Ethiopian airliner down in Africa

[diclemeg]

And yet...it's the MD95, also known as the Boeing 717, that never has had a fatality..... McDonnellDouglas made a great plane...

[diclemeg]

Avionista



I sincerely hope that Boeing engineers are doing this as we speak, otherwise they won't have a leg to stand on if this ever comes to trial. Saying that it was designed and calculated to do X and Y back in 1968, is not going to impress a jury...
Unless a jury is composed of very competent pilots, then I doubt a layman will lead to a real prosecution.

[Dad was ATC]

Only 156 produced though . . .

[dingy737]

“Just because the prelim report has no mention of activity during this time does not mean it was absent, we do not have a CVR transcript just a few excerpts.”

True. There is no mention of the gear up call.

[MurphyWasRight]

That's called irreversibility. A screw Jack is irreversible. A ball recirculation screw Jack is reversible. The steering of a truck as an example of the latter.

And to the poster who suggested to stick to what happened and not to what may have happened, I think he is right and I would try to post only probable theories, not merely possible ones. The trim drift is bugging me inmensely but it is probably irrelevant and the rocking explanation also fits.

Not sure context of your comment, whether just to illustrate the difference or suggest 737 uses recirculating ball screw.

To be clear the 737 does not use a ball recirculation screw Jack, it uses a acme nut and threaded rod hence irreversible .
I am not an aircraft mechanic (engineer across the pond) so I could be wrong but a quick search seems to confirm my understanding.

[AerocatS2A]

With it now comes an additional instrument, the AoA indicator wired into the whole system of automation. This piece of instrumentation did have its rightful place in the cockpit of a fighter jet, with its all moving horizontal stab, but does it really also have a place in a civil transport aircraft. Especially as a command function. After all to what is known so far about this particular event is that it was the stubborn stab that took the aircraft down despite all the crews efforts to encourage it away from its determined course.

The AoA vane (not an indicator) is not new with MCAS. All airliners use AoA vanes.

[Realbabilu]

That's what they tried to do, but it didn't engage.


It was engaged in 05:39:20 with AP CMD A for 30 seconds [off about 05:39:50], or i was wrong?

Since it engaged, the pilot confidence to told the FO retracting the flaps. 05:39:45


https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/1453x879/et302_fdr_trace_specifics_c8e7c4682349647e1c9334fc1dc18e72ef 87f9c0.png

FDR ET AVJ

[deltafox44]

As you accelerate the plane pitches up due to lift being in front of cg and you need to trim nose down to fly level. And vice Versa. Lesson 1 of type rating course on sim covers this.
I know that, thank you :{

At low speed and with a limited amount of AND untrim, increasing speed may reduce or cancel aft column required, due to static stability of the aircraft. But in the case of ET302, even at 500 kt IAS and still both pilots pulling as much as they can, the aircraft has a -10° AoA and -2g ! No hope to reach any in-trim airspeed..

What I mean is that manual trimming was impossible due to loads on elevator (which vary as the square of airspeed) ; that the only thing that could have save the day is to slow down at a speed where loads would have permitted manual trimming.

Instead, they let full power up to VMO and above... I could not imagine why, now I know that it was what was recommended by Boeing... :ooh:

[deltafox44]

AP disengage when AoA disagree.
No. AP has been ON for 33 seconds with AOA disagree since the rotation. It disconnected only when the captain decided to maintain runway heading while the heading selector induced a right turn.

I have read that, depending of software version, AP would disconnect after 5 minutes of stick shaker, but I don't know it is the case for ET301

[DType]

Acme nuts and threaded rods CAN be reversible, especially in a vibrating environment, as has been realised too late too many times.
But probably irrelevant in this case.

[airman1900]

Aviation Week: Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding

Aviation Week: Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding

Guy Norris Apr 9, 2019

Pilot feedback to the proposed software changes to the Boeing 737 MAX Maneuvering Characteristics Augmentation System (MCAS) flight-control law is positive, says Boeing. After demonstrations, pilots believe the potential for further flight-control problems from the system are a “nonissue,” the airframer says.

However, despite the positive response from pilots to the upgraded control system and associated training package, Boeing is gearing up for a prolonged international effort to reinstate the grounded MAX fleet. The embattled company, which first unveiled the proposed MCAS changes to a group of certification authorities and airline pilots in Seattle on March 27, is embarking on a global campaign to convince regulators that the updates will be sufficient to enable the aircraft to return to service.

The campaign encompasses a series of simulator demonstrations and briefings at multiple training sites throughout Europe, Asia and Australia and comes as Boeing attempts to handle a situation unprecedented in its history. Because the MAX was grounded first by China and other authorities around the world days before the FAA followed suit, the company says it is imperative to build support for an international caucus of regulators willing to reauthorize the MAX to return to flight.

The FAA, which in past years would have taken a lead role in such an effort, is similarly shifting gears and is now working alongside a broader group of international regulators to adjudicate the case. The agency says it expects to receive Boeing’s final package of its software enhancement over the coming weeks. Meanwhile the FAA has set up a Joint Authorities Technical Review (JATR) to conduct a comprehensive review of the certification of the aircraft’s automated flight-control system. Chaired by former NTSB Chairman Christopher Hart, the JATR is comprised of a team from the FAA, NASA and international aviation authorities.

Boeing, which on April 5 signaled a 19% production slowdown of its 737 line to ease the growing logjam of undelivered aircraft, is also providing more details about the changes to the MCAS functionality contained in the new P12.1 flight-control computer (FCC) software load that will replace the existing P11.1 software. Based on pilot reaction to date, the company says it is confident its software upgrade is certifiable.

The briefings continue to emphasize that the MCAS, which was added to the speed-trim system to standardize handling qualities with those of the 737 Next Generation, is “not a stall-protection function and not a stall-prevention function,” says Mike Sinnett, Boeing Commercial Airplanes vice president of product development and future airplane development. “It is a handling-qualities function. There’s a misconception it is something other than that.“

Added to ensure a linear relationship between stick force per G, “speed trim is a function of airspeed, so if you’re going fast, it’s a low angle-of-attack (AOA), and if you’re going slow, it’s at higher AOA,” he notes. “The thing you are trying to avoid is a situation where you are pulling back and all of a sudden it gets easier, and you wind up overshooting and making the nose higher than you want it to be.”

Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design. To do that, it activates based on AOA rather than based on speed—which is what speed trim does. Speed trim is a function of airspeed, and MCAS is a function of angle-of-attack and Mach number, but it only triggers off AOA.”

In the initial briefing sessions for pilots on March 27, “we didn’t talk specifically about either of the accidents, but we ran through MCAS scenarios,” says Sinnett. “From the accidents, we now know how MCAS can behave when there is an erroneously high AOA input, so we walked through scenarios where that could occur. We demonstrated those in the simulator.”

In these sessions, pilots and regulators were able to interact via intercom and a big screen with Boeing pilots in the 737 MAX engineering cab. Following the sessions, “we went back to the classroom and said, ‘Here are the things that concern us most when we look at the scenario of the two accidents we just experienced,’” Sinnett says. “Upon reflection on what has occurred, it appeared the system could present a high-workload environment—and that’s not our intention. So we looked at changing the design to compare values from multiple AOA indicators to essentially eliminate the unintended trigger condition that causes MCAS to activate."

Sinnett says pilots appear satisfied that the three main layers of protection now added to the MCAS will prevent any potential repeat of the circumstances involved in the Lion Air and Ethiopian Airlines accidents. “We answered a lot of questions during the discussion, and then we went back into the simulator and demonstrated a number of different scenarios to run against these changes,” Sinnett says. “And the most compelling thing is that the AOA failure case turns into a run-of-the-mill AOA failure case like you might have on any other airplane. We didn’t get any negative feedback. It was all very positive, and any of the pilots who got into the simulator and saw the before and after, it was like, ‘Yes, OK, this is now a nonissue.’”

The first main layer of protection provided by the update is a cross-channel bus between the aircraft’s two FCCs, which now allows data from the two AOA sensors, or alpha vanes, to be shared and compared. AOA data continues to be fed from left and right vanes into their respective air data inertial reference units before being passed to the flight computers. However, the AOA data in both computers is now continuously compared. The change is made by software only and requires no hardware modification.

“In a situation where there is erroneous AOA information, it will not lead to activation of MCAS,” says Sinnett. He underlines that the entire speed-trim system, including the MCAS, will be inhibited for the remainder of the flight if data from the two vanes varies by more than 5.5 deg. If an AOA disagreement of more than 10 deg. occurs between the sensors for more than 10 sec., it will be flagged to the crew on the primary flight display.

The second layer of protection is a change to the logic in the MCAS algorithm that provides “a fundamental robust check to ensure that before it ever activates a second time, pilots really want it to activate,” says Sinnett.

The change would have protected the system from continuing to activate in the case of the Lion Air accident, in which the left AOA vane was stuck in the 20-deg.-nose-high position. In that circumstance, the logic rechecked if the MCAS was required and, registering the apparent nose-high position from the errant vane, commanded more nose-down trim. “Now it sees you’re in the same spot, it says you’ve got a stuck vane and says, ‘I’m not going to activate again,’” Sinnett notes.

“That’s assuming it will activate in the first place, which it won’t because one AOA vane with a high value won’t activate,” he adds. “When you do defense in depth, you have to artificially fail one layer to make sure you adequately design and test the next layer—so that’s what we had to do.”

Explaining the background to the third layer of protection, Sinnett says: “We also made sure if the second layer of protection failed somehow in some weird way and allowed MCAS to activate multiple times, the system now ensures the sum total is command-limited.” The result is that the pilots always have maneuvering authority remaining with the control column. “Pilots will always have the ability to override—although they had that before in other ways, like with the trim switch, for example. But with the software update, the column itself will always provide at least 1.2g of maneuvering capability. So you don’t just have the ability to hold the nose level, you can still pitch up and climb.”

[DaveReidUK]

To be clear the 737 does not use a ball recirculation screw Jack, it uses a acme nut and threaded rod hence irreversible .
I am not an aircraft mechanic (engineer across the pond) so I could be wrong but a quick search seems to confirm my understanding.

No, that's not correct.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/600x360/ballscrew_f2a11cd96867f1da7cc7e1f5871c4afda04cc953.jpg

[Brosa]

It was engaged in 05:39:20 with AP CMD A for 30 seconds [off about 05:39:50], or i was wrong?

Since it engaged, the pilot confidence to told the FO retracting the flaps. 05:39:45



FDR ET AVJTake a look at the blue line named "AP Warn CAPT".
That's the autopilot disconnect warnings they got.
You get that warning when
1. autopilot has disengaged.
2. an autopilot engage attempt is made and is unsuccessful.

The first two warnings were because of the unsuccessful attempts to engage the autopilot at around 400 ft.
The third warning was when it was disconnected after about 30 sek on autopilot.

But there is also a fourth warning at 05:43:15, right after they made those two quick trim inputs.
It certainly looks like they made a failed attempt to engage the autopilot here, doesn't it?


Was that the plan?
To turn the trim cutout switches back on so they could reengage the autopilot, hoping the automation would sort out their problems?

[MurphyWasRight]

Acme nuts and threaded rods CAN be reversible, especially in a vibrating environment, as has been realised too late too many times.
But probably irrelevant in this case.
True, but they can be designed to reliably lock if the conditions are known.
There is a discussion of this in the Lion Air thread, I remember that the consensus seemed to be that it is unlikely to happen in the 737 design, certainly not enough to cause a noticeable issue.
I recall that one point is that Boeing would have designed it to not drift with vibration to eliminate need for an independent brake.

[Bend alot]

So the Boeing software fix.

When you get a AOA disagree MCAS will not engage, and the "safety" requirement stick force feedback will not be there.

Is the feel of the stick there to assist the pilot not to over pitch? and is the feel of the feedback not best to have when you have falling items such as the AOA's.

I think this is not a satisfactory fix, as simply not having MCAS would be safer.

[FrequentSLF]

A stupid question from a SLF, how many not FBW aircrafts needed a software patch to certified? I cannot understand why a main control surface has to be actuated by HAL on a not FBW aircraft, when the certification requirements could be fulfilled with a redesigned feel system, I understand that such will imply no grandfathering, but still, if the problem is pilot feel, adjust the feel, without moving control surfaces...
I apologize if the above sounds stupid, but would like to have a proper understanding ...
thanks for your patience

[MurphyWasRight]

No, that's not correct.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/600x360/ballscrew_f2a11cd96867f1da7cc7e1f5871c4afda04cc953.jpg

Thanks.
I stand corrected,looks like it is indeed a ball screw.

I was misled by more than one diagram referring to the above assembly as a 'nut', some even said 'acme nut'.
That and reading the Alaska Air report which did have a nut rather than ball screw.

This is a good illustration of the pitfalls of using other than detailed drawings/schematics for analysis.
So far in this thread I have seen only one what looks to be a true schematic, the yoke trim switches with wire# but unclear labels, everything else has been a conceptual logic illustration or worse.

Same thing applies to reading the fdr plots without access to the numerical data and other factors such as sampling rates.
I suspect that the sloped lines on binary events on the plots might represent sampling uncertainty but have no way of knowing.

[Loose rivets]

airman1900 #3824

Taken from Mike Sinnett's publication:

Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot.

The bee in my bonnet about that rear column cut-off switch having been removed on the MAX, is it seems, still open to interpretation. The inference is there, but not the positive statement.

[RatherBeFlying]

Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design. To do that, it activates based on AOA rather than based on speed—which is what speed trim does. Speed trim is a function of airspeed, and MCAS is a function of angle-of-attack and Mach number, but it only triggers off AOA.”The software is getting modified - should be good as long as both vanes don't get taken out by a flock and the algorithm to always leave 1.2 g authority in the elevator attains 10E-9 reliability.

What I haven't seen yet is a procedure to block MCAS in certain stick shaker cases, especially on rotation or early takeoff.

[A0283]

9th Apr 2019, 23:38 #3831 (https://www.pprune.org/10443782-post3831.html) (permalink (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-192.html#post10443782)) Loose rivets (https://www.pprune.org/members/34274-loose-rivets)

airman1900 #3824 Taken from Mike Sinnett's publication:

Underscoring the difference between the speed-trim system on the 737 Next Generation (NG) and the MAX, Sinnett says: “Mechanically, on the NG there is a column cutoff switch that stops any automatic trim when the column is back to a certain spot. On the MAX, we still needed automatic trim when you got to that spot."

@LooseRivets - The bee in my bonnet about that rear column cut-off switch having been removed on the MAX, is it seems, still open to interpretation. The inference is there, but not the statement.

The article also states:

On the MAX, we still needed automatic trim when you got to that spot. MCAS differs from speed trim at elevated alpha because it bypasses that switch by design.

Bypassing could also mean the switch is still there for use by other systems. So no removal?

Next to that you would like to know things like if we are talking column or columns. How many switches are there. Are they NG or MAX only. Etcetera, etc… Is there an official Boeing press release with this information? … stilll many questions…

So, Mr Sinnett’s statements add something but are not clear enough and not deep enough. Many would welcome more.

I posted earlier in the thread that my impression was that only a detailed public presentation and publication by the ‘chief engineer (with FAA delegated certification signature authority)’ of the MAX would do. I wonder if Mr Sinnett fits that bill? The text has a ‘nice and sunny taste’, rather more commercial than tech savvy …

[Loose rivets]

Waaaaaaaaaay back I questioned the removal of the rear column switch(es) on the MAX - several times. It was in the same page as the change of cut-out switch wiring.

The statement was unequivocal but having read in for months without making many notes, I fear it was lost in the haze.

I try to filter out my source material and missives from Seattle usually catch my eye.

[fdr]

As you accelerate the plane pitches up due to lift being in front of cg and you need to trim nose down to fly level. And vice Versa. Lesson 1 of type rating course on sim covers this.

back on planet earth, where Newtonian physics still reigns, you may find that for an aircraft to be statically stable, mass is always ahead of the center of pressure. Now your B2 may be unstable but pretty much no airliner is unstable, including the Max8. It has a reduced stick force gradient in part of the envelope, which MCAS addresses, just as STS deals with another gradient issue in a different part of the envelope.

Nect time you you are in a pub with a dartboard, throw a dart feathers first and observe status stability play out.

The acceleration issue as quoted before this comment, where in the excessive out of trim AND case is so that the aircraft approaches the speed that it has been miss-trimmed to, and near that point, the stab forces between section Cm and the elevator countering load will approach a minimum, allowing for movement of the stab with less force.

Now the the non linear longitudinal stability arises from the component of lift arising from the engine nacelle, which happens to be forward of the center of mass, so as additional lift is generated, that results in a pitching moment being added to the total body pitching moment. The fuselage is a lifting component, as are the wings. The stabiliser normally generates a downforce to counter the pitching moment of the total aircraft.

end

[Water pilot]

Aviation Week: Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding
No offense to those here but I would feel a hell of a lot better if Boeing were demoing the system to engineers rather than (or in addition to) pilots. Perhaps Airbus engineers? The best testers are your competitors.

I have no experience with aircraft but their solution does not give me the warm fuzzies. One thing that I find extremely weird is that it silently disables MCAS if the AOA sensors differ by five degrees. So do you need MCAS or not?

[73qanda]

So do you need MCAS or not?
Only if you change the aerodynamics of the aircraft by moving the engines forward and up and making them bigger in order to burn less fuel in order to compete with your competitor and at the same time avoid paying for certifying a new aircraft. ie If you want to have your cake and eat it too.

[YRP]

Something I have never understood wrt this - is it possible for the a330 to be in the air with an airspeed of 60 knots or even 70 knots and NOT be stalled? If not then why inhibit the warning? Worrying about sensor accuracy seems to be missing the bigger picture wrt the purpose of the warning!

I guess you then run into the other failure situation, false stall warnings when a sensor is broken, possibly overloading the crew similar to the stick shaker here.

[Loose rivets]

DaveReidUK #3825 Showed a clear picture of the screwjack motor but presumably not the gearboxes and clutches.

Apropos it having a 'continuous rating' or not, judging by the size of the code plate, it's not an extraordinarily large unit though the 3 phase supply is an indication of its power.

It was stated somewhere that there's one motor, and the clutches and gears are selected for the differing modes. More dredging memories. One statement said the motor can keep running while functions change - implying there might be a time where neither clutch was engaged. I would assume a time-out, on the running, but have failed to find positive details of the processes. I read the very detailed modes with relay control etc., but not how that motor operates inside. i.e., there must be a huge reduction even prior to the other gears/clutches. I base this on the shaft size.

The point has been raised, but the hammering that system got, i.e. heaving against stalled (as in mechanically stalled) stabilizer, might just have made those inert last moments come about by failure rather than just the excessive (aerodynamic) loads.

[Chris2303]

SLF here

Could the pitch up problem caused by the new engine position be ameliorated with the use of strakes such as those on the CF6 attached to the DC10?

[Machinbird]

Loose rivets
It is entirely possible to change speed with a properly wound 3 phase motor by electrical means only, without resorting to clutches and alternate gear paths.
When motors are powered by 400 cycle power, you can make them much smaller for the same horsepower output.
No doubt, there is a gear reduction between the motor and stabilizer trim to match torques properly, but that is all that is necessary to do the job.

[Freehills]

SLF here

Could the pitch up problem caused by the new engine position be ameliorated with the use of strakes such as those on the CF6 attached to the DC10?

Probably, but then you have the issue of understanding what that will do to the rest of the performance of the aircraft - will almost certainly increase fuel consumption, and would require major testing of what the altered airflow may impact in other stages of flight

[kiwi grey]

Taken from Mike Sinnett's publication:

The first main layer of protection provided by the update is a cross-channel bus between the aircraft’s two FCCs, which now allows data from the two AOA sensors, or alpha vanes, to be shared and compared.


Is this a hardware change, it certainly reads like it?
If it is,

what are the certification implications? and
what are the retrofit requirements - minutes / hours / days per aircraft?

[CP Bern von Hoesslin]

Ref.: 737-7/8/9 Training Manual 22-11-00, Dated 19.Sep.2016 Pages 165, 166 and 167

Ref.: THE MOST IMPORTANT QUESTION ON THE LION AIR AND ETHIOPIAN 38M AIRCRAFT CRASH INVESTIGATION maybe!

A simple version here.

Will the PRI Toggle when moved to CUT OUT, IS IT 100% GUARANTEE to remove -all- electrical signals to the Stab Trim Motor?

Why do I ask? "The FCC supplies MCAS signal to enter high speed mode on the stab trim motor and bypass the aft column cutout switches for trim down commands.". As we know also in error.

THUS if the B/U is in CUT OUT, then MCAS still has authority but what about PRI in CUT OUT?"

The trim commands from the FCC is processed in the "autopilot section of the motor". That means besides the FCC A in these cases, there is another controlling Software either part of the MCAS programing (thus active when a Fault like is being considered part a chain of errors in these two accidents) or a separate sub routine / program influencing the Stabilizer Motor into moving the Stabilizer that has never been mentioned before.

I'm thinking like a chicken with its head cut off, the nerves can still allow it to run around.

So the PRI in CUT OUT, does it still allow impulses from the "auto pilot section of the motor" however created, to move the stabilizer via 28VDC thru the motor un-commanded when the operating crew thinks they've isolated that electric trimming (CUT OUT), thus do not expect further electric trimming (non-pilot induced)?

To keep it simple - PRI and B/U toggles in CUT OUT there is no possible way the stabilizer movement (NU or ND) can be activated unless done manually by the crew using the Trim WHEELS OR a failure of the stabilizer mechanics i.e. excessive speeds beyond VMO, thus possibly breaking or stressing / stretching the components moving the stabilizer itself i.e. for example into the full AND position which is then fatal as non-recoverable?

Any Source I can contact, kindly PM? I do not have access to Boeing Customer Service any more.

Thanks in advance for all PPRUNER's efforts here.

CP Bernd von Hoesslin

===============================

You can’t use the Private Messaging system, add url links or images until you have an established posting history

[EDLB]

The MCAS was needed for certification, because the large engine nacelles produce lift, because they are large and in a forward position to CG. That’s for any nose up situation.
I ask myself if the opposite is true in a severe nose down situation with negative AoA, then a larger nose up force by the stabiliser/elevator will be needed to counteract those additional nose down forces than for the non MAX versions.

I would assume that that was a part of the MAX certification test flights.

[quentinc]

Taken from Mike Sinnett's publication:


Is this a hardware change, it certainly reads like it?
If it is,

what are the certification implications? and
what are the retrofit requirements - minutes / hours / days per aircraft?



"The change is made by software only and requires no hardware modification." Is what the article says.

[yanrair]

I know that, thank you :{

At low speed and with a limited amount of AND untrim, increasing speed may reduce or cancel aft column required, due to static stability of the aircraft. But in the case of ET302, even at 500 kt IAS and still both pilots pulling as much as they can, the aircraft has a -10° AoA and -2g ! No hope to reach any in-trim airspeed..

What I mean is that manual trimming was impossible due to loads on elevator (which vary as the square of airspeed) ; that the only thing that could have save the day is to slow down at a speed where loads would have permitted manual trimming.

Instead, they let full power up to VMO and above... I could not imagine why, now I know that it was what was recommended by Boeing... :ooh:

my apologies. Misunderstanding. I was just referring to 737 needing AND trim all the time during acceleration.
all you say is correct. The NNP for runaway stab. Is predicated on staying ahead of trim requirements. To avoid the last ditch heave up , and unload- TRIM TRIM TRIM NU routine. Use trim switches NU until stab back in trim - not blip blip , but major NU input over several seconds. STAB OFF. TRIM Manually thereafter. In runaway stab in previous variants by the time you notice, the stab. will be a couple of divisions AND. Or more and requires a sustained ANU input.

[yanrair]

back on planet earth, where Newtonian physics still reigns, you may find that for an aircraft to be statically stable, mass is always ahead of the center of pressure. Now your B2 may be unstable but pretty much no airliner is unstable, including the Max8. It has a reduced stick force gradient in part of the envelope, which MCAS addresses, just as STS deals with another gradient issue in a different part of the envelope.

Nect time you you are in a pub with a dartboard, throw a dart feathers first and observe status stability play out.

The acceleration issue as quoted before this comment, where in the excessive out of trim AND case is so that the aircraft approaches the speed that it has been miss-trimmed to, and near that point, the stab forces between section Cm and the elevator countering load will approach a minimum, allowing for movement of the stab with less force.

Now the the non linear longitudinal stability arises from the component of lift arising from the engine nacelle, which happens to be forward of the center of mass, so as additional lift is generated, that results in a pitching moment being added to the total body pitching moment. The fuselage is a lifting component, as are the wings. The stabiliser normally generates a downforce to counter the pitching moment of the total aircraft.

end
Well spotted. You trim nose down during acceleration because centre of lift moves forward. From memory.

[GordonR_Cape]

A0283

So, Mr Sinnett’s statements add something but are not clear enough and not deep enough. Many would welcome more.

I posted earlier in the thread that my impression was that only a detailed public presentation and publication by the ‘chief engineer (with FAA delegated certification signature authority)’ of the MAX would do. I wonder if Mr Sinnett fits that bill? The text has a ‘nice and sunny taste’, rather more commercial than tech savvy …

Way back on 27 Mar, the Seattle Times mentioned that Sinnett was trying to win back confidence. As VP of development, this is a double edged sword: https://www.seattletimes.com/business/boeing-aerospace/boeing-details-its-fix-for-the-737-max-but-defends-the-original-design/

Boeing details its fix for the 737 MAX, but defends the original design

Edit: As a computer programmer (not a pilot), those 3 key questions were ones I asked repeatedly after the "fix" was announced. It has taken a long time for details to emerge, so AvWeek needs to be thanked for that.

[Goth]

“In a situation where there is erroneous AOA information, it will not lead to activation of MCAS,” says Sinnett. He underlines that the entire speed-trim system, including the MCAS, will be inhibited for the remainder of the flight if data from the two vanes varies by more than 5.5 deg. If an AOA disagreement of more than 10 deg. occurs between the sensors for more than 10 sec., it will be flagged to the crew on the primary flight display.

Is there a reason for the different thresholds for AoA disagree and STS/MCAS inhibit?

So if an AoA vane sticks so that it's (say) 8 degrees offset from the other for a period, STS and MCAS will be disabled for the remainder of the flight, with a change to handling characteristics but no crew warning - or is there an STS/MCAS warning indication as well as AoA disagree?

[Fortissimo]

You trim nose down during acceleration because centre of lift moves forward

I think the larger effect is not so much any centre of pressure movement (which does contribute) but the fact that your overall lift is a V-squared function. When you accelerate you have to reduce AoA to maintain the same lift (for level flight), so lower nose attitude and more AND trim.

[Ian W]

That is possibly the worst suggestion so far.

Assembly code is almost impossible to analyse for correctness in any meaningful way. It is far better (and provably so) to write in a well-specified (i. e. not C) language, prove the source code correct (for which scalable and practical techniques exist today), or define and prove correct a finite state machine and have code generated from it. That still leaves one with a need to have reasonable confidence in the compiler, but in many cases the service history for the most-used language core, and, in some recent cases, formally verified compilers, take care of that.

Just because you have one hero programmer who claims to have done it "Right" in assembly does not help you in any way because you need to demonstrate that it does what it is supposed to do (reliability), and never does what it is not supposed to do (safety), and ideally also never fails (availabilitiy). And this cannot be demonstrated by testing alone to the extremely high requirements needed in aviation. Assembly and machine code are avoided like the plague in safety-critical programming, and rightly so. Where some parts require it, extreme care must be taken to get it right, and the amount must be kept to a minimum.

Besides, as threemiles has pointed out, the implementation is not the problem (as far as we can tell, it may be flawless), but the specification. "Working as specified" can also mean that it did the wrong thing.

Bernd

Almost all the major 'programming errors' I have seen have been perfectly implemented errors in understanding due to poor systems analysis/design. Coding these days rarely has errors as there are many tools that can be used to verify the code it will also validate correctly as the code does just want the designer erroneously asked it to do. This is the shortcoming in mathematical approaches and formal proofs they do not find these errors in understanding but they do limit the avionics; it is one of the reasons FMCs are beasts of little brain as anything with any power is beyond formal proof.

.

[fdr]

I think the larger effect is not so much any centre of pressure movement (which does contribute) but the fact that your overall lift is a V-squared function. When you accelerate you have to reduce AoA to maintain the same lift (for level flight), so lower nose attitude and more AND trim.

section pitching moment, CsubM tends to increase on symmetric and cambered sections with increasing AoA. A section with a reflex camber may maintain low moments, which is why they are used occasionally on rotor sections, where they reduce pitch link loads. As Mach increases, pitching moment tends to increase. At very high Mach, (above MMO, approaching MD,), CsubL for a given AoA reduces, when a normal shock develops on the underside of the section. As washout results in a higher AoA inboard, and section T/C is greater normally inboard, the shock development is most pronounced inboard, and to maintain a constant total lift, the tips become more loaded, resulting in a shift rear wards of the total lift relative to longitudinal station, with increased lift distribution outboard. Separate to all that, the aircraft is required to have a nose down trim needed for increasing speed above trim speed (AoA) and vice versa, the result of inflow to the tail, tail volume and section moment design. A change in speed alters the normal force from the section as a function of the differences of the squares of the speeds, therefore level flight requires a lower AoA which is achieved by a lowering of attitude. To achieve that outcome the slope of CsubL to AoA, the a-slope need to be equal or the tail has to have a lower slope than the wing, when the inflow. Volume and section coefficients are considered. You can fly a plane with neutral static stability, they are fun to fly, they just are higher workload on instrument flying for extended periods, ask any Helo pilot ( helos are mildly statically stable, but are dynamically unstable in pitch in forward flight and hover and also in yaw in hover)

[Ian W]

And yet...it's the MD95, also known as the Boeing 717, that never has had a fatality..... McDonnellDouglas made a great plane...

Of course to be pedantic it was the Douglas Company 9. They had problems with the screw jack and stab jamming too didn't they in the 717 older brother MD-8# series

[fdr]

Well spotted. You trim nose down during acceleration because centre of lift moves forward. From memory.


nope, Re-read the quote, and get a white board and draw out the forces to see the couples.

read my follow up comment, any further questions feel free to PM.

CsubP moves forward on a section as AoA increases, however it is dependent on section camber, and also to an extent the section LE radius. A section that has a laminar separation bubble will have a slight wobble in moments for lift and pitching but not a big deal. Mach tuck occurs due to reduction in lift inboard, on a swept section this loads the tips giving a pitching moment, as well as a movement rearwards of Cp and the resultant pitching moment from that change, Cp follows normal shock movement on the section. As the wing section and T/C result in shock formation being more pronounced inboard than outboard, the total result is an increase in pitching at higher Mach. At speeds below Mcrit, lift and section a-slope, and inflow to the tail result in pitch moments leading to nose down trim being needed as speed rises above trim speed. Shock formation is not relevant to JT or ET’s events, they had normal pitching moments going on other than the MCAS establishing a major trim error for desired speed.

The annoyance of MCAS is that it has authority to schedule trim for a period of more than 3 times the miss-trim case considered for certification, per 25.255, which seems like a lousy concept.

[LEOCh]

back on planet earth, where Newtonian physics still reigns, you may find that for an aircraft to be statically stable, mass is always ahead of the center of pressure.
Agreed with the rest of your post, but as a counter-example to the statement above, consider a 737 NG loaded to it's absolute rear limit (36%MAC), and trimmed to fly at high but nonstalling AoA. It's CP will be relatively forward and close to but not reaching the wing aerodynamic centre of 25%MAC (will be approximately 32%MAC). CP is hence ahead of the CG and the tail is lifting slightly to maintain trim. However, the aircraft is still longitudinally stable, as although the tail is lifting it's local AoA is less than the wing. Of course this is an edge case for stability, more often CP is behind the CG in all flight regimes and the tail is always in downforce.

[fdr]

Agreed with the rest of your post, but as a counter-example to the statement above, consider a 737 NG loaded to it's absolute rear limit (36%MAC), and trimmed to fly at high but nonstalling AoA. It's CP will be relatively forward and close to but not reaching the wing aerodynamic centre of 25%MAC (will be approximately 32%MAC). CP is hence ahead of the CG and the tail is lifting slightly to maintain trim. However, the aircraft is still longitudinally stable, as although the tail is lifting it's local AoA is less than the wing. Of course this is an edge case for stability, more often CP is behind the CG in all flight regimes and the tail is always in downforce.

nope.

25% is a convention for measurement of moments, so a wing with zero pitching moment will have a Cp at 25% chord. Refer to Abbot and VonDoenhoff to look at the moments that occur on a section. Next time walking around your brand A or B plane have a look at the section of the stab, it is an inverted cambered section, which means it has a zero lift line, ZLL, that is considerably beyond a zero stab LE up limit, which is usually around 2 to 3 degrees up dependent on flavour. The stab resides in an area of down wash on standard tails, less so for T tails or cruciform tails. The stab on an A or B brand does not get to a point in normal use of trimming to an up force. The elevators of course may result in a change above the stab limit, but would be untrimmed. For your vanilla flavoured brand, the neutral point is way, way further back, around a center of mass aft of 40% for a plane with an aft envelope limit of 32%. Long time back we looked at a B744 that achieved 43.5% in flight... vs a 32% envelope. The plane was marginally statically stable (being generous), and appeared to be slightly dynamically unstable, the autopilot coped with the mis load, but dang if the elevators weren’t working their passage, they oscillated for the whole flight. To achieve that level of load error, the nose wheel was not on the ground at 80kts, and on landing, the plane sat with the nose wheels off the ground, unable to steer for taxi. Even at that case, the tail was producing a slight down force.

[3rd_ear]

MCAS... “not a stall-protection function and not a stall-prevention function,” says Mike Sinnett, Boeing Commercial Airplanes vice president of product development and future airplane development. “It is a handling-qualities function. There’s a misconception it is something other than that.“

Eeeeew! That gives me the heebies, it reeks of disingenuity. Is he justified in what he says?

[GordonR_Cape]

Eeeeew! That gives me the heebies, it reeks of disingenuity. Is he justified in what he says?

As a computer programmer and former engineer, the time-delay between the AOA input, and the 10-15 second activation of MCAS, could lead to oscillatory behaviour. Pilot input may still be needed, along with some training.

Edit: I meant it is not an 'elegant' solution, more a band-aid. And the nose-down trim still needs to be explained to pilots.

Edit #2. Forgot to add that when MCAS 'unwinds' the trim that it previously applied, this is another time delayed effect.

[bsieker]

Eeeeew! That gives me the heebies, it reeks of disingenuity. Is he justified in what he says?

Yes, and this has been discussed a dozen times here. Of course one reason for the certification requirement for certain control forces at increasing angles of attack is there to make it harder to stall the aircraft inadvertently, but the primary reason for MCAS is to fulfill very specific criteria for control forces (14 CFR, §25.173), and even more specific instructions on how to demonstrate their fulfillment (14 CFR, §25.175).

Bernd

[catch21]

Sadly I haven't been able to keep up with all the posts in this thread so apologies if this is a duplicate.

How did the MEL change with respect to AoA sensors with the introduction of MCAS?

My understanding from this:

http://fsims.faa.gov/wdocs/mmel/b-737_rev%2057.pdf

is that only one AoA sensor is required before despatch?

[bsieker]

As a computer programmer and former engineer, the time-delay between the AOA input, and the 10-15 second activation of MCAS, could lead to oscillatory behaviour. Pilot input may still be needed, along with some training.

Edit: I meant it is not an 'elegant' solution, more a band-aid. And the nose-down trim still needs to be explained to pilots.

I don't recall anyone having said that there is a delay between fulfillment of MCAS activation criteria and the (first) trim input. There is only a 5 second inhibition of further trim inputs after manual electric trim input.

Bernd

[Lost in Saigon]

SLF here

Could the pitch up problem caused by the new engine position be ameliorated with the use of strakes such as those on the CF6 attached to the DC10?

The problem with the MAX is that the larger, more forward, engine nacelles create too much lift at high angles of attack. Strakes would create even more lift. Why would that help?

[bsieker]

Sadly I haven't been able to keep up with all the posts in this thread so apologies if this is a duplicate.

How did the MEL change with respect to AoA sensors with the introduction of MCAS?

My understanding from this:

http://fsims.faa.gov/wdocs/mmel/b-737_rev%2057.pdf

is that only one AoA sensor is required before despatch?


The line referring to the alpha vanes explicitly only lists Original and Classic models (-100/-200/-300/-400/-500). Not NG (or MAX).

Bernd

[3rd_ear]

Yes, and this has been discussed a dozen times here. Of course one reason for the certification requirement for certain control forces at increasing angles of attack is there to make it harder to stall the aircraft inadvertently, but the primary reason for MCAS is to fulfill very specific criteria for control forces (14 CFR, §25.173), and even more specific instructions on how to demonstrate their fulfillment (14 CFR, §25.175).


Ok, I'm with you - I've read most of this thread and yes, the intent of MCAS seems clear. Perhaps I wouldn't have reacted if he'd said "intended to be a handling qualities function" instead of "is...". Maybe wrongly, I mentally separate emulation from underlying functionality (computer background) and that doesn't apply here? As if, in this case, "sure, it's just like the NG but boy, we had to screw with the kernel to get that working".

[deltafox44]

my apologies. Misunderstanding. I was just referring to 737 needing AND trim all the time during acceleration.
all you say is correct. The NNP for runaway stab. Is predicated on staying ahead of trim requirements. To avoid the last ditch heave up , and unload- TRIM TRIM TRIM NU routine. Use trim switches NU until stab back in trim - not blip blip , but major NU input over several seconds. STAB OFF. TRIM Manually thereafter. In runaway stab in previous variants by the time you notice, the stab. will be a couple of divisions AND. Or more and requires a sustained ANU input.

Here is what I was referring to (published by satguru) :
https://66.media.tumblr.com/24b35c04b87f41a3229fe6b6b67d9f06/tumblr_ppqyih34CG1umtbhho1_540.jpg
Recent training handbook also recommend using the speed for which the aircraft is trimmed, i.e. AND => increasing speed
https://66.media.tumblr.com/9b18a3450ba343df432a64bae8671698/tumblr_ppqyih34CG1umtbhho2_1280.png
In the case of ET 302, it is clear that INCREASING speed had no chance of success and lead to loosing control.

REDUCING speed would have caused a pitch down moment induced by static stability and by reduced thrust, which AMHO could have been counteracted by elevator, until the moment when the aerodynamic loads would have been alleviated enough to permit manual trimming. If manuel trim were still jammed, aft forces required on the column to maintain level flight would have been lower (due to logic of feel and centering system) with no risk of elevator blowback anymore.

[deltafox44]

Eeeeew! That gives me the heebies, it reeks of disingenuity. Is he justified in what he says?
It's just like saying they'll make an already safe aircraft safer. It sounds better that make a dangerous aircraft less dangerous :ooh:
MCAS was not there to prevent stall (which was already very unlikely) it was there to improve already excellent (though not certifiable) flying qualities :D

[armchairpilot94116]

These accidents cast doubt not only on the max but also on Boeing itself and on the FAA. The aljazeera expose on the 787 didn’t put Boeing in a good light about the 787. Now I wonder about the 777x. What did they cock up on that plane that we don’t know about yet? After all who the heck heard of MCAS before? Now it’s Boeing’s 4 letter word as in “ don’t MCAS it up now Jimmy”.

if that plane turns up broken or poorly thought out then Boeing will have nothing but flawed planes. I’m less proud and trustful of Boeing now than I was before. Same goes for the FAA being the authority it used to be.

killing Ralph Naders niece on the Egyptian flight was also bad for PR . Watch out he doesn’t come out with a new book.
“ unsafe at any speed -Boeing’s Corvair”.

Think i I will avoid the Max and the new 777x for a while

[bsieker]

What I don't understand is why they keep on using these "obsolete" AOA vane sensors with so many alternatives available.


And what are the alternatives to angle of attack vanes? Would you mind showing us your engineering analysis for use on commercial airliners, and the hazard and risk assessment showing that they are better?

"Someone had this brilliant idea and it's obviously so much better!" is not sufficient.

Neither is "it doesn't suffer from this particular problem, therefore it's always better."

Bernd

[Alchad]

killing Ralph Naders niece on the Egyptian flight was also bad for PR . Watch out he doesn’t come out with a new book.
“ unsafe at any speed -Boeing’s Corvair”.

Think i I will avoid the Max and the new 777x for a while

The thought had occurred to me that Nader could be a very big thorn in Boeing's side. With his background and the fact it is "personal" I doubt he is going to be very easily placated.

Alchad

[Icarus2001]

https://utcaerospacesystems.com/product_gallery/air-data-systems/

https://www.swiss-airdata.com

https://www.flightglobal.com/FlightPDFArchive/1986/1986%20-%202855.PDF

The "alternative to AoA vanes" have been in use on commercial jet aircraft for quite a while. A moving vane is old style.

[Just This Once...]

Even the F-35 uses a smartprobe non-mechanical sensor for AoA, sideslip and pitot statistics. Even the venerable Bone uses them, so they have quite a broad operating range.

[patplan]

Here is what I was referring to (published by satguru) :
https://66.media.tumblr.com/24b35c04b87f41a3229fe6b6b67d9f06/tumblr_ppqyih34CG1umtbhho1_540.jpg
Recent training handbook also recommend using the speed for which the aircraft is trimmed, i.e. AND => increasing speed
https://66.media.tumblr.com/9b18a3450ba343df432a64bae8671698/tumblr_ppqyih34CG1umtbhho2_1280.png
In the case of ET 302, it is clear that INCREASING speed had no chance of success and lead to loosing control.

REDUCING speed would have caused a pitch down moment induced by static stability and by reduced thrust, which AMHO could have been counteracted by elevator, until the moment when the aerodynamic loads would have been alleviated enough to permit manual trimming. If manuel trim were still jammed, aft forces required on the column to maintain level flight would have been lower (due to logic of feel and centering system) with no risk of elevator blowback anymore.

An edited GIF version of Mentour Pilot Video...
..https://media.giphy.com/media/TgbF6sloqHQxGcxJTe/giphy.gif

Or, you can watch most of it here...
- https://vimeo.com/329558134

[bsieker]

https://utcaerospacesystems.com/product_gallery/air-data-systems/

https://www.swiss-airdata.com

https://www.flightglobal.com/FlightPDFArchive/1986/1986%20-%202855.PDF

The "alternative to AoA vanes" have been in use on commercial jet aircraft for quite a while. A moving vane is old style.




And what do you think is the reason the use of these is not more widespread? I would assume that the main reasons are: mechanical vanes are straightforward, and a standby instrument can just display a value without any computation.

But what's probably more important: they are robust. The "smart sensors" measure pressures at various holes to compute AoA, and these small holes are much more susceptible to icing and being clogged by dirt, in other words, these probes are much more sensitive to less-than-perfect environmental conditions. A partial obstruction of only one of those holes will (perhaps subtly) alter the value. And while that may be fine for an immaculately polished business jet, it is probably not ideal for commercial line operation.

How do you think any of the known accidents involving AoA probes would have been prevented by "modern" sensors?

QF 72: A problem with the ADIRU sending wrong data to the flight control computers. Nothing to do with the mechanical properties of the sensor
XL Airways Perpignan: AoA vane frozen solid because of improper washing procedures: Could just as easily have happened with "smart" vanes. Possibly slightly different failure more, but small orifices can easily ice over or get clogged
Lion Air: We don't know, but possibly also data processing, or else mechanical damage or improper installation. "Smart" probes will also give undefined/wrong values when damaged or installed improperly
Ethiopian: quite likely a sheared off vane. Any force that does that would also severely impact a "smart" probe.


So? Just because something is "old style" doesn't mean it's bad, or that newer things are necessarily better. I think AoA sensors without moving parts have not yet proven to be as good as traditional vanes.

Bernd

[MurphyWasRight]

And what do you think is the reason the use of these is not more widespread? I would assume that the main reasons are: mechanical vanes are straightforward, and a standby instrument can just display a value without any computation.

But what's probably more important: they are robust. The "smart sensors" measure pressures at various holes to compute AoA, and these small holes are much more susceptible to icing and being clogged by dirt, in other words, these probes are much more sensitive to less-than-perfect environmental conditions. A partial obstruction of only one of those holes will (perhaps subtly) alter the value. And while that may be fine for an immaculately polished business jet, it is probably not ideal for commercial line operation.

...
...
So? Just because something is "old style" doesn't mean it's bad, or that newer things are necessarily better. I think AoA sensors without moving parts have not yet proven to be as good as traditional vanes.

Bernd
One excellent use of the 'smart sensors' would be in combination with existing vane style.
This would greatly reduce chances of a common design/environmental fault affecting AoA values.

BTW: The B2 that was totalled in Guam went down due to blocked/miscalibrated sensors, so they are not infallible either.

[Just This Once...]

Don't worry about the video or the trim wheel - EASA has a note from Boeing saying it works throughout the envelope.

[Copy2015]

The MAX8 engine appears to have a strake on the inboard side at about the 3:00 position. Looks like it is for airflow, but would seem to provide lift at higher AOA.

[Just This Once...]

And what do you think is the reason the use of these is not more widespread? I would assume that the main reasons are: mechanical vanes are straightforward, and a standby instrument can just display a value without any computation.

But what's probably more important: they are robust. The "smart sensors" measure pressures at various holes to compute AoA, and these small holes are much more susceptible to icing and being clogged by dirt, in other words, these probes are much more sensitive to less-than-perfect environmental conditions. A partial obstruction of only one of those holes will (perhaps subtly) alter the value. And while that may be fine for an immaculately polished business jet, it is probably not ideal for commercial line operation.

Bernd

Did you just make that all up?

Maybe your idea of widespread is different to mine as just one manufacturer of this style of probe has quite a broad customer base - including Boeing, LM, Airbus, Northrop Grumman, BAES, Bombardier, Embraer, Sikorsky, Dassault, Gulfstream et al.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/1797x723/cef96297_7630_4146_8db5_63d4c96b4f67_f2a8f5fa5f26e9013fa9011 6023deac5d38b433f.jpeg
Your claim on sensitivity to environmental conditions looks odd for a probe type used on everything from battlefield helicopters and tactical airlifters all the way through to supersonic fighter aircraft and supersonic bombers. Airbus have been using them for nearly 20 years across a number of types!

[Lost in Saigon]

Don't worry about the video or the trim wheel - EASA has a note from Boeing saying it works throughout the envelope.


Is that the video that "Mentour Pilot" deleted?

I am not worried about the video because:

1) They purposely trimmed THE WRONG WAY just to see what happens.

2) It is a simulator and may not accurately reflect actual aircraft operation in the same situation.

[VicMel]

From #3820 “Aviation Week: Boeing Expands MCAS Demos To Speed Lifting Of 737 MAX Grounding”: There is not a single mention of SMYD, obviously Boeing cannot allow the stick shaker to still be driven by an invalid AoA. Boeing would not need to mention SMYD if, for the MAX, they had changed AoA processing and supplied AoA L & R data from the FCC directly to the SYMD via the ARINC 429 bus. It would make sense to do the processing only in one system and may help with CPU loading.

The idea that the invalid AoA problem is a fault, or different faults, in 3 AoA sensors seems to me to be very unlikely, purely from a consideration of reliability figures. AoA sensors are very reliable, from satcom.guru on 28th March:-
Reliability of the AoA sensor was evaluated over a 4-6 year period, with a mean time between unscheduled removals was 93,000 hours. A typical airframe is modeled at about 100,000 hours, so the AoA vane typically last nearly the lifetime of the airplane.
As has been suggested in an earlier post, there could be vulnerability in a new harness which causes a short circuit on a resolver signal. Or (back on my favoured suspect) a latent software fault which affects the processing of the AoA data.

There is an anomaly in the FDR for ET302 (Preliminary Report, page 26) at 05:38:42. It seems to show the Control Column L was pushed forward a second or two before Stick Shaker L started! This could be because the SMYD, if it gets its AoA data from the FCC, is running a cycle behind the FCC. Or it could just be an aspect of the ARINC bus data rates. If I recall correctly, there are various data rates available, and a fast changing control parameter going from one system to another (such as Control Column Position) would go at the fastest rate. A slow changing parameter only for diagnostics (such as Stick Shaker) would go at the slowest rate.

[GordonR_Cape]

An edited GIF version of Mentour Pilot Video...
..Or, you can watch most of it here...
- https://vimeo.com/329558134

Thanks for posting. I knew what was on the video from the text transcript on Bjorn at Leeham News, but it still makes for compelling viewing.

I wonder if Boeing's lawyers saw this last week, and said to the CEO: "If the jury ever sees this, we have lost already"...

[Alchad]

Thanks for posting. I knew what was on the video from the text transcript on Bjorn at Leeham News, but it still makes for compelling viewing.

I wonder if Boeing's lawyers saw this last week, and said to the CEO: "If the jury ever sees this, we have lost already"...

I've nothing to do with the aviation industry, but that video is very disturbing, those guys knew it was a simulation, if your (and others) life depended on it, truly frightening. If any pilot on here cares to explain that it's not realistic, or a fair approximation of what happened, please do.

If you don't want to watch the video, the transcript is equally compelling reading...

The original sim session transcript [C=CAPT; F=FO]:
C: We have an IAS disagree.
C: So, IAS disagree memory items.
F: Autopilot if engaged, disengage.
C: Disengaged!
F: Autothrottle if engaged, disengage.
C: Disengaged!
F: Flight directors - Both up
F: With flaps up established a flight path 4 degrees and 75% N1.
C: So, 75% N1.
F: We have 77, 76,...
C: A little bit less...
F: And, there you go.
C: 4 degrees.
F: 4 degrees.

C: So I am trying to establish this now.
F: Check!
F: We are descending...?
F: We probably... Are you feeling troubled with...
F :Any trouble with the flight control?
C: Yeah, I'm trying to trim it but...
C: It continues to trim against me when I'm trimming
C: So state the malfunction, please.
F: Yeah, this doesn't look right. Looks like uh...
F: How do you feel the stabilizer, the trim system?
F: Can you control it?
C: I'm trimming it. It is responding but...
F: It's a runaway stabilizer, if you agree?
C: For every time that I trim backward, it keeps trimming forward.
F: It's trimming forward. Yeah, it's runaway stabilizer.
C: So, runaway stabilizer memory items...
C: And i'm trying to keep this thing at 4 degrees.
F: Control column, hold firmly.
C: I am... [CAPT is holding the yoke firmly with both hands]
F: Autopilot - if engaged, disengage.
C: It's disengaged.
F: Autothrottle - if engaged, disengage.
C: It's..., if you can disengage it for me, make sure that it's disengaged.
F: It's disengaged.
F: And, do you feel that the failure stop?
F: Negative?
C: No, it's still moving.
F: Stab trim cutoff switches to cutoff.
F: OK. It stops. It looks like it stops.
C: You can see now I'm using almost full back pressure here.
F: Exactly.
C: How many degrees nose down?
F: We have 4 units nose down now
C: 4 units nose down?
F: Yup.
C: OK, I'm struggling.
C: I'm actually using almost my full force to keep the aircraft level here.
F: Do you want me to help you?
C: What I would like to do.
C: Just for the sake of exercise, can you trim this forward? [to simulate MCAS trim AND]
C: See if we can reach even zero nose down.
C: And see if I can even hold it.

[FO is trying to crank the trim wheel to reach zero nose down, simulating MCAS AND]

C: So, now we are doing this just as an exercise!
C: Do not try this at home.
C: This...
C: We are at 300 knots now.
F: I'm fighting.
C: I'm sttrugling to to keep this aircraft flying.
F: My god! [FO surprised at how hard it is to trim further nose down]
C: Yeah, the thing is with higher speed the force on the stabilizer will be higher and higher as well.
C: So it becomes almost impossible to move it.
C: So we are now at about 3 degrees.
F: Yup. [FO still tries to continue trimming nose down, the wheels is so difficult to spin]
C: We're still about 3 degrees away from full nose down trim.
C: And I am using everything that I have. [CAPT still holding on to his yoke with both hands]
F: My God ! [the trim wheel barely move for the down trim]
C: This is realistic guys.
C: This is how much of effort it would take to trim the stabilizer at this kind of speed.
C: Umph... [Capt is still trying to hold on to his yoke with his hands]
C: I'm just in control of it, though. But it's getting harder and harder.
C: And remember we're still 2.5 degrees away...
F: My God! [FO still struggles to spin the refused-to-be-spun trim wheel]
C: It's not possible, is it?
C: All right, we stop at that.

C: The reason that we have to try...
C: The reason we have to trim this manually is because the normal trim system wouldn't do this, OK.
C: It would require manual trim to get it away from this.
C: That's fine.
C: Trim it backward. [This time to illustrate the effort to trim the nose back up after "MCAS" brought the AC further nose down]
C: Trim it backward as you can.
F: Oh my God! I couldn't... [FO can't spin the wheel to trim up]
C: OK.
C: Eh...
C: Juan, press the red button! [CAPT called the sim operator...]
C: Press the red button now. [to stop the sim session]
C: This is at 340 knots.
C: And the trim is at...It's still at almost 2.5 degrees.
F: Yeah, 2.5 degrees.

Alchad

[GordonR_Cape]

Alchad

I've nothing to do with the aviation industry, but that video is very disturbing, those guys knew it was a simulation, if your (and others) life depended on it, truly frightening. If any pilot on here cares to explain that it's not realistic, or a fair approximation of what happened, please do.

Many people (still) blame the pilots for getting into that situation, by not taking action sooner. All sorts of clever answers are possible, for those sitting at home, and having had time to read the accident report.

[VicMel]

One excellent use of the 'smart sensors' would be in combination with existing vane style.
This would greatly reduce chances of a common design/environmental fault affecting AoA values.


And it is not just AoA vanes that are a Common Mode Failure by design, the 3 (or 4) pitot tubes for measuring TAS are all same technology, all located near to one another. The purpose of AOA sensors is to detect an imminent stall; a more direct measure (possibly a second source for a plausibility check) would be a pressure sensor built in to the upper and lower wing surface. It need not use holes, if something as mundane as a mobile phone can distinguish between a tap and a swipe, there must be other new technologies out there that could be used.

[MemberBerry]

Is that the video that "Mentour Pilot" deleted?

I am not worried about the video because:

1) They purposely trimmed THE WRONG WAY just to see what happens.

They trimmed the wrong way not "to see what happens", but to replicate MCAS trimming the wrong way, because electric trim can't trim nose down so much with the flaps up, as MCAS can.

At the end they tried to trim THE CORRECT WAY, but even with the trim at just 2.4 units from full nose down it was almost impossible for one person.

2) It is a simulator and may not accurately reflect actual aircraft operation in the same situation.

I don't understand why you are not worried. Is it because you believe it will be much easier on a real aircraft in the same situation? If that's the reason, what is the basis for your belief?

[bsieker]

Did you just make that all up?

Maybe your idea of widespread is different to mine as just one manufacturer of this style of probe has quite a broad customer base - including Boeing, LM, Airbus, Northrop Grumman, BAES, Bombardier, Embraer, Sikorsky, Dassault, Gulfstream et al.


Your claim on sensitivity to environmental conditions looks odd for a probe type used on everything from battlefield helicopters and tactical airlifters all the way through to supersonic fighter aircraft and supersonic bombers. Airbus have been using them for nearly 20 years across a number of types!

Have you ever looked at the nose of an A350? It clearly has a lot of mechanical vanes, three alone for sideslip angle, and some combined probes (pitot plus mechanical vane). Same for the A380. So no, Airbus is not relying on fancy smart probes, although they may use them alongside traditional vanes.

And you are aware that the picture is from a sales brochure by the manufacturer. Maybe Airbus evaluated such probes, which would be enough for them to claim the type on their list. You may also notice that the picture uses the weasel word "... programs", which could mean anything. A "program" can also just be a theoretical evaluation, with a final decision against it.

There are also mechanical vanes on the A400M, the 787, the CSeries, etc. Business jets, yes, but other than the E2 I haven't seen one airliner without them. Not exactly widespread. And that's all just because ... manufacturers cannot be bothered to use modern technology?

Bernd

[Lost in Saigon]

They trimmed the wrong way not "to see what happens", but to replicate MCAS trimming the wrong way, because electric trim can't trim nose down so much with the flaps up, as MCAS can.

At the end they tried to trim THE CORRECT WAY, but even with the trim at just 2.4 units from full nose down it was almost impossible for one person.



I don't understand why you are not worried. Is it because you believe it will be much easier on a real aircraft in the same situation? If that's the reason, what is the basis for your belief?

In the video they spent far too long fighting the control forces before attempting to operate the trim cutout switches. Maybe they were trying to represent the lowest common denominator in pilot skill? MCAS does not operate if the pilot toggles the trim switch so they should have been able to operate the trim cutout switches before the aerodynamic load became excessive. "Should Have" is important but we'll have to wait for the full report to find out why they didn't.

I have no idea whether or not it would be easier in a real aircraft. I just don't trust that a simulator can accurately reproduce what actually happens. It would be interesting to hear from someone who has actually experienced excessive airloading of the stabilizer trim in a B737.

[Jetthrust]

I absolutely agree. The aviation authorities have the hardest of evidence possible that “average” pilots are unlikely to cope. Boeing’s dilemma is this then means the MCAS system (at least) has to be considered as a “catastrophic” safety critical system. The MCAS software then has to be “Level A” according to DO-178C.

IMO no amount of software patching can turn a Level C software package into a Level A.

Has it been stated anywhere what design assurance level (DAL) the new MCAS software will be?

I have read there are several changes:

Compare L & R AOA (and inhibit if they disagree, and display raw AOA values)
Only allow 1 trim application
Limit MCAS input to less than control column authority

But nowhere have I seen what the DAL is going to be. Since the hazard assessment seems to be where the errors started, allowing one sensor, what's the new hazard assessment?

[slacktide]

And it is not just AoA vanes that are a Common Mode Failure by design, the 3 (or 4) pitot tubes for measuring TAS are all same technology, all located near to one another. The purpose of AOA sensors is to detect an imminent stall; a more direct measure (possibly a second source for a plausibility check) would be a pressure sensor built in to the upper and lower wing surface. It need not use holes, if something as mundane as a mobile phone can distinguish between a tap and a swipe, there must be other new technologies out there that could be used.

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

[spornrad]

hope it was the old version:
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/720x699/max_sim_229b4bada3516060ed46b9f662622d3f0227d37b.jpg

[Lost in Saigon]

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

Crafty FOs could carry one of these to test the kazoo......
https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/393x396/clipboard01_cdd2e9f92fb2595ca58b4c5e612f1876f06cdaa9.jpg

[capngrog]

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

What you have described is the old Safe Flight stall warning system which used a moveable vane at the stagnation point instead of an orifice. This stall warning system has been around light aircraft since about 1946 or so.

Cheers,
Grog

[Lost in Saigon]

What you have described is the old Safe Flight stall warning system which used a moveable vane at the stagnation point instead of an orifice. This stall warning system has been around light aircraft since about 1946 or so.

Cheers,
Grog
No, the system he is describing does not use a vane.

[Water pilot]

Coding these days rarely has errors as there are many tools that can be used to verify the code it will also validate correctly as the code does just want the designer erroneously asked it to do.
You just made me spit out my coffee! I think we must work in vastly different parts of the industry.

As a side and possibly interesting technical note, it is not possible to prove even that a given program will terminate given a specific input, that is one of the early theorems in computer theory, dating back to before computers actually existed. Sometime in college I had a course on proving programs correct; the text was a medium sized book that as I recall spent many chapters proving that a simple algorithm for floating point division was correct. Having already worked for a scientific company (and having found a bug in their floating point libraries) and being a better programmer than theoretician I did the obvious thing and implemented the pseudo code -- and promptly found that pseudo code which had been proven correct in several different ways actually produced the incorrect answer in many common cases! The frustrating part was that although I could easily see why the code was wrong, I was never really able to figure out why the proof that it was correct was wrong. My much smarter friend who was just as crazy as I independently did the same thing and she got the same conclusion. She actually worked for Boeing back in the day.

[Realbabilu]

An edited GIF version of Mentour Pilot Video...
..https://media.giphy.com/media/TgbF6sloqHQxGcxJTe/giphy.gif

Or, you can watch most of it here...
- https://vimeo.com/329558134
https://fpdl.vimeocdn.com/vimeo-prod-skyfire-std-us/01/911/13/329558134/1293184506.mp4?token=1554940934-0x89473d99602926ea5f192a1e9fe382f0eef47c84


Maybe the sim not as realistic as the real one.
I cant hear the sim stick shaker for far more dramatize the upset condition

[Loose rivets]

As someone who's flown a simulator with little wooden houses going by on a huge conveyor belt, I suppose I'm predisposed to doubt the purity of even the latest simulation, despite electronics being one of the strings to my bow.

The box they're in obviously doesn't have a long cable run, and if there is any use made of steel cable, it must be loaded by a simulation device. Okay, doable, but here's the rub. If Boeing produce an aircraft that can allow a vital control surface to be impossible to move, how the Dickens can a simulator manufacturer program a valid reality from such incomplete information?

[L39 Guy]

Alchad



Many people (still) blame the pilots for getting into that situation, by not taking action sooner. All sorts of clever answers are possible, for those sitting at home, and having had time to read the accident report.

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

[Hi_Tech]

Ref.: 737-7/8/9 Training Manual 22-11-00, Dated 19.Sep.2016 Pages 165, 166 and 167

Ref.: THE MOST IMPORTANT QUESTION ON THE LION AIR AND ETHIOPIAN 38M AIRCRAFT CRASH INVESTIGATION maybe!

A simple version here.

Will the PRI Toggle when moved to CUT OUT, IS IT 100% GUARANTEE to remove -all- electrical signals to the Stab Trim Motor?

Why do I ask? "The FCC supplies MCAS signal to enter high speed mode on the stab trim motor and bypass the aft column cutout switches for trim down commands.". As we know also in error.

THUS if the B/U is in CUT OUT, then MCAS still has authority but what about PRI in CUT OUT?"

The trim commands from the FCC is processed in the "autopilot section of the motor". That means besides the FCC A in these cases, there is another controlling Software either part of the MCAS programing (thus active when a Fault like is being considered part a chain of errors in these two accidents) or a separate sub routine / program influencing the Stabilizer Motor into moving the Stabilizer that has never been mentioned before.

I'm thinking like a chicken with its head cut off, the nerves can still allow it to run around.

So the PRI in CUT OUT, does it still allow impulses from the "auto pilot section of the motor" however created, to move the stabilizer via 28VDC thru the motor un-commanded when the operating crew thinks they've isolated that electric trimming (CUT OUT), thus do not expect further electric trimming (non-pilot induced)?

To keep it simple - PRI and B/U toggles in CUT OUT there is no possible way the stabilizer movement (NU or ND) can be activated unless done manually by the crew using the Trim WHEELS OR a failure of the stabilizer mechanics i.e. excessive speeds beyond VMO, thus possibly breaking or stressing / stretching the components moving the stabilizer itself i.e. for example into the full AND position which is then fatal as non-recoverable?

Any Source I can contact, kindly PM? I do not have access to Boeing Customer Service any more.

Thanks in advance for all PPRUNER's efforts here.

CP Bernd von Hoesslin

===============================

You can’t use the Private Messaging system, add url links or images until you have an established posting history
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/908x596/stm2_2f6b0966722cb2cf3109aebfba486a68898e0d02.jpg
I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

[Escape Velocity]

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

[EDLB]

https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/908x596/stm2_2f6b0966722cb2cf3109aebfba486a68898e0d02.jpg
I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

Thanks for the diagram. The two cutout switches are in series so they are the STAB and B/U.
The cut out funktion works over the R64 main relay. At the same time the FCC knows that it is cut out. What worries me more is, that the MCAS signal seem to be able to switch the Stab motor into fast mode as when the flaps where down via K5. My assumption is, that since the increase to 2.5 degrees MCAS stab was necessary, MCAS can move the stab faster than the pilots can in a flap up condition.

[HundredPercentPlease]

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).

why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

It was three memory checklists:

Stall recovery.
UAS recovery.
Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

[alf5071h]

‘Blame’ is used as a self-satisfying closure for complex, often indeterminate situations (‘wicked problems’).
Assuming that something was understood as an opening analysis risks hindsight bias, or that everyone will have similar understandings, similar thought processes.
UAS could equally be stick-shaker implying stall, or a range of alternative perceptions according to context. Bounding problems with assumption might aid our after-the-fact understanding, but whatever we conclude is only probability, because we can never know what these crews perceived, what was thought, or understood, or any reasoning for action.

Start with a view that the crew acted as they saw the situation (not our view), that humans are an asset to be used and not a hazard to be constrained; this and the above might provide an alternative analysis. Not fact only probable, but an understanding which might better be used to learn from.

As background see:-

https://www.nifc.gov/PUBLICATIONS/acc_invest_march2010/speakers/Perspectives%20on%20Human%20Error.pdf

https://www.ida.liu.se/~729A71/Literature/Human%20Error_T/Hollnagel,%20Amalberti_2001.pdf

https://www.eurocontrol.int/sites/default/files/publication/files/hindsight-25.pdf Page 10 -

https://www.demos.co.uk/files/systemfailure2.pdf

“Problems worthy of attack prove their worth by hitting back.
Man's a kind of Missing Link, fondly thinking he can think.”

“Modern man has the skill; he can do what he will.
But alas - being man he will do what he can.”

“You'll conquer the present suspiciously fast if you smell of the future -- and stink of the past.”

Grooks of Piet Hein (http://www.sophilos.net/GrooksofPietHein.htm)

[Lost in Saigon]

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

Here is the B737 MAX Unreliable Airspeed Checklist. Compared to the NG, the memory items are identical, and the rest has only a few differences.

https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/352x573/clipboard01_72dd25dc77ad1460ede64a95ab606ff7b4401f3d.jpg
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/353x568/clipboard02_dc66c18d655df6809fc2d0d311914210b7f430cb.jpg
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/353x585/clipboard03_5f6444cb18b3042ae37afb881c16afbe4792f6d1.jpg
https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/354x562/clipboard04_4453d342d0bb76b9b3d33d788db17118c54b5389.jpg

[bsieker]

‘Blame’ is used as a self-satisfying closure for complex, often indeterminate situations (‘wicked problems’).
Assuming that something was understood as an opening analysis risks hindsight bias, or that everyone will have similar understandings, similar thought processes.
UAS could equally be stick-shaker implying stall, or a range of alternative perceptions according to context. Bounding problems with assumption might aid our after-the-fact understanding, but whatever we conclude is only probability, because we can never know what these crews perceived, what was thought, or understood, or any reasoning for action.

Start with a view that the crew acted as they saw the situation (not our view), that humans are an asset to be used and not a hazard to be constrained; this and the above might provide an alternative analysis. Not fact only probable, but an understanding which might better be used to learn from.

As background see:-

https://www.nifc.gov/PUBLICATIONS/acc_invest_march2010/speakers/Perspectives%20on%20Human%20Error.pdf

https://www.ida.liu.se/~729A71/Literature/Human%20Error_T/Hollnagel,%20Amalberti_2001.pdf

https://www.eurocontrol.int/sites/default/files/publication/files/hindsight-25.pdf Page 10 -

https://www.demos.co.uk/files/systemfailure2.pdf

[...]


Thank you. I agree completely.

I would add to the list of references any of Sidney Dekker's works, in particular The Field Guide to Understanding 'Human Error' (https://www.routledge.com/The-Field-Guide-to-Understanding-Human-Error-3rd-Edition/Dekker/p/book/9781472439055).

Bernd

[flyingchanges]

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).



It was three memory checklists:

Stall recovery.
UAS recovery.
Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

MCAS would not be a factor until the flaps were up.

[ams6110]

It was three memory checklists:

Stall recovery.
UAS recovery.
Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

Interesting idea, but I wonder why he would have decided that his strategy was to engage the autopilot rather than simply leave flaps extended. If he knew enough about MCAS to know that it doesn't operate when autopilot is on, he would presumably also know it doesn't operate with flaps extended. Also if that it what he was thinking, then that implies he knew that the stall warning was false?

[Maninthebar]

Interesting idea, but I wonder why he would have decided that his strategy was to engage the autopilot rather than simply leave flaps extended. If he knew enough about MCAS to know that it doesn't operate when autopilot is on, he would presumably also know it doesn't operate with flaps extended. Also if that it what he was thinking, then that implies he knew that the stall warning was false?

Or.... insufficient confidence in knowing which of the three plus inadequate height agl
So
Power maintained to mitigate stall risk
Autopilot engaged to mitigate against MCAS
UAS less of a risk than either of the above

??

[armchairpilot94116]

Ethiopian Crash Data Analysis Points To Vane Detachment | (http://m.aviationweek.com/commercial-aviation/ethiopian-crash-data-analysis-points-vane-detachment?NL=AW-05&Issue=AW-05_20190411_AW-05_553&sfvc4enews=42&cl=article_1&utm_rid=CPEN1000003048565&utm_campaign=19193&utm_medium=email&elq2=fba325a1cf6f4d70854c1f6984167617)

Firewall but but the first paragraph says a lot
now why did the vane come off ? Still doesn’t excuse Boeing of MCAS reliance on one vane.

[GarageYears]

Is it known if the vane has been recovered or was destroyed?

A bit of a needle in a haystack, but they should sure be looking for it. It should be possible to determine a specific location where it detached and hence a search area.

Understanding why it fell off is important, especially since it is not the same problem as affected Lion Air, despite the resultant similar crashes.

- GY

[Loose rivets]

Can't get the above link.


Is the vane detachment - the very bizarre coincidence of two different failures - solely based on the different angle split readouts?

[L39 Guy]

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).



It was three memory checklists:

Stall recovery.
UAS recovery.
Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

If one rolls down the runway with both engines providing the advertised thrust (94%), the airspeed cross check at 80 indicates no disparity, and the aircraft is rotated normally at Vr with both airspeed indicators working normally then rotated to a climb attitude and the engines continue to turn and burn, then any erroneous stall warning has to be ignored and treated as such. That is why manufacturers provide nominal pitch/power settings to insure a stall free climb or cruise while it gets sorted out. In fact, I had the same stick shaker after take-off many years ago on the 737-200 after lift-off; yes, it gets your attention but if the attitude of the aircraft is ok and the engines are running fine then it cannot be a bona fide stall but an erroneous indication.
If the crew thought it was a stall, then the stall recovery should have been implemented - it was not and in fact they (Ethiopian) tried to engage the autopilot, a definite no-no in a stall.
So even setting aside the MCAS issue later, sadly this all points to training and experience to handle a pretty basic emergency. And that points back to the airline and the CAA who are responsible for that.

[alf5071h]

L39 Guy,

“… sadly this all points to …”
… the persistence, the difficulty in avoiding hindsight, prejudging, assuming; -

How would a crew know that stick-shake just after lift off is erroneous. How is the accuracy of AoA established, of attitude, or at that instant, speed, until the accuracy of these is confirmed all that remains is assumption.
Whatever is argued, the correct AoA cannot be determined even with an EFIS display - which one is correct.
The on-side airspeed will be inaccurate because AoA is used in pressure error correction. Similarly the EFIS low speed awareness - based on AoA, perhaps adding to a belief that stick shake is valid.
Add distractions of Speed and Altitude Disagree alerts, and Feel Diff Press, together with the surprise of an unexpected event, or even higher stick force due to Feel Diff, then all available thinking ability is required to manage what exists.
In time, crosschecking speed, attitude, ‘feel’ (experience) might judge otherwise.

Assumptions such as “… it cannot be a bona fide stall but an erroneous indication” can be just as hazardous as an abnormal technical situation.
And thus any conclusion based on such assumption fails because of false reasoning.

Back to the links in https://www.pprune.org/showpost.php?p=10444908&postcount=3898 (https://www.pprune.org/showpost.php?p=10444908&postcount=3898) - background reading.

[GordonR_Cape]

Can't get the above link.


Is the vane detachment - the very bizarre coincidence of two different failures - solely based on the different angle split readouts?

Article summarises the fact that evidence is all in the FDR readout:
- Initial wild gyration of AOA sensor immediately after takeoff.
- Thereafter stable at implausibly high AOA.
- Moments before the final crash, the aircraft entered a negative-g bunt, AOA sensor flipped 180 degrees, stick shaker stopped.
Already hinted before in this thread, but the only physical explanation consistent will all of these data points is vane detachment. The event is clearly different from Lion Air, which had a constant 20 degree offset, but the end result was the same.

Re-posting annotated FDR readout:


https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1453x879/et302_fdr_trace_specifics_c8e7c4682349647e1c9334fc1dc18e72ef 87f9c0_et302_fdr__6947f071bd270b932b3ea192433af7979961e603.g if

[bill fly]

L39 Guy,

“… sadly this all points to …”
… the persistence, the difficulty in avoiding hindsight, prejudging, assuming; -

How would a crew know that stick-shake just after lift off is erroneous. How is the accuracy of AoA established, of attitude, or at that instant, speed, until the accuracy of these is confirmed all that remains is assumption.
Whatever is argued, the correct AoA cannot be determined even with an EFIS display - which one is correct.
The on-side airspeed will be inaccurate because AoA is used in pressure error correction. Similarly the EFIS low speed awareness - based on AoA, perhaps adding to a belief that stick shake is valid.
Add distractions of Speed and Altitude Disagree alerts, and Feel Diff Press, together with the surprise of an unexpected event, or even higher stick force due to Feel Diff, then all available thinking ability is required to manage what exists.
In time, crosschecking speed, attitude, ‘feel’ (experience) might judge otherwise.

Assumptions such as “… it cannot be a bona fide stall but an erroneous indication” can be just as hazardous as an abnormal technical situation.
And thus any conclusion based on such assumption fails because of false reasoning.

Back to the links in https://www.pprune.org/showpost.php?p=10444908&postcount=3898 - background reading.




Well, you can have that problem on all aeroplanes which have an AoA dependent stall warning system. And there are a lot of those certified.

[MurphyWasRight]

From GordonR
Article summarises the fact that evidence is all in the FDR readout:
- Initial wild gyration of AOA sensor immediately after takeoff.
- Thereafter stable at implausibly high AOA.
- Moments before the final crash, the aircraft entered a negative-g bunt, AOA sensor flipped 180 degrees, stick shaker stopped.
Already hinted before in this thread, but the only physical explanation consistent will all of these data points is vane detachment. The event is clearly different from Lion Air, which had a constant 20 degree offset, but the end result was the same.

The other item that strongly supports the departing vane theory is the master caution anti icing alarm and AoA heat trace off at the same time.
This would not (likely) not happen if some coupling/gear inside the sensor failed

[DaveReidUK]

Is the vane detachment - the very bizarre coincidence of two different failures - solely based on the different angle split readouts?

Two independent failures would indeed be a bizarre coincidence.

[GordonR_Cape]

Two independent failures would indeed be a bizarre coincidence.

To understand the prior probability of two independent failures, would require use of Bayes Theorem, and statistical data on each failure mode. It is clear from the (lack of) response to queries about rates of AOA failure, that this data is scarce.

I have stated previously that AOA fail nose-down would give interesting information, but if the vane departs, the failure will always be nose up. Isn't that even more ironic, that the only known failure mode is 100% guaranteed to trigger MCAS!?

The fact that the MAX is a new aircraft may have something to do with the Lion Air fixed offset error, but presumably bird-strike frequency has nothing to do with the model type.

[alf5071h]

bill fly, #3910,
The point was not about whether a system can be certificated or not; it is about the human reaction and ability to manage the failure.
The 737 Max has several consequential ‘failures’ associated with AoA inaccuracy; in many other aircraft there is little or no interaction due to different system design or redundancy.
The certification judgement should involve crew workload, conflicting alerts, ambiguity, and distraction; consideration of the wider situation, risk of assumption, and comparison with additional tasks on top of a range of normal procedures. Thus it could be argued that the 737 requires a different approach, this could involve training or from what has been learnt for these accidents, reconsidering the overall system - AoA, speed correction, low speed awareness, alerts …

[safetypee]

Gordon et al.
Would the scenario of a loose vane about the shaft fit all incidents.

Re Lion, the vane rotated on the shaft as far as 22 deg (grub screw); the vane aligns with the airflow, but misreads due to the repositioned shaft under the influence of the balance weight. This also enabled the vane to be checked by maintenance without fault, because the vane was still free to move around the shaft.

With Ethiopian, the vane became completely free to rotate during takeoff, then the balance weight positioned the shaft equivalent to full up ? (down?). The vane remained free in the airflow, but without connection it was irrelevant. The shaft remained free such that the balance weight reflected the effects of ‘g’ at the end of the flight.
Have the ‘errant’ AoA vane units been found; loose vane, or no vane.

[DaveReidUK]

To understand the prior probability of two independent failures, would require use of Bayes Theorem, and statistical data on each failure mode.

Isn't Bayes' Theorem a way of calculating conditional probability? If two failures are truly independent of each other, you don't need Bayes to work out the probability of both happening together.

Having said that, I have no idea what are the two independent failures the poster is referring to - one is the AoA vane detachment, but what is the other one ?

[spornrad]

...what are the two independent failures ...

https://www.bloomberg.com/news/articles/2019-04-11/sensors-linked-to-737-crashes-vulnerable-to-failure-data-showA review of public databases by Bloomberg News reveals the potential hazards of relying on the devices, which are mounted on the fuselage near the plane’s nose and are vulnerable to damage. There are at least 140 instances since the early 1990s of sensors on U.S. planes being damaged by jetways and other equipment on the ground or hitting birds in flight. In at least 25 cases in the U.S., Canada and Europe, the damage triggered cockpit alerts or emergencies.

[MurphyWasRight]

Gordon et al.
Would the scenario of a loose vane about the shaft fit all incidents.

Re Lion, the vane rotated on the shaft as far as 22 deg (grub screw); the vane aligns with the airflow, but misreads due to the repositioned shaft under the influence of the balance weight. This also enabled the vane to be checked by maintenance without fault, because the vane was still free to move around the shaft.

With Ethiopian, the vane became completely free to rotate during takeoff, then the balance weight positioned the shaft equivalent to full up ? (down?). The vane remained free in the airflow, but without connection it was irrelevant. The shaft remained free such that the balance weight reflected the effects of ‘g’ at the end of the flight.
Have the ‘errant’ AoA vane units been found; loose vane, or no vane.

Not sure why a common AoA failure cause is needed, in any case there are very significant differences between the 2.

Lion Air :Incorrect (offset) values present for entire (2!) flights, the offset shows as soon as speed is sufficient.
Not sure of aerodynamics but doubt that a damaged vane would have a consistent offset.
Since this was a refurbished unit it is possible that it was mis-assembled or damaged on installation/test, only other possibility is a wiring issue, which might fit with prior unit being intermittently bad. One can be sure the investigators will be looking at this in depth.

Ethiopian: Values ok at first then a sudden and dramatic shift to full over and at the same time the heater circuit opens.
This can be explained by bird strike or prior (ramp rash) damage.

Recovery of either unit intact enough for analysis is unlikely due to high energy of crashes and position of sensors.
Finding the missing vane is also unlikely due to small size and other factors, an all out search might find it but would at most just confirm one of the 2 causes, prior damage or bird strike.

[Chronus]

Not sure why a common AoA failure cause is needed, in any case there are very significant differences between the 2.

Lion Air :Incorrect (offset) values present for entire (2!) flights, the offset shows as soon as speed is sufficient.
Not sure of aerodynamics but doubt that a damaged vane would have a consistent offset.
Since this was a refurbished unit it is possible that it was mis-assembled or damaged on installation/test, only other possibility is a wiring issue, which might fit with prior unit being intermittently bad. One can be sure the investigators will be looking at this in depth.

Ethiopian: Values ok at first then a sudden and dramatic shift to full over and at the same time the heater circuit opens.
This can be explained by bird strike or prior (ramp rash) damage.

Recovery of either unit intact enough for analysis is unlikely due to high energy of crashes and position of sensors.
Finding the missing vane is also unlikely due to small size and other factors, an all out search might find it but would at most just confirm one of the 2 causes, prior damage or bird strike.

If the rwy was closed after the accident and if someone then bothered to examine it for FOD after the event, it is unlikely any feathers will turn up along with the missing AoA vane.

[firewall]

I had a look again at the data recorder readout in the context of the AoA being detached and have doubts about the coincidence of AoA going rogue exactly at rotate.
Perhaps the stall warning was genuine.
The RTOW was 72400 and actual TOW was 71896.
Possibly more baggage than standard weights with a lot of long haul pax transferring.
The rotate induced 1.5 G and peaked at 20 deg pitch swiftly reduced to less than 10 deg and 0.8G.
Somehow this kicked off the erroneous AoA disparity and subsequent activation of MCAS.
This was a take-off at max weight and high altitude that demanded careful handling.
Apologies if this has been covered.

[MurphyWasRight]

I had a look again at the data recorder readout in the context of the AoA being detached and have doubts about the coincidence of AoA going rogue exactly at rotate.
Perhaps the stall warning was genuine.
The RTOW was 72400 and actual TOW was 71896.
Possibly more baggage than standard weights with a lot of long haul pax transferring.
The rotate induced 1.5 G and peaked at 20 deg pitch swiftly reduced to less than 10 deg and 0.8G.
Somehow this kicked off the erroneous AoA disparity and subsequent activation of MCAS.
This was a take-off at max weight and high altitude that demanded careful handling.
Apologies if this has been covered.
The left AoA went rogue about 6 seconds after wow changes. The right one did not, stick shaker only on left side.
Hard to see how it was genuine stall since right AoA looks nominal.

[maxxer]

Article summarises the fact that evidence is all in the FDR readout:
- Initial wild gyration of AOA sensor immediately after takeoff.
- Thereafter stable at implausibly high AOA.
- Moments before the final crash, the aircraft entered a negative-g bunt, AOA sensor flipped 180 degrees, stick shaker stopped.
Already hinted before in this thread, but the only physical explanation consistent will all of these data points is vane detachment. The event is clearly different from Lion Air, which had a constant 20 degree offset, but the end result was the same.

Re-posting annotated FDR readout:




All 3 sensors on the left side mess up at the same time , just not as bad as the AOA senser and also in the flip between 05:43:15 and 05:43:30 there is a influence on altitude speed and AOA so it seems the problem is not just with the one sensor but with the wiring or the adiru.
and on both flights they never look further then one of the sensors and then just clear the errors.
Is this poor acceptance checks or something ? just take the plane out for a circle and thats it and then 4 months later errors show up and the solution is to just spray some wd40 on the connector and clear the error log

[HundredPercentPlease]

If one rolls down the runway with both engines providing the advertised thrust (94%), the airspeed cross check at 80 indicates no disparity, and the aircraft is rotated normally at Vr with both airspeed indicators working normally then rotated to a climb attitude and the engines continue to turn and burn, then any erroneous stall warning has to be ignored and treated as such.
.

Really?

You rotate and get a stall warning, and because your engines are "turning and burning", then you just ignore the stall warning? Has it not occurred to you that you may have your high lift devices incorrectly set, and that the fault was the takeoff config system (Spanair)? Or you have been loaded incorrectly? Or you have an engine indication issue (Air Florida)? Just because your engines are "turning and burning" does not mean that any stall detection on rotation is erroneous. Obviously.

[AlexGG]

All 3 sensors on the left side mess up at the same time , just not as bad as the AOA senser and also in the flip between 05:43:15 and 05:43:30 there is a influence on altitude speed and AOA so it seems the problem is not just with the one sensor but with the wiring or the adiru.

AoA data is used to adjust airspeed and altitude, so errorneous AoA signal will affect both of these.

[MurphyWasRight]

This is from the Bloomberg article, seems that pressing on with a stick shaker is not unheard of. SInce this was in Nasa safet database unlikely to be a 'third world crew', correct me if I am wrong on that.

As soon as the plane got airborne, the captain, seated on the left side, got the loud thumping noise and vibrating control column warning that the plane was about to stall, according to the NASA report. The captain’s airspeed and altitude displays disagreed with the copilot’s, indicating an error and setting off additional alerts. All of those symptoms occurred on the two recent Max crashes.

The pilots opted to continue onto their destination in spite of the multiple failures. Both the captain and the copilot said that they regretted continuing the flight and didn’t realize that they had violated their airline’s procedures by disabling the stall warning.

“A return, while considered, should have been accomplished,” said the captain.

Only after they landed did they realize that the captain’s angle-of-attack vane was bent for unknown reasons.

[DaveReidUK]

This is from the Bloomberg article, seems that pressing on with a stick shaker is not unheard of. Since this was in Nasa safety database unlikely to be a 'third world crew', correct me if I am wrong on that.

Correct. US carrier.

[Ace McKool]

Not sure whether this has been posted previously...

https://seekingalpha.com/instablog/398764-vaughn-cordle-cfa/5290930-boeing-737-max-8-crashes-case-pilot-error

[patplan]

If one rolls down the runway with both engines providing the advertised thrust (94%), the airspeed cross check at 80 indicates no disparity, and the aircraft is rotated normally at Vr with both airspeed indicators working normally then rotated to a climb attitude and the engines continue to turn and burn, then any erroneous stall warning has to be ignored and treated as such. That is why manufacturers provide nominal pitch/power settings to insure a stall free climb or cruise while it gets sorted out. In fact, I had the same stick shaker after take-off many years ago on the 737-200 after lift-off; yes, it gets your attention but if the attitude of the aircraft is ok and the engines are running fine then it cannot be a bona fide stall but an erroneous indication.
If the crew thought it was a stall, then the stall recovery should have been implemented - it was not and in fact they (Ethiopian) tried to engage the autopilot, a definite no-no in a stall.
So even setting aside the MCAS issue later, sadly this all points to training and experience to handle a pretty basic emergency. And that points back to the airline and the CAA who are responsible for that.
Maybe you should read about the background a little bit?

ADD, Addis Ababa Bole Airport, 2334 meter [7625 ft] elevation/ASL.
DIA, Denver International Airport, 1655 meter [5431 ft] elevation/ASL.

ADD is more than 2200 feet higher than DIA. It is among the top for the list of notoriously "HOT AND HIGH" airports in the world.

It goes without saying that the aircraft there will have a different TO routine, notably requiring a higher thrust and a longer run, plus high terrain avoidance.

We have to also remember the MCAS "deadly potion" as well: AOA False high & Autopilot Off & FLAP Zero.

105 seconds into their flight, the AOA was already gone mad [IAS disagree, ALT unreliable, stick shaker], but they MUST go FLAP ZERO ASAP to gain Altitude at this higher elevation. And, they needed all the thrust.

They knew they had to play around with the flap and/or the Autopilot to keep MCAS at bay- at least one of these had to be ON to hold off the MCAS "deadly potion".

So, these are their only choices:
1. Going with with Flap On|Autopilot Off.
2. Going with Flap Off|Autopilot On.
3. Going with Flap On|Autopilot On.

Obviously going with Flap On (i.e. [1] and [3]) would go against their effort to gain altitude. That would leave them with (2). So, they turned on the AP, not because they wanted the AP, but it was because their circumstance FORCED them to turn AP on.

When the AP was turned on, they bought themselves about 60 seconds [actually only about 20 "clean" seconds because during FLAP ZERO] to continue gaining the altitude but they were still only about 300-500 feet off the ground [8000+ ft - 7626]...

In other words, the MCAS "deadly potion" constraint made their already difficult TO situation [a high elevation TO, a long run, a stick shaker, an IAS disagree, an ALT unreliable, other warnings] much much worse.

[Lost in Saigon]

Not sure whether this has been posted previously...

https://seekingalpha.com/instablog/398764-vaughn-cordle-cfa/5290930-boeing-737-max-8-crashes-case-pilot-error

Thanks for the link. That is an EXCELLENT read.

Summary

The pilots (crew) mismanaged engine thrust and airspeed.

Excessive airspeed rendered manual trim ineffective.

The crew deviated from the emergency procedure.

Crew experience and competency a major contributing factor.

CONCLUSION

Examining both accidents separately provides valuable insights—it’s easy to understand how these unrelated airlines and crew may have responded in similar ways—but the overall conclusion in our previous article, “Boeing’s Grounding: Catastrophic Crashes, and Questions About Boeing’s Liability And 737 MAX Aircraft Viability,” still stands—the major contributing factor to these accidents was pilot error.

After a more comprehensive analysis of each of the two accidents, especially Lion Air Flight 610, we are persuaded more than ever that the case for pilot error—as well as inadequate training—are the dominant contributing factors in both accidents, not the only ones but the most serious factors.

The LA 610 accident is somewhat excusable since the pilots were not privy to MCAS and its challenges. Even so, there were surprising pilot practices and judgment shortfalls as well as concerns with appropriate MAX training. The Ethiopian accident, however, is more confounding since it was verified by the airline that the pilots were trained in accordance with Boeing (and FAA) recommendations. Perhaps the company’s training verification should be scrutinized.

As we have highlighted, the ET 302 pilots did follow the runaway trim procedure, at least initially. However, questions remain as to why the pilots mismanaged the airspeed and deviated from company and Boeing procedures. These actions led to an unrecoverable dive resulting in the loss of crew and passengers. We believe that the final accident report will (or should) reflect this finding.

[airman1900]

Ethiopian Crash Data Analysis Points To Vane Detachment

Ethiopian Crash Data Analysis Points To Vane Detachment

Guy Norris Aviation Daily Apr 10, 2019

LOS ANGELES—As the investigation continues into the causes of the Mar. 10 Ethiopian Airlines Boeing 737 MAX accident, sources close to the probe say flight data recorder (FDR) data firmly supports the supposition that the aircraft’s left angle-of-attack (AOA) sensor vane detached seconds after take-off and that, contrary to statements from the airline, suggests the crew did not follow all the steps for the correct procedure for a runaway stabilizer.

Detailed analysis of the FDR trace data shows that approximately six seconds after liftoff was signaled by the weight-on-wheels switch data, the data indicate the divergence in angle-of-attack (AOA) and the onset of the captain’s stick-shaker, or stall warning. Almost simultaneously, data shows the AOA sensor vane pivoted to an extreme nose-high position.

This, says one source, is a clear indication that the AOA’s external vane was sheared off—most likely by a bird impact. The vane is counter-balanced by a weight located inside the AOA sensor mounting unit, and without aerodynamic forces acting on the vane, the counterweight drops down. The AOA sensor, however, interpreted the position of the alpha vane balance as being at an extreme nose-high angle-of-attack.

With the stick shaker active, the trace indicates the crew pushed forward on the column to counteract what they believed were indications of potential approach to stall. The aircraft, now in level flight, also accelerated rapidly as its power setting remained at 94% N1 thrust used for take-off. This was followed by some manual trim inputs using the thumb switches on the control column.

Seconds after speed advisories were heard, the crew raised the flaps. With the autopilot turned off, flaps up and erroneous AOA data being fed to the flight control computer (FCC), the stage was set for the MAX’s maneuvering characteristics augmentation system (MCAS) to activate. This is indicated by approximately 8-sec of nose-down stabilizer movement, which was followed by the use of manual trim on the control column. However, with the MCAS having moved the stabilizer trim by 2.5 units, the amount of manual nose-up trim applied to counteract the movement was around 0.5 units, or roughly only 20% of the amount required to correctly re-trim the aircraft.

Because of the way the aircraft’s flight control computer P11.1 software worked, the use of manual trim also reset the MCAS timer, and 5 sec. later, its logic having not sensed any correction to an appropriate AOA, the MCAS activated again. The second input was enough to put in the full nose-down trim amount. The crew again manually counteracted with nose-up trim, this time offsetting the full amount of mis-trim applied by the latest MCAS activation.

By then, some 80% of the initial MCAS-applied nose down trim was still in place, leaving the aircraft incorrectly trimmed. The crew then activated the stabilizer trim cutoff switches, a fact the flight data recorder indicates by showing that, despite the MCAS issuing a further command, there was no corresponding stabilizer motion. The aircraft was flying at about 2,000 ft. above ground level, and climbing.

The crew apparently attempted to manually trim the aircraft, using the center-console mounted control trim wheels, but could not. The cut-out switches were then turned back on, and manual trim briefly applied twice in quick succession. This reset the MCAS and resulted in the triggering of a third nose-down trim activation lasting around 6 sec.

The source says the residual forces from the mis-trim would be locked into the control system when the stabilizer cut-off switches were thrown. This would have resulted in column forces of up to around 50 lb. when the system was switched back on.

Although this could have been reduced by manually trimming the aircraft, this did not occur, and the third MCAS activation placed the aircraft in a steep nose-down attitude. This occurred with the aircraft near its peak altitude on the flight—about 6,000 ft. The engines remained at full take-off power throughout the flight, imposing high aerodynamic loads on the elevators as the crew attempted to pull back on the columns.

Vertical acceleration data also indicates momentary negative g during which the AOA sensor on the left side unwinds. This is seen as further validation of the theory that the external part of the alpha vane was detached as the apparent change in angle indication could only be explained by the effect of negative g on the counterbalance weight, forcing it to float up inside the sensor housing. In addition, the captain’s stick shaker also comes off twice in this final phase, further reinforcing the severed vane notion.

The source indicates the crew appeared to be overwhelmed and, in a high workload environment, may not have followed the recommended procedures for re-trimming. Boeing’s stabilizer runaway checklist’s second step directs pilots to “control aircraft pitch attitude manually with control column and main electric trim as needed,” according to one U.S. airline’s manual reviewed by Aviation Week. If the runaway condition persists, the cut-out switches should be toggled, the checklist says.

[airman1900]

Pilots Say MAX MCAS Software Updates Prove Effective In Simulator Demo

Pilots Say MAX MCAS Software Updates Prove Effective In Simulator Demo

Fred George Aviation Week & Space Technology Apr 11, 2019

Boeing has demonstrated the old and new versions of the MAX’s Maneuvering Characteristics Augmentation System (MCAS) to pilots and regulators in its 737 MAX engineering cab simulator in Seattle. The MCAS is a new flight-control-computer (FCC) function added to the MAX to enable it to meet longitudinal stability requirements for certification.

However, the system is only needed to enhance stability with slats and flaps retracted at very light weights and full aft center of gravity (CG). The aircraft exhibits sufficient natural longitudinal stability in all other parts of the flight envelope without the MCAS to meet the rules. Boeing emphasizes that the MCAS is not an anti-stall or stall-prevention system, as it often has been portrayed in news reports.

The new software load [P12.1] has triple-redundant filters that prevent one or both angle-of-attack (AOA) systems from sending erroneous data to the FCCs that could falsely trigger the MCAS. It also has design protections that prevent runaway horizontal stabilizer trim from ever overpowering the elevators. Boeing showed pilots that they can always retain positive pitch control with the elevators, even if they don’t use the left and right manual trim wheels on the sides of the center console to trim out control pressures after turning off the trim cut-out switches.

Most important, the MCAS now uses both left and right AOA sensors for redundancy, instead of relying on just one. The FCC P12.1’s triple AOA validity checks include an average value reasonability filter, a catastrophic failure low-to-high transition filter and a left versus right AOA deviation filter. If any of these abnormal conditions are detected, the MCAS is inhibited.

Three secondary protections are built into the new software load. First, the MCAS cannot trim the stabilizer so that it overpowers elevator pitch control authority. The MCAS nose-down stab trim is limited so that the elevator always can provide at least 1.2g of nose-up pitch authority to enable the flight crew to recover from a nose-low attitude. Second, if the pilots make electric pitch trim inputs to counter the MCAS, it won’t reset after 5 sec. and repeat subsequent nose-down stab trim commands. And third, if the MCAS nose-down stab trim input exceeds limits programmed into the new FCC software, it triggers a maintenance message in the onboard diagnostics system.

According to a pilot who was shown the changes in a simulator session, the demonstration begins with the original MCAS software load. During a normal takeoff, at rotation, the left AOA indication moves to its maximum reading—as seen from the flight data recorder in the Ethiopian Airlines accident. Pilots currently do not experience this during initial or recurrent simulator training. The stickshaker fires continuously, using loud sound and control wheel vibration to focus the pilot’s attention on the critically high AOA indication. The erroneous AOA reading also creates large-scale indicated airspeed (IAS) and altitude errors on the primary flight display (PFD) which can be both distracting and disorienting.

AOA is used by the aircraft’s air data computers to correct pitot and static pressure variations induced by changes in nose attitude in relation to the relative wind. Large errors in AOA can cause 20-40-kt. errors in IAS and 200-400-ft. errors in indicated altitude. This is accompanied by the illumination of annunciators on both PFDs that warn of disparities in the IAS and altitude between the left and right displays. As part of the MCAS redesign, Boeing also is upgrading the MAX with AOA dial indicator displays and AOA disagree warning annunciators on the PFDs.

After the high-AOA indication, pilots then follow the checklist for “airspeed unreliable,” which assures that auto-pilot, auto-throttles and flight directors are turned off. They then pull back power to 80% fan speed, set 10-deg. nose-up pitch attitude and climb to 1,000 ft. above ground level. At that point, they lower the nose, start accelerating and begin retracting slats and flaps at 210 kt. indicated airspeed. When the slats and flaps are fully retracted—the MCAS kicks in.

“It’s a good thing we knew what to expect. Otherwise tunnel vision from the ‘airspeed unreliable’ event could have blinded us to the subsequent MCAS nose-down trim input. When I noticed the trim wheels racing, I grabbed the left wheel. It was easy to stop the trim with hand pressure, but I knew in advance what was happening,” says the pilot flying. “We followed the checklist for runaway stabilizer, checking again for auto-pilot off and auto-throttle off. We turned off both trim cut-out switches and cranked the ‘frisbees’ [manual trim wheels on both sides of the center console] to relieve control pressures. We used manual trim for the remainder of the flight to landing touchdown and rollout. That was quite an eye-opener, as I had never been exposed to that during sim training,” he notes.

It is critical to follow the checklist memory items: Pull back thrust to 75% after retracting slats and flaps and set attitude at 4 deg., nose up. If speed builds up beyond 220-250 kt., controllability becomes increasingly difficult, he adds.

Pilots for three U.S. air carriers tell Aviation Week that during their sim training they had never been exposed to extreme and continuous AOA indication errors, they’ve not experienced AOA induced airspeed and altitude deviations on PFDs and have not had to deal with continuous stall-warning stickshaker distractions. They also note that they have never been required to fly the aircraft from the point at which a runaway stab trim incident occurred all the way to landing using only the manual trim wheels. “We’re just checking boxes for the FAA,” says one Seattle-based pilot.

A full aerodynamic stall with the MCAS inoperative is another exercise pilots experience in the MAX engineering cab simulator. “We reduced thrust at 5,000 ft. and slowed the aircraft at about 1 kt. per sec. We were at a midrange cg [center of gravity] with gear, slats and flats up. We trimmed until we reached 30% above stall speed and then just continued to ease back on the control wheel,” one of the pilots says.

“Pitch feel was natural, progressively increasing as airspeed decayed. Somewhere between the audible low airspeed warning and stickshaker, I felt the slightest lightening on control pressure in my fingertips. Quite candidly, if I had not been watching for it, I don’t think I would have noticed any difference between the MAX and the Next Gen [NG] models. I kept pulling back through stickshaker, then buffet, then elevator feel shift [a function that doubles the artificial control feel forces near stall] and finally until the yoke was buried in my lap. The nose just flopped down gently at the stall, and I initiated recovery as I would in most other airplanes I’ve flown,” he adds.

During design of the MAX, Boeing added two more leading-edge vortilons [generating vortices over the top of the wing at high AOA] in 2018, for a total of six per side and also lengthened and raised the inboard leading-edge stall strips to assure stall behavior would be as docile as that of the NG.

Repeating many of the same maneuvers in the engineering cab simulator with the new software load would have been academic at best, as the triple-redundant AOA validity checks all but assure that the MCAS will not be triggered by erroneous AOA inputs in the future. But, FCC P12.1 changes do not protect against erroneous AOA causing stickshaker or large-scale distortions in indicated airspeed and altitude values. Those malfunctions still can cause distraction and disorientation, especially when flying at night and/or in instrument conditions.

The new MCAS protections built into the P12.1 software load preserve its essential role in enhancing the MAX’s longitudinal stability, while virtually guaranteeing that it won’t be triggered by erroneous AOA. And when it does activate, its nose-down stabilizer trim command authority will be limited to assure the pilots always can control aircraft pitch with the elevators.

However, the FCC software upgrades are not the only critical changes needed to boost safety margins for operators. Pilots who underwent the demonstration also say the sessions underscored the need for additional simulator training for dealing with compound emergencies involving AOA and runaway trim failures.

[artee]

An article on Bloomberg:
‘Not Suitable’ for Certain Airports (https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports)

...‘Challenging Airports’

Boeing stated in a brief filed in the trade case that the “737 Max 7 has greater performance capabilities at challenging airports. In particular, the 737 Max 7 can serve certain ‘high/hot’ airports and has a greater range operating out of constrained airfields.” The brief then cites a number of such airports -- the names of which are redacted -- that the Max 7 can fly into that “the 8, 9 and 10 cannot."

“Larger 737 variants cannot be used at what are referred to has ‘high/hot’ airports,” the brief stated. Certain U.S. airports are unsuitable for the Max 8 “due to a combination of short runway lengths, elevation, temperature, humidity and other environmental conditions."...

[Loose rivets]

Ace's link is well written, but they don't cut the pilots enough slack. Boeing think crews should have their tiny brains protected from a simple program like MCAS, yet should be able to put up with the chaos of the two fatal flights. Even gums has said words to the effect, 'I don't suppose I would have known what was going on in those first minutes.'


Just what let them allow the wheels to spin for as long as they did? And why the taps open for the entire flight? So odd.

This is from airman1900 long link - the testing by invited pilots to try the new software. The started off with the original software. This shouts that the corrective drills and handling is not a free lunch.

Pilots for three U.S. air carriers tell Aviation Week that during their sim training they had never been exposed to extreme and continuous AOA indication errors, they’ve not experienced AOA induced airspeed and altitude deviations on PFDs and have not had to deal with continuous stall-warning stickshaker distractions. They also note that they have never been required to fly the aircraft from the point at which a runaway stab trim incident occurred all the way to landing using only the manual trim wheels. “We’re just checking boxes for the FAA,” says one Seattle-based pilot.


Back to Gordon's graph of the flight and the probability of three vanes failing. On the ET 302 I am persuaded that there's a high probability that there were two separate kinds of fault, if not three, counting the previous day to the Lion air. Years of electronics fault-finding has me trying to make some connection to all three, but it does sound like the first two could be electronic, and the ET 302 a vane detachment. Yes, the heater current is a strong argument.

What is puzzling is the push on the columns near the end. Yes, there's a negative g reading and its at the moment the left AoA vane or inner workings, spins to a new point. Bad negative g after that, poor souls. But if it's a sharp push forward on the controls ~ 1 g through 0 to ~ - 3 or more, g and AoA follows sharply and the shaker turns off with the pulse of g. A very good indicator that the vane unit is still rotating and sending signals. But why that particular shove on the poles? They were not gifted with much altitude.

Another bee in my bonnet is the burst of Fuel Flow on the Lion Air. It's unprecedented since the takeoff. There's one other large burst, but not like the last moments before the sudden sawing and then diving.

What were they trying to achieve with that? Could it possibly be connected as to why the PF in the 302 had a lot of power on. Could it have been keeping the nose up? Or at least making him think it was? It's these little things that are nagging at me.. Certainly, on the Lion Air, the nose went skyward.
.
.
.

[Capn Bloggs]

And why the taps open for the entire flight? So odd.
Easy answer to that: overload. How often do/did those crews fly around manually using the trim with their other hand on the throttles? If you're not used to doing something, you're hardly going to do it when you need to. Not their fault, I might add.

[Capn Bloggs]

Not sure whether this has been posted previously...

https://seekingalpha.com/instablog/3...se-pilot-error (https://seekingalpha.com/instablog/398764-vaughn-cordle-cfa/5290930-boeing-737-max-8-crashes-case-pilot-error)
ex-USAF Major General. Says it all. Blame the pilots when in reality they were flying a deathtrap. What are we, testpilots, finely honed, ready to pounce into action when disaster strikes?

[rog747]

Not sure I buy the bird taking out the AoA vane shortly after lift off...did they find a dead bird or the vane on or near the runway at ADD?- in this day and age of forensics can these items be found?

[ecto1]

It doesn't need to be detached to cause a reading that match fdr. Just split shaftwill do. Murphy is lazy.

I find it a impossible coincidence to have a bird strike exactly at maximum gs. Torque at the shaft is maximum at maximum g, so it looks more plausible unless we have other clues (mention of birds cvr) which I ignore.

Finding the vane and the bird wouldn't be easy either, their absence from runway doesn't prove anything, they had a bit of height and speed by then, it could have landed quite far.

[CurtainTwitcher]

One has to wonder if the Boeing PR machine is starting to kick into gear behind the scenes, and orchestrate a smear campaign through friendlies to point the finger at the pilots (as per the Seeking Alpha The Boeing 737 MAX 8 Crashes: The Case For Pilot Erro (https://seekingalpha.com/instablog/398764-vaughn-cordle-cfa/5290930-boeing-737-max-8-crashes-case-pilot-error)r) and operators instead of Boeing. Boeing Has Called 737 Max 8 ‘Not Suitable’ for Certain Airports (https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports). The "Not suitable for certain airports" implies Jakarta as being in this category (too hot). All the hallmarks, unattributed expert opinions such as "Mark". Reporters just happened to find these U.S. International Trade Commission documents lying around?

Boeing Has Called 737 Max 8 ‘Not Suitable’ for Certain AirportsBy
Anita Sharpe (https://www.bloomberg.com/authors/APro5q8NJM0/anita-sharpe)12 April 2019, 02:02 GMT+10

Before last month’s crash of a flight that began in Ethiopia, Boeing Co. (https://www.bloomberg.com/quote/BA:US) said in a legal document that large, upgraded 737s “cannot be used at what are referred to as ‘high/hot’ airports."

At an elevation of 7,657 feet -- or more than a mile high -- Addis Ababa’s Bole International Airport falls into that category. High elevations require longer runways and faster speeds for takeoff. The Ethiopian airport’s altitude hasn’t been cited as a factor in the downing of Flight 302 and likely didn’t cause the crash. But it could have exacerbated the situation because an airplane’s performance degrades at higher altitudes, said a 737 pilot who flies into high-elevation airports such as Denver and agreed to speak on background since he’s not authorized to talk with the media.

Data released (https://www.bloomberg.com/news/articles/2019-04-05/six-minutes-to-disaster-ethiopian-air-pilots-battled-boeing-max) last week from the Ethiopian Airlines (https://www.bloomberg.com/quote/1646375D:ZC) flight indicated the pilots didn’t cut the 737 Max 8 airplane’s speed after takeoff when they should have. The preliminary report on the disaster said the plane’s anti-stall system pushed the nose of the plane down less than two minutes into the flight because of a malfunctioning sensor. The pilots struggled to control the plane as it hurtled toward the ground at 575 miles per hour.

“The faster the airplane is going, the more force of air there is on its wings and control surfaces which requires more force on the pilots’ part to pull the control” column, said Robert Mark, a commercial pilot and senior editor with Flying Magazine.

Six Minutes to Disaster: Ethiopian Pilots Battled Boeing Max (https://www.bloomberg.com/news/articles/2019-04-05/six-minutes-to-disaster-ethiopian-air-pilots-battled-boeing-max)

Boeing cited the performance of the 737 Max 8 in a case (http://tinyurl.com/y3hdlhrf) brought before the U.S. International Trade Commission in 2017. Boeing charged that unfair competition from Bombardier -- which beat out Boeing for a large order from Delta Air (https://www.bloomberg.com/quote/DAL:US) Lines -- threatened its 737-700 and Max 7, the smallest of its upgraded single-aisle jets. By pointing out the limitations of the Max 8, the planemaker sought to preserve market share for the 700 and Max 7.

A Boeing spokesman said that Addis Ababa can handle large airplanes because it has long runways.‘Challenging Airports’Boeing stated in a brief filed in the trade case that the “737 Max 7 has greater performance capabilities at challenging airports. In particular, the 737 Max 7 can serve certain ‘high/hot’ airports and has a greater range operating out of constrained airfields.” The brief then cites a number of such airports -- the names of which are redacted -- that the Max 7 can fly into that “the 8, 9 and 10 cannot."

“Larger 737 variants cannot be used at what are referred to has ‘high/hot’ airports,” the brief stated. Certain U.S. airports are unsuitable for the Max 8 “due to a combination of short runway lengths, elevation, temperature, humidity and other environmental conditions."

Aviation consultant Bob Mann said airlines typically use a smaller, earlier version of Boeing’s jet, the 737-700, at higher elevations because that plane usually gets a “better rate of climb" than the Max 8.
Denver and Mexico City
Documents in the trade case referred to at least 16 U.S. airports considered “high and hot” and therefore unsuitable for the Max 8, though the names of those facilities weren’t made public. Asked during a trade commission hearing to specify which airports, an expert witness for Boeing replied that “sometimes Denver would qualify as that.” The expert, Jerry Nickelsburg, an adjunct economics professor at UCLA, added that “Mexico City certainly qualifies as that.”

Both the Denver and Mexico City airports sit at lower elevations than Addis Ababa and have runways as long or longer than the Ethiopian airfield, where they extend more than 12,000 feet, or 3,700 meters.

Denver’s airport is more than 2,000 feet lower than Addis and has five runways that measure 12,000 feet and one that is 16,000 feet (or 4,800 meters). The airport in Mexico City is 300 feet lower than Addis and has four runways that are 13,000 feet (or about 4,000 meters) and two that are 15,000 feet (or about 4,600 meters). Aeromexico flies the Max 8 as part of its fleet.

Hot airfields such as the Jakarta airport, from where the doomed Lion Air plane took off last October, produce similar air densities as high elevations, requiring faster takeoff speeds. Heat, air density and fast speed haven’t been cited as factors in that accident.
‘Detective Story’
The performance of all airplanes deteriorates in high heat or elevation, and all pilots account for that before taking off, said Steve Wallace, former director of the Federation Aviation Administration’s accident investigation branch. Even airlines operating from Orange County, California, which is nearly at sea level, occasionally have to reduce weight on their planes because of high temperatures, Wallace said.

Altitude and heat may well have played no role in either 737 Max 8 crash, but the wording from Boeing’s 2017 trade case could still be seized upon by plaintiffs lawyers.

"Even if it is BS, plaintiffs’ lawyers will focus on the quote and put that back to the company to explain it," said long-time aviation attorney Roger Clark, who teaches aviation law as a visiting professor at Rutgers University in New Jersey.

Chicago attorney Thomas Demetrio, who is leading a lawsuit against Boeing for the Lion Air crash, said he wouldn’t include altitude or heat in a complaint unless investigators or one of his experts said those factors were a proximate cause.

All the factors that contributed to the Ethiopian Airlines crash won’t be known until sometime next year when the full investigative report is completed.“It’s like a detective story right now,” said Mark, the commercial pilot. “And we don’t have all the data."

— With assistance by Michael Sasso, and Margaret Newkirk

[GordonR_Cape]

An article on Bloomberg:
‘Not Suitable’ for Certain Airports (https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports)

...‘Challenging Airports’

Boeing stated in a brief filed in the trade case that the “737 Max 7 has greater performance capabilities at challenging airports. In particular, the 737 Max 7 can serve certain ‘high/hot’ airports and has a greater range operating out of constrained airfields.” The brief then cites a number of such airports -- the names of which are redacted -- that the Max 7 can fly into that “the 8, 9 and 10 cannot."

“Larger 737 variants cannot be used at what are referred to has ‘high/hot’ airports,” the brief stated. Certain U.S. airports are unsuitable for the Max 8 “due to a combination of short runway lengths, elevation, temperature, humidity and other environmental conditions."...

Interesting story about the marketing of the MAX, but absolutely nothing to do with the crash, since Addis Ababa has a long enough runway. Edit: Once you are airborne, and have a positive rate of climb, it should not matter what airport you took off from. The only difference was that N1 may have been higher than at sea-level, but engine thrust certainly did not cause the crash. In any case Boeing sold the MAX 8 to Ethiopian, so that does not exactly absolve them of blame.

[bsieker]

An article on Bloomberg:
‘Not Suitable’ for Certain Airports (https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports)

...‘Challenging Airports’

Boeing stated in a brief filed in the trade case that the “737 Max 7 has greater performance capabilities at challenging airports. In particular, the 737 Max 7 can serve certain ‘high/hot’ airports and has a greater range operating out of constrained airfields.” The brief then cites a number of such airports -- the names of which are redacted -- that the Max 7 can fly into that “the 8, 9 and 10 cannot."

“Larger 737 variants cannot be used at what are referred to has ‘high/hot’ airports,” the brief stated. Certain U.S. airports are unsuitable for the Max 8 “due to a combination of short runway lengths, elevation, temperature, humidity and other environmental conditions."...

That's just a red herring. It talks about "short runways". Nobody in their right mind would think a 3700 m runway was short. It is a sales pitch for the MAX 7, and it has nothing at all to do with this accident or the one in Jakarta.

Documents in the trade case referred to at least 16 U.S. airports considered “high and hot” and therefore unsuitable for the Max 8, though the names of those facilities weren’t made public. Asked during a trade commission hearing to specify which airports, an expert witness for Boeing replied that “sometimes Denver would qualify as that.” The expert, Jerry Nickelsburg, an adjunct economics professor at UCLA, added that “Mexico City certainly qualifies as that.”

Yes, Denver could sometimes be called "hot and high", but would never fall in the category of "short runway". The same goes for Mexico City.

The manufacturer provides rules (usually computer software and long tables) telling the crew the required runway lengths for takeoff for a given combination of weight, elevation and temperature. These values contain ample margins for uncertainties in actual weight, temperature and wind variations and various failures including an engine failure. If the runway is long enough it is long enough.

Yes, there will be some airports, where the MAX 7 can operate with higher payloads than the 8/9/10. So what?

They are probably rather talking about small regional airports such as Telluride (https://en.wikipedia.org/wiki/Telluride_Regional_Airport).

The Ethiopian airport’s altitude hasn’t been cited as a factor in the downing of Flight 302 and likely didn’t cause the crash. But it could have exacerbated the situation because an airplane’s performance degrades at higher altitudes, said a 737 pilot who flies into high-elevation airports such as Denver ,

This shows how disingenious this article is. "It is totally irrelevant but we'll blurb on about it anyway. And look, we even found a pilot who said something totally unrelated!". There certainly was no problem with aircraft performance in either accident, except perhaps there was too much of it.

Denver will not be on this list. Neither will Mexico City, Jakarta or Addis Ababa. They are all big International Airports with very long runways. The "expert" is an "adjunct economics professor". I rest my case.


Bernd

[Cows getting bigger]

You know, back when a young CGB was taught to fly, we didn't just consider runway length when examining departure performance................

Just sayin'

[DaveReidUK]

The "expert" is an "adjunct economics professor". I rest my case.

To be fair, his comments weren't made in the context of either of the Max accidents, but in an anti-competitive hearing where he was simply comparing the hot-and-high performance of the Max 8 compared to the Max 7, in other words stating the obvious. So let's not put words in his mouth.

Incidentally his CV includes being a VP at FlightSafety International, and 8 years at McD before that, so I suspect he does actually know one end of a WAT curve from the other.

[alf5071h]

Curtain Twitcher, :ok: et al, #3938
The value of ‘The Case for Pilot Error’ should be rated by the purpose of the report (small print at the end):-
“The purpose of the report is to help our institutional clients answer the following questions: 1) what are issues, 2) can the problems be fixed, 3) how long will it take, and 4) at what cost. The last step is to value BA (Boeing Co) and the airlines impacted by the grounding of the MAX aircraft fleet.”

Also by who the authors are now, opposed to what they list as piloting experience - ‘what we say reflects thoughts’.
“…founded AirlineForecasts, LLC … has managed airline and transportation-related investment research … Clients included …, Southwest, and WestJet pilot groups.

And their conclusion:-
“Examining both accidents separately provides valuable insights—it’s easy to understand how these unrelated airlines and crew may have responded in similar ways—but the overall conclusion in our previous article, “Boeing’s Grounding: Catastrophic Crashes, and Questions About Boeing’s Liability And 737 MAX Aircraft Viability,” still stands—the major contributing factor to these accidents was pilot error.”

Which begs the question what is ‘pilot error’; or of greater concern is if the views of these US based, airline pilots (authors) reflects the standard or effectiveness of human factors training in the wider industry.

[Cows getting bigger]

I'm starting to draw parallels with the "Guns don't kill people, people do" argument. There certainly appears to be a lack of subscription to modern safety management principles (layers, bow-ties etc).

The whole 'defence' seems to be based around an argument that whilst BA created a characteristic of HAL that would make him suicidal purely because of a single corrupt data path, everything would be OK as long as you subsequently disabled HAL within a finite period. Hmmmm, I'm not detecting an overly mature hazard analysis process there.

I know I've made some very poor decisions recently, but I can give you my complete assurance that my work will be back to normal. I've still got the greatest enthusiasm and confidence in the mission. And I want to help you."

[groundbum]

This seems to be "tombstone" learning..

LionAir didn't know about MCAS, so plain stuffed it up.

Ethiopian learnt about MCAS due Lionair, but didn't know about next to impossible trim forces and yoyo, so stuffed it up.

So airline #3 will come along; know about MCAS, know about high trim loads, but will then encounter ???

It's a rum way to do airline safety... I know in IT we used to do field tests to let customers shake out the bugs but I didn't know aircraft manufacturers now practised it..

G

[bsieker]

To be fair, his comments weren't made in the context of either of the Max accidents, but in an anti-competitive hearing where he was simply comparing the hot-and-high performance of the Max 8 compared to the Max 7, in other words stating the obvious. So let's not put words in his mouth.

Incidentally his CV includes being a VP at FlightSafety International, and 8 years at McD before that, so I suspect he does actually know one end of a WAT curve from the other.

Yes, It was perhaps a bit unfair towards Professor Nickelsburg, and I apologise. What annoyed me is that Bloomberg even put it in the context of the accidents, even going so far as to claim that "it could have exacerbated the situation because an airplane’s performance degrades at higher altitudes", when there is no hint that this may have played any role, and lack of performance (as in: insufficient engine power) was certainly not a problem.

Bernd

[bsieker]

You know, back when a young CGB was taught to fly, we didn't just consider runway length when examining departure performance................

Just sayin'

Well, sure, there's also terrain, overrun areas, possible emergency landing locations and whatnot, but I didn't want to make it longer than it already was. I could have added "and other parameters" but didn't bother.

Bernd

[GordonR_Cape]

I'm starting to draw parallels with the "Guns don't kill people, people do" argument. There certainly appears to be a lack of subscription to modern safety management principles (layers, bow-ties etc).

The whole 'defence' seems to be based around an argument that whilst BA created a characteristic of HAL that would make him suicidal purely because of a single corrupt data path, everything would be OK as long as you subsequently disabled HAL within a finite period. Hmmmm, I'm not detecting an overly mature hazard analysis process there.

I agree. There seems to be a strong correlation between:
- chauvinistic attitudes to 3rd world pilots
- a protective attitude towards a 1st-world manufacturer
- the mentality of blame the victim/dead guy.
Even if its 99% the manufacturers fault, and 1% the pilots fault, its still "pilot error", and "they caused the crash".

Edit: Another irony is that a few pages back in this thread, we have a link to the great Ralph Nader, pointing out the greed and iniquity of the corporate villain Boeing! So far, I don't see Ralph Nader suing the airline. IMO both aspects highlight the gulf in understanding the complex causal chain in any accident.

[VicMel]

Not sure I buy the bird taking out the AoA vane shortly after lift off...did they find a dead bird or the vane on or near the runway at ADD?- in this day and age of forensics can these items be found?

I agree that loss of a vane is questionable for 2 reasons:-
1) The idea that there are 2 (or 3) different AoA sensor faults were experienced on the 2 Lion Air flights and ET302 flight seems to me to be very unlikely from a probabilistic point of view, especially so as the AoA sensor is apparently generally very reliable.
2) The lack of noise on the high value of AoA of a flat-line value of 74.5deg. Noise is seen on both R & L AoA right up to take off, and stays at about the same amplitude on R AoA throughout the flight, suggesting it is not caused just by air speed buffeting of the vane. Instead the noise seems to start just as the engines reached 94%, so I suspect the noise is more air-frame vibration related. I find it hard to believe that a counter weight (without a vane) would stay exactly on 74.5 for minutes and not now be affected by vibration plus all of the other changes to flight dynamics. A fixed offset, sometimes tracking the R AoA value, sometimes not, looks to me like a software generated value.

I think the “lost vane” idea came from an observation on ET 302’s FDR Data chart that Vertical Acceleration lines up with a jump in AoA. It is possible that “cause and effect” may have been misinterpreted here because Vertical Acceleration is a consequence of, and directly related to Pitch Rate. This would fit in with the fact that AoA L was disrupted on the 2 Lion Air flights (as well as on ET 302) just around take off when there would have been a large value for pitch rate.

This could well be relevant as one of the AoA correction factors is Pitch Rate, according to Fig 9 in Boeing’s aero_12 magazine (Figure 9. AOA Measurement Errors (http://www.boeing.com/commercial/aeromagazine/aero_12/attack_fig9.html))
As I mentioned in an earlier post (#2744), I think an error in the correction calculating software may be the source of the AoA corruption problem. Earlier discussions have suggested that the AoA sensor itself must be the single source of a bad analogue value as both the SMYD (for Stick Shaker on/off determination) and the ADIRU receive bad data. However, either the SMYD uses the corrected AoA from the FCC (via ARINC 429) or it computes the same correction (possibly using an exact copy of the software) as the ADIRU. If the SMYD does its own computation of AOA, then both SMYD and the ADIRU took take a good analogue signal, apply an incorrect correction to produce garbage for AoA. Obviously there has to be a common failure that triggers both sets of computations to produce garbage for AoA. As the fault is always on the Left, the common failure could well be the loss of the signal that tells the L SMYD and the L ADIRU that they are Left, resulting in both of them using the correction algorithm for a Right AoA sensor on data from the Left AoA sensor and computing garbage values.

[Loose rivets]

VicMel Thought provoking.


I find it hard to believe that a counter weight (without a vane) would stay exactly on 74.5 for minutes and not now be affected by vibration plus all of the other changes to flight dynamics. A fixed offset, sometimes tracking the R AoA value, sometimes not, looks to me like a software generated value.

I'm swinging between both extremes of scenario. However, that balance weight flopping near the end of ET's flight is hard to reconcile, even with Vic's logic.

That slight change of AoA at 05:41:22 - ish, is also troubling me. Why there? Why so consistent before and then after the change? i.e., if it can change at all, why would it remain steady either side of the change?

[GarageYears]

I agree that loss of a vane is questionable for 2 reasons:-
1) The idea that there are 2 (or 3) different AoA sensor faults were experienced on the 2 Lion Air flights and ET302 flight seems to me to be very unlikely from a probabilistic point of view, especially so as the AoA sensor is apparently generally very reliable.

I think the “lost vane” idea came from an observation on ET 302’s FDR Data chart that Vertical Acceleration lines up with a jump in AoA. It is possible that “cause and effect” may have been misinterpreted here because Vertical Acceleration is a consequence of, and directly related to Pitch Rate. This would fit in with the fact that AoA L was disrupted on the 2 Lion Air flights (as well as on ET 302) just around take off when there would have been a large value for pitch rate.

Well, how does that align with ALL the information?
At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°. At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.
At 05:38:43 and about 50 ft radio altitude, the flight director roll mode changed to LNAV.
At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.

There is very little in terms of cause and effect that would satisfy the heater parameter change other than losing the vane itself. (Unless you want to believe this is entirely spurious).

- GY

[fdr]

One has to wonder if the Boeing PR machine is starting to kick into gear behind the scenes, and orchestrate a smear campaign through friendlies to point the finger at the pilots (as per the Seeking Alpha The Boeing 737 MAX 8 Crashes: The Case For Pilot Erro (https://seekingalpha.com/instablog/398764-vaughn-cordle-cfa/5290930-boeing-737-max-8-crashes-case-pilot-error)r) and operators instead of Boeing. Boeing Has Called 737 Max 8 ‘Not Suitable’ for Certain Airports (https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports). The "Not suitable for certain airports" implies Jakarta as being in this category (too hot). All the hallmarks, unattributed expert opinions such as "Mark". Reporters just happened to find these U.S. International Trade Commission documents lying around?

In reference to the "Not Suitable" article statement... What a load of nonsense.

How does an AOA sensor become discombobulated by temp or pressure altitude???? Seriously, has relaxing the pot laws in WA resulted in loopiness in Chicago head office? If Boeing wants to defend their position, they need to get serious and deal with the facts at hand and not puff smoke or play with mirrors.

WAT limits per 25 Subpart B control suitability of the aircraft for a particular operation for the certification of the aircraft, not the name or number written on the side of the plane by the OEM.

[MurphyWasRight]

Totally agree that this is an effort to build the public opinion case for pilot error.
To me the worst part of the 'case for pilot error' is no mention of even the possibility that the crew was unable to manually trim and the suggestion they were very slowly winding the wrong way.
The slight .2 unit wrong way trim during the manual trim phase of the flight could be due either to struggles with the wheel or (less likely in imho) back drive from the extreme load.

He then slams them for the aparent last ditch re-enabling of electric trim.

The lack of speed management certainly was a factor but had they been able to manually trim they would likely dealt with it next.

[Cows getting bigger]

I think there is another HF issue (already commented on some time back) in that it is utterly counter-intuitive to reduce thrust when the nose is pitching down. It is like leaning to right when you want to turn your bicycle to the left.

[bsieker]

Totally agree that this is an effort to build the public opinion case for pilot error.

I find it quite remarkable that it takes such a long windup to finally conclude that the crew did not do everything perfectly. Duh. No human ever does.

And then it just stops. What is the point of finger-pointing? How can that help anyone in any way? (Except perhaps Boeing's reputation, but even that is doubtful.)

A finding of "Human Error", can never be the end of an analysis, rather it must be the start of asking questions such as:

What was the exact situation the operators were in?
What was the information they could get?
Was some information maybe ambiguous? Even contradictory? Hard to find?
How much time did they have to find it?
How much time did they have to analyse it?
Were they trained to evaluate the information properly?
Were there perhaps multiple anomalies requiring different, possibly even contradictory procedures?
Was there perhaps cognitive overload?
Did they (could they?) have an understanding of why the system did what it did?
What additional information do we have now, that the operators at the time did not have? (The easy one: we know that what they did eventually led to an unrecoverable situation. They didn't. Or else they wouldn't have done it.)
Which again leads to: why did they do what they did?
How can we prevent:

... crews from doing the same things again, or better still:
... anyone from getting into the situation in the first place?


I repeat here the image I posted way back that makes these ideas very clear:

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/480x204/dekker_mishap_001_f90d68daad8bd13f65fdab57ff4332a5b68f98a3.j pg
From The Field Guide to Understanding 'Human Error' by Sidney Dekker

Bernd

[JesusonAHarley]

I used to always think that we, as a community, tend to focus more on the who, instead of the more pertinent, what, which should be followed by the even more pertinent, why. I now understand that the whole industry is afflicted by the malaise.

[Icarus2001]

in that it is utterly counter-intuitive to reduce thrust when the nose is pitching down.

Have you done jet upset or UA recovery in the sim? Low nose is always reduce power.

[MurphyWasRight]

VicMel Thought provoking.



I'm swinging between both extremes of scenario. However, that balance weight flopping near the end of ET's flight is hard to reconcile, even with Vic's logic.

That slight change of AoA at 05:41:22 - ish, is also troubling me. Why there? Why so consistent before and then after the change? i.e., if it can change at all, why would it remain steady either side of the change?
Given the oil damping system and inherent friction it would be reasonable to expect the weight to stay put and not respond to vibration or minor changes in g.
.
The forces on an operating AoA vane/system would be high compared to the weight which is just there to balance the vane.
It is not like the weight on a balance beam scale that is part of the measurement.

I think the change at 05:41:22 - ish and one slightly after that can be explained by 2 brief excursions to ~.5g (bit hard to tell exact from graph) at the same time.
Each of those might have 'bumped' the weight enough to shift it slightly.

[golfyankeesierra]

Have you done jet upset or UA recovery in the sim? Low nose is always reduce power.
Wow, who taught you that?
Un load and wings level are first on the list, but when it comes to power, that is as needed.
That means you might need to add power in a low speed, low nose situation. The faster you are on speed, the faster you can pull out.
(Rule of thumb, speed in the 100's - add power, speed in the 200's - power in the mid range, speed in the 300's - cut the power)

[L39 Guy]

Really?

You rotate and get a stall warning, and because your engines are "turning and burning", then you just ignore the stall warning? Has it not occurred to you that you may have your high lift devices incorrectly set, and that the fault was the takeoff config system (Spanair)? Or you have been loaded incorrectly? Or you have an engine indication issue (Air Florida)? Just because your engines are "turning and burning" does not mean that any stall detection on rotation is erroneous. Obviously.

Based upon my 36 years/26,000 hours of flying, provided that one does not "jerk" the aircraft into the air, if one rotates the aircraft nose at a normal rate to the take-off attitude, roughly 15 degrees in the B737 at 3 degrees per second, the aircraft go flying when the wings are ready to let it go flying, i.e. when the have created enough lift. And, with both engines running, the aircraft will accelerate. Because of this characteristic, this will cover up a lot of mistakes such as wrong flap setting, wrong power setting, wrong C of G (although that would be more an issue of control column forces to rotate as the stab trim setting is based upon the C of G). This would mean the aircraft would take more runway if heavier, lower flaps setting (1 instead of 5 for example), lower power setting and less runway with the opposite conditions.

Regardless of any of this, surely by 400 ft there would be communication between the two pilots about the indicated airspeed between the three airspeed indicators in the flight deck, particularly since the Captain was an 8000+ hour pilot; the FO was probably shell shocked.

But either way - unreliable airspeed or a bona fide stall - why on earth would the Captain call "Command", i.e autopilot engagement at 400 ft? You do not engage an autopilot when one is in a stall, you do not engage an autopilot with an unreliable airspeed.

To me, this points to an experience, training and attitude problem the world over in modern airline flying. Pilots no longer have the basic flying skills to fly an airplane anymore without autopilot, autothrottle, flight director and, heavens forbid, GPS/RNAV! Where I fly (Canada) we call these people "Children of the Magenta Line". I don't know if other countries use this term or not but what it means is all they know is how to fly the magenta line on the nav display as well as the magenta pointers on the primary flight display.

I know in other parts of the world, hand flying an aircraft is not only discouraged its against SOP's and is subject to the "FDR Police". It's all fine and dandy when things are going well but when the crap hits the fan and one actually has to revert to basic flying skills they are not there, either because they never were there in the first place or, if they were, they have atrophied because they haven't been used in years.

While the MAX incident/accidents have brought this home tragically - trying to use the autopilot in a unreliable airspeed situation or a true stall (take your pick), being unable to trim the aircraft with the electric trim (continuous trim rather than short bursts), being unable to manually trim and fly the aircraft, being unable to manage the airspeed and not going the speed of heat, or questionable airmanship decisions such as continuing to destination with unreliable airspeed, and so on - there have been scores of incidents such as the Korean 777 in SFO wherein the crew could not fly a visual approach on a clear day, etc. Only by pure luck or the incredible survivability of the aircraft that no one was killed in the crash itself. And there are scores of other examples of incidents that could have easily become fatal accidents, just go to avherald.com to see for yourself.

The entire industry - ICAO, IATA, the individual airlines, the individual CAA's, the pilot unions, aircraft manufacturers, etc - need to do some serious navel gazing to get the level of pilot proficiency and training back to the point where paying customers can count on the pilot to be the last line of defense when the unexpected happens such as a double engine failure (US Air). Technology is great but it has its limitations and at the end of the day, trained and competent pilots are still needed when the unanticipated events happen.

Editorial over.

[Dr Jay]

This approach is not specific to Boeing or commerical aviation: it's the way the game is played.

Exactly.

Witness the Ethiopian report declaring that their pilots "did everything correctly". By releasing this blatently incorrect statement prior to the publication of the initial report, they controlled the message.

[Smythe]

"Children of the Magenta Line".

This phrase was by American Airlines pilot Warren Van der Burgh...
https://www.youtube.com/watch?v=jxzgwV2a6oM

Latest on the issue...seems as though in the ITC complaint against Bombardier, B provided some interesting details on the MAX 8...

Before last month’s crash of a flight that began in Ethiopia, Boeing Co. (https://www.bloomberg.com/quote/BA:US) said in a legal document that large, upgraded 737s “cannot be used at what are referred to as ‘high/hot’ airports."

At an elevation of 7,657 feet -- or more than a mile high -- Addis Ababa’s Bole International Airport falls into that category. High elevations require longer runways and faster speeds for takeoff. The Ethiopian airport’s altitude hasn’t been cited as a factor in the downing of Flight 302 and likely didn’t cause the crash. But it could have exacerbated the situation because an airplane’s performance degrades at higher altitudes, said a 737 pilot who flies into high-elevation airports such as Denver and agreed to speak on background since he’s not authorized to talk with the media.

Boeing cited the performance of the 737 Max 8 in a case (http://tinyurl.com/y3hdlhrf)brought before the U.S. International Trade Commission in 2017. Boeing charged that unfair competition from Bombardier -- which beat out Boeing for a large order from Delta Air (https://www.bloomberg.com/quote/DAL:US) Lines -- threatened its 737-700 and Max 7, the smallest of its upgraded single-aisle jets. By pointing out the limitations of the Max 8, the planemaker sought to preserve market share for the 700 and Max 7.

Boeing stated in a brief filed in the trade case that the “737 Max 7 has greater performance capabilities at challenging airports. In particular, the 737 Max 7 can serve certain ‘high/hot’ airports and has a greater range operating out of constrained airfields.” The brief then cites a number of such airports -- the names of which are redacted -- that the Max 7 can fly into that “the 8, 9 and 10 cannot."

“Larger 737 variants cannot be used at what are referred to has ‘high/hot’ airports,” the brief stated. Certain U.S. airports are unsuitable for the Max 8 “due to a combination of short runway lengths, elevation, temperature, humidity and other environmental conditions."

Documents in the trade case referred to at least 16 U.S. airports considered “high and hot” and therefore unsuitable for the Max 8, though the names of those facilities weren’t made public. Asked during a trade commission hearing to specify which airports, an expert witness for Boeing replied that “sometimes Denver would qualify as that.” The expert, Jerry Nickelsburg, an adjunct economics professor at UCLA, added that “Mexico City certainly qualifies as that.”

https://www.bloomberg.com/news/articles/2019-04-11/boeing-has-called-737-max-8-not-suitable-for-certain-airports

[EDLB]

Hot and high has zero to do with both accidents. With two healthy donk’s in a twoholer it is no problem since you have lots of additional power. Why does this totally unrelated topic creep in here?

[Chronus]

All this talk about rwy lenghths and high hot airfields. Nothing to do with those at all. All to do with tweaking and twiddling with an aeroplane to fit the bill and having to write up some software because it is prone to go tits up and that no one has yet managed to train a tame gorilla to take the pilot`s seat. May be one day that too will be possible, but they better be ready to swap the control cables for ships hawsers.

[Loose rivets]

That double blip of the thumb switches. The big question seems to be, why didn't he continue trimming? I know of no circuitry which will do this, but what happens to that Stab input if it is already exceeding some load limit? i.e., could there be an electrical current limit that clips the power to the Stab motor/clutches if the motor is taking current commensurate with torque that's too high?

[737 Driver]

That double blip of the thumb switches. The big question seems to be, why didn't he continue trimming? I know of no circuitry which will do this, but what happens to that Stab input if it is already exceeding some load limit? i.e., could there be an electrical current limit that clips the power to the Stab motor/clutches if the motor is taking current commensurate with torque that's too high?

Covered quite well here: https://leehamnews.com/2019/04/05/bjorns-corner-et302-crash-report-the-first-analysis/The insufficient trim mystery after re-activation of Electric TrimAfter 7 PF commands Electric Trim Nose Up in two short cycles. I asked my selves (as did others) why these short trims? They are fighting to get the nose up to the extent they risk switching in the Electric Trim again. Then why not trim nose up continuously or for at least long cycles once Electric Trim is there? It took me several hours to find an explanation. Here my take:

To understand the blip trims one must have flown fast jets at low altitude. At the speed ET302 is flying, 360kts, it’s hypersensitive to trim. The least trim action and the aircraft reacts violently. Any trimming is in short blips.

As PF holds the nose up with a very high stick force, now for a long time, he’s sensitivity to release stick with trim is not there (this is what Pilots do when they trim nose up, otherwise the aircraft pitches up fast). He trims therefore in short blips and has difficulty to judge the trim effect he has achieved. His is not flying on feel. He can’t, he is severely out of trim, holding on to the Yoke with a strong pull force.

Anyone who has flown a grossly out of trim aircraft at high speeds knows your feel is compromised. The sensors you have to rely on are your eyes, not your hands.

PF has the horizon glued to read the aircraft. The result is the short nose-up trims we see. The nose goes up and the stick force needed is reduced. His judgment is; this is enough for now, it was a powerful response. Any MCAS attack I now trim against, then I correct my trim if I need to.

But the aggressive MCAS, trimming with a speed 50% higher than the pilot and for a full nine seconds, kicks in at 8 with a force they didn’t expect. Speed is now at 375kts and MCAS was never designed to trim at these Speed/Altitude combinations. Dynamic pressures, which governs how the aircraft reacts to control surface movements, is now almost double it was when last MCAS trimmed (Dynamic pressure increases with Speed squared).

The Pilots are thrown off their seats, hitting the cockpit roof. Look at the Pitch Attitude Disp trace and the Accel Vert trace. These are on the way to Zero G and we can see how PF loses stick pull in the process (Ctrl Column Pos L). He can barely hold on to the Yoke, let alone pull or trim against.

His reduced pull increases the pitch down further, which increases the speed even more. At 05.45.30 the Pilots have hit the seats again (Accel Vert trace and Ctrl Columns force trace) and can start pulling in a desperate last move. But it’s too late. Despite them creating the largest Control Column movement ever, pitch down attitude is only marginally affected.

We have Control Column displacement this time, JT610 was Force. If the elevator reacts to these displacements, at the Dynamic Pressure we have, we should have seen the diving stop. The lack of reaction to the large Control Column displacement of two Pilots pulling makes me think we now have blowback. This is not a design fault, we are well beyond Vmo. But it explains the rapid dive, unhindered by the Pilots’ actions.

It’s easy to say “Why didn’t they trim then?”. Because they are going down at 20 degrees nose down (which is a lot, a normal landing approach is 3°) and at 400kts. Then you just pull for all you have. And the aircraft is not reacting to the largest Control Column displacement since takeoff. This makes them pull even harder, the aircraft is unresponsive and they are fighting for theirs and all the passenger lives.

​​​​​​

[fotoguzzi]

...the suggestion they were very slowly winding the wrong way.

[Not a pilot] FO asked for permission to try "manual," received permission, and gave up, all within an eight second period.

That would seem not related to the gradual change during the (from memory) two and one half minute period.

[MurphyWasRight]

[Not a pilot] FO asked for permission to try "manual," received permission, and gave up, all within an eight second period.

That would not seem related to the gradual change during the (from memory) two and one half minute period.

That exchange was at/after the electrical trim was re-enabled, I believe the 'manual' refers to electrical trim switches.

The slow change (wrong direction) was while electrical trim was disabled.
The prelim report did not include much (if any) CVR details from that time, does not mean things were not attempted.

LooseRivets:
That double blip of the thumb switches. The big question seems to be, why didn't he continue trimming? I know of no circuitry which will do this, but what happens to that Stab input if it is already exceeding some load limit? i.e., could there be an electrical current limit that clips the power to the Stab motor/clutches if the motor is taking current commensurate with torque that's too high?

Without knowing exactly where the fdr gets its inputs hard to be sure, but since the automatic and pilot trim inputs are shown separately I suspect the 'blips' are commands not motor activity.

One thing that does comes to mind is a different pilot doing the trim, this matches the same ineffective inputs seen in Lion Air aftert the pilot transfers control to FO.
Is it possible that the last pilots in each case were not used to and or afraid of the long inputs that would have been required?

The only "non pilot" thing I can think of is something that made the switches harder to press/confusing/fail while applying extreme pull.

[VicMel]

I'm swinging between both extremes of scenario. However, that balance weight flopping near the end of ET's flight is hard to reconcile, even with Vic's logic.

That slight change of AoA at 05:41:22 - ish, is also troubling me. Why there? Why so consistent before and then after the change? i.e., if it can change at all, why would it remain steady either side of the change?

The correction applied for the difference between AoA vane and AoA body is dependant on Mach number, Pitch rate, Side slip, Flaps, Gear Position and Ground Effect. It is difficult to tell from the 6 figures shown in Fig 9 what form these computations take. Are they look up tables, computed functions, accumulated correction, or serial processed, or what? I’m guessing that they represent different correction lines for different values of the 6 parameters. In which case the single headed arrow line across the Mach number lines could show correction lines to correct AoA Vane to AoA Body from Mach 0 to 0.99, the double headed arrow on Sideslip could indicate + and – sideslip, but there is a single headed arrow for Pitch Rate. Did they not allow for a larger negative Pitch Rate? Could this have led to a negative index in a table? Could some of the computations overflow because of rogue parameters? It could be that one of more of the 6 correction factors used garbage function/table constants to calculate an AoA value of, say 434.5deg, which then ended up as a plausible, but unlikely, 74.5deg on the ARINC 429 bus.

So, the AoA values at the end of ET’s flight (and the 10deg blip at 05:41:22) could be due to the change in the Pitch rate that occurred then, which gave the computations a kick, resulting in different garbage values being picked up. If any of the tables/lines make use of the last computed value of AoA, this can lead to lock in to a particularly high (or low) value. The correction algorithm is far more complex than I first thought, once it goes wrong, any resulting behaviour for a value of AoA is possible!

Whatever damping there may be in the AoA sensor it has to be fairly light otherwise there would be a significant delay on the AoA signal and obviously the pilot does not want to be told he is approaching a stall condition after he has got there! More seriously, if the counterweight without a vane can really get from 35.7 deg to 74.5 deg in 0.75 of a second, then there is very little damping. I do not think it is feasible that the counterweight can then stop, nearly instantaneously, onto the 74.5 deg position, without any overshoot at all, or bouncing off of any end stop that is set at 74.5 deg. Naah, you need software to do that sort of screw up.


Well, how does that align with ALL the information?
At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°

The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.

There is very little in terms of cause and effect that would satisfy the heater parameter change other than losing the vane itself. (Unless you want to believe this is entirely spurious).

- GY

Firstly, the AoA values are all driven by the correction algorithm, as I have theorised above, mainly the one using Pitch Rate as a driver.

Secondly, good point, I’ve no idea why the L AoA Heat changed state. I’m puzzled as to why the state was On at the beginning, when the outside temperature was 16deg C. However, I’m more inclined to believe that it was spurious than I am to believe there was anything other than a single underlying failure which affected all 3 of the flights.

Vic

[fdr]

Comments re thrust on ET302 seem to suggest that from an arm chair the crew can be criticised for keeping it at high thrust.

The BAC FCTM states to attempt to match the out of trim speed in order to reduce load on the trim system. The aircraft is trimmed to an extremely high warp factor (aoa) and the inability to trim a correction arises due to the attendant forces applied by the off trim of the stab, and the corrective elevator input.

Reducing power as suggested does not achieve the matching of speed necessary to unload the stab, yet the comments suggest that the crew erred by keeping power on.... really? The fastest way to restore control, with the least altitude loss comes in this case by having high thrust applied.

Now, in the first instance of a problem with trim, keeping speed in check sounds like a nice principle, but that presumes that the trim has not run away fully, in which case, the control problem is exacerbated by the speed error between current and trimmed speed (aoa).

These guys had a substantial problem to fix in a time critical event, and the comments critical of their technique show the general malaise and lack of knowledge that exists in this industry. Hard to call it a profession. If criticising their actions at least get the physics right.

[MurphyWasRight]

...
...
Whatever damping there may be in the AoA sensor it has to be fairly light otherwise there would be a significant delay on the AoA signal and obviously the pilot does not want to be told he is approaching a stall condition after he has got there! More seriously, if the counterweight without a vane can really get from 35.7 deg to 74.5 deg in 0.75 of a second, then there is very little damping. I do not think it is feasible that the counterweight can then stop, nearly instantaneously, onto the 74.5 deg position, without any overshoot at all, or bouncing off of any end stop that is set at 74.5 deg. Naah, you need software to do that sort of screw up.
...
...
Secondly, good point, I’ve no idea why the L AoA Heat changed state. I’m puzzled as to why the state was On at the beginning, when the outside temperature was 16deg C. However, I’m more inclined to believe that it was spurious than I am to believe there was anything other than a single underlying failure which affected all 3 of the flights.

Vic
The damping is set for significantly higher forces than the weight itself which is just to counterbalance the vane.
The end stop could well be a 'soft' stop where things get wedged, the ticks downward from ~.5g spikes suggest just that.

If you compare the reported left AoA position to vertical g at the end it is a close to perfect match.

The AoA vane heat is likely on by default, it does get a bit colder at higher altitudes. Also there was a reason it was included in the prelim report, another 1000+ (I may be off here) parameters were not.

[deltafox44]

I think there is another HF issue (already commented on some time back) in that it is utterly counter-intuitive to reduce thrust when the nose is pitching down. It is like leaning to right when you want to turn your bicycle to the left.
Reducing speed would have been also against what Boeing recommends in case of a severe AND mis-trim, which is increasing speed (not above VMO, though) in the hope of reducing elevator loads

[deltafox44]

Firstly, the AoA values are all driven by the correction algorithm, as I have theorised above, mainly the one using Pitch Rate as a driver.
I don't know if AoA value shown on the graph was value from the vane or value corrected by algorithms. I suppose both are recorded. Anyway, pitch rate correction cannot drive corrected value from +75° to -60° !

[Smythe]

Firstly, the AoA values are all driven by the correction algorithm, as I have theorised above, mainly the one using Pitch Rate as a driver.

Thank you! Finally, someone else who understands that the output from the AoA vane is subject to numerous algorithms, depending on conditions. To completely base pending stall conditions, and an automated response based on the AoA vane measurement is foolhardy.

First off, the algorithm corrects between the location of the AoA vane, the CG, and wing location angles of attack. The algorithm then corrects for airspeed and sideslip. What is interesting is the AoA measurement becomes less accurate in a climb, especially in a climbing turn (per Boeing) as the winds around the fuselage are deflected, shielded, or otherwise disrupted.

The best solution would be to mount the AoA vane on the wing at midspan, but the disruption from the engine, and moving leading edge prevents this.

The engines are mounted higher on the wing, and further forward, yet the AoA location remained unchanged. Another indication is the green band, on the 738, it is from 1 to 6, yet on the 737-8, it is 3 to 8.....

As noted, originally, the software and modelling people came up with a 0.6 correction on the trim. In testing, that turned into 2.5 degrees. This tells me that the assumptions that created the algorithm are not correct.

[ecto1]

AOA corrects airspeed and then airspeed corrects AOA?

[Loose rivets]

Thanks for the replies.

The double blips. I begged the question some 1,000 posts ago about the possibility of the blips causing alarm because of sudden g forces, despite the graphs not showing any such detail. Strangely, the higher accelerative fluctuations come later - I imagine distressing belt-tugging forces.

The consensus back then dismissed the possibility. So, looking again for why the trim wasn't continued. The extract above is again thought provoking; giving an insight into the psychology. But I'm still not convinced. The g force noise does go up during that period, but not in any recognisable sustained pattern. The column inputs are very well mirrored in g forces shortly after.

05:41:35-40 -ish shows a sustained average positive g despite coming from a series of no doubt powerful tugs. Since it seems to be real, and showing in a definite improved pitch attitude, one wonders why this could not be sustained.

All in all, I still have great sympathy for the pilots, which is no doubt strongly biased by my short flight with the stick shaker going. My highly competent FO pointed in turn at the six speed and attitude dials, but even then half a lifetime of indoctrination was relentlessly tugging at my mind, and that's with nothing else being wrong.

[Smythe]

AOA corrects airspeed and then airspeed corrects AOA?

No, they do not correct each other.
The stall algorithm uses a varied number of inputs to determine if the ac is getting into a stall, most of which are algorithm based due to latency.
Latency of all of the calculations is another issue.
While the critical angle of attack doesnt change, the various factors involves such as weight, configuration, CG, and winds, change the airspeed at which an ac will stall.

Now you have unreliable airspeed indicators, (since the pitot tubes do not move into the winds, they are shielded on turns, angle of attack and crosswinds) unreliable AoA measurements, and a varying configuration feeding an automated trim correction.

[Dave Therhino]

No, they do not correct each other.
.

I'm quite sure that's not fully correct. There is a correction to same side static pressure based on AOA, which affects both airspeed and altitude on the same side. Airspeed is not used to modify the sensed or displayed AOA as far as I know.

[jimtx]

Comments re thrust on ET302 seem to suggest that from an arm chair the crew can be criticised for keeping it at high thrust.

The BAC FCTM states to attempt to match the out of trim speed in order to reduce load on the trim system. The aircraft is trimmed to an extremely high warp factor (aoa) and the inability to trim a correction arises due to the attendant forces applied by the off trim of the stab, and the corrective elevator input.

Reducing power as suggested does not achieve the matching of speed necessary to unload the stab, yet the comments suggest that the crew erred by keeping power on.... really? The fastest way to restore control, with the least altitude loss comes in this case by having high thrust applied.

Now, in the first instance of a problem with trim, keeping speed in check sounds like a nice principle, but that presumes that the trim has not run away fully, in which case, the control problem is exacerbated by the speed error between current and trimmed speed (aoa).

These guys had a substantial problem to fix in a time critical event, and the comments critical of their technique show the general malaise and lack of knowledge that exists in this industry. Hard to call it a profession. If criticising their actions at least get the physics right.

The crew did not “keep” the thrust high. They ignored a control available to them and ignored its effects upon the aircraft. There was no cognitive thought process that said let’s go past Vmo because that will be better for us.

[safetypee]

VicMel, an interesting analysis #3958. Together with that of Smythe … now confused.

(If) Vane-sensed AoA requires correction; is this correction in the vane unit or elsewhere. Peter Lemme argues that errors originate from the vane unit as AoA output is ‘sent’ and used by many separate boxes.
Alternatively a separate (remote) calculation would be more logical with the need of other factors, e.g. embedded in ADC for Mach; which box (function) is not so important if the corrected AoA is available on a digital bus to all other computational boxes. This would also negate the view of a vane-origin error.

Airspeed pressure-error corrections depend on the corrected AoA; differences between ADC computations are alerted (Speed, Alt, Disagree). This should not change the AoA.

AoA is use to position the low speed awareness symbol on the airspeed scale, but this too uses output AoA, it should not correct - change either AoA or airspeed.

Thus what correction is being discussed; where is the computation done, and how is the output accessed by many other functions requiring AoA - MCAS one amongst many.

Re vane damping; an earlier suggestion was that the vane slipped position on the shaft; fortuitously catching at different times and values in each accident. A slipping vane/shaft, when snagged would then act as a single unit involving aerodynamic and mass damping - but incorrect AoA.
Although unlikely, Occam might like the simple mechanical approach.

Alternatively, the digital views might follow Moore-Murphy, where with increasing complexity and add-ons, there is even greater risk of error, the need crosschecking and multiple sources would be paramount. Somewhat lacking in this system.

[delarue]

ex-USAF Major General. Says it all. Blame the pilots when in reality they were flying a deathtrap. What are we, testpilots, finely honed, ready to pounce into action when disaster strikes?

Seekingalpha is an investment-related blog, anybody can write whatever they like there. There are two kinds of people on that site: those talking up stock they own, and those talking down stock they sold short. Utterly unreliable as a source of investment info, let alone anything else.

[Capn Bloggs]

Delarue, the thing that annoys me is he sounds credible, and that the riff raff probably believe him.

[BluSdUp]

At one point the FO selected 238kts in the speed window.
I think that was the only time I can see they try to control speed. and a good speed indeed.
My goto speed is 230kts non the 737-800 at this stage as this gives me any options and safe margins.
BUT
The AT must have disconnected at one point as the IAS became different.

[CurtainTwitcher]

The AT must have disconnected at one point as the IAS became different.
They probably had the AT disconnect annunciator flashing away until the end.

When I see that AT disconnect flashing for more than a few seconds, I know the person I am sitting next to is overloaded and has lost SA. It's interesting experiment to see how long before they attend to it, it can be quite some time. Occasionally they won't even notice I've reached up and pushed the annunciator to cancel it.

[GlueBall]

CurtainTwitcher;"They probably had the AT disconnect annunciator flashing away until the end."

"When I see that AT disconnect flashing for more than a few seconds, I know the person I am sitting next to is overloaded and has lost SA. It's interesting experiment to see how long before they attend to it, it can be quite some time. Occasionally they won't even notice I've reached up and pushed the annunciator to cancel it."

...Except that it's hard not to hear the annoying clacker horn as they zoomed past 340 kts (VMO) 3 minutes after lift off, and past 458 kts two minutes after that. It's apparent that these guys were totally engrossed with pitch control ignoring also the increasing noise of rushing air from the slipstream, ignoring also in day VMC at low altitude the fast moving terrain below their feet.

...

[deltafox44]

The best solution would be to mount the AoA vane on the wing at midspan, but the disruption from the engine, and moving leading edge prevents this.
No, the wing would be the worst place to measure AoA, since airflow perturbation is the highest there. The only place to get an good AoA is on a long stick ahead of the nose. Even there it would be correct only in steady flight in still air...

[Brosa]

Based upon my 36 years/26,000 hours of flying, provided that one does not "jerk" the aircraft into the air, if one rotates the aircraft nose at a normal rate to the take-off attitude, roughly 15 degrees in the B737 at 3 degrees per second, the aircraft go flying when the wings are ready to let it go flying, i.e. when the have created enough lift. And, with both engines running, the aircraft will accelerate. Because of this characteristic, this will cover up a lot of mistakes such as wrong flap setting, wrong power setting, wrong C of G (although that would be more an issue of control column forces to rotate as the stab trim setting is based upon the C of G). This would mean the aircraft would take more runway if heavier, lower flaps setting (1 instead of 5 for example), lower power setting and less runway with the opposite conditions.

Regardless of any of this, surely by 400 ft there would be communication between the two pilots about the indicated airspeed between the three airspeed indicators in the flight deck, particularly since the Captain was an 8000+ hour pilot; the FO was probably shell shocked.

But either way - unreliable airspeed or a bona fide stall - why on earth would the Captain call "Command", i.e autopilot engagement at 400 ft? You do not engage an autopilot when one is in a stall, you do not engage an autopilot with an unreliable airspeed.

To me, this points to an experience, training and attitude problem the world over in modern airline flying. Pilots no longer have the basic flying skills to fly an airplane anymore without autopilot, autothrottle, flight director and, heavens forbid, GPS/RNAV! Where I fly (Canada) we call these people "Children of the Magenta Line". I don't know if other countries use this term or not but what it means is all they know is how to fly the magenta line on the nav display as well as the magenta pointers on the primary flight display.

I know in other parts of the world, hand flying an aircraft is not only discouraged its against SOP's and is subject to the "FDR Police". It's all fine and dandy when things are going well but when the crap hits the fan and one actually has to revert to basic flying skills they are not there, either because they never were there in the first place or, if they were, they have atrophied because they haven't been used in years.

While the MAX incident/accidents have brought this home tragically - trying to use the autopilot in a unreliable airspeed situation or a true stall (take your pick), being unable to trim the aircraft with the electric trim (continuous trim rather than short bursts), being unable to manually trim and fly the aircraft, being unable to manage the airspeed and not going the speed of heat, or questionable airmanship decisions such as continuing to destination with unreliable airspeed, and so on - there have been scores of incidents such as the Korean 777 in SFO wherein the crew could not fly a visual approach on a clear day, etc. Only by pure luck or the incredible survivability of the aircraft that no one was killed in the crash itself. And there are scores of other examples of incidents that could have easily become fatal accidents, just go to avherald.com to see for yourself.

The entire industry - ICAO, IATA, the individual airlines, the individual CAA's, the pilot unions, aircraft manufacturers, etc - need to do some serious navel gazing to get the level of pilot proficiency and training back to the point where paying customers can count on the pilot to be the last line of defense when the unexpected happens such as a double engine failure (US Air). Technology is great but it has its limitations and at the end of the day, trained and competent pilots are still needed when the unanticipated events happen.

Editorial over.They even tried to engage the autopilot near the end at 05:43:15, hoping the automation would fix their problems!
It seems the reason they switched the cutoff-switches back was so they could reengange the autopilot.

This is certainly a severe case of "the children of the magenta line". :(

[Aihkio]

It is some while ago I had to handle the airfoil basics but I think that upwash field is affected by speed and fuselage angle of attac affect the side mounted vane. So both speed and fuselage AoA may have an effect that might be taken into account when correcting the vane reading.

[infrequentflyer789]

That exchange was at/after the electrical trim was re-enabled, I believe the 'manual' refers to electrical trim switches.


Disagree. From the report:


At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.

From the FDR traces, no electric trim command (autopilot or manual) is recorded between approx 05:41 and 05:43, therefore the above exchange can only be referring to manual trim with the wheel (unless you are suggesting a simultaneous failure of the trim switches).

[MurphyWasRight]

Originally Posted by MurphyWasRight https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10446268.html#post10446268)
That exchange was at/after the electrical trim was re-enabled, I believe the 'manual' refers to electrical trim switches.

Disagree. From the report:
At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.

From the FDR traces, no electric trim command (autopilot or manual) is recorded between approx 05:41 and 05:43, therefore the above exchange can only be referring to manual trim with the wheel (unless you are suggesting a simultaneous failure of the trim switches).

You are correct, I did not cross check the times correctly.

This could be explained by the pilot thinking that the cutout switches worked as on the 737NG where it is possible to disable automatic trim inputs using one cutout switch while preserving pilot electicall trim control. This changed on the MAX, either switch disables all electrical trim, no idea why that change was made.

The training slide I saw stated the names had changed but I don't recall seeing a statement on the changed functionality, anyone who has access to the conversion slides please clarify if you can,

From a functional schematic posted on another thread it is likely that this would have disabled the trim switches in a way that they would not show on the FDR, unlike the MCAS attempt at ~ 5:40:45 which did not affect the trim.

This might be part of the answer to 'what were they doing all that time', (mashing on disabled trim switches) while the speed to got even higher before attempting (mechanical) manual trim.

[Lake1952]

They even tried to engage the autopilot near the end at 05:43:15, hoping the automation would fix their problems!
It seems the reason they switched the cutoff-switches back was so they could reengange the autopilot.

This is certainly a severe caser of "the children of the magenta line". :(

The children of the magenta line are playing a video game. They are not flying.

[visibility3miles]

https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html
HomeWhat the Lion Air Pilots May Have Needed to Do to Avoid a CrashBy JAMES GLANZ, MIKA GRÖNDAHL, ALLISON MCCANN and JEREMY WHITE NOV. 16, 2018
https://static01.nyt.com/newsgraphics/2018/11/15/lionair-737-cockpit/74731713c737f17336c9380d70ac644b86e25035/cockpit-Artboard_1.jpg
1. Control stabilizer in tail

wing with electric switch

3. Turn wheel

to manually

control stabilizer

2. Shut down

electricity to

stabilizer controls


By The New York Times. Photograph by Vedant Agarwal.New data from the Lion Air flight shows a fatal tug-of-war (https://www.nytimes.com/2018/11/27/world/asia/indonesia-lion-air-crash-.html) between man and machine after the plane’s nose was repeatedly forced down, apparently by the automatic system described below.



Investigators and experts are uncertain why Lion Air Flight 610 plummeted into the Java Sea last month, killing all 189 people on board. But they are focusing on an automatic system designed to keep the plane, a Boeing 737 Max 8, from going into a “stall” condition.

A stall can occur when the plane’s nose points upward at too great an angle, robbing the craft of the aerodynamic lift that allows it to stay aloft. But if the 737 receives incorrect data on the angle – as the same plane did on the flight just before the crash – the system designed to save the plane can instead force the nose down, potentially sending it into a fatal dive.

The situation in this case is further complicated by Boeing’s installation of the system, which the company did without explaining it in the new model’s operating manual. So the pilots might well have been unfamiliar with it.

In a statement, Boeing said it was confident in the safety of the Boeing 737 Max, and added, “While we can’t discuss specifics of an on-going investigation, we have provided two updates to operators that re-emphasize existing operating procedures — the series of steps required — for these situations.”

If the pilots of Lion Air 610 did in fact confront an emergency with this type of anti-stall system, they would have had to take a rapid series of complex steps to understand what was happening and keep the jetliner flying properly. These steps were not in the manual, and the pilots had not been trained in them.

Approximate data on the plane’s speed and altitude on the 11 minutes it spent in the air suggest that the first indication of trouble may have come just above 2,000 feet, when its trajectory was beginning to level off.


https://static01.nyt.com/newsgraphics/2018/11/15/lionair-737-cockpit/74731713c737f17336c9380d70ac644b86e25035/full-flight-altitude-first-desktop-large.png
The 11-minute

climb and descent

of Lion Air Flight 610

3,000 feet

Possible first indication

of trouble

1,000 feet

6:21 a.m.

6:22

6:23

6:24

6:25

6:26

6:27

6:28

6:29

6:30

6:31 a.m.


The New York Times | Source: Flightradar24At that point, said John Cox, the former executive chairman of the Air Line Pilots Association and now a safety consultant, something unexpected occurred: instead of leveling off momentarily, the plane’s altitude dropped around 600 feet. “This may have been the onset, the first time something happened,” Mr. Cox said.

By this point in the flight, the pilots typically would have moved the flaps on the main wings from the down position needed for takeoff into a trimmed up position for flying at higher speeds. The Boeing anti-stall system cannot activate until the flaps are up.

After the 600-foot drop, the pilots climbed to 5,000 feet, possibly to give themselves more maneuvering room if another unexpected dive occurred. They sought and received permission to return to the airport, but for reasons not yet known, they did not appear to have tried to do so. When the plane leveled off just above 5,000 feet, there was another indication that something was amiss: instead of the smooth, straight flight that the usual autopilot setting would produce, the plane pitched up and down, indicating manual operation.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
Altitude of

Lion Air Flight 610

3,000 feet

Pilot appears to

struggle with

manual control

1,000 feet

6:21 a.m.

6:22

6:23

6:24

6:25

6:26

6:27

6:28

6:29

6:30

6:31 a.m.


The New York Times | Source: Flightradar24That could indicate that the pilot simply was not very good at flying in manual mode. More likely, said Les Westbrooks, an associate professor at Embry Riddle Aeronautical University, the pilot already was struggling with some system causing the plane to veer from its straight path.

In that case, Mr. Westbrooks said, it would be like trying to drive a car that is tugging one way or another – the driver can counteract it, but the path is jagged. The plane’s up-and-down motion continued, including a larger dip and recovery of about 1,000 feet in the last few minutes of the flight that might have felt like a bit of rough turbulence to passengers, said R. John Hansman Jr., a professor of aeronautics and astronautics and director of the international center for air transportation at the Massachusetts Institute of Technology.

Then, suddenly, the plane went down.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
Altitude of

Lion Air Flight 610

Plane

plummets

3,000 feet

1,000 feet

6:21 a.m.

6:22

6:23

6:24

6:25

6:26

6:27

6:28

6:29

6:30

6:31 a.m.


The New York Times | Source: Flightradar24There has been no official finding that the anti-stall system – known as the maneuvering characteristics augmentation system, or M.C.A.S. – was activated. But if the 737’s sensors were indicating erroneously that the nose had pitched dangerously up, the pilot’s first warning might have been a “stick shaker:” the yoke – the steering wheel-like handles in front of the pilot and co-pilot – would vibrate.

If the false warning in turn activated the automatic anti-stall system, the pilots would have had to take a series of rapid and not necessarily intuitive steps to maintain control – a particular challenge since those steps were not in the plane’s operating manual and the pilots had not been trained on how to respond.

If it sensed a stall, the system would have automatically pushed up the forward edge of the stabilizers, the larger of the horizontal surfaces on the plane’s tail section, in order to put downward pressure on the nose.

To counter the nose-down movement, the pilot’s natural reaction would probably have been to use his yoke, which moves the other, smaller surfaces on the plane’s tail, the elevators. But trying that maneuver might well have wasted precious time without solving the problem because the downward force on the nose exerted by the stabilizer is greater than the opposite force the pilot would be trying to exert through the elevator, said Pat Anderson, a professor of aerospace engineering at Embry Riddle.

“After a period of time, the elevator is going to lose, and the stabilizer is going to win,” he said.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
The M.C.A.S system angles the

stabilizer, pushing the tail up.

As a result, the

nose goes down.

ELEVATOR

HORIZONTAL STABILIZER


The New York TimesWith only fragmentary data available, Mr. Hansman said he suspects that a runaway of the M.C.A.S. system played a central role in the crash. “The system basically overrode the pilot in that situation,” Mr. Hansman said.

If the anti-stall system indeed ran away with the stabilizer control, only a fast sequence of steps by the pilot and first officer could have saved the aircraft, instructions later issued by Boeing show.

On the outside of the yoke in front of both the pilot and the first officer, there is a switch for electrically controlling the trim – the angle of the stabilizers. If the pilot understood what was happening, he could have used that switch for a few seconds at a time to counteract what the M.C.A.S. was doing to the stabilizers. But that would have been only a temporary solution: the pilot has to release the switch or the nose could go too high. But if he releases the switch, the anti-stall system would reactivate a few seconds later, according to a bulletin issued by Boeing.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
ELECTRIC

STABILIZER

TRIM SWITCH

YOKE

1. Use thumb on this

switch to temporarily

counteract the automatic

stabilizer movement.


The New York TimesThe crucial step, according to the Boeing bulletin, would be to reach across to the central console to a pair of switches (sometimes protected with covers that must be opened), and flip the switches off. Those switches disable electric control of the motor that moves the stabilizers up and down, preventing the anti-stall system from exerting control over their position.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
STABILIZER

TRIM CUTOUT

2. Flip the covers down

and hit the switches

to cut off electrical

power to stabilizers.


The New York TimesThe final step would complete the process for giving the pilots physical control. Cables for manually operating the stabilizers run over a wheel – actually two wheels, one on either side of the console next to the ankles of the pilot and first officer. One of the pilots must rotate the wheel to pull the stabilizer back into the correct position.


data:image/gif;base64,R0lGODlhCgAKAIAAAB8fHwAAACH5BAEAAAAALAAAAAAKAAoAA AIIhI+py+0PYysAOw==
STABILIZER

TRIM WHEEL

3. Take manual

control of stabilizers

by cranking this wheel.


The New York TimesDesigned and produced by Umi Syam. Hannah Beech contributed reporting.
Site Information Navigation

© 2019 The New York Times Company (http://www.nytimes.com/content/help/rights/copyright/copyright-notice.html)

[visibility3miles]

https://leehamnews.com/2019/04/05/bjorns-corner-et302-crash-report-the-first-analysis/Bjorn’s Corner: ET302 crash report, the first analysisApril 05, 2019, ©. Leeham News: The preliminary accident report of the ET302 crash was released yesterday. It confirmed what we wrote about earlier in the week, the pilots followed the prescribed procedure to stop MCAS. Yet they didn’t make it.

Part of why we presented Wednesday. Here follows additional analysis after studying the information in the Preliminary Crash Report.

https://leehamnews.com/wp-content/uploads/2019/04/ET302-FDR-general-trace.png
Figure 1. The general Flight Data Recorder trace from ET302. Source: ET302 preliminary report.The report confirmed our assumptionsThe report released by the Ethiopian Ministry of Transport is a preliminary report. It follows the structure of the Lion Air JT610 preliminary report.

It confirms what we wrote about earlier in the week, the Flight Crew followed the procedures prescribed by FAA and Boeing in AD 2018-23-51. And as predicted the Flight Crew could not trim manually, the trim wheel can’t be moved at the speeds ET302 flew.

The traces from the report is Shown in Figure 1 and 2 (click on them to make them larger).

Figure 1 shows the general Flight Information traces whereas Figure 2 shows the specific information around MCAS and the signals which affect MCAS.

https://leehamnews.com/wp-content/uploads/2019/04/ET302-FDR-trace-specifics.png
Figure 2. The Flight Data Recorder trace from ET302 which deals with MCAS related data. Source: ET302 preliminary report.

etcetera

[VicMel]

I don't know if AoA value shown on the graph was value from the vane or value corrected by algorithms. I suppose both are recorded. Anyway, pitch rate correction cannot drive corrected value from +75° to -60° !Back in the days when I was working on A320 software we were restricted on how much we could send to the FDR. We would have loved to send raw data as well as processed data for a parameter, it would have helped enormously with post flight diagnostics. So I am fairly certain the value on the FDR is the fully processed value that the ADIRU puts on the ARINC 429 bus for the FCC (and whatever else) to use in their own processing.The value can go from +75 to -60deg because (I believe) the 6 stage AoA correction computation (Pitch Rate possibly being the main one) is using garbage parameters and so producing a garbage output. I think the large negative Pitch Rate starting at 05:43:24 may have caused a change to which garbage parameter was picked up. However although the L AoA value is now dynamic, i.e. not stuck, it does not get anywhere near to being correct as it does not track the R AoA in the precise way that it did at the beginning of the flight.
Thus what correction is being discussed; where is the computation done, and how is the output accessed by many other functions requiring AoA - MCAS one amongst many. There are a number of conditioning/corrections going on. Starting with the description in #2857, the AoA sensor provides analogue voltages representing the Sine & Cosine of the shaft angle, with no corrections. The (simple) AoA sensor does not have access to the other parameters needed to do any more than provide raw measurements. These 2 analogue signals go to the ADIRU (and possibly to the SMYD); the ADIRU takes these signals into its A-To-D front end to turn into digital values, which are then made available to the ADIRU software. The software *should* then do a sine**2 + cosine**2 = 1 check; if that passes then it should calculate RawAoA as Atan (Sin(ShaftAngle) / Cos(ShaftAngle)) *checking* that Cos(ShaftAngle) is not so near 0 that an overflow would occur (see crash of first launch of Ariane 5 if you don’t!). The software *should* then check that RawAoA is within +/- valid limits and *should* check the rate of change from the last reading as plausible. A cross check on any other AoA *should/must* be done. Then the AoA *should* be smoothed to remove electrical or vibration noise. Now the 6 corrections (Pitch Rate, Mach No, etc) can be applied. Finally the WingAoA can be put out onto the ARINC 429 bus, as a fully validated, ready to use value for whoever needs it such as cockpit displays, FCC and possibly SMYD.
Vic

[MurphyWasRight]

The value can go from +75 to -60deg because (I believe) the 6 stage AoA correction computation (Pitch Rate possibly being the main one) is using garbage parameters and so producing a garbage output. I think the large negative Pitch Rate starting at 05:43:24 may have caused a change to which garbage parameter was picked up. However although the L AoA value is now dynamic, i.e. not stuck, it does not get anywhere near to being correct as it does not track the R AoA in the precise way that it did at the beginning of the flight.
Vic
While I agree that some SW issue may have been involved with Lion Air (wrong side detect pin?) I cannot see why anything beyond detachment of the AoA vane is needed to explain the rapid swing to ~70 with later almost perfect tracking of G forces of ~+0.5G to ~ -2.0G between 05:43:25 and end of recording.

The bird strike or pre existing damage that let go at takeoff also explains the AoA heater fail.

[safetypee]

VicMel, thanks, :ok:
With that info and previous analysis, how might the correction routine ‘reset’, if it did, between flights?
How or why would this corruption occur on the particular accident flights apparently at random, or reoccur after the first Lion incident; conversely why were there not more instances of inaccurate AoA.

[brak]

Curious number of new posters piling it up on the pilots of the flight in question, all the while drawing attention away from the true culprits (Boeing & Co). PR at work?

[Loose rivets]

Well brak, that may be true, but countered by the very strongly worded post above. It hits firmly at Boeing, and it's hard to not agree with the fundamental points.

[Lost in Saigon]

Curious number of new posters piling it up on the pilots of the flight in question, all the while drawing attention away from the true culprits (Boeing & Co). PR at work?

No, it is not Boeing PR. As more information becomes available, and there is more understanding of what actually happened, those of us who actually get paid to fly can see that these pilots made a lot of mistakes.

The ET302 pilots did not follow the proper procedures after takeoff when they were faced with an Angle Of Attack disagreement during a day VFR departure. Boeing has taken steps to make the B737 MAX MCAS safer (foolproof?), but there will always be pilots who are their own worst enemies.

[KRUSTY 34]

Curious number of new posters piling it up on the pilots of the flight in question, all the while drawing attention away from the true culprits (Boeing & Co). PR at work?

Yep the gloves are definitely coming off.

If Boeing’s handling of the matter so far is anything to go by, they’ll need to be extremely careful they don’t end up painting themselves into a corner.

Oops!

[KRUSTY 34]

No, it is not Boeing PR. As more information becomes available, and there is more understanding of what actually happened, those of us who actually get paid to fly can see that these pilots made a lot of mistakes.

The ET302 pilots did not follow the proper procedures after takeoff when they were faced with an Angle Of Attack disagreement during a day VFR departure. Boeing has taken steps to make the B737 MAX MCAS safer (foolproof?), but there will always be pilots who are their own worst enemies.

I’m sorry, but that has to be the most disingenuous statement I have ever seen.

[Easy Street]

Yep the gloves are definitely coming off.

If Boeing’s handling of the matter so far is anything to go by, they’ll need to be extremely careful they don’t end up painting themselves into a corner.

Oops!

I agree with the sentiment but realism dictates that Boeing will be heavily protected from the consequences of its actions. There is no way that the political establishment will allow anything to undercut Boeing’s short- to medium-term ability to compete with Airbus, let alone its long-term viability. As such, the only reason Boeing has to play nice is to build bridges with non-US customers. It might well judge that its offer to them is now so poor compared to Airbus’s that it has little to lose from an aggressive mud-slinging strategy.

Also, with another tariff battle seemingly brewing, it will be very interesting to see whether the size of any penalty levied upon Boeing for the MAX saga is sufficiently small that Airbus could point to it as a ‘state subsidy’ in all but name when arguing its case at the WTO. If anyone doubts the ability of the Washington establishment to influence due process for its favoured firms, look at how Halliburton got away with it over Deepwater Horizon while (foreign-owned) BP got absolutely hammered....

[GlobalNav]

No, it is not Boeing PR. As more information becomes available, and there is more understanding of what actually happened, those of us who actually get paid to fly can see that these pilots made a lot of mistakes.

The ET302 pilots did not follow the proper procedures after takeoff when they were faced with an Angle Of Attack disagreement during a day VFR departure. Boeing has taken steps to make the B737 MAX MCAS safer (foolproof?), but there will always be pilots who are their own worst enemies.

BS. There’s not a crew in the world that doesn’t make mistakes, but this crew did not act stupidly nor incompetently. The design of MAX in the case of malfunctioning MCAS is terribly intolerant of error.

[737 Driver]

There’s not a crew in the world that doesn’t make mistakes

Agree.

but this crew did not act stupidly nor incompetently.

Disagree for reasons previously covered. That being said, they were a product of their airline's training and culture.

The design of MAX in the case of malfunctioning MCAS is terribly intolerant of error.

Agree wholeheartedly.

[patplan]

No, it is not Boeing PR. As more information becomes available, and there is more understanding of what actually happened, those of us who actually get paid to fly can see that these pilots made a lot of mistakes.

The ET302 pilots did not follow the proper procedures after takeoff when they were faced with an Angle Of Attack disagreement during a day VFR departure. Boeing has taken steps to make the B737 MAX MCAS safer (foolproof?), but there will always be pilots who are their own worst enemies.

How did the crew of ET302 know there had been an "Angle of Attack Disagreement"? Was it being displayed on their PFD's?? Did you even read the previous thousand or so postings before you posted yours? I'm curious.

[Lost in Saigon]

How did the crew of ET302 know there had been an "Angle of Attack Disagreement"? Was it being displayed on their PFD's?? Did you even read the previous thousand or so postings before you posted yours? I'm curious.


As we all know now, if the AOA fails, it can cause MCAS to trim nose down when it should not. This was a surprise to the Lion Air Pilots but after that accident Boeing sent a Bulletin to all operators explaining the system and how to deal with it.

Ethiopian Airlines got this bulletin but for some unknown reason the crew of ET302 were not able to deal with the problem.

Boeing has since changed MCAS to use info from both AOA and limited how much nose down trim can be applied. This should make it safer even if the pilots mishandle a failure or emergency.

[AerocatS2A]

You didn’t answer the question. How were the crew to know they had an AoA disagree?

[neila83]

As we all know now, if the AOA fails, it can cause MCAS to trim nose down when it should not. This was a surprise to the Lion Air Pilots but after that accident Boeing sent a Bulletin to all operators explaining the system and how to deal with it.

Ethiopian Airlines got this bulletin but for some unknown reason the crew of ET302 were not able to deal with the problem.

Boeing has since changed MCAS to use info from both AOA and limited how much nose down trim can be applied. This should make it safer even if the pilots mishandle a failure or emergency.


Wow, somebody tell the authorities, Boeing already fixed it! No need for any tests, get that thing back in the air LostinSaigon apparently knows all is fine. I'll file this with all the people asking why they didn't just 'cut the trim switches' until it turned out they did cut the trim switches.

The key words in your post were 'for some unknown reason'. I expect the authorities will want to actually find out what that was before letting the plane fly again. Because they did follow the checklist, and there are points in the FDR which may suggest there is a further problem somewhere in the computers; I believe Boeing has stated they have identified an additional undisclosed problem.

[Lost in Saigon]

You didn’t answer the question. How were the crew to know they had an AoA disagree?

They should have read the bulletin.


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/1136x992/5d7f1fa3_ea5a_4790_bac6_ebbc0d8c8d46_adfa23ccf5c449d7511ff6f 2bcdd67a3f066a7d3.jpeg
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/1236x929/2900461d_e90c_4a51_b751_7ff5cdc0fab5_7075f98c6dc2533895bd366 f6ce36d9893c5854a.jpeg

[neila83]

They should have read the bulletin.


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/1136x992/5d7f1fa3_ea5a_4790_bac6_ebbc0d8c8d46_adfa23ccf5c449d7511ff6f 2bcdd67a3f066a7d3.jpeg
https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/1236x929/2900461d_e90c_4a51_b751_7ff5cdc0fab5_7075f98c6dc2533895bd366 f6ce36d9893c5854a.jpeg


Thank you for providing the proof that pilots were not provided with a way of knowing they have an AoA disagree. Unless they happened to work for American Airines who had the optional extra. And yeh the pilots used electric trim up and then hit the cutout switches. There is a question that may be around the additional problem Boeing is investigating about why they didn't trim up further with the electric trim. It's a question because it happens at the start and the end, and there's no logical reason for the pilots to do that, which suggests there may have been an additional system problem. We shall see.

[TBLG]

From a U.S. Private Pilot: My buddy's youngest is a First Officer on the B737 with Alaska. His only comment was that an emergency "CESSNA" button on the instrument panel to kill all digital input except for primary controls, slats, flaps, brakes and steering would be nice; allowing for good old fashioned piloting skills and, hopefully, a safe manual (Cessna) landing.

Possibly an enormous over-simplification but is that possible?

Tim.

[Fursty Ferret]

That’s basically what the stabiliser disconnect switches do on the 737. Pretty much all the controls are string and pulleys.

In any non-normal situation flying the aircraft manually usually comes at the expense of reduced capacity for troubleshooting and decision making. Deliberately increasing workload would be an unusual step to take.

The 737 Max accidents are (IMHO) mainly influenced by design choices that should never have passed certification and trying to slap a sticking plaster on top of those decisions is missing the bigger picture.

[wonkazoo]

No, it is not Boeing PR. As more information becomes available, and there is more understanding of what actually happened, those of us who actually get paid to fly can see that these pilots made a lot of mistakes.

The ET302 pilots did not follow the proper procedures after takeoff when they were faced with an Angle Of Attack disagreement during a day VFR departure. Boeing has taken steps to make the B737 MAX MCAS safer (foolproof?), but there will always be pilots who are their own worst enemies.

I've been mostly silent on this thread, despite reading all posts. But that one rang a bell.

FACT: As far as the world knows exactly seven qualified commercial pilots have seen the scenarios that let to the loss of Lion Air 610 and ET302.

FACT: Of those seven pilots four are dead.

FACT: Of those seven pilots, and the three who are not dead, the only individual who correctly connected the dots was not either pilot 5 or 6. It was a jumpseater sitting behind them, who wasn't responsible for anything, who interrupted the mayhem and allowed the flight to continue and land safely.

A failure that results in an absolute 86 percent of its pilots being overwhelmed, that represents 66 percent of flights on which said failure happened ending up in microscopic sized pieces, this is not a failure that can be allowed on a modern transport aircraft.

If eight out of ten pilots who were exposed to a real life stressor are overwhelmed (empirically and though observation in known environments), how exactly is this their fault??

A failure that results in an absolute 66 percent of its pilots (and passengers) being killed simply cannot be blamed on the pilots. Could they have done better?? You bet. But statistics don't lie- and the numbers here show conclusively that MCAS is a killer unless you line up the slots in just the right way.

Perhaps more concerning: ANU trim above 300?? KIAS can cause you to have no trim control at all. I'll take on MCAS any day, but a stuck trim wheel with no altitude to give and... That's just nuts. I've been interviewing friends of mine who fly heavy iron. Not one can describe an airplane they have flown which loses all trim authority above a certain airspeed and tail loading.

You 737 drivers out there: If you are clocking 320KIAS and you try to use the trim- will it work if you are somewhat mis-trimmed nose-down?? 300KIAS?? 310KIAS?? Where and when does your trim tab become teh hammer nailing the lid shut on your coffin?? I am stunned to see here that people are not discussing this more. MCAS is an abomination, but alone it is simple stupidity. An Airplane that has an envelope within the normal operating range wherein trim will no longer not only be detrimental, it will me immovable...Really??

On every airplane you've got a handy indication of stall speed clean and dirty. If there is a speed above which your horizontal trim may not work, would there not be a need for a little line, to like, ummm, say "Hey dummy- if you are above this line you've got squat in terms of horizontal stabilizer trim control!!"

Finally:

Please stop trying to find the person to pin the blame to. This was a human failure, and it has literally thousands of possible inputs that could have effected the outcome. It is in Boeing's interest to minimize the actual events, as well as their underlying causes. But it is up to people like those of you here- to suss out the difference between corporate protective blame and actual culpability. The pilots had seconds to make decisions that would impact hundreds of lives. Boeing had at least eight years to make decisions that would have kept the bastard MCAS from entering into service in the first place. It is improper to equivocate the two, and moreso to blame the guys who only had a few seconds to guess and act correctly, as opposed to those who had years to do it right- and didn't.

Don't get me wrong- I know how proud we are. I simultaneously joined the Caterpillar Club and destroyed an entire airframe in 1996. I knew what had happened, but I knew that until the NTSB report came out NOT blaming pilot error I would never be free. And if it did blame me I would be crushed to the point of uselessness going forward. We are a proud profession, and we will eat our young in a heartbeat if we feel they have failed our standards in some way.

Eating our young here is a disservice to the profession. They went to work, did their best, their best was not good enough and hundreds died.

That should be enough penalty no??

Apologies for the rant-
dce

[double-oscar]

To be accurate, they had a stall warning on lift-off. There is guidance for this in the QRH and the Flight Crew Training Manual which wasn’t followed. This must raise questions about pilot training and the role of pilots in operating aircraft which are becoming more automated.

[neila83]

To be accurate, they had a stall warning on lift-off. There is guidance for this in the QRH and the Flight Crew Training Manual which wasn’t followed. This must raise questions about pilot training and the role of pilots in operating aircraft which are becoming more automated.

I guess we'll find out in the final report. Although the criminal investigations may preclude that. There are a lot of people here I really hope have no genuine role in aviation safety, so clear is their bias.

[groundbum]

I imagine right now that Boeing HQ are relying on the belief, like some banks, that they are too big to fail. I'm sure they're confident their friends on Capital Hill will manage this fall from grace and cut them all the slack possible on the way back up. Whether this is in the best interests of safety is debatable, The real bogeyman isn't Airbus since they're a known quantity and can co-exist in the world marketplace with Boeing. It's the Chinese who want to dominate everything, and would love to move up the food chain and build and eventually export their own airliners. Look at Huawai v Apple. I'm sure Trump and everybody else are finessing a soft landing, and providing a helping hand up for America's premier manufacturer and exporter.

G

[ATC Watcher]

I've been mostly silent on this thread, despite reading all posts. But that one rang a bell.

FACT: As far as the world knows exactly seven qualified commercial pilots have seen the scenarios that let to the loss of Lion Air 610 and ET302.

FACT: Of those seven pilots four are dead.

FACT: Of those seven pilots, and the three who are not dead, the only individual who correctly connected the dots was not either pilot 5 or 6. It was a jumpseater sitting behind them, who wasn't responsible for anything, who interrupted the mayhem and allowed the flight to continue and land safely.

A failure that results in an absolute 86 percent of its pilots being overwhelmed, that represents 66 percent of flights on which said failure happened ending up in microscopic sized pieces, this is not a failure that can be allowed on a modern transport aircraft.

If eight out of ten pilots who were exposed to a real life stressor are overwhelmed (empirically and though observation in known environments), how exactly is this their fault??

A failure that results in an absolute 66 percent of its pilots (and passengers) being killed simply cannot be blamed on the pilots. Could they have done better?? You bet. But statistics don't lie- and the numbers here show conclusively that MCAS is a killer unless you line up the slots in just the right way.

Perhaps more concerning: ANU trim above 300?? KIAS can cause you to have no trim control at all. I'll take on MCAS any day, but a stuck trim wheel with no altitude to give and... That's just nuts. I've been interviewing friends of mine who fly heavy iron. Not one can describe an airplane they have flown which loses all trim authority above a certain airspeed and tail loading.

You 737 drivers out there: If you are clocking 320KIAS and you try to use the trim- will it work if you are somewhat mis-trimmed nose-down?? 300KIAS?? 310KIAS?? Where and when does your trim tab become teh hammer nailing the lid shut on your coffin?? I am stunned to see here that people are not discussing this more. MCAS is an abomination, but alone it is simple stupidity. An Airplane that has an envelope within the normal operating range wherein trim will no longer not only be detrimental, it will me immovable...Really??

On every airplane you've got a handy indication of stall speed clean and dirty. If there is a speed above which your horizontal trim may not work, would there not be a need for a little line, to like, ummm, say "Hey dummy- if you are above this line you've got squat in terms of horizontal stabilizer trim control!!"

Finally:

Please stop trying to find the person to pin the blame to. This was a human failure, and it has literally thousands of possible inputs that could have effected the outcome. It is in Boeing's interest to minimize the actual events, as well as their underlying causes. But it is up to people like those of you here- to suss out the difference between corporate protective blame and actual culpability. The pilots had seconds to make decisions that would impact hundreds of lives. Boeing had at least eight years to make decisions that would have kept the bastard MCAS from entering into service in the first place. It is improper to equivocate the two, and moreso to blame the guys who only had a few seconds to guess and act correctly, as opposed to those who had years to do it right- and didn't.

Don't get me wrong- I know how proud we are. I simultaneously joined the Caterpillar Club and destroyed an entire airframe in 1996. I knew what had happened, but I knew that until the NTSB report came out NOT blaming pilot error I would never be free. And if it did blame me I would be crushed to the point of uselessness going forward. We are a proud profession, and we will eat our young in a heartbeat if we feel they have failed our standards in some way.

Eating our young here is a disservice to the profession. They went to work, did their best, their best was not good enough and hundreds died.

That should be enough penalty no??

Apologies for the rant-
dce
No analogizes needed. Superb post and hitting where it hurts: I also joined the "Caterpillar club", as you call it, in 2004, and I cannot tell you the number of pilots around me that (still) believe it could not have happened to them . A form of self preservation possibly ,together with a zest of overconfidence surely. Everyone has read about the "startle effect" in an emergency , and training for that is difficult and not really realistic in a sim . when you enter a sim you expect something unusual will happen.
So please , here , unless you work for Boeing and are afraid to loose your job, let's skip the notion that those Ethiopians kids did not follow proper procedures and are somewhat responsible for this accident..

[GlueBall]

GlobalNav - "...BS. There's not a crew in the world that doesn't make mistakes, but this crew did not act stupidly nor incompetently...."

So switching on the autopilot with the stick shaker, zooming past 340 VMO with clacker horn tweeting, continuing past 458 kts at low altitude in day VMC is neither stupid nor incompetent? Do tell.

[alf5071h]

double-oscar, #4005,

‘… they had a stall warning on lift-off. There is guidance for this in the QRH and the Flight Crew Training Manual which wasn’t followed.‘
In addition to stall warning, the crews also had higher stick force (feel shift), airspeed and altitude disagree alerts, ambiguous speed indications; surprise.

Now where in the manual is this combination considered, and belatedly in the FAA AD, how is the description and interaction of these placed in appropriate context.
How should the possibility that the Manufacturer or the Regulator not following their procedures be framed - context, for including a procedure for a situation which was overlooked or not even conceived?

The Lion and Ethiopian crews are the most experienced in our industry in those specific conditions; unfortunately there are unable to relate their experiences for us to learn from. Thus it is everyone’s responsibility to learn from what is known of past events, but not to identify the similarities with (our) current thoughts, or fit understanding to hindsight; instead we all have identify new issue particularly those hidden or already forgotten.

[Alchad]

GlobalNav - "...BS. There's not a crew in the world that doesn't make mistakes, but this crew did not act stupidly nor incompetently...."

So switching on the autopilot with the stick shaker, zooming past 340 VMO with clacker horn tweeting, continuing past 458 kts at low altitude in day VMC is neither stupid nor incompetent? Do tell.

Are you serious?? ….."continuing past 458 kts at low altitude".....that was when they were nose diving towards the ground !!!!!

[DaveReidUK]

Are you serious?? ….."continuing past 458 kts at low altitude".....that was when they were nose diving towards the ground !!!!!

Yes, the myth that they were flying straight and level at that airspeed has been perpetuated in several posts, which is rather odd given how many times the FDR traces have been posted.

[Europa01]

As mere SLF I'm more than disappointed by the lack of self reflection and 'wouldn't have happened to me' arrogance of some posting on this thread. This mindset makes an unnecessary hole in one of those slices of Swiss cheese.
As an engineer working with safety system reliability I'm puzzled by the arrangement of the two stab trim cutout switches on the Max. if I understand the schematic in # 3882 correctly the Main Stab Trim Cutout switch does everything and the Backup simply provides a set of series contacts for a subset of the Main switch functions.
Given that series contacts didn't appear to be necessary in previous 737 systems it might be concluded that the Backup switch is superfluous other than as a piece of window dressing to make the switch arrangement look like it always used to. This seems like a potential error trap for a pilot expecting the functionality of previous 737s.

[GordonR_Cape]

double-oscar, #4005,

‘… they had a stall warning on lift-off. There is guidance for this in the QRH and the Flight Crew Training Manual which wasn’t followed.‘
In addition to stall warning, the crews also had higher stick force (feel shift), airspeed and altitude disagree alerts, ambiguous speed indications; surprise.

Now where in the manual is this combination considered, and belatedly in the FAA AD, how is the description and interaction of these placed in appropriate context.
How should the possibility that the Manufacturer or the Regulator not following their procedures be framed - context, for including a procedure for a situation which was overlooked or not even conceived?

The Lion and Ethiopian crews are the most experienced in our industry in those specific conditions; unfortunately there are unable to relate their experiences for us to learn from. Thus it is everyone’s responsibility to learn from what is known of past events, but not to identify the similarities with (our) current thoughts, or fit understanding to hindsight; instead we all have identify new issue particularly those hidden or already forgotten.


Quite apart from MCAS (when it is fixed on the MAX), and with the same applying to the previous B737 NG model, the biggest story coming out of these crashes is about the effects of the faulty AOA sensor: I am still astonished that Boeing can design, and the FAA can certify, a brand spanking new aircraft model with an archaic flight system, where a single faulty AOA sensor can activate multiple warnings and cascading alerts simultaneously.
And then, to compound the insult, each of those warnings has different, and sometimes contradictory checklists. The checklists are designed to address specific flight conditions, but there seems to be no single clear checklist for sensor failure, nor any way to disable that sensor or the alarms?
What if this scenario happens under heavy workload at night under IMC? Am I missing something?

[Cows getting bigger]

You're missing nothing. You are asking the questions that should be appearing at BA board level. I can't see anyone subscribing to a MAX+ in 10 years time. Time for a clean sheet of paper, regardless of the MAX outcome.

[rog747]

Cayman Airways CEO and Board deliberating over their 737 MAX leases and their future.

They have just had 2 new -8 aircraft delivered in Nov and Mar, and 2 more on order for later this year/next.

They are now resorting to using a smaller 737-300 on their new longer routes which the Max was obtained for - now these 733 flights entail a tech stop.
They were also leasing an EAL 767 and the crippling $$$$ costs are the subject of CAY seeking compensation from the Lessor and/or Boeing plus looking into now cancelling all of the MAX leases outright and re-equipping.
They also think that damage limitation v/v pax with the MAX name is an issue.

[737 Driver]

I’m saddened by the tragic loss of life, and the difficult situation that the crew was given. There is no excuse for the deficiencies of the MCAS design.

That being said, there is no universe in which multiple attempts to engage the autopilot at low altitude with an active stick shaker was the correct choice. There are times in this business in which the only correct choice is to turn off all the magic, grab yourself a handful of aircraft, and return to the basics of pitch, power, and performance. Not knowing the specifics of the crew or their airline, I will leave it to someone else to determine if the crew actions were deficiencies of the individuals or deficiencies of their training, but deficient they were.

[GlueBall]

Are you serious?? ….."continuing past 458 kts at low altitude".....that was when they were nose diving towards the ground !!!!!

Liftoff was at 5:38;00, 5:40:42 passing 305 kts, 5:41:20 Clacker (VMO 340), 5:42:10 still found time to talk to ATC and change heading bug, ...that's 1:33 before impact, while nobody thought about MANUALLY pulling back the thrust levers. ...Helloooo.

[MurphyWasRight]

That’s basically what the stabiliser disconnect switches do on the 737. Pretty much all the controls are string and pulleys.

In any non-normal situation flying the aircraft manually usually comes at the expense of reduced capacity for troubleshooting and decision making. Deliberately increasing workload would be an unusual step to take.

The 737 Max accidents are (IMHO) mainly influenced by design choices that should never have passed certification and trying to slap a sticking plaster on top of those decisions is missing the bigger picture.
For the 737 up to NG one switch disables automatic trim while preserving pilot electrical trim, the second switch disables all electrical trim. On the 737 MAX either switch disables all electrical trim

Manual trim of a significantly out of trim aircraft may be difficult at best.

I have asked how well this change to the cutout was documented in the conversion slideware but have not seen a response.

[LowObservable]

Wonkazoo reminds us of a critical point. If four conditions exist....

1 - An AoA sensor is wrong
2 - It is wrong nose-up
3 - The magnitude of the error is large enough to trigger a stall warning
4 - The AoA sensor happens to be the one driving MCAS on this segment

... then MCAS will be "armed" and it will kick in at flaps up.

Even now, we know of only three such events, two of them leading to fatal accidents. Unless there have been a lot more than three, there is no prima facie case to argue about pilot competence, and the root cause to be investigated is how MCAS was designed, tested and approved for service.

[Thrust Augmentation]

When are all you guys from the deluded "it can't happen to me", "it's pilot error", "they were incompetent", "they were not properly trained" camp going to waken up & smell the wreak here - which is so much more unpleasant than coffee! Regardless of what you may have concluded occurred in the cockpit from the available information, you simply don't know & never will know the whole story. We already know that at least some of the data available is junk / error / erroneous. Basing your opinions on the available data to hold these poor pilots responsible for the deaths of all involved is simply ridiculous, naive & morally wrong.

The time critical situation that the pilots were put in simply does not give enough time to work through & rigorously adhere to checklists & doing so may have killed them even more quickly, especially considering the complex interaction of several systems where a multitude of variables are possible & outcomes numerous. The various procedures involved is successful recovery would appear to be too complex for a normal, qualified pilot & completely inadequate at low level when time is critical - too much to p*** about with & not enough time to do it. It also appears that depending on some circumstances, normally accepted procedures may just be trap doors at low level.

Fudge 1 - Out of sight;
Shoving MCAS so far into the background so as to avoid certification & training issues (translate to cost / money). Someone / lots of someone's at Boeing surely knew that it was mistake to have MCAS quietly installed given the authority it has. "Yea guys, it's nothing, just a few tick boxes on a tablet & we are good to go" - 346 lives in less than five months suggests otherwise.

Fudge 2 - The implementation of MCAS;
Complete authority over life & death on the basis of a single sensor input (sensor, wiring, ADIRU or software).

"How will we activate this thing guys?"
"Just wire it to an AOA sensor"
"What if the AOA sensor or data is faulty?"
I mean, seriously what was after that "They don't go faulty" or "don't ask expensive questions"

"MCAS doesn't seem to work as well as we had hoped boss, should we consider an appropriate aerodynamic fix?"
"Just increase its authority by a factor of 4 or more & stop asking expensive questions"

Apart from Boeing test pilots does anyone really know how pronounced the decreasing input forces with increasing AOA really are? Is it as simple as decreasing input force or is there more to it, such as a lack of authority????

The fact that there seem to be so many differing opinions on the workings & capability of the trim & stab systems from apparent ticketed 737 drivers is concerning, as is the suggestion that that any 737 trim system may become ineffective under certain situations & that spinning the wheels will either be ineffective or impossible.

I cant help seeing MCAS as anything other than a dangerous fudge that was implemented in consideration of sales & profit. That the manufacturer would have been unaware of the potential unintended consequences is not something that I can believe.


737NG's certification was issued on the basis of improved, high accuracy production methods, yet Ducommun were using the high tech sledgehammer method. How many NG's are flying at their maximum certified altitude without the high accuracy parts required for this?

787 - the box fix....

Now 737 Max....

It seems that proper, retrospective fixes are expensive. I don't have a dog in A, B or any other camp, just saying what I see in regards to B at the moment.

[MemberBerry]

Liftoff was at 5:38;00, 5:40:42 passing 305 kts, 5:41:20 Clacker (VMO 340), 5:42:10 still found time to talk to ATC and change heading bug, ...that's 1:33 before impact, while nobody thought about MANUALLY pulling back the thrust levers. ...Helloooo.

They were trying to climb, and they had the stick shaker active. Reducing thrust when you try to climb can be a bit counterintuitive, wouldn't you say? Also, reducing thrust when you have the stick shaker active is usually not the best idea. Especially close to the ground. Also the speed, as measured on the left side, stayed at about 340 knots for about 3 minutes. It seems the pilot flying was controlling the speed using the elevator, pulling harder when it was going over 340. They only went significantly over 340 during the final dive.

So I doubt they were unware of their speed and the clacker. They probably wanted the speed, probably hoping it will allow them to climb faster and it might also make the stick shaker go away. It's like a terrain avoidance maneuver where you pitch up until the stick shaker activates. You actually want the stick shaker to activate, it tells you are doing your best to climb. And you keep it around that point, close to a stall, with the shaker intermittently activating, until you clear the terrain. Something similar may have been going on here, they may have wanted to keep the speed close to VMO.

Of course, you can then question why the pilots didn't pull even harder to climb faster, instead of allowing the speed to reach 340. The column displacement is never more than about 66% nose up in that 3 minute interval they kept the speed at VMO. But then you have to remember the stick shaker. They may have been afraid to pull harder because of the stick shaker. That may also explain why they didn't fully revert the nose down trim from MCAS when they had electric trim available. They may have been reluctant to trim and pull nose up believing they could be near a stall.

They made mistakes that are hard to explain, like attempting to enable the left side auto-pilot, and not realizing the instruments on the right side were the ones working properly. But I don't think allowing the aircraft to reach VMO is one of those mistakes.

[737 Driver]

Regarding the changes to the pedestal cutout switches, from a procedural perspective it doesn’t matter (at least in my FCOM). Our runaway stab trim NNC requires the use of BOTH cutout switches, NG or MAX. We no longer attempt to isolate the faulty trim circuit on the NG. Thus from a differences training point of view, it doesn’t matter that they are wired differently.

[MurphyWasRight]

...
...
That's it. NO MENTION OF ANY CHANGES TO TRIM, TRIM SWITCHES, TRIM SWITCH LABELS OR FUNCTIONS. Or MCAS.
Thank you.
That and the CYA updated runaway trim procedure that appears to have been written to support the claim that Lion Air was could have been prevented had existing procedures been followed is depressing.

For the 'just follow the procedures" crew; what would have been the likely outcome in ET if a new 'MCAS runaway' checklist had been published instead with specific instructions, I am sure Boeing engineers/test pilots could provide a much better one.

Condition:
ND trim in increment of up to 10 seconds, repeated after pilot trim inputs.

MCAS may be the cause, only when manual flying no flaps.

Action:

Fully trim the aircraft.
Note: if either trim switch is 'blipped' MCAS will be disabled for 5 seconds.
This can be used while fine tuning trim, use alternate up/down trim inputs every 3 seconds.

Once trimmed disable electrical trim.

Land and file a full tech report. (One hopes not needed but Lion Air comes to mind)

[Machinbird]

They made mistakes that are hard to explain, like attempting to enable the left side auto-pilot, and not realizing the instruments on the right side were the ones working properly. But I don't think allowing the aircraft to reach VMO is one of those mistakes.
Sir. Thinking like that is cruising for a bruising.
With flight control problems, you should typically go for the center of the envelope and avoid the corners of the envelope, then explore cautiously.
Besides that, if they had managed to keep control much longer, their continued acceleration would likely have caused a structural failure! The aircraft has a Vmo limit for a reason.
What killed them was the loss of control authority that occurs in the 737 control system due to control surface forces exceeding the elevator actuator capability and loss of control movement due to cable stretch at very high control forces.
When you go really fast, that big HS can make bad stuff happen really fast before you have time to counteract with your dinky little elevator.

[gums]

Salute!

I like Thrust..I will fly his right seat any day.

Takwis could be the best expert witness in the trials. Especially if the lawyers can get more pilots that went thru the minimal training for this model. Seems to me that the suits are gonna minimize crew actions and besides, can’t get a lotta money from dead pilots.

Gums sends.......

[Organfreak]

How can this discussion become any more wearisome (albeit fascinating at the same time) than it has? To a dispassionate bystander with a decent grasp of the technical AND human factors involved and NO axe to grind (such as myself :8 ) it has seemed obvious, pages ago, that there is plenty of blame to go around! No-one will emerge blameless from the analysis. All of the arguments from the various POVs here make sense, and only serve to show that almost everybody screwed up! 'Course if we all adopted that POV there'd be no discussion, and what fun would that be?

[Cows getting bigger]

STAB TRIM switches. So, the two little switches on the pedestal look the same and feel the same as those on a 738 etc. But the little white labels say something different and do something different. This isn't indicated anywhere in flight manuals, checklists, training software/documentation etc? What else has changed but isn't covered in the 'training manual'?

Hmmmm. The more I look at this the more I think the MAX has been a third-rate job. Yep, clearly the crews got it wrong. :rolleyes:

[MemberBerry]

Sir. Thinking like that is cruising for a bruising.
With flight control problems, you should typically go for the center of the envelope and avoid the corners of the envelope, then explore cautiously.
Besides that, if they had managed to keep control much longer, their continued acceleration would likely have caused a structural failure! The aircraft has a Vmo limit for a reason.
What killed them was the loss of control authority that occurs in the 737 control system due to control surface forces exceeding the elevator actuator capability and loss of control movement due to cable stretch at very high control forces.
When you go really fast, that big HS can make bad stuff happen really fast before you have time to counteract with your dinky little elevator.

I agree they shouldn't have done that. I didn't say it wasn't a mistake. I was just saying it wasn't a mistake that is hard to explain. There are maneuvers that force you to get to the edge of the envelope to save the aircraft, like the terrain escape maneuver. So, out of everything they did, this is probably part that is the easiest to explain and excuse.

However I disagree with the statement that they kept accelerating. They accelerated for the first 2 minutes but, after getting close to VMO, their speed remained almost constant for about 3 minutes. The airspeed traces on the FDR chart were almost flat. They were not accelerating until MCAS activated again and brought the nose down.

[MPN11]

https://abcnews.go.com/US/american-airlines-entire-fleet-737-max-jets-grounded/story?id=62383585&cid=clicksource_4380645_null_twopack_hed

No quick fix, it appears. AA rescheduling until August, pending resolution.

[L39 Guy]

We can debate all day long about whether MCAS is a piece of crap, whether pilots should or should not have been given more information about it, etc., etc.
The overriding issue with both Lion Air and Ethiopean is why they could not manage the aircraft whereas, as it has been reported earlier in this thread (about 4,000 posts ago) that this same event happened at least five times with US carriers and they all managed to safely gain control of the aircraft and land safely.

The moment the aircraft lifted off in all of these situations they had an unreliable airspeed situation - disparity between airspeed indicators, the stick shaker active. The B737, like all airliners, have three independent altimeter, attitude indicators and airspeed indicators. A quick look at the other two or simply by asking the pilot not flying what his or her airspeed indicator says and comparing it to the standby would quickly isolate which one is unreliable. That is basic airmanship.

This is a textbook UAS event. It's a memory drill - flight directors off, autopilot off, auto throttle off, set an appropriate pitch/power setting for phase of flight. None of this was done. And, as I pointed out earlier, even if the Ethiopean crew thought it was a bona fide stall, you do not engage the autopilot. Period. Moreover, if the aircraft is indeed in a stall, why on earth would one raise a high lift device like the flaps and deepen the stall? Airmanship again. So even before the MCAS event, things were way off the rails.

When the flaps were up the MCAS activated. Having the nose pitch down without any manual input while manually flying the aircraft is a text book stab trim runaway. There is a memory checklist for that too which, among other things, calls for turning off the stab trim switches. And turning off the electrical stab trim kills any MCAS nose down trimming.

I know that it is harsh to criticize the pilots and all too often "pilot error" is the the go-to answer but these aircraft, as the US pilots demonstrated, were completely flyable if the crews simply did what they should have been trained to do yet not one of the memory drills was completed. Even if the airspeed unreliable drill was done and the power setting brought back from 94% to 80% while climbing then 75% when leveled off, the speed would have been such that manual hand wheel trim would have been possible even with MCAS active. This would have bought them lots of time to sort out the runaway trim despite not knowing the memory drill. As we know, the speed got way out-of-hand, past Vne, making manual trim with the hand wheel impossible.

I might be old school, but I believe that professional aviators are paid to know their stuff including knowing their emergency drills, particularly the ones that are memory items. They are memory items for a reason as the control of the aircraft is at stake as we have seen tragically demonstrated in these MAX accidents. Would we turn a blind eye to physicians not knowing how to do CPR? I think not nor should we shy away from criticizing pilots for not knowing two emergency drills designed to cope with situations just like this; hopefully the industry can learn from these accidents and put a lot of focus on pilot training and experience.

[Thrust Augmentation]

this same event happened at least five times with US carriers and they all managed to safely gain control of the aircraft and land safely.


Do we factualy know it was the same or just outwardly similar?

It would have to be an identical scenario for this to mean anything.

[Cows getting bigger]

Documentation, please...this is the first assertation of this that I have heard. Frankly, I don't think that it is true.

Indeed, I've personally seen no evidence of a successful outcome from this scenario other than for Lion Air #1

I might be old school, but I believe that professional aviators are paid to know their stuff including knowing their emergency drills, particularly the ones that are memory items.

I'm also old-school and I was taught to know the effect of every switch and system before I used it. It seems that the MAX manufacturer wasn't too efficient in giving us old-school pilots that sort of information.

[Airbubba]

Who has a GoPro camera mounted on the windshield, pointed at the F/O's seat?

Look like it's Boeing flight test. There is a placard below the FO's display that appears to read BOE 104 EXPERIMENTAL.

[MurphyWasRight]

The moment the aircraft lifted off in all of these situations they had an unreliable airspeed situation - disparity between airspeed indicators, the stick shaker active.
...
This is a textbook UAS event. It's a memory drill - flight directors off, autopilot off, auto throttle off, set an appropriate pitch/power setting for phase of flight. None of this was done. And, as I pointed out earlier, even if the Ethiopean crew thought it was a bona fide stall, you do not engage the autopilot. Period. Moreover, if the aircraft is indeed in a stall, why on earth would one raise a high lift device like the flaps and deepen the stall? Airmanship again. So even before the MCAS event, things were way off the rails.
...
.
Not sure that we know for a fact that ET had a UAS warning. The (frustratingly limited) log in the ET prelim report reports that the displayed speeds diverged but no mention of UAS.
From the FDR plot the 2 speeds are not widely different at first although it is hard to read absolute values.

What is the trigger for UAS warning?

Can the autopilot be engaged while UAS warn is active?

Also puzzled by 'the stick shaker active' in above, is this an expected side effect of all UAS events?

I could well be missing something here so stand ready to be corrected/further enlightened.

[DaveReidUK]

Documentation, please...this is the first assertation of this that I have heard. Frankly, I don't think that it is true.

See this post:

So the Americans have had 5 cases of control issues after takeoff on the MAX. At least two happened when they engaged the auto pilot.There appears to be several issue with the MAX.
IIRC, subsequent discussion was inconclusive about any link between those events and the JT/ET accidents.

[Organfreak]

So, at least two were autopilot related (and MCAS supposedly won't work with the autopilot on), and the others were "inconclusive". Just like the two fatal crashes...yeah.

Is there an easy way to find that exact post, from the information here? Not real competent at working this website, yet.

It's post #981, at present.

[Just This Once...]

I've been mostly silent on this thread...

You 737 drivers out there: If you are clocking 320KIAS and you try to use the trim- will it work if you are somewhat mis-trimmed nose-down?? 300KIAS?? 310KIAS?? Where and when does your trim tab become teh hammer nailing the lid shut on your coffin?? I am stunned to see here that people are not discussing this more. MCAS is an abomination, but alone it is simple stupidity. An Airplane that has an envelope within the normal operating range wherein trim will no longer not only be detrimental, it will me immovable...Really??


Your break from cover is appreciated as there are too few of us posting on this thread with astonishment that the manual and electric trim performance envelop is not defined for the 737 NGs that are still out there flying today.

All we have is a statement from EASA noting that the electric trimmers don't work in part of the performance envelop, complete with a reply from Boeing to say it is 'feature' and that manual trim remains available throughout the envelope. Of course, we now know that Boeing's statement to EASA was a falsehood known to Boeing for decades. If Boeing had answered the question correctly then, just maybe, these accidents may never have occurred.

But that would have deprived so many from the opportunity to blame fellow pilots who really didn't want to die or experienced the pain, fear and anguish trapped in those final frantic moments.

RIP guys - many of us do respect the price you paid and hope that aviation does re-learn the terrible lessons of a corrupted certification process that put the manufacturer above the regulator.

[threemiles]

Stabilizer trim was not mentioned in my MAX training at all. The labels, or functions, of the cutout switches were not mentioned or noticed.

I am re-watching all the videos, now, to make sure I didn't miss something.

Further Editing:
Aircraft Exterior: 8" longer nose strut, Bigger engines, gross weight limitations, tailskid, dual strobes on tailcone.
Flight Instruments and displays: 35 slides about the new, larger displays.
System Differences: HGS, Navigation, Anti-Ice, Air Conditioning, APU, Engines, FLIGHT CONTROLS, FBW (spoilers, speedbrakes, LAM, Ground Spoiler Control Module), fuel system, Landing Gear, Speedbrake light.

Of those the Flight Controls are the relevant section. Under Flight Controls are:
Slides of the new "Spoilers" malfunction light on the overhead panel, and the new Elevator Jam Landing Assist panel, with a light and a guarded switch.

Wrap up: Vertical Situation Display, N1 bugs, Engine Start, New Alert Lights.

That's it. NO MENTION OF ANY CHANGES TO TRIM, TRIM SWITCHES, TRIM SWITCH LABELS OR FUNCTIONS. Or MCAS.

Which means, pilots did not know about the revised trim cutout switches functionality on the MAX?

What does PRI and B/U mean? Would putting PRI to off and B/U on leave MCAS engaged?

Coming from the NG the F/O may have tried to switch off autopilot stab trim only, leaving electrical manual trim to counter MCAS?

[RatherBeFlying]

1 As I gather, on previous versions one cutoff switch blocked autopilot trim while allowing electric trim to continue working. The other switch cut off power to the trim motor from all sources. With the advent of the MAX, you now have to give up electric trim to block MCAS.

We do not yet know how effective electric trim is when the stick shaker is operating. Possibly the usual light touch on the switch may not be enough to sustain electric contact with stick shaker on. Have to wait for the report on that unless somebody finds time to research it on a sim.

2 The underfloor control column switch blocks autopilot trim, but not MCAS

Neither seems to have been disclosed.

We can talk about crew training, but the new MAX curriculum seems short on vital facts.

[737 Driver]

What is the trigger for UAS warning?

> 5 KIAS for > 5 sec. If they didn't have this at rotation, they would have had it very shortly thereafter.

Can the autopilot be engaged while UAS warn is active?

Yes, but procedurally incorrect. One of the first steps of UAS is to disconnect the A/P.

Also puzzled by 'the stick shaker active' in above, is this an expected side effect of all UAS events?

Only if one airspeed/AOA was registering low enough to trigger a stall signal from the Stall Management Yaw Damper (SMYD) computer.

[VicMel]

VicMel, thanks, :ok:
With that info and previous analysis, how might the correction routine ‘reset’, if it did, between flights?
How or why would this corruption occur on the particular accident flights apparently at random, or reoccur after the first Lion incident; conversely why were there not more instances of inaccurate AoA.
Before I address your specific points, I’ve had a re-think on some aspects:-
1) I had noticed on ET302’s FDR that the pilot, just after take-off, seemed to stop pulling the Control Column back a few seconds before the Stick Shaker started! I had suggested that perhaps it was just a latency due to ARINC 429 different data rates; however, I cannot find the same effect on the 2 Lion Air FDRs, so I now think I was wrong. Instead, I think it is plausible that the pilot realised that the nose was coming up too quickly and so backed off. When the Stick Shaker kicked in he could have thought it was due to his over-enthusiastic take-off (perhaps because of shortish runway and heavy load) and that a real stall was threatened. The idea that it was an ‘AoA Disagree’ would not occur to him, it might have taken several vital seconds later, after working to resolve a problem that did not exist, before the crew realised that something other than the pilot’s action was the problem. We know Boeing introduced MCAS because the new MAX engines, being more powerful and lower slung, together with the effect of a larger cowling, would have a larger coupling moment. So without MCAS cutting in, a significantly larger Pitch Rate than on a 737NG is fairly easy to achieve.

2) The larger Pitch Rate might be significant because the AoA Pitch Rate correction software would have had to be modified because the big new engine would have had an effect on Wing AoA. The original software in the ADIRU would have been written several decades ago and now someone who is unfamiliar with it is going to patch that software, they are told the software is not safety critical, and it is a rush job! Recipe for a huge hole in the cheese!

3) The software in the ADIRU has to deal differently with L AoA than with R AoA. There is a sign difference as a positive increase in real world AoA will result in a clockwise motion of the L AoA sensor shaft, but anticlockwise on the R one. Fairly obviously, the Sideslip correction has to be different for L & R AoA sensors.

4) Considering how long ago it was written, I suspect that the original software used fixed point calculations, in which case the original scaling for Pitch Rate may well not be sufficient to cope with the new larger value and so an overflow will occur. I doubt that the person who wrote the patch would be aware of such subtleties.

5) Overflows in software are a bit unpredictable, it all depends what action the hardware and software take when one is detected. The result could be a smallish offset, say 22 deg on AoA, with any lower level noise retained. It could be huge, say 1000 deg, in which case AoA could be any value from 0 to 360, and as a flat line. Any sudden large value could take several seconds to be smoothed out.

So, to go back to your original queries,:-
How might the routines reset? A restart of the computers would do that, just like with Windows.
How would the corruption occur on particular flights? Any flight with a high Pitch Rate could be a trigger. Or anything that has been patched for MAX could be a problem, patched software is notorious as a source of failure. Far more likely than a failure of a piece of hardware that has proved in-service to be very reliable.
Why not more instances? Good question, perhaps in the developed world we have fewer shortish runways and “high and hot conditions”, which according to Boeing, MAX is not suited to.

Vic

[737 Driver]

Once again, pitch, power, performance.

It really doesn't matter how many bells, whistles, lights, or whatnots were going off at rotation. When the proverbial $hit hits the proverbial fan - pitch, power, performance. If the PIC of a commercial airliner can't look at those three items and determine whether or not his/her aircraft is performing anywhere near expected parameters within 30 seconds of rotation, then he/she should not be in that seat. Tough words, but I'm sorry, that's why we have that ATP ticket.

Then.... Confirm.

Again, it doesn't matter what instrument, light, bell, or warning is trying to grab 100% of your attention, you need to fly your aircraft and then confirm any warning by whatever means you have at your disposal. By around 500-1000' off the ground, this crew should have been narrowing in on the nature of the problem and formulating their response - not trying to engage the automation.

Yes, Boeing screwed up the MCAS design. Yes, the crew could have worked the UAS problem correctly and still had the MCAS try to kill them later. In that case, the answer would still be the same - fly the aircraft. First, last, and always.

Every time a pilot takes to the air, someone could have screwed up something and left us with a malfunctioning aircraft. That malfunction may or may not follow some preconceived notion we have about how our aircraft or systems should respond. It is at that moment that it is critical to fall back to the basics - pitch, power, performance. Stabilize the aircraft, get to a safe altitude, and then try to identify the problem.

This crew did not do that. Period.

Why they did not do that should be a significant focus of the investigation.

[RatherBeFlying]

Close, RBF. In the NG, the left one is labeled "MAIN ELECT" and the right one is "AUTO PILOT". MAIN ELECT "deactivates stabilizer trim switch operation" and AUTO PILOT "deactivates autopilot stabilizer trim operation". A few pages later, "The STAB TRIM MAIN ELECT cutout switch and the STAB TRIM AUTOPILOT cutout switch, located on the control stand, are provided to allow the autopilot or [my emphasis] main electric trim inputs to be disconnected from the stabilizer trim motor." They are wired in parallel.
Takwxs, Appreciate the clarification.

[safetypee]

VicMel, #4055, thanks very much for the detailed clarification.
Your views appear to strengthen the software argument, and in answering my questions clarifies the possibilities for local variation. But why just before takeoff (taxying bump, elect transient/switching) / just after take off; pitch rate again?

Stretching the hypothesis a bit more - higher takeoff pitch rate, hot / high operations, takeoff config / speeds, (takeoff pitch attitude limiting ?); also we might consider differences in training or in operating previous versions of the 737. Another pitfall of same type rating, minimum training requirement, no simulation?
Would a simulator (training or design) ever reproduce this type of software error ?
Opportunities for some alternative sleuthing.

[nevillestyke]

Who has a GoPro camera mounted on the windshield, pointed at the F/O's seat?
Suspicious F/O's spouse?

[hawk76]

Another questionable statement. For almost three minutes, the speed was nearly constant, right at VMO. The autothrottles were still engaged. The trim "didn't work"...whatever that may ultimately mean. But the aircraft did not overspeed until the final MCAS input sent it into a deep dive.

Accordind to the FDR data in the preliminary report, around 05:41:20 the aircraft exceeded Vmo according to the right side (correct) airspeed. This is well before the dive or the final MCAS input.

[ams6110]

All we have is a statement from EASA noting that the electric trimmers don't work in part of the performance envelop, complete with a reply from Boeing to say it is 'feature' and that manual trim remains available throughout the envelope. Of course, we now know that Boeing's statement to EASA was a falsehood known to Boeing for decades. If Boeing had answered the question correctly then, just maybe, these accidents may never have occurred.


As previously discussed, the manual electric trim does not have the capability to trim to the "full limit" of the stab. This is claimed as a "safety benefit" to prevent unintentional mis-trimming.

MCAS, and the manual trim wheels, do have the ability to move the stab all the way to its mechanical limit. The manual electric trim can be used to move the stab in the opposite direction if it has been manually cranked (or moved by MCAS, or runaway, etc) past the aforementioned limit.

[meleagertoo]

(Not a pilot). It crossed my mind, would it not be customary in a "stick shaker" situation for the FO/PM to call out that it was one-sided and his instruments were still normal? Maybe because the FO had such low hours he would not have recognized or felt confident pointing this out? Or is it not immediately obvious?
OF COURSE IT IS! THAT'S THE WHOLE POINT!
Had they done this and followed up CORRECTLY with the blindingly obviously necessary UNRELIABLE AIRSPEED checklist this whole disaster would almost certainly not have happened.

[svhar]

Stall warning and overspeed warning. Why are they there? It is 2019. You have at least 3 ASI's. You don't need a sledgehammer or a siren to tell you when something is wrong. You can see in silence from various displays where the problem is. A master caution light that you can reset should be enough.