Ethiopian airliner down in Africa

[edmundronald]

NYT has made the Max its cover story today. And they're not friendly.
https://www.nytimes.com/2019/03/29/business/boeing-737-max-crash.html?action=click&module=Top%20Stories&pgtype=Homepage

[armchairpilot94116]

https://youtu.be/LVOwxV9dVmg

apologies if posted prior

MCAS the Achilles Heel of the Max that has the potential to end the 737 line.
Lets hope Boeing gets the fix right and the Max flies on as a great final version of the robust and venerable 737.

[DaveReidUK]

Because "it's not working properly".
Because "we don't have a spare".
Because they can!

I'm assuming you have never worked in an airline maintenance environment.

[DaveReidUK]

I'm attaching 3 normal flights profiles, 1 normal speed and altitude data vs the profile of the crashed Ethiopian and its speed and altitude readings.
The difference between them is obvious.
Could it be that being, maybe, early and first flight of the day the cover of the pitot tubes where not removed? It has happened before. The latest happened to a MH in Brisbane Australia. Poor preflight checks by engineers and pilots. They both missed it.
This could explain the lack of speed and altitude during almost 2 minutes of the doomed plane. Then in very short time speed of 250-383kts.
During take off roll they were caught by surprise and missed* the 80 kts callout. First reaction of a ill trained crew to fly Airspeed Unreliable Speed NNC or junior crew ( *FO had,its being said, 200hrs) was to level off to gain speed. Once speed increases rapidly he retract flaps to avoid exceed VMO placard. Speed jumps very fast. To control it commander pulls abruptly to control speed and then a real high AOA of attack is reached. Having a problem he requests to turn back...
MCAS kicks in when: High angle of attack, manual flight, flaps up and in a turn.
Assuming pilots did all this in sequence, it might triggered the MCAS. And sadly in this case, it worked exactly the way it was designed to work. To avoid an upset triggered by a unreasonable maneuver by pilots or environment.
Then they kept fighting MCAS, why? Investigation will tell the probable cause...

its just a thought...

Do you mean that a blocked pitot caused erroneous AoA that in turn triggered repeated applications of MCAS ?

Or that those were two independent, simultaneous failures ?

[GordonR_Cape]

Do you mean that a blocked pitot caused erroneous AoA that in turn triggered repeated applications of MCAS ?

Or that those were two independent, simultaneous failures ?

I think VONKLUFFEN is flogging a dead horse. That theory has been supersed by the leaked preliminary accident investigation report, which confirms that MCAS was activated in the Ethiopian crash. The rest of the explanation does not make sense in view of the known ADS-B speed and altitude data points.

[73qanda]

I'm assuming you have never worked in an airline maintenance environment.
I’ve worked in airline maintenance environments that were so cowboy by nature that my local car wrecker would blush if he saw some of the practices.

[WingNut60]

I'm assuming you have never worked in an airline maintenance environment.

Correct. But I have worked in Indonesia for most of the last forty years.
You may think that what I suggested could not happen because of procedures, checks and balances.
I assure you that it can.

Just remember, it's the same environment that recently saw a PIC fly for an hour and a half on stick-shaker and not report it.

My query asks "is it possible to open the AoA vane unit body in the field."
If the answer is Yes, then don't discount the possibility that it could happen, overnight in Jakarta.
It is very possible.

[DaveReidUK]

My query asks "is it possible to open the AoA vane unit body in the field."
If the answer is Yes, then don't discount the possibility that it could happen, overnight in Jakarta.
It is very possible.

"Captain, would you mind testing our unauthorised, undocumented repair to the LH AoA sensor on the next sector?"

"No, we don't have an Overhaul Manual for it - it's not a field-serviceable item - but, hey, how hard can it be?"

"You might find that it reads a bit high (or possibly low) afterwards as we have no idea how to calibrate it, but we can tweak it again if necessary until it's reasonably accurate"

No, I don't think so.

[marchino61]

"Captain, would you mind testing our unauthorised, undocumented repair to the LH AoA sensor on the next sector?"

"No, we don't have an Overhaul Manual for it - it's not a field-serviceable item - but, hey, how hard can it be?"

"You might find that it reads a bit high (or possibly low) afterwards as we have no idea how to calibrate it, but we can tweak it again if necessary until it's reasonably accurate"

No, I don't think so.
Dave Reid, not possible in the UK. But we are talking Indonesia here.

[WingNut60]

No, I don't think so.

While we will have to agree to disagree over the possibility, I would like to see EXACTLY what the techs said they did in each instance.
I know that there have been previous references but I can't find them now.

I am really interested in what was recorded as having been done.
Verbatim, in Bahasa Indonesia, would be best, if anyone has it.

[MMonroe]

Dave Reid, not possible in the UK. But we are talking Indonesia here.

I concur. I live in Indonesia and there is almost zero safety culture. That's not to say this contributed in any way to the Lion crash. But some of the things you see here in regards to basic safety and risk analysis would certainly shock you.

[GotTheTshirt]

Dave, Have you ever worked in Indonesia ?
I have and I agree with the guys above. Its known as the midnight parts store !!
and contra to what you might think some of these guys are technically quite smart
We are not saying it happened but we are saying it can !!

[ecto1]

I have read with interest all possible explanations suggested here fot the incorrect AOA readings.

My humble contribution would be to ask to all future posters to make any theory somehow match with the data trace.

It has a very specific behaviour: 10 or 12 degrees offset, higher on the left at power - up, fairly stable on both sides, then during taxi hardly any real movement at any side, but several (6 or 8) short instances of left AOA vane reading ramping up a few degrees at a time, not vertically (cliff) but at a slope, increasing the offset to about 25 deg, then at rotation the right one increases (normal) the left one decreases (abnormal) and then both set at 22 degrees offset and seem to measure quite faithfully to each other (apart from the offset) for the rest of the flight.

(numbers are very rough guess, trends are right though)

To me the only two explanations that so far match (loosely) are:

- a slipping shaft that slips with the bumps but sticks with aero forces (but two sensors in a row, I don't think so)
- a intermittent electrical connection outside of the probe somewhere in a encoder-like signal which is disturbed by the bumps of taxi and creates an offset. Perhaps at the control module or power to the probe.

I don't think any of them is very probable, though. There must be a better explanation. Although bit corruption or software bug doesn't fit any better to me.

edit: another plausible but quite crazy scenario would be a voltage reference for analog signals drifting up and the electronic box going for the higher value of the sin cos signals instead of simply ruling them unsuitable because the plausibility check failed.

[DaveReidUK]

Dave Reid, not possible in the UK. But we are talking Indonesia here.

If the "replaced" AoA sensor at Denpasar had in fact been the same one that was removed, following an illicit repair, then by definition there would not be a U/S sensor on its way back to the manufacturer, nor any paperwork to show that a serviceable one had been drawn from stores.

Don't you think that the investigation would have established that at an early stage ? In fact, the report states the exact opposite.

[WingNut60]

...............

It has a very specific behaviour: 10 or 12 degrees offset, higher on the left at power - up, fairly stable on both sides, then during taxi hardly any real movement at any side, but several (6 or 8) short instances of left AOA vane reading ramping up a few degrees at a time, not vertically (cliff) but at a slope, increasing the offset to about 25 deg, then at rotation the right one increases (normal) the left one decreases (abnormal) and then both set at 22 degrees offset and seem to measure quite faithfully to each other (apart from the offset) for the rest of the flight.
............

To me the only two explanations that so far match (loosely) are:

- a slipping shaft that slips with the bumps but sticks with aero forces (but two sensors in a row, I don't think so)
- a intermittent electrical connection outside of the probe somewhere in a encoder-like signal which is disturbed by the bumps of taxi and creates an offset. Perhaps at the control module or power to the probe.

I don't think any of them is very probable, though. There must be a better explanation. Although bit corruption or software bug doesn't fit any better to me.
One report that I have for JT says that, in Jakarta :

The technician cleansed the Air Data Module (ADM) pitot and the left static port to repair the IAS and ALT disagree along with operational tests on land with no results. Then the Technician cleaning the electrical connection at the Elevator Feel Computer is accompanied by an operational test with good results.

Who here knows what those "operational tests" might have involved?
Are there any such, approved operational tests?

What approved operational tests might have been carried out that could have shown "no fault" when a fault still existed?

[WingNut60]

If the "replaced" AoA sensor at Denpasar had in fact been the same one that was removed, following an illicit repair, then by definition there would not be a U/S sensor on its way back to the manufacturer, nor any paperwork to show that a serviceable one had been drawn from stores.

Don't you think that the investigation would have established that at an early stage ? In fact, the report states the exact opposite.

The AoA sensor was reported as changed in DPS only, I think. Not Jakarta.
I'm talking about Jakarta.

Dave can you point me to the JT incident report please. I just can't find a link.

FYI - "Cleaning a connector...." is a really dangerous euphemism in Indonesia.

[dozing4dollars]

I would like to know how many similar snags ( Stick Shaker, Unreliable AS, use of Stab Trim cutout switches ) have been logged on the MAX?

[DaveReidUK]

The AoA sensor was reported as changed in DPS only, I think. Not Jakarta.
I'm talking about Jakarta.

There's no reference to any maintenance action involving the AoA sensor at Jakarta in the report.

Dave can you point me to the JT incident report please. I just can't find a link.

http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018%20-%20035%20-%20PK-LQP%20Preliminary%20Report.pdf

[LandIT]

The AoA sensor was reported as changed in DPS only, I think. Not Jakarta.
I'm talking about Jakarta.

Dave can you point me to the JT incident report please. I just can't find a link.



Maybe this post helps...
https://www.pprune.org/10322573-post1730.html

[patplan]

The AoA sensor was reported as changed in DPS only, I think. Not Jakarta.
I'm talking about Jakarta.

Dave can you point me to the JT incident report please. I just can't find a link.

FYI - "Cleaning a connector...." is a really dangerous euphemism in Indonesia.From pp. 7-9 Preliminary Accident Report of Lion Air PK-LQP
https://i.ibb.co/KNShp0C/combo1c.png
https://i.ibb.co/TMBp6y3/combo2z.png
https://i.ibb.co/NWQZGy7/fourthp.png
AOA was not touched in Jakarta, as MX suspected problem(s) laid elsewhere in the system. He fixed other things as mentioned by the CAPT of JT043: "IAS disagree & ALT disagree and Feel Diff Press Light".

Well, his fixes neither cured the problems nor made things any better for the pilots of the next sector. The rest is history.

[fergusd]

With the caveat that I have no inside knowledge of Boeing's programs and so could be talking though my hat, I would be surprised if there were anything as complex as a 'process' in this control system. Even the most simple and minimal operating system introduces a heck of a lot of unnecessary complexity. It is likely that everything runs in the same memory space (especially if it is a 286) and looks like one large interrupt driven program. They probably have some sort of minimal 'frame' so they can compile together the various developer's work, but it is probably quite small and simple compared to the millions of lines of code (literally) that you will see in an operating system.

Unless Boeing are literally working with technology from the stone age your description is about as far from reality as is possible for any modern safety related software.

How many safety critical software systems have you designed, had approved, and put in the field ?

[HarryMann]

From Bjorn Fehrm of Leeham today:

This week Boeing presented how they plan to get the 737 MAX back in the air again. MCAS has a fix.We look at what the fix tells us about the first implementation and the rationale behind its implementation.

https://leehamnews.com/wp-content/uploads/2019/03/AOA_VaneIndicator_AoA_Disagree_lg.jpg (https://leehamnews.com/wp-content/uploads/2019/03/AOA_VaneIndicator_AoA_Disagree_lg.jpg)

Figure 1. The improved Pilot’s Primary Flight Display presented Wednesday. Source: Boeing.Boeing’s MCAS fix casts light on the original implementationBoeing presented its fix for the MCAS problems Wednesday. By it, it spotlights what was wrong with the original implementation.The reliance on a single triggering signal for MCASA lot has been written about the MCAS system relying on a single Angle of Attack input. This is unusual for systems involved in the flight control of aircraft. Normally you have three inputs so a voting procedure can sort out one of them if it has a problem (two singling out the third as faulty).

The 737 has only two Angle of Attack sensors, so no voting can be set up between them. Instead, the system relying on the sensors can be switched off if the sensors disagree and the pilot informed about the missing function.

This is the route chosen for the improved MCAS. It will now be disconnected when the sensed Angle of Attack difference is beyond 5.5 degrees when MCAS activates and over 10 degrees for over 10s when the system is in use.

The wide allowed difference shows what I have written about before. The aerodynamics around these sensor vanes, placed at the nose sides, is dependent on how the aircraft is flown. If there is a sideslip the airflow passing the sensors will be affected and the sensor values will differ.

The actual sensor value is also higher than the wing Angle of Attack (the airflow around a fuselage nose is curving upward), therefore a correction table is used to calculate the wing’s Angle of Attack. It’s the wing’s Angle of Attack which determines how close to stall the aircraft is.

Was the use of only one signal OK to trigger the original MCAS? No, it wasn’t. But at least there was a rationale for this decision, whatever one might think about the rationale. A deactivation of MCAS was not an acceptable solution as it would trigger a need for an MCAS not available signal and this would mean more difference training for the Pilots migrating from 737ng to MAX.The design of the original MCAS functionWhile the reliance on a single sensor is highly questionable, the architecture and implementation of the original MCAS function in inexcusable.

If you have a flight control function which is triggered by a single sensor, it means the likelihood it being incorrectly activated is there. Then you implement a nonhazardous augmentation function!

You make sure it only injects the minimum correction necessary and you limit its total authority to not jeopardize the safe flight of the aircraft.

Where others focus on a single trigger signal, my biggest problem is with the function itself. If you have a weak trigger architecture, you limit the authority of what you trigger!

There was no need for the authority MCAS got. We know this today as the software fix only trims once for each elevated Angle of Attack event and limits the total trim amount to a safe level. This is regardless of the sensors being wrong or the function running wild.

It was just a very, very bad function design, and there was no need for it.Designed to not show, it became the centerpiece of attentionMCAS was a function put there to cater for a very remote case. The pilot needs to maneuver close to the limits of the aircraft and way beyond normal flying practice, to save the aircraft from some emergency. Then MCAS kicked in to make the aircraft easy to fly close to its limits.

In the life of a commercial 737 MAX pilot he should never experience an MCAS augmentation, its use case was so remote. Instead, it became the most known and explained function of all on the 737 MAX. And for the wrong, very sad reasons.

There are only a few airliner OEMs in the world. There is a reason for this. It’s a challenging product to get right and the stakes are very high for any mistakes. In today’s very safe air transport system mistakes of this scale are non-acceptable.

Tick, tick and tick... 10/10 👍

[patplan]

The AoA sensor was reported as changed in DPS only, I think. Not Jakarta.
I'm talking about Jakarta.

Dave can you point me to the JT incident report please. I just can't find a link.

FYI - "Cleaning a connector...." is a really dangerous euphemism in Indonesia.

Something of interest perhaps...Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures
By Simon Hradecky, created Tuesday, Nov 20th 2018 20:04Z, last updated Tuesday, Nov 20th 2018 20:04ZA
Sunwing Airlines Boeing 737 MAX 8, registration C-GMXB performing flight WG-439 from Punta Cana (Dominican Republic) to Toronto,ON (Canada) with 176 passengers and 6 crew, was enroute at FL350 about 50nm northwest of Washington Dulles Airport,DC (USA) when the captain's instruments began to show erroneous indications. The first officer was handed control of the aircraft as his instruments and the standby instruments remained in agreement. The crew decided to descend out of IMC into VMC as a precaution and descended the aircraft to FL250. Descending through FL280 the weather radar and TCAS failed. The crew declared PAN and worked the related checklists. The left IRS fault light illuminated. The flight continued to Toronto for a safe landing without further incident.

The Canadian TSB reported the left ADIRU was replaced. =====

I have a suspicion that in Boeing 737 Max 8 [B38M] perhaps the LEFT/CAPT ADIRU is constantly being overwhelmed by new routines [i.e. MCAS/AOA related programmings] which may from time to time corrupt the system.

- Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures (http://www.avherald.com/h?article=4c0886c4&opt=0)

[ThorMos]

With the caveat that I have no inside knowledge of Boeing's programs and so could be talking though my hat, I would be surprised if there were anything as complex as a 'process' in this control system. Even the most simple and minimal operating system introduces a heck of a lot of unnecessary complexity. It is likely that everything runs in the same memory space (especially if it is a 286) and looks like one large interrupt driven program. They probably have some sort of minimal 'frame' so they can compile together the various developer's work, but it is probably quite small and simple compared to the millions of lines of code (literally) that you will see in an operating system.

This is definetly far away from the truth...

[WingNut60]

Thanks Dave, et al for links.


AOA was not touched in Jakarta, as MX suspected problem(s) laid elsewhere in the system. He fixed other things as mentioned by the CAPT of JT043: "IAS disagree & ALT disagree and Feel Diff Press Light".

Well, his fixes neither cured the problems nor made things any better for the pilots of the next sector. The rest is history.

Correct.
After reading top to tail, nothing to indicate that anything either useful or otherwise untoward was carried out in JKT.

[GordonR_Cape]

ecto

It has a very specific behaviour: 10 or 12 degrees offset, higher on the left at power - up, fairly stable on both sides, then during taxi hardly any real movement at any side, but several (6 or 8) short instances of left AOA vane reading ramping up a few degrees at a time, not vertically (cliff) but at a slope, increasing the offset to about 25 deg, then at rotation the right one increases (normal) the left one decreases (abnormal) and then both set at 22 degrees offset and seem to measure quite faithfully to each other (apart from the offset) for the rest of the flight.

Your analysis is fundamentally flawed because AOA is not valid before takeoff, and any data points prior to that must be ignored. The AOA sensor relies on significant forward speed to align the vane with the airflow, and this is not possible while taxiing.

[GordonR_Cape]

Something of interest perhaps...Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures

By Simon Hradecky, created Tuesday, Nov 20th 2018 20:04Z, last updated Tuesday, Nov 20th 2018 20:04ZA
Sunwing Airlines Boeing 737 MAX 8, registration C-GMXB performing flight WG-439 from Punta Cana (Dominican Republic) to Toronto,ON (Canada) with 176 passengers and 6 crew, was enroute at FL350 about 50nm northwest of Washington Dulles Airport,DC (USA) when the captain's instruments began to show erroneous indications. The first officer was handed control of the aircraft as his instruments and the standby instruments remained in agreement. The crew decided to descend out of IMC into VMC as a precaution and descended the aircraft to FL250. Descending through FL280 the weather radar and TCAS failed. The crew declared PAN and worked the related checklists. The left IRS fault light illuminated. The flight continued to Toronto for a safe landing without further incident.

The Canadian TSB reported the left ADIRU was replaced. =====


I have a suspicion that in Boeing 737 Max 8 [B38M] perhaps the LEFT/CAPT ADIRU is constantly being overwhelmed by new routines [i.e. MCAS/AOA related programmings] which may from time to time corrupt the system.

- Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures (http://www.avherald.com/h?article=4c0886c4&opt=0)

Very interesting information, but raises more questions than answers!

My first question is why did MCAS not activate, unlike the other two cases?
I would speculate 3 possible answers to that:
1. The flight was in autopilot at the time (inhibiting MCAS), and/or FCC was subsequently turned off by crew, or kept on till flaps down.
2. The AOA fault on captain's side may have been nose down (not nose up), so that stick shaker and MCAS were not triggered.
3. On that flight MCAS was active on the co-pilot's flight computer (not captain's side).
They may have survived purely by these chance factors (or good CRM...)

Edit: A question about what happened to the faulty ADIRU: Was it kept and repaired, sent back to the manufacturer, or perhaps handed over to the Canadian TSB? Was this a reportable event, or purely a maintenance issue?

[Data Guy]

https://www.easa.europa.eu/sites/default/files/dfu/IM.A.120%20Boeing737%20TCDS%20APPENDIX%20ISS%2010.pdf REF TO PAGE 15 OF THIS DOCUMENT > Explanatory Note to TCDS IM.A.120 – Boeing 737

[JRBarrett]

Very interesting information, but raises more questions than answers!

My first question is why did MCAS not activate, unlike the other two cases?
I would speculate 3 possible answers to that:
1. The flight was in autopilot at the time (inhibiting MCAS), and/or FCC was subsequently turned off by crew, or kept on till flaps down.
2. The AOA fault on captain's side may have been nose down (not nose up), so that stick shaker and MCAS were not triggered.
3. On that flight MCAS was active on the co-pilot's flight computer (not captain's side).
They may have survived purely by these chance factors (or good CRM...)

Edit: A question about what happened to the faulty ADIRU: Was it kept and repaired, sent back to the manufacturer, or perhaps handed over to the Canadian TSB? Was this a reportable event, or purely a maintenance issue?

There is nothing in that report to indicate there was an AOA problem, specifically. The symptoms sound more like a failure of the ADIRU itself. If the air data portion of the ADIRU failed, it would cause a miscompare in altitude or airspeed. If the IRU portion failed, it would cause a miscompare in pitch, roll and heading. Either type of failure would cause an autopilot disconnection.

The weather radar depends on accurate IRU pitch and roll data for stabilization, and IRU data is also used by the TCAS.

Because of the two crashes, now ANY in-flight technical failure on a 737-8 MAX aircraft is going to draw immediate media attention - as we saw just a few days ago with the engine problem on the SWA ferry flight departing MCO.

[OldnGrounded]

https://www.easa.europa.eu/sites/default/files/dfu/IM.A.120%20Boeing737%20TCDS%20APPENDIX%20ISS%2010.pdf REF TO PAGE 15 OF THIS DOCUMENT > Explanatory Note to TCDS IM.A.120 – Boeing 737

Very interesting. Well worth reading. Here are the first and penultimate paragraphs:

The aisle stand trim switches can be used to trim the airplane throughout the flight envelope and fully complies with the reference regulation Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts.In those cases, longitudinal trim is achieved by using the manual stabilizer trim wheel to position the stabilizer. The trim wheel can be used to trim the airplane throughout the entire flight envelope.In addition, the autopilot has the authority to trim the airplane in these conditions.
[. . .]
Furthermore, the additional crew procedures and training material will clearly explain to pilots the situations where use of the trim wheel may be needed due to lack of trim authority with the wheel mounted switches.

[ecto1]

ecto



Your analysis is fundamentally flawed because AOA is not valid before takeoff, and any data points prior to that must be ignored. The AOA sensor relies on significant forward speed to align the vane with the airflow, and this is not possible while taxiing.

IMHO,

Any data points before takeoff (or after landing) do not correlate with real AOA values, without significant forward speed the vane will not reflect anything resembling AOA: Obviously correct.

These data points should be ignored? I don't agree. Lots and lots of hints there.

For instance, a constant offset theory (like bad indexing) doesn't hold water:

If the offset were there from the power on, as in a software error, it is an amazing coincidence that the right side vane, supposedly ok, has no noise and very minimal changes on the ground while the left one (suspect) has significant noise and/or large changes in both flights. (true I'm only basing this on 3 taxi events, but each is some minutes long). As opposed as in the air, where you could not tell one from the other if it wasn't for the offset. Wind on the ground will move the vanes randomly, of course, but it is an amazing coincidence that only left side dances in all three taxiing events.

Another example. If the offset were a consequence of a wrong correction table based on airspeed being used in the left side computer, it would be an impossible coincidence that the offset remained after landing with airspeed back to zero, as we can see in the data trace of the previous flight.

I would regard any proposed theory better if it is consistent with that behaviour in the air and on the ground seen in both data traces.

In fact, due to Occam's razor, any theory should also be consistent with the rest of the alarms. Specially the FEEL PRESS DIFF. There must be a root cause for all this.

Don't you agree?

[rcsa]

From reading the comments on the mainstream media stories covering this issue, my sense is that a large percentage of pax don't have that faith. I'll be surprised if there isn't widespread reluctance to fly the MAX as SLF, when it returns to commercial service.

Many of us said the same about the early 78, during its 'Firebird' days. Five years later, the 78 gets consistently high ratings by that minority of the passenger community who have any clue what aircraft type they are flying on. Of course, there were no revenue hull losses during the 78's problem period, and one can assume the two crashes will count more against the 73-Max in perception terms. But I suspect in 5 years time most pax will be flying the 73-Max-10/11/12 without a second thought.

Boeing are going to make damn sure branding of the next variant of the Max will be an ocean of clear blue water away from the Max-8/9. They might even drop the 'Max' name, and come up with something touchy-feely that taps into the 'Dreamliner' imagery - The '737-Sunliner', perhaps.

[OldnGrounded]

But I suspect in 5 years time most pax will be flying the 73-Max-10/11/12 without a second thought.

Agreed. But I don't think that's likely to be true for the year or two after the MAX gets back into the air.

Boeing are going to make damn sure branding of the next variant of the Max will be an ocean of clear blue water away from the Max-8/9. They might even drop the 'Max' name, and come up with something touchy-feely that taps into the 'Dreamliner' imagery - The '737-Sunliner', perhaps.

Indeed. There's probably a branding and imagery team working on it as we type.

[vbp.net]

“From reading the comments on the mainstream media stories covering this issue, my sense is that a large percentage of pax don't have that faith. I'll be surprised if there isn't widespread reluctance to fly the MAX as SLF, when it returns to commercial service”

I’m former ATC and I can tell you that even before the MAX was grounded I had checked that my next flight was NOT a MAX, otherwise I would have cancelled it right away. This beeing said, I think that with time, assuming the MAX is allowed to fly again, fewer and fewer people will keep in mind that this version of the venerable 737 has gone a step too far and is probably the last “improved” version of this cable and pulleys dinausaur.
Yet, our last chance of pushing certification agencies to take their mission seriously is for the travellers to refuse to board a plane when they have good reasons to believe their safety was sacrified to better profit for the shareholders which is clearly the case here.

Vincent

[formulaben]

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/960x600/aoa_vaneindicator_aoa_disagree_lg_5b196fd8ae169ef64d606b8224 4f75aa9a78eac9.jpg


Interesting choice of aoa information presentation.

Wouldn't a vertical strip type lead to superior intuitive comprehension?

Totally agree, absolutely horrible placement of both AOA indicator and AOA disgree flag. Both should be adjacent to airspeed indicator.

[GlobalNav]

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/960x600/aoa_vaneindicator_aoa_disagree_lg_5b196fd8ae169ef64d606b8224 4f75aa9a78eac9.jpg




Totally agree, absolutely horrible placement of both AOA indicator and AOA disgree flag. Both should be adjacent to airspeed indicator.

Band-aid on a band-aid - that's the Boeing design philosophy of the Max. The AoA display makes little, if any, safety contribution to the flight deck (procedure wise) and the AOA disagree light even less. What is a pilot supposed to do when the AoA disagree light illuminates? Hit the trim switches? I wonder how often that light will illuminate, anyway. Probably often enough to get ignored.

[ktcanuck]

Band-aid on a band-aid - that's the Boeing design philosophy of the Max. The AoA display makes little, if any, safety contribution to the flight deck (procedure wise) and the AOA disagree light even less. What is a pilot supposed to do when the AoA disagree light illuminates? Hit the trim switches? I wonder how often that light will illuminate, anyway. Probably often enough to get ignored.

I think "MCAS Disabled" would be more useful than either of those two. After all, that's what "AOA disagree" will mean.

[Ian W]

Band-aid on a band-aid - that's the Boeing design philosophy of the Max. The AoA display makes little, if any, safety contribution to the flight deck (procedure wise) and the AOA disagree light even less. What is a pilot supposed to do when the AoA disagree light illuminates? Hit the trim switches? I wonder how often that light will illuminate, anyway. Probably often enough to get ignored.

It would have been better to give everyone the AoA indicator (misplaced though it is) and for AOA Disagree replace the graphic of the indicator with AOA DISAGREE - after all with two AoA's you cannot present guaranteed correct information, and to use the old aphorism - "no information is better than bad information"

[WHBM]

From reading the comments on the mainstream media stories covering this issue, my sense is that a large percentage of pax don't have that faith. I'll be surprised if there isn't widespread reluctance to fly the MAX as SLF, when it returns to commercial service.
Notably, the Max had already got a poor passenger reception for reduced passenger ambience standards, with carriers such as American, with (compared to the NG) reduced seat pitch, particularly cheaper-feeling and less padded seats, and a very minimalist toilet module that some felt difficult to even turn round in. When assigned to long runs such as Miami down to South America these were all apparently noticeable. Yet the carrier did not seem to find them an issue, and continued to market the services and take delivery of additional aircraft without issue.

[slfool]

Leaks this week from the crash investigation in Ethiopia and in the US suggest an automatic anti-stall system was activated at the time of the disaster

https://www.bbc.co.uk/news/business-47759966

[ManaAdaSystem]

Band-aid on a band-aid - that's the Boeing design philosophy of the Max. The AoA display makes little, if any, safety contribution to the flight deck (procedure wise) and the AOA disagree light even less. What is a pilot supposed to do when the AoA disagree light illuminates? Hit the trim switches? I wonder how often that light will illuminate, anyway. Probably often enough to get ignored.

The NGs I fly have this AOA disagree caution. Not sure if it is an option or standard, but this is not new for the MAX.
I have never had it come on. Never had a problem related to the AOA sensors either.
Are the MAX sensors a new design?

[gearlever]

The NGs I fly have this AOA disagree caution. Not sure if it is an option or standard, but this is not new for the MAX.
I have never had it come on. Never had a problem related to the AOA sensors either.
Are the MAX sensors a new design?



To my limited knowledge it's an option for the MAX.
But neither Ethiopian nor Lion had it installed.

[Dee Vee]

There's no reference to any maintenance action involving the AoA sensor at Jakarta in the report.

The more I think about these AoA sensors, the less likely I think they are physically defective, especially given the same nose down scenario was previously reported anonymously by at least 4 US pilots, although they recovered from the incidents and did not crash.

[ecto1]

In what form is the output from the AOA sensor transmitted to the avionics? Apologies if this is going over old stuff...

There is a schematic in this thread for NG: 3 way link, labeled sin, cos and com. That to me points to a resolver, which is really like a synchro but with two poles at 90 deg instead of 3 at 120.

Basically analog, AC, fixed freq, varying amplitude, going from maxAOA (vmax, 0) to minAOA (0, vmax) and being centered in (0.707vmax, 0.707vmax).

I'm not sure, though.

[DaveReidUK]

The NGs I fly have this AOA disagree caution. Not sure if it is an option or standard, but this is not new for the MAX.I have never had it come on. Never had a problem related to the AOA sensors either.
Are the MAX sensors a new design?
No, sensors are interchangeable with those on the NG.

[patplan]

From the NY Times...
In Ethiopia Crash, Faulty Sensor on Boeing 737 Max Is Suspected
March 29 2019

Black box data from a doomed Ethiopian Airlines flight suggests the crash was caused by a faulty sensor that erroneously activated an automated system on the Boeing 737 Max, a series of events suspected in an Indonesian disaster involving the same jet last year.
Data from a vane-like device, called the angle-of-attack sensor, incorrectly activated the computer-controlled system, according to several people who have been briefed on the contents of the black box in Ethiopia. The system, known as MCAS, is believed to have pushed the front of the plane down, leading to an irrecoverable nose-dive that killed all 157 people aboard.

The black box, also called the flight data recorder, contains information on dozens of systems aboard the plane. The black boxes on the jets, Boeing’s latest generation of the 737, survived the crashes, allowing investigators to begin piecing together what caused the disasters. Both investigations are continuing, and no final determinations have been made.

The new connections between the two crashes point to a potential systemic problem with the aircraft, adding to the pressure on Boeing. The company already faces scrutiny for its role in the design and certification of the plane. The Federal Aviation Administration delegated significant responsibility and oversight to Boeing...


- https://www.nytimes.com/2019/03/29/business/boeing-737-max-crash.html

[dozing4dollars]

I would like to know how many similar snags ( Stick Shaker, Unreliable AS, use of Stab Trim cutout switches ) have been logged on the MAX?

I mean world wide.

[compressor stall]

In both causes software is attempting to prevent the stall.

not quite true. The MCAS was developed not to prevent the stall but to ensure that the stick forces approaching the stall continually are heavier iaw FAR design criteria. It does not prevent the stall.

[LandIT]

The new connections between the two crashes point to a potential systemic problem with the aircraft, adding to the pressure on Boeing. The company already faces scrutiny for its role in the design and certification of the plane. The Federal Aviation Administration delegated significant responsibility and oversight to Boeing...

If MCAS is so necessary because of the engine cowling moment in certain attitudes, wouldn't it be better to have a third AOA sensor to enable voting in the system. The bigger Boeing's and AB's have more than 2. The 737 is and is going to continue to be among the most numerous planes in the sky. Why not ensure it is as safe as them. I don't accept that saving a relatively small amount of money on a smaller airplane or quoting failures in the per billion hours is really valid when the larger planes have it, obviously for a good reason. There are far more 737's flying, far more takeoffs and landings making for just as much overall risk as the 777's and 787's (assuming more AOA's were provided for greater passenger capacity).

[joe falchetto 64]

Are you being serious? A faulty AOA vane instructs the flight control computers/stabilizer to pitch the nose down in both the Airbus and the Boeing events, overriding the pilots inputs and you fail to see the similarities. Do you work for Airbus by any chance or are you just being ignorant. In both causes software is attempting to prevent the stall.
Not only Fortissimo but myself being serious, it is like comparing apples and oranges. The Airbus AoA protection is indeed a component of a global envelope protection, in a FBW flight control system. I beg your pardon, my intention is not to give a lecture, but I think I should outline some of the AOA protection features on Airbus for better understanding. If the AoA reaches a value defined as "alphaprot" then the AOA protection activates, and will keep "alphaprot" value without pilot inputs. At this time any stabilizer nose up inputs are inhibited. The pilot's inputs on sidesticks are not anymore a g-load demand but become an AOA demand: the pilot can still increase backpressure on the sisdestick but cannot go beyond the so called "alphaMAX" no matter how much is the pulling: the system keeps the aircraft close at 1 g stall but doesn't exceed it . Let's not talk here about how the autothrust plays the game in "alphaprot". The most important difference that I see is that on Airbus the stabilizer is inhibited in any ANU demand, and gives AND autotrim following the pilot pushing his/her sidestick. That is obviously in a normal condition without mulfunztions.
So there is one big difference: Airbus AOA protection doesn't move the stabilizer at all: it acts on the elevators. It uses three AOA vanes with a voting system. While I am not saying at all that this implementation is the best can be built by the industry, I think it is way different from the path that Boeing has followed with MCAS

[Mac the Knife]

Quote. "Totally agree, absolutely horrible placement of both AOA indicator and AOA disagree flag. Both should be adjacent to airspeed indicator."

And I can't say that having AOA DISAGREE displayed in dark-yellow (#C1994C) on khaki (#5E4300) is exactly attention-drawing...

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/113x81/aoa_disagree_df0220b08a85d8016fe7e8a541d7879fe3ce4bb7.jpg

Mac

[GordonR_Cape]

If MCAS is so necessary because of the engine cowling moment in certain attitudes, wouldn't it be better to have a third AOA sensor to enable voting in the system. The bigger Boeing's and AB's have more than 2. The 737 is and is going to continue to be among the most numerous planes in the sky. Why not ensure it is as safe as them. I don't accept that saving a relatively small amount of money on a smaller airplane or quoting failures in the per billion hours is really valid when the larger planes have it, obviously for a good reason. There are far more 737's flying, far more takeoffs and landings making for just as much overall risk as the 777's and 787's (assuming more AOA's were provided for greater passenger capacity).

The B737 series is a mostly safe and reliable aircraft, with limited levels of automation. To my knowledge no B737 has crashed (other than the MAX MCAS incidents) solely because of a single isolated AOA failure. AOA is not even a primary flight indicator, as shown by the fact that many airlines declined to fit it.

Trying to fix a faulty MCAS system by adding a third AOA sensor would not be a simple exercise. The necessary design, testing, certification, maintenance and type training changes could take years.

MCAS is not so vital that it justifies rewiring large parts of the aircraft. It only adresses a regulatory issue of pilot yoke elevator feedback in the high AOA part of the manual flight regime.

It is deeply ironic that the issue MCAS was designed to cater for was never flight critical, and might never have occurred during the lifetime of the aircraft. Instead the fix ended up killing hundreds of people.

[EDLB]

Trying to fix a faulty MCAS system by adding a third AOA sensor would not be a simple exercise. The necessary design, testing, certification, maintenance and type training changes could take years.

MCAS is not so vital that it justifies rewiring large parts of the aircraft. It only adresses a regulatory issue of pilot yoke elevator feedback in the high AOA part of the manual flight regime.

It is deeply ironic that the issue MCAS was designed to cater for was never flight critical, and might never have occurred during the lifetime of the aircraft. Instead the fix ended up killing hundreds of people.

Are you serious? We have the year 2019 and not 1950. Customers expect a thorough analysis and solution to regain confidence and not an additional kludge.

Thats what the 737 MAX looks on statistics:
https://qz.com/1571820/deaths-on-the-boeing-737-max-8-vs-other-commercial-aircraft/

It is a great case for the industry to learn. And it is more about the decision making processes on all levels, than on a technical only analysis of this latent fault condition of the MCAS system. There is a reason that the FAA AIM has about 800 pages written mostly with blood.

Currently Boeing could have made the complete skin of the B737 MAX only from AoA vanes and would still be better off.

[GordonR_Cape]

Are you serious? We have the year 2019 and not 1950. Customers expect a thorough analysis and solution to regain confidence and not an additional kludge.
Thats what the 737 MAX looks on statistics:
https://qz.com/1571820/deaths-on-the-boeing-737-max-8-vs-other-commercial-aircraft/

It is a great case for the industry to learn. And it is more about the decision making processes on all levels, than on a technical only analysis of this latent fault condition of the MCAS system. There is a reason that the FAA AIM has about 800 pages written mostly with blood.

Currently Boeing could have made the complete skin of the B737 MAX only from AoA vanes and would still be better off.


My comment was in response to a specific question, and not a commentary about the MAX aircraft in general. Nor am I trying to discount the disastrous nature of MCAS, but pointing out that adding a 3rd AOA to an old airframe does not solve anything (unless the avionics are adapted to read and process the 3rd sensor).

I concur with your other comments, which are best directed at Boeing and the FAA. Being judgemental does not help solve this specific problem.

[John4321]

Another issue often missed by software teams is the fact that with analogue sensors, any erratic indications are damped by the meters or are simply ignored by the crew. Converting the outputs of the sensors to digital format doesn’t ignore the noise in the signal and, with polling if the sensor, could lead to large discrepancies in signal used for the controls.

You simply must do thorough testing of flight safety critical systems including flight trials.

Inexcusable imho.

[Interflug]

...Nor am I trying to discount the disastrous nature of MCAS, but pointing out that adding a 3rd AOA to an old airframe does not solve anything.

As far as I understand logic, a 3rd AoA would have allowed the system to run a software algorithm that votes an erroneous AoA sensor input out against the other two. That would have solved EVERYTHING in those two crashes, no?
It would have prevented MCAS from activating in the first place. 346 people would still live. Two airplanes would still fly. And all the other 737 MAX would not have been grounded.
How can you come to the conclusion that it wouldn't have solved anything?
We know by now why Boeing did use only one sensor input: to save money, and keeping the reckless promise, that crews would need no expensive training to fly the plane except minutes with some slideshow on the iPad. In order to do so, they had to downgrade the risk as in case of malfunction not potentially catastrophic, and apparently they did so intentionally, and the FAA was partner in crime.

[GordonR_Cape]

As far as I understand logic, a 3rd AoA would have allowed the system to run a software algorithm that votes an erroneous AoA sensor input out against the other two. That would have solved EVERYTHING in those two crashes, no?
It would have prevented MCAS from activating in the first place. 346 people would still live. Two airplanes would still fly. And all the other 737 MAX would not have been grounded.
How can you come to the conclusion that it wouldn't have solved anything?
We know by now why Boeing did use only one sensor input: to save money, and keeping the reckless promise, that crews would need no expensive training to fly the plane except minutes with some slideshow on the iPad. In order to do so, they had to downgrade the risk as in case of malfunction not potentially catastrophic, and apparently they did so intentionally, and the FAA was partner in crime.

A third AOA would only have worked if the Boeing 737 MAX had new flight control computers like other models (including Airbus). That was never going to happen, due to the huge cost, certification and training issues. I never implied that 3 AOA sensors have no function, but unless the system architecture can process and vote on them, the third one has no purpose.

[RetiredBA/BY]

As far as I understand logic, a 3rd AoA would have allowed the system to run a software algorithm that votes an erroneous AoA sensor input out against the other two. That would have solved EVERYTHING in those two crashes, no?
It would have prevented MCAS from activating in the first place. 346 people would still live. Two airplanes would still fly. And all the other 737 MAX would not have been grounded.
How can you come to the conclusion that it wouldn't have solved anything?
We know by now why Boeing did use only one sensor input: to save money, and keeping the reckless promise, that crews would need no expensive training to fly the plane except minutes with some slideshow on the iPad. In order to do so, they had to downgrade the risk as in case of malfunction not potentially catastrophic, and apparently they did so intentionally, and the FAA was partner in crime.
Triplexing of the A of A vanes could, should have prevented the MCAS system from erroneous operation.
However a DUAL system, with a comparitor could well be the fix. If the AoA sensors disagree the MCAS is disabled and there is a flight deck warning of lack of stall warning, fly the airplane normally to destination then fix it ! Loss of stall warning is, frankly, no big deal for continuing the sector, as there has been an infinitely small number of stalls on commercial airliners.

A Boeing precedent was the rudder ratio system on the 75 and 76, my last aircraft. If we got a rudder ratio failure warning, we flew the airplane normally, being aware that coarse rudder inputs at high speed were to be avoided as fin overload could occur, ( they were never used anyway ! ) No sim training required to deal with that, just knowledge of the system.

In addition I believe the degree of travel of the stab. with MCAS, should be limited as a function of speed such that elevator input could overcome the MCAS commanded travel. After the RAF Valiant, my first 4 jet, tailplane runaway and crash in 1964 , we found we could overcome the runaway stab, just by max elevator input, just.

In addition perhaps the MCAS should be limited to one cycle ONLY. afer all, with the shaker and a single nose down push, just how much more stall warning does a trained crew require before initiating the classic recovery technique, lower the nose til the shaker, vibration and noise, or buffet stops, add power, gently roll wings level. Worked on every jet I have ever flown. Even on the T tailed VC 10 we did not have anything as aggressive as the MCAS system and a stall on a T tailed jet could be a lot more dangerous than on a 737.
Comment based on my Boeing experience of about 6000 command hours on the 737 200 and 300, inc as trainer, and 4000 on the 75 and 76, all brilliant aircraft.

[KRUSTY 34]

Band-aid on a band-aid - that's the Boeing design philosophy of the Max. The AoA display makes little, if any, safety contribution to the flight deck (procedure wise) and the AOA disagree light even less. What is a pilot supposed to do when the AoA disagree light illuminates? Hit the trim switches? I wonder how often that light will illuminate, anyway. Probably often enough to get ignored.

I wonder if the whiz kids who design the interface, and the heads of their departments, ever thought it might be a good idea to at least get some input from those who actually fly the thing?

Nah, pilots! What would they know?

[Blythy]

As far as I understand logic, a 3rd AoA would have allowed the system to run a software algorithm that votes an erroneous AoA sensor input out against the other two. That would have solved EVERYTHING in those two crashes, no?

XL Airways Germany Flight 888T, quote below is from the wiki page:
The aircraft's computers received conflicting information from the three angle of attack sensors. The aircraft computer system’s programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative angle of attack sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative angle of attack sensors.

Triplexing/Voting works on the assumption that a single failure is unlikely, and a failure that affects two parts simultaneously is therefore extremely unlikely. It does not take into account a single root cause failure (as in the XL airways incident) that affects two parts simultaneously.
As an example, on the Space shuttle, there were four identical computers which voted against each other in the case of discrepancy. However, there was a 5th computer (limited to ascent and reentry only) which was different hardware and different software in the event of something which had the same root cause in the software / hardware.

[Interflug]

XL Airways Germany Flight 888T, quote below is from the wiki page:
Triplexing/Voting works on the assumption that a single failure is unlikely, and a failure that affects two parts simultaneously is therefore extremely unlikely. It does not take into account a single root cause failure (as in the XL airways incident) that affects two parts simultaneously.

True. It's never 100% safe. But the XL Airways crash really was a black swan event in comparison, for the holes in the cheese to line up that way:
Test flight with test pilots, intentionally stalling at 3,000' (instead of 10,000').
Two out of three AoA sensors frozen, due to water contamination from high pressure cleaning the aircraft for painting, two days previously.
Would it have been a flight with passengers, they wold not have stalled at 3,000' intentionally.

[Interflug]

Thanks.
So the signal is NOT converted at the sensor and fed into a databus....
Apparently. Begs the question if the cables are shielded.
Airplanes are complex machines.
https://en.wikipedia.org/wiki/Qantas_Flight_72
http://www.atsb.gov.au/publications/investigation_reports/2008/AAIR/pdf/AO2008070_prelim.pdf
https://en.wikipedia.org/wiki/Naval_Communication_Station_Harold_E._Holt

[ATC Watcher]

Test flight with test pilots, intentionally stalling at 3,000' (instead of 10,000').
Not quite , there were not test pilots , otherwise they would not attempted this test like they did on the approach leg .
from the accident synopsis :
The primary cause of the accident was that the crew attempted an improvised test of the AOA warning system, not knowing that it was not functioning properly due to the inoperative sensors. They also disregarded the proper speed limits for the tests they were performing, resulting in a stall
But your reasoning is correct , this cannot be compared to the 2 Max accidents, as as the aircraft been normally flown it would never have stalled, or dive/trimmed into the water.

[TryingToLearn]

Triplexing/Voting works on the assumption that a single failure is unlikely, and a failure that affects two parts simultaneously is therefore extremely unlikely. It does not take into account a single root cause failure (as in the XL airways incident) that affects two parts simultaneously.
As an example, on the Space shuttle, there were four identical computers which voted against each other in the case of discrepancy. However, there was a 5th computer (limited to ascent and reentry only) which was different hardware and different software in the event of something which had the same root cause in the software / hardware.

I think that's the point:
Redundancy is a measure against random faults. Diversity is a measure against systematic faults.
A stone-age sensor which is working perfectly on one type of aircraft (thousands of planes for decades) is now mounted on a modified type and the fault rate went up drastically (350 planes, maybe 500 flights each, 6 failures). Or does every old 737 gets new AoA sensors every year because they fail that often?
How can you explain that with statistics?
I would assume that this cannot be explained without a systematic failure (wrong design, production failure) that leads to this drastic increase in failure probability. Especially since the failure mode is always the same in time (before flight) and even magnitude (22.5°).

So how can you now prevent that by redundancy (2 out of 2)? The actual statistics lead to an error every 3000 flights, so even if both sides are independent there is a double fault at least every 850 million flights. With the airplanes ordered that's every 20 years. But since systematic faults may tamper reliability in an unknown way, this calculation is very optimistic...
Limiting the capabilities of MCAS is the bandaid (less trim only once), comparing the sensors is just a gimmick.
And claiming to fix something with a systematic failure without identifying it is...

Oh, and as a safety consultant working at ASIL D (highest automotive level safety) inductive resolvers I can only imagine 2 failure modes which cause such a deviation if usual diagnostics are in place (vector length check, range check...):
a) Electromagnetic interference 'locked' the driving coil resonator on the EMI frequency and is also received by the receiver coils, being then demodulated on the sin/cos output (maybe from the new engines / engine electrical generators...)
b) If the resolver is made with +-45 mechanical deg angle range (360° electrical equal 90° mechanical) and the software is running on a stone-age 80286 without sin/cos coprocessor, an error in table-based sin/cos calculation would exactly result in 90° electrical / 22.5° mechanical angle deviation. Such tables only contain one quadrant of sin/cos and then just switch signs to get the other three.

btw: For the highest automotive safety level you use 2oo2 with a very strict analysis of production / design common cause errors and dependent failure analysis or even 2oo2 on different sensors from different fabs. But to be fair: randomly blocking tires at 100mph is even less controllable than MCAS, therefore it is not completely comparable.

[YYZjim]

We all know about the negative effect of a strong cockpit gradient.

Could a plane-to-pilot gradient be a factor in Indonesia and Ethiopia? American pilots would have no trouble treating a persistent intermittent auto-trim as a "runaway". Foreign-speaking pilots might be more respectful of a sophisticated American airplane, and more wary about breaching the conditions for a NNC.

[GordonR_Cape]

We all know about the negative effect of a strong cockpit gradient.

Could a plane-to-pilot gradient be a factor in Indonesia and Ethiopia? American pilots would have no trouble treating a persistent intermittent auto-trim as a "runaway". Foreign-speaking pilots might be more respectful of a sophisticated American airplane, and more wary about breaching the conditions for a NNC.

I would add to that the newness factor. A 20-30 year old aircraft might be expected to have some gremlins. A 6 month old one should not have, unless you treat all devices with skepticism. The trust-your-instruments not your gut perception, might add to the confusion and cockpit gradient.

[Back at NH]

Foreign-speaking pilots might be more respectful of a sophisticated American airplane
You gotta be kidding!

I would add to that the newness factor. A 20-30 year old aircraft might be expected to have some gremlins.
Ethiopian's fleet average age is 6.2 years.Their oldest 737NGs are 15-17 years old, most under 10.

[patplan]

SOTBO/layman speculation - Both crashes, same aircraft, same system fault, same type of sensor involved, same environment i.e. low level in the tropics. So, assuming that all national aviation and air operator rules and regs are complied with as regards operations, that's leaves 1. heat, 2. insects or 3. peculiar air pressure variation. I suspect that duplicating the sensors won't eliminate 1 & 2. The solution to 1 is design and or materials to produce more resilient sensor with a bigger envelope of operation and to 2. guards/filters and/or ramped-up servicing/cleaning regimes for same.

N
edited... Ethiopia is actually more continental than a typical tropical country. Addis Ababa at 7700+ ft ASL actually has more elevation than even the mile-high city of Denver. Indonesia, on the other hand, where the Lion Air's PK-LQP crashed, is an archipelago, and literally there are more than 10,000 islands there- surrounded by two oceans- and a home for hundreds of active volcanoes.

They are two completely different "tropical countries".

[GarageYears]

SOTBO/layman speculation - Both crashes, same aircraft, same system fault, same type of sensor involved, same environment i.e. low level in the tropics. So, assuming that all national aviation and air operator rules and regs are complied with as regards operations, that's leaves 1. heat, 2. insects or 3. peculiar air pressure variation. I suspect that duplicating the sensors won't eliminate 1 & 2. The solution to 1 is design and or materials to produce more resilient sensor with a bigger envelope of operation and to 2. guards/filters and/or ramped-up servicing/cleaning regimes for same.

N

Firstly, as it stands the cause of the second crash is unknown. Fingers pointing at MCAS are speculation, at least until the interim report is published. It may well be a better narrative than other options.

Notwithstanding that, the Ethiopian environment is way different than those that occurred with Lion Air. Check out the MSL altitude of both departure airfields...

Finally, the same AOA sensor is flying in several thousand 737NGs today. It doesn’t seem the sensor is likely to be to blame.

Truth is the Lion Air aircraft shouldn’t have been in service, given the maintenance log and lack of accurate documentation of issues with the aircraft on previous flights. As for Ethiopian we just don’t know any facts, other than the actual crash.

- GY

[bill fly]

Well I don’t agree, for me AoA is an anolog value, which can be related directly to vane angle much more easily on a dial, than yet another strip display.

[patplan]

Firstly, as it stands the cause of the second crash is unknown. Fingers pointing at MCAS are speculation, at least until the interim report is published. It may well be a better narrative than other options.

Notwithstanding that, the Ethiopian environment is way different than those that occurred with Lion Air. Check out the MSL altitude of both departure airfields...

Finally, the same AOA sensor is flying in several thousand 737NGs today. It doesn’t seem the sensor is likely to be to blame.

Truth is the Lion Air aircraft shouldn’t have been in service, given the maintenance log and lack of accurate documentation of issues with the aircraft on previous flights. As for Ethiopian we just don’t know any facts, other than the actual crash.

- GY


Well, actually this Ethiopian investigation is almost as leaky as the Indonesian one... The main suspects are very much the same: AOA reading and MCAS.

Since MCAS, in its past iteration, after being fed by erroneous data by a single AOA vane, have a knack to drive the trim mechanism to the end of the jackscrew, essentially doing its job as programmed spectacularly "well", that will leave the AOA vane as the fall guy.

Except..., it is ALMOST IMPOSSIBLE for the vanes which had been in used since forever and thought to have been very reliable would be implicated as the cause for the two crashes within the span of 5 months. This will leave us with something else more plausible as the caused but has been largely ignored: the Max-8 flight control system or something therein...

[hjd10]

A third AOA would only have worked if the Boeing 737 MAX had new flight control computers like other models (including Airbus). That was never going to happen, due to the huge cost, certification and training issues. I never implied that 3 AOA sensors have no function, but unless the system architecture can process and vote on them, the third one has no purpose.

I bet Boeing wished that they had spent that extra cash now!

[EDLB]

I take bets that it has something to do with the signal wiring form the AoA vane to the flight computer (ADIRU) like shorting out one half of the SIN or COS symmetric signal and creating with that something around a 45 degree/2 offset. If the Ethopian airline FDR does show a similar problem, then there is some latent harness, connector or ADIRU problem which will show up in the other 737 MAX made in a similar timeframe. So if that establishes, the investigation might look into some of the grounded planes build in similar timeframe.

[Daft01]

As an example, on the Space shuttle, there were four identical computers which voted against each other in the case of discrepancy. However, there was a 5th computer (limited to ascent and reentry only) which was different hardware and different software in the event of something which had the same root cause in the software / hardware.

Not entirely true. All 5 computers are AP-101. It had a different subset of functions for ascent and descent, written by Rockwell (IBM was the main contractor for the hardware and flight software). It wasn't a complete rewrite of the flight software. The reason given for not having different hardware was that is would have cost too much. The software itself was an OS written in assembly, and the main code written in HAL/S, possibly on different versions of compiler.

Has there ever really been an aircraft with 2 completely separate hardware and software teams?

Info was gotten from
Computers in Spaceflight: The NASA Experience Chapter 4-3
and The Space Shuttle Primary Computer System, Communications of the ACM September 1984 Volume 27 Issue 9

[VicMel]

Whilst all of you Tech ‘bit’ people provide valuable information and possible scenarios, could you please consider why ‘failures’ appear to be very rare and so far only relate to two aircraft / three vanes.

How something fails does not necessarily explain why (when) it failed.
Random, probabilistic, bit count, world clock ?

OK, having considered why the MCAC failures only appear on some flights, possible candidates (the holes in the cheese) that could trigger a software fault in the processing of an AoA correction table (bearing in mind that the ADIRU software was developed only to a “non -safety critical standard”) are:-
1) pin fault: How does an ADIRU recognise it is L or R? Similar sytems I’ve worked on in the past had a fixed pin in the harness connector of one box to designate it as L. If on the problem 737 Max flights the pin became a bad connection, or was bent/missing, the ADIRUs would think they are both L (or both R).
2) IAS fault: As pointed out by patplan in #2799 there was an “IAS & ALT Disagree shown after take off”. If the correction table is indexed by IAS (or has some dependency on it), the software could have used bad IAS data as an index and read garbage data for the correction items.
3) interrupt corruption: A problem that has bitten me hard on a few occasions over the years is with the software that handles interrupts. Typically, interrupt software has to save data held in registers, perform its actions, and then restore the registers to their entry values. A latent problem can exist (just waiting for the right holes to line up) that a piece of software uses another register that the spec writer of the interrupt routine was unaware was being used. Or, more likely, a software update was made (e.g. MCAS date preparation update) that used another register. So after 100s or 1000s of flight hours the holes line up, the interrupt pings off in the middle of the new software, something (could be a data value, a status flag, a jump address or ….) is corrupted. The consequential behaviour could be any of many surprises!
4) processor overload:

I have a suspicion that in Boeing 737 Max 8 [B38M] perhaps the LEFT/CAPT ADIRU is constantly being overwhelmed by new routines [i.e. MCAS/AOA related programmings] which may from time to time corrupt the system.

I agree, as the (old tech) processors become more and more loaded, there will reach a point where, given the right circumstance of several things needing to be computed in one cycle, a software routine will not complete. Just as an example, the start up stage will be quiet busy. I would expect the ADIRU to determine its L or R status (perhaps read a pin) and store the result for other software routines to use. So if this action does not complete the ADIRU L or R status will stay at the default value; ADIRUs would both stay as L (or R).
5) flap position: From the preliminary report (Fig. 5 on accident flight & Fig. 7 on previous flight) there is a difference in when the flap position changes. Fig 5 shows a change well after rotation, Fig 7 shows a change at the point of rotation. Could this difference have affected how MCAS subsequently behaved?

[DaveReidUK]

So after 100s or 1000s of flight hours the holes line up, the interrupt pings off in the middle of the new software, something (could be a data value, a status flag, a jump address or ….) is corrupted. The consequential behaviour could be any of many surprises!

That sounds like a description of a random failure, rather than something that would manifest itself over several consecutive flights, as was the case with Lion Air.

[GlobalNav]

Well I don’t agree, for me AoA is an anolog value, which can be related directly to vane angle much more easily on a dial, than yet another strip display.


The AoA display should be designed to support the pilot’s proper and effective use of it (whatever that is). It should be considered, not in isolation, but in the context of the rest of the flight display(s) and the instrument scan which the pilots are expected to conduct. Does any airline which has aircraft equipped with the AoA display have approved pilot procedures for its use? If a check ride was conducted, in which phases of flight would a pilot be faulted for failure to maintain awareness of the AoA display? If one were to evaluate the AoA display design, what measure of performance would be used? Considering the approved Boeing EFIS with the AoA in the upper right corner, how does that fit Basic T flight display philosophy? Of course it doesn’t, because AoA was never part of the Basic T. But if there was a logical, task performance-based purpose for the AoA display, why would it be placed above the altitude display, about as far from the airspeed and attitude indications as it could be? Yet, we suppose it enhances safety?

[ecto1]

I take bets that it has something to do with the signal wiring form the AoA vane to the flight computer (ADIRU) like shorting out one half of the SIN or COS symmetric signal and creating with that something around a 45 degree/2 offset. If the Ethopian airline FDR does show a similar problem, then there is some latent harness, connector or ADIRU problem which will show up in the other 737 MAX made in a similar timeframe. So if that establishes, the investigation might look into some of the grounded planes build in similar timeframe.

In theory, (older 737s) each computer takes the three wires (the two analog signals) and amplify them, then demodulates them (turns them into DC) using the reference AC current that powers the vane, then filters them and finally go to an A/D converter. The values are stored at a memory block, and then a software block reads them, and translate them into a AOA (degrees (atan(sin/cos)), which is once more filtered (so two AOA are available, raw and filtered).

I would be really surprised if the software block did not, at that point, perform the plausibility check (sin^2+cos^2=vmax). (for instance, it shows a warning if the vane didn't move more than 3 degrees for a period of time).

But even if it didn't, shorting one of the signals to vref would produce 9 degrees offset at the vane. Does that translate to 22 degrees airplane AOA?

[Wilderone]

Well, actually this Ethiopian investigation is almost as leaky as the Indonesian one... The main suspects are very much the same: AOA reading and MCAS.

Since MCAS, in its past iteration, after being fed by erroneous data by a single AOA vane, have a knack to drive the trim mechanism to the end of the jackscrew, essentially doing its job as programmed spectacularly "well", that will leave the AOA vane as the fall guy.

Except..., it is ALMOST IMPOSSIBLE for the vanes which had been in used since forever and thought to have been very reliable would be implicated as the cause for the two crashes within the span of 5 months. This will leave us with something else more plausible as the caused but has been largely ignored: the Max-8 flight control system or something therein...
Except the AOA is not hooked up to MCAS on the NG

[safetypee]

VicMel, #2858, thanks for the reply.

So with my simplistic view the problem appears to be random, chance. Alternatively, as a sceptic, why 2 aircraft in 4 months, whereas the remaining fleet …
OK, so this is the nature of probability, together with the ever-increasing fleet size.

Thus the next question is where a ‘good’ AoA software fix could - should be made, but if not … at least the output of MCAS should be limited.
And if AoA is not fixed (still probability), there could still be problems with speed pressure error correction, air-data disagree, feel, and low speed awareness, but will these events be no more than experience in previous 737s, or if it still is an issue with the Max (inadequate software / FGC ADIRU overloaded) then there will be an increase in disagree alerts due to ‘corrupt’ AoA.

I may be dancing around the same tree as in my post in the other thread - #485 https://www.pprune.org/10434755-post485.html
Where is the value of AoA sampled by the FDR; would this clarify current understanding.

[armchairpilot94116]

Is the Boeing 737 MAX Worth Saving?

can Boeing save it? (http://nymag.com/intelligencer/2019/03/is-the-boeing-737-max-worth-saving.html)

[fdr]

It is deeply ironic that the issue MCAS was designed to cater for was never flight critical, and might never have occurred during the lifetime of the aircraft. Instead the fix ended up killing hundreds of people.

This highlights the underlying issue that the industry has processes that can bite back. To achieve compliance with a particular rule a simple fix is implemented, and that has a potential for unintended consequences. The failure mode of the compliance fix has it's own unknown interaction with the operating system at the man machine interface; somewhere along the way recognition failed as to the underlying cause, for a crew that had never heard of the "fix" and to another crew that had learnt of the problem due to the revelations of the first crews misfortune. In fact, the knowledge gained in the flight preceding JT610 was lost on the next crew as well, the system doesn't allow for the timely transfer of information, and it probably cannot do so under any process that validates the information and the output to avoid errant information being introduced.

The constant offset once in motion would appear inconsistent with a loss of the sin or cos output alone as far as I understand the use of those functions to derive the A-D output state. Contend as previously commented that the sensor itself is unlikely to be the component that has the fault, which leads to the install, wiring, or processing of the signal as being the point of failure. The loss of a single resolved output is intriguing, giving an erroneous result but it would appear that the offset error would alter with the change of actual AOA. The aircraft was operated from low speed, through to high speed, with substantial change in actual AOA, but the offset appears to be constant.

[Livesinafield]

I think the publicity that the max has generated over the last few weeks especially since the grounding, could kill the airframe off... there may be no way back for it. The public are very powerful and could refuse to fly on it even after Boeing has "updated IOS" or whatever they are doing, I personally wont be going near one with my family even after its "fixed" and i fly for a living, so joe public will be even more cautious.

I honesly think its crazy that we are now in a situation where a plane is crashing and we are saying we need a software update... its gone too far.

People except humans make errors and pilots sometimes screw up, what they wont accept is software in charge of their lives

[TryingToLearn]

The constant offset once in motion would appear inconsistent with a loss of the sin or cos output alone as far as I understand the use of those functions to derive the A-D output state. Contend as previously commented that the sensor itself is unlikely to be the component that has the fault, which leads to the install, wiring, or processing of the signal as being the point of failure. The loss of a single resolved output is intriguing, giving an erroneous result but it would appear that the offset error would alter with the change of actual AOA. The aircraft was operated from low speed, through to high speed, with substantial change in actual AOA, but the offset appears to be constant.
There are not many failure modes which may cause such a constant deviation. If normal checks are in place, it rules out everything except wrong calculation within or after atan(sin/cos). Cabling, loss of ground, ADC error... there are checks for such problems and they do not cause a constant offset.
Again, there are 2 possibilities left if I didn't miss something (I'm evaluating such resolvers for 2 safety relevant systems within electric cars at the moment):
-> Electromagnetic interference (EMI) at exactly the frequency the sensor is working on (or the sensor locks on the interference frequency with it's resonator) I tried to find a correlation between engine running/rpm and sensor failure but could not find any. EMI from the new engines would have been a nice one.
-> Error within the calculation after sin/cos and plausibilisation (sin²+cos²=1) -> Software change / bug?

The sin and cos voltage is simply the x and y of a 2D unit vector (look for 'unit vector' on english wikipedia, I'm not allowed to post a link) The receiver simply checks if the unit vector has a length of 1. If a cable breaks or the ADC has an error, it won't.
If there is no need to measure 360°, the electrical full circle is often a fraction of the mechanical one. So the electrical vector would make 2/3/4 turns on one mechanical revolution of the fin. Therefore 22.5° deviation could come from 90° signal error or calculation error. Those 22° somehow smell like some 90° computational error (e.g. wrong sign). Especially since atan calculations in old software only have a table for one quadrant of the unit vector and then switch signs or add/subtract 90°/180°/270°.
Switching cables (sin/cos) would btw. invert the angle (90°-x).

Still: If this sensor design is so bad, why is it still the same for the last decades? What changed on the MAX which tampered the probability of this error that much?

Without an answer to this question I would not trust the AoA signals (and many other) at all! (...and I'm a functional safety consultant)

This SW fix tries to fix the impact of the failure, the root cause seems to be still unknown. But without knowing the cause, other side effects cannot be identified.

[megan]

I honesly think its crazy that we are now in a situation where a plane is crashing and we are saying we need a software update... its gone too farThis is not a first, software code has been responsible for prior accidents, Iberia A320 being one.The design of the flight control system was such that the actions of both pilots over the flight controls were ignored by the logic of the control system and prevented the aircraft from flaring.

The cause of the accident was the activation of the angle of attack protection system which, under a particular combination of vertical gusts and windshear and the simultaneous actions of both crew members on the sidesticks, not considered in the design, prevented the aeroplane from pitching up and flaring during the landing.Fixed by a code modification.

http://www.fomento.es/NR/rdonlyres/8B514392-B79A-46DC-A7C8-DC1BA137D076/23171/2001_006_A_ENG1.pdf

[b1lanc]

This is not a first, software code has been responsible for prior accidents, Iberia A320 being one.
Fixed by a code modification.



Many years ago while working on a fire-control system, we were evaluating test methodologies between the F-16's Westinghouse, General Dynamics Phalanx fire-control, and Airbus fly-by-wire. The Airbus strategy (as I recall which was about 4 decades back) was to deliver the code to 3 companies in three different countries, none of whom knew of the others existence. AB expected each would find some unique code exceptions by doing so. Not so. Well over 90% were identifed by multiple vendors including all deemed critical bugs save maybe one. The rest were not considered major flight control errors.

Maybe Gums could chime in here, but we had heard rumors (maybe urban legend) that some of the early F-16 deployments in Germany with look-down did on occasion lock on to low flying Mercedes on the Autobahn. As a designer, how many would consider that possibility?

There will never be a perfect balance between automation and human interaction. Automation is programmed by humans - mistakes will happen on both ends.

[CurtainTwitcher]

I'm not a software person, however, I have been interested in the automation + human factors since a Computer Science friend put me on a lead in the early 1990's with the Therac-25 accidents (http://sunnyday.mit.edu/papers/therac.pdf), this lead to reading more by Nancy Leveson: High-Pressure Steam Engines and Computer Software (http://sunnyday.mit.edu/steam.pdf). This is a great introduction to the larger picture of the interaction between sophisticated hardware racing well beyond the much slower and risky software engineering in historical context with the engineering of steam engine vs dangerous and lagging boiler tech. Public pressure forced the formation of safety laws to protect the end users from dangerously engineered devices. Although written in 1992, I believe it still has many insights that make it relevant. She also has written much on safe software development techniques.

Her homepage: Nancy Leveson Professor of Aeronautics and Astronautics (http://sunnyday.mit.edu)

[armchairpilot94116]

I think the publicity that the max has generated over the last few weeks especially since the grounding, could kill the airframe off... there may be no way back for it. The public are very powerful and could refuse to fly on it even after Boeing has "updated IOS" or whatever they are doing, I personally wont be going near one with my family even after its "fixed" and i fly for a living, so joe public will be even more cautious.

I honesly think its crazy that we are now in a situation where a plane is crashing and we are saying we need a software update... its gone too far.

People except humans make errors and pilots sometimes screw up, what they wont accept is software in charge of their lives

The Max is all in for Boeing. Fastest selling Boeing jet, yada yada. Boeing is going to do whatever it takes to get that bird back in the air. Too much at stake. The only way for the airframe to end production is if the majority of the orders evaporate overnight. This probably won't happen. So if all goes well and the software patch works and airlines don't cancel orders and the general public goes back to flying it . All will be well. But Boeing will be wise to learn that it is time to get cracking at an all new 737 based loosely on the 757 perhaps. Or better, basically copy the A320. And to amortize the costs of the Max quickly so the line can end soon as the new one is ready. When will it be? Ten years? Now if the Max has another accident within the next few years, no matter the cause, that may be it. Boeing can't afford another Max going down.

[bill fly]

The AoA display should be designed to support the pilot’s proper and effective use of it (whatever that is). It should be considered, not in isolation, but in the context of the rest of the flight display(s) and the instrument scan which the pilots are expected to conduct. Does any airline which has aircraft equipped with the AoA display have approved pilot procedures for its use? If a check ride was conducted, in which phases of flight would a pilot be faulted for failure to maintain awareness of the AoA display? If one were to evaluate the AoA display design, what measure of performance would be used? Considering the approved Boeing EFIS with the AoA in the upper right corner, how does that fit Basic T flight display philosophy? Of course it doesn’t, because AoA was never part of the Basic T. But if there was a logical, task performance-based purpose for the AoA display, why would it be placed above the altitude display, about as far from the airspeed and attitude indications as it could be? Yet, we suppose it enhances safety?

Hi Nav,
The purpose of the AoA indicator on the Max is not to read as an additional flight instrument.
It is a position indicator.
Therefore there is no requirement for it to be included in the scan etc.
If you get a disagree warning you can tell quickly which signal is the troublemaker.
To me it makes sense and yes, it is a safety feature.
If, together with the mod on MCAS travel and necessary information to converting crews, it had been incorporated from the beginning, then it would have given a valuable clue and could have prevented these tragic events.
I am still not a fan of the MCAS as a solution to the control force requirement. That doesn’t make me criticise every move Boeing makes, however, when they try to learn from their mistake.

[ManaAdaSystem]

This could very well be related to something else than just the AOA sensors.
What is different in the MAX AOA system compared to the NG? The sensors are the same.
I have never seen an AOA disagree caution on the NG, so why is does it fail on the MAX?
The sensor may have been installed wrongly on the Lion Air MAX, but that was not the case on the Etiopian MAX.

[DaveReidUK]

I have never seen an AOA disagree caution on the NG, so why is does it fail on the MAX?

Isn't the AoA Disagree annunciation an option on the NG, as it is/was on the Max? Are you sure it was fitted in your case?

[ManaAdaSystem]

Isn't the AoA Disagree annunciation an option on the NG, as it is/was on the Max? Are you sure it was fitted in your case?

Not sure if it’s an option or not, but we do have this annunciation on our NGs.

[safetypee]

Curtain Twitcher #2872

Thanks for the links; I have read some of the rationale for STAMP, but have difficulty in following the arguments.
Many similar safety initiatives tend to fall foul of hindsight; this is a limitation of this type of thinking - ‘what we could have done for this accident’. Alternatively with beneficial application in foresight, the successful intervention and system design might never be established, because we have not had an accident.
Retrospective safety - focus on accidents for learning, is increasingly limiting in design and operation, thus a forward looking ‘processes’ should improve safety, even if we never know that it has - we never see the accident avoided.

The limit in this approach remains with the human; however good the design and evaluation is, the question ‘have you considered this’ (an aspect of concern*), a human answer ‘yes’ has the rule. Whereas perhaps we need ‘Yyeeees, Probably’, and return to the evaluation - double loop learning, return to the assumptions.

The findings from this accident might identify the problems above (hindsight again), yet we must consider the influences in the existing safety process. Some of the designers and regulators might not have even been born at the time of the initial design and certification. Thus, what has been forgotten, assumption based complacency - does a good accident record bias judgement of the safety of future aircraft variants, whereas treating these as ‘new’ aircraft might question pertinent factors - grandfathers die, let them rest peacefully.

* a machine process designed by humans, subject to our limitations.

[sceh]

Many years ago while working on a fire-control system, we were evaluating test methodologies between the F-16's Westinghouse, General Dynamics Phalanx fire-control, and Airbus fly-by-wire. The Airbus strategy (as I recall which was about 4 decades back) was to deliver the code to 3 companies in three different countries, none of whom knew of the others existence. AB expected each would find some unique code exceptions by doing so. Not so. Well over 90% were identifed by multiple vendors including all deemed critical bugs save maybe one. The rest were not considered major flight control errors.

Maybe Gums could chime in here, but we had heard rumors (maybe urban legend) that some of the early F-16 deployments in Germany with look-down did on occasion lock on to low flying Mercedes on the Autobahn. As a designer, how many would consider that possibility?

There will ever be a perfect balance between automation and human interaction. Automation is programmed by humans - mistakes will happen on both ends.

As an ex analyst and software developer this situation frightens me.
Even assuming that the designer can clearly articulate and document what he wants the software to do in my experience, very rare), the coder then needs to understand what the designer wants. The coder then has his job spoiled by software tools claiming to produce rigourous code.He then needs to agree a test suite with the designer assuming it was not part of the specification.
The chances of this chain working are nil in practice. Even for simple things like software drivers for printers there are bugs.
The other core problem is that unless the broad design architecture is right from the beginning there is a limit to retrofitting new features before it becomes impossible to understand the interactions.
As a simple daily example, all cars have been fitted with the an OBD (on board diagnostics) system for decades and this allows diagnostics of all bits of the car including things like the heater as well as lights and brakes and all parts of the engine. This has been around for fifty years and I have three different diagnostic tools for three different cars. Each has bugs since the car systems have bugs and by all accounts ALL cars have bugs and this system is not only simple but its base architectural design is clean and the result of all manufacturers working together to set a standard architecture.It needs to be accepted that ALL planes have software bugs and the solution is simple - a LARGE red button that switches off ALL aids instantly and puts the control in the hands of the pilot instantly.
Might need some new training though

[sleeper]

.............

Maybe Gums could chime in here, but we had heard rumors (maybe urban legend) that some of the early F-16 deployments in Germany with look-down did on occasion lock on to low flying Mercedes on the Autobahn. As a designer, how many would consider that possibility?..........

.

No rumor. In the early f16 years, 81/82, it was easy to lock on to a speeding car in germany. And it was quite fun to fly to it, to make out the model. Later software changes changed the minimum speed for lock-ons and it was no longer possible.

[infrequentflyer789]

I may be dancing around the same tree as in my post in the other thread - #485 https://www.pprune.org/10434755-post485.html
Where is the value of AoA sampled by the FDR; would this clarify current understanding.

737 NG AMM says that the FDAU (flight data acquisition) gets AOA from the SMYD (stall management and yaw damper) and that analogue resolver outputs go to both SMYD and ADIRU (the latter feeds FCC).

Peter Leeme has previously suggested that MAX no longer has separate SMYD "box" - however he retracted that a couple of days ago in this (https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-boeing-fix.html)post:
In prior posts I have postulated whether SMYD had become a function in the FCC on the MAX. I was wrong. The SMYD appears on the 737 MAX pretty much as the 737 NG. This is a significant realization. The AoA vane has one analog resolver output connected to the ADIRU, and one output connected to SMYD.

I would suggest that the most likely source for FDR AOA value is the SMYD, as on the NG.

[GordonR_Cape]

Peter Lemme has previously suggested that MAX no longer has separate SMYD "box" - however he retracted that a couple of days ago in https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-boeing-fix.html

The human factors comments in that article are just as interesting as the AOA analysis. Apologies if already quoted:The response to a stabilizer runaway is to cutout the electric trim. Nowhere does anyone caution the consequences of using manual (turn the wheel manually) trim. The manual trim wheel can be very hard to turn if subject to high aero loads, and particularly if the elevator is commanded significantly (loading the stabilizer).
The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.

[Vilters]

What I don't understand (well I do because building airplanes is all about keeping the costs down) is why they keep using these "obsolete" and fragile vane sensors.

Back in 1979 when we first got the F-16's we where all too happy to see "new" differential pressure activated AOA sensors. => But => But => And that is where it all goes dark => They are more expensive.

[patplan]

First the news said this:Ethiopian Air Report on Boeing Plane Crash to Be Released Monday (https://www.bloomberg.com/news/articles/2019-04-01/ethiopian-air-report-on-boeing-plane-crash-to-be-released-monday)
And slightly later, the news said this:No Ethiopia plane crash report on Monday, maybe this week: source (http://www.yahoo.com/news/ethiopia-release-preliminary-report-cause-ethiopian-airlines-crash-083809516--finance.html)
..

So, the WSJ report earlier during the day appeared to be correctly describing what had happened behind the scene...U.S., Ethiopian Investigators Tussle Over 737 MAX Crash Probe (https://www.wsj.com/articles/u-s-ethiopian-investigators-tussle-over-737-max-crash-probe-11554073749)

Patience is a virtue, or so they say...

[bill fly]

interesting pov.

https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/220x220/trigonometry_triangle_svg_cc39f5485cf233dd1fd2cc8d9c5519d71c 7e6219.png
The adjacent is your datum, angle A is your actual aoa value and the opposite is the actual strip length which varies with angle a. Clear and coherent information with no need to analyse what a gauge reads...

Thanks Wee
I’ve flown with all types of instruments from dials to strip indicators. I find the strip ideal for cross cockpit engine value info during high thrust phases for instance, compared to dials - but can’t share your view that strip length is clearer than a pictorial representation for an AoA vane - or rather for the information it delivers.
Angle nose up / down is more easily seen on a dial display than a strip - which actually does in this situation require analysis - or at least interpretation.

[Capn Bloggs]

Patplan, the last is behind a paywall. Please copy and past the story text.

[Ian W]

What I don't understand (well I do because building airplanes is all about keeping the costs down) is why they keep using these "obsolete" and fragile vane sensors.

Back in 1979 when we first got the F-16's we where all too happy to see "new" differential pressure activated AOA sensors. => But => But => And that is where it all goes dark => They are more expensive.

The reason they use them is that they are simple and they work. A 737 takes off or lands somewhere in the world every 3 seconds or so, if these AoA vanes had any unreliability it would be very very obvious and there is no such failure rate. So almost certainly it is not the AoA vanes. As stated upthread there may be some reason for the Max failure rate that is to do with wiring or perhaps location of the engines, But this will not be simple to find as there have been many many 737Max flights and a simple design fault such as engine location or broken look up tables in software would have become very obvious in every Max - it hasn't.

[Vilters]

As far as eye control goes :

Strip or dial? Both give you the value. But "rate of change" is better to follow on a dial display.

[sansmoteur]

U.S., Ethiopian Investigators Tussle Over 737 MAX Crash Probe

Tension over access to and interpretation of data comes ahead of a preliminary report on what happened to the Boeing plane

Tension is simmering between U.S. and Ethiopian officials as investigators prepare to release in the coming days an interim report about the Boeing Co. 737 MAX jetliner that nose-dived after takeoff from Addis Ababa on March 10, according to people from both countries.

U.S. investigators, according to people familiar with their thinking, have privately complained that Ethiopian authorities have been slow to provide data retrieved from the black-box recorders of Ethiopian Airlines Flight 302, which went down minutes into a flight to Nairobi, killing all 157 people on board.

American air-safety officials also have described what they view as an aloof attitude among the Ethiopians toward other investigators and say the Ethiopians have provided often limited access to relevant crash information, these people said.

A spokesman for the Ethiopian transport minister didn’t respond to requests for comment Sunday. Ethiopians involved in the probe, for their part, have chafed at what they see as American efforts to exert control over the preliminary report, according to other people familiar with the investigation.

The behind-the-scenes maneuvering, according to people from both countries, has impeded but not prevented the international investigators from working together.

The preliminary crash report, according to people briefed on the details, is expected to say that data analyzed so far indicates the Ethiopian accident bears important similarities to the crash of a Lion Air 737 MAX plane that went down in Indonesia less than five months earlier, including activation of an automated stall-prevention system and related features.

Boeing is in the process of rolling out a software fix and enhanced training related to the automated feature, called MCAS.

Publicly, U.S. officials have expressed satisfaction with the sharing of information. Last Wednesday, Robert Sumwalt, chairman of the National Transportation Safety Board, which is leading U.S. participation in the probe, told a Senate subcommittee his experts have gotten the data they need.

On Sunday, a Boeing spokesman said: “We have great respect for the Ethiopian government. As a party to the investigation, we’re following all international protocols and conduct all our work through” the U.S. safety board.

From the outset, though, Ethiopian officials have kept tight control of the probe, carefully guarding the recorder data and pushing back at what they view as efforts by Boeing investigators to influence and speed up release of the preliminary report on the crash, according to people familiar with the matter.

The Boeing spokesman said it was “absolutely not true” that the company’s investigators are trying to influence or speed up the preliminary report.

Safety experts have also tussled over the interpretation of certain data and their presentation in the report, according to people from both countries.

Ethiopian officials asked the French aviation accident investigation bureau BEA, which downloaded data from the black boxes, to permanently delete that information from its servers once it had been transmitted to Ethiopian authorities. The BEA has confirmed complying with the request.

Frequently, probes of airline crashes that occur outside the U.S. in which American investigators play a role prompt friction and outright disagreements between U.S. government and industry experts and local investigators leading the probes.

In the case of Ethiopia, the tension is exacerbated by the country’s limited staff and experience investigating major airliner crashes, according to industry and safety experts tracking the probe.

Officials in Addis Ababa, for their part, are still smarting from the results of an investigation into the deadly 2010 crash of an Ethiopian Airlines plane shortly after takeoff from Beirut. That probe, led by Lebanese authorities, found that the airline’s pilots failed to respond adequately to stormy weather during the aircraft’s ascent. Ethiopia at the time disagreed with the findings of the investigation, attributing the crash to bad weather.

“With this investigation, we are the ones who are in charge,” the chief of Ethiopia’s civil aviation authority, Col. Wosenyeleh Hunegnaw, said in a March 20 interview.

Another potential point of friction, according to some people familiar with the details, is the role played by experts from state-owned Ethiopian Airlines, which also faces scrutiny in the probe. The airline’s engineers have been providing technical support to officials from Ethiopia’s transport ministry.

[meleagertoo]

There's national pride and reputations at stake here, and I don't mean in the US. Boeing are big enough to take whatever's coming on the chin an deal with it. Are Ethiopian/Ethiopian government?
As ever the two accidents will almost certainly come down to a relatively benign aircraft failure getting out of hand due to faulty human factors.

How did the ET pilots fail to recognise a failure that must heve been just about the sole topic of conversation in the crew room for the previous few weeks, analysed and discussed to death by everyone on the fleet? One that Boeing had published to all MAX operators with extreme urgency?`
What action did the ET training department take over it?
Surely that advice was passed on to the line pilots? If so how can it not have taken root? ...or was it?
Was the crew experience-mix even remotely suitable? Was it compatible with published company policy?

The facts from the recorders must have been known to and publishable by the authorities for a couple of weeks now - this delay is beginning to look like unwillingness to publish, not inabiity.

At this stage one can only surmise the whys and wherefores, but chances are there's stuff in there that the publisher either doesn't want publishing or hasn't included when the other interested parties believe it should be.
And that ain't good for the whole point of flight safety.

Ethiopia would do well to ensure total transparency here to reassure the rest of the world that they posess a responsible safety culture. Failure to do so will far outweigh any temporary saving of face if they do otherwise.
Sadly, having spent some time in the country I'm not holding my breath that face-saving won't turn out to be the order of the day, and some 'in charge' Colonel telling us they'll do it their way is hardly reassuring.

[BDAttitude]

What I don't understand (well I do because building airplanes is all about keeping the costs down) is why they keep using these "obsolete" and fragile vane sensors.

Back in 1979 when we first got the F-16's we where all too happy to see "new" differential pressure activated AOA sensors. => But => But => And that is where it all goes dark => They are more expensive.
Having had some professional exposure to differential pressure sensors, thank you, I'd rather take the vane.
Differential pressure sensors are bitches, even more than pitot tubes and static pressure ports. After all you have two tubes which can get congested by a lot of things.
The vane however is an extreme simplistic design. If it can be turned on the ground and if heating is present nothing should go wrong there.
So my odds are on the wiring harness as well.
Timing conditions within the Software have also been mentioned. From my profesionnal experience I would rule that out as well, as such systems monitor their execution times constantly and will declare themselfes faulty if problems are detected in this domain.

Regards
B

[patplan]

Patplan, the last is behind a paywall. Please copy and past the story text.

sansmoteur has been nice enough to post it for us both on post# 2895 (http://www.pprune.org/10435736-post2895.html) ...

[TTail]

Now that the MCAS is being classified as a subsystem of the STS wouldn't the below paragraph - possibly without the EFS module part - read like something you'd find in a Boeing MAX AFM if the intent were to give a brief non-technical description of MCAS?

"As airspeed decreases towards stall speed, the speed trim system trims the stabilzer nose down and enables trim above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced."

This paragraph has been in my B737NG manual for atleast 12 years but I'm not sure if that particular fact is what would have made me take action if my nose were being trimmed down in an inappropriate manner.

[GarageYears]

U.S., Ethiopian Investigators Tussle Over 737 MAX Crash Probe

Tension over access to and interpretation of data comes ahead of a preliminary report on what happened to the Boeing plane

Tension is simmering between U.S. and Ethiopian officials as investigators prepare to release in the coming days an interim report about the Boeing Co. 737 MAX jetliner that nose-dived after takeoff from Addis Ababa on March 10, according to people from both countries.

U.S. investigators, according to people familiar with their thinking, have privately complained that Ethiopian authorities have been slow to provide data retrieved from the black-box recorders of Ethiopian Airlines Flight 302, which went down minutes into a flight to Nairobi, killing all 157 people on board.

American air-safety officials also have described what they view as an aloof attitude among the Ethiopians toward other investigators and say the Ethiopians have provided often limited access to relevant crash information, these people said.

A spokesman for the Ethiopian transport minister didn’t respond to requests for comment Sunday. Ethiopians involved in the probe, for their part, have chafed at what they see as American efforts to exert control over the preliminary report, according to other people familiar with the investigation.

The behind-the-scenes maneuvering, according to people from both countries, has impeded but not prevented the international investigators from working together.

The preliminary crash report, according to people briefed on the details, is expected to say that data analyzed so far indicates the Ethiopian accident bears important similarities to the crash of a Lion Air 737 MAX plane that went down in Indonesia less than five months earlier, including activation of an automated stall-prevention system and related features.

Boeing is in the process of rolling out a software fix and enhanced training related to the automated feature, called MCAS.

Publicly, U.S. officials have expressed satisfaction with the sharing of information. Last Wednesday, Robert Sumwalt, chairman of the National Transportation Safety Board, which is leading U.S. participation in the probe, told a Senate subcommittee his experts have gotten the data they need.

On Sunday, a Boeing spokesman said: “We have great respect for the Ethiopian government. As a party to the investigation, we’re following all international protocols and conduct all our work through” the U.S. safety board.

From the outset, though, Ethiopian officials have kept tight control of the probe, carefully guarding the recorder data and pushing back at what they view as efforts by Boeing investigators to influence and speed up release of the preliminary report on the crash, according to people familiar with the matter.

The Boeing spokesman said it was “absolutely not true” that the company’s investigators are trying to influence or speed up the preliminary report.

Safety experts have also tussled over the interpretation of certain data and their presentation in the report, according to people from both countries.

Ethiopian officials asked the French aviation accident investigation bureau BEA, which downloaded data from the black boxes, to permanently delete that information from its servers once it had been transmitted to Ethiopian authorities. The BEA has confirmed complying with the request.

Frequently, probes of airline crashes that occur outside the U.S. in which American investigators play a role prompt friction and outright disagreements between U.S. government and industry experts and local investigators leading the probes.

In the case of Ethiopia, the tension is exacerbated by the country’s limited staff and experience investigating major airliner crashes, according to industry and safety experts tracking the probe.

Officials in Addis Ababa, for their part, are still smarting from the results of an investigation into the deadly 2010 crash of an Ethiopian Airlines plane shortly after takeoff from Beirut. That probe, led by Lebanese authorities, found that the airline’s pilots failed to respond adequately to stormy weather during the aircraft’s ascent. Ethiopia at the time disagreed with the findings of the investigation, attributing the crash to bad weather.

“With this investigation, we are the ones who are in charge,” the chief of Ethiopia’s civil aviation authority, Col. Wosenyeleh Hunegnaw, said in a March 20 interview.

Another potential point of friction, according to some people familiar with the details, is the role played by experts from state-owned Ethiopian Airlines, which also faces scrutiny in the probe. The airline’s engineers have been providing technical support to officials from Ethiopia’s transport ministry.

I'm going to go out on a limb here - if the cause of this crash was slam dunk unequivocally due to MCAS there would be no reluctance on the part of the Ethiopian authorities to throw Boeing under the bus. But it appears not so.

My take on this posturing is they are trying to align holes in pieces of cheese that at best marginally overlap.

It's not that hard once you have the CVR and FDR. The trim behavior of Lion Air was pretty obvious and it would be very simple if it were the same in the case of ET302.

In many ways this aligns with Boeing moving forward with the 'MCAS fix', despite the (public) status of ET302 being indeterminate.

- GY

[flyingchanges]

Now that the MCAS is being classified as a subsystem of the STS wouldn't the below paragraph - possibly without the EFS module part - read like something you'd find in a Boeing MAX AFM if the intent were to give a brief non-technical description of MCAS?

"As airspeed decreases towards stall speed, the speed trim system trims the stabilzer nose down and enables trim above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced."

This paragraph has been in my B737NG manual for atleast 12 years but I'm not sure if that particular fact is what would have made me take action if my nose were being trimmed down in an inappropriate manner.

Finally, someone else read the NG manual...

[MPN11]

I find this particulary disconcerting ...
Ethiopian officials asked the French aviation accident investigation bureau BEA, which downloaded data from the black boxes, to permanently delete that information from its servers once it had been transmitted to Ethiopian authorities. The BEA has confirmed complying with the request.If this a normal procedure, it still seems strange that the data should be deleted by BEA while investigations are still ongoing. Otherwise it would suggest the Ethiopian authorities are trying to conceal something,

[bill fly]

Actually Wee, it was Vilters who mentioned the rate - I just like the angular presentation in relation to an angular sensor.

Check out the 737 flap position indicator for instance. That could be done on a strip but it wouldnt be so obvious.

As you say, lets agree - to disagree.

[DType]

MPN11
Presumably the information is safely stored everywhere else except the servers?????

[bsieker]

Now that the MCAS is being classified as a subsystem of the STS wouldn't the below paragraph - possibly without the EFS module part - read like something you'd find in a Boeing MAX AFM if the intent were to give a brief non-technical description of MCAS?

"As airspeed decreases towards stall speed, the speed trim system trims the stabilzer nose down and enables trim above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced."


No, because STS is triggered by change in airspeed (in either direction), and MCAS is triggered by angle of attack, and only by high, not by low values. So although they sit in the same box, and one may even be considered a subsystem of the other, their functions and activation criteria are fundamentally different.

STS doesn't even have anything to do with stall, or stick forces, but is about speed stability. Only the first sentence of the paragraph you quoted is about the STS, the rest is about the Elevator Feel Shift module.

The speed trim system (STS) is a speed stability augmentation system designed to improve flight characteristics [...]. The purpose of the STS is to return the airplane to a trimmed speed by commanding the stabilizer in a direction opposite the speed change.


And if someone didn't catch it the first time, it repeast a few lines later:


As the airplane speed increases or decreases [...], the stabilizer is commanded in the direction to return the airplane to the trimmed speed.


Nothing about stall at all. That it is also active close to a stall is mostly a side-effect of the speed stability augmentation.

Bernd

[infrequentflyer789]

STS doesn't even have anything to do with stall,

Careful, the function of STS is nothing to do with avoiding stall (ditto MCAS), but the implementation does have an AOA input and does behave differently at high AOA.

Copy/pasting from the AMM (my emphasis):


JPL 701-799, 803-899, 901-999 The stall detection circuit monitors the flap position and the angle of airflow. Near stall, the speed trim function trims the stabilizer to a nose down condition to allow for trim above the stickshaker AOA and idle thrust. The trim continues until the stabilizer gets to its limits or the aft column cutout position is exceeded.

If the roll angle from the ADIRU is more than 40 degrees, it opens an electronic switch and stops the speed trim signals.

JPL 801, 802 The stall detection circuit monitors the flap position and the angle of airflow. If it calculates that the airplane is near a stall condition, it opens a switch and stops the speed trim signals.

If the roll angle from the ADIRU is more than 40 degrees, it opens the same switch and stops the speed trim signals.

As I understand this, STS normally trims nose up when you add power (speed), on early revisions of the 737-800 this is prevented at AOA near stall (for obvious reasons). On later revisions this was modified so that near stall AOA, STS will trim down to allow it to then trim up if/when you add speed (and thus maintain speed stability). I believe I've seen rumours, maybe here, that this revision was needed to achieve EASA certification.

I think it is likely that the idea (and maybe some of the implementation) for MCAS came from this part of STS.

[ferry pilot]

There's national pride and reputations at stake here, and I don't mean in the US. Boeing are big enough to take whatever's coming on the chin an deal with it. Are Ethiopian/Ethiopian government?
As ever the two accidents will almost certainly come down to a relatively benign aircraft failure getting out of hand due to faulty human factors.

How did the ET pilots fail to recognise a failure that must heve been just about the sole topic of conversation in the crew room for the previous few weeks, analysed and discussed to death by everyone on the fleet? One that Boeing had published to all MAX operators with extreme urgency?`
What action did the ET training department take over it?
Surely that advice was passed on to the line pilots? If so how can it not have taken root? ...or was it?
Was the crew experience-mix even remotely suitable? Was it compatible with published company policy?

The facts from the recorders must have been known to and publishable by the authorities for a couple of weeks now - this delay is beginning to look like unwillingness to publish, not inabiity.

At this stage one can only surmise the whys and wherefores, but chances are there's stuff in there that the publisher either doesn't want publishing or hasn't included when the other interested parties believe it should be.
And that ain't good for the whole point of flight safety.

Ethiopia would do well to ensure total transparency here to reassure the rest of the world that they posess a responsible safety culture. Failure to do so will far outweigh any temporary saving of face if they do otherwise.
Sadly, having spent some time in the country I'm not holding my breath that face-saving won't turn out to be the order of the day, and some 'in charge' Colonel telling us they'll do it their way is hardly reassuring.

You nailed it. The first accident left no doubt what the problem was and what to do if it happened again. Top of mind for every Max driver on the planet. Where were those two? There appears to be much more to this than MCAS alone.

[TTail]

No, because STS is triggered by change in airspeed (in either direction), and MCAS is triggered by angle of attack, and only by high, not by low values. So although they sit in the same box, and one may even be considered a subsystem of the other, their functions and activation criteria are fundamentally different.

STS doesn't even have anything to do with stall, or stick forces, but is about speed stability. Only the first sentence of the paragraph you quoted is about the STS, the rest is about the Elevator Feel Shift module.



And if someone didn't catch it the first time, it repeast a few lines later:



Nothing about stall at all. That it is also active close to a stall is mostly a side-effect of the speed stability augmentation.

Bernd

Hi Bernd.

Thanks for your input. I do not pretend to be anywhere close to fully understanding these systems although contributors in this thread have certainly inceased my knowledge tremendously.

It's funny that your quoted passages are the exact sames ones I have underlined in my manual! I'm still not convinced though, that your last sentence is 100% accurate :"That it is also active close to a stall is mostly a side-effect of the speed stability augmentation". The headline where my quoted paragraph is taken from, follows the section that gives the general explanation of the STS where your quotes are from, and it reads Stall Identification. The first sentence here says: "Stall identification and control is enhanced by the yaw damper, the Elevator Feel Shift (EFS) module and the speed trim system. These three systems work together to help the pilot identify and prevent further movement into a stall condition." There are no caveats in terms of CG position, weight or thrust condition for this to work so it is atleast possible to interpret this as something more than just a side effect of the STS.

But this is not really my main point. The thing is, Boeing has mentioned in several places in their manual that there is another system, in addition to the pilot and autopilot, that has the authority to run the THS in flight - the STS. If you consider this alongside the "Runaway Stabilzer" NNC and Boeing's opening statement that "....checklists cannot be created for all conceivable situations and are not intended to replace good judgement", it would not be too far fetched to see how Boeing could argue their case that any qualified crew should be able to handle the Lionair situation (and possibly the Ethiopean if it turns out the culprit is the same).

I'm not saying I agreee with this, in fact after having read on these pages how MCAS works, I'm in a state of shock and utter disbelief that a system like this could pass quality and safety checks. But no matter where in the chain the fault originates - from the AOA vane to the FCC - I think it will boil down to whether Boeing will find acceptance for their claim that the pilot should be the ultimate safety mechanism if something should go wrong in these scenarios. I do not think an AOA indicator or AOA DISAGREE lights would have made much difference - and the Boeings I flew had both. The major thing to me that sets these three flights apart (the two Lionair and the one Ethiopean) is the presence of a third crew member. This added mental capacity seems to have saved the day and the lives of many people. And I think this is what Boeing will argue. Not the introduction of a third pilot but the fact that experience, training, skills and knowledge of any two pilots in the cockpit of one of their airplanes should be able to free up enough capacity to deal with situations similar to those we are discussing.

[bsieker]

infrequentflyer789, TTail,

thanks a lot for your input. Food for thought.

It would appear that, even without MCAS, there is more to automated trimming on the 737 (even pre-MAX) than meets the eye. I'm quite experienced in reading and interpreting FCOMs and related material, but sometimes this feels like deliberate obfuscation.

I have a feeling Boeing's idea that the pilot has to save the day will fall short of regulators' approval. They can no longer maintain after two accidents (where in the second one the crew almost certainly knew about the first) that any pilot "without exceptional skill" (which is the regulatory requirement, and, if you think about it, is a lot less than "average") will be able to handle it.


Bernd

[73qanda]

How did the ET pilots fail to recognise a failure that must heve been just about the sole topic of conversation in the crew room for the previous few weeks, analysed and discussed to death by everyone on the fleet?
Whats a crew room?
My comment is obviously facetious but it’s there to highlight that the way we share information has changed significantly over the last decade.
I now arrive at the gate 55 mins before departure to meet an F/O that I often have never met, we work together and then his/her name will ring a bell when it’s on my roster six months later but I can’t picture them.
I certainly don’t chat with other Captains as was the way when I joined up many years ago.
The safety related information we get sent can be pored over and dissected in an armchair and discussed online........or it can be deleted without reading between feeding the cat and putting the rubbish out. Nobody knows if the latter has occurred.

It is easy to become isolated from the company ‘safety culture’ even if it is a strong one.

Putting a Safety Notice out digitally is very very cheap. When faced with a training issue/problem, it is far more attractive commercially to take this route and regulators appear happy to allow companies to deal with most training issues in this manner. The person who decides whether to bring 500 pilots into the classroom/ simulator v’s firing off a digital memo is financially incentivised to choose the latter.

I will be interested to read how Ethiopian responded to the Lion crash. I will be analysing whether or not the head of their Safety Department knew, without doubt, that every one of their Max pilots was fully aware of how the MCAS event manifested itself, and had at least chair-flown their response regarding disconnecting the stab trim cut-out switches.
If their chosen strategy involved no method of confirmation that each pilot fully understood those things then it was insufficient.

[ferry pilot]

I come from the past. We do things different there. If something like the Lion Air crash happened to any airplane I was flying, nothing would have stopped me from finding out every detail about it and having a plan for what to do if it happened to me. On my own. Before there was any internet.
I did not know anyone who thought otherwise.

[DozyWannabe]

The Airbus strategy (as I recall which was about 4 decades back) was to deliver the code to 3 companies in three different countries, none of whom knew of the others existence. AB expected each would find some unique code exceptions by doing so.

Hi b1lanc,

It's also been a long time since I was in Uni (B.Eng Software Engineering) and my old Engineering/Reliability Prof. had us study the Airbus methodology. As I recall, you've got the gist - but I think some of the specifics have been mixed up in translation.

It wasn't three teams, it was two, and it as far as I can recall it wasn't contracted out to different companies - I believe it was all in-house. The reason for this was because we're talking roughly 1984-88, and at the time all of the techniques they were using were pretty much on the bleeding-edge of what had gone before - though built on tried-and-tested principles, all the way down to algebraic engineering expressions that hurt my head to this day. Also, while I can't be certain that this was a motivation, one of the overriding goals of developing the FBW system was to provide an unprecedented level of commonality within their product range - keeping things in-house reduced the risk of losing that potential competitive advantage.

Also, as I understood things, dissimilar/differential implementation wasn't a matter of "find[ing] code exceptions" as much as it was aimed at reducing the risks of implementation errors in the code (as opposed to specification and/or design problems with the underlying logic) causing flight control problems - as I recall the code from both teams underwent multiple reviews and if a single similarity was found, one of the teams was tasked with finding a different implementation of the logic. In effect this was an extra "belt and braces" level of redundancy in the code layer - and interestingly, Boeing did not follow suit in this manner when developing the B777 (and later FBW types). The unparalleled safety record of the B777 could be used to argue that while dissimilar implementation was completely necessary for a pioneering effort, it might have been less so once the concept was proven.

[73qanda]

I come from the past. We do things different there. If something like the Lion Air crash happened to any airplane I was flying, nothing would have stopped me from finding out every detail about it and having a plan for what to do if it happened to me. On my own. Before there was any internet.
Thats great Ferry pilot, I’m in the same boat. That doesn’t change my point though, things are different now and there are always going to be pilots who have a different attitude to you or me so we need to look at the way we train, recruit, and disseminate information to mitigate against the pilot who doesn’t research and study like you do, the pilot who was on annual leave for three weeks and then didn’t read all the memos because he or she knows that most are garbage and nobody is watching anyway.

[joe falchetto 64]

Thanks for the reply but my comparison was never meant to be in in depth technical discussion. I have flown widebody and narrow bodied Airbus for over 10 years and Boeing's for even longer so the Airbus flight protection system's summary wasn't nessecary.

The simple point I was actually trying to make is the fact that the flight control inputs we as pilots make can be overridden by 'computers' in both the Airbus abnormal V alpha prot and the Boeing MCAS situation. This would not of happened before the advent of flight control computers and fly-by wire technology.
I certainly didn't want to get drawn into a deep technical comparison, it was not my intention.
I now remember why I stopped contributing to these forums. There is always some smart arse hiding behind his keyboard trying to show the rest of the world how brilliant they are.

Good morming. My comment was aimed to the people that don’t have a so deep knowledge of the Airbus flight control system and not specifically to you. There are many people reading here that could simply make some general and wrong assumptions from your original post. About technology... I have flown a lot of second generation fighter bombers and first generation four engine jet transport aircraft... a lot of fun either way. I don’t like when pilots are taken out of the picture but that is good for me...today most of my valid second-in-command cannot just make a proper landing with 20 knots crosswind. About the smart arse, you can always delight me with all the contributions and efforts you have profused in changing the actual industry situation during your long flight career.
Happy landings.
JF

[safetypee]

infrequentflyer789 #2884,

Thank you for the interesting information.
A conclusion from this is that the vane output was corrupt, but perhaps without considering the wiring into ADIRU and thence to FCC.

There is still no explanation from investigations or Boeing as to how AoA could be corrupted.
As currently described, the Boeing modification limits the difference in AoA which MCAS uses, but presumably not so for other systems.
Thus if the AoA corruption is ‘new’ to the 737 Max, then other systems could suffer more frequent events after the modification because AoA corruption would still occur.

[WHBM]

Thats great Ferry pilot, I’m in the same boat. That doesn’t change my point though, things are different now and there are always going to be pilots who have a different attitude to you or me so we need to look at the way we train, recruit, and disseminate information to mitigate against the pilot who doesn’t research and study like you do, the pilot who was on annual leave for three weeks and then didn’t read all the memos because he or she knows that most are garbage and nobody is watching anyway.Also, time was when the piloting profession would commonly, and indeed was even expected to, hav their own thoughts and deep interest like this. Now it's not only dumbed down but all about just about compliance, fuel consumption league tables,and following what someone else has written down in SOPs. If they haven't envisaged it there, hey ho ...

[737mgm]

infrequentflyer789, TTail,

thanks a lot for your input. Food for thought.

It would appear that, even without MCAS, there is more to automated trimming on the 737 (even pre-MAX) than meets the eye. I'm quite experienced in reading and interpreting FCOMs and related material, but sometimes this feels like deliberate obfuscation.

I have a feeling Boeing's idea that the pilot has to save the day will fall short of regulators' approval. They can no longer maintain after two accidents (where in the second one the crew almost certainly knew about the first) that any pilot "without exceptional skill" (which is the regulatory requirement, and, if you think about it, is a lot less than "average") will be able to handle it.


Bernd

Dear Bernd,

Have a look at this video of American Airlines pilots talking about the MCAS system after experiencing it at Boeing's 737 MAX simulator:

Pilots talk to King 5 about 737 Max fix (You tube - I am not allowed to post URLs yet)

At 01:25 one of the pilots says, "the natural pilot reaction is to not allow the airplane to become uncontrollable."

Now I understand that having stick shaker on right after Takeoff, IAS disagree and so on is confusing and overwhelming. But there are airspeed unreliable memory items for that scenario and from what I have read in the preliminary report the crew did not carry those out, which would be the first issue already one could look at. Just food for thought: They could have carried out the airspeed unreliable memory items and then used the pitch and power values for flaps extended as there would not really have been a need to retract the flaps as one would want to return to the airfield with the problem at hand anyway. Under those circumstances MCAS would not have activated at all.

Instead they did retract the flaps 2:05 Minutes after Take off. By that time at least the intial surprise factor concerning the stick shaker going off should have been gone. Based on the faulty sensor signal MCAS moved the horizontal stabilizer creating a nose down movement. What happens in the cockpit at that time? The stabilizer trim wheels can be heard and seen as they are moving and the first time MCAS activated they moved for 10 seconds, which would already qualify as a criteria for a stab trim runaway. If understandably due to all the confusion the pilots didn't notice the trim wheels, the pilot flying will still feel on his control yoke that the force required to maintain the desired pitch attitude has become significantly greater. Coming back to the statement of the American Airlines pilot: what is the natural thing to do now? The pilot will pull a little more on the yoke and then he will trim via the electric trim switch to counter the forces felt. This is the most basic aspect of flying the aircraft and even a Cessna pilot will fly a plane in this way. It has nothing to do with superior skills. In fact this is exactly what the pilot flying did:

After the flaps reached 0, the DFDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim.

This actually went on for more than 30 times. Tragic to think about is the fact that even this procedure could have saved the plane. It isn't even necessary to think of the stab trim runaway memory items and set the cut out switches to cut out. The pilot can also just continue to counter the MCAS induced horizontal stab trim nose down movement with an equal horizontal stab trim nose up movement until the flaps are retracted again for landing which is when MCAS will stop operating. Nonetheless after 30 times trimming against the nose down trim movement, it is hard to understand why the pilots did not think to set the stab trim cut out switches to cut out. Every 737 pilot knows that doing this will disable any system to move the horizontal stabilizer if there is unwanted movement. Also does it matter if one knows that the MCAS is moving the stab trim wheels in the cockpit? If there is an engine fire -for example- it also doesn't matter what is causing the fire. All that matters is that I shut down the engine via the engine fire memory items. If my stab trim wheels continue to move even though I don't want them to, all that matters it that I stop this from happening via a procedure that all 737 pilots must know. What does this have to do with superior pilot skill?

We have to wait for the official results to come out and in the case of Ethiopian we really do not know yet what actually happened. Also I realize that it is easy to comment on the accident flight when I am sitting at home on my couch. In fact, as a pilot I have already experienced plenty of situations where I did not have the full situational awareness required and I have of course made plenty of mistakes already. Nonetheless, solely based on the official information that is available so far it seems as if the accident could have been prevented by the crew simply flying the aircraft in a way that comes natural to a pilot and by applying the memory items that they were trained for.

[RetiredBA/BY]

I come from the past. We do things different there. If something like the Lion Air crash happened to any airplane I was flying, nothing would have stopped me from finding out every detail about it and having a plan for what to do if it happened to me. On my own. Before there was any internet.
I did not know anyone who thought otherwise.
"...........and hear, hear to that !

[73qanda]

Nonetheless, solely based on the official information that is available so far it seems as if the accident could have been prevented by the crew simply flying the aircraft in a way that comes natural to a pilot and by applying the memory items that they were trained for.
“In the way that comes natural”..... I thought maximum use of automation was the call of the decade? Hand flying now days often takes significant cognitive effort because of the automation policies in place at most Airlines, and that’s without contradictory information being presented.
“that they were trained for.......”. .I suspect we are going to find out that the training received to transition to the Max was insufficient.

[737mgm]

“In the way that comes natural”..... I thought maximum use of automation was the call of the decade? Hand flying now days often takes significant cognitive effort because of the automation policies in place at most Airlines, and that’s without contradictory information being presented.
“that they were trained for.......”. .I suspect we are going to find out that the training received to transition to the Max was insufficient.


It may very well be that the pilots were used to relying on automation and I have thought of that being an issue as well. However, being able to maintain a certain pitch attitude and trimming out the forces felt as one is doing that... are you suggesting pilots have even forgotten to do that?

Furthermore they did counter the nose down trimming of the MCAS several times as I mentioned, which shows they were able to do it. The question is why did they stop. News reports suggest that the Captain was pilot flying at first. After a while he handed control to the first officer who then did not counter the MCAS induced nose down trimming sufficiently ( information cannot be verified though).

About the training aspect: airspeed unreliable memory items and stab trim runaway memory items aply to the 737 Classic and NG just like they do to the 737 MAX. I don't see how transition training has anything to do with it.

[VicMel]

That sounds like a description of a random failure, rather than something that would manifest itself over several consecutive flights, as was the case with Lion Air.

Depends on what causes the holes to line up. On a new system it is more likely to be random occurrence as it is just a case of a very low probability of event(s) that eventually just happens. On an old system that has had an additional piece of software bolted on (MCAS) it is more likely to be the new software that has now introduced a significant hole in the cheese. Obviously as a system starts up, if all of the external factors are the same, the processing sequence will be exactly the same, including which bit of code is interrupted by a specific interrupt. However, if something happened on both of the Lion Air flights just prior to take-off (purely as an example, such as detection of an IAS Disagree), the change to the processing sequence would be the same on both flights, which caused the software frailty and the colliding interrupt to create a corruption. All other flights without the special trigger would get away with it, perhaps forever, perhaps not.

[CaptainSAC]

I would say yes. But they have not forgotten, They have just been taught not how to do it on the particular model they are flying. The current generation of "computer pilots" only use the computers as far as they are taught to do so. I had a "guru" come and sort out my communications systems on the ship I was running, and It took him 3 days of "trial and error" to fix the faults in the system... and he was the guy that designed the system..! If Boeing software engineers are going to take 2 months to analyse and then generate a software fix, then how do us mere mortals that actually know how to fly planes get to learn how to disable the system or modify or fix it in flight..? I actually welcomed computers onto my bridge to help us to pilot the ships, but increasingly we are only operators and the computers are controlling us. Increasingly, we are limited as to what kind of access we can get to setup menus and and excluded from interrogating the computers or turning them off, when we sense that something is wrong.

[noske]

Ethiopian officials asked the French aviation accident investigation bureau BEA, which downloaded data from the black boxes, to permanently delete that information from its servers once it had been transmitted to Ethiopian authorities. The BEA has confirmed complying with the request.

This may be formally justified by the fact that, unlike the NTSB, BEA is not an official party to the investigation, but it still strikes me as an odd request. BEA have always respected annex 13 protocol, and even a harsh case like the Yemenia crash, where the Comores investigators pondered the flight recorder data endlessly without making any progress, got no more than an angry letter by Jean-Paul Troadec. (https://www.bea.aero/uploads/tx_elyextendttnews/lettre.commission.d.enquete.comorienne.5juillet2011.pdf)


Officials in Addis Ababa, for their part, are still smarting from the results of an investigation into the deadly 2010 crash of an Ethiopian Airlines plane shortly after takeoff from Beirut. That probe, led by Lebanese authorities, found that the airline’s pilots failed to respond adequately to stormy weather during the aircraft’s ascent. Ethiopia at the time disagreed with the findings of the investigation, attributing the crash to bad weather.

That's a cautious phrasing. I remember the "disagreement" to be on the same level of stubborn denial as in the Egypt Air 990 case, but lacking the technical finesse of the Egyptians. Some highlights from the related thread on pprune, back then in 2012:

Ethiopian Airlines said Tuesday the 2010 crash of its jet off Lebanon was likely caused by sabotage, a lightning strike or was shot down, rejecting an official Lebanese probe blaming pilot error.
The fact that Ethiopian mentions eye-witness reports of a fireball in the sky is laughable.

Finally, getting back to the current WSJ article posted by sansmoteur:

“With this investigation, we are the ones who are in charge,” the chief of Ethiopia’s civil aviation authority, Col. Wosenyeleh Hunegnaw, said in a March 20 interview.

Oh yes, this is gonna be great.

[Icarus2001]

If Boeing software engineers are going to take 2 months to analyse and then generate a software fix, then how do us mere mortals that actually know how to fly planes get to learn how to disable the system or modify or fix it in flight..
​​​​​​​Us mere mortals turn off the stab trim.

[TryingToLearn]

Nose down trimming of the MCAS several times as I mentioned, which shows they were able to do it. The question is why did they stop. News reports suggest that the Captain was pilot flying at first. After a while he handed control to the first officer who then did not counter the MCAS induced nose down trimming sufficiently ( information cannot be verified though).

Are you sure they were still able to?
If the forces on TRIM are that high that even Boeing mentions one may be forced to do it manually because the TRIM motor ist not powerful enough, why do you assume that it is capable of going back&forth unter max. load all the time?
Would be interesting to know if the flight recorder is recording the manual TRIM command or the actual movement of the motor after overheat etc.
Also, at the end of the recording, it seems to me that the trim position does not longer correlate with the commands, but this is hard to recognize in this one plot.

Is it otherwise possible that the pilot handed control BECAUSE his TRIM commands were no longer compensating MCAS sufficiently?
As far as I understood there are increasing forces with speed which help the motor to trim down as commanded by MCAS but could maybe block/overheat the motor trimming up.

[73qanda]

However, being able to maintain a certain pitch attitude and trimming out the forces felt as one is doing that... are you suggesting pilots have even forgotten to do that?
I know it sounds unlikely but I have seen one pilot so taken aback by the aircraft misbehaving that he was angrily pushing the A/P button hoping it would engage even though the flight path was not where he wanted it to be. ( why not? he’s virtually never flown an aircraft anyway, why start now when things are turning to custard?)
I’m not suggesting that’s what happened here at all, but I am aware that the difference in pilot standards around the world is significant. I’m of the belief that we need to double up on mandated sim time and make the extra all manual flying. Tickets would have to go up about a buck per passenger. So be it.
I know it will never happen but I think it anyway :)

[VicMel]

I have a feeling Boeing's idea that the pilot has to save the day will fall short of regulators' approval. They can no longer maintain after two accidents (where in the second one the crew almost certainly knew about the first) that any pilot "without exceptional skill" (which is the regulatory requirement, and, if you think about it, is a lot less than "average") will be able to handle it.


Bernd

I absolutely agree. The aviation authorities have the hardest of evidence possible that “average” pilots are unlikely to cope. Boeing’s dilemma is this then means the MCAS system (at least) has to be considered as a “catastrophic” safety critical system. The MCAS software then has to be “Level A” according to DO-178C.

IMO no amount of software patching can turn a Level C software package into a Level A.

The Level A process is a full life-cycle development process, starting with the top level system requirements down through the coding process and then through the validation and verification processes; a lot of the reviewing and compliance checking has to be carried out “independently”, i.e. not by the supplier. In addition any “safety critical” item of data, such as AoA, has to be at the appropriate level. Typically this means triplex sensors, BUT without Common Mode Failure characteristics. So, another (same technology) vane on the nose would not be suitable.

[jafa]

Spot on Icarus. You know I am starting to think Boeing and FAA are off the hook with this one. That is assuming something new doesn't turn up. If the thing malfunctions at approach to stall speeds control loads are light and any runaway is a non-event. If it malfunctions at higher speed, accelerating after flaps up for instance, it is a straight forward runaway. In either case, follow the memory items in the QRH. So how did it get away from them? Yes. Well. Pre-employment history. The country regulator. Training and checking systems. After that we may be heading into the murky waters of leadership, culture, etc..

It is going to take a while.

[737mgm]

I know it sounds unlikely but I have seen one pilot so taken aback by the aircraft misbehaving that he was angrily pushing the A/P button hoping it would engage even though the flight path was not where he wanted it to be. ( why not? he’s virtually never flown an aircraft anyway, why start now when things are turning to custard?)
I’m not suggesting that’s what happened here at all, but I am aware that the difference in pilot standards around the world is significant. I’m of the belief that we need to double up on mandated sim time and make the extra all manual flying. Tickets would have to go up about a buck per passenger. So be it.
I know it will never happen but I think it anyway :)

I am actually not surprised by that story. In fact, I know of at least one accident where the same thing happened:

At time 00:39:40 the captain was heard saying in Amharic “OK, engage autopilot”. However, the DFDR data does not show any engagement of any auto-pilot throughout the flight. At the time of the call the DFDR shows the control wheel was Aft from the neutral position and the aircraft roll angle reaching 64° left bank

That is an excerpt from the final report of Ethiopian flight 409 in 2010 in which the Captain attempted to engage the autopilot when it was at a 64° left bank.

I agree with you that there should be a much greater emphasis on manual flying. At my company manual raw data flying is allowed at any time and I believe on a clear day, with little traffic, at a familiar airport, it adds greatly to a pilot's confidence and skill set to regularly fly manually (this subject has been discussed endlessly at pprune already though). Practicing in the simulator will work as well of course.

Overall you may be right, that among other reasons the actions of the Lion Air crew could be explained by a lack of manual flying skills, which has to be countered by more training in this regard.

[Ian W]

I absolutely agree. The aviation authorities have the hardest of evidence possible that “average” pilots are unlikely to cope. Boeing’s dilemma is this then means the MCAS system (at least) has to be considered as a “catastrophic” safety critical system. The MCAS software then has to be “Level A” according to DO-178C.

IMO no amount of software patching can turn a Level C software package into a Level A.

The Level A process is a full life-cycle development process, starting with the top level system requirements down through the coding process and then through the validation and verification processes; a lot of the reviewing and compliance checking has to be carried out “independently”, i.e. not by the supplier. In addition any “safety critical” item of data, such as AoA, has to be at the appropriate level. Typically this means triplex sensors, BUT without Common Mode Failure characteristics. So, another (same technology) vane on the nose would not be suitable.

You may be right. However, all automation systems currently have a predicate that in the 'otherwise case' or if things get difficult, the automation can drop out and give the aircraft to the pilot.

As soon as pilots start to say 'we cannot cope in manual flight; we cannot switch off systems that are in error - even though the switches have been there for decades as have the NNC for the failure and we were specifically told of the issues..... THEN money will be spent on automation that does not hand back to a pilot but manages itself even in cases of unknown error. There will then be no pilot shortage as the automation will have taken over entirely and automation doesn't need a pension or a union and doesn't care about hours worked.

[alf5071h]

Icarus2001, #2923; ( jafa, #2926)

From your ‘immortal’ view, have you considered the difficulty in identifying a trim malfunction, particularly with a mindset of unreliable airspeed since takeoff. Add to which an immensely annoying - distracting stick shake. See many other posts, and reports from some who have evaluated this in the simulator.

Also, with the strength of wax wings, what magnitude of force can be pulled, both hands, both pilots; and for how long. MCAS training should have involved some visits to the gym.
I don’t have the stick force gradients immediately to ‘hand’, but with trim offset they can be large, and further increase with airspeed increase due to the marginally - uncontrollable nose down trim situation.
Who is going to release the stick - allowing more nose down input, to inhibit the trim, which might not be at the forefront of thought.
A third person on the flight deck; another mod option for Boeing.

[Interflug]

Us mere mortals turn off the stab trim.
...while pulling 60 pounds with the left hand only on the control column and then manually turn the aerodynamically loaded (from high speed) STAB TRIM wheel with the right hand at least a hundred revolutions, within seconds?

[patplan]

I am actually not surprised by that story. In fact, I know of at least one accident where the same thing happened:

At time 00:39:40 the captain was heard saying in Amharic “OK, engage autopilot”. However, the DFDR data does not show any engagement of any auto-pilot throughout the flight. At the time of the call the DFDR shows the control wheel was Aft from the neutral position and the aircraft roll angle reaching 64° left bank

That is an excerpt from the final report of Ethiopian flight 409 in 2010 in which the Captain attempted to engage the autopilot when it was at a 64° left bank.

I agree with you that there should be a much greater emphasis on manual flying. At my company manual raw data flying is allowed at any time and I believe on a clear day, with little traffic, at a familiar airport, it adds greatly to a pilot's confidence and skill set to regularly fly manually (this subject has been discussed endlessly at pprune already though). Practicing in the simulator will work as well of course.

Overall you may be right, that among other reasons the actions of the Lion Air crew could be explained by a lack of manual flying skills, which has to be countered by more training in this regard.

For Lion Air, from pp. 4-5 of Preliminary Accident Investigation of PK-LQP Flight JT-610:

1.5.1 Pilot in Command
Age:31 years
Nationality:India
Date of joining company:25 April 2011
License:ATPL
Date of issue:28 July 2016
Aircraft type rating:Boeing 737
Instrument rating validity:31 May 2019
Medical certificate:First Class
Last of medical:5 October 2018
Validity:5 April 2019
Medical limitation:Pilot shall wear corrective lenses
Last line check:19 January 2018
Last proficiency check:7 October 2018

Flying experience
Total hours: 6,028 hours 45 minutes
Total on type: 5,176 hours
Last 90 days: 148 hours 15 minutes
Last 30 days: 81 hours 55 minutes
Last 7 days: 15 hours 45 minutes
This flight:about 11 minutes



1.5.2 Second in Command
Age:41 years
Nationality:Indonesia
Date of joining company:31 October 2011
License:CPL
Date of issue:15 May 1997
Aircraft type rating:Boeing 737
Instrument rating validity:31 August 2019
Medical certificate:First Class
Last of medical:28 September 2019
Validity:28 March 2019
Medical limitation:Pilot shall possess glasses that correct for near vision
Last line check:4 July 2017
Last proficiency check:25 August 2018

Flying experience
Total hours: 5,174 hours 30 minutes
Total on type: 4,286 hours
Last 90 days: 187 hours 50 minutes
Last 30 days: 32 hours 55 minutes
Last 7 days: 20 hours 20 minutes
This flight:About 11 minutes

[patplan]

Boeing, FAA say more time needed for fix of troubled 737 Max
Boeing and U.S. aviation regulators say the company needs more time to finish changes in a flight-control system suspected of playing a role in two deadly crashes.

The Federal Aviation Administration said Monday it anticipates Boeing’s final software improvements for 737 Max airliners “in the coming weeks.”

Boeing was expected to complete the work last week, but FAA spokesman Greg Martin said the company needs more time to make sure it has identified and addressed all issues.

Chicago-based Boeing offered the same timetable as it works to convince regulators that it can fix software on the planes.

“Safety is our first priority, and we will take a thorough and methodical approach to the development and testing of the update to ensure we take the time to get it right,” said Boeing spokesman Charles Bickers.

Boeing needs approval not just from FAA, but elsewhere, including Europe and China, where safety officials have indicated they will conduct their own reviews.

The planes have been grounded around the world since mid-March...


- https://www.bostonherald.com/2019/04/02/faa-expects-boeing-update-for-troubled-jet-in-coming-weeks/

[Cows getting bigger]

Us mere mortals turn off the stab trim.



Icarus, did you miss the lesson on Safety Management or were you too busy polishing your Ray-Bans? :)

I'll try and keep this simple. $120m aircraft has a single point of failure (AOA vane) that will subsequently cause HAL to become suicidal. The ONLY layer of safety in place now is Biggles and Biggles Minor who are expected to treat that failure with the flick of a switch. At this point any sensible person in our industry will already be sucking their teeth at the risks and lack of inherent safety protections. But this one gets better because Biggles didn't even know about the existence of this failure mode or how to resolve it (flick the switch). Nothing in his QRH/AFM, no training, nyada. For sure, there's something called a trim runaway but he's not sure this is a runaway because it's stopping.......... thump.

Perhaps Biggles could have done better. I'm pretty sure Boeing could have done far better.

[Arydberg]

There was also the Kenya airways flight 507

[bill fly]

Has anyone knowledge of stab motor overheat scenarios or motor specs on the Max?

If the stab trim is trimmed continuously - down, then up, then down - etc. for minutes on end, is it possible that the motors can eventually overheat and quit?

If so, and the trim is at AND limit that could change a cockpit scenario from manageable to marginal.

This could and did happen for instance on the MD-80

[VicMel]

all automation systems currently have a predicate that in the 'otherwise case' or if things get difficult, the automation can drop out and give the aircraft to the pilot.

As soon as pilots start to say 'we cannot cope in manual flight; we cannot switch off systems that are in error - even though the switches have been there for decades as have the NNC for the failure and we were specifically told of the issues..... THEN money will be spent on automation that does not hand back to a pilot but manages itself even in cases of unknown error.

I’m not sure if you are misinterpreting my point. I am concerned about any automation system that might not do what it is supposed to, for example, it might refuse to drop out and hand over when it should! Or, as an extreme example, a system that has gone berserk because it is “stuck in a loop” and continually drives a flight surface to its extreme position, or (as happened on one of the “faster, cheaper, better” Mars missions) turns the engine off because it decided the lander leg had touched the surface when in fact it was still way up high – I bet that was Level C software!

I think pilots will always be needed, real AI is still many decades away. And pilots should have the option to turn a system off, BUT the aircraft safety case (with Human Factor considerations) must show in detail how they will then cope. Perhaps, extra, specific to emergency, information needs to appear to assist them, also what warnings/alarms will be muted – who needs an 11 minute stick shaker!!

[patplan]

A little excerpt from NY Times:
..Between Two Boeing Crashes, Days of Silence and Mistrust..

April 2 2019
When a new Boeing 737 Max 8 plunged into the waters off Indonesia last October, a terrifying mystery confronted the aviation industry: What could have caused Lion Air Flight 610, flown by experienced pilots in good weather, to fall out of the sky just 12 minutes after takeoff?

But it took the second, equally terrifying crash of an identical aircraft under similar conditions five months later, in Ethiopia, to reveal the climate of mistrust that has plagued inquiries into what caused the first disaster....

...In November, Haryo Satmiko, the deputy chief of Indonesia's National Transportation Safety Committee, known as KNKT, recounted confusing conversations he was having with Boeing employees who had arrived in Jakarta. Mr. Haryo said he brought up whether inaccurate data readings could have prompted Flight 610's sudden descent.

What Mr. Haryo was describing, though he did not know it at the time, was a malfunction of MCAS, which automatically forces the plane's nose down if data indicates that the jet is angled too sharply upward and might stall.

Nurcahyo Utomo, the head of the safety group's air-accident subcommittee, said he first learned of the term MCAS from news reports....

...Days after Flight 610 crashed, Polana Pramesti, the head of Indonesia's civil aviation authority, waited for visiting Boeing and F.A.A. officials to talk to her. As head of Indonesia's version of the F.A.A., she wanted advice on whether to ground Max 8 jets in Indonesia. But the Americans, who did spend time with transportation safety committee officials, never came to her, she said.

The official in her office in charge of airworthiness and aircraft operation, Avirianto, who like many Indonesians goes by one name, fired off messages to the F.A.A. asking for an explanation of MCAS, which at the time was only vaguely understood, even by aviation experts, because Boeing had failed to put information about it in the plane's manual.

Although he conducted four teleconferences with F.A.A. officials, Mr. Avirianto said he was never given a clear explanation of how MCAS worked or whether it was safe. "They kept saying they were still analyzing, evaluating," he said. "We never received any guidance because there were never any clear answers for us.",,,

...Ms. Polana also sent a letter to Boeing in November, asking for guarantees about the Max. But Boeing was not forthcoming, either, she said. "Of course, we were worried," Ms. Polana said. "We wanted reassurance that the Boeing 737 Max 8s in Indonesia are airworthy."

Boeing and the F.A.A. have come under scrutiny since the Lion Air crash. The United States Department of Transportation is examining the F.A.A.'s certification of the Max model, amid revelations that Boeing employees may have facilitated that process.

Only after the Ethiopian Airlines crash, Ms. Polana said, did the F.A.A. and Boeing become more responsive. On March 22, she had her inaugural teleconference with F.A.A. officials -- the first time Indonesian officials received a precise explanation of how MCAS worked and how Boeing was planning to fix it, they said...

...After the crash, the replaced angle of attack sensor was shipped to Minnesota, home of Rosemount Aerospace, the Boeing subcontractor that made it, Mr. Nurcahyo said. He and other Indonesian investigators went to Minneapolis in December. The sensor, he said, was deemed defective...

...For Lion Air Flight 610, even after the vane was changed, the Max 8 continued to malfunction, producing an array of errant data. Some aviation experts believe the variety of airspeed problems points not to a defective sensor but a more fundamental problem with the processor that collects the data displayed in the cockpit.

"I don't think it's a vane failure. It makes no sense," said Bjorn Fehrm, an aeronautical engineer. "It's more like a computer failure or a component failure, a system failure."

The air data inertial reference unit is the processor that helps collect data from the probes and vanes on the plane. A malfunction in that system could be consistent with data inaccuracies that triggered MCAS, aviation experts said.

Mr. Nurcahyo acknowledged that Indonesian investigators were looking into the possibility of an issue with the air data inertial reference unit...

Source:
- https://www.nytimes.com/2019/04/02/world/asia/boeing-max-8-lion-air.html

[Ian W]

Icarus, did you miss the lesson on Safety Management or were you too busy polishing your Ray-Bans? :)

I'll try and keep this simple. $120m aircraft has a single point of failure (AOA vane) that will subsequently cause HAL to become suicidal. The ONLY layer of safety in place now is Biggles and Biggles Minor who are expected to treat that failure with the flick of a switch. At this point any sensible person in our industry will already be sucking their teeth at the risks and lack of inherent safety protections. But this one gets better because Biggles didn't even know about the existence of this failure mode or how to resolve it (flick the switch). Nothing in his QRH/AFM, no training, nyada. For sure, there's something called a trim runaway but he's not sure this is a runaway because it's stopping.......... thump.

Perhaps Biggles could have done better. I'm pretty sure Boeing could have done far better.

Well Biggles may not understand what to do - but Ginger has read about the problems and learned that a UAS with all the bells and whistles in the cockpit on takeoff was one of the first indications of a problem that could lead to a crash and that either not fully raising flap or switching off the Stab Trim would prevent the issue. So he turned down Biggles' offer of the weight training courses and went instead for switching off Stab Trim as first action on a UAS or if it was immediately on take off just leave some flap down as this was what was in the ACs/ADs that Biggles was using as a coffee mat.

[YYZjim]

Once is airplane error; twice is pilot error.

[flyingchanges]

I'll try and keep this simple. $120m aircraft has a single point of failure (AOA vane) that will subsequently cause HAL to become suicidal.

#1 radio altimeter failure can have the same effect.

[MurphyWasRight]

Well Biggles may not understand what to do - but Ginger has read about the problems and learned that a UAS with all the bells and whistles in the cockpit on takeoff was one of the first indications of a problem that could lead to a crash and that either not fully raising flap or switching off the Stab Trim would prevent the issue. So he turned down Biggles' offer of the weight training courses and went instead for switching off Stab Trim as first action on a UAS or if it was immediately on take off just leave some flap down as this was what was in the ACs/ADs that Biggles was using as a coffee mat.

When Ginger read (if she did) the updated manual she would have seen, from the emergency AD.
g) Revision of Airplane Flight Manual (AFM): Certificate Limitations Within 3 days after receipt of this AD, revise the Certificate Limitations chapter of the applicable AFM to include the information in figure 1 to paragraph (g) of this AD. Figure 1 to paragraph (g) of this AD – Certificate Limitations Required by AD 2018-23-51

Runaway Stabilizer
In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual:

• Continuous or intermittent stick shaker on the affected side only.
• Minimum speed bar (red and black) on the affected side only.
• Increasing nose down control forces.
• IAS DISAGREE alert. • ALT DISAGREE alert.
• AOA DISAGREE alert (if the option is installed).
• FEEL DIFF PRESS light.
• Autopilot may disengage. • Inability to engage autopilot
"a UAS with all the bells and whistles in the cockpit on takeoff was one of the first indications of.." does not jump out at the reader.

[IFixPlanes]

Has anyone knowledge of stab motor overheat scenarios or motor specs on the Max?
If the stab trim is trimmed continuously - down, then up, then down - etc. for minutes on end, is it possible that the motors can eventually overheat and quit?
...
To test the control cable and chain adjustment you have among others "Operate the stabilizer system through 5 full cycles."
So I do not see an overheat problem...

[ferry pilot]

Someone must have seen this coming. A massive increase in the demand for airplanes, a critical shortage of experienced pilots and technology available to completely automate every aspect of flying an airliner. These two accidents are a perfect example of a problem that is only going to get worse. You can’t make better pilots by putting them in airplanes that fly themselves until the day they don’t, then expecting them to fly it out of the fire. The days of good hands and feet flying are never coming back, and this is not news to those who make the software. The sooner we give up and turn it all over to them the better. You can rest assured they are ready for it, even if the public and the pilots are not. That said, if it was me getting kicked out of the loop they would have to pry my cold dead hands off the controls.

[gums]

Salute Ferry !!
I love it.

Although I flew very sophisticated aerospace vehicles, I am not quite ready to let HAL run everything at this time. And you are correct about not providing the human crewmembers with realistic training and practice for that one day they may have to actually perform their 'Chuck Yeager" routine. The "children of the magenta line" still live, and there's more of them every year.
CASE IN POINT:
The Lion 610 and previous flight's MCAS problem would not have been handled successfully by HAL, especially if the same sfwe shop did the design and code. At the time of Lion 610, the problem facing the plane was not the basic "runaway trim" that most of us think about. Then there;s the stall warning! HAL would likely have commanded some nose down, huh? Did HAL know altitude above the terrain or note the rising terrain ahead? Did the sfwe folks think that MCAS would activate at takeoff speed, and a few hundred feet and not at the other end of the envelope doing a banked turn at 20,000 feet? Would HAL have reduced power at 700 feet with stall warning shaking and been aware that getting too fast would reduce elevator effectiveness due to "blow up" with AND trim being commanded?

The single point of failure, the AoA doofer, that everyone points out was only the first event in the sequence that eventually resulted in loss of control. Just like almost all crashes. Few are the result of one thing going tango uniform. And that is where HAL has trouble, but the carbon-based lifeforrms can connect things that HAL's father had not thot of, and then do something not "programmed". You know, turn off both electric stab switches before treating the stall warning and not experiencing continuous trim in one direction.

Gums opines...

[pilot9250]

My highlight.
Sim training in some places seems from comments here to be very samey. So the expectations of the people writing the NNC and the trained reactions of the crews have diverged significantly.

The designers obviously felt that the worse thing to happen would be a crew switching stab trim off in the highly unlikely event that the AoA failed (they probably checked failure rates in NGs). Seems that for some crews switching stab trim off is very unlikely even when the trim is motoring way down and making things uncomfortably heavy and for some reason the AoA vanes have a lot higher failure rate in the Max.

Yes but I find this response unconscionable.

I think I would have found it.

You think you would have found it.

Two professional crews flew it into the ground within a few months very early in the adoption cycle of this aircraft.

Training and experience didn't change.

What changed was the introduction of MCAS.

I can't find that the fault of the aircrew and don't see how anyone else can.

[Ian W]

Yes but I find this response unconscionable.

I think I would have found it.

You think you would have found it.

Two professional crews flew it into the ground within a few months very early in the adoption cycle of this aircraft.

Training and experience didn't suddenly change.

What changed was the introduction of MCAS.

I can't find that the fault of the aircrew and don't see how anyone else can.

See Ferry Pilot #2945

[bill fly]

To test the control cable and chain adjustment you have among others "Operate the stabilizer system through 5 full cycles."
So I do not see an overheat problem...
Thanks Ifix,
That is on ground, with no aerodynamic load I guess?
The two accidents happened in warm places...

[MurphyWasRight]

Salute Ferry !!
I love it.

Although I flew very sophisticated aerospace vehicles, I am not quite ready to let HAL run everything at this time. And you are correct about not providing the human crewmembers with realistic training and practice for that one day they may have to actually perform their 'Chuck Yeager" routine. The "children of the magenta line" still live, and there's more of them every year.
CASE IN POINT:
The Lion 610 and previous flight's MCAS problem would not have been handled successfully by HAL, especially if the same sfwe shop did the design and code. At the time of Lion 610, the problem facing the plane was not the basic "runaway trim" that most of us think about. Then there;s the stall warning! HAL would likely have commanded some nose down, huh? Did HAL know altitude above the terrain or note the rising terrain ahead? Did the sfwe folks think that MCAS would activate at takeoff speed, and a few hundred feet and not at the other end of the envelope doing a banked turn at 20,000 feet? Would HAL have reduced power at 700 feet with stall warning shaking and been aware that getting too fast would reduce elevator effectiveness due to "blow up" with AND trim being commanded?

The single point of failure, the AoA doofer, that everyone points out was only the first event in the sequence that eventually resulted in loss of control. Just like almost all crashes. Few are the result of one thing going tango uniform. And that is where HAL has trouble, but the carbon-based lifeforrms can connect things that HAL's father had not thot of, and then do something not "programmed". You know, turn off both electric stab switches before treating the stall warning and not experiencing continuous trim in one direction.

Gums opines...
/sarcasm/ Ahhh but you miss the magic of automation: Hal would -never- get itself into a incipient stall in the first place./sarcasm/

Gums: thanks very much for your 'real world' perspective on all of this

It is true that MCAS is only active when autopilot is disabled, the autotpilot does not get confused by the non-linear change in control force.
Also true HAL could handle all the available sensors without sensory overload so in this case quite possibly the AOA disagree would have just been logged and flight continued.
Although there would have been more than 2 if HAL was in full charge, I hope :uhoh:

Very long term I can see that a fully automatic system might -overall- be safer but anything that has to rely on 'human exception handling' is a far from there.

If anything this whole mess point to a major issue when different philosophies are intermingled, 9 parts "the pilot is in control", one part "except when we don't think so".

[pilot9250]

See Ferry Pilot #2945

Actually I agree with Ferry Pilot and concur that the inevitable and unstoppable answer to imperfect automation is improved automation.

That said he is discussing a long term trend and I am discussing a step change.

That yesterday's crews can deal with faults in today's automation is irrelevant or at least of very limited utility.

It was unreasonable to expect today's crews to deal with this automation now.

The conclusion is that this automation should not have been introduced, and Boeing are recognising this by fixing it so that it is safe for today's pilots.

[patplan]

Whistleblowers claim aviation inspectors who evaluated Boeing 737 MAX were poorly trained
April 2, 2019 4:34 pm

The U.S. Senate Commerce Committee is investigating claims by a number of whistleblowers that aviation safety inspectors, including some who worked to evaluate the now-grounded Boeing 737 MAX, were not properly trained or certified, the committee chairman said on Tuesday.

More than 300 Boeing 737 MAX jets have been grounded worldwide after two crashes -- in Indonesia in October and in Ethiopia last month -- killed nearly 350 people.

Senator Roger Wicker, a Republican, said in a letter to the Federal Aviation Administration that the FAA may have been notified about the training and certification concerns as early as August 2018 -- before the Indonesia crash -- citing information from the whistleblowers and documents.

The letter did not disclose if the whistleblowers worked for Boeing, the FAA or another entity. The FAA has come under criticism for delegating some of its certification responsibilities to Boeing and other manufacturers.

In his letter, Wicker asked acting FAA administrator Daniel Elwell to provide answers to detailed questions by April 16...

...Wicker's letter said the whistleblowers alleged that safety inspectors without proper safety training could have been participants on the Flight Standardization Board that evaluated the 737 MAX 8 to "determine the requirements for pilot type ratings, to develop minimum training recommendations, and to ensure initial flightcrew member competency."...

Source:
- https://globalnews.ca/news/5123264/boeing-737-max-faa-whistleblowers/

[73qanda]

The days of good hands and feet flying are never coming back, and this is not news to those who make the software.
I don’t want to agree with you. Hopefully you’re incorrect.
At the moment the regulator mandates that I get 8 hours of simulator time p/a. In reality it’s more like 16 because the pilot I am teamed up with also needs 8 hours. We complete this over two checks held six months apart. If the regulator mandated that I need 12 hours, and the extra four hours had to be sans automation and both high level and circuit work, the difference in my handling skills and confidence as a pilot would be significant. The cost would easily be passed onto the flying public and would effect all operators equally.
With all the cosy relationships between Airlines and regulators and manufactureres globally I won’t hold my breath but it would go a long way to making our Industry safer for very little cost.
This is one situation that would benefit from some autocratic leadership and hang the corporate consequences......anyone know a leader like that?
Edited to add; A ‘bad outcome’ from the Max saga would be that Boeing tinker with their software and manage their corporate relationships to get the aircraft flying again.
A ‘good outcome’ to the saga would be if pilots around the world became more competent through mandated automation-free sim time that is in addition to the current requirements.

[edmundronald]

Gums,

HAL just eats the data coming down the wire and keeps going. Human can notice things are going pearshaped, point Mark I eyeball out nearest viewport and evaluate real-world situation, hopefully even recover..

On the other hand, sadly, it's harder to postmortem diagnose and later avoid human error than mechanical error, even when honest efforts at discovery are made.

Edmund



Salute Ferry !!
I love it.

Although I flew very sophisticated aerospace vehicles, I am not quite ready to let HAL run everything at this time. And you are correct about not providing the human crewmembers with realistic training and practice for that one day they may have to actually perform their 'Chuck Yeager" routine. The "children of the magenta line" still live, and there's more of them every year.
CASE IN POINT:
The Lion 610 and previous flight's MCAS problem would not have been handled successfully by HAL, especially if the same sfwe shop did the design and code. At the time of Lion 610, the problem facing the plane was not the basic "runaway trim" that most of us think about. Then there;s the stall warning! HAL would likely have commanded some nose down, huh? Did HAL know altitude above the terrain or note the rising terrain ahead? Did the sfwe folks think that MCAS would activate at takeoff speed, and a few hundred feet and not at the other end of the envelope doing a banked turn at 20,000 feet? Would HAL have reduced power at 700 feet with stall warning shaking and been aware that getting too fast would reduce elevator effectiveness due to "blow up" with AND trim being commanded?

The single point of failure, the AoA doofer, that everyone points out was only the first event in the sequence that eventually resulted in loss of control. Just like almost all crashes. Few are the result of one thing going tango uniform. And that is where HAL has trouble, but the carbon-based lifeforrms can connect things that HAL's father had not thot of, and then do something not "programmed". You know, turn off both electric stab switches before treating the stall warning and not experiencing continuous trim in one direction.

Gums opines...

[Oakape]

For years military aviation has been going down the path, where the aircraft needs a certain level of automation just to be able to fly. It seems that that philosophy is creeping into commercial aviation in the never ending quest for cost reduction & the 737 MAX & it’s MCAS is evidence of that trend. The thing the designers seem to have forgotten or ignored is that in an airliner we can’t eject when the automation fails or does what is unintended.

[Noel Duguet]

If Ethiopian Airlines experienced controllability problems very shortly after takeoff, at 400-500 ft AGL, is it likely that the plane was in clean configuration already?
And if not, what does that say about the issues the pilots were facing ?

[GarageYears]

Today I had the opportunity to talk with a line pilot from a major US carrier that has both 737NGs and MAX 9’s in their fleet, and we chatted about both Lion and Ethiopian incidents. He routinely flys 737NGs and had only flown the MAX on one leg to date, but had nothing other than good things to say about it.

That’s not the point of this post - what is, was his absolute certainty that ANY pilot flying the MAX post-Lion crash should have known in a heartbeat the symptoms of a misbehaving AOA sensor and how to disable MCAS. He was unequivocal that this would be a non-event.

Additionally he noted that he routinely hand-flys the aircraft on departure to 10,000 or 18,000 feet (route dependent) and would only then switch on the AP. Equally, on approach he would switch off the automatics around 6,000 feet and hand-fly the aircraft. This is encouraged by his airline. This seems rather different than many these days.

His point was any time the airplane isn’t doing something he expected - turn off all the automatics including electric trim and figure out what was going on.

I asked whether he felt he would have turned off the trim BEFORE he knew about MCAS, and he was adamant that any repeated trim as experienced by Lion Air would have had the electric trim disabled no more than the second iteration. It’s simply not the same trim action as that which occurs with the STS, and would have turned off.

Of course this anecdotal and simply one pilot’s input, but take it for what it is. This pilot said he would fly a MAX tomorrow without concern.

- GY

[MurphyWasRight]

For years military aviation has been going down the path, where the aircraft needs a certain level of automation just to be able to fly. It seems that that philosophy is creeping into commercial aviation in the never ending quest for cost reduction & the 737 MAX & it’s MCAS is evidence of that trend. The thing the designers seem to have forgotten or ignored is that in an airliner we can’t eject when the automation fails or does what is unintended.
The real problem with 737 MAX is the overlaying of FBW features (some initially hidden) on an updated legacy design to make it mimic an earlier version to keep it 'in family'.

A 737 MAX airframe made fully FBW Airbus sidestick style would be a safe airplane with no need for kludges such as MCAS or STS.
From what I have read even 'raw mode' would be fine although a bit touchy in some cases.

Of course then it would no longer be a 737 so that would be a non-starter.

[Capn Bloggs]

Additionally he noted that he routinely hand-flys the aircraft on departure to 10,000 or 18,000 feet (route dependent) and would only then switch on the AP. Equally, on approach he would switch off the automatics around 6,000 feet and hand-fly the aircraft. This is encouraged by his airline. This seems rather different than many these days.
I have no doubt that the automation policies of some outfits reduces the ability of pilots to detect and counter abnormal handling characteristics when they are (forced to) hand flying. The autopilot is an aid, not a crutch.

[sheppey]

The problem is the autopilot is a crutch to perhaps 85% of airline pilots in Asia, Europe, India and the Middle East. As is the flight director, too. The FOQA computer transmits all handling back to the engineering base and flight crew heads roll if it detects FD turned off, or AP not engaged. It depends on the operator of course but the knowledge that FOQA is monitoring so many parameters is enough to discourage flight crews from keeping their hand in during line flying.

[Capn Bloggs]

Sheppey, I have no doubt what you say is true, even though it is not right. :ok:

[pilot9250]

Today I had the opportunity to talk with a line pilot from a major US carrier that has both 737NGs and MAX 9’s in their fleet, and we chatted about both Lion and Ethiopian incidents. He routinely flys 737NGs and had only flown the MAX on one leg to date, but had nothing other than good things to say about it.

That’s not the point of this post - what is, was his absolute certainty that ANY pilot flying the MAX post-Lion crash should have known in a heartbeat the symptoms of a misbehaving AOA sensor and how to disable MCAS. He was unequivocal that this would be a non-event.

Additionally he noted that he routinely hand-flys the aircraft on departure to 10,000 or 18,000 feet (route dependent) and would only then switch on the AP. Equally, on approach he would switch off the automatics around 6,000 feet and hand-fly the aircraft. This is encouraged by his airline. This seems rather different than many these days.

His point was any time the airplane isn’t doing something he expected - turn off all the automatics including electric trim and figure out what was going on.

I asked whether he felt he would have turned off the trim BEFORE he knew about MCAS, and he was adamant that any repeated trim as experienced by Lion Air would have had the electric trim disabled no more than the second iteration. It’s simply not the same trim action as that which occurs with the STS, and would have turned off.

Of course this anecdotal and simply one pilot’s input, but take it for what it is. This pilot said he would fly a MAX tomorrow without concern.

- GY

Two professional crews didn't.

It just doesn't matter what other crews who didn't actually experience it think they might have done.

We need to deal with what actually happened, not what might have happened on a different night with a different crew.

Boeing are fixing it.

The reason they are fixing it is that it is broken.

[BuzzBox]

Boeing are fixing it.
The reason they are fixing it is that it is broken.

Perhaps so, but it's also important to understand why the crews of the accident aircraft did not handle the situation they encountered. We don't yet know what happened in the Ethiopian accident, but assuming that crew encountered something similar to the Lion Air crew, why did neither crew think to deactivate the electric trim in sufficient time to recover the situation? Was basic training a factor, or were they simply overwhelmed by the number of warnings that occurred?

[pilot9250]

Perhaps so, but it's also important to understand why the crews of the accident aircraft did not handle the situation they encountered. We don't yet know what happened in the Ethiopian accident, but assuming that crew encountered something similar to the Lion Air crew, why did neither crew think to deactivate the electric trim in sufficient time to recover the situation? Was basic training a factor?

Part of fixing it means Boeing are revising training.

[BuzzBox]

Part of fixing it means Boeing are revising training.

They might fix MCAS training, but I doubt they will do anything to change basic pilot training. In the Lion Air case, why would a pilot sit there, flying more or less level at a more or less constant speed and allow an automatic trim system to trim nose down on 20-odd occasions without doing something to stop it? If an automatic system is doing something it's not supposed to do and is making control difficult, then there's one very obvious solution. Deactivate the bloody thing and revert to something more basic. To my way of thinking, that should be part of a pilot's basic training

[pilot9250]

They might fix MCAS training, but I doubt they will do anything to change basic pilot training. In the Lion Air case, why would a pilot sit there, flying more or less level at a more or less constant speed and allow an automatic trim system to trim nose down on 20-odd occasions without doing something to stop it? If an automatic system is doing something it's not supposed to do and is making control difficult, then there's one very obvious solution. Deactivate the bloody thing and revert to something more basic. To my way of thinking, that should be part of a pilot's basic training

They only need to fix MCAS implementation and training to deal with problems caused by MCAS.

737's weren't dropping out of the sky otherwise.

[BuzzBox]

They only need to fix MCAS implementation and training to deal with problems caused by MCAS.

So what happens next time somebody has a different type of problem for which they have had no specific training?

[Rated De]

So what happens next time somebody has a different type of problem for which they have had no specific training?

Needn't worry the actuaries and accountants have already costed it to the cent.

[ferry pilot]

On the touchy ( forgive me ) subject of hand flying there was a time some here will recall, when a lot of training was done in the airplanes, some of it at night. Circling approaches, recovery from unusual attitudes, stalls and steep turns, offsets and every conceivable situation that might be encountered before all the airports had good approach aids and long enough runways. Hands on, heads up stuff you could never forget because it scared the daylights out of you. Behind us now, with a few exceptions in remote parts of the world, and good riddance to it. Safe and sanitary simulation, nowhere near as stimulating but a lot less dangerous, is here to stay. But it is no substitute for experience, and that brings up something else that has changed. Flying time and flying experience are no longer the same thing. Five thousand hours at one time would have exposed you to several difficult and trying situations in almost any job outside the airlines and some within. Today, five thousand hours in the right seat of a scheduled carrier with modern well maintained equipment may seem like enough time, but it may not be very much experience at all. I don’t have humble opinions, but the one I do have favors intelligent acceptance of the inevitable AI, not the expensive step in the wrong direction of trying to make new pilots more like the old ones. The teachable autopilot is right around the corner, able to be programmed with more experience than a room full of pilots. Driving airplanes is not what it used to be, nor should it be.

[Sucram]

His point was any time the airplane isn’t doing something he expected - turn off all the automatics including electric trim and figure out what was going on.

- GY
Hindsight is a wonderful thing............but in the past people have disconnected the autopilot when things have gone wrong, lost mental capacity and made some pretty poor decisions.......although there are some situations where autopilot disconnect is a memory item or sometimes it might be plain common sense to do so, but I would suggest you would "figure out what's going on" before you disconnect, and only if it's appropriate to do so!

[Tokyo Geoff]

I shouldn't paste the whole article but these are the opening two paragraphs. I'm sure this will be more widely picked up by other news outlets shortly.

Pilots at the controls of the Boeing (https://quotes.wsj.com/BA) Co. 737 MAX that crashed in March in Ethiopia initially followed emergency procedures laid out by the plane maker but still failed to recover control of the jet, according to people briefed on the probe’s preliminary findings.

After turning off a flight-control system that was automatically pushing down the plane’s nose shortly after takeoff March 10, these people said, the crew couldn’t get the aircraft to climb and ended up turning it back on and relying on other steps before the final plunge killed all 157 people on board.

[maxter]

Busines (https://www.wsj.com/news/business)Ethiopian Airlines Pilots Initially Followed Boeing’s Required Emergency Steps to Disable 737 MAX System

Details of Ethiopian crew’s actions gleaned from preliminary black-box datahttps://si.wsj.net/public/resources/images/S1-CF765_BOEING_OR_20190402225203.jpgPeople from various hamlets and villages pay respects to the 157 victims who perished in the crash of Ethiopian Airlines flight 302. Photo: Jemal Countess/Getty Images ByAndy Pasztor andAndrew TangelApril 2, 2019 11:47 p.m. ET Pilots at the controls of the Boeing (https://quotes.wsj.com/BA) Co. 737 MAX that crashed in March in Ethiopia initially followed emergency procedures laid out by the plane maker but still failed to recover control of the jet, according to people briefed on the probe’s preliminary findings.After turning off a flight-control system that was automatically pushing down the plane’s nose shortly after takeoff March 10, these people said, the crew couldn’t get the aircraft to climb and ended up turning it back on and relying on other steps before the final plunge killed all 157 people on board.The sequence of events, still subject to further evaluation by investigators (https://www.wsj.com/articles/u-s-ethiopian-investigators-tussle-over-737-max-crash-probe-11554073749?mod=article_inline), calls into question assertions by Boeing and the U.S. Federal Aviation Administration over the past five months that by simply following established procedures to turn off the suspect stall-prevention feature, called MCAS, pilots could overcome a misfire of the system and avoid ending in a crash.

The pilots on Ethiopian Airlines Flight 302 initially reacted to the emergency by shutting off power to electric motors driven by the automated system, these people said, but then appear to have re-engaged the system to cope with a persistent steep nose-down angle. It wasn’t immediately clear why the pilots turned the automated system back on instead of continuing to follow Boeing’s standard emergency checklist, but government and industry officials said the likely reason would have been because manual controls to raise the nose didn’t achieve the desired results.

After first cranking a manual wheel in the cockpit that controls the same movable surfaces on the plane’s tail that MCAS had affected, the pilots turned electric power back on, one of these people said. They began to use electric switches to try to raise the plane’s nose, according to these people. But the electric power also reactivated MCAS, allowing it to continue its strong downward commands, the people said.

The same automated system, also implicated in a 737 MAX crash in Indonesia (https://www.wsj.com/articles/ethiopian-airlines-black-boxes-showed-clear-similarities-with-lion-air-crash-11552839318?mod=article_inline) in late October, has become the focus of various congressional and federal investigations (https://www.wsj.com/articles/senate-committee-opens-inquiry-into-faa-safety-inspectors-training-requirements-for-boeing-737-max-11554241623?mod=article_inline), including a Justice Department criminal probe.

The latest details are based on data downloaded from the plane’s black-box recorders, these people said. They come as Ethiopian investigators prepare to release their report about their preliminary conclusions from the accident, anticipated in the coming days.

Investigators probing the Oct. 29 crash of Lion Air Flight 610 believe erroneous data from a single sensor caused the MCAS system to misfire, ultimately sending the plane into a fatal nose-dive and killing all 189 people on board. Some of the same key factors were at play in the Ethiopian crash, according to people briefed on the details of both crashes.https://images.wsj.net/im-63660?width=1260&aspect_ratio=1.5U.S. Investigators looked at debris from the crash in Bishoftu, Ethiopia, on March 12. Photo: Jemal Countess/Getty Images After the Lion Air accident, Boeing and the FAA issued bulletins to 737 MAX operators around the world reminding them of the existing procedure pilots are trained to follow should the plane’s flight-control system go haywire and mistakenly push down the nose. Those are the steps the Ethiopian pilots initially took months later, these people said.

That procedure works to disable the new MCAS, much like another flight-control feature on earlier 737 models, by cutting power. The plane maker and FAA’s bulletins highlighting that safeguard were often mentioned after the Lion Air accident when U.S. aviation industry officials vouched for the aircraft’s safety. Boeing Chief Executive Dennis Muilenburg noted the procedure in a Nov. 13 television interview when asked about information given to pilots.

“In fact, that’s part of the training manual,” Mr. Muilenburg said on Fox Business Network, adding the manufacturer was confident in the plane’s safety. “It’s an existing procedure so the bulletin we put out…pointed to that existing flight procedure.”

At a briefing for reporters last week, a Boeing official noted investigations of both crashes were continuing but didn’t comment about specifics when he outlined a coming software fix for the MCAS system and related training changes.Related

Between Two Deadly Crashes, Boeing Moved Haltingly to Make 737 MAX Fixes (https://www.wsj.com/articles/between-two-deadly-crashes-boeing-moved-haltingly-to-make-737-max-fixes-11554164171?mod=article_inline)
The Final Minutes of Ethiopian Airlines’ Doomed Boeing 737 MAX (https://www.wsj.com/articles/the-final-minutes-of-ethiopian-airlines-doomed-boeing-737-max-11553876300?mod=article_inline)
How Boeing’s 737 MAX Failed (https://www.wsj.com/articles/how-boeings-737-max-failed-11553699239?mod=article_inline)

The revised system will rely on two sensors, instead of one as originally designed, to prevent erroneous data triggering it. The system will now be designed to make it less aggressive and allow pilots more control over it, according to previous Boeing and FAA statements.

Mike Sinnett, Boeing’s vice president of product strategy, said last week the plane maker had “complete confidence that the changes we’re making would address any of these accidents.” The software fix could come as soon as mid-April (https://www.wsj.com/articles/lawmakers-scrutinize-timeline-for-boeing-737-max-software-fix-11553601603?mod=article_inline), according to a person briefed on that issue, but further tests are needed before regulators can approve and mandate it so the grounded fleet can return to service. Another person close to the process, however, said final FAA reviews and tests could take up to six weeks. After that, it could take months longer for some overseas regulators to review and certify the fix for aircraft they oversee.

Activation of MCAS and a related pilot alert, which warns pilots of an impending aerodynamic stall, had been reported previously regarding the Ethiopian crash. But in the wake of the tragedy, Boeing, the FAA and Ethiopian authorities leading the probe have refrained from making any comments about whether the crew followed Boeing-sanctioned procedures to cope with the emergency.

Going forward, aviation experts, regulators and pilots debating the relevant safety issues will have to consider the implications that while the pilots did take such steps in the beginning, those apparently didn’t work as expected likely due to the plane’s speed, altitude and other factors. Eventually, the crew veered to other, nonstandard procedures that made their predicament even worse.

Another issue likely to be raised by the preliminary Ethiopian report is why a single sensor malfunctioned or somehow may have been damaged shortly after takeoff—touching off the deadly chain of events.

Write to Andy Pasztor at [email protected] and Andrew Tangel at [email protected]
Appeared in the April 3, 2019, print edition as 'Ethiopia Pilots Followed Boeing Steps.'

[fdr]

Once is airplane error; twice is pilot error.

Wright Bros broke more than 2 planes...

If you amend your comment from PIlot Error to Human Error, which would include the software designers, the DER's operating under the ODA, the Regulatory oversight of the OEM, the airline management response, the mechanics undertaking fault finding of apparently repetitive defects, the regulatory oversight of the operational and maintenance program, and possibly the pilots, then that may be a valid statement.

The pilots here were the first to the scene of the accident, and in these cases they had an interest in surviving, yet didn't. Pretty easy post hoc to brand the crew with the fault, when they are confronted with what appears to be events that precluded a safe outcome, irrespective of how clear and simple that appears to us sitting around our computers and relaxing, without being placed in a life threatening situation. When we know why the second crew didn't sort it out, the industry will have gained valuable knowledge and maybe hardened against similar future events. With the knowledge that the 2nd crew had been briefed on the issue, the fact that it didn't end well is important, and until we understand why that was the case, the system will have a hole in it.

“There is nothing more deceptive than an obvious fact.” Arthur Conan Doyle

[ferry pilot]

I don’t want to agree with you. Hopefully you’re incorrect.
At the moment the regulator mandates that I get 8 hours of simulator time p/a. In reality it’s more like 16 because the pilot I am teamed up with also needs 8 hours. We complete this over two checks held six months apart. If the regulator mandated that I need 12 hours, and the extra four hours had to be sans automation and both high level and circuit work, the difference in my handling skills and confidence as a pilot would be significant. The cost would easily be passed onto the flying public and would effect all operators equally.
With all the cosy relationships between Airlines and regulators and manufactureres globally I won’t hold my breath but it would go a long way to making our Industry safer for very little cost.
This is one situation that would benefit from some autocratic leadership and hang the corporate consequences......anyone know a leader like that?
Edited to add; A ‘bad outcome’ from the Max saga would be that Boeing tinker with their software and manage their corporate relationships to get the aircraft flying again.
A ‘good outcome’ to the saga would be if pilots around the world became more competent through mandated automation-free sim time that is in addition to the current requirements.
There is nothing I would like more than to see those with your attitude get what you want, even if I disagree.. Check out my last 2972 post and you will see why I feel the need for a different approach.

[aeronaut321]

737qanda that's a great idea.

Ferry pilot, I think producing pilots capable of hand flying with confidence is an essential skill - it can be achieved without much cost but just requires a change of culture. Some airlines already do this just by encouraging turning off the automation (when appropriate, ie good weather, low traffic levels).

I remember a skipper I flew with when I almost overcooked a hand flown approach say: what would the passengers rather have, a perfectly flown approach by the autopilot everytime or a pilot who can confidently fly if the situation requires it, even if we'd had to throw that approach away?
​​​​

[GotTheTshirt]

One think I don't understand in all the above.
The consensus is that these pilots were not adequately trained or knowledgeable about the aircraft, which may of course be true.
But to get into their situation there had to be a failure in the aircraft systems of some kind.
So accepting that the fact that all the US pilots were better equipped to deal with this situation , have there not been any failures of this system on US registered aircraft?
Apart from the 2 we know about, have there not been no log book write ups for this system in the US ?

[TTail]

Now that it seems very likely that MCAS was involved in both the Lionair and the Ethiopean accidents, a sad irony emerges namely that the pilots (of the non-accident Lionair flight) who had the least knowledge of both the general MCAS issues and also of their own specific a/c issues, were the only ones who were able to handle the problem. Assuming warnings, cautions and lights were somewhat identical on all three flights - what was different? And what were the significant differences?

I didn't read through the now closed Lionair thread until yesterday and I realize many of the questions, quotes and opinions from my previous posts were already there - my apologies and thanks to Hans, Bernd, iff789, Denti, FCeng84 for their patience, persistence and insight. Kudos to gums for figuring out the gist of it within a couple of days of the first accident!

[mh370rip]

The consensus is that these pilots were not adequately trained or knowledgeable about the aircraft, which may of course be true.
?

Or maybe not. The WSJ article quoted above says that the Ethiopian pilots were aware of the Lion Air crash and did turn off the stab trim motors but couldn't get the nose up using the manual wheels.

[patplan]

Now that it seems very likely that MCAS was involved in both the Lionair and the Ethiopean accidents, a sad irony emerges namely that the pilots (of the non-accident Lionair flight) who had the least knowledge of both the general MCAS issues and also of their own specific a/c issues, were the only ones who were able to handle the problem. Assuming warnings, cautions and lights were somewhat identical on all three flights - what was different? And what were the significant differences?

I didn't read through the now closed Lionair thread until yesterday and I realize many of the questions, quotes and opinions from my previous posts were already there - my apologies and thanks to Hans, Bernd, iff789, Denti, FCeng84 for their patience, persistence and insight. Kudos to gums for figuring out the gist of it within a couple of days of the first accident!

Actually, the most intriguing question is: Why the data from the two different vanes of two separate airlines in two separate continents made the MAX-8's, more or less, went berserk the same way...??

There are about 380 B38M's in operation, and about 100 of them - roughly 26% of it- are operated in the US/Canada.

[meleagertoo]

Or maybe not. The WSJ article quoted above says that the Ethiopian pilots were aware of the Lion Air crash and did turn off the stab trim motors but couldn't get the nose up using the manual wheels.
During my 737 3-400 type rating training I clearly recall a demonstration in which stab trim was allowed to go beyond the point where manual trim could be operated due to control loads. Whether this was part of a stab trim runaway drill or an extension of demonstrating the trim system I no longer recall. The purpose was to enable awareness of the condition and practice the technique of (both pilots) hauling back on the yoke and then relaxing the pull while simultaneously clawing back a little manual trim using the wheel. This has to be repeated several times before the loads reduce enough to allow continuous trimming without unloading pull on the yoke.
If a pilot hadn't seen this simple but crucial demostration their recovery from a sufficiently runaway stab would be problematic, and in the Ethiopian case I expect their inordiantely high airspeed would have exacerbated the problem.
Little details like this can make a huge difference years later on the line, and if small details get dropped from the training manual...
Does any other 737 pilot recall doing/not doing this exercise? I'd imagined it to be a universally inuded part of the course but perhaps not. It would certainly be of great importance to now if it was included in the training all four accident pilots recieved.

[GordonR_Cape]

Now that it seems very likely that MCAS was involved in both the Lionair and the Ethiopean accidents, a sad irony emerges namely that the pilots (of the non-accident Lionair flight) who had the least knowledge of both the general MCAS issues and also of their own specific a/c issues, were the only ones who were able to handle the problem. Assuming warnings, cautions and lights were somewhat identical on all three flights - what was different? And what were the significant differences?

I posted this elsewhere this morning: IMO the main differences were the speed at which the trim switches were cut. It has become clear that manual control is not possible when the horizontal stabiliser is loaded by the elevator deflection, at airspeeds > 250kts. The only way to survive that scenario was to reduce the power, and cut the switches early enough. Can someone with the FDR readout of the earlier Lion Air flight confirm if this was what happened?

Edit: Ironically in a nose down condition, engine thrust may produce a pitch up force due to the underslung engines. This could have given some assistance at low speeds, but would not overcome the inability to move the stabiliser at high speeds.

[patplan]

I posted this elsewhere this morning: IMO the main differences were the speed at which the trim switches were cut. It has become clear that manual control is not possible when the horizontal stabiliser is loaded by the elevator deflection, at airspeeds > 250kts. The only way to survive that scenario was to reduce the power, and cut the switches early enough. Can someone with the FDR readout of the earlier Lion Air flight confirm if this was what happened?https://i.ibb.co/Rg8HXwf/JT043.jpg (https://ibb.co/tHRC0rg)
..

https://i.ibb.co/gjG09cd/JT610.jpg (https://ibb.co/3rwxdPv)

[MrsDoubtfire]

One think I don't understand in all the above.
The consensus is that these pilots were not adequately trained or knowledgeable about the aircraft, which may of course be true.
But to get into their situation there had to be a failure in the aircraft systems of some kind.
So accepting that the fact that all the US pilots were better equipped to deal with this situation , have there not been any failures of this system on US registered aircraft?
Apart from the 2 we know about, have there not been no log book write ups for this system in the US ?

I don´t know if this incident is related to the discussion. In this case the ADIRU has been replaced.
A Sunwing Airlines Boeing 737 MAX 8, registration C-GMXB performing flight WG-439 from Punta Cana (Dominican Republic) to Toronto,ON (Canada) with 176 passengers and 6 crew, was enroute at FL350 about 50nm northwest of Washington Dulles Airport,DC (USA) when the captain's instruments began to show erroneous indications. The first officer was handed control of the aircraft as his instruments and the standby instruments remained in agreement. The crew decided to descend out of IMC into VMC as a precaution and descended the aircraft to FL250. Descending through FL280 the weather radar and TCAS failed. The crew declared PAN and worked the related checklists. The left IRS fault light illuminated. The flight continued to Toronto for a safe landing without further incident.

The Canadian TSB reported the left ADIRU was replaced.
Incident: Sunwing B38M near Washington on Nov 14th 2018, multiple system failures (http://avherald.com/h?article=4c0886c4&opt=0)

[Mike FRA]

TTail
I tend to believe that the most significant difference would be the fact that in the cockpit there were 3 heads, 6 hands/arms and 6 feet/legs available for turning on and off switches, pulling very heavily on yokes and, most of all, turning very quickly 2 trim wheels to pull a (by the wind speed “forced-up”) stabilizer back down.R.I.P. 347 lost souls.

[widgeon]

https://i.ibb.co/Rg8HXwf/JT043.jpg (https://ibb.co/tHRC0rg)
..

https://i.ibb.co/gjG09cd/JT610.jpg (https://ibb.co/3rwxdPv)

i am not sure if this was discussed earlier , was the stick shaker left active and the autopilot disengaged for the entire flight ( Jt 043) ?. Would this normally have warranted a more substantial maintenance action before the next flight .

[GordonR_Cape]

patplan
Thanks for the Lion Air FDR charts.

TTail It seems from the scale readings in the preceding Lion air flight, that they hit the cutout switches early on, before speed and nose down trim became excessive, and full manual control was possible.

In the fatal Lion air crash they did the opposite, relying on electric trim to repeatedly counter MCAS, until the captain relinquished control and the co-pilot added insufficient nose up trim.

The WSJ leaked Ethiopian crash details indicate a third scenario, unsuccessfully attempting manual trim after speed and stabiliser loading became excessive.

widgeon
i am not sure if this was discussed earlier , was the stick shaker left active and the autopilot disengaged for the entire flight ?. Would this normally have warranted a more substantial maintenance action before the next flight.

That is the story, and why it was not reported is the million dollar question.

[TTail]

Actually, the most intriguing question is: Why the data from the two different vanes of two separate airlines in two separate continents made the MAX-8's, more or less, went berserk the same way...??

There are about 380 B38M's in operation, and about 100 of them - roughly 26% of it- are operated in the US/Canada.

While I agree that the most important answer to find right now is how a single input error could cause such a catastrophic event, I don't necessarily agree that your question is the most intriguing one. That would depend on whether your interest is centered around hardware, software or humanware. As a pilot of "less than exceptional" skill, I would like to get a handle on whether I was supposed to be able to resolve an MCAS event like these or whether the crew of the non-accident flight indeed were of "exceptional skill" - either in their own right or as a consequence of the third crew member. I'm sure that the vane, wiring, converters, computers and everything else that has anything to do with MCAS are all being scrutinized by the investigative agencies and no MAX will fly again without that issue being resolved.

@Gordon: I have no experience at interpreting those readouts but it seems to me that until the very last part of the accident flight, the speed is fairly constant and multiple trim inputs are being made not only by MCAS but also through manual electric trim. Almost up until the point of the final dive. Where is it indicated that the trim switches were cut?

Edit: With your most recent post I now understand that you talk about the switch cut out happening on the non-accident Lionair flight and the Ethiopean whereas they didn't attempt this action at all on the Lionair accident flight.

[MemberBerry]

Now that it seems very likely that MCAS was involved in both the Lionair and the Ethiopean accidents, a sad irony emerges namely that the pilots (of the non-accident Lionair flight) who had the least knowledge of both the general MCAS issues and also of their own specific a/c issues, were the only ones who were able to handle the problem. Assuming warnings, cautions and lights were somewhat identical on all three flights - what was different? And what were the significant differences?


One significant difference was the 3rd pilot in the cockpit. It's reported that he was the one proposing to disable the electric trim.

And after reading the WSJ article, suggesting the pilots had difficulty trimming manually with the trim wheels, I wonder if having a 3rd pilot wouldn't have helped with that too.

If that's the case, then clearly the procedure for dealing with runway trim is inadequate, especially in the scenario where MCAS activates. Especially since on the MAX you can no longer disable manual electric trim and automatic electric trim independently, both cutout switches now disable both functions. In older 737s you could re-enable just manual electric trim if needed, you can no longer do that in the MAX.

And I'm annoyed by Boeing's claims that disabling electric trim, after following the runway trim procedure, is all you need to do to deal with this emergency.

And the claim of "making a safe aircraft safer" with the MCAS software update rubbed me the wrong after the Lion Air accident. But when they still kept saying that after the Ethiopian crash, it reeked of refusing to publicly accept responsibility for their contribution to the accidents.

It's like Porsche launching a new 911 model, that automatically opens the throttle when you are climbing a steep hill, and the engine is close to stalling, controlled partly by the RPM sensor. And if the RPM sensor fails, the car will suddenly accelerate for no reason, with no way of turning that off, except by turning off the ignition. Except you now have to brake and get the car under control, and that may be difficult because the power steering and power brakes stop working when the engine is turned off. And imagine having to do that on a winding downhill road.

I think that's a close enough analogy to the 737 MAX problems. What would people then think of Porsche if they would come with a press release saying: "our car is perfectly fine, any driver should know to turn off the engine in that situation"?

[threemiles]

The WSJ article quoted above says that the Ethiopian pilots were aware of the Lion Air crash and did turn off the stab trim motors but couldn't get the nose up using the manual wheels.

MCAS is inhibited as long as the flaps are down. As the flaps are retracted (at 1000 AGL per SOP) MCAS starts to push the nose down for 5 secs, maybe twice or three times, before PF realizes whats going on .
Then per EAD trim cutout.
The plane gets faster quickly, control loads higher.
Someone would need to pull the yoke and reduce thrust, but both are trying to get the nose up with the trim wheel???
Really??.

[Loose rivets]

I know HS loads has been mentioned several times, but I feel this post raises the bar.

It really spells out how ordinary mortals can be trapped into a different kind of coffin corner.

https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-150.html#post10437474

[Centaurus]

During my 737 3-400 type rating training I clearly recall a demonstration in which stab trim was allowed to go beyond the point where manual trim could be operated due to control loads. Whether this was part of a stab trim runaway drill or an extension of demonstrating the trim system I no longer recall. The purpose was to enable awareness of the condition and practice the technique of (both pilots) hauling back on the yoke and then relaxing the pull while simultaneously clawing back a little manual trim using the wheel. This has to be repeated several times before the loads reduce enough to allow continuous trimming without unloading pull on the yoke.

I was trained in the 737-200 simulator in 1977 on the technique you described. One rather crude method of demonstrating the roller coaster sequence (and I emphasize this was purely 'playing around' and not a structured planned exercise so please no criticism) was to get airborne with the stabiliser trim purposefully set full electrical forward to see what stick force was needed to get airborne.

It required full back control column to get airborne as can imagine and we passed VR plus about 20 knots before the nose would rise. The purpose was to gain enough altitude before attempting the roller coaster method of relieving aerodynamic forces on the stabiliser. With the body angle pulled hard to 10 degrees nose up, or more if possible, against the full forward stab trim, the pull force was momentarily relaxed and the aircraft 'bunts' over (for want of a better word).

During that very short period that the aircraft is transitioning from nose high to nose low the manual stab trim wheel was able to be very rapidly wound back from full forward for about five seconds before the nose dropped and height was lost.

Both pilots then again pulled back hard against the aerodynamic force until the nose was high enough to repeat the exercise. As soon as the pull was relaxed and the aerodynamic load momentarily eased, more frantic winding back of the stab trim handles was available for another five second until the nose dropped again. It is emphasized that it is extremely hard to wind the stab trim handles back unless the aerodynamic load against the stabiliser is reduced

From this rather amateur experiment it was clear that below about 1500 feet the success of the roller coaster method of using manual stab trim was very much dependent on how high the nose could be raised above the horizon before the elevator could do no more and backward pressure let go to enable the manual stab trim to be operated relatively freely for that few vital seconds you had before pulling back on the elevator to stop the ensuing dive.

Two pilots using their combined strength was needed to keep the nose from dropping but as soon as the PF took one hand from the control wheel to wind the manual stab trim, it was difficult for the other pilot to stop the nose from dropping sharply.

Once you have seen this quite dramatic exercise demonstrated in the simulator you will never forget how to fall back if necessary on the roller coaster method of using the manual stabiliser trim to relieve the aerodynamic forces on the stabiliser.

[TTail]

MCAS is inhibited as long as the flaps are down. As the flaps are retracted (at 1000 AGL per SOP) MCAS starts to push the nose down for 5 secs, maybe twice or three times, before PF realizes whats going on .
Then per EAD trim cutout.
The plane gets faster quickly, control loads higher.
Someone would need to pull the yoke and reduce thrust, but both are trying to get the nose up with the trim wheel???
Really??.
So they clean up the airplane, N1 is in the 80s or 90s, MCAS kicks in and the PF for some reason is not trimming off the loads with manual electric trim. Instead the STAB TRIM CUTOUT switches iaw the EAD are set to cutout at the most unfortunate time.They bring out the trim wheel handle and try to trim via muscle power. While thrust remains in the 80s or 90s. You're now in a place where reducing thrust will make the a/c attempt to point the nose down even further and not reducing thrust/speed will make it increasingly more difficult to rotate the trim wheel. And the person next to you has 2-300hrs total flight time... Is this how it reads?

[Icarus2001]

...while pulling 60 pounds with the left hand only on the control column and then manually turn the aerodynamically loaded (from high speed) STAB TRIM wheel with the right hand at least a hundred revolutions, within seconds?

So are you saying there was only one pilot on the flight deck?

[GordonR_Cape]

MCAS is inhibited as long as the flaps are down. As the flaps are retracted (at 1000 AGL per SOP) MCAS starts to push the nose down for 5 secs, maybe twice or three times, before PF realizes whats going on .
Then per EAD trim cutout.
The plane gets faster quickly, control loads higher.
Someone would need to pull the yoke and reduce thrust, but both are trying to get the nose up with the trim wheel???
Really??.

I am not a pilot, but have read enough to think we are all seeing the same story now. Once they had passed 250kts at low altitude, they really had run out of options. This is despite what Boeing and the FAA confidently told us with the emergency AD in November. Nothing there about lowering speed or releasing the elevator, to reduce stabiliser loading under manual trim.

They also didn't have the option of putting flaps down (due to overspeed), which would have immediately inhibited MCAS. Enabling auto-pilot was equally impossible because of IAS disagree.

A reminder of the exact AD wording, which sounds so easy:
Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can beused to neutralize control column pitch forces before moving the STABTRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can beused before and after the STAB TRIM CUTOUT switches are movedto CUTOUT.

[safetypee]

If the reports of the Ethiopian pilot’s difficulties after following the procedure are correct, either being unable to trim manually or the perception of ineffectiveness - high force slow trim rate, this would increase pressure on Boeing and the FAA.

Furthermore, if the FAA knew of this inability (NTSB rep), then how could they issues a special approval for repositioning flights with empty 737 Max.
Might the operators / unions have a view on this.

Control force discussion and EASA views (#25) in https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html

[GarageYears]

Correct me if I'm wrong, but as far as I am aware, there was/is nothing stopping the crew from electrically trimming the aircraft nose-level (or high even) and THEN hitting the trim cutout switches?

Notwithstanding speed or any other factors?

Yes, I'm sitting here with 20/20 hindsight as many are happy to point out, but assuming Ethiopian WAS an AOA sensor high issue (which we still have no confirmation) leading to an MCAS issue, why wouldn't the crew trim NU electrically and then in the 5 seconds before MCAS would run again, hit the cut-outs?

- GY

[safetypee]

GarageYears, #3001, there is much conjecture as to a crew’s ability to detect a malfunction, where initially the trim - MCAS function is working as designed, so that it might take at least two cycles to deduce a problem (less so with increasing stick force, but this is not directly associated with trim).
Thus why fly / trim nose high if everything appears normal (except distracting stick shake, air-data alerts, low speed awareness, all of which might suggest keep the nose low).

More recently, from the EASA certification documents ‘Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, … this description appears to relate to conventional trim assessment of trim force vs speed in level flight and not the the failure condition, (and to what extent does this simulation represent the real aircraft if the aircraft had never experienced the condition, MCAS induced extreme trim setting, + stick shake, + increased feel)

[GordonR_Cape]

Furthermore, if the FAA knew of this inability (NTSB rep), then how could they issues a special approval for repositioning flights with empty 737 Max.Might the operators / unions have a view on this.
Control force discussion and EASA views (#25) in https://www.pprune.org/tech-log/619326-boeing-advice-aerodynamically-relieving-airloads-using-manual-stabilizer-trim.html



My understanding (not a pilot) is that if the stabiliser trim is set on the ground, and the trim cutoff switches activated before takeoff, then the aircraft should be controllable under normal flight conditions. Keeping airspeeds below 250kts would be an extra precaution.

The FDR readout for the Lion Air flight (JT043) prior to the crash (posted on previous page) looks mostly unremarkable (stick shaker notwithstanding). Following the initial oscillations, and after the cutoff switches were activated, trim adjustments were handled manually as per normal flight parameters.

Correct me if I'm wrong, but as far as I am aware, there was/is nothing stopping the crew from electrically trimming the aircraft nose-level (or high even) and THEN hitting the trim cutout switches?

Notwithstanding speed or any other factors?

Yes, I'm sitting here with 20/20 hindsight as many are happy to point out, but assuming Ethiopian WAS an AOA sensor high issue (which we still have no confirmation) leading to an MCAS issue, why wouldn't the crew trim NU electrically and then in the 5 seconds before MCAS would run again, hit the cut-outs?

- GY

Sources differ, and that was the advice from Boeing and the FAA (see my earlier post). There is a strong suggestion that the electric trim was intentionally restricted in power, specifically to prevent runaway nose up trim. This meant that overpowering MCAS this way was not possible, though it might have made a few degrees difference before they hit the cutoff switches. The recent simulator run reported by the NY Times last week, was not encouraging: https://www.nytimes.com/2019/03/25/business/boeing-simulation-error.html

Edit: safetypee has the EASA warning.

[SteinarN]

Very interesting video from Mentour Pilot where he simulates the Ethiopian accident in a real simulator:
Pilots did right and it went MAX wrong - MCAS (https://www.youtube.com/watch?v=EzgBft-79U8&feature=youtu.be)

Bjørn Ferhm at Leeham:
ET302 used the Cut-Out switches to stop MCAS (https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/#more-29790)
The crew of Ethiopian Airlines ET302, which crashed with 157 people on board, used the prescribed Stabilator Trim Cut-Out switches to stop MCAS according to an article by Wall Street Journal today. Yet still, they crashed. We’ve had the information this could indeed be the case for several days, but we didn’t want to speculate in such a sensitive matter.The Wall Street article sites information coming from the investigation. By it, we can now reveal how it’s possible the aircraft can crash despite using the Cut-Out switches. To verify, we ran it all in a simulator together with MentourPilot Youtube channel over the last days.

[Nomad2]

I've flown an aircraft with constant and continuous stick shaker operation, and I can tell you it's quite disconcerting. especially when IMC and hand flying, as we were.

It's certainly going to absorb a big chunk of the reasoning power available in any flight deck.

[Airbubba]

From the Reuters wire a report that the MCAS may have reactivated with the stab trim switches off:

Ethiopian Airlines crash: anti-stall system 'engaged repeatedly'Software may have redeployed without human input before plane went down, say sources
Reuters Wed 3 Apr 2019 07.02 EDT
Boeing’s anti-stall software on a doomed Ethiopian Airlines jet re-engaged up to four times after the crew initially turned it off due to suspect data from an airflow sensor, two people familiar with the matter have said.

It was not immediately clear whether the crew had chosen to redeploy the system, which pushes the nose of the Boeing (https://www.theguardian.com/business/boeing) 737 Max downwards, but one person with knowledge of the situation said investigators were studying the possibility that the software had kicked in again without human intervention.

A Boeing spokeswoman declined to comment. Ethiopian investigators were not immediately available for comment.

Investigators 'believe Ethiopian 737 Max's anti-stall system activated' Boeing’s anti-stall software, known as MCAS, is at the centre of investigations into both the Ethiopian Airlines crash (https://www.theguardian.com/world/ethiopian-airlines-crash) last month and a Lion Air (https://www.theguardian.com/world/lion-air-crash-flight-jt610)
crash (https://www.theguardian.com/world/lion-air-crash-flight-jt610) in Indonesia in October, which together killed nearly 350 people.

People familiar with the investigation said the anti-stall software – which automatically pushes the aircraft’s nose down to guard against a loss of lift – was activated by erroneous “angle of attack” data from a single sensor.

The investigation has now turned towards how MCAS was initially disabled by pilots following an emergency checklist procedure, but then appeared to repeatedly start working again before the jet plunged to the ground, they said.

A directive issued after the Indonesian crash instructed pilots to use cutout switches to disengage the system in the event of problems, and leave it switched off.

Doing so does not shut down the MCAS system completely, but severs an electrical link between the software and aircraft systems, a person familiar with the technology said.

Investigators are studying whether there are any conditions under which MCAS could reactivate itself automatically, without the pilots reversing the cutout manoeuvre. Boeing is in the process of upgrading the software while adding extra training.

A preliminary report is expected within days.

The pilots manoeuvred the plane back upwards at least two times before pressing the stabiliser cutout switches to disable the system, the other person familiar with the matter said.

However, initial flight data indicates the aircraft was not in a “neutral” attitude when pilots used the stabiliser cutout switches to disable the MCAS system, the person added, making the situation harder to manage.

After the pilots turned off MCAS, the plane gained roughly 2,000ft over the next few minutes, but dived to the ground after the renewed succession of nose-down inputs from MCAS.

None of the parties involved in the investigation was available for comment.

[Albino]

Sources differ, and that was the advice from Boeing and the FAA (see my earlier post). There is a strong suggestion that the electric trim was intentionally restricted in power, specifically to prevent runaway nose up trim. This meant that overpowering MCAS this way was not possible, though it might have made a few degrees difference before they hit the cutoff switches.

If I've read your post correctly I think you are getting confused with the wording. The bulletin (the one I read anyway) specifically states that MCAS can be stopped and reversed with use of the electric trim switches on the control column. The note in the Operating Instructions implies that the electric trim should be used to neutralise the pitch force required to maintain controlled flight - then placing the stab trim switches to cutout. So position the stabilizer exactly where you want it and then cut power to the system.

If the information leaked is accurate and the system was behaving as Boeing expected it to in the bulletin, this was misunderstood by the pilots.

[ManaAdaSystem]

From the Reuters wire a report that the MCAS may have reactivated with the stab trim switches off:



How is this possible? MCAS is still operational with the trim system disabled????
If this is true Boeing not only designed the MCAS system and installed it without telling the pilots, but they also failed to tell pilots it can’t be switched off, even after Lion Air crashed?
They made a procedure to deal with a runaway MCAS that is completely worthless and will not take care of the problem?

[Airbubba]

How is this possible? MCAS is still operational with the trim system disabled????

Or, were the column forces in pitch so great with the stab trim switches off that the crew turned them back on momentarily to retrim, not realizing that they could trim manually with the trim wheels?

[SLF3]

If the 'fix' advised by Boeing post Lion Air turns out to be have been followed by the Ethiopian crew that will not reflect well on either Boeing or the FAA.

If they have got it wrong twice what else is out there? The questions will go way beyond MCAS implementation.

[safetypee]

Albino, #3008, further to the post https://www.pprune.org/10437707-post3003.html
and EASA text via https://www.pprune.org/10437609-post25.html there could be questions about the validity of the AD procedure, at least if it was evaluated in the abnormal conditons or only in theory.

Also see the video (via SteinerN) https://www.youtube.com/watch?v=EzgBft-79U8&feature=youtu.be (https://www.youtube.com/watch?v=EzgBft-79U8&feature=youtu.be)
Whilst it appears easier to set nose down trim, it is less so to recover back to a trimmed condition. The nose down direction might be aided by the aerodynamic forces, whilst nose up the trim wheel has to overcome them.
Also, MCAS could run the trim nose down after flap retraction - lower stab trim loads, but if speed increases due to descending flight, then back trim at a higher speed is less achievable, having to overcome much higher stab trim loads.

This is a dynamic, escalating situation. And for those following the ‘40secs time to react’ theme, consider that recognition might take two MCAS cycles 10sec trim, 5 sec pause / back trim, 15 x 2 = 30 sec, only leaves 10secs for action - select trim inhibit, then apply back trim wheel. See the video, move seat back, pull the handle out, then wind - how much, how long, if able.

[FIRESYSOK]

How is this possible? MCAS is still operational with the trim system disabled????
If this is true Boeing not only designed the MCAS system and installed it without telling the pilots, but they also failed to tell pilots it can’t be switched off, even after Lion Air crashed?
They made a procedure to deal with a runaway MCAS that is completely worthless and will not take care of the problem?



The poster you’re responding to didn’t read the article critically enough. It says ‘may have re-activated up to four times after INITIALLY being switched off.’

It was poorly written to begin with or written to elicit reaction from people who don’t read well.

[gums]

Salute!

Looking more and more like Big B needs to bite the bullet and do something with the engine mounting design and possibly the stabilizer/elevator configuration. Screw MCAS. Fix the aero problem for certification and general good handling characteristics.

It can be done, and was long ago by Lockheed, but......

Back when the earth was still cooling, Lockheed had to modify all of the Electra airliners due to harmonic vibrations and such. Hell, the wings were being ripped off! The public relations war was lost, however, and even though the fix cured the problem, had great results and the legendary P-3 Orion resulted. the damage had been done and folks wouldnt fly the thing.

I can't unnerstan why slots or slats on the nacelles wouldn't help with the pitch moments. Maybe small cannards. Reshape the nacelles?. And so forth. With many features of the old design already certified, doesn't seem to me that re-certifying without the MCAS kludge would not be as expensive as a complete new design, although the billions about to be paid for the lawsuits could influence that proposal.
_____________________________________
I tried to imagine the roller coaster procedure posted here to regain useable trim and had to laugh. Imagine the pax barfing and screaming, plus flight attendants bouncing off the overhead bins and more. And just when it seems to the SLF in seat 23A that things are under control, whooo hooo one more time!!

Gums sends...

[patplan]

How is this possible? MCAS is still operational with the trim system disabled????
If this is true Boeing not only designed the MCAS system and installed it without telling the pilots, but they also failed to tell pilots it can’t be switched off, even after Lion Air crashed?
They made a procedure to deal with a runaway MCAS that is completely worthless and will not take care of the problem?
Hence, this might be the reason for the delay in releasing the preliminary report.

Apparently, according to WSJ, there were disagreements between investigators about how to interpret the FDR [& CVR] data.

...Safety experts have also tussled over the interpretation of certain data and their presentation in the report, according to people from both countries...

The major news is that MCAS was turning back on after being shutoff as per NNC for Runaway Trim. The question becomes why was it back on? There are two conflicting news coming out. The first version suggested that the crew had turned the stab trim motor back on because they'd had some difficulty to trim the AC manually, essentially going against the NNC procedure. And, the other version of the news reported that the MCAS system was turning back on by itself, suggesting there was yet another unknown/undocumented power mechanism in the Max-8 coming into play.

We can safely guess now that the disagreement between investigators mainly must have been about what/who turned the MCAS back on.

Personally, I think it is doubtful that MCAS really have another route to power up its trim. Unless, it had metamorphosed itself into a franken-system, unbeknownst to us all.

[SMT Member]

Or, were the column forces in pitch so great with the stab trim switches off that the crew turned them back on momentarily to retrim, not realizing that they could trim manually with the trim wheels?

Airbubba, see the video posted on Leeham news. They're simulating a high-speed runaway stabiliser after an unreliable airspeed event. The cut-off switches are thrown at roughly 3 degree ANU and 310 knots, and it is almost impossible to get the aircraft back in trim using manual trimming whilst the PF is holding almost full-aft stick. And this was at 3 degrees ANU, the ET crew was facing a stabiliser trimmed much further nose down. In short, it's physically impossible to get the aircraft back in trim manually without unloading the stabiliser, which require a lot of airspace between you and terra firma.

[PEI_3721]

Yo gums,
Boeing certainly have their hands full with the Max, but if the high stick-force trim loads are a dominant factor, then any solution, MCAS or not, might also have to consider other variants of 737.

I surmise that an inability to trim the Max with excessive trim loads (MCAS induced), will be compared to previous variant certifications which had to consider high trim loads because of Trim Runaway (also still applicable in the Max), which necessitated the previous roller coaster manoeuvre. If it is concluded that the practicality of this procedure is unreasonable for pilots fly in order to recover from ‘any’ extreme trim failure then the trim system may have to be rethought - e.g stop-down the range of trim movement, if able in comparison with the required certification range of trim.

Fixing MACS / AoA should address the deficient stability margin, but this most probably will not overcome the high stick-forces with offset trim - basic aircraft issue.

[GordonR_Cape]

The Mentour Pilot video has been disabled. This often happens for technical or copyright legal reasons, and may be re-posted. His recent videos cover MCAS in outline, and runaway stabiliser trim in an actual simulator, showing how hard manual control is, but not commenting in detail.

Edit: Mentour pilot's previous videos have been actual training on a simulator. Doing freelance accident investigation (during company paid for simulator time) was probably pushing the limits too far.

The article by Bjorm Fehrm describes the situation clearly: https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/#more-29790

My point (not mentioned in the article) was that the checklists and emergency AD fail to mention disengage auto-throttle. IMO this step leads to excessive airspeed after takeoff, turning a hazardous situation into an unrecoverable one.

P.S. I have been away from my desk for a few hours, so responding to earlier posts won't add anything to the thread clarity.

[TachyonID]

Also see the video (via SteinerN)...
Whilst it appears easier to set nose down trim, it is less so to recover back to a trimmed condition. The nose down direction might be aided by the aerodynamic forces, whilst nose up the trim wheel has to overcome them.
Also, MCAS could run the trim nose down after flap retraction - lower stab trim loads, but if speed increases due to descending flight, then back trim at a higher speed is less achievable, having to overcome much higher stab trim loads.

This is a dynamic, escalating situation. And for those following the ‘40secs time to react’ theme, consider that recognition might take two MCAS cycles 10sec trim, 5 sec pause / back trim, 15 x 2 = 30 sec, only leaves 10secs for action - select trim inhibit, then apply back trim wheel. See the video, move seat back, pull the handle out, then wind - how much, how long, if able.



'
Now, it's worrisome to note that Mentour Pilot's very-illuminating videos on Youtube are being suppressed. Without being too paranoid, it would appear Boeing's PR department is now working overtime to "damage control" the revelation that the ET pilots HAD followed procedure.

It's inconceivable that, having followed the Procedure to disable TRIM, that the pilots would have re-enabled TRIM unless they found the trim wheels insufficient to overcome the nose-down attitude MCAS-HAL gave them. It's a large number of revolutions to make much impact, especially with the all the back pressure PF and PNF were likely applying via the column, and with only limited time to recover the pilots may have wished to re-enable electric trims in order to expedite matters. Perhaps the first thing MCAS-HAL does, since he'd be out of the loop on the physical disconnection of the electrical circuit, might actually be to "catch up" with a full Down Cycle when the motors are turned back on? No matter how you view it, this appears like Boeing didn't "think the realities of the situation through thoroughly".

[SteinarN]

The Mentour Pilot video has been disabled.

It was deleted because MentourPilots employer objected I have learned.

[ferry pilot]

737qanda that's a great idea.

Ferry pilot, I think producing pilots capable of hand flying with confidence is an essential skill - it can be achieved without much cost but just requires a change of culture. Some airlines already do this just by encouraging turning off the automation (when appropriate, ie good weather, low traffic levels).

I remember a skipper I flew with when I almost overcooked a hand flown approach say: what would the passengers rather have, a perfectly flown approach by the autopilot everytime or a pilot who can confidently fly if the situation requires it, even if we'd had to throw that approach away?
​​​​
There are a great many out there who think exactly as you do, and I am one of them in spite of my argument. Hand flying is an essential skill. But it is a dying one. The tide, my fellow artful flyers, has turned against us. Were it any other way, we would not be having this discussion. Like your car that spends ninety five percent of its useful life parked on the ground, airliners may as well be spending theirs parked in the sky when it comes to improving your driving skills. The truth is, you get those skills the hard way, before you arrive in the big leagues. The only way in not all that long ago.

[CodyBlade]

It was deleted because MentourPilots employer objected I have learned.

Surely this was expected.

[hans brinker]

Salute!

Looking more and more like Big B needs to bite the bullet and do something with the engine mounting design and possibly the stabilizer/elevator configuration. Screw MCAS. Fix the aero problem for certification and general good handling characteristics.

It can be done, and was long ago by Lockheed, but......

Back when the earth was still cooling, Lockheed had to modify all of the Electra airliners due to harmonic vibrations and such. Hell, the wings were being ripped off! The public relations war was lost, however, and even though the fix cured the problem, had great results and the legendary P-3 Orion resulted. the damage had been done and folks wouldnt fly the thing.

I can't unnerstan why slots or slats on the nacelles wouldn't help with the pitch moments. Maybe small cannards. Reshape the nacelles?. And so forth. With many features of the old design already certified, doesn't seem to me that re-certifying without the MCAS kludge would not be as expensive as a complete new design, although the billions about to be paid for the lawsuits could influence that proposal.
_____________________________________
I tried to imagine the roller coaster procedure posted here to regain useable trim and had to laugh. Imagine the pax barfing and screaming, plus flight attendants bouncing off the overhead bins and more. And just when it seems to the SLF in seat 23A that things are under control, whooo hooo one more time!!

Gums sends...

I would have thought a wing-tip extension, not to increase span, but to extend the chord further aft, between the aileron and the tip could help (just a line pilot, not a designer), as it is a lot further aft than the MAC.
Obviously need to make sure that that part of the wing stalls last as well.

[hans brinker]

Yo gums,
Boeing certainly have their hands full with the Max, but if the high stick-force trim loads are a dominant factor, then any solution, MCAS or not, might also have to consider other variants of 737.

I surmise that an inability to trim the Max with excessive trim loads (MCAS induced), will be compared to previous variant certifications which had to consider high trim loads because of Trim Runaway (also still applicable in the Max), which necessitated the previous roller coaster manoeuvre. If it is concluded that the practicality of this procedure is unreasonable for pilots fly in order to recover from ‘any’ extreme trim failure then the trim system may have to be rethought - e.g stop-down the range of trim movement, if able in comparison with the required certification range of trim.

Fixing MACS / AoA should address the deficient stability margin, but this most probably will not overcome the high stick-forces with offset trim - basic aircraft issue.



Very good point IMHO.

[RatherBeFlying]

It appears that MCAS can in ten seconds move the stab whenever it's in the mood, but the pilots need considerably longer to bring back the stab with dozens of cranks of manual trim - provided that airload allows them to move the trim.

Very much an unequal contest.

​​​​​​MCAS really shouldn't be putting in more trim than can be corrected by the crew in the interval before it reactivates.

But then, limiting MCAS authority might fail to achieve required stick force increase approaching stall. The software will have to get even fancier to satisfy 10E-9 reliability.

I'm with gums. Dump MCAS and fix the nacelle aerodynamics.

[infrequentflyer789]

The Mentour Pilot video has been disabled. This often happens for technical or copyright legal reasons, and may be re-posted.

Disappeared while I was watching it I think - soon as I finished it I was going to comment and say something like "wow that cleared a lot up", but when it ended, it was just "unavailable".


Edit: Mentour pilot's previous videos have been actual training on a simulator. Doing freelance accident investigation was probably pushing the limits too far.


He has a bunch of other videos on LionAir, MCAS, etc. which don't seem to have been a problem. I've saved copies of the Leeham page and Peter Leeme's latest, for my own records in case the takedown is not originating directly at the employer and spreads wider. The investigation seems to have been leaking eight ways to Sunday, but everyone who had the info (possibly including tdracer on here) has been too scared to go public (there was just one post hinting on here, I recall) until WSJ blew it open. Then everyone felt safe, but maybe that was misplaced...

The video was eye-opening, raised a few more questions as well, still digesting it - made more difficult by only being able to rewind in my memory now.

Whatever, it is clear this is getting worse, Boeing are definitely not going to be able to fix this with a small patch over the hole, buffing it out with PR and a final coat of blame-johnny-foreigner.

[gums]

Salute!

Another solution that keeps the basic construction jigs and such in place for building more dinosaurs was proposed earlier here, but will still require certification, just not as much. Expensive, yes. But not as expensive as all the $$$ that will be paid out to the families and possibly airlines with useless airframes on the ramp.

Ditch all the STS, feel system, MCAS and such crapola. Go FBW and retain a few of those ropes, levers, pulleys, tubes and such that some here still prefer for a modern airliner. You wouldn't have to worry about control force versus AoA or "Q" or mach gradients, just ask the Airbus folks how they got by the FAR 25 requirements. And you knoiw what? I don't think the FBW version of the MAX would pass. The design is not as inherently as "nice" and gentle and forgiving as it should be.

The 'bus showed its inherent stability and pretty good aerodynamic characteristics on at least two crashes - the "showboat" public relations pass and AF447. Without all the "protections" and such, most pilots could fly the thing in the "direct mode" and get it back on the ground in one piece. After all, FBW primarily means replacing all those mechanical connections with a hydraulic source and an actuator commanded by an electrical signal. You do not even need a computer to have what the 'bus calls "direct law".

So I have a feeling this "fix" is gonna take a lot more time and $$$ before many carriers and countries are gonna buy in. I wish Boeing well, but I also wish Boeing would get back to the basics that made them one of the premier aircraft production empires in aviation history.
And just so you know, I never flew a single model of anything Boeing ever built. I flew McDonnell, Cessna, Lockheed, Convair/General Dynamics and Vought.military planes , and on the civilian side Luscombe, Piper, Aeronica and Taylorcraft.

Gums sends...

[ecto1]

I think the procedure should be:

If Trim is bad and you didn't put it there (memory item, but quite intuitive).

1. Bring it back to something reasonable with column switches.
2. Then cut it.

Maybe also including a suggestion to check that you actually are restoring trim in the direction you desire with a quick look at the trim wheel at step one, and go straight to 2 if you are not (different failure than what we are discussing).

If for some reason you need minute adjust afterwards, use the wheel.

Column switch vs mcas, column wins, it's faster and overrides mcas.

But,

Hand crank vs mcas, mcas wins. Hand crank too slow and perhaps underpowered. You may run out of usable sky or energy before you get it back.

I'm also in the group of those who would like to see an aero solution, although for some reason I would expect some lift added in the rear lateral fuselage at high aoa only, rather than modify the nacelles (I can't see in which way) or add a trailing lift device at the tip of the wings (big mess, and heavier due to shorter leverage)

Main advantage over software patch: it will actually help in real life.

[jpfle]

One sensor, 10E-9 reliability, LoL!
(Referring to Post #3024 from RatherBeFlying).

[fgrieu]

Column switch vs mcas, column wins.

I that dead sure? Have an authoritative source?

[CurtainTwitcher]

The problem is the instant you get airborne, you have the stick shaker AND IAS disagree. If you have the mental capacity to realise at this point that you aren't actually stalling (first instinct would be "oh sh!t, are my takeoff performance or flaps figures correct"), AoA probe failure wouldn't be my first thought.

Once you have had time and brainspace to process, "good, I'm actually still flying, no buffet, not stalling my speed & config are probably good", the next thought would be to notice IAS disagree, disconnect the autopilot (not engaged at this point) autothrottle blip blip off, lets climb at my initial performance tool target (if available ~15 +/- degrees). Now we are climbing away with a know thrust, known good pitch attitude, not stalling and that is going to get me toward a safe place (away from the hard stuff).

In all the confusion my buddy would probably be prompting me to turn off the flight directors too. At this point we have done the first part of the IAS disagree memory items, pitch and thrust to come.

This might make this sound somewhat logical, possibly easy, but believe me, that would be a REALLY bad day already and I might be between 400 to 1000' AGL before I can even begin to comprehend what MAY be wrong with my aircraft.

Boeing only gives guidance of 10 degrees nose up pitch and 80% thrust for this scenario. Would you really wanting do that with the stick shaker going off just after takeoff? It's going to climb like a dog and there are hills around and I have the SS going off, so I think I'm going to try to climb away for a while with some known good datums.

So, the problem is in this scenario disconnecting the autothrottle with the blip blip is actually going to leave you with takeoff, not climb thrust, not 80% N1 set. You may not revisit the thrust for some time because I still have the stick shaker. That is possibly a trap in all this. There is so much other stuff going on, that having takeoff thrust set is going to get you into the >230 knot realm real quick once you lower the nose to 10 degrees and forget to set the 80% N1 . Oh did I mention, that, at this point I may have to consider moving the stab trim switches to cutout too before retracting the flaps. Now I have to use the manual pitch trim wheel too as we accelerate.

I am actually now running TWO memory checklist simultaneously, the IAS disagree and Runaway Stabiliser. All because of a single sensor failure. Surely the certification basis for the aircraft is fundamentally flawed on this count alone.

Gums, the reason Boeing don't want to certify a new type is probably not so much the actual cost of the certification, rather the cost of type rating pilots. It was the operators who put the pressure on Boeing. Boeing knew if it was a new type they it would hand operators an opportunity to play the Airbus card against them, if you are going to have to put your pilots through a rating, does it matter if it is Boeing or Airbus?

[jagema]

I that dead sure? Have an authoritative source?
Control column cutout switches do not inhibit MCAS trimming (which makes sense if you think why the system was designed in the first place, but also no sense to a 737 pilot that doesn't expect the trimwheel to move AND when pulling up, pre-MCAS discovery).

[MurphyWasRight]

CT:
It is a shame that the Mentour Pilot video has been disabled, I managed to watch it and it showed what happens when the IAS disagree and runaway trim checklist are followed in the (presumed) ET MCAS case. Overall fairly similar to your scenario.

The pilots in the sim calmly and methodically followed the checklists in what I would call a demonstrating or teaching mode, certainly not stressed or surprised.
Don't believer they even had a stick shaker going.

Even so they ended up in a state where manual trim inputs were physically close to impossible after electrical trim cutout due to the air speed.
My takeaway was that unless the pilot trimmed close to neutral before electrical tim cutout there was no way to manually trim.
Note that this should be possible (as shown in both lion air flights) since pilot trim cancels (for 5 seconds) MCAS trim actions.

One other observation from the video is that from the jumpseat camera point of view the trim wheel action is very obvious. I suspect it might be much less so for stressed pilots trying to make sense of the situation. This may be why the jumpseat pilot was able to save the penultimate Lion air flight.

Gums: If you are referring my post re making a full FBW 737, that was meant as a thought experiment on automation more than a practical suggestion, if for no other reason that it 737 FBW would certainly require more than a slideware conversion course.

[AVAT]

Given the known the MCAS problem, and Boeing air directive, I would use flaps 1 for as long as possible to prevent MCAS from engaging if pilot sees IAS disagree. Once atleast 2500 agl retract flaps to see if MCAS engages. If yes, extend flaps immediately and return to airport. WSJ reported MCAS engaged in this flight at 450 agl which suggests plane already in clean configuration. Interesting to see what fdr shows for flap settings and retraction.

[GordonR_Cape]

CT:
It is a shame that the Mentour Pilot video has been disabled, I managed to watch it and it showed what happens when the IAS disagree and runaway trim checklist are followed in the (presumed) ET MCAS case. Overall fairly similar to your scenario.

The pilots in the sim calmly and methodically followed the checklists in what I would call a demonstrating or teaching mode, certainly not stressed or surprised. Don't believer they even had a stick shaker going.

Even so they ended up in a state where manual trim inputs were physically close to impossible after electrical trim cutout due to the air speed.
My takeaway was that unless the pilot trimmed close to neutral before electrical tim cutout there was no way to manually trim.
Note that this should be possible (as shown in both lion air flights) since pilot trim cancels (for 5 seconds) MCAS trim actions.

One other observation from the video is that from the jumpseat camera point of view the trim wheel action is very obvious. I suspect it might be much less so for stressed pilots trying to make sense of the situation. This may be why the jumpseat pilot was able to save the penultimate Lion air flight.

Gums: If you are referring my post re making a full FBW 737, that was meant as a thought experiment on automation more than a practical suggestion, if for no other reason that it 737 FBW would certainly require more than a slideware conversion course.

I never got to see Mentour Pilot's latest video, but a previous one from 2 weeks ago on runaway stabiliser trim is still available. It shows a much 'tamer' scenario, with speed < 250kts, and positive pitch, but indicates that manual trim can be difficult. Worth watching a minute of footage (start at 18m35s), for those who can't visualise what actually happens in such a scenario: https://www.youtube.com/watch?v=xixM_cwSLcQ&t=1115

[lomapaseo]

It appears that MCAS can in ten seconds move the stab whenever it's in the mood, but the pilots need considerably longer to bring back the stab with dozens of cranks of manual trim - provided that airload allows them to move the trim.


...... The software will have to get even fancier to satisfy 10E-9 reliability.

.

There is no such requirement applicable, besides you probably wouldn't believe it anyhow.

It's really a balance between the pilot and the design. If the pilot can't be relied on, then the design is not good enough

[fgrieu]

Control column cutout switches do not inhibit MCAS trimming (which makes sense if you think why the system was designed in the first place, but also no sense to a 737 pilot that doesn't expect the trimwheel to move AND when pulling up, pre-MCAS discovery).

The control column trim switches are not the "cutout" switches. I'm inclined to believe [Late edit: it turns out, wrongly] that central cutout switches have authority over MCAS, but control column trim switches do not, contrary to Column switch vs mcas, column wins.

But again, do we have an authoritative answer, based on some circuit diagram, manual, first-hand knowledge?

[Airbubba]

An update from ABC News:

Sensor damaged by a foreign object on Ethiopian Airlines 737 MAX triggered fatal crash: Sources

The preliminary crash findings are expected to be released on Thursday.By David Kerley (https://abcnews.go.com/author/david_kerley) and Jeffrey Cook (https://abcnews.go.com/author/jeffrey_cook) Apr 3, 2019 5:04 PM

The Ethiopian Airlines Boeing 737 MAX, which crashed in March (https://abcnews.go.com/Politics/anti-stall-system-activated-ethiopian-airlines-boeing-737/story?id=62035244) and killed 157 people, suffered a damaged angle-of-attack sensor upon takeoff from a bird or foreign object, triggering erroneous data and the activation an anti-stall system (https://abcnews.go.com/US/clear-similarities-ethiopian-lion-air-crashes-ethiopias-transport/story?id=61754299) -- called MCAS -- sending the pitch of the plane downward and ultimately crashing into the ground, two aviation sources familiar with the investigation told ABC News.

As the jet was nose diving (https://abcnews.go.com/Politics/boeing-reveals-proposed-updates-737-max-amid-scrutiny/story?id=61979434), the Boeing 737 MAX pilots did not try to electronically pull the nose of the plane up before following Boeing's emergency procedures of disengaging power to the horizontal stabilizer on the rear of the aircraft, according to the sources.

One source told ABC News that they manually attempted to bring the nose of the plane back up by using the trim wheel. Soon after, the pilots restored power to the horizontal stabilizer.

With power restored, the MCAS was re-engaged, the sources said, and the pilots were unable to regain control and the plane crashed.

The preliminary findings (https://abcnews.go.com/Politics/anti-stall-system-activated-ethiopian-airlines-boeing-737/story?id=62035244) in the crash investigation are expected to be released (https://abcnews.go.com/US/clear-similarities-ethiopian-lion-air-crashes-ethiopias-transport/story?id=61754299) by transportation (https://abcnews.go.com/alerts/tsa) officials in Ethiopia on Thursday morning.

[horizon flyer]

I believe the basic problem is lift from the engine cowlings at high AoA in a turn with flaps up this I think pulls the CL in front of the C of G so the nose keeps pitching up.

I seem to remember Learjet had a problem with a T tail model that at high angel of attack could blank the tail so entering a deep stall, so required a stick shaker.

So to over come the problem they fitted under the rear fuselage what they called Delta Fins these at high AoA produced lift and pushed the nose down so no stick shaker or any other aid required. May be the fix the Max needs. Just a thought.

[ecto1]

The control column trim switches are not the "cutout" switches. I'm inclined to believe that central cutout switches have authority over MCAS, but control column trim switches do not, contrary to

But again, do we have an authoritative answer, based on some circuit diagram, manual, first-hand knowledge?

Yes, we do. We are talking 3 sets of switches in series here: 1) thumb (normally open), 2) control column "extreme deflection" (normally closed) and 3)pedestal cutouts (normally closed).

What I meant is that if you electrically trim nose up with your thumb, MCAS stops trimming nose down right then, so you win. Plus, there is a 5 second delay between you releasing your thumb and MCAS trying to nosedive again. That's your timeframe to kill it with pedestal cutout switches.

I don't know where I learnt it first, but that fact is "authoritatively" shown on FDR from both lionair flights, to begin with. Also, reductio ad adsurdum: Otherwise no way the scenario is survivable for any amount of time with cutout switches to "normal". 60 seconds after first MCAS activation you are diving vertical, regardless of elevator position.

In fact, if you could hear it trim, (you cant because stick shaker) it would be quite trivial to discover that, as soon as you trim with your thumb switch, it stops. I'd bet the accidents would have not happened.

The only ongoing debate now* is (and as far as I know, there is no consensus yet but there will be soon) if you were slow with your thumb and got to a point in which you need a lot of pull to remain level, your control column "extreme deflection" trim cutout switches may inhibit your trim inputs and then (possibly) MCAS wins by lack of opposition. (because at that moment you will not recall yet another system working silently against you and release control column to regain the ability to trim).

Which, if comfirmed, is a frightening situation, because it only takes one panicking pilot pulling too hard to prevent both from trimming up and wining the fight against MCAS. Thats a good theory to explain what happened in the last seconds of the first crash.

*Edit: I'm quite convinced after examining again the schematics, that MCAS vs thumb trim switch battle is not affected by control column deflection switches.

[ecto1]

I believe the basic problem is lift from the engine cowlings at high AoA in a turn with flaps up this I think pulls the CL in front of the C of G so the nose keeps pitching up.

I seem to remember Learjet had a problem with a T tail model that at high angel of attack could blank the tail so entering a deep stall, so required a stick shaker.

So to over come the problem they fitted under the rear fuselage what they called Delta Fins these at high AoA produced lift and pushed the nose down so no stick shaker or any other aid required. May be the fix the Max needs. Just a thought.

Yes, that is also my impression.

[jagema]

I'm inclined to believe that central cutout switches have authority over MCAS, but control column trim switches do not

This is correct except that it's the control column cutout switches that do not have authority.

The only ongoing debate now is (and as far as I know, there is no consensus yet but there will be soon) if you were slow with your thumb and got to a point in which you need a lot of pull to remain level, your control column "extreme deflection" trim cutout switches may inhibit your trim inputs and then (possibly) MCAS wins by lack of opposition.

There is a forward and an aft control column cutout switch. Enough movement of the control column in either direction opens the circuit, creating a discontinuity and disallowing trim in the direction of column deflection (ie. You cannot trim up while pushing down) unless STAB TRIM OVRD switch is in OVRD. I guess you refer to the cutout switches installed in the column when speaking of "extreme deflection trim cutout switches". Schematic for clarity.
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1600x1093/screen_shot_2018_11_14_at_10_15_04_am_c76720caa660a1b60796f7 7199cc3c939e8cd6ab.png
B737 Trim

edit: this is the schematic for the NG. The MAX introduced changed to the pedestal cutout switches, renamed PRI and B/U respectively.

[fdr]

I am aware of the procedure but was never taught it on type training on the 737 conducted under FAA.

Simply, there is no manner by which such a heroic technique complied with the Type Certification requirements under Part 25. The rules do not permit the application of exceptional force, technique or skill, and any need to have 2 pilots apply force at the same time is grossly unacceptable, breaching the FAA’s own prohibition on control inputs by more than one pilot.

As the aircraft often flies with a seat unoccupied when nature calls, it would be incompatible to have a flight condition where both pilots must be able to have inputs onto controls at all times in flight.

The 737 is grandfathered to revisions of the rules in the 60’s but the basic rationales have not changed that much.

If the the plane has any condition that may necessitate rock n’ roll as a recovery, using both pilots, then I would imagine that it needs a type review and rectification of the underlying design deficiency.

How on on earth would it be acceptable to have a passenger transport with a known need for exceptional training outside of the training for CPL or ATPL/ATP, requiring both pilots simultaneous inputs on the flight controls, necessitating a ballistic flight path, where the pax are not required to be restrained at ALL times, I.e., whenever the flaps are retracted....

it it is not acceptable under the rules, and the plane has been known to have this characteristic for how long?

I’ve flown flown the 737 out way beyond VMO MMO Under controlled conditions, and while careful about tuck considerations, was not aware of a “jack stall” potential on the aircraft. That is troubling.

25.143 provides the general handling qualities requirements, including statements on skill, limit of force on elevator to 70 lbs short term, 2?hands, and 10 lbs long term.

25.255 covers mid trimmed cases, and potentially lets the OEM off the hook, but places the regulations in question. Recovery with a force of 120 lbs should be shown for a maximum runaway trim of 3 seconds of trim motion for the conditions of flight. MCAS action exceeds the 3 seconds, but the OEM is only required to show acceptable characteristics with 3 seconds of trim motion from in trim conditions, which is clearly inadequate to protect the aircraft operation.

[GlobalNav]

It appears that MCAS can in ten seconds move the stab whenever it's in the mood, but the pilots need considerably longer to bring back the stab with dozens of cranks of manual trim - provided that airload allows them to move the trim.

Very much an unequal contest.

​​​​​​MCAS really shouldn't be putting in more trim than can be corrected by the crew in the interval before it reactivates.

But then, limiting MCAS authority might fail to achieve required stick force increase approaching stall. The software will have to get even fancier to satisfy 10E-9 reliability.

I'm with gums. Dump MCAS and fix the nacelle aerodynamics.

That's Design Assurance Level A. Does anyone here know what the DAL for this software actually is? As a previous poster said, it's no easy fix to make it so, if it's not DAL A.

[Albino]

This is correct

No it isn't. AFAIK

MCAS will operate regardless of the control column cutout switches.
It will not operate against the control column TRIM switches, or if the stab trim switches are cutout.

[jagema]

No it isn't. AFAIK

MCAS will operate regardless of the control column cutout switches.
It will not operate against the control column TRIM switches, or if the stab trim switches are cutout.
Precisely what I meant by "correct." We are saying the same thing. MCAS obeys all switches except for the aft and fwd motion of the column, essentially.

Edit: I thought I read control column cutout in my quoted post above. Corrected

[ecto1]

No it isn't. AFAIK

MCAS will operate regardless of the control column cutout switches.
It will not operate against the control column TRIM switches, or if the stab trim switches are cutout.

This is my understanding also, based on the schematic posted before:

https://www.pprune.org/tech-log/615709-737max-stab-trim-architecture-9.html#post10433110

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/1278x850/b737_max_columnswitchingmodule_2cf8055695fc24da4521cb26ab661 afac41f93a3.jpg
When MCAS is engaged, control column "extreme deflection" towards pull will NOT disable MCAS trim down, but it will NOT disable your thumb switch trim up either, so you still win.

In other words, this battle will not be affected by too much pull.