilots from five airlines - American, United, Southwest, Copa and Fly Dubai - took turns testing how the Max would have responded with the software running as it was originally written, and with the updated version, known as 12.1.....==========
For the full article:
- https://www.nytimes.com/2019/03/25/business/boeing-simulation-error.html

[gums]

Salute!

Great article, pat.
The 40 secind scenario appears to be simply allowing the MCAS to act without the crew using the trim switches. Eventually, unless power is reduced, the aero forces on the elevator and the awesome column forces required will not permit a recovery. And who wants to pull power back just after gear up? ( although I did for my LEF episode as I was light and could easily fly at 200 knots - it was the old " doing O.K. now, so don't change anything" procedure that lets you live to be old and grey) I also feel most of the 737 folks here would have used the trim switches for a time before treating the problem as a FUBAR trim system and then turning off the power as the previous flight crew did.

The MCAS mod should be interesting and provide a feast of fodder here on pPrune, huh?

Gums sends...

[Zeffy]

https://www.seattletimes.com/business/boeing-aerospace/boeing-has-737-max-software-fix-ready-for-airlines-as-dot-launches-new-scrutiny-of-entire-faa-certification-process

Boeing has 737 MAX software fix ready for airlines as DOT launches new scrutiny of entire FAA certification process
March 25, 2019 at 1:22 pm Updated March 25, 2019 at 4:46 pm


Dominic Gates By Dominic Gates
Seattle Times aerospace reporter

Flight tests are likely to begin this week on the proposed software fix for Boeing’s 737 MAX flight control system, and the company has invited airlines to order it pending formal approval from the Federal Aviation Administration (FAA).

Boeing said Monday it is finalizing the proposed update. Some airline pilots flew 737 simulators with the updated system software in Renton on Saturday.

Company spokesman Gordon Johndroe said the MAX software fix will be offered to airlines “free of charge” and will be released only after it is certified by the FAA.

Meanwhile, the U.S. Department of Transportation (DOT) announced Monday the establishment of an expert “special committee” to review the FAA procedures for the certification of new aircraft, including the Boeing 737 MAX.

Retired Air Force Gen. Darren McDew, former head of the U.S. Transportation Command, and Captain Lee Moak, former president of the Air Line Pilots Association, will serve as the interim co-chairs of the panel, pending the appointment of other members.

Flaws in a new flight control system, called MCAS (Maneuvering Characteristics Augmentation System), that Boeing introduced on the MAX are suspected as having played a major role in two crashes in less than five months.

Boeing has been working on the software fix since last November after it became clear that MCAS had been inadvertently triggered before the crash of Lion Air Flight 610 the previous month. Evidence pointing again at MCAS in the crash of Ethiopian Airlines Flight 302 this month resulted in the FAA’s March 13 order to ground the plane.

On Saturday, Boeing held an information session for airlines and safety regulators in Renton to share details about the proposed software fix. The jetmaker said it also has invited more than 200 airline pilots, technical leaders and regulators for the next session in Renton on Wednesday.

A person familiar with how Saturday’s session was conducted said it was “very hands-on.” Airline pilots were able to fly the MAX with the updated software patch in a simulator, and were asked for their feedback.

A pilot with a U.S. airline that operates 737 MAX jets, who was briefed on the session, said his contacts “are very pleased with what they’ve seen so far in the software change.”

As early as this week, Boeing is likely to start actual 737 MAX flight tests for the purpose of certifying the new software.

An FAA spokesman said that as of noon Monday, the FAA was still awaiting details of Boeing’s fix. However, he added that “Boeing has kept the FAA in the loop throughout the process and we expect to receive the software from Boeing early this week.”

MCAS is designed to push the nose of the airplane down in certain stall situations by swiveling the horizontal tail. It’s triggered by a signal from a sensor measuring the plane’s angle of attack, which is the angle between the wings and the air flow.

The software fix will revamp how the system operates: One key change is that MCAS will be activated using input from both of the jet’s angle of attack sensors, rather than just one.

The update will also ensure MCAS is not triggered multiple times, as it was in the Lion Air crash. And it is likely to limit the maximum nose-down movement that the system can produce.

In addition to the software fix, Boeing has decided to include on the MAX, at no charge, two angle of attack indicators that were previously optional and available only at extra cost.

A person familiar with Boeing’s plans to get the grounding of the MAX lifted said that a light that warns when the two angle of attack sensors disagree will become a standard feature on the MAX from now on. And for airlines that request it, Boeing will retrofit this warning light at no charge on previously delivered airplanes.

In addition, Boeing will no longer charge airlines that choose an option to place the angle of attack data on the primary flight display.

But it’s unclear if these changes and the MCAS software fix, even if certified, will be enough to lift the grounding of the Boeing jets. For instance, the airplane’s flight manuals and the pilot training protocols will also have to be updated.

And the ongoing investigations into the two fatal jet crashes may bring other contributing factors to the surface.

The DOT special committee will conduct a broader investigation into how the FAA certifies new airplanes as safe. The way that currently works, in a process mandated by Congress, is that Boeing does most of the safety evaluations itself, then passes paperwork to the FAA for review.

A Seattle Times story this month revealed concern among FAA technical staff that they were not given enough time to do proper oversight of Boeing’s work on the safety analyses during certification of the MAX, and that too much of the analysis was delegated to Boeing employees.

Announcing the special committee Monday, Secretary of Transportation Elaine Chao said, “This review by leading outside experts will help determine if improvements can be made to the FAA aircraft certification process.”

Boeing said in response that the company will work with the special committee “to advance our shared goal of an aviation industry that is safe and trusted by the flying public.”

[calypso]

Obviously there are plenty of malfunctions in any aircraft that require "some" pilot input before 40 seconds. EFATO, TRO, Unreliable airspeed, Autopilot disconnect, TCAS. GPWS, runaway stabiliser .... to name but a few. The premise of the article is flawed in my view.

[Mike Flynn]

Boeing are being quite generous now...
In addition, Boeing will no longer charge airlines that choose an option to place the angle of attack data on the primary flight display.

If they did that from day one we might be in a better place today.

A lot of people died before Boeing decided their optional extra came at a human cost.

[TowerDog]

Boeing are being quite generous now...


If they did that from day one we might be in a better place today.

A lot of people died before Boeing decided their optional extra came at a human cost.

Or people died because the pilots crashing had no idea how to shut of a runaway stab trim system?

[safetypee]

Mike, #2580, et al,


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/432x481/attack_fig12_bcb0ec50419abd2956a9d40802963a3d0bec09ee.jpg

Mark on this instrument the AoA value as reported for the Lion accident; change seats, mark your new instrument similarly.
Which way should you move the stick according to the display - whose display, who holds the stick.
Actually what is required is to hold the stick centrally, against an unexpected and unexplained increasing nose down trim force.
Would these ‘new’ optional displays help with this situation - after what training, for what scenarios. Or are they just another distraction, requiring comprehension by a ‘surprised mind’ already challenged by the need to control the aircraft.

Aero 12 - Angle of Attack (http://www.boeing.com/commercial/aeromagazine/aero_12/attack_story.html#figure12)

P.S. which other flight instrument parameter would be closely associated with AoA. Airspeed, particularly as this scale has an AoA derived low speed awareness cue.
So why would we expect an AoA dial to be positioned nearer the altitude display?

PPS. The EFIS location and dial format might be better used to display pitch trim
position.
An ill-conceived thought, with trim in mind, cf # 2585

[GordonR_Cape]

safetypee

PPS. The EFIS location and dial format might be better used to display pitch trim position.


I asked a question earlier in the thread, but it got lost. Do pilots ever look at the stabiliser trim analog scale on the pedestal during flight (after takeoff)?

You are asking a related question. My followup questions: Is there a digital value of stabiliser trim available on the flight control computers? Is this value used, or is trim driven from arbitrary positions by incremental turns of the jackscrew? Are there any software limits on the jackscrew position?

I may have this story backwards, but have not seen it discussed in relation to MCAS (nor in the Tech Log forum).

[infrequentflyer789]

You are asking a related question. My followup questions: Is there a digital value of stabiliser trim available on the flight control computers?


According to AMM info there certainly was in the NG, specifically "stabilizer position" is shown as an input to the speed trim function. I don't see why it would have been removed, but I guess that is possible.

Whether and how it is used in the MCAS algorithm I don't know - I haven't seen any public info on it, and I don't have access to any non-public info.

[FCeng84]

safetypee



I asked a question earlier in the thread, but it got lost. Do pilots ever look at the stabiliser trim analog scale on the pedestal during flight (after takeoff)?

You are asking a related question. My followup questions: Is there a digital value of stabiliser trim available on the flight control computers? Is this value used, or is trim driven from arbitrary positions by incremental turns of the jackscrew? Are there any software limits on the jackscrew position?

I may have this story backwards, but have not seen it discussed in relation to MCAS (nor in the Tech Log forum).

The only time that stabilizer positioning requires or even benefits from reference to the absolute position of the stabilizer is when on ground, preparing for takeoff. When in air, pilot commanded movement of the stabilizer is completely based on establishing pitch trim such that no column input is needed and the pilot is able to maintain the desired pitch attitude / with the column in its spring centered detent. The cue for the pilot to move the stabilizer when in flight is steady column force needed to balance airplane pitching moments to keep the pitch attitude where it is needed to achieve the desired steady state flight path response. Where the stabilizer ends up to achieve pitch trim is a function of CG, weight, thrust, speed, Mach number, flap position, speedbrake position, gear position, and anything else that might impose a steady pitching moment on the airplane.

There are limits on the stabilizer travel both in the software that is used to provide automatic stabilizer control and in the pilot trim input paths via electric wheel mounted trim switch and manual cranking of the mechanical trim wheel. These are designed to allow for the range of stabilizer positions that are needed to be able to achieve pitch trim throughout the flight envelope including the allowable range of loading and flap/speedbrake/gear configurations.

[SquintyMagoo]

It hasn't been released. It has been shared with the other participants to the investigation, as stipulated by ICAO Annex 13.

It also won't speed up the public release of the data, because only the Ethiopian agency leading the investigation can do that.


Bernd
Can we finally at least expect some leaks of the data?

[golfbananajam]

Flight tests are likely to begin this week on the proposed software fix for Boeing’s 737 MAX flight control system, and the company has invited airlines to order it pending formal approval from the Federal Aviation Administration (FAA).

In my opinion, this should not need to be ordered, it should be a mandatory update SENT by Boeing

[FCeng84]

Salute!

Great article, pat.
The 40 secind scenario appears to be simply allowing the MCAS to act without the crew using the trim switches. Eventually, unless power is reduced, the aero forces on the elevator and the awesome column forces required will not permit a recovery. And who wants to pull power back just after gear up? ( although I did for my LEF episode as I was light and could easily fly at 200 knots - it was the old " doing O.K. now, so don't change anything" procedure that lets you live to be old and grey) I also feel most of the 737 folks here would have used the trim switches for a time before treating the problem as a FUBAR trim system and then turning off the power as the previous flight crew did.

The MCAS mod should be interesting and provide a feast of fodder here on pPrune, huh?

Gums sends...

One of the key elements to the baseline MCAS logic is that it will only put in a single increment of stabilizer motion as long as no pilot trim command is given. This goes in over no more than 10 seconds (less if operating at Mach number greater than 0.4 where MCAS single increment authority is less than 2.5 degrees). The amount of elevator needed to balance one MCAS increment of stabilizer motion will be approximately 5 degrees due to the 2:1 ratio of stabilizer to elevator pitch control power. That amount of elevator can readily be commanded via the column with plenty of additional pitch control authority available to perform any maneuvers needed to maintain desired flight path and speed (if, for instance, climbing with a fixed throttle while varying path to maintain speed). Even in the presence of errant AOA data causing MCAS to activate when actually at AOA well below the intended MCAS activation point, MCAS will not move the stabilizer more than one increment without the crew making a pitch trim input. The only path to compromised pitch control authority via the column is for the crew to make pitch trim inputs but not make sufficient pitch trim inputs to return the stabilizer to the proper trimmed position.

Where this notion of "40 seconds" comes from is a total mystery - particularly when coupled with the statement "... without the crew using the trim switches". The scenario that led to problems after 40 seconds must have included short, ineffective periods of crew pitch trim switch commands that did not establish column force free pitch trim but did enable MCAS to insert another increment of airplane nose down stabilizer.

FCeng84 provides clarity ...

[gums]

Salute1

@FCeng I got the 40 seconds and it is what I posted - 10 ,seconds without pilot trim switch,5 second rest, 10 seconds of trim with no pilot trim, 5 second rest and then 10 seconds trim without pilot trim. That would move the stab well over 5 degrees if stab was trimmed just above zero, but could max it out if trim was zero or more nose down.

One thing all 737 pilots need to understand is this
One of the key elements to the baseline MCAS logic is that it will only put in a single increment of stabilizer motion as long as no pilot trim command is given.

And then tell them that if the trigger event/value is still present that the process repeats.

Those Lion troops did a good job but for treating the problem as an MCAS quirk or STS working backwards as previous crew asserted, or a "runaway trim" that was not continuous. And besides, if they had heard about MCAS, then it was suposed to work making steep turns or slowing way down at cruise altitude or whatever and not be a stall prevention gizmo, and not activating just after flap retraction on takeoff.

Hoping new computer folks at Boeing do a better fault tree analysis this time.

Gums sends...

[GordonR_Cape]

FCeng84

Thanks for your multiple clarifications! I appreciate the fact that my 'dumb' questions elecit enlightening responses.

Something that still puzzles me (I refetred to previously) is the contradiction between making MCAS safe under faulty AOA scenario, and effective under actual high AOA conditions.

1. Under the faulty AOA scenario MCAS activates but is only allowed one trim down increment, after which it is inhibited, with a relatively harmless outcome.
2. Under an actual high AOA condition MCAS will activate, and start to trim nose down. If (for whatever reason) the pilot decided to trim the nose fractionally up, this would inhibit MCAS. Following the new rules MCAS is only allowed to make one nose down operation. If the pilot does nothing further for 5 seconds and the AOA remains high, does the remainder of the nose down cycle complete? Or does it remain where the pilot left it, leaving the aircraft in a degraded condition, potentially falling outside regulatory requirements?
3. If an aircraft encounters two high AOA events in sequence, is MCAS inhibited for the second event? What time interval or event, would allow MCAS to be enabled for a second valid high AOA event activation?

Does any of this make sense, or have the details been worked out, and I am creating imaginary difficulties?

Edit: gums is asking the same kind of question.

Edit: Disabling MCAS if AOA disagree would remove gums fault scenario.

Edit: I see similar questions (and answers) being covered in the Stabiliser Trim thread. Potentially the moderators could move this entire discussion, though it follows closely on from earlier posts.

[gums]

Saute!

Good questions Gordon.

The way FCeng described it on another thread was that the MCAS returns trim to previous/ past position if the trigger event/condition no longer exists after the initial nose down trim command. So you can understand the logic, as the MCAS was only to reduce the nose up pitch moment as AoA approached stall value.

It was obvious with Lion 610 that the abnormal AoA was still present every time the 5 seconds elapsed. And the fact that every time the pilot beeped the trim switch that the uncommanded nose down disappeared.

[added] The sad part of the story is that the same AoA sensor MCAS was using was the one making the stick shake. And it may be that the left/right logic for the flight director and other stuff has a human factor deficiency as well

Gums sends...

[GarageYears]

One of the key elements to the baseline MCAS logic is that it will only put in a single increment of stabilizer motion as long as no pilot trim command is given. This goes in over no more than 10 seconds (less if operating at Mach number greater than 0.4 where MCAS single increment authority is less than 2.5 degrees). The amount of elevator needed to balance one MCAS increment of stabilizer motion will be approximately 5 degrees due to the 2:1 ratio of stabilizer to elevator pitch control power. That amount of elevator can readily be commanded via the column with plenty of additional pitch control authority available to perform any maneuvers needed to maintain desired flight path and speed (if, for instance, climbing with a fixed throttle while varying path to maintain speed). Even in the presence of errant AOA data causing MCAS to activate when actually at AOA well below the intended MCAS activation point, MCAS will not move the stabilizer more than one increment without the crew making a pitch trim input. The only path to compromised pitch control authority via the column is for the crew to make pitch trim inputs but not make sufficient pitch trim inputs to return the stabilizer to the proper trimmed position.

Where this notion of "40 seconds" comes from is a total mystery - particularly when coupled with the statement "... without the crew using the trim switches". The scenario that led to problems after 40 seconds must have included short, ineffective periods of crew pitch trim switch commands that did not establish column force free pitch trim but did enable MCAS to insert another increment of airplane nose down stabilizer.

FCeng84 provides clarity ...

Request for clarification:

Do I understand this correctly?

If MCAS detects an AOA that satisfies whatever criteria is needed, it activates 10 seconds (or less, depending on Mach number) of nose down trim for a maximum of 2.5 degrees nose down trim and stops.

If NO pilot trim input is commanded, MCAS remains disabled?

Thanks, GY

[hawk76]

FCeng84 provides clarity ...

Thank goodness. But there still appears to be confusion.


One thing all 737 pilots need to understand is this


One of the key elements to the baseline MCAS logic is that it will only put in a single increment of stabilizer motion as long as no pilot trim command is given.


And then tell them that if the trigger event/value is still present that the process repeats.

FCeng84 and other sources I've read over the course of this and the Lion Air thread seem to say this is not true. In the existing MCAS, there is only a single 10s (or less) nose-down trim provided, even if the trigger event/value is still present, unless the pilot makes a pitch trim input. This resets the MCAS state, resulting in a 5 second delay, followed by more nose-down trim if the condition is still met. If no pitch trim inputs are made, MCAS will not trim further down (but may restore trim). I can understand the logic to reset the MCAS state, because it can no longer make a trim/AOA association once the pilot changes the trim.

Is there a reference for what gums says?


Those Lion troops did a good job but for treating the problem as an MCAS quirk or STS working backwards as previous crew asserted, or a "runaway trim" that was not continuous. And besides, if they had heard about MCAS, then it was suposed to work making steep turns or slowing way down at cruise altitude or whatever and not be a stall prevention gizmo, and not activating just after flap retraction on takeoff.

Hoping new computer folks at Boeing do a better fault tree analysis this time.

Gums sends...

I can understand cirticism of an MCAS that should be more fault-tolerant and pilot-tolerant, and apparently that is what Boeing is designing and documenting. This has been said before, but it appears the engineers didn't consider that the pilot may make pitch trim changes that do not put the h stab into a proper position, and that the resulting state reset then could have bad consequences if the pilot hadn't already turned stab trim off.

I was happy to see data early and often from Lion 610. Having an open, informed discussion of what happened is the best way to improve safety. I hope to see this soon for ET302.

[Vilters]

Sometimes it is very good to go back to basics. => I have read the lot, and the focus is on the wrong point

IF, and I say ; "IF" , no AOA sensor had failed, not a soul would have heard about what the MCAS was / is / is going to do.

All these events start 'or are triggered by" failing AOA sensors. => And naturally the single probe problem MCAS surfaces, and then what MCAS is trying surfaces, but it all starts with the failing AOA SENSOR/system.
The MAIN FOCUS should be on WHY the AOA probe/system fails.

[lomapaseo]

Can we finally at least expect some leaks of the data?

depends

Who has the most to gain?

[gums]

Salute!

Good questions, Hawk.

The Lion 610 data clearly shows the MCAS reset and then the 5 second delay. All the while the AoA from the pilot sensor is up at 20 degrees or so from the other side. You can also see the flap position logic in action. So the MCAS worked as designed, but had FUBAR AoA data. I would love to see MCAS act in an approach to stall in a banked turn where the pilot could simply relax back pressure and the AoA would go down. Then see what MCAS does.

Without a data table to check the traces second by second, it is hard to tll if MCAS re-trimmed back to what is was when it first trimmed or that the pilot commanded a whole lotta nose up trim. From the plot, looks like he trimmed up a lo, but all the way back to the original stab angle. Right at the end you can see that the FO did not rettrim as much, so I am questioning the complete reset

Gums sends...

[VicMel]

The MX in CGK didn't suspect the newly replaced vane to be the caused.https://i.ibb.co/KNShp0C/combo1c.png (https://ibb.co/4s3tnmB)
https://i.ibb.co/TMBp6y3/combo2z.png (https://imgbb.com/)
https://i.ibb.co/NWQZGy7/fourthp.png (https://imgbb.com/)
This multiple and varied mix of fault reports (all ADIRU related) suggests the problems are nothing to do with a faulty AoA sensor, but a problem within the ADIRU. Perhaps something like a erratic reference voltage to the A to D converter affecting several channels. The AoA sensor was replaced possibly just as a hopeful guess. The assumption then seems to have been jumped on that as the MCAS uses AoA, the errant behaviour of MCAS must have been due to an AoA fault. Possibly the ADIRU fault is 'confusing' the MCAS; perhaps it cannot handle AoA values that are all over the place and gets trapped in a logic loop. Can I ask a question of the many experts on this forum, are the ADIRUs, the displays and MCAS (FCCs) all on the same ARINC bus?

[deltafox44]

A 737 MAX on ferry just had an emergency landing (though has no relation with the crashes, being an engine problem)
https://edition.cnn.com/2019/03/26/us/boeing-737-max-emergency-landing/index.html

[BobM2]

The AoA sensor was replaced possibly just as a hopeful guess. The assumption then seems to have been jumped on that as the MCAS uses AoA, the errant behaviour of MCAS must have been due to an AoA fault.
Nobody knew MCAS even existed. It & the need to use trim cutout to correct "STS running Backward" was not ever written up.

[ironbutt57]

nice to go into the simulator well prepped on what's happening reminds me of the sims they conducted to see if Sully could have made it back to the airport..startle factor missing, 40 seconds long gone..

[tfx]

I was thinking Boeing and the FAA had been a bit slack here, but I am starting to change my mind. Clean stall, the back stick is supposed to increase all the way to the break. It doesn't in this airplane apparently because of nacelle lift. So they put a mouse in the system to drive the stab L.E. up at Vs plus a few knots to start to fly the airplane nose down so we have to pull that little bit harder. Fine. All this at low speeds - stick forces light and any runaway a non-event. Also they put it the FTM.

Now we have a situation where a dozy alpha vane sends spurious information to the mouse when hand flying it clean at say 240 knots. The airplane tends nose down in response, the pilot holds attitude in the normal fashion and trims the load out with the pickle switches. Back where we started. Five seconds later it does it again. At some stage the flying pilot or the support pilot or both are going to notice the trim wheel is running while the pilot is not trimming and follow the drill. Oppose the runaway, stop the wheel, and / or operate the stab trim cut-outs. (Is that right? - it is many years since I have been in a 737)

I don't see how it got away from them. There has to be more to it. I gather in both cases the stab trim jack has been found full scale stabilizer nose up. Unfortunately post-crash mechanical evidence is rarely relevant because everything changes during the break-up.

Be that as it may, we have two brand new, on the evidence to date perfectly flyable airplanes planted face first into the planet in broad daylight.

Either there is something the matter with the way Boeing and the FAA are doing things, or there is something the matter out here in the rest of the world. Something serious. MCL for instance raises it's hand immediately. Simulators are great training tools but you can't get hurt in one and those basic piloting defensive thought processes don't grow. The FAA is right to call for 1500 hours pre requisite for getting into an airliner cockpit. The rest of the world must follow that lead. We are going to have to toughen up. It has been made too easy. It is an airplane, not a sago pudding. It is not just a computer game, although many are selling that line. High time, I think for the regulators and operators world-wide to have a hard look at the way they are going about things.

It is them going to get the midnight phone calls.

[FCeng84]

Several people have asked MCAS clarification questions in response to some of my recent posts. Rather than respond to them individually I offer the following as hopeful a fairly comprehensive description of the MCAS system that has been in the 737MAX fleet to date. Note that this does not reflect any of the changes about to be released. Hopefully Boeing will provide clear detail of those soon.

As always, if you still have questions after reading and trying to absorb the following please ask.

1. MCAS was designed to command airplane nose down stabilizer in response to high AOA up to an authority limit of 2.5 degrees for Mach less than 0.4 with lower authority at higher Mach numbers. If the pilot does not make any pitch trim commands, once AOA goes low MCAS will run the stabilizer in the airplane nose up direction back to the location from which it started.

2. MCAS is activated when all of the following are true:
a. Flaps are up
b. Autopilot is not engaged
c. Sensed AOA is above the MCAS activation AOA threshold

3. Once activated, MCAS will not command more than one increment of airplane nose down stabilizer motion until it has been reset. MCAS will be reset by either:
a. Pilot pitch trim command followed by a period of 5 consecutive seconds with no pilot pitch trim command.
- The assumption is made that pilot activation of pitch trim will be closely followed by continued pilot use of pitch trim to return the airplane to a column neutral pitch trim condition. MCAS seeing no further pilot pitch trim for a period of 5 seconds is interpreted as indication that the pilot has achieved column neutral pitch trim.
b. Return (by MCAS) of the stabilizer to its starting position per (1) above.
- Having returned the stabilizer to its pre-MCAS event starting point it is assumed that the airplane is back to a column neutral pitch trim condition.

4. Pilot pitch trim input at any time during the MCAS sequence as described in (1) above will stop MCAS stabilizer motion and end the current MCAS event while immediately moving the stabilizer in the direction of the pilot command.
a. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose down, that motion will stop and the stabilizer will immediately move in the direction of the pilot command.
b. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose up, that motion will stop and the stabilizer will move in the direction of the pilot command.
c. If pilot pitch trim input is issued after MCAS has completed its airplane nose down motion but prior to MCAS acting to take that motion out (as a result of return to low AOA), the stabilizer will immediately move in the direction of the pilot command.
d. It is assumed that the pilot issuing a pitch trim command is indication that the pilot is taking over the pitch trim task and will return the airplane to a column neutral pitch trim condition.


As a result of 1 through 4 above, given an AOA sensor that is failed so as to give an erroneously high reading (similar to what data appears to indicate occurred during the Lion Air accident flight), the following MCAS related scenarios can occur:

A. MCAS will activate (if flying manually) as soon as the flaps are retracted to up. Note that the stick shaker will have activated as soon as the airplane lifted off the ground regardless of the takeoff flap setting.

B. If the pilot does not make any pitch trim inputs, MCAS will run the stabilizer airplane nose down for one MCAS increment (as much as 2.5 degrees over approximately 10 seconds if Mach is less than 0.4). Without pilot pitch trim input, MCAS will not command further stabilizer motion in either direction. There is plenty of pitch control authority via the elevator using the column to counter the pitch disturbance generated by one MCAS increment of stabilizer motion.

C. If during or after the MCAS stabilizer motion per (A) above the pilot gives a pitch trim command the stabilizer will immediately start moving in the direction of the pilot command.
a. If the pilot pitch trim commands drive that stabilizer back to a column neutral pitch trim condition then the airplane will be back where it started from. In this event, provided sensed AOA is still high, MCAS will activate again once it sees a period of 5 seconds with not pilot pitch trim input. This process will repeat itself with the stabilizer never getting further than one MCAS increment out of trim. It appears that this sequence was repeated 20 or more times by the Lion Air accident flight pilot before he handed control over to his first officer.
b. If the pilot pitch trim commands are activated, but do not drive the stabilizer back to a column neutral pitch trim condition it is possible that successive activation of MCAS triggered by high AOA signal and ineffective pilot pitch trim inputs will lead to the stabilizer moving progressively further in the airplane nose down direction. It appears that this is what took place on the Lion Air accident airplane once the first officer took over control.


As for the reference in media reports this week regarding the crew’s need to intervene within 40 seconds of errant MCAS response to an AOA signal failed high, the following sequence of events would have to occur to so compromise pitch control power in that amount of time:
(a) The flight crew would have to allow a full increment of MCAS airplane nose down stabilizer motion to go in over 10 seconds without interrupting that motion via pilot pitch trim input.
(b) The flight crew would then have to have made a very short pitch trim command that triggered MCAS to reset, but did not re-establish anywhere near a column neutral pitch trim condition.
(c) After a 5 second pause wherein MCAS inferred that no more pilot pitch trim indicated the airplane was back to column neutral pitch trim, the flight crew would have to allow a second full increment of MCAS airplane nose down stabilizer motion to be inserted over another period of 10 seconds. Once again the crew would have to allow this stabilizer motion to go in without interruption via pilot pitch trim command.
(d) Once again, there would have be a repeat of (b) with a short, ineffective pilot pitch trim command.
(e) The final 10 seconds of this proposed 40 second sequence would be allowing another errant MCAS airplane nose down stabilizer motion increment to go in without interruption by pilot pitch trim command.

To summarize, getting in trouble over the course of just 40 seconds requires the crew to not trim when then should and make two very short, ineffective trim inputs following each of the first two MCAS stabilizer motion increments. This represents a worst case scenario.

[Wodrick]

I want to but can't read that, never heard of paragraphs ? or spacing sentences so it becomes legible ?

[gums]

Salute!
BobM2

The STS running backwards was from a photo or copy of an entry by the previous Lion crew. It was early in the Lion crash threads. And the lack of entering the shaker on the normal log or squawk book is obvious. And nothing about turning off power to the trim motor? Hmmmm....

What at would YOU do if you knew the previous flight had the shaker going on and manual trim was required because they had turned of trim motor power?

Gums asks...

[meleagertoo]

I was thinking Boeing and the FAA had been a bit slack here, but I am starting to change my mind. Clean stall, the back stick is supposed to increase all the way to the break. It doesn't in this airplane apparently because of nacelle lift. So they put a mouse in the system to drive the stab L.E. up at Vs plus a few knots to start to fly the airplane nose down so we have to pull that little bit harder. Fine. All this at low speeds - stick forces light and any runaway a non-event. Also they put it the FTM.

Now we have a situation where a dozy alpha vane sends spurious information to the mouse when hand flying it clean at say 240 knots. The airplane tends nose down in response, the pilot holds attitude in the normal fashion and trims the load out with the pickle switches. Back where we started. Five seconds later it does it again. At some stage the flying pilot or the support pilot or both are going to notice the trim wheel is running while the pilot is not trimming and follow the drill. Oppose the runaway, stop the wheel, and / or operate the stab trim cut-outs. (Is that right? - it is many years since I have been in a 737)

I don't see how it got away from them. There has to be more to it. I gather in both cases the stab trim jack has been found full scale stabilizer nose up. Unfortunately post-crash mechanical evidence is rarely relevant because everything changes during the break-up.

Be that as it may, we have two brand new, on the evidence to date perfectly flyable airplanes planted face first into the planet in broad daylight.

Either there is something the matter with the way Boeing and the FAA are doing things, or there is something the matter out here in the rest of the world. Something serious. MCL for instance raises it's hand immediately. Simulators are great training tools but you can't get hurt in one and those basic piloting defensive thought processes don't grow. The FAA is right to call for 1500 hours pre requisite for getting into an airliner cockpit. The rest of the world must follow that lead. We are going to have to toughen up. It has been made too easy. It is an airplane, not a sago pudding. It is not just a computer game, although many are selling that line. High time, I think for the regulators and operators world-wide to have a hard look at the way they are going about things.

It is them going to get the midnight phone calls.
I rather agree with you TFX, a previous LionAir crew recognised the root-cause of their problem and selected STAB TRIM CUTOFF switches to CUTOFF so the problem is far from dififcult to identify. Indeed they later took several other NNC measures that seem, on the face of it, to be rational and sensible. Thus they identified the threat, if not the cause which in this case is largely irrelevent. But what scares the crap out of me they soon selected the electric trim back on! That isn't the way of a professional crew. They soon selected it back off again, thank God, when the trim runaway re-occurred but then inexplicably continued the flight in manual control(no a/p) and manual trim with the stick shaker running continuously! These are fundamental aberrations of simply unbelieveable proportion in an ATPL and something no normal Professional pilot would consider doing for a moment. Lion Air's crew attitude and operating standards must surely take a massive hit from these shocking errors. It isn't good enough to hide behind the company's shameful, disgraceful shoulder-sloping repetition of the wet excuse that "nowhere in these checks did they say to land at the nearest suitable airport." As if an ATPL needs to be told that! That is a disgraceful way for a company with sloppy procedures to try to shift blame onto an implied fault in Boeing's manuals and demonstrates a company culture of either blissful unawareness or wilful disregard of normal Professional procedures, airm*****ip (Oh bugger! I nearly swore again!) I mean cheesy excuses for blind unthinking magenta-line following and no apparent command presence at all.

One has to wonder whether LionAir should have been let off the EU banned list so soon...

Boeing may have made errors in their systems design but the more I read the more I see how appallingly badly LionAir crews (and maintenance?) mishandled the accident flight and those that preceeded it whilst having all the means at hand to prevent the disaster.

The Ethiopan report, should it be open and transparent, will go a long way to corroborate or refute these remarks but I'm not holding my breath on either count.

[Organfreak]

Note that this does not reflect any of the changes about to be released. Hopefully Boeing will provide clear detail of those soon.

I bet they WILL!
:)

[ktcanuck]

I rather agree with you TFX, a previous LionAir crew recognised the root-cause of their problem and selected STAB TRIM CUTOFF switches to CUTOFF so the problem is far from dififcult to identify. Indeed they later took several other NNC measures that seem, on the face of it, to be rational and sensible. Thus they identified the threat, if not the cause which in this case is largely irrelevent. But what scares the crap out of me they soon selected the electric trim back on! That isn't the way of a professional crew. They soon selected it back off again, thank God, when the trim runaway re-occurred but then inexplicably continued the flight in manual control(no a/p) and manual trim with the stick shaker running continuously! These are fundamental aberrations of simply unbelieveable proportion and something no normal Professional pilot would consider doing for a moment. Lion Air's crew attitude and operating standards must surely take a massive hit from these appalling errors. It isn't good enough to hide behind thecompany's shameful, disgraceful shoulder-sloping repetition of the wet excuse that "nowhere in these checks did they say to land at the nearest suitable airport." That is an utterlt disgraceful way for a company with sloppy procedures to try to shift blame onto Boeing's manuals and thus demonstrates a company culture of blissful unawareness of normal Professional procedures, airm*****ip (Oh bugger! I nearly swore again!) I mean cheesy excuses for blind unthinking magenta-line following and no apparent command presence at all.

One has to wonder whether LionAir should have been let off the EU banned list so soon...

Boeing may have made errors in their systems design but the more I read the more I see how appallingly badly LionAir crews mishandled the accident flight and those that preceeded it whilst having all the means at hand to prevent the disaster.
Your point is not lost. But I am drawn to the testimony given by an American (nationality, not airline) Max crew who, on their first flight, found that they did not understand the meaning of certain unique indications provided by the Max but flew anyway whilst they tried to find out what they meant from their company. That doesn't seem like solid airman-ship either to me.

[BobM2]

Salute!
BobM2

The STS running backwards was from a photo or copy of an entry by the previous Lion crew. It was early in the Lion crash threads. And the lack of entering the shaker on the normal log or squawk book is obvious. And nothing about turning off power to the trim motor? Hmmmm....

What at would YOU do if you knew the previous flight had the shaker going on and manual trim was required because they had turned of trim motor power?

Gums asks...

The first question should be "what would maintenance have done?". Hopefully more than just resetting breakers & cleaning cannon plugs. Of course the airplane had been flying revenue trips for 3 days in an unairworthy condition with capt "unreliable airspeed & altitude". Were they flying that way in RVSM airspace? Maintenance that was done had only made it much more unairworthy with continuous stick shaker & "sts running backwards", but "just press on". Do they not get paid if they cancel a trip or was it a hot date waiting in Jakarta? Indonesia has one of the worst safety records & from the operation of this "airline" I can see why. Do they carry maintenance discrepancies to the next D-check in 20,000 hrs? Of course, it's easy to blame Boeing for not selling them an airplane that can fly safely with mounting unairworthy discrepancies for an indefinite time. Three days is not nearly enough.
What would I have done? On my airline, I would have sat comfortably in the crew room while someone more qualified made a maintenance test flight, since these write-ups involved serious control issues.

[airman1900]

Aviation Week Network: Boeing’s 767 Tankers Also Use Augmented Pitch System KC-46, March 25, 2019

Boeing’s 767 Tankers Also Use Augmented Pitch System KC-46, March 25, 2019

Steve Trimble | Aerospace Daily & Defense Report

Boeing’s 767-based tankers use a version of the pitch augmentation system that grounded the 737 Max 8 fleet, the manufacturer and U.S. Air Force officials say.

The disclosure provides a new data point in the unfolding story of how Boeing installed the Maneuvering Characteristics Augmentation System (MCAS) on the narrowbody airliner fleet.

Both the KC-767 and KC-46 fleets delivered to air forces in Italy, Japan and the U.S. rely on the MCAS to adjust for pitch trim changes during refueling operations.

In the 1980s, Boeing’s engineers considered using a pitch augmentation system for the commercial version of the 767, but dropped the idea after finding that vortex generators provided adequate control.

By 2011, Boeing had already delivered KC-767s to Italy and Japan fitted with the first version of MCAS. The use of the system then spread as Boeing won the Air Force’s KC-46 contract in February and launched the 737 Max 8 in August.

But Boeing designed the integration on the KC-767 and KC-46 slightly differently than on the 737 Max family.

The single-aisle airliner uses one angle of attack vane — either the captain’s or first officer’s — to generate the data used by the flight computer to activate the MCAS.

By comparison, the KC-767 and KC-46 are designed to use two sensor inputs to feed angle of attack data, Boeing says.

Boeing spokesmen declined to elaborate on which sensor inputs are used to provide the data in the tanker design. The options include multiple angle of attack vanes and flush-mounted static ports.

How the MCAS functions has come under the microscope since the March 10 crash of a 737-8 on Ethiopian Flight 302. It was preceded by a Lion Air 737-8 crash in October after an abrupt dive. Preliminary findings released by Indonesian investigators linked the Lion Air crash to erroneous data provided by angle of attack sensors. An Ethiopian airline official said preliminary information about the Ethiopian crash revealed similar control problems.

The U.S. Air Force has launched a review of flight procedures for the KC-46, a spokeswoman says.

'The USAF does not fly the models of aircraft involved in the recent accidents, but we are taking this opportunity to exercise due diligence by reviewing our procedures and training as part of our normal and ongoing review process,' she says.

[Rated De]

The first question should be "what would maintenance have done?". Hopefully more than just resetting breakers & cleaning cannon plugs. Of course the airplane had been flying revenue trips for 3 days in an unairworthy condition with capt "unreliable airspeed & altitude". Were they flying that way in RVSM airspace? Maintenance that was done had only made it much more unairworthy with continuous stick shaker & "sts running backwards", but "just press on". Do they not get paid if they cancel a trip or was it a hot date waiting in Jakarta? Indonesia has one of the worst safety records & from the operation of this "airline" I can see why. Do they carry maintenance discrepancies to the next D-check in 20,000 hrs? Of course, it's easy to blame Boeing for not selling them an airplane that can fly safely with mounting unairworthy discrepancies for an indefinite time. Three days is not nearly enough.
What would I have done? On my airline, I would have sat comfortably in the crew room while someone more qualified made a maintenance test flight, since these write-ups involved serious control issues.

In many regulatory regimes, airlines can and will cancel flights and compensation to the crew, probably half way through a working day!
A commercial decision impacts pilots. Who could have ever thought that pilots would feel obligated to continue, haggle for make-up flying and probably also stress on the financial impact said cancellations create?

A mainline carrier in Australia has a very low minimum contract, paying the pilots for extra flying, that at whim is cancelled. Effectively remuneration can vary for roster to roster.
With personal debt levels very high, makes for a commercially compliant workforce.
Naturally the regulator in Australia sees zero conflict with such a strategy. The chairman likely a member of the invite only, Chairman's lounge.

Revolving doors between regulator and industry.
Regulatory capture.
Normalisation of deviance.

The 737 MAX a symptom of the place these roads lead.

[Water pilot]

Boeing spokesmen declined to elaborate on which sensor inputs are used to provide the data in the tanker design
Did they tell the pilots?

This one statement shows what is wrong right now at Boeing. You can unintentionally kill more people with an airplane than almost any other technological device. Playing "need to know" games so that you can sell products into applications for which they may not be perfectly suited is unacceptable when so many lives are at stake. What possible harm comes from telling the journalist what they want to know? If the military system also relies on a single sensor, we should know that even if it is uncomfortable for Boeing. "We screwed up and we are going to fix it" is a perfectly acceptable engineering response to a problem, even if you get punished in the short term by the stock market.

[GordonR_Cape]

Water pilot

The article seems clear that the military B767 variants use two AOA inputs for MCAS, while the passenger B737 MAX only uses one.

[patplan]

It appears Boeing 737 Max 8, B38M, will get a much longer rest in China...
..China suspends airworthiness certificate for Boeing 737 Max jet

China suspended a so-called airworthiness certificate for Boeing Co's 737 Max jet, saying it needs to review a proposed modification before determining whether the plane is safe to fly after two recent crashes (https://www.straitstimes.com/world/fix-to-737-max-anti-stall-software-is-ready-sources).

The move raises the possibility of the Max being kept out of China's skies should authorities there deem a fix for software linked to the disasters inadequate.

The decision was taken in light of uncertainty surrounding the model and an anti-stall system that's the focus of a probe into the loss of an Ethiopian Airlines plane on March 10 (https://www.straitstimes.com/world/pilot-on-ethiopian-airlines-flight-wasnt-trained-on-737-max-8-simulator), according to the Civil Aviation Administration of China.

It will be reviewed once Boeing has detailed the changes, the body said...---------
.
China not taking Boeing 737 MAX 8 airworthiness certificate applications

China’s civil aviation regulator has stopped taking applications for Boeing’s 737 Max 8 airworthiness certification since March 21, an official at the regulator’s news department said on Tuesday.

China was the first to ground the newest version of Boeing’s workhorse 737 model earlier this month following a deadly Ethiopian Airlines crash, prompting a series of regulatory actions by other governments worldwide....

Earlier on Tuesday, financial magazine Caijing reported that the Civil Aviation Administration of China (CAAC) had suspended certification for Boeing 737 MAX 8 aircraft, citing an internal document issued on March 21....

It took Boeing 15 months to get the airworthiness certification for the aircraft from CAAC, which it obtained in October 2017, Caijing said, citing industry insiders.

Boeing did not immediately respond to a Reuters request for comment.===========





Sources:
- https://www.straitstimes.com/asia/east-asia/china-suspends-airworthiness-certificate-for-boeing-737-max-jet
- https://in.reuters.com/article/ethiopia-airplane-china-idINKCN1R71CN

[concernedengineer]

Please indulge my adding a few comments. Today’s commercial aviation has embraced use of automation to enable optimization for performance. This has led to configurations that do not have certifiable handling characteristics without at least a minimum level of computer augmentation. On these airplanes there is no way for pilots to select complete manual. The higher level automation provided for workload relief can be turned off but not the lowest level of automation required to provide acceptable handling qualities.
I am glad to see this topic being broached. The present incident has in common with other LOC incidents the feature that the crew is faced with an all of nothing situation. Continue to rely on automation which may exacerbate a bad situation, or choosing to go manual which may be a time consuming and unfamiliar transition in a situation where time is of the essence. This is akin (worse) that a car driver having to disable power steering and brakes because of a malfunctioning cruise control. Surely there should be a lower level of automation the pilot could revert to but still giving him/her power assistance with the control surfaces, and some degree of automatic recovery, while bypassing higher level problems. This lower level should involve only the most basic, reliable components. Does Airbus do this already?

[Smythe]

The AoA measurement vane with the calibration and usefulness, is not a science but an art. To rely on the AoA measurement, especially on a DEP climb (forget if there is a turn) to be able to determine if the ac is near stall is simply voodoo engineering.

Some enlightened reading would be on the calibration, latency, and overall algorithms created to try to make some use of the readings. The AOA readings must be coupled with airspeed, weight, flaps settings, and winds aloft.

Front landing gear doors open, sideslip, vertical winds, and of course, banked turns...all render the readings useless without an algorithm.

Last algorithm went from 0.5 degrees to 2.5 degrees to make it work....and we see how that went.

Add yet another algorithm that they 'think' might work. (but didnt they already do that?)

[edmundronald]

I think someone mentioned that if the runaway trim wasn't dealt with within 40 seconds then there was basically no way back. Is this correct? It may not explain why the crews let the problem get away from them, but it would explain why perfectly capable aircraft flew into the ground or water.

Edmund

[ferry pilot]

Here is a thought perhaps worth repeating. A while back, pilots had the idea they were the last link in the safety chain, and someone else’s accident was a gift you could not turn away from, especially if it was fairly recent and an airplane you were flying. You only had to ask yourself two questions. First, what can I do to keep that from happening to me, and second, what else can I do to keep that from happening to me? There is more to it no doubt, as we will see when the facts are all out.

[wheelsright]

The AoA measurement vane with the calibration and usefulness, is not a science but an art. To rely on the AoA measurement, especially on a DEP climb (forget if there is a turn) to be able to determine if the ac is near stall is simply voodoo engineering.

Some enlightened reading would be on the calibration, latency, and overall algorithms created to try to make some use of the readings. The AOA readings must be coupled with airspeed, weight, flaps settings, and winds aloft.

Front landing gear doors open, sideslip, vertical winds, and of course, banked turns...all render the readings useless without an algorithm.

Last algorithm went from 0.5 degrees to 2.5 degrees to make it work....and we see how that went.

Add yet another algorithm that they 'think' might work. (but didnt they already do that?)

I think that you are nearer the mark than most other posts. I am still seeing posts that A/P should be engaged to overcome trim runaway (contrary to Boeing revised OP). Currently, all there is to go on is the Lion Air FDR. However, there are material differences between the "previous flight" and the doomed flight data. It would appear that issues are far more complicated than it may first appear. At the heart of the issues are the algorithms that process the AoA and computed air speed. The doomed flight had stick shaker on take-off rotation unlike the previous flight (stick shaker started at an altitude about 400ft). The published data does not include all the parameters available.

It is not known how the MCAS system actually works. Obviously, somebody at Boeing knows precisely how it works, but they are not going to be posting on PPRUNE any time soon. The real info will be supplied by depositions. The contributions here, are educated guesses based on the limited information available. Even so, it seems that the Preliminary Report into Lion Air may have been too casual about the potential risks. Boeing may have been to casual about the risks. There are some obvious defects in the MCAS system, even from the scant information available. Those defects may be complicated or exacerbated by the changes to the aircraft's flight characteristics in the MAX design. In short, Boeing will have a lot of explaining to do to restore confidence.

[GordonR_Cape]

The AoA measurement vane with the calibration and usefulness, is not a science but an art. To rely on the AoA measurement, especially on a DEP climb (forget if there is a turn) to be able to determine if the ac is near stall is simply voodoo engineering.

Some enlightened reading would be on the calibration, latency, and overall algorithms created to try to make some use of the readings. The AOA readings must be coupled with airspeed, weight, flaps settings, and winds aloft.

Front landing gear doors open, sideslip, vertical winds, and of course, banked turns...all render the readings useless without an algorithm.

An article (previously linked) by Peter Lemme describes some of the uncertainties around AOA measurement, which are particularly relevant to this discussion: https://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html

[Capn Bloggs]

Front landing gear doors open, sideslip, vertical winds, and of course, banked turns...all render the readings useless without an algorithm.
Vertical winds?? Banked turns?? I suggest they would have no practical bearing on the AOA. If the aeroplane is balanced in a turn, I'd reckon the airflow around both sides of the nose would be, for all intents and purposes, exactly the same. As for "vertical winds", that's all AOA is; anybody who's flown these types of aeroplanes would notice the stick shaker zipper bouncing up and down in turbulence when you're slow, but to say they are "useless without algorithms" is going a bit overboard.

[KRUSTY 34]

Water pilot

The article seems clear that the military B767 variants use two AOA inputs for MCAS, while the passenger B737 MAX only uses one.

Well, that makes sense!

[Volume]

The AoA measurement vane with the calibration and usefulness, is not a science but an art. To rely on the AoA measurement, especially on a DEP climb (forget if there is a turn) to be able to determine if the ac is near stall is simply voodoo engineering.
I agree that it is an art, but not as much as to find the perfect location for static pressure sensors and to calibrate those. Luckily we have some "artists" around who understand this type of engineering, and of course these days with all the computers you can "photoshop" any picture of an artist after painting is complete, i.e. you can postprocess the measured value in the air data computers. It is absolutely possible to install a perfectly working AoA System on any aircraft which has no propeller at the nose of the fuselage. It is not easy, it might actually be rocket science, but we have the experience to do it. Nobody is interested in absolute AoA values, we just need to have a value which we can compare with critical AoA figures determined during test flight. As long as we know the indicated stall AoA, we can work with the AoA indication perfectly.
This sometimes means compromising, I for example wonder who decided to put the AoA vane on the dreamliner that close to the #1 door, just asking for the airstair operator to accidentially damage it...

[Ferpe]

Several people have asked MCAS clarification questions in response to some of my recent posts. Rather than respond to them individually I offer the following as hopeful a fairly comprehensive description of the MCAS system that has been in the 737MAX fleet to date. Note that this does not reflect any of the changes about to be released. Hopefully Boeing will provide clear detail of those soon.

As always, if you still have questions after reading and trying to absorb the following please ask.

1. MCAS was designed to command airplane nose down stabilizer in response to high AOA up to an authority limit of 2.5 degrees for Mach less than 0.4 with lower authority at higher Mach numbers. If the pilot does not make any pitch trim commands, once AOA goes low MCAS will run the stabilizer in the airplane nose up direction back to the location from which it started.

2. MCAS is activated when all of the following are true:
a. Flaps are up
b. Autopilot is not engaged
c. Sensed AOA is above the MCAS activation AOA threshold

3. Once activated, MCAS will not command more than one increment of airplane nose down stabilizer motion until it has been reset. MCAS will be reset by either:
a. Pilot pitch trim command followed by a period of 5 consecutive seconds with no pilot pitch trim command.
- The assumption is made that pilot activation of pitch trim will be closely followed by continued pilot use of pitch trim to return the airplane to a column neutral pitch trim condition. MCAS seeing no further pilot pitch trim for a period of 5 seconds is interpreted as indication that the pilot has achieved column neutral pitch trim.
b. Return (by MCAS) of the stabilizer to its starting position per (1) above.
- Having returned the stabilizer to its pre-MCAS event starting point it is assumed that the airplane is back to a column neutral pitch trim condition.

4. Pilot pitch trim input at any time during the MCAS sequence as described in (1) above will stop MCAS stabilizer motion and end the current MCAS event while immediately moving the stabilizer in the direction of the pilot command.
a. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose down, that motion will stop and the stabilizer will immediately move in the direction of the pilot command.
b. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose up, that motion will stop and the stabilizer will move in the direction of the pilot command.
c. If pilot pitch trim input is issued after MCAS has completed its airplane nose down motion but prior to MCAS acting to take that motion out (as a result of return to low AOA), the stabilizer will immediately move in the direction of the pilot command.
d. It is assumed that the pilot issuing a pitch trim command is indication that the pilot is taking over the pitch trim task and will return the airplane to a column neutral pitch trim condition.


As a result of 1 through 4 above, given an AOA sensor that is failed so as to give an erroneously high reading (similar to what data appears to indicate occurred during the Lion Air accident flight), the following MCAS related scenarios can occur:

A. MCAS will activate (if flying manually) as soon as the flaps are retracted to up. Note that the stick shaker will have activated as soon as the airplane lifted off the ground regardless of the takeoff flap setting.

B. If the pilot does not make any pitch trim inputs, MCAS will run the stabilizer airplane nose down for one MCAS increment (as much as 2.5 degrees over approximately 10 seconds if Mach is less than 0.4). Without pilot pitch trim input, MCAS will not command further stabilizer motion in either direction. There is plenty of pitch control authority via the elevator using the column to counter the pitch disturbance generated by one MCAS increment of stabilizer motion.

C. If during or after the MCAS stabilizer motion per (A) above the pilot gives a pitch trim command the stabilizer will immediately start moving in the direction of the pilot command.
a. If the pilot pitch trim commands drive that stabilizer back to a column neutral pitch trim condition then the airplane will be back where it started from. In this event, provided sensed AOA is still high, MCAS will activate again once it sees a period of 5 seconds with not pilot pitch trim input. This process will repeat itself with the stabilizer never getting further than one MCAS increment out of trim. It appears that this sequence was repeated 20 or more times by the Lion Air accident flight pilot before he handed control over to his first officer.
b. If the pilot pitch trim commands are activated, but do not drive the stabilizer back to a column neutral pitch trim condition it is possible that successive activation of MCAS triggered by high AOA signal and ineffective pilot pitch trim inputs will lead to the stabilizer moving progressively further in the airplane nose down direction. It appears that this is what took place on the Lion Air accident airplane once the first officer took over control.


As for the reference in media reports this week regarding the crew’s need to intervene within 40 seconds of errant MCAS response to an AOA signal failed high, the following sequence of events would have to occur to so compromise pitch control power in that amount of time:
(a) The flight crew would have to allow a full increment of MCAS airplane nose down stabilizer motion to go in over 10 seconds without interrupting that motion via pilot pitch trim input.
(b) The flight crew would then have to have made a very short pitch trim command that triggered MCAS to reset,We but did not re-establish anywhere near a column neutral pitch trim condition.
(c) After a 5 second pause wherein MCAS inferred that no more pilot pitch trim indicated the airplane was back to column neutral pitch trim, the flight crew would have to allow a second full increment of MCAS airplane nose down stabilizer motion to be inserted over another period of 10 seconds. Once again the crew would have to allow this stabilizer motion to go in without interruption via pilot pitch trim command.
(d) Once again, there would have be a repeat of (b) with a short, ineffective pilot pitch trim command.
(e) The final 10 seconds of this proposed 40 second sequence would be allowing another errant MCAS airplane nose down stabilizer motion increment to go in without interruption by pilot pitch trim command.

To summarize, getting in trouble over the course of just 40 seconds requires the crew to not trim when then should and make two very short, ineffective trim inputs following each of the first two MCAS stabilizer motion increments. This represents a worst case scenario.
We have full Stall ID in the case of JT610 by a margin of some 10 degrees. Stall ID on the 737ng triggers: Stick shaker, Feel pressure increase and trim actions very similar to MCAS (though with the Yoke cutout switches active). So given we don't have a clean MCAS case (MCAS should fix the pitch moment curve before stall), what is the MAX logic at Stall ID? Does MCAS replace the 737ng Stall ID trimming and is then the MCAS logic as you described unchanged?

[yanrair]

“40 SECONDS TO DISASTER- DAILY MAIL
Not sure where this 40 seconds to disaster is coming from. Apologies if it’s obvious but can’t see it. DID not the subject flight fly for ten min. Plus constantly trimming back in increments but not enough to overcome the trimming forward. Like losing a tug of war where other team gains an inch each time.
If they mean 40 seconds if you did nothing ok, I get that. But you are not going to do nothing. If at any time a pilot on any flight thought he was losing the battle against a STAB TRIM running nose down inexorably which must lead to losing control eventually, there are two stitches called STAB OFF. It occurs to me that if it wasn’t pointed out in training what these switches actually do (cut all power to the stab trim motor) as in THESE ARE YOUR LIFELINE if all else fails (as we were taught) - the “Jesus “switches , then is there a clue here. In other words rather than knowing what every switch on the plane actually does even if you have never run a particular QRH drill on it, if we imagine that you only go to a switch when directed by a checklist and by rote switch it ON/OFF without really knowing it’s function - well that is not a good road. These are all “if,s “ of course.
i remember hearing first hand of a flight where the yaw damper went ape and started doing the opposite of what it was meant to do. The plane flew in violent Dutch roll for a couple of hours because the captain would not switch off the yaw damper despite verbal efforts from the co pilot to do so, because he didn’t really know how it worked and of course there was no QRH drill for “ plane flying crazy and looks like it’s going to turn over “. So a skill called “airmanship” was needed. And you don’t get that from an IPad.
Just a thought that I had not considered because it’s four years since I’ve seen type rating course being run and I’m wondering if they are getting into the realms of minimalist information on some assumption that “ you are never going to need to know that”. Because the plane knows best.

Y

[yanrair]

Here is a thought perhaps worth repeating. A while back, pilots had the idea they were the last link in the safety chain, and someone else’s accident was a gift you could not turn away from, especially if it was fairly recent and an airplane you were flying. You only had to ask yourself two questions. First, what can I do to keep that from happening to me, and second, what else can I do to keep that from happening to me? There is more to it no doubt, as we will see when the facts are all out.

Dear Ferry pilot
thats exactly how it works. We used to read every incident in minute detail and ask” what would I have done”. Dozens every month. You can’t learn nowadays from your own experience because planes rarely go wrong so you have to listen to the rest of the industry. When I started we suffered dozens of real failures including engines every year and learned that way. Not now. But we are and always will be the last link. Think uncontainable fire after takeoff. You can get a 747 back on the ground in five minutes with no checklists at all. None
Y

[yanrair]

ht data. It would appear that issues are far more complicated than it may first appear. At the heart of the issues are the algorithms that process the AoA and computed air speed. The doomed flight had stick shaker on take-off rotation unlike the previous flight (stick shaker started at an altitude about 400ft). The published data does not include all the parameters available.

it has yet to be established if the flight was “Doomed”. Doomed would suggest something like the wings falling off. There MAY have been a solution.
Yanrair

[armchairpilot94116]

Love Boeing and their jets. But I feel Boeing let the people on those two planes down. In the very worst possible way. Not advising and training on a feature that can (and did) prove deadly and very quickly. Especially if it is thought that airline pilots that are not American are less trained and less able. If that is indeed so or even suspected to be so, then it is even more so the supplier of the aircraft's duty to train them to operate the aircraft in a safe manner. The airplane manufacturer should, indeed must provide (more than) adequate supervision and after sales training ( both flying and maintenance) for the proper use of their product. At least that is what I feel.

If you supply nuclear reactors to a client you (the maker) should be at least morally responsible to provide adequate training in its operation.

You sell hundreds of the latest jets to a client, you should and indeed must provide training in their operation and maintenance to a proper level.
The client should not be allowed to 'wing it' so to speak. But that is what Boeing and Airbus do . This methodology should change.

Again my one penny.

[PEI_3721]

FCeng84, re #2597
thanks for the comprehensive explanation. “… worse case scenario.”
However, does the analysis consider the dynamic nature of events. Nose down trim, without inadequate piloting compensation (10 sec down, only 5 sec back), could result in the aircraft descending with corresponding speed increase.
Additional speed would add to the high mis-trimmed stick force - feel unit.
Thus the next erroneous MCAS cycle starts with a higher nose down stick-force, repeatedly increasing in a non-liner manner.

A separate point, is any additional nose down stick force generated by the feel unit because the stall condition has been sensed?

[yanrair]

Dear Armchair
When you buy a fleet of planes you are given the manuals. They are not exhaustive because no two airlines fly their planes the same way. SOPs can vary greatly. I have trained pilots from other airlines on the same plane and it takes ages to reach them the new SOPs. The manuals don’t tell you so much how to fly as what to do. The airlines and their regulators do the training. Boeing do not train you. Airbus I guess the same. the first ten or so training captains go to Seattle and learn the ropes. They then cascade that down through the airline.
Y
example
Boeing- Select Flap 1
Airline 1- PF CALLS FLAP 1. PM REPEATS “FLAP1.?” PF NOTES CORRECT REPETION OF COMMAND. PM SELECTS FLAP 1, PM NOTES FLAP MOVEMENT. PM CALLS FLAP 1 ONCE F1 IS SET
Airline 2 PF CALLS F1 - PM selects F1
There are several ways to do this and Boeing are not involfved unless your procedures go against their advice

[RTM Boy]

Love Boeing and their jets. But I feel Boeing let the people on those two planes down. In the very worst possible way. Not advising and training on a feature that can (and did) prove deadly and very quickly. Especially if it is thought that airline pilots that are not American are less trained and less able. If that is indeed so or even suspected to be so, then it is the supplier of the aircraft's duty to train them to operate the aircraft in a safe manner. The airplane manufacturer should, indeed must provide (more than) adequate supervision and after sales training ( both flying and maintenance) for the proper use of their product. At least that is what I feel.

If you supply nuclear reactors to a client you (the maker) should be at least morally responsible to provide adequate training in its operation.

You sell hundreds of the latest jets to a client, you should and indeed must provide training in their operation and maintenance to a proper level.
The client should not be allowed to 'wing it' so to speak.

Again my one penny.

Your first sentence demonstrates the modern phenomenon of fanboyism. But really the problem revolves around competing needs. Fundamentally A/C are tools with which to do a job, they are not, must not, be considered in terms of wafer-thin shallowness as say Nike vs Adidas.

Passengers want cheap(est) fares. Cheaper fares = more passengers = higher load factor = airline profitability (for a given mean fare).
So, airlines want lowest cost; low(est) leasing rates, low(est) fuel consumption, low(est) maintenance costs, low(est) training costs for new A/C types, lowest wage rates, maximum airframe and crew utilisation, lowest airport charges, etc, etc.
Aircraft manufacturers want high volume sales for profitability to amortise fixed and development costs, in part to please investors and in part to create sufficient cash flow to allow development of the next model and so will make what they think the market will buy most of...to the minimum standard permitted in service (ie lowest cost). They will offer 'optional extras' at extra cost to the airlines/leasing agents (ie another profit centre).
Governments and their aviation regulators want maximum safety (in theory). It's not helpful for your voters to suffer the consequences of your mistakes or to see others do so.


Just this simple construct (yes, I know it's more complicated than that), illustrates the tensions in decision-making and taking. Remember, there is no such thing as 'safe' or 'unsafe'. It's all a matter of degree based on thorough, objective, tested risk assessment. Or it should be. But then everyone has an agenda. Everyone.

[wheelsright]

ht data. It would appear that issues are far more complicated than it may first appear. At the heart of the issues are the algorithms that process the AoA and computed air speed. The doomed flight had stick shaker on take-off rotation unlike the previous flight (stick shaker started at an altitude about 400ft). The published data does not include all the parameters available.

it has yet to be established if the flight was “Doomed”. Doomed would suggest something like the wings falling off. There MAY have been a solution.
Yanrair

"Doomed" was based on the fact that the aircraft did crash; for whatever the reason. It was not intended to mean that at no time was the accident avoidable. It is certain, by the combination of factors, that the flight was in fact doomed. I not sure that quibbling over word usage or placing your own spin on words is a of any assistance. I chose "doomed" purely to differentiate the final flight from the previous flight, rather than using flight numbers or similar differentiation that may not be immediately clear.at first glance.

[HarryMann]

Dear Armchair
When you buy a fleet of planes you are given the manuals. They are not exhaustive because no two airlines fly their planes the same way. SOPs can vary greatly. I have trained pilots from other airlines on the same plane and it takes ages to reach them the new SOPs. The manuals don’t tell you so much how to fly as what to do. The airlines and their regulators do the training. Boeing do not train you. Airbus I guess the same. the first ten or so training captains go to Seattle and learn the ropes. They then cascade that down through the airline.
Y
example
Boeing- Select Flap 1
Airline 1- PF CALLS FLAP 1. PM REPEATS “FLAP1.?” PF NOTES CORRECT REPETION OF COMMAND. PM SELECTS FLAP 1, PM NOTES FLAP MOVEMENT. PM CALLS FLAP 1 ONCE F1 IS SET
Airline 2 PF CALLS F1 - PM selects F1
There are several ways to do this and Boeing are not involfved unless your procedures go against their advice

Whilst obviously true for the general case, perhaps somewhat simplistic in the case of disseminstion of information ON and training FOR introduction of an aircraft type with MCAS, a new and quite different approach to meeting stability and control requirements ?

[armchairpilot94116]

All true. Car manufacturers don't teach you how to drive either. Boeing and Airbus sell their planes and expect competent crew certified by their countries' authorities to fly them. All good, until it is not good enough. It would appear to be in the makers interest to hand hold at least some of their clients longer than others. There is a thought (not without grounds perhaps) that the Indonesian maintenance crew did not correctly identify or rectify the issues with the ill fated plane. But at least the flight crew of the Lion flight could not be blamed for not understanding what was happening. They could perhaps have been blamed for not being trained enough to GUESS or at least theorize the right thing to do especially when minutes or even seconds count. The Captain in hindsight (always 20/20) maybe should not have left his position and handed the controls to his Co pilot while he tried to find out what was happening. Perhaps at that particular juncture they should have been trying to keep the horse from bucking and doing their best to turn right around and land. Or perhaps it was already too late. But at that point in time no pilots knew about MCAS . What happened exactly on the Egyptian flight is not 100pct known as yet.

If I was Boeing I would want to (as part of my sales pitch) provide after sales supervision of the maintenance and observe and provide guidance for any flying issues for a time. Perhaps station some key personnel for a reasonable time. I don't think this is done now but it should be looked into.

Doesn't matter who crashes your product really. It is going to affect you.

p.s. I am not a Boeing fanboy though as I love Airbus products equally. I'm not fond of the sidestick though, where one pilot doesn't "see" what the other is doing.

[yanrair]

Whilst obviously true for the general case, perhaps somewhat disingenuous or simplistic in the case of disseminstion of information ON and training FOR introduction of an aircraft type with MCAS, a new and quite different approach to meeting stability and control requirements
Quite so Harry. If the training captains did not know about MCAS then the pilots will not either. Whether or not MCAS caused this crash is yet to be determined but we should know more today.
Cheers
Y

[wheelsright]

Several people have asked MCAS clarification questions in response to some of my recent posts. Rather than respond to them individually I offer the following as hopeful a fairly comprehensive description of the MCAS system that has been in the 737MAX fleet to date. Note that this does not reflect any of the changes about to be released. Hopefully Boeing will provide clear detail of those soon.

As always, if you still have questions after reading and trying to absorb the following please ask.

1. MCAS was designed to command airplane nose down stabilizer in response to high AOA up to an authority limit of 2.5 degrees for Mach less than 0.4 with lower authority at higher Mach numbers. If the pilot does not make any pitch trim commands, once AOA goes low MCAS will run the stabilizer in the airplane nose up direction back to the location from which it started.

2. MCAS is activated when all of the following are true:
a. Flaps are up
b. Autopilot is not engaged
c. Sensed AOA is above the MCAS activation AOA threshold

3. Once activated, MCAS will not command more than one increment of airplane nose down stabilizer motion until it has been reset. MCAS will be reset by either:
a. Pilot pitch trim command followed by a period of 5 consecutive seconds with no pilot pitch trim command.
- The assumption is made that pilot activation of pitch trim will be closely followed by continued pilot use of pitch trim to return the airplane to a column neutral pitch trim condition. MCAS seeing no further pilot pitch trim for a period of 5 seconds is interpreted as indication that the pilot has achieved column neutral pitch trim.
b. Return (by MCAS) of the stabilizer to its starting position per (1) above.
- Having returned the stabilizer to its pre-MCAS event starting point it is assumed that the airplane is back to a column neutral pitch trim condition.

4. Pilot pitch trim input at any time during the MCAS sequence as described in (1) above will stop MCAS stabilizer motion and end the current MCAS event while immediately moving the stabilizer in the direction of the pilot command.
a. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose down, that motion will stop and the stabilizer will immediately move in the direction of the pilot command.
b. If pilot pitch trim input is issued while MCAS is running the stabilizer airplane nose up, that motion will stop and the stabilizer will move in the direction of the pilot command.
c. If pilot pitch trim input is issued after MCAS has completed its airplane nose down motion but prior to MCAS acting to take that motion out (as a result of return to low AOA), the stabilizer will immediately move in the direction of the pilot command.
d. It is assumed that the pilot issuing a pitch trim command is indication that the pilot is taking over the pitch trim task and will return the airplane to a column neutral pitch trim condition.


As a result of 1 through 4 above, given an AOA sensor that is failed so as to give an erroneously high reading (similar to what data appears to indicate occurred during the Lion Air accident flight), the following MCAS related scenarios can occur:

A. MCAS will activate (if flying manually) as soon as the flaps are retracted to up. Note that the stick shaker will have activated as soon as the airplane lifted off the ground regardless of the takeoff flap setting.

B. If the pilot does not make any pitch trim inputs, MCAS will run the stabilizer airplane nose down for one MCAS increment (as much as 2.5 degrees over approximately 10 seconds if Mach is less than 0.4). Without pilot pitch trim input, MCAS will not command further stabilizer motion in either direction. There is plenty of pitch control authority via the elevator using the column to counter the pitch disturbance generated by one MCAS increment of stabilizer motion.

C. If during or after the MCAS stabilizer motion per (A) above the pilot gives a pitch trim command the stabilizer will immediately start moving in the direction of the pilot command.
a. If the pilot pitch trim commands drive that stabilizer back to a column neutral pitch trim condition then the airplane will be back where it started from. In this event, provided sensed AOA is still high, MCAS will activate again once it sees a period of 5 seconds with not pilot pitch trim input. This process will repeat itself with the stabilizer never getting further than one MCAS increment out of trim. It appears that this sequence was repeated 20 or more times by the Lion Air accident flight pilot before he handed control over to his first officer.
b. If the pilot pitch trim commands are activated, but do not drive the stabilizer back to a column neutral pitch trim condition it is possible that successive activation of MCAS triggered by high AOA signal and ineffective pilot pitch trim inputs will lead to the stabilizer moving progressively further in the airplane nose down direction. It appears that this is what took place on the Lion Air accident airplane once the first officer took over control.


As for the reference in media reports this week regarding the crew’s need to intervene within 40 seconds of errant MCAS response to an AOA signal failed high, the following sequence of events would have to occur to so compromise pitch control power in that amount of time:
(a) The flight crew would have to allow a full increment of MCAS airplane nose down stabilizer motion to go in over 10 seconds without interrupting that motion via pilot pitch trim input.
(b) The flight crew would then have to have made a very short pitch trim command that triggered MCAS to reset, but did not re-establish anywhere near a column neutral pitch trim condition.
(c) After a 5 second pause wherein MCAS inferred that no more pilot pitch trim indicated the airplane was back to column neutral pitch trim, the flight crew would have to allow a second full increment of MCAS airplane nose down stabilizer motion to be inserted over another period of 10 seconds. Once again the crew would have to allow this stabilizer motion to go in without interruption via pilot pitch trim command.
(d) Once again, there would have be a repeat of (b) with a short, ineffective pilot pitch trim command.
(e) The final 10 seconds of this proposed 40 second sequence would be allowing another errant MCAS airplane nose down stabilizer motion increment to go in without interruption by pilot pitch trim command.

To summarize, getting in trouble over the course of just 40 seconds requires the crew to not trim when then should and make two very short, ineffective trim inputs following each of the first two MCAS stabilizer motion increments. This represents a worst case scenario.

This description while helpful is no more than very superficial and raises far more questions than it answers. Only a comprehensive review of the hardware and software involved in MCAS together with AoA, stick shaker, computed air speed, left/right redundancies etc. will get to the bottom of whether there is more to the problem. The was evidence of unreliable indicated airspeed, altitude disagree, feel differential pressure, mach trim fail, speed trim fail and much more. The PIC and the SIC had to deal with far more than runaway trim on both Lion Air flights. In the previous flight the crew quickly parsed what was happening and disabled the auto trim. Stick shaker before you have left the ground is not helpful to immediately thinking "trim runaway" and could have tended to point the crew's minds in the wrong direction..

The systems are all based on various algorithms. The question is not whether there are algorithms, but whether they are capable of dealing with all possible flight conditions or fault conditions in a way that is helpful. Among these complex interactions between sensors and the controls there are many possibilities for unexpected interactions or interpretations. Does the system work as intended or have some situations been missed? I have some insight into the difficulties of eliminating unexpected conditions in controls engineering; having spent the first part of my life designing control systems in a non-aircraft environment. It is really easy to be lulled into the belief you have thought of everything, only to find there is a major defect in your logic that you have totally missed.

There is growing evidence that trim runaway must be identified at a very early stage to ensure that recovery is possible. The pilots may have to differentiate conflicting information at a time that there is a high workload. It seems likely that the risks are extremely high and have not been adequately mitigated. I look forward to seeing the source code that will have to produced in evidence at some time in the future.

Just to touch on an obvious problem... it is extremely unlikely that full nose down trim would be required in any flight. MCAS has full authority to provide full nose down trim regardless of many other factors (save for the crew disabling it). It would appear to me to be a dangerous degree of authority that should be, at the very least, be immediately obvious and notified to the pilots. Not only is there apparently too much authority but there is also insufficient redundancy and warning. My guess is it is an embarrassing mess, but only detailed investigation will confirm or invalidate that speculation.

[WHBM]

All true. Car manufacturers don't teach you how to drive either. Boeing and Airbus sell their planes and expect competent crew certified by their countries' authorities to fly them. All good, until it is not good enough. It would appear to be in the makers interest to hand hold at least some of their clients longer than others. There is a thought (not without grounds perhaps) that the Indonesian maintenance crew did not correctly identify or rectify the issues with the ill fated plane..
Cars are a consumer product, designed as such. But if you purchase a fleet of railway locomotives, or ships, the manufacturer will certainly provide extensive training and on-site support on their aspects, both for operating and maintenance.

As little or nothing was shared with the pilot group about MCAS, it is a bit difficult to believe that nevertheless there was full and complete documentation, procedures, spares availability, etc, about it provided to the engineering side. If anyone can post the Aircraft Maintenance Manual procedures for the Max for a "repeatedly moves stabiliser down" issue, different to "runaway stabiliser", it would be good to see them. Especially the bit about it using alternate AOA probes on alternate flights.

[airman1900]

This Senate hearing is at 3 PM Eastern Daylight Time to be broadcast on C-SPAN 2 at 8 PM Eastern Daylight Time (2.5 hours long) and probably will be available online.

Senate Commerce Hearing on Airline Safety
Government officials testify on airline safety after a global recall recall of the Boeing 737 max jets. A Senate Commerce subcommittee holds the hearing.
Program ID: 459047-1
Category: Senate Committee
Format: Senate Committee
Location: Washington, District of Columbia, United States
Will Air: Mar 27, 2019 | 8:00pm EDT | C-SPAN 2

https://www.c-span.org/video/?459047-1/senate-commerce-hearing-airline-safety

[FCeng84]

We have full Stall ID in the case of JT610 by a margin of some 10 degrees. Stall ID on the 737ng triggers: Stick shaker, Feel pressure increase and trim actions very similar to MCAS (though with the Yoke cutout switches active). So given we don't have a clean MCAS case (MCAS should fix the pitch moment curve before stall), what is the MAX logic at Stall ID? Does MCAS replace the 737ng Stall ID trimming and is then the MCAS logic as you described unchanged?

Please explain what you mean by “Stall ID”. Also please describe “737Ng Stall ID trimming”. I am very familiar with the term “Stall ID” as part of the regulations but not in this context.

[bsieker]

I like you don't like semantics, like "was the STAB TRIM" actually "continuous".
Y

Is that really how you imagine troubleshooting on the flight deck of an airliner to work?

"Hey, the airplane is trimming repeatedly in a direction I don't like, but we cannot use this procedure here because it says the trim needs to be 'continuous'. Drat!"

The problem is not semantics, although that is an important concept and I don't like people using the word to imply "it is just splitting hairs". It is not. It is about what we mean by words.

The problem is identifying the issue in the first place. Identifying that the trim movements are in fact pathological. Automatic trim inputs are normal and expected on the 737, mostly from the STS, and in situations where high angle of attack values are delivered (valid or not), a lot else is going on that requires your immediate attention, such as stick shaker and IAS disagree. Trimming occasionally to remove stick forces is second nature to any pilot, from light GA singles to large airliners (Airbus FBW autotrim notwithstanding), for a while you wouldn't even think about it. And then there is the problem of perhaps throwing the baby out with the bathwater, i. e. the evaluation of what functions are lost when electric trim is completely disabled. Remember that there is no way to disable MCAS only.

The symptoms are significantly different from runaway trim, which is a trained procedure precisely because the time in which the pilots need to react may be very short for a real runaway, to a large part because manual trim inputs may not stop it. But manual trim inputs do stop MCAS trim inputs. So it is substantially different from a runaway and is much harder to diagnose, and this has nothing whatsoever to do with "just semantics".

Bernd

[BluSdUp]

I am on my way for 5 day of 737-800 duty and are not able to post , so can anyone please post any outcome or links to the outcome of the meeting Boeing has invited 200+ customer pilots and admin personnel in Seattle today.

And BTW I am a bit tired of the does and donts of the MCAS .
It is a **** system and the human factor is the clue.
I used to be interested in teck and performance.
Now mostly performance, the HUMAN performance and Limitations!
Looking forward to something constructive from Boeing , FAA ,Canada MOT and EASA.
Regards
Kpt B
And a safe day to You All

[infrequentflyer789]

Please explain what you mean by “Stall ID”. Also please describe “737Ng Stall ID trimming”. I am very familiar with the term “Stall ID” as part of the regulations but not in this context.

I've seen this in bits of the AMM that I have (annotated image attached):

[yanrair]

[QUOTE=bsieker;10431328]Is that really how you imagine troubleshooting on the flight deck of an airliner to work?

"Hey, the airplane is trimming repeatedly in a direction I don't like, but we cannot use this procedure here because it says the trim needs to be 'continuous'. Drat!"

I don't advocate limiting the forum to pilots, but an attitude of "I'm not a pilot, but I would have identifed the problem and applied the fix immediately" without knowing how things work, is just not
Reply
i am sorry Bsieker. Are you saying that I’m not a pilot?
Y

[bsieker]

Is that really how you imagine troubleshooting on the flight deck of an airliner to work?

"Hey, the airplane is trimming repeatedly in a direction I don't like, but we cannot use this procedure here because it says the trim needs to be 'continuous'. Drat!"

I don't advocate limiting the forum to pilots, but an attitude of "I'm not a pilot, but I would have identifed the problem and applied the fix immediately" without knowing how things work, is just not

Reply
i am sorry Bsieker. Are you saying that I’m not a pilot?
Y



I am saying no such thing, and it is also irrelevant. I have said all I have to say on this, and I am sorry if you are still missing the point.

The offending sentence in my original post was perhaps a mistake. Since it added no content, I have removed it.


Bernd

P. S. be careful to retain the closing quote bracket, or the forum software will mess up the formatting.

[A0283]

Secretary Chao (during Senate appropriations hearing March 27th) answering the question on why the FAA did not ground the plane faster. She repeatedly points out the fact driven approach of the FAA. No facts known warranted a grounding according to the FAA. That started to change on the Wednesday morning of March 13th when two facts emerged:

[1] new, raw satellite data became available, this first had to be processed before it could be read, this data gave information on the first 3 minutes of the flight, that showed similarities with the Lion flight data,

[2] physical evidence was found at the site that was similar to the Lion crash evidence/information,

[3] not the same importance as point 1 and 2, but the FAA had expected that the black boxes would have been read sooner, …

There was, relatively speaking, a lot of attention for the Ethiopian and Lion accidents in this hearing covering all transportation type funding budgets.

She repeated both the IG audit (detailed factual history of the certification of the 737 MAX 8) and the establishment of a special advisory committee that will adress certification issues. This will be further explained during the later safety related hearing in the Senate.

She also indicated that she shared a number of specific concerns of the various senators (like suggested 'cozy' relations between manufacturers and FAA management), that they would be adressed and investigated, and the Senate kept informed of progress.

One senator was already preparing a Bill aimed at demanding that 'safety related equipment' should be included in the 'basic price of the aircraft'. You could read that as 'should be standard' probably. Another senator, noting he was a pilot himself, considered an AoA indicator to be such a 'standard safety item'. Seems a bit premature but ... That last senator also mentioned that the American public had lost faith in the plane.

So no new issues for pprune readers (except perhaps point [3]). But interesting to see how this is translated at the political level.

FYI - these are my own notes

[WHBM]

One senator was already preparing a Bill aimed at demanding that 'safety related equipment' should be included in the 'basic price of the aircraft'. You could read that as 'should be standard' probably.
I think there were a number of us surprised that such were a chargeable extra ticket item. It would be interesting to ask if the FAA knew it was such, as (surely the prototype but) also the initial production aircraft used in the certification tests all seem to have been for operators who had selected the AOA comparison option.

[FascinatedBystander]

"Obviously, somebody at Boeing knows precisely how it works" Actually, that's not obvious. Boeing may merely know what specification was given to a subcontractor.

[yanrair]

I've seen this in bits of the AMM that I have (annotated image attached):
Thanks for the AMM info. Any more pages like that? It looks like the maintenance engineers have information not available the the training department. Especially the bit about "pilots cannot easily overcome the nose down trim....." but it doesn't stay how it achieves this. In fact it suggest by saying "not easily" that it is in fact possible but not easily! What on earth does that mean I wonder.
The full AMM pages would be interesting if you have them.
Many thanks
Y

[A0283]

@WBHM

Quote: Originally Posted by A0283 One senator was already preparing a Bill aimed at demanding that 'safety related equipment' should be included in the 'basic price of the aircraft'. You could read that as 'should be standard' probably.

Quote: Originally Posted by WBHM: I think there were a number of us surprised that such were a chargeable extra ticket item. It would be interesting to ask if the FAA knew it was such, as (surely the prototype but) also the initial production aircraft used in the certification tests all seem to have been for operators who had selected the AOA comparison option.

I would say we dont know at the moment.

An example is the AoA indicator discussion (which the pilot senator mentioned). We have this AoA discussion on Pprune too. I would not like to fly without one (based on my background), but quite a few others (including on Pprune) dont consider them necessary for the majority of commercial pilots (which goes quite beyond just for the 'average' pilot). In some other discussions people state that an AoA indicator is only confusing, or 'worse'. As long as there is no formal conclusion on this type of solutions you might not be right to call them a 'safety item'.

I would like to add that the airlines that you mention were formally not the launching customer of the MAX. That was something that really surprised me at the time. You (historically) expect a launch to be with a customer who has more than average and competent (maintenance) engineering staff. When I asked around nobody could really answer my questions on this. Would be interesting to find out if the IG audit or the Special Committee come up with any facts or answers on this.

[yanrair]

I think there were a number of us surprised that such were a chargeable extra ticket item. It would be interesting to ask if the FAA knew it was such, as (surely the prototype but) also the initial production aircraft used in the certification tests all seem to have been for operators who had selected the AOA comparison option.

Thanks a lot for that feedback on this conference. This refers to a senator saying that AoA indicators should fitted as standard. Fitting AoA indicators is certainly not something that most airlines want even if money were no object. That is why wealthy airlines apart from one perhaps, don't fit them. They can be very confusing, require a lot of training and understanding - far more than the data we already have at our disposal - which many on this forum have said is confusing enough already. An AOA disagree warning would be a good idea and would result in pilots knowing not to trust AoA any more and probably get on the ground asap. and avoid any flight situation that might require their use.
Anyway my concern here is we have people from Donald Trump and now a senator who flies a light aircraft telling the industry how it should be done. An industry that has driven airline deaths to almost zero over the last forty years. Not every year, and 2017 did see one death world wide but to no other industry gets close to those sort of safety improvement statistics.
And of course if the AoA indicators are being fed erroneous information by the AoA sensors then ..................
Y

[PEI_3721]

yanrair, #2644, re ‘it suggest by saying "not easily" that it is in fact possible but not easily”
See thread https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html which discusses this issue relating to 737 Classics and NG.
I suspect that the AMM ‘not easily’ relates to this discussion. However, for the Max - as yet unknown, there is the possibility that ‘not easily’ could become ‘not at all’ at some point during a MCAS failure situation.

[yanrair]

I am saying no such thing, and it is also irrelevant. I have said all I have to say on this, and I am sorry if you are still missing the point.

The offending sentence in my original post was perhaps a mistake. Since it added no content, I have removed it.


Bernd

P. S. be careful to retain the closing quote bracket, or the forum software will mess up the formatting.
Ok Bseiker, I will be careful and thanks. I thought that you imagined from my comments that I was not a pilot. And I think it is relevant whether a contributor is an airline pilot of just someone asking questions.
I have flown the 737 aircraft many times in manual reversion (no power at all - nothing but a 24 v battery) and in manual trim mode - STAB SWITCHES OFF. In the older days when we did not have a good simulator, we had to do runaway stabilisers on the real plane with a training captain hitting the AND (airplane nose down) button and holding it there until you reacted - and that sometimes was a long time - maybe 10 -15 seconds. I am not sure that too many of our readers have actually done any of this stuff for real - but that doesn't make their commentary any less valuable. I find all of this commentary valuable even though I don't agree with a all of it - I certainly know more about algorithms than I did two weeks ago. It is just that I think the human brain is better at these things than most automation - hence autopilots not being able to land in seriously bad windy weather. Or make decisions when the data coming in doesn't compute - AF 447 sort of scenario and we know what happened there.

[PEI_3721]

A0283, # 2645,
Thank you for a balanced view of AoA, definitely not ‘a safety item’ - you can fly without the display.

Perhaps the Senators (yanrair #2647) should be invited to view:-
#2577 https://www.pprune.org/showpost.php?p=10430462&postcount=2577

[Realbabilu]

Even MAX Boeing test pilot didnt aware that MCAS is using one sensor data.


https://www.bakersfield.com/ap/news/lack-of-redundancies-on-boeing-max-system-baffles-some-involved/article_8a9b4837-9e96-544e-a8c6-5037e6384825.html

[gums]

Opinion on the AoA indicator/instrument
_________________________________________
Salute!
Many opinions about the AoA indicator or instrument or....or.....
I must admit that I flew three jets with AoA indications, two presented AoA all the time and one only with gear down.
I liked an AoA indication that presented the optimum AoA for an approach regardless of my weight, and allowed for configuration such as flaps and gear Being a single seater, it kept me from flipping thru a lotta pages and such, and also being more accurate than the old rules of thumb like 175 KIAS with 3,000 pounds and 5 knots for every 1,000 above that ( yep, that was a rocket I flew as a raw nugget).
I never used AoA for optimum cruise or holding pattern to save gas. Although two of my planes used AoA for stall warning and protection, the only indication I had was a pusher or a no kidding FBW limiter on the elevator no matter if I pulled with 200 pounds!
So I tend to agree with many that adding another instrument that can be used for most of the flight is of dubious value. EXCEPT it is worth its weight in gold for approaches and when flying right at the edge of the envelope. So my feeling is to have some. representation presented when those two conditions exist. It's a no brainer. Shows you why you are close to a stall and confirms your approach AoA/speed. I will guarantee that the Asiana 777 that got slow would have seen the AoA bracket going way high in the HUD ( oops? that thing have HUD?). Ditto for AF447.

Finally, many recent posters do not understand how trim works with regard to AoA and pitch attitude and Gee. I suggest they visit the Tech Log.

Gums sends..

[Longtimer]

Boeing has launched fixes for its 737 Max plane



1 hour agohttps://www.bbc.com/news/business-47722258





Boeing said in future airlines would no longer be charged extra for that safety system to be installed.Upgrade

The planemaker has also issued an upgrade to the software that has been linked to the crashes.

The Manoeuvring Characteristics Augmentation System (MCAS), designed to keep the plane from stalling, reacts to sensors which detect whether the jet is climbing at too steep an angle.

But an investigation of the Lion Air flight last year suggested the system malfunctioned, and forced the plane's nose down more than 20 times before it crashed into the sea killing all 189 passengers and crew.

The US Federal Aviation Administration says there are similarities between that crash and the Ethiopian accident on 10 March.

Boeing has redesigned the software so that it will disable MCAS if it receives conflicting data from its sensors.Timetable

Boeing said a final version of the software would be submitted to the Federal Aviation Authority (FAA) by the end of the week.

But it added that airlines would have to install the new software, give feedback on its performance, and train pilots before the changes could be certified and the planes passed safe to fly again.

In a briefing to reporters Boeing said that the upgrade to MCAS was not an admission that the system had caused the crashes.

A joint investigation by the U.S. National Transportation Safety Board, France's aviation investigative authority BEA and Ethiopia's Transport Ministry is expected to release a preliminary report into the Ethiopian crash this week.Image copyright Getty Images A Boeing official said: "Following the first incident in Indonesia we followed the results of the independent authorities looking at the data, and, as we are always looking to ways to improve, where we find ways to improve, we make those changes to make those improvements."

FAA is also coming under scrutiny on Wednesday as the Senate Commerce sub-committee on Aviation and Space is due to question its acting head Daniel Elwell as to why the FAA was one of the last of the world's regulatory bodies to ground the plane after the two crashes.

[PJ2]

Even MAX Boeing test pilot didnt aware that MCAS is using one sensor data.


https://www.bakersfield.com/ap/news/lack-of-redundancies-on-boeing-max-system-baffles-some-involved/article_8a9b4837-9e96-544e-a8c6-5037e6384825.html

I understand from having read earlier in the thread that both AoA sensors are used but only one at a time, on alternating flight legs, between the left & right FCCs which are fed by the left & right AoA sensors respectively. It's still a single-point-of-failure issue and as has been stated numerous times throughout this thread, that design requires an answer as to why.

For airline pilots, particularly non-military-fighter types, AoA is a secondary piece of information. If AoA is to be implemented, then mental habits have to change to accomodate a new way of viewing the wing. One cannot make both airspeed and AoA equal in the pilot's mind due to the obvious potential for confusion. Airline pilots fly by speed not AoA, and introducing data on the PFD in an abnormal situation could be confusing in terms of a quick intellectual apprehension, (mental modelling), necessary for timely and correct decision-making. We are accustomed to "obeying" airspeed, not AoA and when the priority suddenly becomes "AoA over speed or pitch", even though perfectly correct, may in a rapidly unfolding situation which is becoming more confusing by the second, render AoA of dubious value.

This is not to dismiss AoA itself as valuable; out of interest, I used to watch it using the ACMS section of the rear MCDU on the A330/A340 when in cruise. But the modelling of behaviours necessary to make it become "primary" in pilot awareness when we've used airspeed as primary forever, is a signifcant change which may not be necessary, for as I have mentioned before, recognizing and using AoA still doesn't have any "saves" to its credit in airline work. It may have such a potential, but planning for or requiring its use is by no means straightforward, as just displaying AoA on the PFD or even installing a comparator does not resolve the question of which parameter to prioritize when AoA's don't match by a set value and set off yet another attention-getting device to which the pilots must intutively react, possibly swiftly.

[Ian W]

Thanks a lot for that feedback on this conference. This refers to a senator saying that AoA indicators should fitted as standard. Fitting AoA indicators is certainly not something that most airlines want even if money were no object. That is why wealthy airlines apart from one perhaps, don't fit them. They can be very confusing, require a lot of training and understanding - far more than the data we already have at our disposal - which many on this forum have said is confusing enough already. An AOA disagree warning would be a good idea and would result in pilots knowing not to trust AoA any more and probably get on the ground asap. and avoid any flight situation that might require their use.
Anyway my concern here is we have people from Donald Trump and now a senator who flies a light aircraft telling the industry how it should be done. An industry that has driven airline deaths to almost zero over the last forty years. Not every year, and 2017 did see one death world wide but to no other industry gets close to those sort of safety improvement statistics.
And of course if the AoA indicators are being fed erroneous information by the AoA sensors then ..................
Y

An AoA disagree was already known to the aircraft systems that is why there was the cascade of other warnings on UAS etc. As was stated upthread slightly more sophisticated software would identify the AoA vane reports that were not behaving within normal parameters. Then the one assumed good AoA could be used with just an alert for the crew that they were now on one AoA. While the new Boeing fix will stop the MCAS issue surfacing, there could be a slightly more sophisticated approach to reduce the instant jump in workload in the cockpit and just provide caution the systems are now using only one AoA ensure pitch and power are correct for each phase of flight (or some such), As was said earlier the 'automation surprise' and cacophony of warnings and systems dropping out only obfuscates what is happening. It is definitely not useful and is likely to create cognitive overload leading to attentional tunneling (tunnel vision) concentrating on something that is actually less important (you have 20 seconds left to hit those switches!!!!). HF people should sit in a cockpit for each type of alert and see how many PANIC PANIC!! warnings are issued that may not actually be totally necessary. All that happens is the majority of these alarms and alerts are not even noticed. So with each failure in a particular flight phase what is the most important alert? Get the pilots' attention on that and do cognitive walkthroughs to find out how the system can assist the pilots. In some flight phases a minor fault could become major and vice versa. Yes they do this with EICAS/ECAM messages etc., but even they scroll off. It just seems a little more thought could be given to prioritization and alerting types you want the right reaction not panic or tunneling.

[Chronus]

AoA Indicators.

There is a good research paper published in 2014 on this subject. I may be accessed at :

https://www.researchgate.net/publication/277331189_Review_of_Research_on_Angle-of-Attack_Indicator_Effectiveness

[Bergerie1]

PJ2,

Thank you for a dose of common sense. I have never flown with AoA displays, apart from CofA airtests on VC10s, and I think, for the reasons you state, they would have little value in normal commercial operations. To me, the issue is the single point of failure. To have AoA information from only one sensor for such an important software control system is bizarre, to say the least. I can appreciate that the MCAS is an 'add-on' and thus inherited the existing system architecture of the 737, but I note that a similar system in the military version of the 767 uses inputs from two AoA sensors. Surely three AoA sensor inputs should be used, with a simple voting system to decide which to discard, would be better.

[gums]

Salute!

The problem, Berg, is that the MCAS acts upon AoA because of the aero requirements of the certification. Airspeed , actually Mach, only influences degree of trim. So you can have MCAS trimming you as long as flaps are up, and the intent was for it to help at other than approach speeds or right after takeoff.

PJ. and I and others here went thru this with AF447 a century ago. With all the crapola about MCAS, last thing I want is something new that could confuse the crew, take up space on a display or..... I still like AoA indication for approach/landing. I feel the pilots here know how AoA affects lottsa things and the basic lift equation and induced drag and so forth. But for others, go over to Tech Log and we can talk.

We need one of the 40 second sim pilots to contribute here. Know any? My guess is they demonstrated a scenario that had no pilot trim inputs Nd let the system rip! So add the times and it is 40 seconds. If you do not reduce power, you wind up in a very bad corner of the envelope.

Gums sends...

[Fortissimo]

It seems that the majority of people who see no value in displaying AOA are those who have never used it. It works very well, as I found out when I needed to land at night following a complete loss of IAS, and it works on big aircraft as well as fighters.

An absolute AOA indication (in degrees) is not necessary, far better to have an indexed system, the main point being that it gives you a direct indication of how well your wing is performing - that is extremely useful information when you are near or nearer to the margins, for example on take-off, approach or landing. And if you are on the point of stalling, it is the only thing that will tell you reliably how close to the edge you are. With the right tab data, you can also get a pretty good indication of your AUW by comparing IAS and AOA values, which means you can find out easily if your pax are lardballs who have decided to carry on 15kg apiece - that might mean you being able to add 5kts to Vref in the knowledge that you are maintaining your stall margin on the approach. Would that not be useful information?

I would have AOA displayed any time the gear is down, if the speed is below 200kts (for most large aircraft), or if the stall warner is active. For the latter case, I would bin all other speed cues and display attitude, AOA and altitude until a recovery is obvious. Yes, there will be training required to ensure that IAS-only pilots understand what they are being shown, but once learned, never forgotten.

[A0283]

FYI the Senate hearing just ended after about 2hrs30minutes.

Senator Cruz chairing ... with member Senator Sinema...
Witnesses Messrs Elwell (FAA) has pilot experience on multiple types but not 737, he has flown aircraft with and without AoA indicators,
Sumwalt (NSTB) has commercial pilot experience on the (Flintstone versions of) the 737,
Scovel (DoT IG),
Senators - at least one had pilot experience, another some aviation software development experience.

Some notes after listening through it. Beware - these are my notes and not an official transcript - and is not chronological or complete. I try to give an impression and not an opinion here.

What was interesting is that the senators quoted multiple newspaper (NYT, Reuters, Dallas Morning News, Washington Post, Seattle Times,....) stories to support their questions. A number of the newspapers reports were used by pprune members as input and discussed on this forum.

The issue of AoA - indication, warning light, etc got a lot of attention.

Mr Elwell regularly repeated that the FAA "is the global golden standard of aviation safety". Also regularly repeated that the FAA "is fact based and data driven". Mr Elwell did not answer any YES/NO question. Some of the Senators question were quitely asked, others quite agressive. Mr Elwell repeatedly briefed the president and the DoT secretary on the MAX developments, he briefed the president on his intent of grounding, the president then went to a press conference and talked about grounding, Mr Elwell refused to talk about his conversations with the president.
He repeatedly referred to using the Flight Standardisation Board, how international that was, and how the FSB did not come up with any issues.
Appears Mr Elwell's opinion is that the runaway procedure was enough to cover what happened and that every pilot (in the US) is trained and trained on that, and that it is a memory items, so no need to take up a manual in the cockpit. Which suggests that every pilot would have recognized it as such.
Mr Elwell clearly stated that he sees MCAS as a subsystem of the existing STS system. Suggesting that it is not directly visible to the pilot and therefore not directly trained. And also mentiond a number of times that MCAS only operated in a very thin part of the flight envelope. So MCAS was 'already in the NG under STS'.
He stated that delegation has been around since the 1920's and that 'ODA has been around for 60 years'. His estimate was IIRC that skipping ODA would require 10,000 staff and 1.8 billion dollars. And that the EU 'does more ODA'. On ODA he stated that the shift from enforcement (the tool) to compliance (the end game) was a good one.
He stated that after 57,000 flights in the US there have been no reported MCAS issues. And that SWAPA, APA and ALPA in the US leaders all told him they thought the 737 MAX was safe for US pilots to fly. And that he used that information to decide not to ground the MAX. Also after reading all ASRS 24 reports which in his view were not about MCAS. And review of FDR data of all flights.
In his view AoA indicates an energy state, and opined that pilots have other means to determine that.
He called the Boeing 737 MAX a FBW aircraft a number of times during the hearing.

Mr Sumwalt stated that the cooperation with the Ethiopian authorities till now was good and open. He expected a preliminary Ethiopian report (in the 30 days timeframe I guess) - but indicated the Ethiopians are in the lead.

Mr Scovel discussed a number of earlier IG reports that had some serious issues on the FAA and oversight including ODA (IG report of 2015). Normally an IG investigation takes 10 months, Mr Scovel suggested this one might take a bit longer. The IG are working on a report on the Southwest issues with 737 engines, report expected about August 2019, while the NTSB expects its Final Report in November 2019.

A group of at least 16 senators are drafting a Bill that state that safety critical items may not be sold as optional. Mr Elwell in his way states that this is already so. So this is an interesting point, is this a misunderstanding or a difference of opinion.
A number of senators talk about 'shaken consumer confidence'. Some go much further and suggest the FAA has lost its 'gold standard position'...
A number of 'regulatory capture' and 'whistle blower' questions were asked but not really answered.

[gums]

Salute!

Thank you Fortissimo.

To be honest, we fighter guys never used AoA to fly the 'quickest, tightest turn", or to hang at best AoA as MIGCAP, or to cruise home or let down at optimum AoA.
We used it mostly for approach and landing. And as you said, the absolute AoA was not necessary. What the U.S. Navy and later USAF presented on the modern HUD and "indexer" chevrons on each side of the old gunsites was where you had to go to reach and fly optimum approach AoA. I liked it.

So your idea of having AoA represented in some fashion once gear is down, maybe when flaps are down and gear coming up as for a go around has merit, IM(not so) HO.

Gums sends...

[yanrair]

Your first sentence demonstrates the modern phenomenon of fanboyism. But really the problem revolves around competing needs. Fundamentally A/C are tools with which to do a job, they are not, must not, be considered in terms of wafer-thin shallowness as say Nike vs Adidas.

Passengers want cheap(est) fares. Cheaper fares = more passengers = higher load factor = airline profitability (for a given mean fare).
So, airlines want lowest cost; low(est) leasing rates, low(est) fuel consumption, low(est) maintenance costs, low(est) training costs for new A/C types, lowest wage rates, maximum airframe and crew utilisation, lowest airport charges, etc, etc.
Aircraft manufacturers want high volume sales for profitability to amortise fixed and development costs, in part to please investors and in part to create sufficient cash flow to allow development of the next model and so will make what they think the market will buy most of...to the minimum standard permitted in service (ie lowest cost). They will offer 'optional extras' at extra cost to the airlines/leasing agents (ie another profit centre).
Governments and their aviation regulators want maximum safety (in theory). It's not helpful for your voters to suffer the consequences of your mistakes or to see others do so.


Just this simple construct (yes, I know it's more complicated than that), illustrates the tensions in decision-making and taking. Remember, there is no such thing as 'safe' or 'unsafe'. It's all a matter of degree based on thorough, objective, tested risk assessment. Or it should be. But then everyone has an agenda. Everyone.

Thats all true of any business but good airline management is what it’s about- managing those factors. Qantas has never lost a passenger. Ryanair (from annual report)!has had no fatalities in over thirty years with currently 600 plus737s. Same is true of so many operators. Safety is no accident. It’s as you say risk Assessment and ensuring the highest possible standards.
Y

[GlobalNav]

I know there have been several posts regarding the display of AoA, but with no disrespect for the potential usefulness of the parameter, I seriously doubt its safety benefit for the 737 MCAS scenarios.

It would be good to understand the current flight deck context. Display of AoA, itself, is not a required element of flight information, per the certification regulations and never has been. Further, I doubt that even those airlines which opted to have AoA (i.e., "normalized" AoA) displayed have adopted any flight deck procedures for its use, at least nothing stronger than "you may cross check it". So, what would motivate pilots to pay significant attention to it? Hence, except perhaps for a few former Navy and Marine pilots, I doubt the AoA display even enters the most pilots' instrument scan.

I won't argue that things are the way they should be, but there would be a lot of procedural inertia to overcome to achieve safety benefits from the display of AoA. If this change is attempted, I would suggest a far more prominent display of AoA than is found in current transport aircraft flight decks.

[AerocatS2A]

The parallels to XL air crash in the A320 in 2008 are worth a read if you are not familiar... Stuck AoA sensors, no best of three inputs (let alone a single sensor), and un-commanded full forward trim in response to erroneous data inputs.

https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T


That is a completely false representation of the XL crash. The crew stalled the aircraft while testing the stall protection system. There was a "best of three" inputs, but the two inputs that agreed were wrong. There was no uncommanded full forward trim, in fact the auto-trim wasn't operating at all. You might like to read your own link for further education.

[hans brinker]

An AoA disagree was already known to the aircraft systems that is why there was the cascade of other warnings on UAS etc. As was stated upthread slightly more sophisticated software would identify the AoA vane reports that were not behaving within normal parameters. Then the one assumed good AoA could be used with just an alert for the crew that they were now on one AoA. While the new Boeing fix will stop the MCAS issue surfacing, there could be a slightly more sophisticated approach to reduce the instant jump in workload in the cockpit and just provide caution the systems are now using only one AoA ensure pitch and power are correct for each phase of .... ot panic or tunneling.

No, there was no comparison done between the left and right AOA. The left side incorrectly indicated a very high AOA, the right side indicated correct. The warnings generated (stall/UAS) were all from the left side, and the MCAS was using the left side too.

[HarryMann]

I see a trend going back several days in this thread: people who have not flown with an AOA indicator feel that they are unnecessary or distracting, while those who have flown with them find them a valuable addition to the flight instruments.

At the time I went through Air Force pilot training, everyone flew the T-38, as the "advanced trainer". Supersonic, not quite as fast on final as Gums' bird, but close. Very vague "stall warning"; really, it didn't stall so much as just increase descent rate. You could (and I have) pull the stick slowly back into your lap, full aft, and the plane would maintain a nose up attitude, but descend at greater than 12,000 fpm. That was fine at 30,000 feet, in a MOA, but not optimal on approach. So an AOA indicator was fitted, not on the instrument panel, but on top of the dash, right in your line of sight when looking at the runway. The data was simplified...on airspeed, a green donut. Too fast, a yellow chevron indicating you needed to slow down, too slow, a red chevron indicating you had better increase your airspeed, and mind your sink rate. The instrument was absolutely essential to flying the T-38 well, and everyone in the Air Force for decades had done it. When I got out of pilot training, my next jet was a KC-135 (grand-dad to the 737), and it had two AOA gauges on the dash. Not essential, but a valuable crosscheck, not only on final, but also at long range cruise. Never distracting.

I'm not decrying AoA displays nor for or against just listening to PJ2 Gums et al but....

the T-38 being low aspect ratio has a much greater alpha range up to stall than an airliner so those comparisons may not be that relevant ?

[HarryMann]

Another AoA display 'thing"...
.how exactly would it have helped in either of these two 737 MAX accidents.
the crew barely knew whether they were on foot or horseback once MCAS kicked off. Pretty sure AoA display wouldn't have helped solve "the immediate control crisis'.

.again.. I'd welcome an AoA display being sn engineer/technophile.

[Capn Bloggs]

You could (and I have) pull the stick slowly back into your lap, full aft, and the plane would maintain a nose up attitude, but descend at greater than 12,000 fpm. That was fine at 30,000 feet, in a MOA, but not optimal on approach. So an AOA indicator was fitted, not on the instrument panel, but on top of the dash, right in your line of sight when looking at the runway. The data was simplified...on airspeed, a green donut. Too fast, a yellow chevron indicating you needed to slow down, too slow, a red chevron indicating you had better increase your airspeed, and mind your sink rate. The instrument was absolutely essential to flying the T-38 well
That's what airspeed indicators are for. In my previous life on fighters, we only used the "AOA" indicator (traffic light system) for manoeuvring limits. We used IAS for takeoff, approach and landing.

I agree with Harry. An AOA indicator may be useful in a UAS situation (provided of course you can verify it/which one is correct) but in the 737 Max crashes, would have been of limited or no value.

[Ian W]

No, there was no comparison done between the left and right AOA. The left side incorrectly indicated a very high AOA, the right side indicated correct. The warnings generated (stall/UAS) were all from the left side, and the MCAS was using the left side too.

From earlier in the thread the ADIRUs disagreed because of the AoA disagree. I was pointing out that the aircraft systems had already sensed an AoA disagree otherwise they would not alert to a UAS.

[FCeng84]

From earlier in the thread the ADIRUs disagreed because of the AoA disagree. I was pointing out that the aircraft systems had already sensed an AoA disagree otherwise they would not alert to a UAS.

The UAS on Lion Air resulted from the left and right airspeed signals not tracking each other. This was most likely caused by the the left /right sensed AOA difference, but declaring UAS did not involve a direct comparison of the two AOA signals. On 737 the difference between measured static pressure and actual static pressure is a function of AOA. In order to account for this, measured static pressure is compensated based on measured AOA to minimize the resulting static pressure error that would result from a change in AOA. This AOA compensation for static pressure is done independently by the two air data systems that use the sensors on the two sides of the airplane. As a result, if the left and right static pressure ports measure identical pressures but AOA as sensed by the vanes on the two sided of the airplane differ, the compensated static pressure signals will between left and right. This difference causes the left and right barometric altitudes to differ slightly and the computed left and right airspeeds to differ slightly. It is the difference in airspeeds left to right that leads to the system issuing its UAS indication.

[Realbabilu]

Another AoA display 'thing"...
.how exactly would it have helped in either of these two 737 MAX accidents.
the crew barely knew whether they were on foot or horseback once MCAS kicked off. Pretty sure AoA display wouldn't have helped solve "the immediate control crisis'.

.again.. I'd welcome an AoA display being sn engineer/technophile.

So how to differentiate quickly whether it usual STS or insidious MCAS faster? Aoa display or MCAS activation alert,that may written in future AD.

Could Aoa display save the plane before airborne (in taxy) by detecting the differentiate two vane?

Aoa display is more like debugging. It will stress more pilot but it will helped understand the way Hal think.

[FCeng84]

So how to differentiate quickly whether it usual STS or insidious MCAS faster? Aoa display or MCAS activation alert,that may written in future AD.

Could Aoa display save the plane before airborne (in taxy) by detecting the differentiate two vane?

Aoa display is more like debugging. It will stress more pilot but it will helped understand the way Hal think.

AOA vane position is not valid until up to an airspeed well above that for taxi. Revised MCAS logic keeps MCAS from acting at all if an AOAs signals differ by anywhere near as much as appears to have been the case with the Lion Air accident data. I don't think the MCAS changes do anything for stick shaker so the shaker on the side with AOA failed high would activate as it did on Lion Air, but no MCAS.

[gums]

Salute!

Gums and maybe PJ and others are advocating limited use of an AoA indication, and primarily for your approach phase. You guys that want only airspeed will one day have a heavy plane and use a wrong entry on the table. The AoA doesn't care about the weight. Using both AoA and a rough idea for speed ( +/- a few knots) from a table is the best way to go.

For those not used to the really low aspect wings, or the jets with variable leading edge devices and so forth, there is no sharp AoA for stall, if any. Deltas like I flew early and the Concorde, Mirage series, etc, simply mushed. No stall break, just increasing vertical descent rate and loads of drag. Knowing the right speed for those helped a lot, but knowing the AoA was vital to keep from getting behind the "curve".
______________________
U.S. Congress hearing today shoulda had Sully. He knows about AoA, leaing edge devices, underslung motors, crew coordination and such. Plus has unreal reputation, right up there with the Sioux City folks in that crippled DC-10.

Gums sends...

[Smythe]

Vertical winds?? Banked turns?? I suggest they would have no practical bearing on the AOA. If the aeroplane is balanced in a turn, I'd reckon the airflow around both sides of the nose would be, for all intents and purposes, exactly the same. As for "vertical winds", that's all AOA is; anybody who's flown these types of aeroplanes would notice the stick shaker zipper bouncing up and down in turbulence when you're slow, but to say they are "useless without algorithms" is going a bit overboard.

Read Boeings Aero-12. That is where this information comes from.

It has been here several times, but keep getting deleted, so you will have to look up the issues with AoA measurement, calibration, latency, and other issues on your own.

[JRBarrett]

The UAS on Lion Air resulted from the left and right airspeed signals not tracking each other. This was most likely caused by the the left /right sensed AOA difference, but declaring UAS did not involve a direct comparison of the two AOA signals. On 737 the difference between measured static pressure and actual static pressure is a function of AOA. In order to account for this, measured static pressure is compensated based on measured AOA to minimize the resulting static pressure error that would result from a change in AOA. This AOA compensation for static pressure is done independently by the two air data systems that use the sensors on the two sides of the airplane. As a result, if the left and right static pressure ports measure identical pressures but AOA as sensed by the vanes on the two sided of the airplane differ, the compensated static pressure signals will between left and right. This difference causes the left and right barometric altitudes to differ slightly and the computed left and right airspeeds to differ slightly. It is the difference in airspeeds left to right that leads to the system issuing its UAS indication.

AOA sensors are standard on almost every transport category aircraft. They are the primary sensor for the stall warning system (along with indicated airspeed), and may (or may not, depending on model) be used as part of static source error compensation.

I am an AME, not a pilot, so cannot comment on the operational utility of having an AOA display in the cockpit. Two aircraft models I have worked on that do have such displays as “standard kit” are the Beech 400A - which uses a military-style lighted chevron indexer on top of the glareshield, and the Gulfstream GIV, which has an relative AOA index scale on the pilot and copilot PFD displays, immediately to the left of the airspeed tape.

On both models, I assume flight crews are trained in the proper use and interpretation of the AOA readings.

On every other model in my experience, AOA is “there” in the background, as part of the overall stall warning and air data system, but not displayed to the pilots directly.

On the GIV, the AOA correction to altitude and airspeed can be significant in certain flight configurations. It is something we test during the required 24-month re-certification of the air data system. In landing configuration, with full flaps and the AOA vane rotated to a specified high alpha setting, the correction to indicated altitude can be as much as 600 feet.

The only aircraft model I am familiar with where the AOA system can cause an automatic aircraft configuration change is the Falcon 900. If both AOA vanes sense an impending stall, and the leading edge slats are deployed, the inboard slats will automatically retract. I believe this is done to prevent instability in the roll axis from occurring when close to to a stall.

But unlike the 737-8 MCAS - the Falcon autoslat retraction is not a “hidden mystery”. Every Falcon pilot is trained in the existence and operation of the system, and there is are specific preflight tests performed prior to taxi to insure it is working properly. If either AOA vane fails in flight, the autoslat system becomes inoperative with a warning light displayed to alert the crew.

[Ferpe]

Please explain what you mean by “Stall ID”. Also please describe “737Ng Stall ID trimming”. I am very familiar with the term “Stall ID” as part of the regulations but not in this context.
infrequentflyer789 answered the question. Stall ID is Boeing speak for when the SYMD has identified an AoA above the stall threshold for a 737ng. This triggers Stick shaker, Increased stick force (four times) and a nose down trim to make it harder for the pilot to pull more aft yoke. As we have full stall ID, how does MCAS come into play. Does MCAS replace Stall ID trim or not? The Stall ID trim respects the Column cut-out switches, MCAS does not. What logic prevails and why?

[FCeng84]

AOA sensors are standard on almost every transport category aircraft. They are the primary sensor for the stall warning system (along with indicated airspeed), and may (or may not, depending on model) be used as part of static source error compensation.

I am an AME, not a pilot, so cannot comment on the operational utility of having an AOA display in the cockpit. Two aircraft models I have worked on that do have such displays as “standard kit” are the Beech 400A - which uses a military-style lighted chevron indexer on top of the glareshield, and the Gulfstream GIV, which has an relative AOA index scale on the pilot and copilot PFD displays, immediately to the left of the airspeed tape.

On both models, I assume flight crews are trained in the proper use and interpretation of the AOA readings.

On every other model in my experience, AOA is “there” in the background, as part of the overall stall warning and air data system, but not displayed to the pilots directly.

On the GIV, the AOA correction to altitude and airspeed can be significant in certain flight configurations. It is something we test during the required 24-month re-certification of the air data system. In landing configuration, with full flaps and the AOA vane rotated to a specified high alpha setting, the correction to indicated altitude can be as much as 600 feet.

The only aircraft model I am familiar with where the AOA system can cause an automatic aircraft configuration change is the Falcon 900. If both AOA vanes sense an impending stall, and the leading edge slats are deployed, the inboard slats will automatically retract. I believe this is done to prevent instability in the roll axis from occurring when close to to a stall.

But unlike the 737-8 MCAS - the Falcon autoslat retraction is not a “hidden mystery”. Every Falcon pilot is trained in the existence and operation of the system, and there is are specific preflight tests performed prior to taxi to insure it is working properly. If either AOA vane fails in flight, the autoslat system becomes inoperative with a warning light displayed to alert the crew.

JR - your story about automatic retraction of the inboard leading edges at high AOA on the Falcon 900 reminds me of stall characteristics on the original 777. As an airplane approaches stall you would like to see two things happen. First the center of lift shifting aft will generate a nose down pitch break. Second the wing tips continuing to hold on (i.e., not stall first) will preserve roll control. Both of these objectives are achieved if the inboard portion of a swept wing can be made to stall before the outboard portion of the wing. On 777 the darn thing would not stall! It got up to 30+ degrees without a pitch break and the wing tips would sometimes go first leading to a rather exciting rolloff - beyond 90 degrees in some cases! The solution on 777 was to practically eliminate the leading edge gap on the inboard wing when the slat are extended. This caused the inboard wing to stall first at a much lower AOA and preserved roll control with the outboard ailerons. It sounds like the Falcon 900 by retracting the inboard leading edges at high AOA was probably accomplishing the same thing by forcing the inboard portion of the wing to stall first with the wing tips still flying well and thus preserving roll control.

Memory lane ...

[parabatix]

From a piece on Radio 4 Today programme just- refreshingly simple and succinct:
'the only mention of MCAS in the a/c manufacturer's manual is in the abbreviations- that was quite a surprise'
and this;
'Absolutely novel that a major system in the cockpit or a/c was not explained to the pilots'
Tilmann Gabriel. IPTA

[DaveReidUK]

From a piece on Radio 4 Today programme just- refreshingly simple and succinct:
'the only mention of MCAS in the a/c manufacturer's manual is in the abbreviations- that was quite a surprise'
and this;
'Absolutely novel that a major system in the cockpit or a/c was not explained to the pilots'

BBC TV News showed the page in question from the FCOM:

https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/527x525/mcas_d11e0e73f040d9360c39ccfa3cb9be220c8b1a45.jpg

[yanrair]

Another AoA display 'thing"...
.how exactly would it have helped in either of these two 737 MAX accidents.
the crew barely knew whether they were on foot or horseback once MCAS kicked off. Pretty sure AoA display wouldn't have helped solve "the immediate control crisis'.

.again.. I'd welcome an AoA display being sn engineer/technophile.
Ref AOA
Harry. That is so right. Adding more confusion to confusion/ which AOA would have done in this instance was not going to help. The most important instrument in a confusing situation is the horizon- ADI. If you are flying level with power set you are flying level no matter what lights are flashing, horns blaring. Unless you have gone into deep stall.
And your ground speed is always there which equates closely to airspeed at lower levels.

[CodyBlade]

Ref AOA
Harry. That is so right. Adding more confusion to confusion/ which AOA would have done in this instance was not going to help. The most important instrument in a confusing situation is the horizon- ADI. If you are flying level with power set you are flying level no matter what lights are flashing, horns blaring. Unless you have gone into deep stall.
And your ground speed is always there which equates closely to airspeed at lower levels.
exactly! Revert to attitude + power = performance.

Cessna 172 flying.

[MickG0105]

BBC TV News showed the page in question from the FCOM:

The entry 'MCAS Maneuver Characteristics Augmentation System' started appearing in the Abbreviations section of the B737 NG FCOMs from around late 2016 but neither the term nor the acronym appeared anywhere else in the FCOM.

I don't know if it's significant or not but Boeing have been referring to the system fitted to the MAX as the 'Maneuvering Characteristics Augmentation System'.

[Dan_Brown]

Boeing I believe have a "fix" for the problem. Strange how these things can be moved forward, when the fleet is grounded. Tombstone regulation?

[HarryMann]

AOA sensors are standard on almost every transport category aircraft. They are the primary sensor for the stall warning system (along with indicated airspeed), and may (or may not, depending on model) be used as part of static source error compensation.

I am an AME, not a pilot, so cannot comment on the operational utility of having an AOA display in the cockpit. Two aircraft models I have worked on that do have such displays as “standard kit” are the Beech 400A - which uses a military-style lighted chevron indexer on top of the glareshield, and the Gulfstream GIV, which has an relative AOA index scale on the pilot and copilot PFD displays, immediately to the left of the airspeed tape.

On both models, I assume flight crews are trained in the proper use and interpretation of the AOA readings.

On every other model in my experience, AOA is “there” in the background, as part of the overall stall warning and air data system, but not displayed to the pilots directly.

On the GIV, the AOA correction to altitude and airspeed can be significant in certain flight configurations. It is something we test during the required 24-month re-certification of the air data system. In landing configuration, with full flaps and the AOA vane rotated to a specified high alpha setting, the correction to indicated altitude can be as much as 600 feet.

The only aircraft model I am familiar with where the AOA system can cause an automatic aircraft configuration change is the Falcon 900. If both AOA vanes sense an impending stall, and the leading edge slats are deployed, the inboard slats will automatically retract. I believe this is done to prevent instability in the roll axis from occurring when close to to a stall.

But unlike the 737-8 MCAS - the Falcon autoslat retraction is not a “hidden mystery”. Every Falcon pilot is trained in the existence and operation of the system, and there is are specific preflight tests performed prior to taxi to insure it is working properly. If either AOA vane fails in flight, the autoslat system becomes inoperative with a warning light displayed to alert the crew.

That's a pretty relevant post Thanks and puts it in a nutshell!

[The Bullwinkle]

I’m still really confused as to why the MCAS is being held totally responsible for this crash.
Didn’t this flight and the Lion Air flight both have unreliable airspeed problems immediately after takeoff?
Can somebody please explain how the MCAS system can cause an unreliable airspeed indication after takeoff?
I still don’t understand why a blocked pitot isn’t even being discussed.
It’s my understanding that this was a morning flight (local time).
Could the pitot covers have been left on, or possibly a mud wasp got in there overnight?
At the end of the day, if the engines and the hydraulics were working, why weren’t two qualified pilots able to “fly” the aeroplane in apparently fine weather back to Addis Ababa?
I’m honestly confused as to why everybody seems to be jumping on the MCAS bandwagon!

[73qanda]

Because if it was a case of only a blocked pitot, the plane would have sat trimmed with a nose up bias and very few control inputs would have been required in order for the aircraft to fly away from the ground. It is thought by many ( waiting on report) that the MCAS system trimmed the stab nose down with no command from the pilots to do so, which would necessitate
1/ making more control inputs of greater magnitude in order to allow the aircraft to fly away from the ground
2/ recognising that the trim was running uncommanded
3/ preventing the trim from running uncommanded.

Two different scenarios really.

[The Bullwinkle]

Because if it was a case of only a blocked pitot, the plane would have sat trimmed with a nose up bias and very few control inputs would have been required in order for the aircraft to fly away from the ground. It is thought by many ( waiting on report) that the MCAS system trimmed the stab nose down with no command from the pilots to do so, which would necessitate
1/ making more control inputs of greater magnitude in order to allow the aircraft to fly away from the ground
2/ recognising that the trim was running uncommanded
3/ preventing the trim from running uncommanded.

Two different scenarios really.
But it still doesn’t explain the unreliable airspeed.

[Interflug]

I’m still really confused as to why the MCAS is being held totally responsible for this crash.
Didn’t this flight and the Lion Air flight both have unreliable airspeed problems immediately after takeoff?
Can somebody please explain how the MCAS system can cause an unreliable airspeed indication after takeoff?
I still don’t understand why a blocked pitot isn’t even being discussed.
It’s my understanding that this was a morning flight (local time).
Could the pitot covers have been left on, or possibly a mud wasp got in there overnight?
At the end of the day, if the engines and the hydraulics were working, why weren’t two qualified pilots able to “fly” the aeroplane in apparently fine weather back to Addis Ababa?
I’m honestly confused as to why everybody seems to be jumping on the MCAS bandwagon!

developing on your train of thought, there is a lot of talking about the AoA sensor, but very little about the role of the ADIRU further down the signal chain.
I haven't followed every technically enlightening post here, but isn't for what we know by now the chain of events consistent with some kind of data corruption or software error in the ADIRU and it's related systems?
I wouldn’t rule out ADIRU problems, corrupted code or else.

[gearlever]

I’m still really confused as to why the MCAS is being held totally responsible for this crash.
Didn’t this flight and the Lion Air flight both have unreliable airspeed problems immediately after takeoff?
Can somebody please explain how the MCAS system can cause an unreliable airspeed indication after takeoff?
I still don’t understand why a blocked pitot isn’t even being discussed.
It’s my understanding that this was a morning flight (local time).
Could the pitot covers have been left on, or possibly a mud wasp got in there overnight?
At the end of the day, if the engines and the hydraulics were working, why weren’t two qualified pilots able to “fly” the aeroplane in apparently fine weather back to Addis Ababa?
I’m honestly confused as to why everybody seems to be jumping on the MCAS bandwagon!

FAA EAD 2018-32-51


An erroneous AOA input can cause some or all of the following indications and effects:

- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the option is installed).
- FEEL DIFF PRESS light.
- Autopilot may disengage.
- Inability to engage autopilot.

[Grummaniser]

But it still doesn’t explain the unreliable airspeed.
The AOA is used to calculate an adjustment to the Indicated Airspeed so a faulty AOA will cause the calculation to be unreliable thus causing an Unreliable Airspeed annunciation

[Loose rivets]

I think it was just mentioned that it modifies the static pressures. It would be easy to see why it required information about the angle of the airflow over the static plate.


EDIT - It's just occured to me that if the PF selected the left HS cutout switch in the hope of using the autopilot, he would have been * out of luck. I wonder if he knew those switches had different wiring on the MAX.

[wiedehopf]

I’m still really confused as to why the MCAS is being held totally responsible for this crash.
Didn’t this flight and the Lion Air flight both have unreliable airspeed problems immediately after takeoff?
Can somebody please explain how the MCAS system can cause an unreliable airspeed indication after takeoff?
I still don’t understand why a blocked pitot isn’t even being discussed.


I'm really curious why people don't look at the FDR graphs from the Lion Air flight.
They are readily available.
The airspeed difference between left and right side is about 10 to 20 knots.
The FDR readout is not consistent with a blocked pitot.

The pitot readout as well as the static port readout is corrected for AoA slightly, that is were the Airspeed disagree comes from.
This correction for AoA is small so even with the left AoA reading 21 degrees high the magnitude of the error on speed and altitude is there but both are still in the right ballpark.
I've attached the FDR readout from the first pdf report that was available on the Lion Air crash (with some annotations):
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/1400x1050/fdr_accident_flight_8f862e7792ac7a84d325dad6fd8cca87f44b61fb .jpg

In this graph only the left side altitude readout is plotted, in the preliminary report you can see the difference to the side with working AoA:
https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

Note also that the 100-200 ft altitude dip on rotation is present on the Ethiopian ADSB data as well.
(That alone doesn't mean that there the AoA was misreading in that case as well but i makes it more likely in my opinion)

[A0283]

@ gums US Congress hearing today shoulda had Sully. He knows about AoA, leading edge devices, underslung motors, crew coordination and such.

This Safety Hearing was the 1st in a series of at least 2 hearings. It was announced, and confirmed during this 1st hearing, that Boeing will be invited to the 2nd hearing. Date as yet unknown.
So at this point in time we have two international safety investigations on Lion and Ethiopian, a series of Congressional hearings, FBI investigation (I am not sure if this is technical support or indeed a criminal investigation), and two DoT IG investigations on the 737, the first referring to Southwest engine problems and maintance (perhaps including looking into the insertion of acquired aircraft) and the second on the MAX (which reports to the DoT and parallel to Congress). Not to forget the NTSB safety investigation into the Southwest engine fatality case. They all may add some pieces and answers to the puzzle that we are discussing here.

[Golf-Sierra]

It seems like there is an element of clash between western and eastern culture here. I believe in the previous flight problems with airspeed discrepancy and the stick shaker coming on one side were experienced. And the runaway trim condition was also experienced. Yet - the flight continued to the destination. Is this what would likely happen in Europe or would the pilots elect to make an emergency landing in such circumstances?

I find it hard to believe the crew were not aware what the correct course of action was when they saw there is something blatantly wrong with the automatics in the flight control system. Switch it off! The CVR will explain everything once it is published. They were either trying to troubleshoot the problem and/or some conflict (save face/pull rank) occurred in the cabin.


Golf Sierra

[Fzz]

The 26th bit data error giving ~20 degrees on the AoA signal is compelling. On pressure detections, I'm biased towards the static system.


I'm not convinced by the 26th bit error theory. If you look at the AoA data from the previous flight in Fig 7 on page 16 of the preliminary report, the AoA disagreement is there from the start, but it increases significantly around rotation. This isn't really consistent with it being a constant 22 degree error.

https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

[Bleve]

I’m still really confused as to why the MCAS is being held totally responsible for this crash.
Didn’t this flight and the Lion Air flight both have unreliable airspeed problems immediately after takeoff?
...
I’m honestly confused as to why everybody seems to be jumping on the MCAS bandwagon!

In the aftermath of the AF447 accident, Boeing (and Airbus) substantially changed the Unreliable Airspeed non-normal checklist (NNC). The message that has since been repeatably reinforced is that if there are ANY abnormalities related to airspeed, pilots should NOT make any assumptions as to what indication is right and what is wrong. They should simply run the Unreliable Airpeed NNC methodically until the correct indications are determined. So a stick shaker activating after takeoff (due to a faulty AOA signal) will be treated (and reported to ATC) as 'Unreliable Airspeed'.

The accident scenario that we are discussing might run something like this:
- At rotation stick shaker activates (due to a faulty AOA signal).
- You see normal speed indications.
- Stick shaker at normal indicated airspeeds is NOT logically consistent. Post AF447, that is an Unreliable Airspeed event. (You are NOT jumping to any conclusions at this stage that the IAS is correct and the Stick Shaker is wrong).
- Climb to a safe height and begin the Unreliable Airspeed NNC.
- Report to ATC that you have Unreliable Airspeed (because that is the NNC that you are now working through).
- Manually set a known power and attitude for level flight (the NNC requires the autopilot to be disconnected).
- Unbeknownst to you, MCAS has now been activated because of the faulty AOA signal.
- Your efforts to trim the aircraft for straight and level flight are proving difficult (because of the hidden MCAS intervention). Confusion increases because you can't even establish straight and level flight to continue the NNC.
- You are soon overwhelmed.

[DaveReidUK]

I'm not convinced by the 26th bit error theory. If you look at the AoA data from the previous flight in Fig 7 on page 16 of the preliminary report, the AoA disagreement is there from the start, but it increases significantly around rotation. This isn't really consistent with it being a constant 22 degree error.

And the converse is true of the accident flight - the AoA disagreement reduces around rotation. I don't buy the bad bit theory either.

[gums]

Salute!
And the converse is true of the accident flight - the AoA disagreement reduces around rotation. I don't buy the bad bit theory either.

Ditto, Dave. And we still don't know where the AoA signal comes from. Being "digital" on the FDR, somebody has to be digitizing it unless the sensor outputs digital bits and that does not seem to be the case. My point being that the incorrect AoA could have come from the ADRIU and not the sensor itself.

Gums....

[bsieker]

Can somebody please explain how the MCAS system can cause an unreliable airspeed indication after takeoff?

It doesn't, and I don't see that anyone has implied such. There is, however, a plausible common cause to both MCAS activation and IAS disagree: an erroneous AoA value by one sensor. AoA is used for calculating a correction to static pressure, and both ADIRUs independently calculate airspeed from their respective values for static and total (pitot) pressure. Since the static pressure has been adjusted for AoA, both ADIRUs will come up with different values for indicated airspeed, which will trigger an "IAS disagree" warning, which is a trigger for the unreliable airspeed procedure.

I still don’t understand why a blocked pitot isn’t even being discussed.

Because it doesn't fit the known FDR traces from the Lion Air accident. And from all we have heard, there are huge similarities between the Ethiopian and the Indonesian accident, which even Boeing has acknowledged and led them to recommend grounding the type ("out of an abundance of caution").

Could the pitot covers have been left on, or possibly a mud wasp got in there overnight?

From all we know, very very unlikely.

At the end of the day, if the engines and the hydraulics were working, why weren’t two qualified pilots able to “fly” the aeroplane in apparently fine weather back to Addis Ababa?

That is the 300-million-dollar question, isn't it? Probably because an insidious system did underhanded things, unknown to the crew, which were preoccupied with the Ureliable Airspeed procedures and distracted by a stick shaker. In end, nose-down trim overwhelmed the pilots' ability to control the aircraft.

I’m honestly confused as to why everybody seems to be jumping on the MCAS bandwagon!

Because all symptoms, and all data we know so far are consistent with an inadvertent MCAS activation, and are not consistent with most other plausible explanations.

I would think that Boeing would be the first, if there was any doubt that the Ethiopian accident was very similar to Lion Air, to vehemently deny any MCAS involvement.

Bernd

[Rananim]

I saw the hearing and found it interesting.Cruz asks Erwell towards the end if its true
that there was no information on MCAS provided to pilots.Erwell fumbles a bit and
then responds that the errant MCAS intervention is runaway trim and that is already
covered in the QRH under the Runaway Stabilizer NNC.Boeings AD in
November says the same thing.I think the Committee's investigation will center on this
argument plus the single sensor issue and the controversial decision
to have MAX added to a 1967 certificate as amended type with flimsy
self-administered ipad training.
I think the AoA presentation on the PFD is a red herring but agree that the
dispatch light for AoA disagree is a critical safety feature and should be fitted as
standard equipment.
The stick shaker in my view is still the golden nugget here as it blocks
the auditory channel of both pilots,masking trim runaway and leading
to startle factor for some crews.

[Loose rivets]

My mind's wide open on the D to A error, though I'll remain interested.

Fzz, one post shortly before yours shows the AoA diverging from a commons zero with distinct slopes.

https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-135.html#post10432423

I don't know what to make of that, inasmuch as vanes are flopped anywhere but zero while bouncing along the ground. If t=0 is at some point during the acceleration run then how come they are both zero? Rhetorical question.

[Fzz]

Fzz, one post shortly before yours shows the AoA diverging from a commons zero with distinct slopes.


Ignoring the very left hand side of the graph, it looks to me like neither AoA indicator reads zero until the airspeed increases. This isn't surprising - without airspeed, we'd not expect them to read the same. After airspeed increases, the right AoA settles to zero and the left settles to 20 degrees. Thereafter, the left maintains a constant offset. The information from the previous flight seemed more interesting, as there the offset was not constant - it changed around rotation. If the problem was a fixed offset due to a stuck bit, we'd expect the offset to be constant after the aircraft has airspeed.

What happens at the very left hand side? I've no idea - but I wouldn't necessarily expect the AoA to read zero with no airspeed.

Edit: I think I was reading the previous flight graph wrong. That one also seems to settle into a constant offset as soon as the aircraft has airspeed, rather than around rotation. In which case this does not rule out a digital error.

[netstruggler]

26bits gives a resolution of approx 1 part in 70 million. What on an aircraft needs to be measured to that resolution?

[safetypee]

netstruggler, not a measurement, but the required system integrity?
Two aircraft crashing within months with the same indications involving a supposedly high integrity system - probably a probability of 1 : 70m ;)

[Loose rivets]

netstruggler
Fair comment. It might be the approved chips just happen to be available/standardized on, but it wouldn't explain how one bit error would be such a large proportion of the full scale deflection.

[safetypee]

Loose rivets, et al, see:-
https://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html

[DaveReidUK]

26bits gives a resolution of approx 1 part in 70 million. What on an aircraft needs to be measured to that resolution?

It doesn't need 26 bits. It needs, amongst others, Bit Number 26 (Bits Nos 17 to 29, in fact).

LSB is 0.044° (though I doubt an AoA vane can actually measure even to that precision).

[Loose rivets]

Thank you safetypee!!!!!!!!!!!!! That has been my exact point so many times.

If assessed against "unlimited", it would have been hazardous. That must also be assessed in the context of the aft column cutout switch being disabled.

The decision to disable the aft column cutout switch may not have been assessed as a hazard at all. Yet, this was the most threatening change made by Boeing, and very likely took away the last thread for survival on JT610 and I fear ET302.

[MarcK]

If the problem was a fixed offset due to a stuck bit, we'd expect the offset to be constant after the aircraft has airspeed. Stuck bits are more likely an optical encoder error in the AOA vane, not a software error.

[Maninthebar]

Stuck bits are more likely an optical encoder error in the AOA vane, not a software error.

How likely is that in two different aircraft (or maybe more if we take into account NASA reports)? Is that a possible QC issue at manufacture?

(I realise that I have jumped to more conclusions than a champion pole vaulter)

[GordonR_Cape]

Stuck bits are more likely an optical encoder error in the AOA vane, not a software error.

Wow! You have just reminded me of something that caused us a great deal of trouble, on a completely different different piece of equipment. Our electric gate motor closing mechanism used to give problems, due to contamination of the digital encoding optical sensor (a glorified rotary counter).

I know the AOA is completely different sensor, but in the context of this thread that might consistently produce a consistent bit-flip (20 degrees) error.

How likely is that in two different aircraft (or maybe more if we take into account NASA reports)? Is that a possible QC issue at manufacture?

(I realise that I have jumped to more conclusions than a champion pole vaulter)

Possible QC error that only reveals after a few months service?

In our case it was it was an oil leak from the bearing that got onto/contaminated the optical sensor.

[HighWind]

Stuck bits are more likely an optical encoder error in the AOA vane, not a software error.
An absolute encoder is usually encoded with gray code or something similar, and I would expect a SIL3 encoder to have two encoders on the same shaft to make it fault silent.
Is IEC61508 SIL used in aircraft ?
https://www.tr-electronic.com/products/sil.html

[mm43]

Stuck bits are more likely an optical encoder error in the AOA vane, not a software error.

IF the vane had been changed out after displaying the same problem on JT43, then the accident flight JT610 wouldn't have had the same error.

The offset IMO is a downstream A/D problem, that wasn't picked up probably because there was no comparison made between AoA vane physical position and A/D output prior to and after changing the vane.

[pilot9250]

No, not wrong focus. Nobody is advocating RTO above Vr unless unlimited runway is available. A faulty AOA could give a stick shaker on take-off rotation in any airplane whether it has MCAS or not. The point I am trying to make is if the airplane is climbing & accelerating normally & stick shaker is on one side only, it is an AOA failure & not a valid stall warning. The correct response to this is to return & land the airplane. Get it fixed! You don't accelerate, clean up the flaps & try to continue the flight with an active stick shaker as Lion Air did on two occasions, only one of which was successful (barely).

I guess there's not much on here that hasn't already been written.

"Runaway stab" was the real problem and isn't normally accompanied by all the other indications and certainly isn't trained that way. Nor did it start until after clean up and certainly wasn't visible at Vr.

I think the correct question is how did two professionally trained crews fly it into the ground?

While agreeing with you the best response, and perhaps many crews would find it, I don't find clean up and climb obviously unintuitive.

Perhaps the nuts and bolts of this is why was a reasonable intuitive response so dangerous?

[Towhee]

That no one who wrote the MCAS software for the 737 MAX seems to have even raised the issue of using multiple inputs, including
the opposite angle of attack sensor, in the computer’s determination of an impending stall is mind-blowing. As a lifetime member
of the software development fraternity, I don’t know what toxic combination of inexperience, hubris, or lack of cultural understanding led to this.

But I do know that it’s indicative of a much deeper and much more troubling problem. The people who wrote the code for the
original MCAS system were obviously terribly far out of their league and did not know it. How can we possibly think they can
implement a software fix, much less give us any comfort whatsoever that the rest of the flight management software, which is
ultimately in ultimate control of the aircraft, has any fidelity at all?

https://drive.google.com/file/d/1249KS8xtIDKb5SxgpeFI6AD-PSC6nFA5/view


Travis is unequivocal in his assessment of the Boeing 737 MAX. “It’s a faulty airframe. You’ve got to fix the airframe [and] you can’t fix the airframe without moving the engines” back and away from their current position.The root problem with the engine-forward design is “once this thing pitches up, it wants to keep pitching up,” said Travis. “That’s a big no-no,” he continued, because pitch-up on an aircraft increases angle of attack.

....Travis insists that the pilots of the two fatal 737 MAX flights could not have overridden the system no matter how hard they pulled on the yoke. The only way the system could be overridden was by hitting a circuit breaker that should have been prominently displayed among the 737 MAX controls.


https://www.eetimes.com/document.asp?doc_id=1334482#

[Loose rivets]

The vanes are a supreme bit of kit. As posted earlier, they probably have an AC voltage out, continuously variable, centred on 0, and swinging + or _ . this is derived by a reference AC voltage in, and variable transformer coupling either side of zero - proportional to the vane angle.

Most non-scheduled vane changes are because of heater failure. That constant-ish error 'must' be due to downstream electronics.

Let's get back to the recent thrust of the thread. What other factors added to the vane's error signal and so radically confused two separate crews?

[yanrair]

I'm really curious why people don't look at the FDR graphs from the Lion Air flight.
They are readily available.
The airspeed difference between left and right side is about 10 to 20 knots.
The FDR readout is not consistent with a blocked pitot.

The pitot readout as well as the static port readout is corrected for AoA slightly, that is were the Airspeed disagree comes from.
This correction for AoA is small so even with the left AoA reading 21 degrees high the magnitude of the error on speed and altitude is there but both are still in the right ballpark.
I've attached the FDR readout from the first pdf report that was available on the Lion Air crash (with some annotations):
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/1400x1050/fdr_accident_flight_8f862e7792ac7a84d325dad6fd8cca87f44b61fb .jpg

In this graph only the left side altitude readout is plotted, in the preliminary report you can see the difference to the side with working AoA:
https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

Note also that the 100-200 ft altitude dip on rotation is present on the Ethiopian ADSB data as well.
(That alone doesn't mean that there the AoA was misreading in that case as well but i makes it more likely in my opinion)
good analysis Wiedehopf. The ias disagree messsges and stick shakers may have caused confusion. But this was not an airspeed disagree crash like AF447 but a Stabilizer running fully nose down. We know why. It was not noticed &or stopped for reasons yet to be determined. Stopping the STAB and retrimming would have made the plane fly normally. Straight and level. As the day before. Even with IAS DISAGREE The pilots would still have GPS, pitch and power and one IAS would have been reading correctly- possibly two. THE SBY ASI should have been ok. As well as the unaffected side? These are all supposition but are possible scenarios given the info so far. For me the fact that the previous flight had similar problems with totally different outcomes is significant.
I am not sure if the safety office had picked up on the previous incident.

[yanrair]

I am glad to see this topic being broached. The present incident has in common with other LOC incidents the feature that the crew is faced with an all of nothing situation. Continue to rely on automation which may exacerbate a bad situation, or choosing to go manual which may be a time consuming and unfamiliar transition in a situation where time is of the essence. This is akin (worse) that a car driver having to disable power steering and brakes because of a malfunctioning cruise control. Surely there should be a lower level of automation the pilot could revert to but still giving him/her power assistance with the control surfaces, and some degree of automatic recovery, while bypassing higher level problems. This lower level should involve only the most basic, reliable components. Does Airbus do this already?
The 737-Max can of course be flown in total manual mode. It’s about the only series of models that can- all 737s can.
You can even lose ALL hydraulic and all AC POWER and it still flies.

[Ian W]

I guess there's not much on here that hasn't already been written.

"Runaway stab" was the real problem and isn't normally accompanied by all the other indications and certainly isn't trained that way. Nor did it start until after clean up.

I think the correct question is how did two professionally trained crews fly it into the ground?

While agreeing with you the correct response, and perhaps many crews would find it, I don't find clean up and climb obviously unintuitive.

Perhaps the nuts and bolts of this is why was a reasonably intuitive response so dangerous?

My highlight.
Sim training in some places seems from comments here to be very samey. So the expectations of the people writing the NNC and the trained reactions of the crews have diverged significantly.

The designers obviously felt that the worse thing to happen would be a crew switching stab trim off in the highly unlikely event that the AoA failed (they probably checked failure rates in NGs). Seems that for some crews switching stab trim off is very unlikely even when the trim is motoring way down and making things uncomfortably heavy and for some reason the AoA vanes have a lot higher failure rate in the Max.

[Loose rivets]

It would be interesting to know if when the vanes are stripped by the manufacturer, any fault whatsoever is found.

[Realbabilu]

AOA vane position is not valid until up to an airspeed well above that for taxi. Revised MCAS logic keeps MCAS from acting at all if an AOAs signals differ by anywhere near as much as appears to have been the case with the Lion Air accident data. I don't think the MCAS changes do anything for stick shaker so the shaker on the side with AOA failed high would activate as it did on Lion Air, but no MCAS.

Yes, I think the software fix will be mcas disabled due aoa disagree or limiting it power. Hopefully the aircraft still in stable envelope. The training with mcas should be mandatory. Since there no mention of mcas notification.

The ground aoa sensor system troubleshooting need to be fixed also, since it somehow seems more fragile than NG series, and lion air ground crew can't fix it.

[patplan]

Possibly a reposting of what had happened minute by minute on that Lion Air PK-LQP Flight JT610, as found on pp.1-3 of The Lion Air PK-LQP Preliminary Crash Investigation Report:

1 FACTUAL INFORMATION
1.1 History History of the Flight of the Flight
On 29 October 2018, a Boeing 737-8 (MAX) aircraft registered PK-LQP was being operated by PT. Lion Mentari Airlines (Lion Air) as a scheduled passenger flight from Soekarno-Hatta International Airport (WIII), Jakarta1 with intended destination of Depati Amir Airport (WIPK), Pangkal Pinang2. The scheduled time of departure from Jakarta was 0545 LT (2245 UTC3 on 28 October 2018) as LNI610.

At 2320 UTC, the aircraft departed from Jakarta using runway 25L and intended cruising altitude was 27,000 feet. The LNI610 pilot was instructed to follow the Standard Instrument Departure (SID) of ABASA 1C4.
According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adult, one child and two infants. The voyage report5 showed that the number of flight attendant on board was six flight attendants.
The Digital Flight Data Recorder (DFDR) recorded a difference between left and right Angle of Attack (AoA) of about 20° and continued until the end of recording. During rotation the left control column stick shaker activated and continued for most of the flight.

Shortly after departure, the Jakarta Tower controller instructed LNI610 to contact Terminal East (TE) controller. At 23:21:22 UTC, the LNI60 SIC made initial contact with the TE controller who responded that the aircraft was identified on the controller Aircraft Situational Display/ASD (radar display). Thereafter, the TE controller instructed the LNI610 to climb to altitude 27,000 feet.

At 23:21:28 UTC, the LNI610 SIC asked the TE controller to confirm the altitude of the aircraft as shown on the TE controller radar display. The TE controller responded that the aircraft altitude was 900 feet and was acknowledged by the LNI610 Second in Command (SIC).

At 23:21:53 UTC, the LNI610 SIC requested approval to the TE controller “to some holding point”. The TE controller asked the LNI610 the problem of the aircraft and the pilot responded “flight control problem”.
The LNI610 descended from altitude 1,700 to 1,600 feet and the TE controller then asked the LNI610 of the intended altitude. The LNI610 SIC advised the TE controller that the intended altitude was 5,000 feet.

At 23:22:05 UTC, the DFDR recorded the aircraft altitude was approximately 2,150 feet and the flaps were retracted. After the flaps reached 0, the DFDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim.

At 23:22:31 UTC, the TE controller instructed the LNI610 to climb and maintain altitude of 5,000 feet and to turn left heading 050°. The instruction was acknowledged by the LNI610 SIC.

At 23:22:48 UTC, the flaps extended to 5 and the automatic AND trim stopped.

At 23:22:56 UTC, the LNI610 SIC asked the TE controller the speed as indicated on the radar display. The TE controller responded to the LNI610 that the ground speed of the aircraft shown on the radar display was 322 knots.

At 23:24:51 UTC, the TE controller added “FLIGHT CONT TROB” text for LNI610 target label on the controller radar system as reminder that the flight was experiencing flight control problem.

At 23:25:05 UTC, the TE controller instructed the LNI610 to turn left heading 350° and maintain altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:25:18 UTC, the flaps retracted to 0. At 23:25:27 UTC, the automatic AND trim and flight crew commanded ANU trim recorded began again and continued for the remainder of the flight.

At 23:26:32 UTC, the TE controller instructed the LNI610 to turn right heading 050° and maintain altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:26:59 UTC, the TE controller instructed the LNI610 to turn right heading 070° to avoid traffic. The LNI610 pilot did not respond to the TE controller‟s instruction, thereafter, the controller called the LNI610 twice who responded at 23:27:13 UTC.

At 23:27:15 UTC, the TE controller instructed the LNI610 to turn right heading 090° which was acknowledged by the LNI610 SIC. A few second later, the TE controller revised the instruction to stop the turn and fly heading 070° which was acknowledged by the LNI610 SIC.

At 23:28:15 UTC, the TE controller provided traffic information to the LNI610 who responded “ZERO”. About 14 seconds later, the TE controller instructed the LNI610 to turn left heading 050° and maintain an altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:29:37 UTC, the TE controller questioned the LNI610 whether the aircraft was descending as the TE controller noticed that the aircraft was descending. The LNI610 SIC advised the TE controller that they had a flight control problem and were flying the aircraft manually.

At 23:29:45 UTC, the TE controller instructed the LNI610 to maintain heading 050° and contact the Arrival (ARR) controller. The instruction was acknowledged by the LNI610 SIC.

At 23:30:03 UTC, the LNI610 contacted the ARR controller and advised that they were experiencing a flight control problem. The ARR controller advised LNI610 to prepare for landing on runway 25L and instructed them to fly heading 070°. The instruction was read back by the LNI610 SIC.

At 23:30:58 UTC, the LNI610 SIC stated “LNI650 due to weather request proceed to ESALA8” which was approved by the ARR controller.

At 23:31:09 UTC, the LNI610 PIC advised the ARR controller that the altitude of the aircraft could not be determined due to all aircraft instruments indicating different altitudes. The pilot used the call sign of LNI650 during the communication. The ARR controller acknowledged then stated “LNI610 no restriction”.

At 23:31:23 UTC, the LNI610 PIC requested the ARR controller to block altitude 3,000 feet above and below for traffic avoidance. The ARR controller asked what altitude the pilot wanted.

At 23:31:35 UTC, the LNI610 PIC responded “five thou”. The ARR controller approved the pilot request.

At 23:31:54 UTC, the FDR stopped recording.

The ARR controller attempted to contact LNI610 twice with no response. At 23:32:19 UTC, the LNI610 target disappeared from the ASD and changed to flight plan track. The ARR controller and TE controller attempted to contact LNI610 four more times with no response.
The ARR controller then checked the last known coordinates of LNI610 and instructed the assistant to report the occurrence to the operations manager.
The ARR controller requested several aircraft to hold over the last known position of LNI610 and to conduct a visual search of the area.
About 0005 UTC (0705 LT), tug boat personnel found floating debris at 5°48'56.04"S; 107° 7'23.04"E which was about 33 Nm from Jakarta on bearing 56°. The debris was later identified as LNI610.


It appeared At 23:31:09, they started losing their battle to control the aircraft as they could not overcome the MCAS nose down trim. And at 23:31:23, they were still trying their best effort to battle the MCAS, even though it appeared the battle had been already lost some 10-20 seconds ago.


From pp. 14-15 of the Lion Air PK-LQP Preliminary Crash Investigation Report:
https://i.ibb.co/dGQm5j9/fig1.png
.. (https://ibb.co/xJMF7Xv)

https://i.ibb.co/Vwks8Dm/fig2.png (https://ibb.co/J3S9P2Q)
..


The leaked CVR recording [albeit only partially confirmed by the official] seemed to indicate the two pilots had been very calm and composed even just seconds before the impending crash.

[SLF3]

WSJ reporting that the SWA contract for the Max had a penalty of USD 1 million per aircraft if ‘additional training’ (undefined) was required to fly it, and that they bought 280 aircraft.

[EDLB]

It has probably no bearing here but ATC should question itself if it is a good idea, to vector a plane around in 30 second intervals if it already stated flight control problems. You would think that they immediate trade that as emergency even when not declared. That vectoring distracts the already over 100% mentally loaded crew.

If that WSJ report is correct you might wonder if SWA might get sued by some victims too. By contract forcing an aircraft manufacturer to cut corners on certification sounds strange.

[EDLB]

I think that Unhook is right in a way, that Boeing installed a “poor mans” version of alpha floor protection in the 737 MAX. However without the redundancy and thorough safety analysis required for flight control surface operations.

[blind pew]

Reuter’s article that EASA recognised the problem in 2016 but it wasn’t included in flight manuals.
https://uk.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUKKCN1RA0DP

[aeronaut321]

I believe they are referring to this EASA Explanatory Note to TCDS IM.A.120 - Boeing 737 - Issue 10:
(sorry can't post URL but it can be found in EASA document library >product certification >type certificate data sheets (tcds) )


​STATEMENT OF ISSUE
The aisle stand trim switches can be used to trim the airplane throughout the flight envelope and
fully complies with the reference regulation Simulation has demonstrated that the thumb switch trim
does not have enough authority to completely trim the aircraft longitudinally in certain corners of
the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear
down/flaps up, at speeds above 230 kts.
In those cases, longitudinal trim is achieved by using the manual stabilizer trim wheel to position
the stabilizer. The trim wheel can be used to trim the airplane throughout the entire flight envelope.
In addition, the autopilot has the authority to trim the airplane in these conditions.
The reference regulation and policy do not specify the method of trim, nor do they state that when
multiple pilot trim control paths exist that they must each independently be able to trim the airplane
throughout the flight envelope.
Boeing did not initially consider this to be a compliance issue because trim could always be
achieved, even during the conditions where use of the aisle stand trim switch was required.
Subsequent to flight testing, the FAA-TAD expressed concern with compliance to the reference
regulation based on an interpretation of the intent behind “trim”. The main issue being that
longitudinal trim cannot be achieved throughout the flight envelope using thumb switch trim only.
EASA POSITION
Boeing set the thumb switch limits in order to increase the level of safety for out-of-trim dive
characteristics (CS 25.255(a)(1)). The resulting thumb switch limits require an alternative trim
method to meet CS 25.161 trim requirements in certain corners of the operational envelope.
The need to use the trim wheel is considered unusual, as it is only required for manual flight in
those corners of the envelope.
The increased safety provided by the Boeing design limits on the thumb switches (for out-of-trim
dive characteristics) provides a compensating factor for the inability to use the thumb switches
throughout the entire flight envelope. Furthermore, the additional crew procedures and training
material will clearly explain to pilots the situations where use of the trim wheel may be needed due
to lack of trim authority with the wheel mounted switches.
The trim systems on the 737Max provide an appropriate level of safety relative to longitudinal trim
capability.​​​​​​

[blind pew]

Additional procedures and training needed to “clearly explain” when the manual wheel might be needed, according to the document. The EASA spokesman said that was a reference to the Boeing flight crew operations manual.
apparently this wasnt done.

[ecto1]

I think that Unhook is right in a way, that Boeing installed a “poor mans” version of alpha floor protection in the 737 MAX. However without the redundancy and thorough safety analysis required for flight control surface operations.
One more time: MCAS is not there to correct/avoid stalls. Only to force the pilot to pull a little bit harder to induce it than without it, but not more so than in a NG.

I think it is a very bad idea, but it's important to get facts straight, it's not a bad idea because they wanted to go all "airbus" about it suddenly.

Fundamentally it's a bad idea because we as humans cheated at solitaire, we created something that allows us to pass a rule that we wrote (pitch moment vs aoa curve test), without getting the good things that the rule is supposed to grant (pitch moment vs aoa at real life speed). And then the added complexity bit us, partly because no engineer is going to give very much thought to a system which is anyway useless in a real life scenario. It's kind of dieselgate all over, only poor man's version of it. And murderous.

[patplan]

Investigators reportedly believe Boeing 737 Max anti-stall system activated before Ethiopia crash

Investigators looking into the fatal Ethiopian Airlines crash (https://www.cnbc.com/2019/03/10/ethiopian-airlines-flight-302-no-survivors-in-crash-of-boeing-737.html) involving a Boeing (https://www.cnbc.com/quotes/?symbol=BA)737 Max plane are said to have reached a preliminary conclusion that an anti-stall system on board misfired, the Wall Street Journal reported Friday (https://www.wsj.com/articles/investigators-believe-737-max-stall-prevention-feature-activated-in-ethiopian-crash-11553836204?ns=prod/accounts-wsj).

Based on data retrieved from the flight’s black boxes, the stall prevention system — known as the MCAS, or Maneuvering Characteristics Augmentation System — activated automatically before the plane nose-dived into the ground, the Journal said, citing people briefed on the matter.

Those sources told the WSJ the preliminary finding is subject to revisions and one of the people said the U.S. government air-safety experts have been analyzing details gathered from the Ethiopian investigators.

Boeing did not immediately respond to a request for comments sent outside office hours...


Source:
- https://www.cnbc.com/2019/03/29/ethiopian-crash-boeing-737-max-anti-stall-system-likely-activatedwsj.html

[PEI_3721]

aeronaught321, #2730, I agree with your interpretation of the Reuter’s article linked by blind pew, #2729. This should be read by everyone contributing to this thread.
https://uk.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUKKCN1RA0DP

The point being made relates to an existing issue discussed in the thread https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html which refers to the separate problem of ‘runaway’ trim.

However, this is very relevant to the accident discussion because of the accumulated incremental trim change due to MCAS malfunction can result in the same trim condition.
The difficulties in flying the aircraft in a nose-down mis-trim situation are identified in the Reuter’s article (pilot quotes). Further to this, in a situation where MCAS involves incorrect high AoA value, the inferred stall condition appears to change the pitch feel, with further increase in nose-down control forces, i.e. it is possible - even most probable based on the Lion accident, that the aircraft can reach a condition from which it is physically unrecoverable.

If the Boeing ‘MCAS’ mods sufficiently restrict the trim movement then such high forces should not be encountered, but in some circumstances (failed high AoA) the feel system additive could still apply.

EASA, other regulators, and FAA could revisit the runaway trim certification to check if any of the 737 Max physical, aerodynamic, or engineering changes (cable friction), change the level of out of trim force and thus affect the ability to recover the aircraft, or even if the difficult, unusual manoeuvre required (tech log) is viable based on modern pilot experience, sufficiently trainable, and can be identified in time.

[derjodel]

It has probably no bearing here but ATC should question itself if it is a good idea, to vector a plane around in 30 second intervals if it already stated flight control problems. You would think that they immediate trade that as emergency even when not declared. That vectoring distracts the already over 100% mentally loaded crew.

If that WSJ report is correct you might wonder if SWA might get sued by some victims too. By contract forcing an aircraft manufacturer to cut corners on certification sounds strange.

No. Boeing promised something even SWA found had to believe. So hard in fact they wanted to guard themselves against it. If anything this shows how Boeing execs live in their own reality where you can expand 50 years old airframe ad infinitum...

Reality of corporate world. Politics and power. People who speak the truth get labeled as "being negative" and find themselves out of the company. But yeah, sooner or later it fires back.

[Torquelink]

From Bjorn Fehrm of Leeham today:

This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.

https://leehamnews.com/wp-content/uploads/2019/03/AOA_VaneIndicator_AoA_Disagree_lg.jpg (https://leehamnews.com/wp-content/uploads/2019/03/AOA_VaneIndicator_AoA_Disagree_lg.jpg)

Figure 1. The improved Pilot’s Primary Flight Display presented Wednesday. Source: Boeing.Boeing’s MCAS fix casts light on the original implementationBoeing presented its fix for the MCAS problems Wednesday. By it, it spotlights what was wrong with the original implementation.The reliance on a single triggering signal for MCASA lot has been written about the MCAS system relying on a single Angle of Attack input. This is unusual for systems involved in the flight control of aircraft. Normally you have three inputs so a voting procedure can sort out one of them if it has a problem (two singling out the third as faulty).

The 737 has only two Angle of Attack sensors, so no voting can be set up between them. Instead, the system relying on the sensors can be switched off if the sensors disagree and the pilot informed about the missing function.

This is the route chosen for the improved MCAS. It will now be disconnected when the sensed Angle of Attack difference is beyond 5.5 degrees when MCAS activates and over 10 degrees for over 10s when the system is in use.

The wide allowed difference shows what I have written about before. The aerodynamics around these sensor vanes, placed at the nose sides, is dependent on how the aircraft is flown. If there is a sideslip the airflow passing the sensors will be affected and the sensor values will differ.

The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.

Was the use of only one signal OK to trigger the original MCAS? No, it wasn’t. But at least there was a rationale for this decision, whatever one might think about the rationale. A deactivation of MCAS was not an acceptable solution as it would trigger a need for an MCAS not available signal and this would mean more difference training for the Pilots migrating from 737ng to MAX.The design of the original MCAS functionWhile the reliance on a single sensor is highly questionable, the architecture and implementation of the original MCAS function in inexcusable.

If you have a flight control function which is triggered by a single sensor, it means the likelihood it being incorrectly activated is there. Then you implement a nonhazardous augmentation function!

You make sure it only injects the minimum correction necessary and you limit its total authority to not jeopardize the safe flight of the aircraft.

Where others focus on a single trigger signal, my biggest problem is with the function itself. If you have a weak trigger architecture, you limit the authority of what you trigger!

There was no need for the authority MCAS got. We know this today as the software fix only trims once for each elevated Angle of Attack event and limits the total trim amount to a safe level. This is regardless of the sensors being wrong or the function running wild.

It was just a very, very bad function design, and there was no need for it.Designed to not show, it became the centerpiece of attentionMCAS was a function put there to cater for a very remote case. The pilot needs to maneuver close to the limits of the aircraft and way beyond normal flying practice, to save the aircraft from some emergency. Then MCAS kicked in to make the aircraft easy to fly close to its limits.

In the life of a commercial 737 MAX pilot he should never experience an MCAS augmentation, its use case was so remote. Instead, it became the most known and explained function of all on the 737 MAX. And for the wrong, very sad reasons.

There are only a few airliner OEMs in the world. There is a reason for this. It’s a challenging product to get right and the stakes are very high for any mistakes. In today’s very safe air transport system mistakes of this scale are non-acceptable.

[fizz57]

...... However without the redundancy and thorough safety analysis required for flight control surface operations.

This cavalier approach has killed people before - Amsterdam 2009 comes to mind. There Boeing had a clear warning of the dangers of a single unmonitored sensor making flight-critical inputs, but chose to ignore it on the mitigating factor of the poor crew response to the problem (familiar?)

[PiggyBack]

From Bjorn Fehrm of Leeham today:

If you have a flight control function which is triggered by a single sensor, it means the likelihood it being incorrectly activated is there. Then you implement a nonhazardous augmentation function!
.

This all comes back to a proper hazard/failure analysis and that the analysis needs to include the possibiity of all failures including software failures. If safety relies on SW to ensure that the augmentation function is non-hazardous then the risk of that SW failing needs to be controlled appropriately. In this case the MCAS SW even after the fix clearly has a level of at least hazardous and needs to be developed to at least DO-178 - level B. Was/is this the case for MCAS? If it is not then the fix should not be accepted.

It is important that looking at the root cause of this accident that the investigation does nots stop at the pilots actions and the poor design of MCAS but is pursued as far back as possible into why the design error occured, why it was not picke dup as a problem in development and why the aircraft was certified despite having a design error which could cause a hazardous situation to arise so easily.

[concernedengineer]

The 737-Max can of course be flown in total manual mode. It’s about the only series of models that can- all 737s can.
You can even lose ALL hydraulic and all AC POWER and it still flies.


Yanair,

Thank you for your reply. This illustrates the point I am trying to make. I've learned a great deal about the 737 max from following the posts on this long thread, and have learned that the 737 is one of the few airliners that can be flown completely manually. I've also learned, correct me if I'm wrong, that manual recovery from from a seriously out of trim situation involves turning a jackscrew 10's of times to move the horozontal stabilizer back to neutral against strong aerodynamic forces.

What I learned as well was that horizontal stabilizer fulcrum is at the back of the stabilizer, and the jack screw moves the front edge. This means that aerodynamic forces push the stabilizer harder to extreme up or down positions the further it is from neutral and the higher the airspeed. The scenario has been discussed (forgive me if I can't find it in this long thread) where the pilot desperately accellerates to try to gain altitude resulting in a situation where the forces are too great to recover the trim manually.

Consider the situation if the pilot has the option of maintaining power to the trim, and other control surfaces, while shutting off other automated functions. Firstly he/she has a much easier decision than going completely manual and, once taken, will be able to make trim corrections much more quickly and against a much larger force.

Consider, also an option with a higher level of automation, but still using the most reliable and time tested components and software, where, upon activation by the pilot, sets the ac controls to best obtain level and stable flight. The 'panic' button. This way the pilot can start recovery more easily and from a known state.

These options do not absolve the manufacturer from culpability, but make it much easier to recover from higher level automation errors which inevitably will occur as aircraft automation gets more and more complex.

My question again is: Is this all or nothing choice unique to Boeing? Does Airbus offer a more graduated approach?

[infrequentflyer789]

The point being made relates to an existing issue discussed in the thread https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html which refers to the separate problem of ‘runaway’ trim.


I think this may be right, but that it may also or instead be referring to the "stabilizer trim limit switches", note that "There are different limits for manual, autopilot, and for flaps up and flaps down." - well at least for the NG.

The trim wheels in contrast will run the jack screw to the physical stops, I believe (if you can get there against the aero loads, which the other thread covers). MCAS may also be only limited by the physical stop (singular, since it only runs one way, well should only run one way).


However, this is very relevant to the accident discussion because of the accumulated incremental trim change due to MCAS malfunction can result in the same trim condition.


To my mind it also blows a hole in the reported design assumptions for the MCAS "reset". MCAS design apparently assumed that if the pilots touched the trim switches, they would get the aircraft back in trim and therefore the total mis-trim due to MCAS was limited. This assumption was clearly wrong on pilot behaviour, but it seems possible it was also more fundamentally wrong in that (as I read it) there are known areas of the flight envelope where it is not possible to get the a/c in-trim with the switches. This means the "reset" assumption was never valid, even before it was tested with real pilots.

[Fortissimo]

Please can we stop conflating Boeing's MCAS and Airbus' ALPHA PROT? The latter is part of an envelope protection system, whereas MCAS addresses handling characteristics (stick forces) at or near the stall.

[A0283]

Sincerely, .. there is something deeply worrying .. and if it continues (and I am afraid it will, as such things have a momentum of their own), will become deeply disturbing. The following may sound a bit abstract, but it has real, deeply, and widely ranging consequences.

Simplified and compressed, this worry is based on when you rank the growth level of an organization on a scale of: failing - bad - normal - good(objectively factbased&datadriven) - best(culture).

What sets the aerospace industry apart from all others is that over a period of many years it has established a safety culture. And it should be very clear that “culture” is on a level above “factbased and datadriven”. Some subordinate examples: In compliance ‘cultural compliance’ standing above ‘tick-box compliance’. In legal the ‘intent of the law’ standing above ‘the letter of the law’. Etc, etc,..

So when a person uses ‘factbased and datadriven’ in a conversation on aviation safety, I read that as driving a level down from where we are. When he or she repeats that a number of times, then it suggests systemic issues. And the higher ranked a person is, the more serious it gets and the more persistent it will be.

Take the March 27th, 2019, Senate Appropriations Hearing on the 2020 Budget for the Transportation Department. The Secretary of Transportation using the words (when discussing the 737 MAX events and developments): .. “the FAA is professional and fact based” .. “they [FAA] are very fact based” .. and .. “on Wednesday March 13th .. [flight data on] the first 3 minutes of flight [became available] that showed similarity [with the Lion Air crash data] .. physical evidence .. [together this] was the first factual evidence”..

Take the March 27th, 2019, Senate Subcomittee Hearing on Airline Safety. The (Acting) Administrator of the FAA (in this hearing triggered by 737 MAX events) using the words: ... “[FAA’s] fact based data driven approach” .. “data driven” .. “data based” ..

You could use the sketched ranking approach yourself, to reflect on a number of issues that still await an answer.

The FAA administrator was asked on the grounding of the 737 MAX why the FAA was “lagging and not leading”, as most other authorities, countries and airlines had grounded the MAX [days] before, and the administrator holding the FAA as the ‘Golden Standard of safety in aviation’. He answered that the FAA operates “fact based” and that the facts only obtained on the 13th were required before ‘ordering’ a grounding. So the question here is, and we need more information to answer that clearly, is if these other international parties were basing their decisions on cultural grounds or on factbased & datadriven grounds.

The FAA administrator pointed to the 57,000 flights of the 737 MAX in the USA till now. These flights did not provide [any] data that gave them [the FAA, but as he stated also Boeing and three US major airline pilot associations] [any] worries on the 737 MAX. [This implies that AoA vane, or AoA data, or outputs based on AoA data, gave them no worries . A question in quite a few Pprune posts. It does not answer the Pprune questions if there was any activation of MCAS. And writing this I wonder if MCAS activation would be FDR/QAR recorded at all or would be a derived parameter]. Interesting of course is, considering the global effect of FAA decisions, if FAA decisions should be based on US data alone !! This might turn into a fundamental question. It puts my own question on (non-US) ‘launch airline’ capabilities in a new perspective.

The FAA administrator pointed out, when asked about ‘non-positive’ pilot and engineers statements quoted in newspapers on issues and problems, that there were no reports in [any] ‘ASRS’ or ‘whistleblower reporting system’ that pointed to something. He could not answer the question if Boeing had an ODA whistleblower reporting system and if and how that functioned. So a question to be answered is, if the FAA data capture has been wide enough (nationally and internationally).

[VicMel]

I've attached the FDR readout from the first pdf report that was available on the Lion Air crash (with some annotations):
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/1400x1050/fdr_accident_flight_8f862e7792ac7a84d325dad6fd8cca87f44b61fb .jpg

In this graph only the left side altitude readout is plotted, in the preliminary report you can see the difference to the side with working AoA:
https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf


Thank you wiedehopf, your annotations have helped me a lot to make sense of the preliminary report.

I have worked for years on the software for aircraft ‘black boxes’ and spent many long days trying to diagnose ‘why is the system doing that??’, usually in a test rig environment, but also post test flight. For what its worth, my diagnostic based on your information is as follows:-
1) There is nothing wrong with the AoA vane in itself. After the left stick shaker kicks in, both sides match perfectly (apart, obviously, the fixed offset), every little blip occurs on both L & R AoA – neither vane is bent/ frozen/ dirty.
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt.
3) The offset is not due to a ‘stuck bit’. The offset in AoA as the aircraft first started to move is about 12 deg, increases to about 17 deg and then settles on about 22 deg. A stuck bit would be 22.5, or 11.25, or 5.625; to get 17 deg would take two ‘stuck’ bits. Besides which serial buses of themselves (e.g. ARINC 429) do not have ‘stuck’ bits, they have multi bit corruption, usually recognised as a ‘bad message’ and rejected.
4) The AoA digital signal goes into the applicable ADIRU for further processing. Part of this processing *should have been* to reject any invalid input!! Another part will be to smooth the data to get rid of the noise, but this is the same software in both ADIRUs, so would not give an offset.
5) ‘Light bulb’ moment -
From Bjorn Fehrm of Leeham today:

This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.

The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.


The software in the two ADRIUs is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit, so I believe they probably use different correction tables, or the algorithm to apply to them is subtly different, possibly something as simple as using a wrong sign.

I know which bit of code I would be diving into now!

[Fortissimo]

You would expect Boeing to be gathering data from its global fleet as part of its normal product safety activities because it is core to any airworthiness assurance process. It follows that the FAA, as the lead regulator for MAX certification and continuous airworthiness, should be kept informed about the global picture by the manufacturer. As a hypothetical example, it would be madness for the FAA not to be involved in the issue of a service bulletin that only fixed problems with the left inboard spoiler for aircraft based in Europe because that is where all the occurrences had been reported.

The MAX fleet is still small, it is still very early in its service life, and it should not be a surprise that (possibly) the only 2 known failures of the system have occurred outside the USA. But if the Administrator is taking the view that 'it hasn't happened here so it doesn't count', confidence in the CAW process is going to take an even bigger hit.

[alf5071h]

A0283, #2743 :ok:
I agree about the general concerns and risk of escalation.

Meanwhile this forum should ‘cut the design engineers some slack’. These are people doing their normal day job, doing their best given the circumstances at the time.
We, alternatively, with enormous hindsight after two accidents and many months of ‘wisdom from the crowds’ might identify aspects which should previously have been considered.
This, for everyone is ‘the human condition’; beware of our biases.

Some posts have referred to a management ‘Go, go, go’ mentality in developing a new variant; imagine what mentalities might exist after the entire fleet has been grounded.
Consider our posts carefully so as not to add further pressure on these people in the design and test front line, either as unjustified speculative comment, ‘fuel’ for tabloid media, or inaccuracies to be used by those in government.

[netstruggler]

The software in the two ADRIUs is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit, so I believe they probably use different correction tables, or the algorithm to apply to them is subtly different, possibly something as simple as using a wrong sign.


I'd assumed that the two vanes are on opposite sides of the cockpit to avoid(through symmetry) the need to use different correction tables. Having used up all available axes of symmetry, adding a third vane would likely require different correction parameters.[/QUOTE]

[Euclideanplane]

The software in the two ADRIUs [sic] is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit
That analysis is both intriguing, and very scary.
Is it easy to explain in more detail why and how the software should behave differently between treating left and right AoA sensor data?
It seems that no matter how the ADIRU software might possibly be different, it ought to take a fairly simple comparison analysis to detect an inconsistency, such as a flipped sign or a logical error.

[Luc Lion]

...
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt.


VicMel,
it looks as though, at least for the NG, the AOA sensor provides an analog output to both the ADIRU and the SMYD box.
I couldn't find a diagram of the ADIRU Analog interfaces, but here is the SMYD Analog Interfaces diagram.
The three AOA sensor wires are labeled "SIN", "COS", "COM", whose meanings are obvious.
https://3.bp.********.com/-qCwEtMS3-yU/W-xF4QyEZLI/AAAAAAAAFCo/mpLqB83Yau4ph1pPKUjgqSKBFmPoYOWugCLcBGAs/s640/Screen%2BShot%2B2018-11-14%2Bat%2B7.56.25%2BAM.png (http://3.bp.********.com/-qCwEtMS3-yU/W-xF4QyEZLI/AAAAAAAAFCo/mpLqB83Yau4ph1pPKUjgqSKBFmPoYOWugCLcBGAs/s640/Screen%2BShot%2B2018-11-14%2Bat%2B7.56.25%2BAM.png)

[I]Edit: somehow pprune replace "b l o g s p o t" with "********". If you want to see the diagram, you have to retype "b l o g s p o t" (without spaces) after clicking the link.

[Jan Window]

I think VicMel's analysis is compelling. The AoA vanes are probably conforming to spec and the fault is further down the chain. It is possible that there is a fault in the nose to wing conversions as described. But these faults are reasonably easy to prevent through peer review processes such as code walkthrough and also module testing. What is more difficult is if an event causes some other subsystem to write garbage into the working space of the AoA handler, and that event is low probability. This sort of thing is really difficult to find in real-time systems.

[DaveReidUK]

The software in the two ADRIUs is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit, so I believe they probably use different correction tables, or the algorithm to apply to them is subtly different, possibly something as simple as using a wrong sign.

Yes, the L and R AoA sensors on the 737 are interchangeable, so for a given AoA they will generate rotational signals in the opposite sense to each other. At the very least, the ADIRUs will have to resolve that.

[patplan]

...
2) Looking at a picture of the AoA module, I am presuming that the A to D convertor is in the body, and it is of the ‘rotary’ kind, i.e. the A to D converts the rotated position of the vane shaft into a digital signal. Most of the A to Ds I worked on were typically 12 bit parallel output, I suspect that more modern ones would be a serial output. Either way the signal would be very noisy, responding to every vibration that the vane felt....

VicMel,
it looks as though, at least for the NG, the AOA sensor provides an analog output to both the ADIRU and the SMYD box.
I couldn't find a diagram of the ADIRU Analog interfaces, but here is the SMYD Analog Interfaces diagram.
The three AOA sensor wires are labeled "SIN", "COS", "COM", whose meanings are obvious.
https://3.bp.%62%6C%6F%67%73%70%6F%74.com/-qCwEtMS3-yU/W-xF4QyEZLI/AAAAAAAAFCo/mpLqB83Yau4ph1pPKUjgqSKBFmPoYOWugCLcBGAs/s640/Screen%2BShot%2B2018-11-14%2Bat%2B7.56.25%2BAM.png (http://3.bp.********.com/-qCwEtMS3-yU/W-xF4QyEZLI/AAAAAAAAFCo/mpLqB83Yau4ph1pPKUjgqSKBFmPoYOWugCLcBGAs/s640/Screen%2BShot%2B2018-11-14%2Bat%2B7.56.25%2BAM.png)
Helping Luc with his diagram...[img]https://i.ibb.co/7vZ3LR1/via-oth.png (https://ibb.co/gyf0hPR)

[jimjim1]

3) The offset is not due to a ‘stuck bit’. The offset in AoA as the aircraft first started to move is about 12 deg, increases to about 17 deg and then settles on about 22 deg. A stuck bit would be 22.5, or 11.25, or 5.625; to get 17 deg would take two ‘stuck’ bits. Besides which serial buses of themselves (e.g. ARINC 429) do not have ‘stuck’ bits, they have multi bit corruption, usually recognised as a ‘bad message’ and rejected.
4) The AoA digital signal goes into the applicable ADIRU for further processing. Part of this processing *should have been* to reject any invalid input!! Another part will be to smooth the data to get rid of the noise, but this is the same software in both ADIRUs, so would not give an offset.

5) ‘Light bulb’ moment -
The software in the two ADRIUs is different, it has to allow for the fact that the two vanes are on opposite sides of the cockpit, so I believe they probably use different correction tables, or the algorithm to apply to them is subtly different, possibly something as simple as using a wrong sign.
I know which bit of code I would be diving into now!

Hmm!

The AoA disagree is pretty close to 22 degrees from half way down the runway onwards. I suspect that at low speeds, say during taxi, the AoA vane does not respond to the airflow accurately.

I still quite like the One Bad Bit explanation although I agree that it could be a software issue. As you clearly will know it is quite common for software (in general, not in necessarily in aviation) to set a memory Bit to store a status. Perhaps the wrong bit got changed?

Do these computers have hardware memory protection such that one "process" cannot interfere with another? I suspect that they will not have such protection but I am not sure. I read somewhere that they were 80286 based . The 286 does not have integrated hardware memory protection although I suspect that an addition Memory Management Unit might be able to provide it.

[SteinarN]

Yes, the L and R AoA sensors on the 737 are interchangeable, so for a given AoA they will generate rotational signals in the opposite sense to each other. At the very least, the ADIRUs will have to resolve that.

I have no knowledge of this position system. But could it be so simple as to swap the cos and sin wires and then the output would be in the other direction? So no need for different software in the ADIRU?

[DaveReidUK]

But could it be so simple as to swap the cos and sin wires and then the output would be in the other direction?

That sounds neither simple nor reliable.

[EDLB]

SIN and COS tend to be a resolver type of angle “encoding”. A very robust passive type of design. You need an excitation AC signal and you get two AC signals back, one with the SIN of your angle and the other with the COS of your angle signal. Typical those signals are differential and isolated from GND, because they come out of a transformer style winding. That makes them robust against noise on the harness. A possible scenario, where you might get wrong or offset values if there is a short between harness lines either the output or the excitation line which is not detected. That might tell us, why exchanging the sensor did not improve the problem.

For Boeing it should be easy to make some tests on the ground to determine what harness failure can create a 22 degree error in their “normal” flight orientation.

[VicMel]

Yes, the L and R AoA sensors on the 737 are interchangeable, so for a given AoA they will generate rotational signals in the opposite sense to each other. At the very least, the ADIRUs will have to resolve that.

In which case the software in the ADRIUs *has* to be different, one side has to add the correction, the other has to subtract it. I can well believe from bitter experience that the software team did not know enough about the hardware subtlety to appreciate that the ADIRU software has to have a L and a R version. This would explain why testing and peer reviewing did not spot anything wrong, the software met its spec!

A correction table would also explain the different offsets. I would expect the table to be a 'look-up' table using air speed as the selector. As the airspeed went up it would reach a point where the next value in the table has to be used, so there would be a step change in the correction. So, I would expect the first value in the correction table to be about 6 deg (to give a 12 deg offset), the next value to be about 8 deg and the final value to be about 11 deg.

[ams6110]

For Boeing it should be easy to make some tests on the ground to determine what harness failure can create a 22 degree error in their “normal” flight orientation.

Wonder if it might indeed tie back to wiring. In the "Go Go Go" article quoted earlier, it was claimed that the wiring blueprints had been rushed and lacked the usual amount of detail regarding the fitting of the wiring and and specific tools to be used. Especially if it is shown that L and R AoA was offset in the same way in both crashes, this has to be a red flag. Surely AoA disagree is not commonplace on other 737s.

[Luc Lion]

VicMel, what you write does not match the FDR data on AOA values that were shown in the interim report of the Lion Air accident.
It doesn't fit how SIN/COS resolvers work either.

There is a good analysis of what type of resolver, mechanical or electronic failure could match such an almost constant 22° offset on the site of Peter Lemme.
It is worth a read. It's here:
https://www.satcom.guru/2018/12/angle-of-attack-failure-modes.html

I made a quick check of what would produce a constant 34% positive parasite signal on the sinus entry combined with a 16% negative parasite signal on the cosinus entry.
It gives the series (in degrees)
Real Angle - Reported Angle - Delta
-2 19.97512 21.97512
-1 21.00953 22.00953
0 22.03623 22.03623
1 23.05537 22.05537
2 24.06711 22.06711
3 25.0716 22.0716
4 26.06899 22.06899
5 27.05944 22.05944
6 28.04309 22.04309
7 29.02008 22.02008
8 29.99056 21.99056

I have no idea on what could cause such parasite signals.
Could be inductive from a 400Hz current (like the excitation current), or could be a DC parasite signal in the entry of the analog to digital converter.

Don't misunderstand me ; I do not state that this is what caused the AOA failure.
Just looking at failures that give similar symptoms.

[MurphyWasRight]

In which case the software in the ADRIUs *has* to be different, one side has to add the correction, the other has to subtract it. I can well believe from bitter experience that the software team did not know enough about the hardware subtlety to appreciate that the ADIRU software has to have a L and a R version. This would explain why testing and peer reviewing did not spot anything wrong, the software met its spec!

A correction table would also explain the different offsets. I would expect the table to be a 'look-up' table using air speed as the selector. As the airspeed went up it would reach a point where the next value in the table has to be used, so there would be a step change in the correction. So, I would expect the first value in the correction table to be about 6 deg (to give a 12 deg offset), the next value to be about 8 deg and the final value to be about 11 deg.

The basic (left/right) tables have to be correct since in normal operation the AOA values do match. The tables are likely fine grained and probably interpolated so doubt there is a visible step in correction. Only the tables would change for L/R, the rest of the code would be common.

I agree that a 'stuck bit' does not seem to fit the data since there would be discontinuities as the data crossed the point where the stuck bit should change, especially true since there are 2 A to D converters, one each for SIN and COS. Easily ruled out if we had access to the raw data.

Mention has been made of the AOA analog signals being connected to 2 boxes, this opens a possibility that an electrical fault in one box could cause an offset for both.

[safetypee]

Whilst all of you Tech ‘bit’ people provide valuable information and possible scenarios, could you please consider why ‘failures’ appear to be very rare and so far only relate to two aircraft / three vanes.

How something fails does not necessarily explain why (when) it failed.
Random, probabilistic, bit count, world clock ?

[JLWSanDiego]

I see the WSJ information as a little misleading. While it apparently states that "...the MCAS system activated prior to its dive..." it can not be assumed that it was the cause of an initial upset.

[jmelson]

That sounds neither simple nor reliable.

Swapping Sin and Cos could be done in the wiring harness.

Jon

[DaveReidUK]

Swapping Sin and Cos could be done in the wiring harness.

Indeed it could.

Except that it would be pointless - swapping Sin and Cos doesn't turn a positive angle into a negative one. :O

[Luc Lion]

It transforms any angle alpha in (90° - alpha).
So 0° becomes 90°.
Not sure this is convenient...

[Australopithecus]

But both of these aircraft were a few months old...a harness problem should have manifested iteself on the first flight, no?

[srobarts]

An interesting article from Vox.com https://www.vox.com/business-and-finance/2019/3/29/18281270/737-max-faa-scandal-explained

[jmelson]

But both of these aircraft were a few months old...a harness problem should have manifested iteself on the first flight, no?


A misWIRED harness would have shown up immediately, but an intermittent problem would usually not show up right away.
It IS quite interesting that two planes may have had similar problems after just a few months of operation. Certainly a mystery, and Boeing and several CAA's are REALLY wanting to know what the heck happened!

I'd love to know more about exactly how these sensors work, and how the signals get into digital form in the computers.
It is looking like they MIGHT just be bare resolvers in the sensor.

Jon

[Dee Vee]

I have no knowledge of this position system

me either, but I was wondering if its possible to physically (or even manual adjustment wise) install this AoA sensor 22° out of alignment??

https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/385x623/ktglhky_c17b78aa5c73b2052bb68bd5ec29da24780674c5.jpg

[DaveReidUK]

me either, but I was wondering if its possible to physically (or even manual adjustment wise) install this AoA sensor 22° out of alignment.

Discussed at length in one of the Lion Air threads.

No, it's not possible, by design.

[airman1900]

The Final Minutes of Ethiopian Airlines’ Doomed Boeing 737 MAX

The Final Minutes of Ethiopian Airlines’ Doomed Boeing 737 MAX

By Matina Stevis-Gridneff and Yonathan Menkir Kassa
March 29, 2019 12:18 p.m. ET

ADDIS ABABA, Ethiopia—It took less than six minutes to deepen one of the gravest crises in the history of Boeing Co.

At 8:37 a.m. on March 10, Captain Yared Getachew and First Officer Ahmed Nur Mohammed were accelerating an Ethiopian Airlines Boeing 737 MAX along runway 07R of Addis Ababa’s highland airport.

The flight conditions were perfect—warm and cloudless—at 8:38 as the jet lifted above the hills to commence the one hour and 40 minute shuttle to Nairobi.

Something almost immediately went wrong. At 8:39, as the jet reached an altitude of 8,100 feet above sea level, just 450 feet above ground, its nose began to pitch down.

Mr. Mohammed radioed the control tower, his crackling voice reporting a “flight-control problem.” The tower operators asked for details as Mr. Getachew, a veteran with 8,000 flight hours, fought to climb and correct the glide path. By 8:40, the oscillation became a wild bounce, then a dive.

“Pitch up, pitch up!” one pilot said to the other, as the Boeing jet accelerated toward the ground. The radio went dead.

At 8:44, the airliner crashed into a field just 30 miles from the runway. All 157 people on board were killed instantly.

This reconstruction of the final moments of Ethiopian Airlines Flight ET302, described in new detail by people close to the crash investigation, airline executives and pilots, paints a picture of a catastrophic failure that quickly overwhelmed the flight crew.

It appears to support a preliminary conclusion reached by Ethiopian officials and international investigators, who believe an automated flight-control feature activated before the plane nose-dived into the ground, according to people familiar with the matter.

This emerging consensus—relayed during a high-level briefing at the Federal Aviation Administration on Thursday and reported later the same night by The Wall Street Journal—represents the first findings based on data retrieved from the flight’s black boxes. It is the strongest indication yet that Boeing’s misfiring system was at the heart of both the Ethiopian Airlines crash earlier this month and a Lion Air flight in Indonesia, which crashed less than five months earlier. Both doomed jets were Boeing 737 MAXs. The two disasters claimed 346 lives. A report from Ethiopian authorities is expected within days.

The Justice Department and other U.S. federal agencies are investigating whether Boeing provided incomplete or misleading information to regulators and airline customers about the 737 MAX aircraft to get the jetliner certified as safe to fly. The focus on disclosures is part of a broader investigation into how the plane was developed and certified.

Pilots flying the 737 MAX around the world were only alerted to the stall-prevention system after the Lion Air crash, and saw almost no mention of it in manuals, according to the pilots and industry officials. Most didn’t have visible cockpit warnings that would have alerted pilots to a malfunctioning sensor, and they had no access to simulators that could replicate the kinds of problems that doomed Lion Air flight 610.

In that crash, the stall-prevention system, based on erroneous sensor information, repeatedly pushed the plane’s nose down and, according to a preliminary report, the pilot battled the flight controls while facing a cacophony of alarms before losing control and plunging into the Java Sea, killing all 189 people on board.

Boeing said it is updating the MCAS software and making safety alerts that had been optional a standard feature. The fix has been undergoing flight trials since Feb. 7, Boeing said, before the Ethiopian airliner crashed.

Ethiopian Airlines—Africa’s largest carrier—is fighting to defend its record. Across this vast nation of 105 million people, the state-owned airline has in recent years become emblematic of, and indispensable to, Ethiopia’s ascent from one of the world’s poorest countries to a regional powerhouse. The closely-linked fates of carrier and country are now under the spotlight, raising the stakes for the airline to effectively manage the fallout of the accident.

Minutes after the plane crashed, Ethiopian Airlines chief executive officer felt a buzz in his pocket. Tewolde Gebremariam was attending Sunday service with his family at the Medhane-Alem Cathedral close to the airport when his phone rang.

It was the number for the airport’s “collaborative decision-making system,” a task force of airline, air-traffic control and airport officials who work together to ensure flight traffic is managed efficiently.

“We’ve lost ET302 from the radar,” the voice on the other end of the line said in Amharic, Ethiopia’s national language.

By the time Mr. Gebremariam reached the airport, it was becoming clear the plane had crashed.

“Right there, immediately,” Mr. Gebremariam thought of the Lion Air crash, he said in an interview. “The similarities were very striking. The impact, both were brand-new airplanes, both were MAX, and [they both crashed] in a short time, quickly after takeoff.”

As two air force helicopters prepared to lift off to search for ET302, pilots on the airport runway were getting restless.
Lazarus Kuol was in line for departure, preparing to take off on his single-engine turboprop aircraft on a medevac flight to the southwestern city of Jinka. He was due to collect two Chinese patients and bring them back to Addis Ababa for treatment.

The waiting pilots, listening to the control tower’s shared frequency, heard the operators discuss an emergency and order all aircraft to remain grounded, while two incoming planes were told to delay landing. The tower had lost contact with ET302. Maybe it was a communication problem, Mr. Kuol thought, or maybe they made an emergency landing on the flat farmlands southeast of the capital.

The minutes passed with no word from the missing aircraft or the search-and-rescue mission, and Mr. Kuol began to fear the worst.

He was given clearance to take off at 09.50, the second aircraft to depart Bole International Airport after ET302 went missing, and began to listen to the exchange between two radio frequencies, “Addis Center,” the main control-tower, and “Harar Meda,” the air force base.

“We can’t see it in the lowland,” said one of the two air force helicopter pilots dispatched to search for ET302. “We’ll climb on the highlands to look.”

In fact, the helicopters were circling over the crash site without realizing. The dive had been so fast and so steep that the aircraft had bored a crater into the ground and fractured into thousands of pieces. It was hardly visible from air.

“When I went to the site, the plane was completely below ground,” said Mr. Gebremariam, the CEO. He took off in another helicopter as soon as the crash site had been identified. “At that time, we knew there were no survivors.”

He notified the country’s Prime Minister, Abiy Ahmed, who first tweeted about the crash in Amharic at 10.48am local, just over two hours after the doomed flight had taken off.

At 10.50am, the news broke abruptly into the quiet Sunday mornings of the families of the 157 on board, and the rest of the world.

“The Office of the PM, on behalf of the Government and people of Ethiopia, would like to express [its] deepest condolences to the families of those that have lost their loved ones on Ethiopian Airlines Boeing 737 on regular scheduled flight to Nairobi, Kenya this morning,” a tweet from his official account said.

—Robert Wall, Andy Pasztor and Andrew Tangel contributed to this article.

Write to Matina Stevis-Gridneff at [email protected]

Appeared in the March 30, 2019, print edition as '‘Pitch Up, Pitch Up!’ The Final Minutes of an Ethiopian Jet.'

[yanrair]

In the aftermath of the AF447 accident, Boeing (and Airbus) substantially changed the Unreliable Airspeed non-normal checklist (NNC). The message that has since been repeatably reinforced is that if there are ANY abnormalities related to airspeed, pilots should NOT make any assumptions as to what indication is right and what is wrong. They should simply run the Unreliable Airpeed NNC methodically until the correct indications are determined. So a stick shaker activating after takeoff (due to a faulty AOA signal) will be treated (and reported to ATC) as 'Unreliable Airspeed'.

The accident scenario that we are discussing might run something like this:
- At rotation stick shaker activates (due to a faulty AOA signal).
- You see normal speed indications.
- Stick shaker at normal indicated airspeeds is NOT logically consistent. Post AF447, that is an Unreliable Airspeed event. (You are NOT jumping to any conclusions at this stage that the IAS is correct and the Stick Shaker is wrong).
- Climb to a safe height and begin the Unreliable Airspeed NNC.
- Report to ATC that you have Unreliable Airspeed (because that is the NNC that you are now working through).
- Manually set a known power and attitude for level flight (the NNC requires the autopilot to be disconnected).
- Unbeknownst to you, MCAS has now been activated because of the faulty AOA signal.
- Your efforts to trim the aircraft for straight and level flight are proving difficult (because of the hidden MCAS intervention). Confusion increases because you can't even establish straight and level flight to continue the NNC.
- You are soon overwhelmed.
bleve
my understanding was that the STAB running fully nose down wasn’t “hidden”_ the pilot tried repeatedly to trim the other way for ten minutes- isn’t that correct? It’s just that every time he trimmed nose up the STAB trimmed nose down and was winning the tug of war. Apart from that your analysis seems entirely plausible. Yes- we revert to pitch power for safe flight once normal speed indications become unreliable. 15 deg pitch in initial climb. 6 deg pitch straight and level.
When all indications fail you pitch power are always valid. And of course GPS which is largely ignored in these discussions but is a life saver
cheers
Y

[Water pilot]

Do these computers have hardware memory protection such that one "process" cannot interfere with another? I suspect that they will not have such protection but I am not sure. I read somewhere that they were 80286 based . The 286 does not have integrated hardware memory protection although I suspect that an addition Memory Management Unit might be able to provide it.
With the caveat that I have no inside knowledge of Boeing's programs and so could be talking though my hat, I would be surprised if there were anything as complex as a 'process' in this control system. Even the most simple and minimal operating system introduces a heck of a lot of unnecessary complexity. It is likely that everything runs in the same memory space (especially if it is a 286) and looks like one large interrupt driven program. They probably have some sort of minimal 'frame' so they can compile together the various developer's work, but it is probably quite small and simple compared to the millions of lines of code (literally) that you will see in an operating system.

[WingNut60]

Discussed at length in one of the Lion Air threads.

No, it's not possible, by design.

I asked previously, with no meaningful reply, whether the unit can be opened in the field.
It seems that they are repairable at point of manufacture, but could a field tech get one open.
If they can be opened in the factory, what stops them from being opened in the field.

Installing a complete unit, correctly indexed for position, may be irrelevant if the unit has been opened and internal components incorrectly indexed.
How many splines hold the internal rotor onto the vane shaft?

I have spent a long time in Indonesia. I have a pretty good idea of what can happen in these here parts.
Murphy may have even been Indonesian, I suspect. Maybe "Murfi"?

[DaveReidUK]

If they can be opened in the factory, what stops them from being opened in the field.

Why would anyone want to do that ?

[WingNut60]

Why would anyone want to do that ?

Because "it's not working properly".
Because "we don't have a spare".
Because they can!

[fdr]

The details on the trigger event have blocked out the major issue in these events, that is, why the crew were unsuccessful in coping with the problems that they encountered?

Note: MCAS is not a stall prevention system, it is a system to achieve compliance with a static stability criteria for a part of the envelope.
The deficiency in the natural stability could lead to excessive g loading or inadvertent stalls etc as a consequence as attitude maintenance tasks need greater monitoring than with a compliant system. The rules themselves are not necessarily as relevant as they were in the days of early attitude displays, and with shorter body aircraft. The flight crew in a modern aircraft will notice the response on their coffee cup as they pull a bit harder on the prong, which is not simulated well in current 6-DOF FFS.

Two crews had issues that presented in such a way that what is obvious post fact was not at the time. Why? That is the question. While Bill Boeing needs to sort out his system that appears to have been based on various assumptions of response that did not occur as expected, the fundamental case remains that all conceivable failure modes of the total aircraft as a system are unlikely to be run down prior to experiencing the same in the air, and the crew response needs to be able to recover from unknown symptoms in a time critical period.

Lion Air is poignant where it appears the pilot during the fault finding attempted to apply human factor training concepts, and in doing so control was finally lost. Every time we push on a balloon it reshapes the balloon... actions have consequences. The fundamental tenets of priorities have not changed, nor does human factor training expect to do so, but on the day, the intervention that was holding ground and keeping the flight path managed was lost with the transfer of control. The transfer was undertaken to give the pilot more cognitive capacity to deal with the issue, however the preventive action was not maintained by the FO...

Control reversion with true FBW aircraft, alternate modes on Boeing FBW aircraft are quite different to Airbus, however as Boeing always uses a speed trim input from the trim switches, the reversion from full FBW to none on the Boeing is not a significant change. On the Airbus, the degradation of modes results in the introduced requirement to use manual trim, which is also displayed on the ECAM, however history shows that the crews in a high work load and stress environment do not always respond with manual trim inputs, resulting in loss of control.

AOA gauges are great, and indexers of any type are good tools in achieving stable approaches. HUD's are also great, but neither of them is an absolute necessity to the safe flight of the aircraft. Given adequate funding, they are the first equipment on the options list to ask for. For these cases, the symptom of the problem was the out of trim case, and the inability to simply re-trim and cure the out of trim case. The trim system on any aircraft is not a Möbius loop, it will end at some point, and the continued demand to re-trim was inconsistent with normal operation of the trim on any aircraft.

Somewhere in the design architecture decision making, the necessity of a correct crew response to a fault was either not considered, or was considered and assumed that the crew would readily identify the problem symptom as a trim runaway, and intervene using the method that has been incorporated for more than 50 years. That a crew would not be able to recognise and respond appropriately shows that human factors are alive and well in the design and certification process. It is the human that may make an incorrect assumption on a design or certification matter who also intervenes and ensures that other matters that would not be caught purely by compliance with preexisting rules are mitigated. To err is human, but removing humans from decision making is a high risk game.

[jimjim1]

It is likely that everything runs in the same memory space (especially if it is a 286) and looks like one large interrupt driven program. They probably have some sort of minimal 'frame' so they can compile together the various developer's work

Thanks.

Oops too short pprunepadding.

[Giant Bird]

I tossed in my commercial licence 40 years ago for a rewarding and exciting career in finance and IT but flying was always in my blood so I have always been interested in aviation. In this 737 Max crash issue something seems totally wrong to me. Both here in Pprune and in other media I have see a number of times where it has been inferred that this is pilot error as a MCAS fault is like trim runaway and fixing that is a memory item and takes 15 secs. However if I understand it correctly with runaway trim when you go to trim nose up the automation keeps on trimming more nose up even though the pilot has stopped trimming. In this situation it is the exact opposite the pilot trims up and the automation pushes the nose down. But I cannot see where people have focused on this critical difference. I would have thought in a crisis situation which was the case in these two crashes the last thing you would train your pilots to do would be tho take actions contrary (or in this case opposite to) to the symptoms being experienced. The people including some people presented in the media as experts who say that this is the same or similar to trim runaway seem to be missing the point that it is the exact opposite and therefore totally confusing. Who is missing the point here? Me or the experts?
And for those who wonder how I could give up flying for a business career. I am now long retired but I think I was unsuitable. I would have been totally bored as a pilot and therefore eventually potentially unsafe. I had a career where nearly every day was different, regular crisis to keep my attention, lots of mentally challenging problems to solve, and where I got to be the rule maker and breaker rather than the follower.

[VONKLUFFEN]

I'm attaching 3 normal flights profiles, 1 normal speed and altitude data vs the profile of the crashed Ethiopian and its speed and altitude readings.
The difference between them is obvious.
Could it be that being, maybe, early and first flight of the day the cover of the pitot tubes where not removed? It has happened before. The latest happened to a MH in Brisbane Australia. Poor preflight checks by engineers and pilots. They both missed it.
This could explain the lack of speed and altitude during almost 2 minutes of the doomed plane. Then in very short time speed of 250-383kts.
During take off roll they were caught by surprise and missed* the 80 kts callout. First reaction of a ill trained crew to fly Airspeed Unreliable Speed NNC or junior crew ( *FO had,its being said, 200hrs) was to level off to gain speed. Once speed increases rapidly he retract flaps to avoid exceed VMO placard. Speed jumps very fast. To control it commander pulls abruptly to control speed and then a real high AOA of attack is reached. Having a problem he requests to turn back...
MCAS kicks in when: High angle of attack, manual flight, flaps up and in a turn.
Assuming pilots did all this in sequence, it might triggered the MCAS. And sadly in this case, it worked exactly the way it was designed to work. To avoid an upset triggered by a unreasonable maneuver by pilots or environment.
Then they kept fighting MCAS, why? Investigation will tell the probable cause...
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_02afab3cf2e317e5006f9109db2e0533b2 0996f9.jpg
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_1_7098b1ca4ea82c90c1c582faf3a2550b 44a28f16.jpg
https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_2_3da1744920932deefd2149dc725baad4 e20dcfc9.jpg
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_3_c86d79297d3b84d69ffb2f70037186fe 1f41464b.jpg
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_4_a54b04e8206b3d5b3318e4ca3eff98a1 9e085541.jpg
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/750x1334/photo_2019_03_24_18_47_17_5_41fafd05b559167b4717db21f28da26e 4601051e.jpg
its just a thought...