Ethiopian airliner down in Africa

[Majorbyte]

Not that simple. As stated already hundreds of times, MCAS is required because of aerodynamic differences with the older model (bigger nacelle, further forward), making the required pull to increase AOA at high AOA too light (best way I can phrase it). You could blame Boeing for not designing a new aircraft, but based on all their other new designs i am sure it would have more, not less envelope protection.

MCAS is required for what? to malfunction and drive the aircraft into the ground! you dont need it. period.

[Capn Bloggs]

Call out "AIRPSEED UNRELIABLE MEMORY ITEMS".
At the risk of thread drift, what is the point of calling out "AIRPSEED UNRELIABLE MEMORY ITEMS".
You're the PF. You just do it/them. Or do you need your PM to call the attitude and thrust out for you?

I must admit you lost me when you said they (the ET pilots) were a "complete diversion from ...JEP PROCEDUES". Seriously?

[armchairpilot94116]

https://www.youtube.com/watch?v=96m6bNjkAFc&feature=share

Not fun being grilled by senators

the FAA is going to have to re-examine the Max

[Derfred]

Before the MCAS input the PF trims up twice with the thumb switch for appr. 3 s each. This results in appr 1 U uptrim stab movement, twice.
At 5:40:15 after the first MCAS ND he trims again up for appr. 3 s. The stab movement is barely visible now on the chart. Then, unusual:
At 05:40:27, the Captain advised the First-Officer to trim up with him.
Why? Is his switch not working correctly?
The trim up (together or) by the FO is the only long one in the entire FDR recording. It shows again a stab movement at appr 1 U / 3 s. It is followed by STAB TRIM CUTOUT.
Is it possible that the PF had a broken trimswitch?

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/403x522/et302_zoom_12a1b16bf287a639d10f7d3706a38bc53023f128.jpg

The earlier trim durations you refer to happened with flaps extended. The trim wheel moves faster with flaps extended. That explains the difference.

[locblue]

Because MCAS is not a powered device! It is software!

Well then, how about TAC (Thrust Asymmetry Compensation) on the 777? There’s a switch to isolate it...

[SherwoodA]

Nope don't work for Boeing but flew the 38M.
Prove me wrong.

If a stall warning triggers at a low altitude, the flight crew should consider that there is an immediate flight path threat, and a potential risk of ground contact. In other words, there is no time to differentiate between a real or spurious stall warning, and there is no altitude to convert to speed. However, when a stall warning triggers (i.e. stick shaker activation), aircraft still have positive climb performance capability. Note:An “approach to stall” is a controlled flight maneuver. An aircraft that is stalled is out of control, but is recoverable. Do not confuse an “approach to stall” with “a full stall”. When ground clearance is not an issue, the recommended technique is to recover from the near-stall condition in the minimum amount of time, by applying power and nose down input. When ground clearance is an issue, the recommended technique is to lose as little altitude as possible, by applying fullpower and by flying an optimum pitch attitude.

Are you saying the crew ought to have prioritized identifying the stick shaker as spurious, in your opinion?

[Crosswind Limits]

Nope don't work for Boeing but flew the 38M.
Prove me wrong.

I’m guessing you’re a troll!

I don’t have the expertise to comment on the 737 let alone MCAS, but I found your comments arrogant and insensitive in the extreme!

To you a “stick shaker” after take off is no problem and you comment about the crew’s actions amounting to a fail in the sim! WTH!!! This was real life with no doubt the crew doing their best under extreme duress. They didn’t turn up to work that fateful day to do anything other than return home that night - like we all do!

[Richard C]

Gear Up.
Stick Shaker, no problem as the aircraft is in trim, flaps, etc. are all just fine. A-Thl is still in HOLD.
Aviate and navigate.
Call out "AIRPSEED UNRELIABLE MEMORY ITEMS".
Do the MI's which takes 10-15 sec if you are fast or 159 sec if slow and forget them which is usual here.
10 Deg Pitch 80% N1 and simply fly runway heading climbing slowly with slow increasing IAS.
CP calls for the NNC 10.1 and skip Step 7 for now if you wish as that will take too long to open the page. Just keep the pitch and power set above. No terrain, CB's, windshear, TCAS risk, etc.
PM makes the PAN call, reaches and opens the NNC QRH.
Step 9 leads to 10.
Step 10, leads to Step 11 & the FO has Control.
Step 12 would have not worked or maybe just for a while. When the AP drops, manual flying on a beautiful sunny morning. Easy as VMC, two AC power sources, lots of fuel, flaps and slats and gear that will extend normally and crew well rested.
Step 13 switch from Alt 1 to 2.
Step 14 would have taken painfully long as CP's and FO's usually fumble their way thru there. Eventually open NNC page PI-QRH.10.1 & 10.2 and you are finished in maybe 150 to 300 secs.
All the while with F5 and you want to burn fuel anyways.
After Take Off Checklist.
Now all under control, adivse ATC, swing north or south, prepare for an over weight landing, PA to the Seatbelted Cabin Crew and Pax. Even a visual return is no issue as they all grew up flying locally around Addis but FMC still available for the RNAV 07R.
F40, AB3, Max Reverse and expect maybe a brake cooling issue. That is also hard for many to figure out here the Brake Cooling and since over Max Landing Weight you'd need the QRH again for the landing distance,
NNC finished and you will be on the ground in 10 - 20 mins safe after pressing TOGA.
Just like the sim, but the sim sessions at ET are dramatically different and produce this outcome, plus the commercial pressure GET TO NBO ITIS reared its head for sure.
Notes:
They would have kept F5, MCAS remains dormant and you live for another day.
So it comes down to following the standard published Boeing procedures.
That will be exactly how Boeing's massive legal team will argue it for the next many years of litigation.
BUT NO IT WAS A COMPLETE DIVERSION FROM THE SOP, FOM, FCTM, AND QRH and JEP EMERGENCY PROCEDURES.

So in doing what they did, you enter the realm of being a Test Pilot.
In the sim, would have been a Fail for the actual actions taken on March 5th.

Learn from it my Pilot Friends.

Yes - it's clear that if you get a shaker that you determine to be spurious, by retracting the flaps you allow MCAS to start and thus seriously compound your problems.

However, one thing's not making sense to me - after the electric trim was defeated and they were then unable to retrim manually, they re-enabled the trim motors but after that there were only a couple of short blips of electric trim. You'd have thought that in a plane which is only being prevented from nose diving by a lot of back pressure on the controls, the crew would run nose-up trim continuously until the load came off the controls, not blip it. Is it possible that the electric trim was also unable to retrim the stab with a lot of control load?

[Derfred]

Here's an explanation of the EASA position on the observation that the yoke trim switches on the MAX don't work throughout the entire speed envelope (with some highlighted text):



From: https://www.easa.europa.eu/sites/default/files/dfu/IM.A.120%20Boeing737%20TCDS%20APPENDIX%20ISS%2010.pdf

The EASA document is being mis-interpreted by many.

It notes that once you get to a certain point of AND trim (somewhere between 3 and 4 units from memory, varying by model), you cannot trim further AND with the yoke switches (flaps up). If you ever needed to, for an unusual reason (eg jammed flight controls), you would need to use manual trim. In normal ops, you would never need to.

This point is irrelevant to this discussion because it doesn’t prevent the yoke switches from trimming ANU, even if the aircraft has been trimmed full AND. It is a one directional limit switch only. It doesn’t prevent trim in the other direction.

Note: I’m referring to the limit switch in the forward trim range above. There is another limit switch aft which works similarly in reverse.

EASA have made it confusing by referring to it as trim “authority”, which could be interpreted as “the motor is not powerful enough”.

Ironically, the limit switch was implemented to help prevent either runaway trim or pilot yoke switch trim into the “danger zone” which might result in an unrecoverable dive. EASA, in recognition of this “safety improvement”, approved the implementation on the basis that it improved safety rather than reducing it.

But Boeing’s MCAS implementation has actually allowed MCAS to trim past this limit switch, which was very unwise and has turned out to have had tragic consequences.

I hope this clears it up.

[bill fly]

so you're blaming both sets of pilots? do you work for Boeing by any chance?

That post from Under Duress is unfortunately typical of what can get postulated after an accident / incident and reminds me of the criticism directed at Sullenberger and crew because it was demonstrated that a pre briefed crew, after some practice attempts could react within seconds and land the aircraft on a runway (see the documentary “Sully”). This without any time for recognition, analysis or decision. They were trained dogs performing in the sim and just about hacking it.
We should remember that lots of folk look in here - you can be sure that Boeing does too - engineers and legal team.
Any sensible suggestions will at least be taken on board - any condemnation of crew actions seen as vindication of their insistence on the suitability of the stab runaway drill for a different and complex failure.

[threemiles]

The EASA document is being mis-interpreted by many.

It notes that once you get to a certain point of AND trim (somewhere between 3 and 4 units from memory, varying by model), you cannot trim further AND with the yoke switches (flaps up). If you ever needed to, for an unusual reason (eg jammed flight controls), you would need to use manual trim. In normal ops, you would never need to.

This point is irrelevant to this discussion because it doesn’t prevent the yoke switches from trimming ANU, even if the aircraft has been trimmed full AND. It is a one directional limit switch only. It doesn’t prevent trim in the other direction.

Note: I’m referring to the limit switch in the forward trim range above. There is another limit switch aft which works similarly in reverse.




I hope this clears it up.

No. I take an aviation document as literal and binding. What you say may be from some private working papers, which is not an official numbered published document. So can be anything, including fake.

[GordonR_Cape]

Why does Boeing not delete MCAS from their new B73 8/9s?. They have thousands flying around successfully without it.

Your comment (and my response) probably deserve to be deleted, but here goes:
- Thousands of fighter jets fly every week without the election seats being used. Why not delete them, and save all that weight and complexity?
- The inflight entertainment system poses a hazard due to the risk of fire in the cabin. Why not delete it, and save all that weight and complexity?

My points are intentional hyperbole, but highlight the fact that nothing is ever added to an aircraft unless there is a purpose for it, and nothing is ever deleted from an aircraft if there is a safety aspect involved.

Passenger aircraft still carry liferafts for over water flights, its a requirement, no matter how archaic. End of rant.

[GordonR_Cape]

That post from Under Duress is unfortunately typical of what can get postulated after an accident / incident and reminds me of the criticism directed at Sullenberger and crew because it was demonstrated that a pre briefed crew, after some practice attempts could react within seconds and land the aircraft on a runway (see the documentary “Sully”). This without any time for recognition, analysis or decision. They were trained dogs performing in the sim and just about hacking it.
We should remember that lots of folk look in here - you can be sure that Boeing does too - engineers and legal team.
Any sensible suggestions will at least be taken on board - any condemnation of crew actions seen as vindication of their insistence on the suitability of the stab runaway drill for a different and complex failure.

Valid points, but I just read an equally convincing argument stating exactly the opposite. It was posted in a thread which is somehow in the Tech Log forum, but IMO worth cross posting (with due acknowledgement).
Originally Posted by Water pilot
I doubt there is going to be much in the way of legal arguments on this one, Boeing does not want to be anywhere near a jury. You can talk about the pilot's actions all that you want to, but ultimately you have two aircraft that were pointed to the ground at low altitude by a flight control system that was not disclosed to the pilots and that was (according to media reports) significantly different than the certification documentation described. Add in the cosy relationship with the FAA along with the whistleblower report and this is not something that goes to trial if Boeing has any competent lawyers left.

I am not a lawyer, but I don't think you ever want to be in a civil trial where the jury is wondering why the executives are not in jail yet.

[spornrad]

The earlier trim durations you refer to happened with flaps extended. The trim wheel moves faster with flaps extended. That explains the difference.




Nope. Look at the FO trim up input (long one) that stops MCAS. First 3 s of that input moves the stab appr. 1 U up. Even at the lousy resolution of the plot you can see the difference. I copy/pasted all 4 events together:

https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/111x126/et302_zoom2_6dcbf03e3eb4ec546da53dd5df67946211d6359c.jpg
Or, for more precision: The FO input lasts 10 s and brings the stab up appr. 2.3 U 1.9 U. That is appr. 0.7 0.6 U / 3 s. The third blue arrow from the left does not show that much movement. Flaps up applies to both rightmost events.
And, again, as you raised: Why does PF ask FO to help with the trim (switch)? [Edited because Derfred gave more correct numbers in a later post]

[Derfred]

A simple question from an engineer, why a designer should put a pilot in such situation, why the designer cannot prevent and design a solid system?

They can design a solid system, although never perfect. In this case, sadly, they failed to design a solid system. That is not in question. Even Boeing have effectively admitted this.

The question now is, “how and why did this happen?”, especially in such a tightly regulated, conservative and safety-conscious industry, with one of the world’s most respected organisations. The answer to that is now under extensive inquiry.

We may or may not ever discover the truth, but typically when this many people die unnecessarily, the difficult questions finally get asked, and those with the answers are forced to actually answer.

Of course, it will fundamentally point to one thing: MONEY.

But we aren’t going to get rid of money, so it’s the movement of money, to whom and how much, and how much those in charge of money get to influence those in charge of solid design, that will come into question.


[And why if he is not able to do so the blame is on the operator? A wrong design is a wrong design, no matter how much you train the operators

Well, if by operator, you mean the airline, well they are in charge of employing sufficiently skilled pilots and providing them sufficient training to get their passengers from A to B safely. The airline is also in charge of purchasing sufficiently safe equipment to do so, and maintain it to a sufficient standard.

If they fail to do this, they must accept some liability for the failure. Whether they failed to do this is not yet ascertained - some think the pilots should have saved the passengers from the design fault, some think that’s an unreasonable ask, and some think it was impossible.


If, on the other hand, by “operator” you mean the particular pilots involved, well, in my opinion, pilots have a personal obligation to maintain a standard on top of that required by their employer and their regulator. They can also be held personally liable for the failure, and depending on the global jurisdiction may be supported and/or indemnified by their employer, or, not.

Aviation safety is a rich tapestry, that normally results in a high level of safety, but many argue that it is gradually being eroded in standards of design, training, and skills, generally by one thing: MONEY.

Think about that next time you buy the cheapest ticket available, because that MONEY only comes from one place: you. The less you pay, the less MONEY available to pay someone to design a solid system, or to pay or train the pilot to save you from the less-than-solid system.

[AerocatS2A]

Has anyone tried trimming with the stick shaker going? Honest question. Is it difficult or no problem?

[Derfred]

Has anyone tried trimming with the stick shaker going? Honest question. Is it difficult or no problem?

In the Sim, yes.

We have done exercises pulling the aircraft into deep stall from initial stick shaker, while trimming back continuously (otherwise it’s hard to get deep stall due to increased elevator feel force - B737NG not MAX). Then having to be trimming forward again during recovery. I’ve never noticed a difficulty with this.

But not saying for one moment that the Captain in this event was not having a problem (I was the one who raised the possibility!). My stick shaker was happening at stall speed (150-ish kt), not 325 kt, and it was a Sim.

[spornrad]

But not saying for one moment that the Captain in this event was not having a problem (I was the one who raised the possibility!).

Thanks for your explanations. Since it would be another lottery win the thumb switch going south at that exact instance (besides why less, not no stab movement): Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?

[George Glass]

Bill Fly,
Under Duress gave a pretty accurate description of what SHOULD have happened. Airline Pilots ARE “trained dogs” in certain circumstances. Few emergencies require immediate and appropriate action but stick-shaker on rotation and/or Unreliable Airspeed are definitely two of them. The metaphorical Swiss cheese started lining up from rotation and errors compounded from that point. It was badly mis-handled. Was MCAS the ultimate contributing factor? Absolutely. Was it the sole cause? Absolutely not. Most professional Pilots reading this thread with experience on the B737 would expect to do much better. By following published procedures. And exercising good Airmanship. Maybe that sounds like arrogance but that’s the nature of the beast.
Boeing and the families of victims are in a world of pain right now and comments should be worded accordingly.
But there is much more to this than MCAS.

[Derfred]

No. I take an aviation document as literal and binding. What you say may be from some private working papers, which is not an official numbered published document. So can be anything, including fake.

???

I’m explaining how the 737 stab trim works, from the manuals. Not some ‘private working papers”. I know it works that way because I’ve been flying the thing most of my life.

I even know it works that way because I’ve used it that way on the ground. Actual aircraft, not Sim. You can use yoke trim to just forward of 4 units, then it stops. You can wind it forward to 0 units manually, then you can use yoke trim to electrically wind it back. That’s how it was designed, and that’s how it performs.

EASA brought it up because it was at odds with some certification criteria, and then allowed it because it made sense from a safety perspective.

Now whether it works at 365 knots with sufficient aft control column for level flight is an entirely different question. That question is currently under congecture. My point is that the EASA document is irrelevant to that congecture because that was not the subject of the EASA document, and the word “authority” is being mis-interpreted by some here. I doubt it was mis-interpreted by the actual audience it was intended for.

We know it works at 325-330 knots, because it did. It’s on the FDR trace. Yoke trim from 0.4-2.3 units.

I hope that helps.

[Albino]

Bill Fly,
Under Duress gave a pretty accurate description of what SHOULD have happened. Airline Pilots ARE “trained dogs” in certain circumstances. Few emergencies require immediate and appropriate action but stick-shaker on rotation and/or Unreliable Airspeed are definitely two of them. The metaphorical Swiss cheese started lining up from rotation and errors compounded from that point. It was badly mis-handled. Was MCAS the ultimate contributing factor? Absolutely. Was it the sole cause? Absolutely not. Most professional Pilots reading this thread with experience on the B737 would expect to do much better. By following published procedures. And exercising good Airmanship. Maybe that sounds like arrogance but that’s the nature of the beast.
Boeing and the families of victims are in a world of pain right now and comments should be worded accordingly.
But there is much more to this than MCAS.

Spot on, it's is also the view of every colleague I have spoken to.

[FullWings]

That post from Under Duress is unfortunately typical of what can get postulated after an accident / incident and reminds me of the criticism directed at Sullenberger and crew because it was demonstrated that a pre briefed crew, after some practice attempts could react within seconds and land the aircraft on a runway (see the documentary “Sully”). This without any time for recognition, analysis or decision.
Very much in agreement.

The Human Factors are, IMO, the most important/interesting part of these accidents.

To recap: There are many situations which require some sort of action from pilots, be it promptly or after consideration. The more time-critical an event is, the less time/capacity there is to figure out what to do, so responses to predictable events are based more on rules than extended cognition, hence “memory” or “recall” items are used. They need to have a simple, unambiguous trigger, e.g. an engine fails below V1, perform an RTO or GPWS says “PULL UP!”, perform the GPWS pull up manoeuvre.

When the situation is more complex and there is normally time for diagnosis, we have reference checklists which may contain decision trees, often leading to different actions and outcomes, dependent on further data. If no checklist really fits the bill completely, maybe due to multiple failures or unusual circumstances, then you need to use your general aviation understanding, backed up by specific type knowledge and all the resources you have access to in order to formulate and execute a plan of action. This is something you would generally do *after* you had determined there were no published normal or non-normal produces that were applicable, or you had applied the procedures and they had not helped or made the situation worse. Boeing specifically caution against “troubleshooting” unless all other possibilities have been exhausted but they also provide a useful “Situations Beyond the Scope of Non-Normal Checklists” guide in their training manuals.

Now, it is good aviation practice to have some kind of action associated with a single, predictable failure which affects the safe operation of the airframe, be it recall items or a reference checklist, or even just a note for crew awareness. In the case we are discussing, an AoA probe failure (which is singular, predictable and measurable) has caused a cascade of issues and warnings that are difficult to assimilate and don’t immediately point to any particular checklist, except maybe the Airspeed Unreliable one, which doesn’t include deactivating the trim. Remember we are looking at these accidents with hindsight and the warnings that occurred can be triggered by many different events that require different responses - we only know which was the correct path to take because we have most of the data in front of us to peruse at leisure.

There have been quite a few posts highlighting the startle effect plus the saturation of input channels by excess information of questionable usefulness, e.g. stick shaker, GPWS, fault messages, high control loadings, etc. It is quite easy to see how some things were missed, in fact most of the above is taught in basic HF modules but this seems have passed some manufacturers by.

It’s easy to say that you’d have disconnected the trim as soon as you got a stick shake in the climb out because the flaps are correct and power is set. Well done. But supposing that was a *real* stall warning because you put the wrong weights in the FMC so have rotated 20kts early? Not so well done now, eh? This has happened before and will happen again and is just one example of why it is so important NOT to rush to conclusions if you can absolutely help it.

[fdr]

I read it that this must be shown only for speeds between minimum for steady, unstalled flight and VLO/VFE. MCAS operates when flaps are retracted. The rubber word "appropriate" may be the secret.

But... 25.173 is for static longitudinal stability, the item of note is mis trim case which comes under 25.255 and that has a further set of criteria which if anything are inadequate for this case, or the underlying potential to get out of trim that exists on the B737 in general. The MCAS is covered in 25.672 and either will be determined to meet the requirement or be inadequate to show compliance with that. The out of trim case that resulted from the characteristics of MCAS is the major concern IMHO, which raises the matters of unloading the stab etc, which has it's own set of questions. That nexus is going to take lawyers to sort out, and that is not good for the operational outcome. That an aircraft can get out of trim excessively is not purely a Boeing matter, the Max just happens to be the current headline. A few years back it was A320's like the Perpignan event, a departure or two out of Reagan, and before that, it was A310s galore in-dispersed with A300-600's. Some of those ended up in smoking holes, some missed the ground on a number of occasions in the same event. If the conditions can occur that the pilot is at odds with the plane, it deserves more than a passing comment in the FCTM or a note in the FCOM.

[patplan]

The Condensed ET-AVJ flight data from the Preliminary Accident Report
Omitted Parameters: Engine RPM, AOA, AOA Heat, Master Caution.
..
..

https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/1692x852/cond_et_avj_13a1e44f412f266d02d3e72d437913a552facde3.jpg

[Just This Once...]

You must know by now that MCAS didn't (couldn't) start it's tricks until flap was retracted...er...don't you?


Always worth remembering that the MCAS functionality is a new, non-DAL A software routine, programmed into the FCC as an unmonitored open-loop system. Its function has already been drawn into doubt, as has its certification, safety analysis and technical documentation. Again, MCAS is a virtual system only - the FCC is the actual system that has control of the stab.

It is supremely unwise to state definitively as to what the FCC can or cannot do beyond stating that this software routine has full authority of the most powerful flight control installed on the aircraft.

It is also of note that the FCC commanded the stab aircraft nose down 3 times with the flaps still set.

[CodyBlade]

Is it possible that the electric trim was also unable to retrim the stab with a lot of control load?

Good point,why only a few blips at this point?..

[GarageYears]

It is also of note that the FCC commanded the stab aircraft nose down 3 times with the flaps still set.

Why is it of note? This is normal STS action.

- GY

[Just This Once...]

Why is it of note? This is normal STS action.
- GY


The STS functionality is also a software routine programmed into the FCC, it is a virtual system only.

The aviation community (outside of the test community) has become all-too-comfortable in accepting and using simplistic discrete 'system' descriptions for different functions that are actually hosted by a common system running a common code.

I readily accept and acknowledge that a number, or even the majority, of professional pilots will have their 'pedant' caption flashing when they read my words, but these distinctions matter. If and when Boeing produces an acceptable software-only fix for the current issues the only thing that will change will be the software version running in the FCCs.

[Derfred]

It is also of note that the FCC commanded the stab aircraft nose down 3 times with the flaps still set.

No, it isn't of note.

That's autopilot trim.

It is the autopilot keeping the aircraft in trim while it accelerates to the selected bug speed of 238 knots while engaged in LVL CHG mode. What would you have it do... fly out of trim?

(It isn't speed trim - if the pilot was flying manually, then speed trim would have activated, but it would have been nose up instead of nose down.)

If and when Boeing produces an acceptable software-only fix for the current issues the only thing that will change will be the software version running in the FCCs.

And your point is?

The current problem appears to be a poorly designed piece of software known as "MCAS".

The proposed solution is a better designed piece of software to replace it.

If it works, what are you getting agitated about?

[deltafox44]

The AD does in fact say to trim the forces out before using the cutout. https://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdf

As far as I understand english, it does not. It says electric trim CAN be used to neutralise column forces before cutout (nobody would think it cannot, anyway). It says also Manual trim can be used before and after cutout. It never say electric trim MUST be used to neutralise column forces before cutout

[Albino]

As far as I understand english, it does not. It says electric trim CAN be used to neutralise column forces before cutout (nobody would think it cannot, anyway). It says also Manual trim can be used before and after cutout. It never say electric trim MUST be used to neutralise column forces before cutout

Really?!!! You need that clarifying? Unbelievable.

[Just This Once...]

And your point is?

The current problem appears to be a poorly designed piece of software known as "MCAS".

The proposed solution is a better designed piece of software to replace it.


You are mistaken, there is no piece of software (or hardware known) as MCAS.

The software under scrutiny is for the Collins FCC / DFCS P11.1 and above.

If 'better' software is the accepted solution then the FCC / DFCS software will be the only thing revised.

[Derfred]

For the non-pilots:

Boeing Quick Reference Handbook:

While every attempt is made to supply needed non-normal checklists, it is not possible to develop checklists for all conceivable situations.

In some multiple failure situations, the flight crew may need to combine the elements of more than one checklist. In all situations, the captain must assess the situation and use good judgement to determine the safest course of action.

The Flight Crew must be aware that checklists cannot be created for all conceivable situations and are not intended to replace good judgement. In some situations, at the Captain's discretion, deviation from a checklist can be needed.

[Derfred]

You are mistaken, there is no piece of software (or hardware known) as MCAS.

The software under scrutiny is for the Collins FCC / DFCS P11.1 and above.

If 'better' software is the accepted solution then the FCC / DFCS software will be the only thing revised.

And the portion of the software under scrutiny is referred to as MCAS. Yes, I get it, it all gets compiled into a software version and loaded into an FCC. So what? The offending bit is MCAS. The rest is fine.

[Loose rivets]

Derfred #3586

The proposed solution is a better designed piece of software to replace it.
If it works, what are you getting agitated about?

Well, for my money, because it's still a quasi-sentient being that can still access the aircraft's controls.

The very least I would want is full annunciation of every input* . . . and the certain ability to stop it.
*Periodic movement of the Stab Trim wheel could be there anyway, so I would want a specific annunciation.


There's been little talk of MCAS putting settings back to where it found them before an input. I'm sure I read it, but is it true? If so, it seemingly failed to do so.

[DaveReidUK]

As far as I understand english, it does not. It says electric trim CAN be used to neutralise column forces before cutout (nobody would think it cannot, anyway). It says also Manual trim can be used before and after cutout. It never say electric trim MUST be used to neutralise column forces before cutout

There is nothing wrong with your understanding of English.

[edmundronald]

They can design a solid system, although never perfect. In this case, sadly, they failed to design a solid system. That is not in question. Even Boeing have effectively admitted this.

The question now is, “how and why did this happen?”, especially in such a tightly regulated, conservative and safety-conscious industry, with one of the world’s most respected organisations. The answer to that is now under extensive inquiry.

We may or may not ever discover the truth, but typically when this many people die unnecessarily, the difficult questions finally get asked, and those with the answers are forced to actually answer.

Of course, it will fundamentally point to one thing: MONEY.

But we aren’t going to get rid of money, so it’s the movement of money, to whom and how much, and how much those in charge of money get to influence those in charge of solid design, that will come into question.




Well, if by operator, you mean the airline, well they are in charge of employing sufficiently skilled pilots and providing them sufficient training to get their passengers from A to B safely. The airline is also in charge of purchasing sufficiently safe equipment to do so, and maintain it to a sufficient standard.

If they fail to do this, they must accept some liability for the failure. Whether they failed to do this is not yet ascertained - some think the pilots should have saved the passengers from the design fault, some think that’s an unreasonable ask, and some think it was impossible.


If, on the other hand, by “operator” you mean the particular pilots involved, well, in my opinion, pilots have a personal obligation to maintain a standard on top of that required by their employer and their regulator. They can also be held personally liable for the failure, and depending on the global jurisdiction may be supported and/or indemnified by their employer, or, not.

Aviation safety is a rich tapestry, that normally results in a high level of safety, but many argue that it is gradually being eroded in standards of design, training, and skills, generally by one thing: MONEY.

Think about that next time you buy the cheapest ticket available, because that MONEY only comes from one place: you. The less you pay, the less MONEY available to pay someone to design a solid system, or to pay or train the pilot to save you from the less-than-solid system.

Absent regulation, any money that goes into the system just goes to management and shareholders. the Boeing 737 Max 8 failure has little to do with pilot training, or with not enough money for safety, it was caused by Boeing figuring out a way around the process of verifying the design. They could afford to lose a month or two and go through the process, and indeed they can afford it now.

Edmund

[GordonR_Cape]

FullWings Thanks for your insightful comments.

In the case we are discussing, an AoA probe failure (which is singular, predictable and measurable) has caused a cascade of issues and warnings that are difficult to assimilate and don’t immediately point to any particular checklist

Your statement reinforces a point I made earlier. We have vividly seen how faulty AOA data on the B737 affects so many systems simultaneously, that it creates a hazard in itself.

IMO AOA disagree should never have been an optional display extra, but instead trigger a high priority checklist on its own. BTW, a false low AOA value would not trigger a stick shaker, but does comprise a degraded flight condition.

The proposed software fix will remove the possibility of catastrophic MCAS activation. However the potential for a cascade of AOA derived warnings remains on the B737, including the wider NG series, and should be a concern.

Prompt identification of the underlying AOA trigger would avoid going down multiple redundant fault trees. I understand that changing existing checklists should not be treated lightly, but IMO the current review should be an opportunity to enhance this process.

Edit: Derfred (https://www.pprune.org/members/144883-derfred) Thanks for the note about discretion to bypass checklist rules.

[AerocatS2A]

As far as I understand english, it does not. It says electric trim CAN be used to neutralise column forces before cutout (nobody would think it cannot, anyway). It says also Manual trim can be used before and after cutout. It never say electric trim MUST be used to neutralise column forces before cutout
Yes, it doesn’t say “must”. It also doesn’t say “must not”. Given that there is a reminder there that it CAN be used prior to cutout, what would be the reason for NOT using it to fully counter the MCAS? Aside from the design failures themselves, a key to this accident is why weren’t they trimming up as far as they needed to? I know it’s been asked numerous times already in this thread, but it is perplexing.

BTW, it does say at the very start of the trim runaway (in the AD not the abbreviated memory item procedure) to disconnect the autopilot and control pitch with column and electric trim. That’s not a “may” or “can”.

[Fortissimo]

Well, if by operator, you mean the airline, well they are in charge of employing sufficiently skilled pilots and providing them sufficient training to get their passengers from A to B safely. The airline is also in charge of purchasing sufficiently safe equipment to do so, and maintain it to a sufficient standard.

If they fail to do this, they must accept some liability for the failure. Whether they failed to do this is not yet ascertained...

I think it would be somewhat unlikely for liability to be attributed to Ethiopian Airlines for failing to doubt the safety of a brand new aircraft from a major manufacturer that had been certified as safe by the regulator. To my mind, operators buying aircraft are entited to rely on the assurances of a competent authority that design and manufacture complies fully with the standards that have been laid down. This is the fundamental principle behind the certification process - the standards are there to ensure safety, and purchasers should therefore be confident that the equipment satisfies their duty of care to pax and crew in this regard.

As for training, how are you supposed to train, or direct training, for a system on which you have little or no information? If an airline ensures that its pilots complete the training recommended by the manufacturer and approved by the regulator, it would be very hard to prove at a later date it should have guessed that more needed to be done.

QUOTE] If, on the other hand, by “operator” you mean the particular pilots involved, well, in my opinion, pilots have a personal obligation to maintain a standard on top of that required by their employer and their regulator. [/QUOTE]

A laudable view but hard to achieve in practice. Regardless of the operation (fixed wing, rotary, commercial, non-commercial etc) there will be those who achieve and maintain a higher standard than that required simply because they are gifted as pilots, whereas others will have to work much harder. That said, I agree with the point about money/investment - it is next to impossible for pilots to voluntarily improve skills when the tools do the job are unavailable because of policies on hand-flying v automation and the absence of resources for non-jeopardy sims.

It is going to take multiple lines of specialist investigation to bottom all this out. In 3500+ posts on the thread, we still have arguments raging about what this crew should have done (with hindsight...), how MCAS works and why it was implemented, what the implications are for managing the trim system, where the design may have failed, the roles of Boeing and the FAA in the certification process, what should happen with training, and of course the inevitable PPrune sport of playing the man rather than the ball. We have had some very thoughtful and helpful interventions and some frankly unhelpful diversions

For the purposes of further meaningful discussion, I think it would be very useful if someone could collate the most valid information on MCAS and the MAX trim system and have it posted on a separate locked thread that the rest of us can use for reference. That way, some of the excellent grains of truth in this very lengthy thread would not be lost/forgotten, and we would not have to keep going round the same buoys time after time.

[SamYeager]

Spot on, it's is also the view of every colleague I have spoken to.

It seems clear from the posts of various experienced 737 pilots that both sets of pilots messed up, didn't follow clear NNCs and are therefore solely and exclusively responsible for tarring Boeing's reputation and causing such unnecessary alarm that the 737 MAX was grounded. Obviously this would never have happened with US, European or Australian pilots who would have done the right thing. Since it's clear that there is nothing that Boeing can do to bring pilots from Asia and Africa up to the afore mentioned standards the solution is obvious. Just don't sell Boeings to Asia and Africa with perhaps the odd exception for Japan and Singapore. Job done!

What's that you say? Boeing says they have a problem with that because they won't make a big enough profit and that would leave the field open to Airbus? Surely that would just mean Airbus aircraft crashing with the consequent deep smelly stuff and no skin off Boeing nose? Still not good enough? Well I suppose Boeing will just have to change their assumptions about what pilots will and won't do and then design their aircraft and associated documentation so pilots from all continents will follow the correct action(s) and not crash their Boeing aircraft. After Boeing's a business and a key purpose of business is to make money.

N.B. In case you haven't twigged it yet I very much do not repeat not hold the views expressed in the first two sentences.

[TTail]

Very much in agreement.

The Human Factors are, IMO, the most important/interesting part of these accidents.

To recap: There are many situations which require some sort of action from pilots, be it promptly or after consideration. The more time-critical an event is, the less time/capacity there is to figure out what to do, so responses to predictable events are based more on rules than extended cognition, hence “memory” or “recall” items are used. They need to have a simple, unambiguous trigger, e.g. an engine fails below V1, perform an RTO or GPWS says “PULL UP!”, perform the GPWS pull up manoeuvre.

When the situation is more complex and there is normally time for diagnosis, we have reference checklists which may contain decision trees, often leading to different actions and outcomes, dependent on further data. If no checklist really fits the bill completely, maybe due to multiple failures or unusual circumstances, then you need to use your general aviation understanding, backed up by specific type knowledge and all the resources you have access to in order to formulate and execute a plan of action. This is something you would generally do *after* you had determined there were no published normal or non-normal produces that were applicable, or you had applied the procedures and they had not helped or made the situation worse. Boeing specifically caution against “troubleshooting” unless all other possibilities have been exhausted but they also provide a useful “Situations Beyond the Scope of Non-Normal Checklists” guide in their training manuals.

Now, it is good aviation practice to have some kind of action associated with a single, predictable failure which affects the safe operation of the airframe, be it recall items or a reference checklist, or even just a note for crew awareness. In the case we are discussing, an AoA probe failure (which is singular, predictable and measurable) has caused a cascade of issues and warnings that are difficult to assimilate and don’t immediately point to any particular checklist, except maybe the Airspeed Unreliable one, which doesn’t include deactivating the trim. Remember we are looking at these accidents with hindsight and the warnings that occurred can be triggered by many different events that require different responses - we only know which was the correct path to take because we have most of the data in front of us to peruse at leisure.

There have been quite a few posts highlighting the startle effect plus the saturation of input channels by excess information of questionable usefulness, e.g. stick shaker, GPWS, fault messages, high control loadings, etc. It is quite easy to see how some things were missed, in fact most of the above is taught in basic HF modules but this seems have passed some manufacturers by.

It’s easy to say that you’d have disconnected the trim as soon as you got a stick shake in the climb out because the flaps are correct and power is set. Well done. But supposing that was a *real* stall warning because you put the wrong weights in the FMC so have rotated 20kts early? Not so well done now, eh? This has happened before and will happen again and is just one example of why it is so important NOT to rush to conclusions if you can absolutely help it.
Hi FullWings.

Your explanation on how things are resolved in a modern day cockpit makes for a very interesting read and should be part of the curriculum for any up and coming MCC/JOC student. It should also be interesting for the laypeople frequenting these pages. For a professional airline pilot it should be obvious.

I agree with you that Human Factors is a subject of much interest and it is also where I feel I still have the most to learn about the Ethiopean accident. As much as I hate this MAX software addition and its capabilities, I do think I have picked up on the significant features of the MCAS and further detail on it would most likely not have had any influence on how I would deal with an "MCAS Runaway Stabilizer" or whatever we end up calling this scenario.
Although some contributors on this forum have a less than diplomatic way of stating certain facts and assumptions about the crew's actions and inactions I don't think this should be interpreted as putting the whole blame on the crew. Not even close. But there certainly is a lot to be explored following the statement by Ethiopean officials that the crew "followed expected procedures" implying there are no issues whatsover concerning the crew's way of dealing with the problems of this flight. And it is in this space I believe some posters in here get a little bit agitated, trying to get that point across.

There certainly were a number of crossroads at which catastrophy could have been avoided on ET302, especially up to the point of flap retraction and a bit, and from a Human Factors perspective it is extremely interesting to learn why certain choices were made. We all know that the company culture of an airline and also the culture of countries/regions greatly influence how we behave, both as people and as pilots. This has nothing to do with the "supremancy of the Western pilot" or however some may want to phrase it in these times of identity politics.

But when countries ban unions, when people are fired for having opposing views to those of their superiors, when airlines ban handflying within the autopilot envelope and mandate autolands, when airlines have the captain always be the Pilot Flying, when one thousand airline flying hours may entail only a dozen or two actual take-offs and landings.... If you become financially penalized or limited in your career advancement due to non-compliance with said policies, you know there are issues that need to be addressed. I don't think it should be perceived as offensive to ask if any of these or other factors were important when it comes to understanding why a seemingly experienced captain would try to engage the autopilot at 400'AGL while the stickshaker is going off? And why choose the onside autopilot? Why clean up? Regardless of any NNC memory/recall items or checklists, why not establish a known and safe pitch/thrust setting and fly the aircraft? Does everything boil down to "the startle effect" when at first the stick shaker goes off and then later the AP trips off at the same time they clean up? These are not unreasonable questions to ask.

It is a sad fact that whoever is left holding the matches when the house burns down will be looked at with much scrutiny - even by his friends.

[abdunbar]

I think it would be somewhat unlikely for liability to be attributed to Ethiopian Airlines for failing to doubt the safety of a brand new aircraft from a major manufacturer that had been certified as safe by the regulator. To my mind, operators buying aircraft are entited to rely on the assurances of a competent authority that design and manufacture complies fully with the standards that have been laid down. This is the fundamental principle behind the certification process - the standards are there to ensure safety, and purchasers should therefore be confident that the equipment satisfies their duty of care to pax and crew in this regard.


QUOTE] If, on the other hand, by “operator” you mean the particular pilots involved, well, in my opinion, pilots have a personal obligation to maintain a standard on top of that required by their employer and their regulator.

A laudable view but hard to achieve in practice. Regardless of the operation (fixed wing, rotary, commercial, non-commercial etc) there will be those who achieve and maintain a higher standard than that required simply because they are gifted as pilots, whereas others will have to work much harder. That said, I agree with the point about money/investment - it is next to impossible for pilots to voluntarily improve skills when the tools do the job are unavailable because of policies on hand-flying v automation and the absence of resources for non-jeopardy sims.[/QUOTE]

The good news for aviation safety is that these two accidents have shown a bright lite on aircraft design and certification. The liability question can be answered at this point. Regardless of how poor the skills ,training or supervision of the crews might be proven to be, the aircraft design led directly to the accidents. The fact that a well trained crew on Monday morning, could possibly have recovered the aircraft successfully, will not be relevant in shifting the major liability.

As far as the future of the 737 Max, hopefully Boeing will be required to do enough recertification to prove that no automated system can put the aircraft in an unrecoverable configuration, in other words, that the manual stab trim wheel can reasonably be used even at high speed, high g load and high elevator forces. Also they will need to find a simple way of allowing the crew to quickly analyse compounding failures.

in reviewing the performance of the crew, it cannot be over emphasized how disorienting multiple failure manifestations can be. If a crew does not fight an aggressive mental battle, fixation occurs quickly. For example, real stick shaker is rarely encountered. When it is, you are usually aware that you are approaching a limit anyway, perhaps slowing and near a flap extension speed and you hit some turbulence that gives you a momentary stick shaker. This is not alarming. But if you do not have a clue why you have a stick shaker, it is very distracting. In olden times the only way to get rid of it was to find the CB. Then you add other stall warning lights and sounds, if there is no way to rapidly get rid of erroneous warnings they take a toll on your mental state. A Navy flight instructor once told me that the first step in any emergency procedure was, "wind the clock." I don't think he was serious but the point is to maintain initiative. First due no harm. Do common sense things. Silence unneeded sound and get rid of warnings. Then confirm situational awareness. Altitude, terrain, speed, attitude, power setting, configuration, standby instruments. Make appropriate corrections, if not stable, get stable. This process, for an experienced pilot takes seconds.

[MemberBerry]

It's interesting that the Lion Air crew on the flight before the accident also raised the flaps while having unreliable airspeed and the stick shaker. So 3 out of 3 of the crews experiencing the failed AOA sensor did this.

Looking at the FDR traces for the previous Lion Air flight, one difference is that they also enabled the A/P, on the F/O side, when they retracted the flaps. The Ethiopian crew enabled A/P on the captain's side, and started retracting the flaps about 20 seconds later.

In both cases, MCAS activated after the A/P deactivated. For the previous Lion Air flight the fight with MCAS lasted over 4 minutes before they used the cutout switches. For the Ethiopian flight it lasted only 30 seconds.

Another difference for the Lion Air crew that saved the aircraft is that they did the unreliable air speed checklist, according to the preliminary report. And while we can't determine from the FDR trace of the previous Lion Air flight what their exact speeds were, it probably resulted in a more manageable speed.

Both crews later re-enabled electric trim (the Lion Air crew temporarily). And there is nothing in the runaway stabilizer memory items explicitly saying you should not re-enable electric trim. It does however explicitly say that for the autopilot and autothrottle: "Do not​ re-engage the autopilot.​" "Do not​ re-engage the autothrottle".

And, from the FDR traces, the Lion Air crew that saved the aircraft also didn't bring the aircraft to neutral trim before using the cutout switches. And later they did just what the Ethiopian crew did seconds before the crash: they re-enabled electric trim, they started trimming ANU, and MCAS started trimming AND again. Then they used the cutout switches again to stop the runway, again without bringing the aircraft to neutral trim with the thumb switches first. Then they trimmed with the trim wheels for the remainder of the flight.

I can't help but wonder if their knowledge about MCAS is what contributed significantly to the Ethiopian accident, by making them prioritize the stabilizer runaway memory items over everything else, making them tunnel vision and focus on the trim problems primarily, and ignoring other issues, like the increasing speed, and the need to perform other checklists.

[Albino]

It seems clear from the posts of various experienced 737 pilots that both sets of pilots messed up, didn't follow clear NNCs and are therefore solely and exclusively responsible for tarring Boeing's reputation and causing such unnecessary alarm that the 737 MAX was grounded.

I disagree....

Boeing ARE responsible for a poorly designed system, I've yet to meet anyone who doesn't feel the MCAS should not have been certified, allowed to work from a single sensor or able to make the level of input that it does.

Where the difference of opinion lies is that Boeing are solely responsible, particularly for the Ethiopian crash. Their press release stated that all procedures were followed and press around the world are stating as fact that this was completely the fault of the aircraft.

Looking at the information released it is hard to agree. Procedures were not followed. Control of the aircraft was not maintained. The crew had direct control over the stabilizer (apart from when the cutouts were used) at all times. Flying the aircraft is the most basic aspect of our job and the most important.

My final post on this topic.

[shmerik]

Following this thread and others on other forums I've seen the reason for MCAS explained and occasionally debated and I'm left with a question about the decision making that determined that software that controlled the trim was the best way to manipulate stick feel.

My understanding is that MCAS applies AND in order to comply with the regulation requirement that says that the stick pressure must feel a certain way as the aircraft's nose pitches upwards. If it's only the "feel" of flying the aircraft that needs to be changed why not write software that applies forces to the controls themselves instead of applying sporadic input to one of the main pieces that keeps the plane balanced in flight?

[GlobalNav]

I disagree....

Boeing ARE responsible for a poorly designed system, I've yet to meet anyone who doesn't feel the MCAS should not have been certified, allowed to work from a single sensor or able to make the level of input that it does.

Where the difference of opinion lies is that Boeing are solely responsible, particularly for the Ethiopian crash. Their press release stated that all procedures were followed and press around the world are stating as fact that this was completely the fault of the aircraft.

Looking at the information released it is hard to agree. Procedures were not followed. Control of the aircraft was not maintained. The crew had direct control over the stabilizer (apart from when the cutouts were used) at all times. Flying the aircraft is the most basic aspect of our job and the most important.

My final post on this topic.

The primary problem is the design. PERIOD
It’s fine when things are normal, deadly when they are not. It was not designed for fault tolerance. If AOA inputs are invalid, perhaps with IAS disagree, the initial procedures (pitch & power), coupled with unwanted nose down trim will naturally lead pilots to maintain proper pitch, speed increases, MCAS trim down more and on and on. Pilots hit Trim Cutout and are left with manual (slow) trim which becomes increasingly difficult to use as speed increases, until it becomes impossible. Can’t unload (nose down) at 1000 feet, and there’s too much nose down trim to control the airplane.

[PJ2]

Hi FullWings.

Your explanation on how things are resolved in a modern day cockpit makes for a very interesting read and should be part of the curriculum for any up and coming MCC/JOC student. It should also be interesting for the laypeople frequenting these pages. For a professional airline pilot it should be obvious.

I agree with you that Human Factors is a subject of much interest and it is also where I feel I still have the most to learn about the Ethiopean accident. As much as I hate this MAX software addition and its capabilities, I do think I have picked up on the significant features of the MCAS and further detail on it would most likely not have had any influence on how I would deal with an "MCAS Runaway Stabilizer" or whatever we end up calling this scenario.
Although some contributors on this forum have a less than diplomatic way of stating certain facts and assumptions about the crew's actions and inactions I don't think this should be interpreted as putting the whole blame on the crew. Not even close. But there certainly is a lot to be explored following the statement by Ethiopean officials that the crew "followed expected procedures" implying there are no issues whatsover concerning the crew's way of dealing with the problems of this flight. And it is in this space I believe some posters in here get a little bit agitated, trying to get that point across.

There certainly were a number of crossroads at which catastrophy could have been avoided on ET302, especially up to the point of flap retraction and a bit, and from a Human Factors perspective it is extremely interesting to learn why certain choices were made. We all know that the company culture of an airline and also the culture of countries/regions greatly influence how we behave, both as people and as pilots. This has nothing to do with the "supremancy of the Western pilot" or however some may want to phrase it in these times of identity politics.

But when countries ban unions, when people are fired for having opposing views to those of their superiors, when airlines ban handflying within the autopilot envelope and mandate autolands, when airlines have the captain always be the Pilot Flying, when one thousand airline flying hours may entail only a dozen or two actual take-offs and landings.... If you become financially penalized or limited in your career advancement due to non-compliance with said policies, you know there are issues that need to be addressed. I don't think it should be perceived as offensive to ask if any of these or other factors were important when it comes to understanding why a seemingly experienced captain would try to engage the autopilot at 400'AGL while the stickshaker is going off? And why choose the onside autopilot? Why clean up? Regardless of any NNC memory/recall items or checklists, why not establish a known and safe pitch/thrust setting and fly the aircraft? Does everything boil down to "the startle effect" when at first the stick shaker goes off and then later the AP trips off at the same time they clean up? These are not unreasonable questions to ask.

It is a sad fact that whoever is left holding the matches when the house burns down will be looked at with much scrutiny - even by his friends.

TTail, Fullwings, +1.

[threemiles]

The primary problem is the design. PERIOD
It’s fine when things are normal, deadly when they are not. It was not designed for fault tolerance. If AOA inputs are invalid, perhaps with IAS disagree, the initial procedures (pitch & power), coupled with unwanted nose down trim will naturally lead pilots to maintain proper pitch, speed increases, MCAS trim down more and on and on. Pilots hit Trim Cutout and are left with manual (slow) trim which becomes increasingly difficult to use as speed increases, until it becomes impossible. Can’t unload (nose down) at 1000 feet, and there’s too much nose down trim to control the airplane.

The other primary problem is the Emergency AD. It ignores an accelerating aircraft, low altitude, low pitch, and increasing stab load, and then asks to cutout electrical trim, without any prerequisite. It leaves manual trim as the sole remedy, which is highly reduced and slow.
This certification statement about the authority of the trim wheel over the entire flight envelope is certainly not correct, if the trim wheel cannot be cranked ANU at 10000 ft, 320 KIAS.

The holes line up in the cheese: Boeing, crew, FAA, EASA, ...
Litigation - where Boeing will claim that QRHs, NNCs are more a recommendation for great independant airmen, while Lion/ET and victims lawyers will claim that a manual/NNC is to be followed exactly, including what's not in there shall not be done.

[fotoguzzi]

[Not a pilot] From one of the documents on the Ethiopian Preliminary Report: "If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT."

So, if relaxing the column does not allow trim to be moved, what then? Slow down? Immelmann? Something else?

Or does this sentence not apply to the possibility of manual trim? The word "causes" rather than "allows." Is this sentence merely a method of determining whether you have a classic trim runaway? That is, if the runaway stops because the jackscrew is binding, you can confirm this by letting off column back pressure. If trim continues, yep, you have a classic runaway. If no more trim, the runaway has stopped for now.

In either reading, is Boeing not saying that the jackscrew might bind around the time a pilot might be contemplating hand cranking?

[Just This Once...]

This certification statement about the authority of the trim wheel over the entire flight envelope is certainly not correct, if the trim wheel cannot be cranked ANU at 10000 ft, 320 KIAS.

The holes line up in the cheese: Boeing, crew, FAA, EASA, ...

Your point about the certification statement is well made and whoever made such a statement to a regulator must be feeling hot under the collar. Boeing seemed to accept that electric trim on the Max did not work over the entire flight envelope and somehow claimed this as a safety feature. To go on to claim that the trim wheels cover the entire envelope, when the previous wisdom was that it did not, starts to smell less like a mistake and more like deliberate subterfuge to try and cover-up a certification breach.

As I stated earlier, nobody is sure of the actual envelope where electric trim and manual trim are assured, including on the 737NGs that are operating today. If I was representing an AOC holder I would be seeking urgent clarification of the trimmable flight envelope for the current 737 family.

[Chronus]

It is not the stall charectoristics. The B737 MAX has pitch up tendencies which don’t meet FAA Static Longitudinal Stability certification standards. To meet the standard, MCAS was needed to reduce the pitch up tendency at high angles of attack. Addtional sim training won’t exempt you from meeting the certification standard.

Sec. 25.173 Static longitudinal stability.
Under the conditions specified in Sec. 25.175, the characteristics of the elevator control forces (including friction) and the elevator control surface displacement must be as follows:

(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. In addition, if the elevator control forces are not dependent upon the hinge moments of the elevator control surface, it must also be shown that upward displacement of the elevator trailing edge is required to obtain and maintain speeds below the specified trim speed, and a downward displacement of the elevator trailing edge is required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or VFC / MFC , whichever is appropriate, or lower than the minimum speed for steady, unstalled flight.

(b) The airspeed must return to within 10 percent of the original trim speed when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.

(c) The stable slope of the stick force versus speed curve may not be less than 0.5 pound for each three knots or exceed a value beyond which control of the airplane is difficult. "
"The B737 MAX has pitch up tendencies which don’t meet FAA Static Longitudinal Stability certification standards. To meet the standard, MCAS was needed to reduce the pitch up tendency at high angles of attack."

Presumably this is because they have gone and under slung the engines way ahead of the LE of the wings which would make the whole thing go tits up in no time at all, if you get a bit excitable and give a generous helping with stick and power. So to guard against the ham- fisted, they have come up with a little thing clever bit of electronic wizardry and named it MCAS. The end result seems so far to be the Correction bit of it is worse than that which could have been achieved by the ham -fisted.

[SamYeager]

Litigation - where Boeing will claim that QRHs, NNCs are more a recommendation for great independant airmen

From what I can understand from this thread this is very much not the case as the plane is supposed to be designed for the average pilot rather than great independant airmen. The key question is what constitutes an average pilot? With the vast ramp up in the amount of planes and pilots flying over the last decade or so I think there's a good argument to be made that currently there's wider range of abilities than previously and hence maybe the threshold needs to be lower than is currently the case. Hopefully at some time in the future as the newer airlines and pilots mature this threshold will rise.

It's worth pointing out US commercial aviation did not suddenly burst into being as is now the case but it evolved. Let's face it surely any "halfwit" would know better than to get near to the plane in front to try to melt the snow on the wings right?

[hec7or]

It's worth pointing out US commercial aviation did not suddenly burst into being as is now the case but it evolved. Let's face it surely any "halfwit" would know better than to get near to the plane in front to try to melt the snow on the wings right?

Well since the FO in the incident to which you refer was a military jet fighter pilot as reported in NTSB AAR 82-8, I'm going to have to redefine my understanding of the term "half wit"

20/20 hindsight is not something pilots find particularly useful on the day

[steamchicken]

Yes, it doesn’t say “must”. It also doesn’t say “must not”. Given that there is a reminder there that it CAN be used prior to cutout, what would be the reason for NOT using it to fully counter the MCAS? Aside from the design failures themselves, a key to this accident is why weren’t they trimming up as far as they needed to? I know it’s been asked numerous times already in this thread, but it is perplexing.

BTW, it does say at the very start of the trim runaway (in the AD not the abbreviated memory item procedure) to disconnect the autopilot and control pitch with column and electric trim. That’s not a “may” or “can”.

The key problem here is that the runaway procedure asks you to identify that you can't trust the trim system and cut it off.

In the MCAS context, you're now asked to decide that you can't trust it, but then maybe keep trusting it until you've got back in trim, then cut it off. If you can't trust the electric trim, and you need to cut it off, it's very strange to have to trust it a while more. If you can trust it, why are you even turning it off?

The 737NG procedure, as someone pointed out, identifies whether the automation or the electric drive is the problem. This detail seems more and more important.

[steamchicken]

It's interesting that the Lion Air crew on the flight before the accident also raised the flaps while having unreliable airspeed and the stick shaker. So 3 out of 3 of the crews experiencing the failed AOA sensor did this.

Looking at the FDR traces for the previous Lion Air flight, one difference is that they also enabled the A/P, on the F/O side, when they retracted the flaps. The Ethiopian crew enabled A/P on the captain's side, and started retracting the flaps about 20 seconds later.

In both cases, MCAS activated after the A/P deactivated. For the previous Lion Air flight the fight with MCAS lasted over 4 minutes before they used the cutout switches. For the Ethiopian flight it lasted only 30 seconds.

Another difference for the Lion Air crew that saved the aircraft is that they did the unreliable air speed checklist, according to the preliminary report. And while we can't determine from the FDR trace of the previous Lion Air flight what their exact speeds were, it probably resulted in a more manageable speed.

Both crews later re-enabled electric trim (the Lion Air crew temporarily). And there is nothing in the runaway stabilizer memory items explicitly saying you should not re-enable electric trim. It does however explicitly say that for the autopilot and autothrottle: "Do not​ re-engage the autopilot.​" "Do not​ re-engage the autothrottle".

And, from the FDR traces, the Lion Air crew that saved the aircraft also didn't bring the aircraft to neutral trim before using the cutout switches. And later they did just what the Ethiopian crew did seconds before the crash: they re-enabled electric trim, they started trimming ANU, and MCAS started trimming AND again. Then they used the cutout switches again to stop the runway, again without bringing the aircraft to neutral trim with the thumb switches first. Then they trimmed with the trim wheels for the remainder of the flight.

I can't help but wonder if their knowledge about MCAS is what contributed significantly to the Ethiopian accident, by making them prioritize the stabilizer runaway memory items over everything else, making them tunnel vision and focus on the trim problems primarily, and ignoring other issues, like the increasing speed, and the need to perform other checklists.

This is such a good point.

[Loose rivets]

It is, and I still beg the question as to whether the five seconds pause applies upon resetting the Stab supply switches.

[FrequentSLF]

It is, and I still beg the question as to whether the five seconds pause applies upon resetting the Stab supply switches.
MCAS activated even after cutout, it is visible in the FDR traces, but was unable to move the stab because of the cutout. It was a single full 10 sec. intervention and did not repeat again because was not reset by the thumb switches operation. Looking at the schematics and the description of the system, i would speculate that it will not activate upon resetting the stab supply switches, unless there is a thumb operation, in such case it will pause for 5 seconds.

[Gegenbeispiel]

From what I can understand from this thread this is very much not the case as the plane is supposed to be designed for the average pilot rather than great independant airmen...

Wrong. Safety philosophy requires the plane to be designed for the worst possible but still properly licenced and type rated crew.
Designing civil air transport aircraft for great airmen is completely out of the question. Don't even think about it!

[KRUSTY 34]

The primary problem is the design. PERIOD
It’s fine when things are normal, deadly when they are not. It was not designed for fault tolerance. If AOA inputs are invalid, perhaps with IAS disagree, the initial procedures (pitch & power), coupled with unwanted nose down trim will naturally lead pilots to maintain proper pitch, speed increases, MCAS trim down more and on and on. Pilots hit Trim Cutout and are left with manual (slow) trim which becomes increasingly difficult to use as speed increases, until it becomes impossible. Can’t unload (nose down) at 1000 feet, and there’s too much nose down trim to control the airplane.





Terrifying!

[deltafox44]

[Not a pilot] From one of the documents on the Ethiopian Preliminary Report: "If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT."

So, if relaxing the column does not allow trim to be moved, what then? Slow down? Immelmann? Something else?
Here "the trim to move" means "runaway continues". If it does not move anymore by itself, the manual trim still should be able to move (it is, when not blocked by too much loads)

[futurama]

Wrong. Safety philosophy requires the plane to be designed for the worst possible but still properly licenced and type rated crew.
Designing civil air transport aircraft for great airmen is completely out of the question. Don't even think about it!
This is also wrong.

The general safety principle prohibits aircraft characteristics requiring "exceptional pilot skill, alertness, strength or other capabilities". This human factors requirement is embedded throughout the regulations, e.g., in particular FAR 25.143:


FAR 25.143
(b) It must be possible to make a smooth transition from one flight condition to any other flight condition without exceptional piloting skill, alertness, or strength, and without danger of exceeding the airplane limit-load factor under any probable operating conditions

Although the interpretation of this principle is subjective by nature, it is clearly not a requirement to design for "the worst possible" licensed/typed-rated crew.

[TryingToLearn]

To me (as a functional safety engineer) it looks like the designers made a very common beginners mistake at the very beginning while designing MCAS.
This mistake can sometimes even be found within training documents.

MCAS should only be active in rare situations and only change the feel (low impact).
It's like an airbag which is only needed in case of an accident where it may help you.
Therefore it got a low A rating.
But this is an availability rating, not safety!

Functional Safety covers a different question: What can go wrong if this functions fires off in the worst possible situation (by considering all possible situations). In this case at maximum speed and low height. And is there any kind of controlability?
Like an airbag explosion hitting and killing you (critical) while stepping out of the car (common situation) without any chance to avoid it (too fast).
-> It should have been rated higher, probably critical (C) as already mentioned
All further analysis, quality methods, redundancies (2 or 3 sensors), documentation, process requirements... rely on this rating which was probably wrong.
In addition they changed the maximum impact of the system later (0.6 to 2.5) and did not question the assumptions within the first analysis. This should happen automatically as part of the safety process.

MCAS had apparently a latent systematic (design) fault which ended up in a critical fault as soon as the AoA reading was wrong (2nd fault).

[CurtainTwitcher]

To me (as a functional safety engineer) it looks like the designers made a very common beginners mistake at the very beginning while designing MCAS.
This mistake can sometimes even be found within training documents.

MCAS should only be active in rare situations and only change the feel (low impact).
It's like an airbag which is only needed in case of an accident where it may help you.
Therefore it got a low A rating.
But this is an availability rating, not safety!

Functional Safety covers a different question: What can go wrong if this functions fires off in the worst possible situation (by considering all possible situations). In this case at maximum speed and low height. And is there any kind of controlability?
Like an airbag explosion hitting and killing you (critical) while stepping out of the car (common situation) without any chance to avoid it (too fast).
-> It should have been rated higher, probably critical (C) as already mentioned
All further analysis, quality methods, redundancies (2 or 3 sensors), documentation, process requirements... rely on this rating which was probably wrong.
In addition they changed the maximum impact of the system later (0.6 to 2.5) and did not question the assumptions within the first analysis. This should happen automatically as part of the safety process.

MCAS had apparently a latent systematic (design) fault which ended up in a critical fault as soon as the AoA reading was wrong (2nd fault).
This is no beginners mistake. They apparently knew EXACTLY what they were doing. The only reason it was not classified as Critical is because in doing so would require a crew warning and thus more crew training. This allegedly would trigger penalties embedded in purchase contracts (the figure quoted was $1 million per aircraft for just one operator who had ordered 280 units).



System failed on a single sensor
The bottom line of Boeing’s System Safety Analysis with regard to MCAS was that, in normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.

In the case of an extreme maneuver, specifically when the plane is in a banked descending spiral, an activation of MCAS was classified as a “hazardous failure,” meaning that it could cause serious or fatal injuries to a small number of passengers. That’s still one level below a “catastrophic failure,” which represents the loss of the plane with multiple fatalities.
Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system (https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/)




This is much much darker than a rookie error, a Rubicon has been crossed...

[Ian W]

This is no beginners mistake. They apparently knew EXACTLY what they were doing. The only reason it was not classified as Critical is because in doing so would require a crew warning and thus more crew training. This allegedly would trigger penalties embedded in purchase contracts (the figure quoted was $1 million per aircraft for just one operator who had ordered 280 units).



Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system (https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/)




This is much much darker than a rookie error, a Rubicon that has been crossed...


The reasoning was not 'a dark plot'. As with all automation in modern aircraft if things go awry as they will, it was thought that the flight crew would be able to counteract the problem. Just using the pickle trim stops MCAS, trimming up reverses MCAS. Repeated uncommanded down trim that becomes intrusive would be dealt with by the runaway trim NNC, but just trimming back to trim using normal trim would be sufficient as it was in the Lion Air cases except in the last the FO didn't trim back to normal trimmed flight and let MCAS take over. That in itself is a clue - Boeing thought that pilots would trim to trimmed flight as second nature as part of normal flying. In the same way that car manufacturers with lane keeping software assume that drivers want to stay in lane - only more so. As for professional pilots trimming so the controls can be lightly held is a natural part of flying. Boeing were wrong in this expectation.

It may be as discussed in several posts that the sheer human factors overload and automation surprise has been totally underestimated - in several posts the intrusive nature of the stick 'shaker' has been mentioned as completely over the top of what is required, a single minor fault has an FMEA that results in multiple systems all deciding to add to the cacophony instead of one calm report saying AOA disagree. This is a major human factors issue/failure in all modern aircraft.

Nevertheless, had autopilot, autothrottle and stab trim all been switched off; and control taken over manually all these aircraft would have been controllable and landed.
Aviate , Navigate, Communicate. is nice as a chant - but Boeing relied too much on pilots managing to aviate.

Be aware that this is logically pushing aircraft development toward full automation.

[Derfred]

i would speculate that it will activate upon resetting the stab supply switches
...

The FDR plots indicate that it didn’t. There was no further activation of MCAS until 5 seconds after the final two yoke switch inputs.

Furthermore, it is apparent that MCAS is unaware of the position of the stab cutout switches, because it still tried to trim while the switches were in cutout.

So I would speculate that MCAS wouldn’t have a clue that the cutout switches had just been reactivated, and would only attempt to trim again when the already published criteria are met:

1. AOA still exceeding threshold, and
2. Reset by subsequent pilot activation of yoke trim switch.

So, in theory, a pilot with superior understanding of MCAS could:

1. Hit the cutout switches in response to undesirable MCAS input,
2. Hold back pressure to keep the aircraft safe while collecting thoughts,
3. Reactivate cutout switches,
4. In his own good time, then electrically trim ANU either continuously or in “blips” spaces less than 5 seconds apart,
5. Hit the cutout switches again less than 5 seconds after the last “blip”.

Now, with an aircraft “in trim”, continue with manual trim.

Speaking purely academically of course.

[dingy737]

Because I now have an understanding of MCAS from this thread. It is conceivable, for whatever reason ( demonstration) that MCAS could be handled like a snake charmer that pats a cobra repeatedly on its head. Dangerous yes, but if every time MCAS “attacks”, the pilot immediately uses a blip of manual electric trim to shut it down for 5 seconds , he could fly a tedious ILS in such a condition. The knowledge which I have now, but isn’t in the FCOM, takes the mystery out of the MCAS monster, which can be easily tamed in so many ways: Flaps, autopilot, cutout switches, trim switches
1. I am convinced that the captain incorrectly kept control instinctively because of how extremely green the FO was and the very low altitude. 100 feet.
2. With that thought implanted in his mind he focused only on AP A. instead of B
3. Nevertheless I don’t buy the explanations in this thread thus far, that the captain used manually electric trim on three seperate occasions but stopped at 2.4, 2.3, and 2.3 units exactly, while still leaving him holding back pressure, instead of prolonged trimming until the column was neutral. I consider this a vital clue and one still to be explained.
4. How unfortunate manual electric trim was never used during the 9 seconds of MCAS activation to expose the control of manual electric trim over MCAS.
5. As for 3 out of 3 crews retracting the flaps. It was always expressed, if possible, clean up the aircraft and speed is your friend. Get clean and fast quickly. The flap connection with MCAS was not clear in their minds.
6. The crew had to think through warnings and confusion immediately as the aircraft got airborne : stick shaker from start to finish, master caution, anti ice, left alpha vane, autopilot wailers, GPWS DONT SINK, over speed clacker, while having to hold increasing back pressure on a vibrating column.

[CurtainTwitcher]

Ian W, I respectfully disagree. A lot of money was at stake, riding on the MCAS being single source, hidden from virtually everyone. I am not the only one making the allegations, it's people who worked on the MAX project.

Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet

March 26, 2019 at 5:00 pm Updated March 27, 2019 at 3:01 pm
...The design

Boeing had been exploring the construction of an all-new airplane earlier this decade. But after American Airlines began discussing orders for a new plane from Airbus in 2011, Boeing abruptly changed course, settling on the faster alternative of modifying its popular 737 into a new MAX model.

Rick Ludtke, a former Boeing engineer who worked on designing the interfaces on the MAX’s flight deck, said managers mandated that any differences from the previous 737 had to be small enough that they wouldn’t trigger the need for pilots to undergo new simulator training.

That left the team working on an old architecture and layers of different design philosophies that had piled on over the years, all to serve an international pilot community that was increasingly expecting automation.

“It’s become such a kludge, that we started to speculate and wonder whether it was safe to do the MAX,” Ludtke said.

Ludtke didn’t work directly on the MCAS, but he worked with those who did. He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off.

And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table.

“The decision path they made with MCAS is probably the wrong one,” Ludtke said. “It shows how the airplane is a bridge too far.”

Boeing said Tuesday that the company’s internal analysis determined that relying on a single source of data was acceptable and in line with industry standards because pilots would have the ability to counteract an erroneous input.

In addition to the imminent software fix for the MCAS, people familiar with Boeing’s plans said the company now intends to make standard two features that previously were optional add-ons at extra cost.
Seattle Times: Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet (https://www.seattletimes.com/business/boeing-aerospace/a-lack-of-redundancies-on-737-max-system-has-baffled-even-those-who-worked-on-the-jet/)



The bottom line is that airlines have for the most part "Aviation, Navigating, Communicating" with the 737 Classic and NG safely around the world for a long time. The AoA vane is the same part number on the NG and the MAX, yet suddenly there are two Loss Of Control accidents in a very short space of time on a new airframe due to a fault in this sensor. It is hard to conclude that a lack of aviating, navigating & communicating is suddenly the root cause of the problem.

A fully conscious rational business decision was made to withhold knowledge of the new MCAS software and down rate the risk assessment. The two accidents are proof that that an AoA failure on the MAX and the MCAS should have a failure rating of Catastrophic, and a warning feature & additional training should have been mandated as a consequence.

If that had occurred, a lot of people would still be alive, and ironically, Boeing managers and shareholders would be significantly wealthier.

[armchairpilot94116]

https://youtu.be/q17vykscK0w

Mentourpilot explains (back tracks)

[Realbabilu]

pax here,
In et-Avj fdr traces,
1. The ap Cmd a activated in 1 interval, it is means autopilot can be activated when ias disagree. Even though it willl be off later. Why not directly off by system

At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted, and the pitch trim position decreased to 4.6 units.
2. There is 3 trim nose down commanded by autopilot trim I suppose and flaps retracted when ap cmd a activated,
flaps retract by autopilot / pilot ?

EDIT: it was captain pilot who retract
At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.
At 05:39:55, Autopilot disengaged,

Seems the weird activated autopilot made the pilot brave enough to retract the flaps.
unfortunately the autopilot turned off again due IAS disagree. How it can be activated for 33 seconds when stick shaker was shaking?

[Schnowzer]

Not trying to criticise the crew but rather clarify my reading of the data presented:

1. Pilot manually flying, gets an AoA disagreement on climb out, pilots clean up.
2. Pulls back on stick and gets a stick shaker.
3. Pilot trims logically, MCAS trims ND worried about AoA.
4. At some point AP goes in then out, not clear why.
5. MCAS trims ND.
6. Pilots cut-out trim. (It seem MCAS tries to trim down to no effect which was good)
7. No further trim inputs from pilots (Looks like trim wheel not used)
8. Issues with stick forces, re-engage automatic trim and lose control.
9. Manual trim wheel doesn't seem to have been used
9.Throughout speed is increasing because thrust has not changed so stick forces are increasing.

A confusing situation no doubt, but after cutting out the electric trim would setting a sensible pitch and reducing power while using the trim wheel have lead to a different result?

[alf5071h]

Schnowzer,
AoA Disagree not fitted to the accident aircraft.
Stick-shake after wt-off-wheels, normal operation of stall warning system with (erroneous) high AoA.
MCAS only active with flap up; nose down trim MCAS operation as designed - until it isn’t. **
Pilots continuing concern about stick-shake and corresponding, but erroneous indications of low speed / stall awareness on EFIS (no immediate indication / association with AoA).
Some texts indicate that MCAS is inoperative with AP engaged.
MCAS intermittently trims down, but at a rate / time ratio which overcomes pilots opposing trim.
Pilot electric trim increasingly ineffective (nose up), MCAS more effective nose down due to tail forces / hinge moments.
Stab off, manual wheel trim similarly unable to move trim nose up due to high forces.
A point is reached where what ever option, SOP, etc, is applied, then if the aircraft is not within reasonable control (trim) - manageable by one pilot, there is little more that can be done.

** Underlying question applying to many posts - ‘how do pilots know when the MCAS is not working as required ?’

[CodyBlade]

When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.

[DHC6tropics]

A couple quick questions for the airline pilots out there. I’m trying to get a general feeling for the experience/airmanship level of my colleagues around the world. For any transport category jet, how many of you would:

Engage an autopilot with a stick shaker active or any other signs of unreliable airspeed on departure?
Retract flaps with a stick shaker active or any other signs of unreliable airspeed on departure?
Be uncomfortable manually controlling thrust at any point during the flight.
Be uncomfortable manually flying the aircraft during an emergency?
Distrust the average pilot in your company to accurately fly manually during an emergency.
Not use the electric trim system to relieve control column pressure (if it is having a positive effect, such as was almost assuredly the case in the Lion-air and Ethiopian accidents)?

[KyleRB]

When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.

Of course that’ll be the job of Boeing lawyers to mitigate and try to reduce liability but ultimately the main culprit will come down to MCAS, it’s design, certification, discreet implementation, lack of redundancy and ultimately its power to overcome pilot actions without crews being made fully aware of its capabilities.

[CurtainTwitcher]

When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.
Well, if we want to get really picky, did they complete the "Approach to Stall or Stall Recovery" Non-Normal Manoeuvre (NNM) first, because that the second line says"
"Immediately do the following at the first indication of stall (buffet or stick shaker).
The third item is (step 2 disconnect autothrottle):
"smoothly apply node down elevator to reduce the angle of attack until until buffet or stick shaker stops".

Glad they skipped that NNM and went onto something else. I wonder what the lawyers will make of that decision?

In the cold hard light of day, 3 crews were placed in situations beyond the engineering assumptions of all the SOP's, NNC and NNM's. They faced a continuous cacophony of noise (stick shaker), that has been shown by anecdotal reports in this thread to induce tunnel vision and difficulty doing ANY task, including just flying the aircraft. Two crew were unable to cope, the third had assistance from an additional pilot.

Perhaps as the lawyers are debating and dissecting second by second details, they should do it with the continuous Stick Shaker loop in the background. It really is an asymmetric situation for the crews, if they don't do something (following the NNM for the stick shake and shove the nose down) and save the day at that point they get no credit, yet they don't do something else everyone wants to point to them and say see, pilot error. For the manufacturer it is a business decision to hang the crew if possible as it reduces their liability. They get to cherry pick the inevitable forced pilot errors in such difficult circumstances and gloss over the manufacturers errors and omissions. Nothing personal, just business to make the most bucks it can.

I've pretty much argued consistently in the Lion Air thread and this one, that the crews were put into incredibly difficult circumstances by the rational design choices of the manufacturer. Those design choices were made under circumstances of far less pressure than the crews faced. The only possible justification Boeing could make is was more profitable for them to design the system this way.

[alf5071h]

DHC6tropics, #3633
Without context none of these ‘predetermined’ measures can rate airmanship.
Experience might be judged according to what has been done (past), but this cannot be reliable projected for the use, the application of that experience in some future event. Who judges, you or an external observer.
Airmanship is not a quantity, at best it’s a rating, a term, something which can be used in conversation because it impossible to deal with these qualities in any other way.

Context, hindsight, and the human condition.

[CodyBlade]

Of course that’ll be the job of Boeing lawyers to mitigate and try to reduce liability but ultimately the main culprit will come down to MCAS, it’s design, certification, discreet implementation, lack of redundancy and ultimately its power to overcome pilot actions without crews being made fully aware of its capabilities.


going to be judged not by your peers or professionals who can intepret the data objectively.But by mom and pop.

[DHC6tropics]

DHC6tropics, #3633
Without context none of these ‘predetermined’ measures can rate airmanship.
Experience might be judged according to what has been done (past), but this cannot be reliable projected for the use, the application of that experience in some future event. Who judges, you or an external observer.
Airmanship is not a quantity, at best it’s a rating, a term, something which can be used in conversation because it impossible to deal with these qualities in any other way.

Context, hindsight, and the human condition.

Are you serious!?! The ability to make fundamental decisions with regards to configuration and automation in abnormal situations and the ability to confidently and accurately manually fly the aircraft are pillars of airmanship. Unfortunately, airmanship can not be taught purely in a classroom. Much of airmanship comes from professional experience. I’m not American, but I applaud them for their 1500 hour rule. Learning the fundamentals of flying and airmanship should happen long before a pilot is allowed to set foot in a transport category jet.

[flyingmate]

Hi, anyone knows the standard pax weight used by Ethiopia Airline? Male/Female. The ECAA gives a standard weight 90 M/ 70F including 20lbs handbag. Is it the same?

[fizz57]

When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.

Getting a bit fed up with this canard. Not saying it shouldn't have been done, but what exactly would this have done to the throttle position in the accident scenario?

[DHC6tropics]

Getting a bit fed up with this canard. Not saying it shouldn't have been done, but what exactly would this have done to the throttle position in the accident scenario?

Ummm...it would have allowed them to manually control the thrust levers...which is exactly what basic airmanship would dictate.

[ecto1]

I see more and more posts selecting solutions which are strictly inside the coordinates of what we "know" it is possible. (EG: more training, software patch...) and not seriously mentioning much better / obvious ones.

I say: listen to people from other industries. What we sometimes believe impossible in terms of complexity / cost / time may not be so.

It's time to roll up our sleeves and produce good computer systems for planes. Systems in which sensor signals jumping straight up to off - the - scale - high are automatically rejected and have zero impact. For a start. Updating whichever rules as we go to keep a cheap but much safer solution.

We totally know how to do it right, it's just we forbid ourselves to do it by all sorts of rules and bureaucracy. Let's not accept another band aid.

Somebody wrote many pages ago he spent 30 years in the industry and failed to change substandard quality. Sorry I forgot who. But to him and everyone else, we have to keep fighting, as futile as it may be. It's simply what we have to do.

[CodyBlade]

Getting a bit fed up with this canard. Not saying it shouldn't have been done, but what exactly would this have done to the throttle position in the accident scenario?

You miss my point.

[bsieker]

It's time to roll up our sleeves and produce good computer systems for planes. Systems in which sensor signals jumping straight up to off - the - scale - high are automatically rejected and have zero impact. For a start. Updating whichever rules as we go to keep a cheap but much safer solution.


In general, the industry does, and overall does a very good job of it. Input value filtering is normal, and even the A330 that nose-dived in cruise had computers which did. It was done inappropriately, but most of the time the erroneous values were rejected.

The problem here lies much earlier, in specifying the requirements for MCAS. More specifically, the failure modes and the severity and likelihood of each were not properly analysed.


We totally know how to do it right, it's just we forbid ourselves to do it by all sorts of rules and bureaucracy. Let's not accept another band aid.


Au contraire. Aviation is the industry which mandates appropriate techniques. They are well-known, and used.

Add-on systems that bring airliners back into compliance, which are not by themselves aerodynamically completely compliant to regulations, are literally as old as jet airliners themselves. Many types have stick-nudgers or stick-pushers, and they work fine, and are perfectly sensible to use. But that does not mean one can skip due diligence in developing them, which includes a thorough risk and hazard assessment.

Bernd

[GordonR_Cape]

Of course that’ll be the job of Boeing lawyers to mitigate and try to reduce liability but ultimately the main culprit will come down to MCAS, it’s design, certification, discreet implementation, lack of redundancy and ultimately its power to overcome pilot actions without crews being made fully aware of its capabilities.

CurtainTwitcher
Perhaps as the lawyers are debating and dissecting second by second details, they should do it with the continuous Stick Shaker loop in the background. It really is an asymmetric situation for the crews, if they don't do something (following the NNM for the stick shake and shove the nose down) and save the day at that point they get no credit, yet they don't do something else everyone wants to point to them and say see, pilot error. For the manufacturer it is a business decision to hang the crew if possible as it reduces their liability. They get to cherry pick the inevitable forced pilot errors in such difficult circumstances and gloss over the manufacturers errors and omissions.

going to be judged not by your peers or professionals who can intepret the data objectively.But by mom and pop.

Not a lawyer. Presumably there are differing degrees/amounts of liability. More important are punitive damages, which can be many multiples of the actual damages claimed. All of these will be argued intensely, and the various role players will have differing inputs into this process, other than the dead pilots.

[Aihkio]

Before rotation there is speed where AoA sensors should work in the intended way, why not check the values then and throw out the bad one. That does not help for events after rotation but would atleast check for ground damage.

[TeachMe]

Hello all,

My understanding from these situations is one contributing factor may be that a pilot may ultimately get into a situation where he or she has little to no ability to correct a badly out of trim Max manually or electrically due to aerodynamic loads in certain flight situations. What I have not seen is anyone noting is if this inability, irregardless of how it came about, is the same in other aircraft from Boeing or Airbus. From a 320 to a 380 or a 737 NG or 747 to a 787 would a pilot have the ability to re-trim from the same situation these two flights faced?

TME

[DaveReidUK]

My understanding from these situations is one contributing factor may be that a pilot may ultimately get into a situation where he or she has little to no ability to correct a badly out of trim Max manually or electrically due to aerodynamic loads in certain flight situations.

That appears to be true for manual (wheel) trim, but there's no evidence that it's the case for electric trim.

[Freehills]

I see more and more posts selecting solutions which are strictly inside the coordinates of what we "know" it is possible. (EG: more training, software patch...) and not seriously mentioning much better / obvious ones.

I say: listen to people from other industries. What we sometimes believe impossible in terms of complexity / cost / time may not be so.

It's time to roll up our sleeves and produce good computer systems for planes. Systems in which sensor signals jumping straight up to off - the - scale - high are automatically rejected and have zero impact. For a start. Updating whichever rules as we go to keep a cheap but much safer solution.

We totally know how to do it right, it's just we forbid ourselves to do it by all sorts of rules and bureaucracy. Let's not accept another band aid.

Somebody wrote many pages ago he spent 30 years in the industry and failed to change substandard quality. Sorry I forgot who. But to him and everyone else, we have to keep fighting, as futile as it may be. It's simply what we have to do.

Or we could get rid of the grandfathering loophole that Boeing and the FAA have abused, where software has been used as a bandaid. A320/ B787 etc that were designed to make full use of computer systems from the ground up are fine. It is the unholy mixing of digital & analogue on the MAX that is the issue.

Would a similar AOA failure on an NG cause a crash? Almost certainly not.

In my opinion, Boeing & FAA have stretched the definition of a derivative aircraft beyond what is reasonable. What will be interesting will be impact on 777X, I am guessing FAA will be reviewing all assumptions on that now, and we might even see the end of "NG" derivative programmes (as opposed to stretches) with authorities insisting that if you build a new plane, it meets current standards. This is how it works in contruction. Sure, you don't have to rebuild a 40 year old building to new standards, but you can't say "this design met earthquake standards in 1990, so I can just build a derivative of it"

[Icarus2001]

Exactly. The electric trim will still work as advertised. This was not, on the surface of it an unrecoverable situation.

[quentinc]

but there's no evidence that it's the case for electric trim.

Agreed. There is the suggestion though, that the pilots, after the again assumed switching back on, of the electrical trim... Only apply relatively short trim up commands... as perhaps the TRIM appears to be jammed to the pilots. The FDR doesn't seem to show any significant movement in TRIM to their last commands. The subsequent MCAS TRIM down, seems to have an immediate effect.

[KRUSTY 34]

Hello all,

My understanding from these situations is one contributing factor may be that a pilot may ultimately get into a situation where he or she has little to no ability to correct a badly out of trim Max manually or electrically due to aerodynamic loads in certain flight situations. What I have not seen is anyone noting is if this inability, irregardless of how it came about, is the same in other aircraft from Boeing or Airbus. From a 320 to a 380 or a 737 NG or 747 to a 787 would a pilot have the ability to re-trim from the same situation these two flights faced?

TME

I guess it depends on whether the A320 to A380 or a 737 NG or 747 to a 787 would also suddenly and arbitrarily trim itself into the sea/ground!

[DaveReidUK]

The FDR doesn't seem to show any significant movement in TRIM to their last commands.

I don't think you can deduce anything from that.

The previous application of trim, 9-10 seconds' worth at around 05:30:40 resulted in a tad under 2 units (degrees) of ANU stab movement. The final two bursts of trim command were no more than 1 second each, so any stab movement would have been a fraction of a degree (which is actually just discernable on the trace).

[alf5071h]

DaveReidUK, #3647, Icarus2001, quentinc
“… no evidence that it's the case for electric trim.”

Indications in the EASA reference ‘Equivalent Safety Case’ suggest otherwise.
“Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts.”

Also see the ‘forceful‘ arguments in https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-range.html

Where the Equivalent Safety Case relates to normal flight with an aircraft reasonably in trim - low tail forces - Peter L, initial diagrams with level tail +/- elevator.
However with serious trim malfunctions, the tail displacement together with adverse elevator load attempting to recover, might limit electric trim (latter diagrams). Add effects of elevator feel offset due to false stall warning, higher stick loads add to trim offset loads.

Discussions range between trim motor stall, and/or trim inhibit at large angles for trim runaway safety case.

Also remember that MCAS vs elect trim is 10 to 5 time ratio in favour of nose down.

[astrodog3]

DaveReidUK, #3647, Icarus2001, quentinc
...

Indications in the EASA reference ‘Equivalent Safety Case’ suggest otherwise.
“Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts.”

...

However with serious trim malfunctions, the tail displacement together with adverse elevator load attempting to recover, might limit electric trim (latter diagrams). Add effects of elevator feel offset due to false stall warning, higher stick loads add to trim offset loads.

...

Also remember that MCAS vs elect trim is 10 to 5 time ratio in favour of nose down.

I've seen this comment a few times, and I think there may be a misunderstanding about how MCAS and the electric trim switches interact.

While MCAS *can* operate for up to 10 seconds, it is inhibited by the activation of the wheel trim switches. When they are activated, MCAS stops until they are released, and waits 5 seconds. There isn't a ratio of time between one and the other. You can hold the trim switch for any length of time and MCAS will stay off until 5 seconds after it is released.

Nothing stops a pilot from trimming to neutral in one long press, then using the cutout switches, beyond the counterintuitive nature of that reaction.

[VicMel]

Au contraire. Aviation is the industry which mandates appropriate techniques. They are well-known, and used.

Add-on systems that bring airliners back into compliance, which are not by themselves aerodynamically completely compliant to regulations, are literally as old as jet airliners themselves. Many types have stick-nudgers or stick-pushers, and they work fine, and are perfectly sensible to use. But that does not mean one can skip due diligence in developing them, which includes a thorough risk and hazard assessment.

I fully agree Bernd. As someone who has worked for years on aviation safety critical software, I am stunned at the poor specification and implementation for the MCAS software. The Ethiopian flight FDR showing an AoA of 75 – where is the limit check?? Even for software that was (incorrectly) not considered as DO-178C Level A, I still find it impossible to comprehend how someone somewhere in the development process did not suggest to put in a “if AoA > x deg, no trim”, perhaps only as a “just in case – belt and braces couple of lines of code”. It grieves me to think that if they had, we might not have lost 2 aircraft.

IMO the MCAS software has to be redeveloped from scratch as Level A, not just patched. The risk of a bug in the software that could cause an AND runaway has to be reduced to ALARP (As Low As Reasonably Practical).

[MemberBerry]

DaveReidUK, #3647, Icarus2001, quentinc
“… no evidence that it's the case for electric trim.”

Indications in the EASA reference ‘Equivalent Safety Case’ suggest otherwise.
“Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts.”

This has already been discussed, the EASA document refers to the designed limits for electric trim, that do not allow you to trim electrically outside its designed range, even though the range available with mechanical trim is larger, and in some situations you need to access a larger range than manual electric trim allows. Those design limits don't apply when you trim electrically ANU to counter MCAS. They would only apply if you would try to trim further AND electrically, after you reached the AND design limit for manual electric trim (lower than 3.95 units on the 737-800, for example). The opposite direction, ANU, would be unaffected and should work just fine, even when you are trimmed AND outside the designed range for manual electric trim.

[Capn Bloggs]

The Ethiopian flight FDR showing an AoA of 75 – where is the limit check?? Even for software that was (incorrectly) not considered as DO-178C Level A, I still find it impossible to comprehend how someone somewhere in the development process did not suggest to put in a “if AoA > x deg, no trim”, perhaps only as a “just in case – belt and braces couple of lines of code”.
Consider AF447. The design team thought that an aeroplane could not be flying below 60KIAS, so they inhibited the stall warning... We know how that ended.

It could be possible to have an AOA of 75° and appreciate some assistance from the machine (MCAS) to keep the nose from getting there in the first place. The F up was making it reliant on only one sensor.

[etrang]

A simple question from an engineer, why a designer should put a pilot in such situation, why the designer cannot prevent and design a solid system? And why if he is not able to do so the blame is on the operator? A wrong design is a wrong design, no matter how much you train the operators

A simple answer; a designer will do what his boss tells him to do and his boss will tell him to do what increases the share price. A simple answer is that neither Boeing nor the airlines were willing to pay for the cost of a full re-design.

[zzuf]

DaveReidUK, #3647, Icarus2001, quentinc
“… no evidence that it's the case for electric trim.”

Indications in the EASA reference ‘Equivalent Safety Case’ suggest otherwise.
“Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts.”

Now why would a manufacturer limit the thumb switch trim range to even less than the autopilot trim authority, particularly when it could no longer be shown to trim throughtout the required envelope?
How about non compliance with the out of trim dive requirement as mentioned in said equivalent safety determination?
Perhaps the easiest solution was to use the 30lbf out of trim with the wheel rather than redesign the system to be compliant when 3 seconds of no load electric trim operation is applied?

[DaveReidUK]

The opposite direction, ANU, would be unaffected and should work just fine, even when you are trimmed AND outside the designed range for manual electric trim.

Yes, that was my point, supported by the FDR trace.

[alf5071h]

Thanks MemberBerry, #3655

Your helpful description, interpretation of the EASA text, infers that the trim demand will be as required for the flight condition. Even in extreme ‘normal flight’, in-trim conditions, the trim system should not hold any significant load other than that required for a balanced aircraft, which will fly ‘hands off’.

The situation with MCAS malfunction is that the flight condition is not balanced - ‘abnormal flight’; the trim system is creating the flight path deviation which the crew are attempting to correct. A correcting force has to be applied via the trim motor and elevator; these forces are probably much higher than that for the near trim condition.
Thus are the differences in the required force and direction of motion, at or beyond the capability of the trim elect motor ?

The apparent anomaly towards the end of the FDR could be interpreted as a nose up elect trim demand, but no trim movement, yet shortly after MCAS trim demands nose down and the tail moves. This of course is not evidence of a nose up elect trim limit (stall), but remains a possibility.

Is this above a valid position, is it one which the EASA (FAA, Boeing) text might not have considered ?

[Speed of Sound]

That appears to be true for manual (wheel) trim, but there's no evidence that it's the case for electric trim.

Does anyone know whether the friction on the threads of the jackscrew caused by high aerodynamic loading above Vmo is the same whether the motor is trying to trim NU or ND?

[DaveReidUK]

Thus are the differences in the required force and direction of motion, at or beyond the capability of the trim elect motor ?

Peter Lemme, in the link you quoted in your previous post, states:

electric trim motor is designed to not stall out under severe out-of-trim conditions

[kilomikedelta]

perhaps if the software and sensor device drivers were written in assembler by programmers who understood the hardware inter-relationships,these accidents could have been avoided.
I suppose machine language and assembler are foreign languages these days with few practitioners but the MBA's want things done cheap and dirty especially if they can outsource if offshore.

[alf5071h]

Dave, depends on what the design (1970s ?) assumed to be ‘severe out of trim conditions’.
The aircraft trimmed state - the pilots flew the aircraft there (as zzuf #3658 dive) or misplaced tail due to an abnormality - elect trim runaway (where restricting the use of pilot elect trim could be required for safety).

In my previous posts ‘force’ is probably misused; the discussion relates more to torque and hinge moment. Thus the relative location of the point of tail hinge to air load is important.

[quentinc]

electric trim motor is designed to not stall out under severe out-of-trim conditions

I would imagine the forces at the stabilizer, played some part in the setting of VMO, which had now been exceeded.

[SteinarN]

Does anyone know whether the friction on the threads of the jackscrew caused by high aerodynamic loading above Vmo is the same whether the motor is trying to trim NU or ND?




The friction per definition should be the same. However the force required will not be the same.
Think of this as pushing a car uphill against a slight inclination versus pushing it downhill the same inclination. The friction from the wheels running on the ground is the same in both cases, but in the first example you have the added force from the uphill inclination to overcome versus in the downhill example the force from the downhill inclination helps you pushing the car.

[DaveReidUK]

I would imagine the forces at the stabilizer, played some part in the setting of VMO, which had now been exceeded.

The aircraft was more-or-less level and only just above Vmo at the point where those two brief applications of trim occurred.

The widely quoted 500 kts was subsequent to that, the result of the last episode of MCAS AND trim kicking in and the unrecoverable descent.

[threemiles]

perhaps if the software and sensor device drivers were written in assembler by programmers who understood the hardware inter-relationships,these accidents could have been avoided.
I suppose machine language and assembler are foreign languages these days with few practitioners but the MBA's want things done cheap and dirty especially if they can outsource if offshore.

This is a serious system design matter. MCAS does its job as planned. It is just the wrong job. There is no need for assembler to speed anything up. It makes code harder readable, less maintainable and certifyable ... oops.

[bsieker]

Consider AF447. The design team thought that an aeroplane could not be flying below 60KIAS, so they inhibited the stall warning... We know how that ended.


In hindsight that is probably a shortcoming of the risk and hazard assessment of the ADIRUs of the A330, yes. But the rationale for regarding all air data invalid at indicated air speed below 60 knots is that it was simply not known how the aircraft would behave in that regime. And it is sometimes a better idea (although that, too, requires careful evaluation and assessment) to flag all data as invalid (or not deliver it at all) rather than deliver data wich may be wrong.

As far as I recall the A3330 was not flight tested into a full stall, and very few other ways of flying that slow can be envisioned.

On the other hand it is not clear that the "reverse logic" (pitch down in a deep stall: stall warning comes on, raise the nose again: stall warning stops) of the stall warning at very high angles of attack and very low indicated air speeds was a causal factor in the accident: There are some indications that the crew did not only not react to the stall warning, but that they literally did not perceive it. It was lost to cognitive overload.


It could be possible to have an AOA of 75° and appreciate some assistance from the machine (MCAS) to keep the nose from getting there in the first place. The F up was making it reliant on only one sensor.

While the absolute value may be valid (although 75° is probably a bit of a stretch, even AF447 never even reached 50°. but the 25° or so from Lion Air is clearly in an attainable range), some things can also be deduced about the validity by evaluating rate of change, or cross-checking with other values, such as static and total pressures, vertical speed, pitch angle, acceleration, etc., even without cross-checking with the other-side AoA.


Bernd

[threemiles]

The aircraft was more-or-less level and only just above Vmo at the point where those two brief applications of trim occurred.

The widely quoted 500 kts was subsequent to that, the result of the last episode of MCAS AND trim kicking in and the unrecoverable descent.

Also, they were in a 30 degrees bank turn when things started to really go wrong. Almost no pitch, 340 kts, no ability to pull or trim ANU, how can that work out? Before the bank had increased slowly over 2 to 3 minutes for whatever reason.
Then they were flying at 10000 feet, inside a MSA sector of 14000 ft, heading towards range with a peak of 11000 MSL, with little to no climb rate. Albeit in VMC, this alone is brutal.

[bsieker]

perhaps if the software and sensor device drivers were written in assembler [...]

That is possibly the worst suggestion so far.

Assembly code is almost impossible to analyse for correctness in any meaningful way. It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it. That still leaves one with a need to have reasonable confidence in the compiler, but in many cases the service history for the most-used language core, and, in some recent cases, formally verified compilers, take care of that.

Just because you have one hero programmer who claims to have done it "Right" in assembly does not help you in any way because you need to demonstrate that it does what it is supposed to do (reliability), and never does what it is not supposed to do (safety), and ideally also never fails (availabilitiy). And this cannot be demonstrated by testing alone to the extremely high requirements needed in aviation. Assembly and machine code are avoided like the plague in safety-critical programming, and rightly so. Where some parts require it, extreme care must be taken to get it right, and the amount must be kept to a minimum.

Besides, as threemiles has pointed out, the implementation is not the problem (as far as we can tell, it may be flawless), but the specification. "Working as specified" can also mean that it did the wrong thing.

Bernd

[.Scott]

perhaps if the software and sensor device drivers were written in assembler by programmers who understood the hardware inter-relationships,these accidents could have been avoided.
I suppose machine language and assembler are foreign languages these days with few practitioners but the MBA's want things done cheap and dirty especially if they can outsource if offshore.Having programmed in machine language, I would NOT recommend it. It would be very difficult to reach the level of confidence for direct machine code (or even assembly) that would be required for this software.

Just to be clear, we are talking about software that must not allow the MAX to do a mid-flight back flip and/or break up while also not dooming the plane to a high-speed nose dive. And if it fails and is disabled, the pilot may not be able to act fast enough to recover. It's hard to image a software component on an ATP flight that is more critical.

The sequence would be: requirements, requirements review, design, design review against the requirements, test development based on the design, test procedure review, coding, code review, code testing. This requires code that can be examined by several team members with no chance of misinterpretation.

So what is needed it a well exercised development environment - one that's been around for several years and has been very widely used - with a good reputation and version release notes that reflect a solid tool.

[ecto1]

In general, the industry does, and overall does a very good job of it. Input value filtering is normal, and even the A330 that nose-dived in cruise had computers which did. It was done inappropriately, but most of the time the erroneous values were rejected.

The problem here lies much earlier, in specifying the requirements for MCAS. More specifically, the failure modes and the severity and likelihood of each were not properly analysed.



Au contraire. Aviation is the industry which mandates appropriate techniques. They are well-known, and used.

Add-on systems that bring airliners back into compliance, which are not by themselves aerodynamically completely compliant to regulations, are literally as old as jet airliners themselves. Many types have stick-nudgers or stick-pushers, and they work fine, and are perfectly sensible to use. But that does not mean one can skip due diligence in developing them, which includes a thorough risk and hazard assessment.

Bernd
I know some plane computers are properly built and programmed and that part of the industry works ok. That's exactly what I meant with 《we know how to do it》.

What I meant is that there is a 《all or nothing》spirit that doesn't quite cut it. Either is a 8 year development with millions of man hours on it ,or a terrific patch that looks like done overnight. No middle ground.

I'm all in for a cheap patch. The cheapest possible, no need to doom the plane and start over. But if the computers in the plane have no room for improvement, a software patch in 1980s style is not going to be enough. We need sanity checks, cross sensor checks and history checks on ALL sensors. Not only AOA.

Precisely, no software patch will fix the issue of mcas being useless for real life (too slow).

[unworry]

. . .
They faced a continuous cacophony of noise (stick shaker), that has been shown by anecdotal reports in this thread to induce tunnel vision and difficulty doing ANY task, including just flying the aircraft. Two crew were unable to cope, the third had assistance from an additional pilot.

Perhaps as the lawyers are debating and dissecting second by second details, they should do it with the continuous Stick Shaker loop in the background.


Indeed.

https://www.youtube.com/watch?v=TrjTUvhpBlE&t=13s

[.Scott]

It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it.

I doubt that they used C or C++, but given appropriate coding standards, I do not have problems with either. In fact, a major issue with keeping the code in alignment with an understandable design is in what kind of awkward and extraneous semantics the programmers needs to go through to getting the code to do what they want. Languages like C# are advertised as "safer" because they prevent certain types of errors - like memory management. But they add a major layer of code that is unrelated to the final functionality. That makes the really important parts of the code diffused and harder to review.

When I say "appropriate coding standards", the issue is reviewability. So using the C++ support for object oriented coding is good. Using polymorphism or the "virtual" keyword is avoidable - and for an application like this, should be avoided.

[.Scott]

I'm all in for a cheap patch. The cheapest possible, no need to doom the plane and start over. But if the computers in the plane have no room for improvement, a software patch in 1980s style is not going to be enough. We need sanity checks, cross sensor checks and history checks on ALL sensors. Not only AOA.

Precisely, no software patch will fix the issue of mcas being useless for real life (too slow).Interesting. I guess somewhere in this thread is a revelation that the MCAS hardware was too slow - I hadn't heard that. It it's from the 1980's, where they using Ada? That was one of those "safe" languages - but may come with a lot of overhead. If it had been coded in C, there would have been no practical problem with the machine speed.

If I was the FAA, I would not allow the plane to fly without having simulators available that fully simulate operations where the MCAS can work and fail - and then require that the pilots go through the different failure modes before visiting the MAX cockpit. If the MCAS hardware needs to be replaced, replace it.

I think that if Boeing tackles this problem correctly, they could have the planes flying safely in about four months. Or they can go for Micky Mouse fixes and risk either an ineffective fix or a recovery timeline that goes well beyond four months.

[FlightDetent]

While the absolute value may be valid (although 75° is probably a bit of a stretch, even AF447 never even reached 50°. but the 25° or so from Lion Air is clearly in an attainable range), some things can also be deduced about the validity by evaluating rate of change, or cross-checking with other values, such as static and total pressures, vertical speed, pitch angle, acceleration, etc., even without cross-checking with the other-side AoA.MelVic's original remark read to me that accepting 75° raises questions how was the input validation done if at all.

[KRH270/12]

Hi,

can anyone pls explain to me, why they had an IAS disagree with just an AOA sensor fault.

I thought the pitot/static system is independent...or is there some „mixing of data“ going on in the ADIRUs?

thx

[edmundronald]

Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.


Edmund

[bsieker]

What I meant is that there is a 《all or nothing》spirit that doesn't quite cut it. Either is a 8 year development with millions of man hours on it ,or a terrific patch that looks like done overnight. No middle ground.

I'm not sure what gave you that idea. There are various levels of criticality for different pieces of software.

However, there are bigger issues at stake. MCAS has the potential, without quick and correct intervention by the crew, to cause a catastrophic outcome ("catastrophic" is not just a fancy term, it is quite well defined in certification specifications.) Therefore software for systems with such severe possible consequences, need to be developed to particularly stringent standards of requirements specification, analysis, coding practices, planning, documentation, verification, etc. That is what some people here mean when they refer to "DAL A" or "Level A": That is the most stringent category for safety-critical software in airborne systems, as defined in DO-178C (or ED-12C in Europe, which is excatly the same standard):


Level A: Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a catastrophic failure condition for the aircraft.


As we now know, MCAS is just such a system. So, as others have pointed out repeatedly, at least in hindsight, anything less than Level A is not appropriate.

Objectives that need to be demonstrated include things like

High-level requirements are accurate and consistent.
Low-level requirements are verifiable.
Software architecture is verifiable.
Source Code is verifiable.
Source Code is traceable to low-level requirements.
Source Code is accurate and consistent.
High-level requirements are accurate and consistent.
Low-level requirements are traceable to high-level requirements.

And many more. That is "the cheapest fix possible". It's not cheap, but it's doable in significantly less than 8 years for a company which has the procedures in place, which Boeing does.


Bernd

[FlightDetent]

1) CAS is derived from pitots and static using an adjustment for AoA.

2) To disable MCAS: physically workable suggestion but knowingly failing a certification requirement is not an option.

[jimtx]

Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.


Edmund

Agreed, waive the Part 25 criteria and show the handling change in the sim. It would be nice to know what that envelope is. I'm surprised 737 pilots, pre the final incident, were happy flying an aircraft where if they were unlucky enough to apply the Emergency AD, they then would be at risk of encountering the envelope without MCAS and Boeing/FAA do not even warn about it in the AD.

[HighWind]

That is possibly the worst suggestion so far.

Assembly code is almost impossible to analyse for correctness in any meaningful way. It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it.
I would assume that it is either SCADE, or Simulink.
Both tools generate C code, but with SCADE you don't have to inspect the C once the tool chain have been qualified. (Considered the safest alternative of the two)
SCADE is used by Airbus (Both French products), and Boeing might use Simulink.
But this is irrelevant for this discussion since the fault is in the specification, not the software.

[EDLB]

I think that if Boeing tackles this problem correctly, they could have the planes flying safely in about four months.

My guesimate is more a year if they have already started and they are lucky. Can easily be more. A Level A software piece need to run on a hardware worth that level. Don’t think that they have it in the 737 so they will need an additional box.
So I don’t think that the MAXes in storage will hit the friendly skies anytime soon.

Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.

[PiggyBack]

There are a lot of confident and ridiculously detailed statements about the softare use din MCAS even the language used to code it. None of thsi is relevant. It is clear that the root is a system design error compounded by a failure of hazard and failure analysis and the regulatory/certification process.

I can see quick fixes which address the deficiencies in the way MCAS responds to erroneous inputs which from a functional point of view make the behaviour safe. I can't see a quick fix which address the wider hazard/failure analysis and regulatory concerns.

I write safety related software but discussing which language or tools to use to develop SW when the fundamental concept is flawed make no sense. The best solution to a safety hazard is intrinsic - remove the hazard, in this case that means aerodynamic changes and I assume that won't happen but it should have been thought about at the design stage. If intrinisc safety is not possible then a functional safety like MCAS is possible but the consequences of failures must be considered and controlled and any additional hazards by introducing the functional safety sub-system must be considered. I assume this was done, at least in the formal sense but it seems to have been done inexplicably poorly. This was not a case of a complicated combination of unlikely events but an entirely forseeable concsequence of a single failure. IF MCAS is retained it has to be designed and developed appropriately given the impact of it failing and that is not going to happen very quickly.

Ther eis no evidence I am aware of that the software did anything other than what it was intended and specified to do. Even the software specification was not really the eproblem. The problem was the overall system design and the safety analysis behind it. It is actually quite shocking and shoud result in a very deep analysis of both the development and regulatory processes.

[Golf-Sierra]

In hindsight that is probably a shortcoming of the risk and hazard assessment of the ADIRUs of the A330, yes. But the rationale for regarding all air data invalid at indicated air speed below 60 knots is that it was simply not known how the aircraft would behave in that regime.

I think you are either missing the point or perhaps I do not fully understand what you mean. In real life reality an A330 could not be at or below 60 knots kias other than either with the wheels on the ground or during some quite spectacular upset - and even then it would last for maybe a few seconds. I think the only sensible rationale was to reject an indicated airspeed of 60kts for an airliner in cruise many tens of thousands of feet above the ground.


Golf - Sierra

[Water pilot]

The problem looks intractable to me but that is why "A team" engineers exist. I didn't think that they were going to get the tunneling machine that got stuck under Seattle working again, but they did. Whether or not the public ever trusts the plane and whether SouthWest and Boeing survive without a government bailout may be another question.

The overall problem is far more insidious than relying on a single sensor, and I think that is what they are running into. Moving the stabilizer seemed like an elegant solution but there are circumstances where moving it can get it stuck due to aerodynamic forces. This requires heroic efforts from the pilots to unstick it (whether or not that was a factor in either accident is being debated). Low cost airlines can't afford to hire hero pilots, and an alternative plane exists that does not require them (allegedly.)

What I don't understand is how the system met the requirement for a continuous pressure gradient on the stick (I'm probably phrasing that badly.) So you have constant pressure when pulling the jetliner up rapidly to avoid that drone in your path, which is great because you don't get a sudden light stick sensation that lets you pull up too far into stall, but now push down to get back to level flight. This is probably yet another stupid question, but with the stab trimmed down, aren't the stick forces pushing down going to be much lighter than they normally are? I haven't seen anything -- although I could have missed it -- that MCAS trims back up when the AOA decreases, that is supposed to be noticed and handled by the pilot. This may be a reasonable assumption, but remember this is the pilot who couldn't be trusted not to pull the plane into a stall!

[infrequentflyer789]

[left]Hi,

can anyone pls explain to me, why they had an IAS disagree with just an AOA sensor fault.


On that point - can you show where it is confirmed that they did have IAS disagree, because as far as I can see it isn't mentioned at all in the report.

IAS is divergent (expected as ADIRU does use AOA to correct it, and AOA is massively diverged), but IAS DISAGREE isn't confirmed. I am pretty certain it should have happened, particularly given that it did with LionAir with AOA far less divergent, however there are several oddities in the narrative and traces that I can't get my head round at all.

[Avionista]

EDLB:

Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.

The FAA stuck their neck out already when they nodded through the original MCAS bodge and look at the mess that has got them into. I don't think they will approve any B737 MAX fix without first getting the agreement of other important regulating authorities such as EASA, Canadian CAA, Chinese CAA, etc. If a further catastrophe were to occur the FAA will want to be able to say that the 'fix' was also approved by other regulators. Also, for the commercial success of the MAX it has to be approved for operations in Canadian, European and Chinese airspace.

[bsieker]

In real life reality an A330 could not be at or below 60 knots kias other than either with the wheels on the ground or during some quite spectacular upset - and even then it would last for maybe a few seconds.

Golf - Sierra

Well, that assumption turned out to be false for the A330. It was in this spectacular upset, with indicated airspeed < 60 kts, for almost 3 minutes with only short interruptions. During almost the entire time (again, with only brief interruptions), computed airspeed values alternate between 400, 45, 0, 45, 400, etc. where both 0 and 400 are recording artifacts, and the 45 possibly more or less accurate. During periods where the values were valid again, computed airspeed rose to 150, 120 and 100 knots, respectively, before returning to the invalid values.

Bernd

[ATC Watcher]

My guesimate is more a year if they have already started and they are lucky. Can easily be more. A Level A software piece need to run on a hardware worth that level. Don’t think that they have it in the 737 so they will need an additional box.
So I don’t think that the MAXes in storage will hit the friendly skies anytime soon.
Or does anyone believe that the FAA will stick their neck out and allow the next “quick fix”.
As mentioned already , maybe the FAA, but not the Canadians and EASA to name only two, Then the Max will be restricted to domestic US , which is maybe what will happen in the end., as in previous cases, and then possibly a new " Super 737" or even 797 will roll out with some new features , @ la MD-11.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .

[Water pilot]

Thanks for your explanations. Since it would be another lottery win the thumb switch going south at that exact instance (besides why less, not no stab movement): Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?
Not particularly remote since it was the left side that the shaker was active on. We don't really know how the thumb switches operate, at first I thought that they were just switches to a solenoid but it seems more likely that they are just inputs to the fancy two computer/four processor 'black box' that is part of the flight control system. At that point, anything is possible since it is software.

[gums]

Salute!

Thanks, bernd

Guess many were not there for the megathon AF447 discussion about the stall warning relationship to the Aoa when speed was under 60 knots.
On that night, the plane proved it was very stable in a deeply stalled part of the envelope, and had only a slight change in heading versus a violent yaw/roll . So smooth that the crew didn't understand that they had actually stalled - no stall warning audio due to the 60 knot criteria and the "you can't stall this plane" mentality of many at the time.

Gums sends...

[Lost in Saigon]

Why not just disable MCAS, leave the pilots to trim as usual, and retrain them a bit to deal with the feel of the plane at a high AoA?
Zero software to write, and no new bugs introduced.
Because as they say in the industry, new features always means new bugs.


Edmund

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed. If you disable MCAS, the B737 MAX will not meet the FAA stability requirements of Sec. 25.173 (Static longitudinal stability)

I suspect that without MCAS there would need to be a major aerodynamic redesign to meet the stability requirements.

[RatherBeFlying]

I spent a large part of my career deep in mainframe Assembler applications and operating systems. A lot of it was really good and some was absolutely dreadful.

The principal determinant of success was elegance (or lack thereof) in design.

Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.

Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.

[threemiles]

As mentioned already , maybe the FAA, but not the Canadians and EASA to name only two, Then the Max will be restricted to domestic US , which is maybe what will happen in the end., as in previous cases, and then possibly a new " Super 737" or even 797 will roll out with some new features , @ la MD-11.
I know of 2 European airlines now that have taken out their stored Max from their Summer schedule altogether, and one is using this as a marketing thing to get their pax back during the Summer.
I am not sure about Air Canada , but I am going to OSH at the end of July and one domestic leg was on a Max, and I was two weeks ago rescheduled on a different flight at a very different time on an A321. So it would seem that also Canada is not expecting to get them flying soon. .

Re-scheduling has nothing to do with "expectations". You have to keep managing the operations about 180 days in advance, i.e. availability of the right aircraft and crew at the right time, feeding the res systems with the right capacity and classes, and so on. The deadlines are different for each airline but 90 days before take-off everything needs to be fixed.
Doing otherwise is gross negligence and you'd have a good chance to never get to OSH.
That means, if the Max fleet is back before, it is just up to daily operations to fuse it in again.

[yanrair]

Well, that assumption turned out to be false for the A330. It was in this spectacular upset, with indicated airspeed < 60 kts, for almost 3 minutes with only short interruptions. During almost the entire time (again, with only brief interruptions), computed airspeed values alternate between 400, 45, 0, 45, 400, etc. where both 0 and 400 are recording artifacts, and the 45 possibly more or less accurate. During periods where the values were valid again, computed airspeed rose to 150, 120 and 100 knots, respectively, before returning to the invalid values.

Bernd
What was the most accurate speed readout on the plane indicating, during AF447 and the recent two MAX incidents - that being the GPS?? In AF447 it was reading something like 450 kts at the time of losing IAS. It is not going to change unless you do something like change pitch or power. Which is what happened to AF447 of course. You can fly on GPS speed for a long time until you have sorted out the problem. You can fly an immaculate circuit to land using just GPS. Yet in all the posts so far I have not seen much reference to its use in sorting out conflicting IAS/Stick shaker style events. Climbing out at 15deg pitch, 200 kts IAS Full power. GPS will be reading something similar, depending on wind and altitude. All hell breaks lose ( I am ignoring MCAS here which is a separate matter). Indicated speed all over the place. IAS disagree messages. Stick Shaker going off (one side failure) - what to believe?? Your GPS PITCH AND POWER. They are real, they are going to work and are unaffected by the ADIRU which relies among other things such as AOA and Indicated Airspeed.

[KRH270/12]

On that point - can you show where it is confirmed that they did have IAS disagree, because as far as I can see it isn't mentioned at all in the report.

IAS is divergent (expected as ADIRU does use AOA to correct it, and AOA is massively diverged), but IAS DISAGREE isn't confirmed. I am pretty certain it should have happened, particularly given that it did with LionAir with AOA far less divergent, however there are several oddities in the narrative and traces that I can't get my head round at all.

eh, the FDR readout from the preliminary report shows some 20kt disagree and the non normal checklist for AOA disagree mentions possible IAS and ALT disagree....

so i wonder whats going on in the ADIRUs... the MAX documentation I got is no help at all...

[gums]

Salute Water !

Great point about hybrid systems as we see with this plane. I do not normally like big quotes, but need to include to set the stage
Quote:Originally Posted by
spornrad https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10441348.html#post10441348) Is there any remote possibility that software reduces the thumb switch authority on the left, not right, in those conditions (AOA disagree/MCAS activation) ?
Water replies:


Not particularly remote since it was the left side that the shaker was active on. We don't really know how the thumb switches operate, at first I thought that they were just switches to a solenoid but it seems more likely that they are just inputs to the fancy two computer/four processor 'black box' that is part of the flight control system. At that point, anything is possible since it is software.

If the data we have thus far on the architecture is close to accurate, then the MCAS software or maybe a switch somewhere that feeds the software or ..... ignores some of the previous model features that disabled some trim functions if the control column was pulled or pushed in opposition to what HAL was commanding.

It's the problem with a hybrid system, and a kludge one at that. The 'bus and military FBW systems give up from the beginning, and admit that the computers read control inputs and then give the pilot all the capability the plane has. The interfaces with the controls and computers are strightforward and easy to troubleshoot. It's also easy to determine whether you have a sensor problem or a stick problem or faulty gear/flap position switch and so forth.

Hate to break the bad news to our old, experienced 737 pilots who were unaware of MCAS and how it was implemented, but this new kid on the block ain't the one you flew 5 years ago. We now have had three documented cases where all the pulleys, levers and cables were not enough to overcome stabilizer trim position due to a kludge hdwe/sfwe "fix" to meet the aerodynamic requirements of the certification requirements. You know? Make the thing act/feel like "real" planes are supposed to act/feel.

Since 1973, we have only had a half dozen or so FBW failures in the F-16 that resulted in loss of the aircraft. They were primarily related to power supply design problems, wiring harness chafing, and in one case the loss of the radome due to a pelican impact that destroyed AoA and other air data sensors ( plane flew for another 8 or 9 minutes using just rate and attitude sensors before the pilot used the nylon let down).

I would also put up the Airbus statistics along with those of that little jet I first flew 40 years ago and the newer ones like the Raptor and Stubby (F-35). And be advised that the Stubby does not even have hydraulic lines to some control surface actuators. They are powered by electric motors or electrically powered hydraulic pumps. Makes for survivability if one of your ailerons is blown off by flak, see?

Gums sends...

[jimtx]

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed. If you disable MCAS, the B737 MAX will not meet the FAA stability requirements of Sec. 25.173 (Static longitudinal stability)

I suspect that without MCAS there would need to be a major aerodynamic redesign to meet the stability requirements.

The autopilot does not need MCAS. I don’t know which part of 25.173 MCAS was there for but I thought it was the stick force gradient. There is an exception to the trim speed requirement if exceptional attention is not required of the pilot. The lack of concern of FAA/Boeing to identify an envelope of concern if you actually had a malfunction involving turning off MCAS makes me think you could certify the MAX without MCAS if waivers are allowed for Part 25.

[astrodog3]

It is pretty basic. An aircraft has to fly like an aircraft. If you pull the nose up, and then release back pressure, the nose must return to somewhere near the original attitude and speed.
All indications are that the MAX does this.

What MCAS does is insure that the pilot must keep pulling on the control column harder and harder to continue pitching the nose up further as AoA rises. It was added because the regulations do not allow the resisting force of the column to decrease as elevator input increases and AoA rises.

The Lion Air and Ethiopian crashes seem to have occurred because the aircraft was unable to accurately judge if it was in this flight regime, and in the short, distracting time available to them, it did not occur to the pilots to perpetually counter AND trim from MCAS with ANU trim of their own or to trim the aircraft to neutral and then disable electric trim completly.

[1066]

If it is true that SWA were a major push for the common type rating for the Max, (comments somewhere above in this thread that SWA could be in line for $1m per aircraft ordered if sim time was required for Max conversion), SWA were consistent with the way they influenced the introduction of the NG again with the intention of a common type rating for the NG and the 'classic' 300/400. I understand that the NG could have had a flight deck much like the 747-400 but this was ruled out to ensure the common type rating.
I'm not blaming SWA for any part in these two accidents but I think their part, as a very large customer, in the development of the 737 is relevant.

1066

[TachyonID]

If it is true that SWA were a major push for the common type rating for the Max, (comments somewhere above in this thread that SWA could be in line for $1m per aircraft ordered if sim time was required for Max conversion), SWA were consistent with the way they influenced the introduction of the NG again with the intention of a common type rating for the NG and the 'classic' 300/400. I understand that the NG could have had a flight deck much like the 747-400 but this was ruled out to ensure the common type rating.
I'm not blaming SWA for any part in these two accidents but I think their part, as a very large customer, in the development of the 737 is relevant.

1066

Well, one of the "lined up holes in the cheese" here will undoubtedly be the question of which parties provided fiscal incentives to cut corners.
As an aero engineer, I'm appalled at Boeing's response. It is after all their design.
As a pilot, I'm disappointed in the design decisions that led to this point.
As a stakeholder in the aviation industry, though, we'll eventually get to the question of whether the industry leaders with the purse strings applied too much pressure that rippled through some bad decision making. If SWA offered $1M per plane to "not need additional simulator time"... well it will get interesting.

[fergusd]

I spent a large part of my career deep in mainframe Assembler applications and operating systems. A lot of it was really good and some was absolutely dreadful.

The principal determinant of success was elegance (or lack thereof) in design.

Same applies to C, C++ and all the wonderful new development environments that these days are proliferating faster than I can keep count. You may as well be in the fashion industry as bleeding edge IT.

Likely the A & B folk are sticking to well understood and proven development environments that are behind the times.

Simplicity, understandability and testability . . . and these days provability.

Modern safety standards strictly limit the use of assembler, because it meets none of the criteria above at all.

C is going the same way on some of those criteria IMHO especially as software complexity inevitably increases, C++ with very strict limitations (basically like very strongly typed C) has many things going for it with appropriate mitigations.

I don't think anybody would consider what I describe as anything other than archaic in terms of modern software development, about as far away from fashionable as it's possible to get.

;-)

Fd

[TryingToLearn]

Having programmed in machine language, I would NOT recommend it. It would be very difficult to reach the level of confidence for direct machine code (or even assembly) that would be required for this software.

The sequence would be: requirements, requirements review, design, design review against the requirements, test development based on the design, test procedure review, coding, code review, code testing. This requires code that can be examined by several team members with no chance of misinterpretation.


I fully agree, as an example the automotive functional safety process has the following steps:
-> Hazard & Risk analysis
-> Functional safety concept
-> Technical system safety concept
-> System achitecture
-> Technical Software Safety concept
-> Software architecture
-> fine design
-> implementation (code writing)
-> Module test
-> SW integration test
-> System integration test
-> System test
-> Vehicle Integration test
It is recommended to write technical safety documents in formal language to exclude misinterpretation. Implementation is less than 10% of the work. Toolchain qualification is also an important part of the process. Even the best compiler may cause errors if the memory module within the programmer's laptop has defective bits... (Yes, it already happened).
All documents are to be reviewed, accessed, there are walkthrough meetings and so on. All requirements need to have verification criteria specified together with the requirement and test cases are later based on there criteria... Within accessments, certain levels of safety require a certain independence between accessor and author (other team, department, division, company...).

Safe code can be done and if this was skipped just because one feared a diagnosis (AoA disagree), reaction (deactivate MCAS) and pilot teaching (continue flying, you probably never need MCAS anyway), this is a violation of safety culture beyond my imagination.
Fun fact: Emission standards for cars (onboard diagnosis 2) require 2 out of 2 for every sensor which may cause the violation of emission standards (ULEV, EU6...) and the engine control light on disagree. Seems like this is more important than a few hundred airplane passengers...

Oh, just one question:
People claim that the manual trim may not be operable in certain flight conditions while the electric trim motor is more powerful.
On the other hand the manual states that in case CUTOUT does not work, one should grasp and hold the wheel (?against the motor?). Did I miss something?

[MarcK]

I don't think anybody would consider what I describe as anything other than archaic in terms of modern software development, about as far away from fashionable as it's possible to get. ;-) Fd Maybe someone thought that "Agile" was the way to implement MCAS.

[sycamore]

Anyone care to say what the aircraft trim change is at 350kts if you pop the speedbrales...?

[FrequentSLF]

Not particularly remote since it was the left side that the shaker was active on. We don't really know how the thumb switches operate, at first I thought that they were just switches to a solenoid but it seems more likely that they are just inputs to the fancy two computer/four processor 'black box' that is part of the flight control system. At that point, anything is possible since it is software.
I am not a pilot, but it happens I can understand electrical schematics, the stab one is messy, clearly has been patched and subject to additions over the years with a mix of relays logic, analog and digital. The thumb switches are inputs to a fancy block, but they are hardware interlocked by column swtiches, cutout, etc. MCAS does not even compute the cutout switches...i do not believe the SW has any major control on thumb switches, Imcannot post the circuit from mobile, but,was posted earlier on this thread

[VicMel]

As we now know, MCAS is just such a system. So, as others have pointed out repeatedly, at least in hindsight, anything less than Level A is not appropriate.

It did not need loss of an aircraft to decide MCAS should be Level A, any software that has direct control of a piece of equipment, which if erroneously controlled could lead to a fatality, IMO must be Level A. So, MCAS should have been Level A from its original conception, if nothing else, in order to reduce the risk that the software will get “stuck in a loop” and just drive the stabiliser straight to its physical limit as fast as it will go! And I’m not too keen on the idea of putting non-Level A software in the same box as Level A software (assuming that the rest of the FCC software is Level A). Proving isolation and non-interference is very difficult.



Objectives that need to be demonstrated include things like

High-level requirements are accurate and consistent.
Low-level requirements are verifiable.
Software architecture is verifiable.
Source Code is verifiable.
Source Code is traceable to low-level requirements.
Source Code is accurate and consistent.
High-level requirements are accurate and consistent.
Low-level requirements are traceable to high-level requirements.

And many more. That is "the cheapest fix possible". It's not cheap, but it's doable in significantly less than 8 years for a company which has the procedures in place, which Boeing does.

Bernd
Boeing must realise that if there is another software “event” involving a 737 MAX, even if it has nothing to do the AoA, they will lose the public’s confidence completely. They really need to do an over-the-top job here, MCAS (and possibly other systems) need to be upgraded to A+. This should include (at least):-
a) fully independent (i.e. not another department of Boeing) verification of the items in the “objectives” list.
b) verification of robustness of code, preferably using tools to check for such things as poorly defined end condition of loops, depth of subroutine calling to prevent stack corruption, full timing analysis to prove there is no “timing overloaded” path etc., etc.
c) asking “what ifs” involving pilots, hardware team and experienced assessors, e.g. what information would pilots need to know to deal with a fault, what hardware idiosyncrasies need to be considered, what else could go wrong.
d) ensuring that every input is either from another Level A system, or validated by the new MCAS software
e) storing important status (e.g. flaps up) as a code and its complement, not as a single bit.
f) making MCAS an integral part of FCC i.e runs in both channels, if the outputs disagree the controller (could be the pilot, which would be a bit radical!) decides what to do
g) upgrading other systems to make them more robust e.g. ADIRU.

Redoing MCAS as Level A ready for submitting to the certification process should be relatively straight forward, I'd estimate 1 to 2 years; how long to ensure that supporting systems are brought up to an appropriate level (ADIRU to Level A?), 2 to 4 years perhaps. Achieving global certification, no idea.

[threemiles]

What was the most accurate speed readout on the plane indicating, during AF447 and the recent two MAX incidents - that being the GPS?? In AF447 it was reading something like 450 kts at the time of losing IAS. It is not going to change unless you do something like change pitch or power. Which is what happened to AF447 of course. You can fly on GPS speed for a long time until you have sorted out the problem. You can fly an immaculate circuit to land using just GPS. Yet in all the posts so far I have not seen much reference to its use in sorting out conflicting IAS/Stick shaker style events. Climbing out at 15deg pitch, 200 kts IAS Full power. GPS will be reading something similar, depending on wind and altitude. All hell breaks lose ( I am ignoring MCAS here which is a separate matter). Indicated speed all over the place. IAS disagree messages. Stick Shaker going off (one side failure) - what to believe?? Your GPS PITCH AND POWER. They are real, they are going to work and are unaffected by the ADIRU which relies among other things such as AOA and Indicated Airspeed.

There is a THIRD and independant IAS speed tape on the flight deck, right above the gear announciators.

​​​​GPS delivers ground speed and is of little value, unless you are close to MSL in calm air.

[737 Driver]

Anyone care to say what the aircraft trim change is at 350kts if you pop the speedbrales...?
That maneuver is above Vmo, so unlikely anyone here could say. However, just below Vmo I seem to recall that there is a very mild pitch up and completely manageable.

[njc]

Furthermore, it is apparent that MCAS is unaware of the position of the stab cutout switches, because it still tried to trim while the switches were in cutout.Well yeah, it tried to trim, but only once. Does that mean that it figured out it was having no effect or that it only activates once and then waits until the pilots hit the trim switches again before having another go?
I can't understand how the latter would make any sense or indeed how it could have satisfied the requirement for which MCAS was invented. The former doesn't make a lot of sense either though.

[ams6110]

I fully agree, as an example the automotive functional safety process has the following steps:
-> Hazard & Risk analysis
-> Functional safety concept
-> Technical system safety concept
-> System achitecture
-> Technical Software Safety concept
-> Software architecture
-> fine design
-> implementation (code writing)
-> Module test
-> SW integration test
-> System integration test
-> System test
-> Vehicle Integration test
It is recommended to write technical safety documents in formal language to exclude misinterpretation. Implementation is less than 10% of the work. Toolchain qualification is also an important part of the process. Even the best compiler may cause errors if the memory module within the programmer's laptop has defective bits... (Yes, it already happened).
All documents are to be reviewed, accessed, there are walkthrough meetings and so on. All requirements need to have verification criteria specified together with the requirement and test cases are later based on there criteria... Within accessments, certain levels of safety require a certain independence between accessor and author (other team, department, division, company...).

Safe code can be done and if this was skipped just because one feared a diagnosis (AoA disagree), reaction (deactivate MCAS) and pilot teaching (continue flying, you probably never need MCAS anyway), this is a violation of safety culture beyond my imagination.
Fun fact: Emission standards for cars (onboard diagnosis 2) require 2 out of 2 for every sensor which may cause the violation of emission standards (ULEV, EU6...) and the engine control light on disagree. Seems like this is more important than a few hundred airplane passengers...


And yet Tesla, an automotive company which presumably follows this process, still has an "auto pilot" software function that on more than one occasion drove a car into a stationary object at 70mph.

I would have little doubt that the software people at Boeing know how to develop software for any level of assurance needed. The question is why was MCAS not seen as a "critical" system?

[A. Muse]

I have followed this thread from the beginning, and read all of the posts, and some of the deleted ones, (thanks to the mods for keeping things on track and removing the abuse).

Two posts stick in my mind and I have been waiting for someone with more knowledge than me to put 2 and 2 together and make 22, so I’m ready to be shot down in flames.

Way back someone posted that in the rush to market Boeing might not have given full instructions for the installation of the wiring in the Max as was normal practice with previous builds. IF this is a fact and not hearsay or fabrication, is it possible that a wrongly routed, worn, stretched or chafed wire or faulty connection is partly to blame for the AoA readings? I link this to Post 3234 by jimjim1If the vane had been lost the AoA sensor would become unbalanced about its usual axis of rotation. The internal balance weight** would then cause the axle to be subject to movement when the aircraft transitioned from +g to -g. +g would cause the indication of +AoA. (If I have got this the right way round).

Looking at the FDR traces it can be seen that this appears to be the case. I have drawn four green vertical lines to indicate the transitions from +g to -g and vice versa. In each case they appear to align with a change in the direction of movement of the sensor in the correct sense. Remember that the data consists of discrete samples and we do not know the sample rate and I am assuming that any small discrepancies are due to errors introduced by the sampling.

I have (rather crudely) chopped out a period in the middle of the chart so that it is a bit narrower so that the scale markings can be easily seen. The horizontal blue line in the "g" section of the chart is coincidentally exactly on 0g.

It therefore seems quite likely that the vane was lost or perhaps damaged soon after take off, perhaps by a bird strike or otherwise. Note however that if the vane had been bent back its balance would be moved in the other direction and its aerodynamic influences would still have been felt so I think that the best conclusion consistent with the data is that the vane was lost. If the transition from +g to -g caused a wiring loom or connector to move and interrupt a current or produce an unwanted one, would this have the same effect on the instruments and controls as a faulty AoA vane?

Sadly we can never know how things were installed on the two lost aircraft, but checking of the routing and condition of cables and connectors in the grounded planes might be advisable.

[ecto1]

Electrical gremlin highly unlikely in Ethiopian event, because the vane readings when the plane dives are there, and spread all over the range. The vane essentially turned into a g-meter, either by loosing the exterior part of it or the connection to the exterior part of it.

Indonesia, OTOH, it is possible, although highly unlikely. However, It is still in my eyes the most probable explanation (short signal to ground with high resistance).

[threemiles]

How is it sourced though?

Aux pitot & alternate static sources, no ADC/ADIRU’s.

https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/700x486/image_523fdddbfae3e36124cf8e43c5faac49bf363b2a.png

[infrequentflyer789]

How is it sourced though?

Pretty sure it is from the third set of pitot/static sensors, without AOA correction - since there isn't a third AOA sensor.

[threemiles]

Pretty sure it is from the third set of pitot/static sensors, without AOA correction - since there isn't a third AOA sensor.

The question was about using GPS ground speed when there is IAS disagree /UAS.

[Loose rivets]

Harnesses. I watched the making of the A380 quite recently. Finding some of the harnesses were too short was a jaw-dropping moment.

[ecto1]

GPS speed could be used to have an approximation to real airspeed in case your air data is lost. The error would be huge if you don´t program it carefully (basically wind speed=error). However, if you assume that the readings from air sensors were right to the point in which you had a disagreement, you can calculate the wind at that moment (strictly speaking, an average of the last seconds) and assume a persistent wind vector. The error in the very first moments of "GPS synthesized" airspeed would be negligible, even in a turn. As the aircraft moves and wind conditions change, error will grow, being immense in worst case scenarios and longer times.

Same applies to Inertial speeds.

It could even be possible (maybe some planes do it nowadays, I'm no expert) to compute a real airspeed without air data. At any given moment of the flight, the airspeed is the only unknown parameter of a vector F = m x a, because mass is accurate to some degree from load sheets, acceleration you can measure with the inertial platform and the force is the result of adding the trust of the engine, which is calculated out from engine conditions and tabulated air conditions from GPS altitude, and the lift + drag, which relates to air speed and air conditions with a known characteristic.

In other words, the plane knows its airspeed just by feeling how pitch and thrust translate into acceleration (longitudinal, vertical and lateral) at every moment.

Sure the error will exist (almost every part of the calculation is an estimation), but it would be tolerable (as a backup, say 20 or 30 knots) and it will valid over long periods of time.

This concept of multiple possible ways of calculation of a magnitude is valid with many others (altitude) and to me is one of the things the plane could do before just going all UAS on you.

I dream (it is free) of a dial with a very precise reading when all sensors are working that turns into a less precise reading (a sector instead of a thin needle) when errors are expected, because of alternative calculations. "250 knots with 50 knots error" is a lot better than "250 knots but do not believe it much because another sensor reads different". (And a stick shaker and overspeed clacker on top of it, just to get things interesting).

[Rananim]

We can't see the wood for the trees.
We've got so immersed in MCAS that we're missing the point. Its not MCAS,its the UAS.
This one was just a faulty sensor(not even UAS) Captain's side.They could have engaged AP B,pulled Capt's stick shaker cb,and flown to NBO(no just kiddin).
But thats all it was.....,a failed sensor.
FO gets some disagree flags but his side is good,so is ISFD.And yet the stick shaker and the master caution and the Captain's PFD flags all conspire to make it seem dire.Only the Captain's
shaker was active so they know immediately its not a real stall.
ISFD agrees with FO ASI which agrees with IRS GS....an experienced FO would nudge the skipper@Looks like your side is down,shall I take it?"
We had one poster come on and say he'd climb to MSA and run the Boeing UAS NNC bla bla bla.
This was not UAS.
UAS comes in many forms and can be a nasty scenario on a dark night in IMC.If you're in cruise,I prefer the old Boeing NNC(ie do nothing).
The new NNC is there to cover the possibility you were not in stable flight prior to UAS.After takeoff,you need to make a diagnosis quickly to establish what you're facing....is it single side?is it a
sensor?is it a genuine pitot-static blockage and which one is it,pitot or static....the aeroperu crew had blocked statics so altimeter registered no climb and ASI undereads on climb out.It was night but VMC.If they had climbed to 1500' using radalt as altimeter and IRS GS as speed reference, they would have landed safely after a visual circuit but...you need to have that info and diagnosis in the memory
database.Its not something you can intuit in the moment.
The worst thing they did was climb away from Lima as they lost their altitude reference and their speed reference became less accurate the higher they climbed.
MCAS is the presumed culprit....but MCAS alone didnt bring this aircraft down.Nor the Lionair.It was the crew's inability to diagnose what type of UAS failure they were facing and failure to just simply
fly the plane.If MCAS would activate alone,any crew would simply counter-trim and cut off its electrical supply without much thought. But combine it with a "confusing" UAS scenario and shakers and
warnings and bingo..you get a smoking hole in the ground.
So these UAS scenarios have to be taught in the classroom and sims to all crews so that when the time comes they can make a diagnosis and take the right action.Boeing tell you nothing,they just give you a flight attitude and thrust setting to follow.Pilots have to be trained more on these UAS scenarios before they kill again.
Aeroperu,birgenAF447 and the 2 MAXs,and others.....
Re manual trim...have we had any engineering input as to just when manual trim no longer becomes available in the flight envelope?Is it primarily speed dependent,stabilizer positon-dependent,yoke dependent,or a combination of all 3?
Where is FCENG 84?

[yanrair]

There is a THIRD and independant IAS speed tape on the flight deck, right above the gear announciators.

​​​​GPS delivers ground speed and is of little value, unless you are close to MSL in calm air.
Hi Three Miles. I don't know if you have tried the following but it works ..........

The Standby instruments are basic non corrected airspeed altitude, Horizon and ILS. You an fly a successful approach using just these with all else failed.
An additional value of these third readouts is when you get an disagree between the to main ASI or ALT readouts, the third man can be judge and jury if used carefully.
Indeed that is how you often resolve AIS disagree issues. Which two agree?

Now to Groundspeed GPS. It is a remarkably useful and I would say essential tool in cases of confusion as arose on AF477 and might have been factors in the recent MAX cases. And in many cases total hull loss with loss of airspeed over the years GPS would have got them down safely. You can easily compensate for wind and True Airspeed using simple knowledge of groundspeed at various altitudes.
From cruise altitude right down to touchdown your flight plan has the groundspeed for every leg based on your track, altitude and forecast wind,accurate to within maybe 5 kts. You just fly it using the tables provided by Boeing in the QRH which give pitch and power for every flight condition, weight related. Remember that to crash you have to be wildly out on airspeed. if AF 477 had maintained current GPS speed at time of failure (450 KTS or whatever it was) and not made adjustments to power and pitch, and not got below say 400 kts groundspeed /GPS they could have flown home to Paris, or certainly long enough to work our what was wrong. I have seen demonstrated over the years pilots practice GPS only flying from Altitude to touchdown (on simulators) with no effort whatsoever with NO other data. On 737s during initial type rating training we would put beer mats with blue tack over all the instruments except SBY and GPS and they could fly a perfect circuit even with no ALT readout using GPS and radio altimeter below 2500 feet.
The Tristar taught flying GPS G SPEED approaches in serious headwind landings - none of this is new, but it is being forgotten. So here we have big jets using this technique when it is the very opposite of still air!
Cheers
Y

[fergusd]

And yet Tesla, an automotive company which presumably follows this process, still has an "auto pilot" software function that on more than one occasion drove a car into a stationary object at 70mph.

That is a regulatory failure (or the regulatory process lagging far behind the technology), just like the MCAS issue, neither MCAS or the Tesla autopilot should, IMHO, have the safety rating they do (ander any sane safety analysis) . . . Secondly, the automotive safety standard is nowhere near capable of dealing with this kind of technology . . . it's from the nuts and bolts save lives era . . .

This is not a software problem, the software, certainly in the case of the Boeing product, could have been specified to be compliant with a higher safety case under well established processes, but it wasn't, and so that wasn't the way it was created, that decision would have been made months or years before a single line of code was written. The code monkey writing the code has no input, whatsoever, to that process, single AOA, Dual voted AOA, Triple AOA, inverted AOA on one side, monkey holding the AOA while standing on a unicycle, it's all decided and specified at the system level, miles above the tedium of people writing code.

Tesla (and the automotive industry) actually have a more difficult problem, their autopilot software uses deep learning AI which by its very nature produces indeterministic outputs, so the standard safety approaches and mitigations do not work (indeterminism in a safety critical system is not really allowed), this is another regulatory failure and the safety industry is struggling to understand how to approve these kinds of systems . . . I would not let one drive me.

Fd

[Chu Chu]

Whatever you might think about Boeing's assumption that a MCAS malfunction could be treated as a species of runaway trim (apart from the fact that this was beyond at least two crews), I wonder if it fully analyzed all implications of a single failure (of an AOA probe).

Unless I'm missing something, if that happened in IMC, the crew would be faced with a stick shaker (on one side), a UAS warning, and a display showing the horizon moving above the flight path. Would they recognize that they had to ignore the first two indications and act immediately on the third? If they refrained from significant control (never mind trim!) inputs until they'd worked through the obvious indication problems, they'd have to deal with a flight path upset on top of everything else.

Perhaps recovering from that situation wouldn't be as challenging as it seems to this SLF. But sure seems a lot tougher than anything the accident crews faced. . .

[deltafox44]

Hello all,

My understanding from these situations is one contributing factor may be that a pilot may ultimately get into a situation where he or she has little to no ability to correct a badly out of trim Max manually or electrically due to aerodynamic loads in certain flight situations. What I have not seen is anyone noting is if this inability, irregardless of how it came about, is the same in other aircraft from Boeing or Airbus. From a 320 to a 380 or a 737 NG or 747 to a 787 would a pilot have the ability to re-trim from the same situation these two flights faced?

TME
737s are fly-by-cable, from the pre-electronics era. 320, 380 and 787s are fly-by-wire, therefore their stabilizers do not have the same limitations

[Capn Bloggs]

Only the Captain's shaker was active so they know immediately its not a real stall.
The control columns are connected. I therefore assume that the sticks will both shake (an old 737 800 FCOM I have says "Either stick shaker vibrates both columns through column interconnects"). In the heat of the moment, how could you easily tell which shaker was going off?

[OldnGrounded]

Almost all the coverage continues to clobber Boeing. Notably, Tajer is popping up in multiple articles, and providing quotes on the record. Also, more ex-Boeing folks are speaking for attribution, and saying things Boeing won't like.

Boeing’s 737 Max: 1960s Design, 1990s Computing Power and Paper Manuals (https://www.nytimes.com/2019/04/08/business/boeing-737-max-.html)

[Snip]

But the strategy has now left the company in crisis, following two deadly crashes in less than five months. The Max stretched the 737 design, creating a patchwork plane that left pilots without some safety features that could be important in a crisis — ones that have been offered for years on other planes. It is the only modern Boeing jet without an electronic alert system that explains what is malfunctioning and how to resolve it. Instead pilots have to check a manual.

The Max also required makeshift solutions to keep the plane flying like its ancestors, workarounds that may have compromised safety. While the findings aren’t final, investigators suspect that one workaround, an anti-stall system designed to compensate for the larger engines, was central to the crash last month in Ethiopia and an earlier one in Indonesia.

The Max “ain’t your father’s Buick,” said Dennis Tajer, a spokesman for the American Airlines pilots’ union who has flown the 737 for a decade. He added that “it’s not lost on us that the foundation of this aircraft is from the ’60s.”

More (https://www.nytimes.com/2019/04/08/business/boeing-737-max-.html)

[Icarus2001]

when things started to really go wrong. Almost no pitch, 340 kts, no ability to pull or trim

The electric trim WAS AVAILABLE to be used.

[737 Driver]

In the heat of the moment, how could you easily tell which shaker was going off?

Look between your legs and see which eccentric motor is spinning.

[737 Driver]

Unless I'm missing something, if that happened in IMC, the crew would be faced with a stick shaker (on one side), a UAS warning, and a display showing the horizon moving above the flight path. Would they recognize that they had to ignore the first two indications and act immediately on the third? If they refrained from significant control (never mind trim!) inputs until they'd worked through the obvious indication problems, they'd have to deal with a flight path upset on top of everything else. The proper response would be to turn off the magic, set the attitude and power to a known quantity, fly away from the ground, and then figure out what instruments were lying to you. You know, the basic pilot stuff that is no longer emphasized.

[YRP]

Salute!

Thanks, bernd

Guess many were not there for the megathon AF447 discussion about the stall warning relationship to the Aoa when speed was under 60 knots.
On that night, the plane proved it was very stable in a deeply stalled part of the envelope, and had only a slight change in heading versus a violent yaw/roll . So smooth that the crew didn't understand that they had actually stalled - no stall warning audio due to the 60 knot criteria and the "you can't stall this plane" mentality of many at the time.

Gums sends...

Jus' sec here. AF447 had plenty of stall warning. It only stopped after the crew held it into the deep stall. The crew didn't register the warning or believed it spurious.

On the 60 kt criteria, I find it hard to criticize that design decision. It would get increasingly difficult to get reliable meaningful data from the sensors at that point (i.e. IAS vs CAS spread). And who would have thought an airliner would actually manage to be flown to that point.

[YRP]

The Tristar taught flying GPS G SPEED approaches in serious headwind landings - none of this is new, but it is being forgotten. So here we have big jets using this technique when it is the very opposite of still air!


Surely the Tristar predated GPS by some years.

[threemiles]

The electric trim WAS AVAILABLE to be used.

It was cut out by the cutout switches.

[DieselOx]

Reading this whole thread, this civilian would have no problem flying on a MAX with any competent pilot at any major carrier, at this point, if it could be proved that the MCAS implementation is the only major change/problem not previously disclosed with the design of the MAX.

What else lurks in the dark of undisclosed changes? What other switches have had their independent control effectively coupled together, with no disclosure in the training deck?

At least one unspecified software bug regarding control surfaces exists and is being addressed in secret, at least so far.

I'm no longer too concerned with the ins and outs of MCAS, it's failures and fixes. It could be perfectly repaired, and I still will never set foot on a MAX, not because of MCAS or its underlying performance change that it corrects, but because of the arrogance that led to it in the first place. Without a complete, independent analysis of all the cascading impacts of all the other design changes, by an impartial 3rd party, given access to all the internal documentation and communication that went into the MAX, no one can convince me, definitively, that it is actually safe to fly. You still can't prove the non-existence of something unknown.

If they could bury a change as critical as this, and remove, (or never allow) the ability to shut it off, they could bury anything to cover up critical design changes.

Was the wing re-designed to deal with the increased thrust from the new engines? Really, every last bit of it, with no influence from the directive to not trigger a new type rating? Or was the new engine just scabbed onto the old structure, with local reinforcement? How do you know?

Up intil 6 months ago, I would assume Boeing modeled the harmonic changes to the wing structure in the most rigorous process of any engineering undertaking ever executed. Now, I have doubts. If they were beefing up the wing for more thrust, why couldn't they roll in an entirely new wing design to accommodate longer landing gear, and keep the engines back where they belonged? New type rating trigger?

Fixing MCAS is not the problem. The culture that led to it is.

[threemiles]

GPS speed could be used to have an approximation to real airspeed in case your air data is lost. The error would be huge if you don´t program it carefully (basically wind speed=error). However, if you assume that the readings from air sensors were right to the point in which you had a disagreement, you can calculate the wind at that moment (strictly speaking, an average of the last seconds) and assume a persistent wind vector. The error in the very first moments of "GPS synthesized" airspeed would be negligible, even in a turn. As the aircraft moves and wind conditions change, error will grow, being immense in worst case scenarios and longer times.

Same applies to Inertial speeds.

It could even be possible (maybe some planes do it nowadays, I'm no expert) to compute a real airspeed without air data. At any given moment of the flight, the airspeed is the only unknown parameter of a vector F = m x a, because mass is accurate to some degree from load sheets, acceleration you can measure with the inertial platform and the force is the result of adding the trust of the engine, which is calculated out from engine conditions and tabulated air conditions from GPS altitude, and the lift + drag, which relates to air speed and air conditions with a known characteristic.

In other words, the plane knows its airspeed just by feeling how pitch and thrust translate into acceleration (longitudinal, vertical and lateral) at every moment.

Sure the error will exist (almost every part of the calculation is an estimation), but it would be tolerable (as a backup, say 20 or 30 knots) and it will valid over long periods of time.

This concept of multiple possible ways of calculation of a magnitude is valid with many others (altitude) and to me is one of the things the plane could do before just going all UAS on you.

I dream (it is free) of a dial with a very precise reading when all sensors are working that turns into a less precise reading (a sector instead of a thin needle) when errors are expected, because of alternative calculations. "250 knots with 50 knots error" is a lot better than "250 knots but do not believe it much because another sensor reads different". (And a stick shaker and overspeed clacker on top of it, just to get things interesting).

There is not just another sensor, there are two other sensors. One is called ISFD speed tape that can be used to vote 2 over 1.

If two or three probes are iced and all three tapes show different speed GPS ground speed may be helpful to understand, e.g. a deep stall, by a matter of magnitude. 0 kts GS is certainly not a comfortable number then. But that is a different discussion. This thread is about IAS disagree and stick shaker upon lift off.

[gmx]

It was cut out by the cutout switches.

Well, it was cut out by the pilots. They had the option to re-trim the aircraft using electric trim before hitting the cutout. I believe this "option" occurred to the crew close to the end when they re-enabled the electric trim but their attempts to re-trim with the column switches was unsuccessful (either through pilot error or malfunction). Had they done this earlier, right before they activated the STAB TRIM CUTOUT, they would have been in a very similar situation to the pre-accident LionAir flight -- a trimmed, stable aircraft, with AP disconnected, and stick shaker going off on PF side.

A couple of points, one made a few posts back.

Firstly, it seems the lessons from the pre-accident LionAir flight and the subsequent accident flight were not learned well enough. As far as we know, the MCAS issue that occurs as a result of PF-side erroneous AoA signal is completely survivable by the crew taking the correct course of action. It seems that the correct course of action wasn't spelled out clearly enough for the ET302 crew, or it was not drummed into them methodically enough. That's a further failing of the airline industry following the initial accident.

Secondly, it has been remarked here on numerous occasions that it is extremely rare for a transport crew to encounter a stick shaker alert. Had the pre-accident LionAir B737 been grounded following that flight, and had the ET302 crew leveled the aircraft before disabling the electric trim and subsequently managed to land, that would have been two flights with PF-side stick shaker active for the duration of those flights. That would suggest a systemic issue, but it does not appear to have received the same attention as the MCAS response.

[threemiles]

Hmm. So a direct reading gauge with nothing getting in the way.

Apart from the cabin diff press indicator tap.

So not totally independent after all...

Cabin diff press indicator has no influence on ISFD IAS shown.
Some sophisticated numerical compensations that are done inside ADM and ADIRU are missing, as for AoA. But these are not too relevant for normal manoeuvering. All non digital airplanes have flown well like this for decades.​

[threemiles]

Well, it was cut out by the pilots. They had the option to re-trim the aircraft using electric trim before hitting the cutout. I believe this "option" occurred to the crew close to the end when they re-enabled the electric trim but their attempts to re-trim with the column switches was unsuccessful (either through pilot error or malfunction). Had they done this earlier, right before they activated the STAB TRIM CUTOUT, they would have been in a very similar situation to the pre-accident LionAir flight -- a trimmed, stable aircraft, with AP disconnected, and stick shaker going off on PF side.

A couple of points, one made a few posts back.

Firstly, it seems the lessons from the pre-accident LionAir flight and the subsequent accident flight were not learned well enough. As far as we know, the MCAS issue that occurs as a result of PF-side erroneous AoA signal is completely survivable by the crew taking the correct course of action. It seems that the correct course of action wasn't spelled out clearly enough for the ET302 crew, or it was not drummed into them methodically enough. That's a further failing of the airline industry following the initial accident.

Secondly, it has been remarked here on numerous occasions that it is extremely rare for a transport crew to encounter a stick shaker alert. Had the pre-accident LionAir B737 been grounded following that flight, and had the ET302 crew leveled the aircraft before disabling the electric trim and subsequently managed to land, that would have been two flights with PF-side stick shaker active for the duration of those flights. That would suggest a systemic issue, but it does not appear to have received the same attention as the MCAS response.

Of course, they could have done so, this and that. But they elected to start a 30 degrees bank manual flown turn at 340 kIAS without the ability to pull or trim ANU. Whatever dictated them to turn.

With regard to lessons learnt from Lionair: an Emergency AD is a quite ultimate document. If that is not well thought through and written by lawyers there is not much room left.

[Icarus2001]

But they elected to start a 30 degrees bank manual flown turn at 340 kIAS without the ability to pull or trim ANU.

Why do you keep saying this? They did have the ability to trim nose up.

[fgrieu]

Well, [electrical trim] was cut out by the pilots. They had the option to re-trim the aircraft using electric trim before hitting the cutout..

Is that sure ? Can the electric trim work despite aerodynamic forces in all situations (overspeed, trim full nose down) ? Does it even work in more situations than manual trim ?

[bill fly]

That appears to be true for manual (wheel) trim, but there's no evidence that it's the case for electric trim.

Dave and others,
At ultra high speed the stab can only be trimmed after releasing up-elevator. This is because of loading to the stab mechanism.
This is the reason for elevator release during upset training.
But if you are at tree top height you can’t do that.
So trim, Manual or Electric is, as the man said, not possible under certain conditions - and those were the conditions encountered here.

[DaveReidUK]

Re manual trim...have we had any engineering input as to just when manual trim no longer becomes available in the flight envelope?

We've had lots of discussion about that, albeit without any numbers.

Is it primarily speed dependent, stabilizer positon-dependent, yoke dependent, or a combination of all 3?

All of the above contribute to the load on the stab, which determines the force you have to overcome in getting the trim wheel to move.

Dave and others,At ultra high speed the stab can only be trimmed after releasing up-elevator. This is because of loading to the stab mechanism.
This is the reason for elevator release during upset training.
But if you are at tree top height you can’t do that.
So trim, Manual or Electric is, as the man said, not possible under certain conditions - and those were the conditions encountered here.

With respect, we don't have any evidence of that being a factor here - there are no points in the FDR trace that show trim input without corresponding stab movement. Even the last two very brief ANU inputs appear to have had an effect, although the stab only moved by a fraction of a degree before the the inputs ceased.

[gmx]

Well, [electrical trim] was cut out by the pilots. They had the option to re-trim the aircraft using electric trim before hitting the cutout..

Is that sure ?

Yes, it is sure. We know this because MCAS drives the stabilizer using the electric motor, and MCAS dialed in another batch of nose-down trim AFTER the pilots re-enabled electric trim and blipped the column switches (which had negligible affect on stabilizer position). Therefore, the electric trim motor was able to drive the stabilizer with the stabilizer in its final position prior to stab trim cutout activation. As such, I think it is fair to conclude that the pilots decided against trimming back to neutral before activating the cutout (or were cognitively overwhelmed at the time and did not think to do so).

[quentinc]

Therefore, the electric trim motor was able to drive the stabilizer with the stabilizer in its final position

It certainly was able to move the stabilizer trim nose down. I am not sure we can say it was able to trim nose up, against the aerodynamic force being applied to the jack screw, rather than with it.

[AlexGG]

It was able to move trim nose up, although ever so slightly. The movement is there is you zoom into FDR trace. I suppose it trimmed slower against the load than along with the load, but some nose-up capability was there. I presume the motor has some overheat/overload protection. Does anyone know the reset criteria, if any, of the motor going back to operation after whatever protection is tripped?

[EDLB]

Well, [electrical trim] was cut out by the pilots. They had the option to re-trim the aircraft using electric trim before hitting the cutout..



Yes, it is sure. We know this because MCAS drives the stabilizer using the electric motor, and MCAS dialed in another batch of nose-down trim AFTER the pilots re-enabled electric trim and blipped the column switches (which had negligible affect on stabilizer position).

That the electric motor drives the trim in one direction, does not mean that it is capable to drive it in the other direction if loaded. Think about tightening a vice.

[SteinarN]

Oh, just one question:
People claim that the manual trim may not be operable in certain flight conditions while the electric trim motor is more powerful.
On the other hand the manual states that in case CUTOUT does not work, one should grasp and hold the wheel (?against the motor?). Did I miss something?

Yes, you did miss something. To be honest, I too have missed that same thing.

I think all the check lists that say something about manually trimming with the wheel and/or hold/grasp the wheels will need to be rewritten.
And then, what will the new procedure for trimming with cut out switches set to cut out be? How to stop trim runaway when wheels supposedly cant be stopped by grabbing them?
I think there hides a lot of problems for Boeing in the manual trim wheel system.

[bsieker]

I presume the motor has some overheat/overload protection.

Probably not. What would be the point? It is a vital pitch control surface. Why would you intentionally make it unavailable because it might fail at some later time? It is better to have it available, and damage it, rather than to make it unavailable and potentially lose the entire aircraft.

I don't think there will be more than an overcurrent circuit breaker, but that is mostly to protect the wiring.


Bernd

[spornrad]

We can't see the wood for the trees.
This one was just a faulty sensor(not even UAS)..
If MCAS would activate alone,any crew would simply
counter-trim and cut off its electrical supply without much thought.
But combine it with a "confusing" UAS scenario and shakers and
warnings and bingo..you get a smoking hole in the ground...
Pilots have to be trained more on these UAS scenarios before they kill again.
Aeroperu,birgenAF447 and the 2 MAXs,and others.....

Wise words. Seems to me that the entire concept of "artificial feel" and "artificial buffet" (AKA stickshaker) was envisioned many decades ago assuming pilots had stick and rudder skills ingrained and whose muscle instincts would guide them to do the right thing if their hands were provided with the correct aerodynamic, albeit artificial clues.
Today, the artificial manual feedback stuff is degrading the primary flight control ergonomics, and distracting and stressing the crew. Instead of providing clues, it may even make pilots loose the trim switch with their thumb as a result of a hydraulically shaken column with massive artificial pull on top.
MCAS could then be seen as the ultimate perversion of that concept. Abuse a secondary flight control to create artificial stick force, give it a delay of 5 s so the pilot will not intuitively get the message, and give it so much authority, that it effectively overrides the primary control.
2 ct

[DaveReidUK]

Oh, just one question:
People claim that the manual trim may not be operable in certain flight conditions while the electric trim motor is more powerful.
On the other hand the manual states that in case CUTOUT does not work, one should grasp and hold the wheel (?against the motor?). Did I miss something?

I don't think there is any dispute about the fact that grasping the trim wheel stops the stab moving. Reportedly, and depending on how positively you grab it, you may lose a bit of skin in the process.

Once the wheel is held, you are not fighting against the electric trim motor, which is disabled if resistance is detected at the cable drum.

[RetiredBA/BY]

I never tried ( in the sim! ) grabbing and trying to hold the trim wheel during a runaway stab. Not sure it was possible without burning my hand or losing some fingers !

Was it possible?

Sorry, DR s post was being written as I was typing !

However, anyone actually have any first hand ( no pun intended ) experience of doing it ?

[deltafox44]

People claim that the manual trim may not be operable in certain flight conditions while the electric trim motor is more powerful.
On the other hand the manual states that in case CUTOUT does not work, one should grasp and hold the wheel (?against the motor?). Did I miss something?
There is a clutch that ensures that manual trim has priority on electric trim. So Yes, grasping the wheel should stop trim runaway.

[PerPurumTonantes]

I don't think there will be more than an overcurrent circuit breaker, but that is mostly to protect the wiring.
Bernd
A motor which is forcibly stopped can pull a huge amount of current. Depends on motor type but for old fashioned non-electronic controls can be 20x full speed current. Of course we don't know the motor type or controlling electronics. Anyone?

Also DaveReid's post above about motors stopping if they meet resistance.

I can't see any reason for the 'blips' in nose up trim other than pilot trying it and it not working/ not appearing to work. Why else would you release the switch when it's the one thing you're focussing on, the one thing you know you need?

[deltafox44]

The 737 manuals says that incase of extreme nose-down out-of-trim, one should INCREASE speed to relieve elevator load and permit manual trimming.

That's insane !

(see https://www.satcom.guru/2019/04/what-happened-on-et302.html)

[groundbum]

so why not have a separate cutout switch just for MCAS, keep the other two to cutout electric trim. But the new MCAS cutout switch would leave electric trim available.

I'm also unclear since the certification requirement was for force feedback on the stick during certain stall regimes why Boeing didn't just use some kind of motor/pneumatic on the stick to give this force, rather than connecting MCAS to control surfaces! Seems overkill, no pun intended. I mean the stick shaker no doubt uses a motor to shake the stick, it doesn't shake the ailerons in order to make the stick shake!

G

[deltafox44]

I can't see any reason for the 'blips' in nose up trim other than pilot trying it and it not working/ not appearing to work. Why else would you release the switch when it's the one thing you're focussing on, the one thing you know you need?
I see on good reason : at very high speeds a long trim command would induce huge vertical acceleration, therefore you have to use it with caution, using actions of one second or so.

What I can't see is why they did not continue as many times as needed to trim back

[deltafox44]

so why not have a separate cutout switch just for MCAS, keep the other two to cutout electric trim. But the new MCAS cutout switch would leave electric trim available.

I'm also unclear since the certification requirement was for force feedback on the stick during certain stall regimes why Boeing didn't just use some kind of motor/pneumatic on the stick to give this force, rather than connecting MCAS to control surfaces! Seems overkill, no pun intended. I mean the stick shaker no doubt uses a motor to shake the stick, it doesn't shake the ailerons in order to make the stick shake!

G
There would be no force on the stick without the feel and centering system. It has been said that, for some reason, this system is not able to provide the extra force needed near stall. Of course it could have been modified to do so, but that mean a lot of money, whereas MCAS is just a software modification :ooh:

[Deepinsider]

I don't think there is any dispute about the fact that grasping the trim wheel stops the stab moving. Reportedly, and depending on how positively you grab it, you may lose a bit of skin in the process.

Once the wheel is held, you are not fighting against the electric trim motor, which is disabled if resistance is detected at the cable drum.

Wasn't it the (unofficial) procedure to grab the copliot's leg and jam it as hard as you could against the wheel, then quickly unfolding your own
handle, shedding no skin at all !!

[Maninthebar]

Wasn't it the (unofficial) procedure to grab the copliot's leg and jam it as hard as you could against the wheel, then quickly unfolding your own
handle, shedding no skin at all !!

Would this not require 3 hands?

[Deepinsider]

Would this not require 3 hands?

Yes....that's how amazing captains are !

Sorry folks, just trying to lighten it up a bit,
but don't intend to imply any disrespect to
the victims of these crashes.

(It just happens that in my now ancient 737 times,
this was the joke about the runaway stab drill)

[TryingToLearn]

And yet Tesla, an automotive company which presumably follows this process, still has an "auto pilot" software function that on more than one occasion drove a car into a stationary object at 70mph.
Tesla used the same chip as Audi, BMW etc. from a company called Mobileye.
But Tesla called it AutoPILOT instead of Lane/TrafficASSISTANT and used the System far beyond it's clearly stated limitations (no cross-traffic detection, 0,4s driver reaction). All other OEMs limited the system to 30 sec. without driver interaction.
After the accident, the company stopped delivering their system to Tesla because they then knew that it was used beyond it's limits (like MCAS?)
Mobileye claimed Tesla was 'pushing the envelope in terms of safety'. I'm not allowed to post the link (Reuters).
In addition, Tesla was forced to prevent the forseeable misuse by stopping the car after a certain time without driver interaction (touching the steering wheel...)
All other OEMs ripped Teslas apart to learn all the modern new solutions and mostly considered the solutions not state of the art in terms of safety.

It's the same story, management wanted something impossible. In one case a new aircraft without additional training, in the other case being in the news as first autonomous car manufacturer with affordable electric cars...
In one case it may have been forseeable that pilots go into the stall memory item (more speed), in the other one that people may take a nap while driving.

[xyze]

Jus' sec here. AF447 had plenty of stall warning. It only stopped after the crew held it into the deep stall. The crew didn't register the warning or believed it spurious.

On the 60 kt criteria, I find it hard to criticize that design decision. It would get increasingly difficult to get reliable meaningful data from the sensors at that point (i.e. IAS vs CAS spread). And who would have thought an airliner would actually manage to be flown to that point.


Something I have never understood wrt this - is it possible for the a330 to be in the air with an airspeed of 60 knots or even 70 knots and NOT be stalled? If not then why inhibit the warning? Worrying about sensor accuracy seems to be missing the bigger picture wrt the purpose of the warning!

[bsieker]

A motor which is forcibly stopped can pull a huge amount of current. Depends on motor type but for old fashioned non-electronic controls can be 20x full speed current. Of course we don't know the motor type or controlling electronics. Anyone?

Yes, so it will heat up, and eventually the wiring will burn up / melt /otherwise fail. But that will take a while. Being essential, that motor will be dimensioned rather larger to avoid such problems. And we know that on the Lion Air flight, the trim motor worked much more than in Ethiopia, and there was no question about it overheating or being disabled.


Also DaveReid's post above about motors stopping if they meet resistance.


No, that's not what he said. He said that the motor will be "disabled if resistance is detected at the cable drum.", which is different from just meeting any resistance to its motion, e. g. resistance from the jackscrew nut.


I can't see any reason for the 'blips' in nose up trim other than pilot trying it and it not working/ not appearing to work. Why else would you release the switch when it's the one thing you're focussing on, the one thing you know you need?

We don't know what they were focusing on at that time. Possibly not trim, but just pulling together. Just before the blips the "Captain asked the First Officer to pitch up together and said that pitch is not enough." And pitch trim did work, it moved from 2.1 to 2.3 units. I cannot comment on how much that would be felt in the control column.

Bernd

[Loose rivets]

Quote:Originally Posted by yanrair https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-187.html#post10442821)
The Tristar taught flying GPS G SPEED approaches in serious headwind landings - none of this is new, but it is being forgotten. So here we have big jets using this technique when it is the very opposite of still air!


Surely the Tristar predated GPS by some years. I looked that up just to see how many were still flying. One thing I found is that you can apply a GPS package to almost any Flight Sim aircraft.

[PJ2]

LR, Yanrair, we used IRS GS for monitoring headwind correction. Did that on the DC8 too using the INS, from the early 70's on, as a formal, (book) procedure. The Lockheed, (100 & 500), didn't have GPS when I flew it in the late '80's..

[TryingToLearn]

I don't think there is any dispute about the fact that grasping the trim wheel stops the stab moving.
Once the wheel is held, you are not fighting against the electric trim motor, which is disabled if resistance is detected at the cable drum.
But this proves that electronic trim is less powerful than manual trim, right? Or can the motor distinguish where the force is coming from?

To me as an engineer everything lines up if one adds this clutch/force limit:
Pilots try manual trim: Too much force, no chance (and free hands)
Pilots reactivate electric trim: Short movement and the clutch/force limit stops it. (FDR Trace...)
Pilots try a few times: Small blips... (FDR Trace...)
Pilots give up: MCAS kicks in again...

If you find people at Boeing with lot's of bandaid, you know they had the same idea recently... :)

[threemiles]

The cutout switch function was changed with the 737MAX from all prior 737 models. The legacy switch combination was one switch to cutout electric trim altogether, the other to cutout the autopilot trim commands. MCAS and Speed Trim System are both commands from the “autopilot”. With the legacy switch configuration, the flight crew can disable the autopilot commands and retain electric trim. With the 737MAX, the flight crew lose both electric trim and autopilot trim with the cutout switch.

The Flight Standardization Board (FSB) took notice of the nomenclature change of the cutout switches but did not make any mention of the difference in responding to autopilot stab trim runaway. On the 737NG, the flight crew retain electric trim; on the 737MAX the flight crew must use manual trim. It turns out, this is a significant difference in pilot workload and pilot capacity to fly the airplane.

Was this taught in the difference powerpoint "training"?

[PJ2]

Most of this has been reviewed in the thread elsewhere, but to perhaps summarize from a B737-400 AMM describing the HS trim system:The horizontal stabilizer trim control system provides longitudinal trim of the airplane by varying the angle of attack of the horizontal stabilizer. The horizontal stabilizer is moved through 17 degrees of travel by means of a jackscrew with ball nut. The main electric actuator and the cable drum on the jackscrew gearbox provide for trim control from three separate control systems. The normal control is an electrical system which actuates the jackscrew through the main electrical actuator. The main electric actuator and autopilot actuator, autopilot control is provided by the autopilot actuator on the gearbox. A manual control system drives through cables to the cable drum on the jackscrew gearbox. The manual system remains engaged at all times and is therefore back-driven by the main electric actuator or autopilot actuator during normal operation. Manual system operation will disengage both the normal electrical and autopilot actuators if these systems become jammed. A continuous indication of stabilizer position is provided by trim position indicators adjacent to trim wheels on the control stand. The indicators are positioned by the manual system. A takeoff warning system indicates any unsafe stabilizer position for takeoff.The control column actuated cutout switch located under the cockpit floor, stops electric trimming of the stabilizer when opposed by the motion of the elevator control.

Normal electrical trim control system consists of control switches, cutout switches, a column- actuated cutout switch, trim control relays, flap switch and relay, limit switches and an electric actuator. The electric actuator contains an electric motor, two electromagnetic clutches, a speed change relay, torque limiting clutch and output shaft to drive the jackscrew gearbox. The motor is operated by 3 phase AC power and the relay and clutches by DC power. The stabilizer actuator is controlled by the trim control switches, control cutout switch, limit switches and cutout switches. The control switches, located on the outboard horn of each control wheel, have two momentary positions, nose up and nose down, and are spring-returned to the center off position.The column- cutout switch located beneath the cockpit floor is actuated by forward and aft movement of either control column. Stabilizer limit switches are located on the bulkhead aft of the jackscrew gearbox and actuated by a striker to limit stabilizer leading edge up and down travel. The cutout switches on the control stand are used to remove power from the main electric actuator or the autopilot actuator.

Normal electrical trim control system consists of control switches, cutout switches, a column- actuated cutout switch, trim control relays, flap switch and relay, limit switches and an electric actuator. The PSTA contains an electric motor, two electromagnetic clutches, a speed change relay, torque limiting clutch and output shaft to drive the jackscrew gearbox. The motor is operated by 3 phase AC power and the relay and clutches by DC power. The PSTA is controlled by the trim control switches, control cutout switch, limit switches and cutout switches. The control switches, located on the outboard horn of each control wheel, have two momentary positions, nose up and nose down, and are spring-returned to the center off position. The column-cutout switch located beneath the cockpit floor is actuated by forward and aft movement of either control column. Stabilizer limit switches are located on the bulkhead aft of the jackscrew gearbox and actuated by a striker to limit stabilizer leading edge up and down travel. The cutout switches on the control stand are used to remove power from the PSTA.

Normal electric trimming of the stabilizer is done at one of two rates as controlled by flap position. Trim rate with flaps retracted is 1/3 the trim rate with flaps extended. The autopilot actuator also trims at one of two rates as controlled by flap position. High speed autopilot rate is equal to the normal electric low speed rate. The low speed autopilot rate is 1/2 the rate of the high speed autopilot rate.

[infrequentflyer789]

Something I have never understood wrt this - is it possible for the a330 to be in the air with an airspeed of 60 knots or even 70 knots and NOT be stalled? If not then why inhibit the warning? Worrying about sensor accuracy seems to be missing the bigger picture wrt the purpose of the warning!

It is the design of the warning rather than the purpose. Invalidating the sensor readings (speed and AOA) at the ADIRU is not a bad design (and might have saved ET302). Failure to consider the possibility of known-invalid data further downstream is bad design.

The AF447 stall warning problem is even more subtle though - invalid data was designed for, the problem is (it appears) that it was designed without state so known invalid data resulted in "no warn". This was arguably incorrect, but known invalid data shouldn't result in "warn" either. With a stateful design a transition from stalled-data to invalid-data would not take you out of the "warn" state, not complicated (he says, having forgotten most of his NFA/DFA and statemachine stuff), just wasn't done that way.

Ironically if AF had taken the optional (standard on later buses) A330 feature that they said their pilots didn't need, the stall warning design issue would have been fixed (BUSS, optional on 330, fixes it). Whether it would have saved them, I don't know for sure, very possibly irrecoverable by the time they got to that point.

[bsieker]

So being unable to use the electric trimmers whilst pulling back on the column is a design feature, hard-wired into the system.

Not so keen on that idea.

You can always trim (within electric trim range) in the same direction as control column deflection:

Control column actuated stabilizer trim cutout switches stop operation of the main electric and autopilot trim when the control column movement opposes trim direction.

... and ...

Stabilizer Trim Override Switch
OVERRIDE – bypasses the control column actuated stabilizer trim cutout switches to restore power to the Stabilizer Trim Switches
NORM (guarded position) – normal operating position

So there's a "control-column-actuated-stabilizer-trim-cutout-switch override switch". In case you want to use the control wheel trim switches to trim opposite your control column input.

Bernd

[DaveReidUK]

But this proves that electronic trim is less powerful than manual trim, right?

No, it simply proves that manual trim inputs outvote electric trim (and A/P trim) inputs by design.

Or can the motor distinguish where the force is coming from?

Yes, it can.

So being unable to use the electric trimmers whilst pulling back on the column is a design feature, hard-wired into the system.

You can trim ANU while pulling back on the column, but not AND.

[infrequentflyer789]

So being unable to use the electric trimmers whilst pulling back on the column is a design feature, hard-wired into the system.

Not so keen on that idea.

Only trim in the opposing direction is stopped, and all electric trim in the opposing direction is stopped. The only way to trim forward whilst pulling back would be manual trim wheel.

This is one of the simplest and neatest examples of Boeing philosophy of helping the pilot not do stupid but never by overriding the pilot's primary control inputs. This was a good system, but not any more. MCAS broke the system. Now there is another way to trim forward whilst pulling back - just let HAL do it for you, all the way down.

[yanrair]

The 737 manuals says that incase of extreme nose-down out-of-trim, one should INCREASE speed to relieve elevator load and permit manual trimming.

That's insane !

(see https://www.satcom.guru/2019/04/what-happened-on-et302.html)
As you accelerate the plane pitches up due to lift being in front of cg and you need to trim nose down to fly level. And vice Versa. Lesson 1 of type rating course on sim covers this.

[bsieker]

Only trim in the opposing direction is stopped, and all electric trim in the opposing direction is stopped. The only way to trim forward whilst pulling back would be manual trim wheel.


Not all opposing electric trim is stopped. Only main electric (control wheel switch) and autopilot trim. STS is not the autopilot.

And you can also use the control-column-actuated-stablizer-trim-cutout-switch override switch.


This is one of the simplest and neatest examples of Boeing philosophy of helping the pilot not do stupid but never by overriding the pilot's primary control inputs.


So, the design philosophy is, "Don't let the pilot do anything stupid. Unless he does something stupid with the primary flight controls. Then, don't interfere."

This was a good system, but not any more. MCAS broke the system. Now there is another way to trim forward whilst pulling back - just let HAL do it for you, all the way down.

Well, the whole raison d'être for MCAS is to modify stick forces when pulling back, so obviously it needs to be able to trim against stick deflection.

And if you insist that something "broke" the column cutout switch design philosophy, STS did it first. It also trims against stick deflection, explicitly to "increase control column forces".

Bernd

[gums]

Salute!

AvWeek has a summary of the thjings Big B is doing, and also iterates the purpose and function of MCAS. If it's paywalle I'll come back and cut-and-paste.

https://aviationweek.com/commercial-aviation/boeing-expands-mcas-demos-speed-lifting-737-max-grounding

I wonder why Boeing didn't separate the two stab trim cutout switches. One for only the wheel electric trim switches and the other for all of HAL's stuff -STS, A/P and MCAS.

That would seem to have saved both planes and it also allows the "revert to manual" procedure that many of the 737 drivers here have bragged about. 'cause I do not see using electric trim switches to reduce loads as being much removed from cranking a wheel, just less tiring and faster.

Gums sends..

[BDAttitude]

... The normal control
is an electrical system which actuates the jackscrew through the main electrical actuator. The main
electric actuator and autopilot actuator, autopilot control is provided by the autopilot actuator on the
gearbox. A manual control system drives through cables to the cable drum on the jackscrew
gearbox. ...
Normal electric trimming of the stabilizer is done at one of two rates as controlled by flap position.
Trim rate with flaps retracted is 1/3 the trim rate with flaps extended. High speed autopilot rate is
equal to the normal electric low speed rate. The low speed autopilot rate is 1/2 the rate of the high
speed autopilot rate.
From this excerpt it seems that there were two discrete actuators for autopilot and for electric manual (hence the need for two cut out switches).
This would also suggest that there could be two electric motors fighting each other when AP and manual el. trim are applied the same time?
Which one would succeed? I would also expect the rate switch to have some impact on available torque. So the outcome may be dependent on AC coniguration.

From what has been posted here it seems very likely, that this has been changend on the MAX.

So unfortuneately this actually raises more questions to me.

[threemiles]

I wonder why Boeing didn't separate the two stab trim cutout switches. One for only the wheel electric trim switches and the other for all of HAL's stuff -STS, A/P and MCAS.


737s prior to MAX worked like this.

[737 Driver]

Not all opposing electric trim is stopped. Only main electric (control wheel switch) and autopilot trim. STS is not the autopilot.

.......

And if you insist that something "broke" the column cutout switch design philosophy, STS did it first. It also trims against stick deflection, explicitly to "increase control column forces".

Incorrect. STS function is stopped by the control column cutout switch. MCAS is the only system that bypasses this function.

[DaveReidUK]

From this excerpt it seems that there were two discrete actuators for autopilot and for electric manual (hence the need for two cut out switches).
This would also suggest that there could be two electric motors fighting each other when AP and manual el. trim are applied the same time?
Which one would succeed? I would also expect the rate switch to have some impact on available torque. So the outcome may be dependent on AC configuration.

There is only one stab trim motor on the 737.
https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/492x494/eaton_6355c_stabilizer_trim_motor_0001_96542145e7ded880d2288 726440911cbfb865586.jpg
Yoke trim wil outvote A/P trim.

[Avionista]

It looks as if the STAB CUT-OUT switches were set to OFF at around 05:40:39 and remained OFF until around 05:43:06. Presumably, during this period the crew tried to use the manual trim crank wheels to counteract the ND trim which had been applied by MCAS before the STAB CUT-OUT was switched to OFF. The pitch trim trace shows no sign of reduced ND trim using the trim crank wheels so, presumably, the force needed to turn the trim wheels was too great. Switching the manual electric trim back on must have been a last-ditch attempt by the crew to save their aircraft. I'm wondering if the two short manual electric trim inputs just before the aircraft entered its final dive are an indication that manual NU electric trim becomes impossible once ND trim reaches a certain point.

It should be possible to calculate the turning moment about the HS pivot point for a range of ND trim units at various aircraft speeds and elevator positions. This should determine the range of forces which has to be resisted by the HS trim jackscrew. A ground test rig capable of applying this range of forces to a jackscrew could then be used to check the ability of the manual trim (both electric and crank wheel) to apply NU trim under all circumstances.

[infrequentflyer789]

Not all opposing electric trim is stopped. Only main electric (control wheel switch) and autopilot trim. STS is not the autopilot.
[...]
And if you insist that something "broke" the column cutout switch design philosophy, STS did it first. It also trims against stick deflection, explicitly to "increase control column forces".

Bernd

Sorry, with the greatest respect, I think you are mistaken.

STS is not the autopilot, and it only operates with autopilot off, but it operates using the autopilot trim signal. It is therefore cutout by (a) the "autopilot" console cutout switch on NG, and (b) the column cutout switch (if in opposing direction). I have multiple references all clearly stating this and functional diagrams showing it, but I'll quote just one, from the NG AMM 27-41-00:

The column cutout switches stop the stabilizer trim actuator when the pilot moves the control column in a direction opposite to the trim direction.


Stop the actuator, for opposing trim, period, regardless of signal source.

But not on the MAX - the cutout is bypassed when MCAS enabled (and that new bypass wouldn't be needed if STS already bypassed it).

[GordonR_Cape]

Avionista

It should be possible to calculate the turning moment about the HS pivot point for a range of ND trim units at various aircraft speeds and elevator positions. This should determine the range of forces which has to be resisted by the HS trim jackscrew. A ground test rig capable of applying this range of forces to a jackscrew could then be used to check the ability of the manual trim (both electric and crank wheel) to apply NU trim under all circumstances.

I sincerely hope that Boeing engineers are doing this as we speak, otherwise they won't have a leg to stand on if this ever comes to trial. Saying that it was designed and calculated to do X and Y back in 1968, is not going to impress a jury...

[Lost in Saigon]

" the whole raison d'être for MCAS is to modify stick forces when pulling back"

Is it? That seems to be in contradiction with everything I have read on the media.

Just about everything you have read in the media is wrong. MCAS is not stall protection. MCAS does not counter the additional thrust of the more powerful engines. It is only there because the larger engine nacelles of the B737 MAX cause an aerodynamic pitch up moment at high angles of attack that did not meet FAA longitudinal stability and stick force certification standards.

The easiest fix was to automatically apply a little nose down trim at high angles of attack.


25.173 Static longitudinal stability.

Under the conditions specified in 25.175, the characteristics of the elevator control forces (including friction) must be as follows:

(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or VFC/MFC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.

(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in § 25.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in § 25.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.

(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.

(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.

*

[DaveReidUK]

Just about everything you have read in the media is wrong. MCAS is not stall protection. It is only there because the larger engine nacelles of the B737 MAX cause an aerodynamic pitch up moment at high angles of attack that did not meet FAA stick force certification standards.

I fear you are fighting a losing battle in your campaign.

For the mainstream media, and even some of the industry press, knowing that aircraft can stall and that it's generally considered a BAD THING represents about the limit of their understanding.

Start talking about FARs and stick force gradient certification standards and their eyes will start to glaze over ...

[MPN11]

The easiest fix was to automatically apply a little nose down trim at high angles of attack.
But a little [0.6] became a lot [2.5], semi-persistently/repetitively?
Am I reading that correctly?

[Grummaniser]

I fear you are fighting a losing battle in your campaign.

For the mainstream media, and even some of the industry press, knowing that aircraft can stall and that it's generally considered a BAD THING represents about the limit of their understanding.

Start talking about FARs and stick force gradient certification standards and their eyes will start to glaze over ...
Heard BBC Radio4 news the other day saying that MCAS was a system to prevent the ENGINES stalling. I wrote them a stiff email...!

[Lost in Saigon]

But a little [0.6] became a lot [2.5], semi-persistently/repetitively?
Am I reading that correctly?

Yes, and Boeing has admitted that it was a little too much: “Upon reflection on what has occurred, it appeared the system could present a high-workload environment—and that’s not our intention."

It appears as though they have now remedied the situation.

[sky9]

The easiest fix was to automatically apply a little nose down trim at high angles of attack.

I'm just an old retired pilot.
Couldn't the same effect have been achieved by inputting nose down elevator? At least the crew would be kept in the picture and no lasting aerodynamic input would have been involved.

[bsieker]

737 Driver, infrequentflyer789, I stand corrected. Thanks!

I have amended my previous post.

The posted diagrams are quite inconclusive because the various switches are only labelled with cryptic identifiers, and the outgoing signals not at all, and it is hard to tell what is what.

Bernd

[fizz57]

I'm just an old retired pilot.
Couldn't the same effect have been achieved by inputting nose down elevator? At least the crew would be kept in the picture and no lasting aerodynamic input would have been involved.

That probably would have been the preferred option, however the elevator feel system cannot accept these inputs. I know that this is a very long thread, but this has been gone into in some depth earlier. Search for posts by FCEng84, which are particularly authoritative and illuminating.

[dlen]

Could they just have switched autopilot on?

[fotoguzzi]

For the mainstream media, and even some of the industry press, knowing that aircraft can stall and that it's generally considered a BAD THING represents about the limit of their understanding.

"Our airplane flies too well when the nose gets high, so the jealous authorities made us tamp it down. We overtamped."

[yanrair]

Surely the Tristar predated GPS by some years.
apologies. Quite right. INS ground speed. Just as accurate though. And on 737-200 we had Doppler ground speed - and 707. Pretty accurate too!
GPS ground speed will get you out of trouble in all these cases of chaotic airspeeds/stickshakers etc. Couple it with pitch and power and you actually cannot stall or over speed. Maintain ground speed at time of failure.

[yanrair]

I’ll Could they just have switched autopilot on?
Switching AP ON in chaotic situations of unreliable airspeeds and concurrent stick shakers is deadly since it’s inputs become unreliable. Better to fly the plane using the reliable information that is available PITCH. POWER. GROUNDSPEED. it works. Some time back (1980s) 737 suffered bird strike which took out AOA. And all air data including airspeed and altitude. Safe landing using above parameters. This became a standard training exercise. Fly a circuit with no speed info at all- except of course GPS which is a great help.

[dlen]

Wouldn't it be possible to just measure the nose up tendency - be it caused by engine nacelle lift or thrust at low speed - by evaluating both pitch change rate and control column position, and apply ND trim accordingly?

[derjodel]

" the whole raison d'être for MCAS is to modify stick forces when pulling back"

Is it? That seems to be in contradiction with everything I have read on the media.

That's because the media is clueless. The problem Boeing had with Max was that it didn't provide the same tactile feedback as NG (and other 737s) at high AoA, which is required for (grandfather?) certification. The reason is that the feel system could not produce enough force. In addition, Boeing promised to deliver Max which required no sim training to transition from NG. Nothing less, nothing more.

The very bright "solution" for the above problems from Boeing was to move the stab up to 6 units (from original 2 or so which were "not enough") in order to produce additional force on the stick. Yes, the bright heads at Boeing used one of the most essential flight control surfaces just to produce feedback force. Sending the plane straight to the ground in the process is just an overlooked side effect. Ooopsie. Well at least MCAS provided great (false!) tactile feedback of supposedly high AoA in the process - which was never there in the first place (a single faulty AoA vane).

Yes. Read it again. Let it sink.

Now imagine how a jury is going to react to that once Boing is sued by the victims families.

[yanrair]

Surely the Tristar predated GPS by some years.
you are correct of course. It was INS groundspeed. For those unfamiliar with how this works it’s easy. Say VRef +5 =140. Surface wind headwind 30 kts. Fly approach at 110 g/s.
Target threshold speed less headwind. All the way down. Guarantees excellent speed control and avoids wind gradient shear effects.

[derjodel]

Could they just have switched autopilot on?

AP disengage when AoA disagree.

[ecto1]

Another possible actor in this drama.

When boeing says to hold the trim wheel, when one study how the system is build and when one studies the data trace (and the misterious ND changes during multiple periods with no ND input).

I believe with sufficient pull and sufficient speed the trim motor clutch will slip and the trim wheels will creep ND.

If you blip the yoke switch and see the trim wheel not moving at a good pace and then you release and you see it slowly moving BACKWARDS, the whiskey tango foxtrot moment may be enough to make you forget about the pedestal switches.

Just another disturbing thought.

[GordonR_Cape]

Wouldn't it be possible to just measure the nose up tendency - be it caused by engine nacelle lift or thrust at low speed - by evaluating both pitch change rate and control column position, and apply ND trim accordingly?

Pitch and AOA are not the same. Pitch and AOA can change independently during maneuvers, which is why tracking pitch changes will not help determine rates of AOA changes, nor will it help determine the absolute value of AOA. In order to do this properly, you need a full blown computer system that integrates all of these sensor inputs, plus GPS, airspeed, etc. Those are fitted in an A350 or B787, and their price is more than twice that of a B737.

AP disengage when AoA disagree.

Someone should write a thread showing all of the things that do not work when there is AOA disagree. IMO it would also simplify checklists if there were a single comprehensive one for AOA disagree, instead of parts of other checklists for procedures which bear some relevance to the actual flight conditions.

Edit: @ecto1 (https://www.pprune.org/members/484909-ecto1) IMO Boeing needs to produce some hard data about how the trim system actually operates under real world conditions, not how manuals written in 1968 say it should work.

[GarageYears]

Another possible actor in this drama.

When boeing says to hold the trim wheel, when one study how the system is build and when one studies the data trace (and the misterious ND changes during multiple periods with no ND input).

I believe with sufficient pull and sufficient speed the trim motor clutch will slip and the trim wheels will creep ND.

If you blip the yoke switch and see the trim wheel not moving at a good pace and then you release and you see it slowly moving BACKWARDS, the whiskey tango foxtrot moment may be enough to make you forget about the pedestal switches.

Just another disturbing thought.

There is no evidence that anything like this happened. I suppose with enough time you could sit and make up all sorts of possible problems, but let's stick to the evidence as we have it.

- GY

[jan99]

I wonder if Boeing would not be better off taking their losses with MCAS and the trim system kludge by designing something appropriate for the narrow stick feel purpose, even if it means the certification of new hardware. A further software attempt is unlikely to impress and the equivalent of recertification and pilot sim training will be required anyway.
Loss of face, loss of money and admission of guilt are all water under the bridge.

[Chronus]

[QUOTE=Lost in Saigon;10443422]Just about everything you have read in the media is wrong. MCAS is not stall protection. MCAS does not counter the additional thrust of the more powerful engines. It is only there because the larger engine nacelles of the B737 MAX cause an aerodynamic pitch up moment at high angles of attack that did not meet FAA longitudinal stability and stick force certification standards.

The easiest fix was to automatically apply a little nose down trim at high angles of attack. (Quote)

I agree with all in the first paragraph but believe it needs to be expanded a little bit.

The B737 sat low on its undercarriage.For fuel efficiency the MAX was powered with much larger engines which had to be slung more forward than the old version. In addition the nose gear was raised by eight inches. This therefore meant that in order to satisfy the longitudinal stability requirements for certification, some fix was necessary. This then gave birth to MCAS. A quick fix through electronics control technology. The only point of its application naturally became the point of maximum effect, namely the horizontal stab. Accordingly the whole thing is one that addresses the original design concept, everything else would appear to be an attempt to overcome/control this in built longitudinal instability issue.
With it now comes an additional instrument, the AoA indicator wired into the whole system of automation. This piece of instrumentation did have its rightful place in the cockpit of a fighter jet, with its all moving horizontal stab, but does it really also have a place in a civil transport aircraft. Especially as a command function. After all to what is known so far about this particular event is that it was the stubborn stab that took the aircraft down despite all the crews efforts to encourage it away from its determined course.

[RatherBeFlying]

I hope the investigators will look into the AoA failure rate pre MAX. How many have been pulled for repair or replacement? Birds and ramp rash did not begin with the MAX.

Pre MAX, an AoA failure seems to produce "only" stick shaker and IAS disagree which every 737 crew handled successfully (until ET and JT). I suspect there's been a considerable number.

[MurphyWasRight]

Another possible actor in this drama.

When boeing says to hold the trim wheel, when one study how the system is build and when one studies the data trace (and the misterious ND changes during multiple periods with no ND input).

I believe with sufficient pull and sufficient speed the trim motor clutch will slip and the trim wheels will creep ND.

If you blip the yoke switch and see the trim wheel not moving at a good pace and then you release and you see it slowly moving BACKWARDS, the whiskey tango foxtrot moment may be enough to make you forget about the pedestal switches.

Just another disturbing thought.
A better explanation for the slight drift down while the electrical trim was disabled is that the pilots were attempting to move the wheel by rocking it but were not able to.
The deleted video clearly show how this might happen.
Just because the prelim report has no mention of activity during this time does not mean it was absent, we do not have a CVR transcript just a few excerpts.

The jackscrew cannot back drive the manual trim wheel for the same reason a screw jack holding a car will not slowly lower the car.
.

[Brosa]

Could they just have switched autopilot on?That's what they tried to do, but it didn't engage.

[ecto1]

A better explanation for the slight drift down while the electrical trim was disabled is that the pilots were attempting to move the wheel by rocking it but were not able to.
The deleted video clearly show how this might happen.
Just because the prelim report has no mention of activity during this time does not mean it was absent, we do not have a CVR transcript just a few excerpts.

The jackscrew cannot back drive the manual trim wheel for the same reason a screw jack holding a car will not slowly lower the car.
.
That's called irreversibility. A screw Jack is irreversible. A ball recirculation screw Jack is reversible. The steering of a truck as an example of the latter.

And to the poster who suggested to stick to what happened and not to what may have happened, I think he is right and I would try to post only probable theories, not merely possible ones. The trim drift is bugging me inmensely but it is probably irrelevant and the rocking explanation also fits.