Ethiopian airliner down in Africa

[Loose rivets]

Takwis:

Close, RBF. In the NG, the left one is labeled "MAIN ELECT" and the right one is "AUTO PILOT". MAIN ELECT "deactivates stabilizer trim switch operation" and AUTO PILOT "deactivates autopilot stabilizer trim operation". A few pages later, "The STAB TRIM MAIN ELECT cutout switch and the STAB TRIM AUTOPILOT cutout switch, located on the control stand, are provided to allow the autopilot or [my emphasis] main electric trim inputs to be disconnected from the stabilizer trim motor." They are wired in parallel.

I know what you mean, but electrically, they are independent circuits up to the NG. If parallel, either would force an on state.

Coming from the NG, the First Officer may well have tried cuting out just the autopilot trim, but there is no way for us to confirm it, because, in the MAX, the two switches are now wired in series. If one is off, all the electric trim is off. PRI stands for PRIMARY and B/U for "Backup". Both have the notation "deactivates main electric and autopilot trim operation".

And presumably, with the main circuit, MCAS.

The Control Column switches are overridden by MCAS, but the MAX Flight Reference Manual does not mention that.

Are you sure?

[Capn Bloggs]

The overriding issue with both Lion Air and Ethiopean is why they could not manage the aircraft whereas, as it has been reported earlier in this thread (about 4,000 posts ago) that this same event happened at least five times with US carriers and they all managed to safely gain control of the aircraft and land safely.
No they didn't. The reports of dodgy Max behaviour were from the ASRS about the autopilot diving after it was were engaged.

If there had been any other MCAS events that had been handled well by Americans, Boeing would have been screaming about them from the rooftops.

[Australopithecus]

OF COURSE IT IS! THAT'S THE WHOLE POINT!
Had they done this and followed up CORRECTLY with the blindingly obviously necessary UNRELIABLE AIRSPEED checklist this whole disaster would almost certainly not have happened.

Here's a tip: get off your high horse and into the FCOM. Especially the system description of the stall warning. You’ll find this information which you would know anyway if you ever performed a 737 preflight:

“The SMYD Computers provide outputs for all stall warning to include stick shaker and signals to the pitch limit indicator and airspeed displays and the GPWS windshear detection and alert.

Two test switches are installed in the aft overhead panel. Pushing either of these initiates a self-test of the respective stall warning channel. The No1 activates the Captain stick shaker and the No.2 activates the F/O stick shaker. Either stick shaker vibrates both columns though column interconnects. “

[Winemaker]

We know Boeing introduced MCAS because the new MAX engines, being more powerful and lower slung, together with the effect of a larger cowling, would have a larger coupling moment. So without MCAS cutting in, a significantly larger Pitch Rate than on a 737NG is fairly easy to achieve.

No we don't. MCAS is designed to increase stick forces at greater AoA as the cowlings for the engines generate nose up forces at large AoA leading to reduced stick force. Further, the engines are actually mounted higher and more forward to allow ground clearance vs the NG and generate a lower thrust couple as they are actually closer to the aircraft c.g. and so generate less torque.

[George Glass]

Lots of people getting upset at experienced B737 drivers being “ judgmental” and assuming they would have done better.
Well, back to basics.
- Stick shaker on rotation. Do NOT engage the autopilot.
- Commence Airspeed Unreliable Checklist.
Yes you DO reduce thrust to 80% and maintain 10 degrees nose up.
The procedure is specifically designed to keep you flying at a safe speed and rate of climb. Just do it.
Disconnect the auto throttle as per the checklist.
-Fly the aircraft
-DO NOT maintain straight and level with autopilot and autothrottle engaged and allow aircraft to continue to accelerate to VNE while failing to ensure terrain clearance.
-Uncommanded Trim? Complete Runaway Stabilizer checklist as per training and specific Boeing recommendation in AD briefing we have all read ,and presumably understood ,as a result of previous accident.
-DO NOT allow airspeed and trim status to runaway to the extent that recovery becomes difficult or impossible.
Anything so far beyond the wit of a well trained Pilot?
Am I a Boeing troll? No, just an experienced B737 Pilot who still cant understand how you can get an aircraft so out of shape.
What do you think we get paid for?

[JLWSanDiego]

Lots of people getting upset at experienced B737 drivers being “ judgmental” and assuming they would have done better.
Well, back to basics.
- Stick shaker on rotation. Do NOT engage the autopilot.
- Commence Airspeed Unreliable Checklist.
Yes you DO reduce thrust to 80% and maintain 10 degrees nose up.
The procedure is specifically designed to keep you flying at a safe speed and rate of climb. Just do it.
Disconnect the auto throttle as per the checklist.
-Fly the aircraft
-DO NOT maintain straight and level with autopilot and autothrottle engaged and allow aircraft to continue to accelerate to VNE while failing to ensure terrain clearance.
-Uncommanded Trim? Complete Runaway Stabilizer checklist as per training and specific Boeing recommendation in AD briefing we have all read ,and presumably understood ,as a result of previous accident.
-DO NOT allow airspeed and trim status to runaway to the extent that recovery becomes difficult or impossible.
Anything so far beyond the wit of a well trained Pilot?
Am I a Boeing troll? No, just an experienced B737 Pilot who still cant understand how you can get an aircraft so out of shape.
What do you think we get paid for?
Amen👍 And well said

[Bend alot]

Lots of people getting upset at experienced B737 drivers being “ judgmental” and assuming they would have done better.
Well, back to basics.
- Stick shaker on rotation. Do NOT engage the autopilot.
- Commence Airspeed Unreliable Checklist.
Yes you DO reduce thrust to 80% and maintain 10 degrees nose up.
The procedure is specifically designed to keep you flying at a safe speed and rate of climb. Just do it.
Disconnect the auto throttle as per the checklist.
-Fly the aircraft
-DO NOT maintain straight and level with autopilot and autothrottle engaged and allow aircraft to continue to accelerate to VNE while failing to ensure terrain clearance.
-Uncommanded Trim? Complete Runaway Stabilizer checklist as per training and specific Boeing recommendation in AD briefing we have all read ,and presumably understood ,as a result of previous accident.
-DO NOT allow airspeed and trim status to runaway to the extent that recovery becomes difficult or impossible.
Anything so far beyond the wit of a well trained Pilot?
Am I a Boeing troll? No, just an experienced B737 Pilot who still cant understand how you can get an aircraft so out of shape.
What do you think we get paid for?



Give that the pilots recently have read the new AD in relation to MCAS.

The stick shaker was an item of possible occurrences of MCAS but not limited to.

The pilot reported having control issues to the tower, not an unreliable airspeed. So they may not be interested in the Unreliable Airspeed Checklist and more trying to recall the AD.

MCAS apparently does not work with AP engaged - and in the obvious confusion with clearly not enough training on the difference on type to the MAX, the attempt to get control was to put on the AP.

I do not think that there is any possible reason that can claim that this MAX, does not require far more and far better training than what was/has been given.

After the first MAX crash I expect there was a large amount of "the pilots stuffed up" and this AD is just a band aid to keep PR looking good. After the second crash, I will bet that a very large number of MAX pilots had a second and very detailed look at both the AD and MCAS - and many were concerned.

The reason that both these aircraft crashed is because MCAS moved the stabiliser (had it not - no crashes) - there was no training given about MCAS and MCAS was not even mentioned when these aircraft were delivered. That is the basic error, anything after that is a domino.

[George Glass]

The event did not start as an MCAS event. It started as an AoA failure. Maybe a birdstrike.
I am not trying to be smart after the fact. I’ve had a similar event and survived by doing what I was trained to do.
At some point the travelling public has to be reassured that not every technical failure ends up in a smoking hole.
I’ll fly a Max anytime.anywhere.
And no, I don’t work for Boeing.

[Lord Farringdon]

Lots of people getting upset at experienced B737 drivers being “ judgmental” and assuming they would have done better.
Well, back to basics.
- Stick shaker on rotation. Do NOT engage the autopilot.
- Commence Airspeed Unreliable Checklist.
Yes you DO reduce thrust to 80% and maintain 10 degrees nose up.
The procedure is specifically designed to keep you flying at a safe speed and rate of climb. Just do it.
Disconnect the auto throttle as per the checklist.
-Fly the aircraft
-DO NOT maintain straight and level with autopilot and autothrottle engaged and allow aircraft to continue to accelerate to VNE while failing to ensure terrain clearance.
-Uncommanded Trim? Complete Runaway Stabilizer checklist as per training and specific Boeing recommendation in AD briefing we have all read ,and presumably understood ,as a result of previous accident.
-DO NOT allow airspeed and trim status to runaway to the extent that recovery becomes difficult or impossible.
Anything so far beyond the wit of a well trained Pilot?
Am I a Boeing troll? No, just an experienced B737 Pilot who still cant understand how you can get an aircraft so out of shape.
What do you think we get paid for?

All good George and seems sensible and expressed by numerous other 737 drivers in this long thread. Especially the 80 percent and 10 degrees. I mean that's just physics isn't it. On a dark night (terrain allowing) you can keep the blessed thing flying while the rest is sorted out. But one thing I wonder about. Is that power and pitch based on any given percent MAC being inside the authorised Cof G envelope? I mean, if you are unknowingly heavier than MAXTOW and with a C of G outside the envelope, in a hot and high airfield with V2 calculated to occur a little closer to the end than you would normally like, is that checklist going to help you stay airborne while you establish why your airspeed has gone to crap and the stick is shaking? Not saying that was the case in this event (especially with in daylight and CAVOK) but seriously just wondering how quick you need to decide that UAS checklist may not be your first and best port of call when the stick is shaking and your decaying airspeed is actually reliable! I suppose a wing drop like Cubana de Aviación Flight 972 might be the teller but I imagine it's all a bit late by then. An agressive pitch up immediatley after take off might also be a clue. Serious question, not trying to be smart a*** . (Ex Mil Loadmaster C130/B727).

[DaveReidUK]

I mean, if you are unknowingly heavier than MAXTOW and with a C of G outside the envelope

Neither of those was the case for ET302, according to the Preliminary Report.

[yanrair]

Stall warning and overspeed warning. Why are they there? It is 2019. You have at least 3 ASI's. You don't need a sledgehammer or a siren to tell you when something is wrong. You can see in silence from various displays where the problem is. A master caution light that you can reset should be enough.
Hi Svhar -the warnings are there for the very reason that if they go off, you clearly are a bad pilot who has not been minding the basics. To stall for example you have to ignore 6 separate aural, visual and sensory clues/warnings prior to actual stick shake. So it’s the system saying “ which part of ‘you are stalling and about to die’ , don’t you understand “”
So you are right- they shouldn’t be needed, but they are.

[yanrair]

double-oscar, #4005,

‘… they had a stall warning on lift-off. There is guidance for this in the QRH and the Flight Crew Training Manual which wasn’t followed.‘
In addition to stall warning, the crews also had higher stick force (feel shift), airspeed and altitude disagree alerts, ambiguous speed indications; surprise.
These indications were all in the post Lion Air AD.

[yanrair]

Thank you for providing the proof that pilots were not provided with a way of knowing they have an AoA disagree. Unless they happened to work for American Airines who had the optional extra. And yeh the pilots used electric trim up and then hit the cutout switches. There is a question that may be around the additional problem Boeing is investigating about why they didn't trim up further with the electric trim. It's a question because it happens at the start and the end, and there's no logical reason for the pilots to do that, which suggests there may have been an additional system problem. We shall see.
Isnt a single stick shake indication that you have AOA disagree? Esp if One ASI and SBY ASI are reading what you would expect ? And pitch power are correct. 15 NU and 90%N1? Ground speed around 150 kts ( you need to be below 100 go get stick shake) ?

[yanrair]

When the Stick Shaker kicked in he could have thought it was due to his over-enthusiastic take-off (perhaps because of shortish runway and heavy load)

Sorry but what is an enthusiastic takeoff ? There is only one correct technique irrespective of all the myriad factors at play. The aircraft is loaded up to the max permitted weight for the r/w length, temperature, altitude etc and no more. Takeoff is then normal and the same margin as at sea level.

[yanrair]

The reason that both these aircraft crashed is because MCAS moved the stabiliser (had it not - no crashes) - there was no training given about MCAS and MCAS was not even mentioned when these aircraft were delivered. That is the basic error, anything after that is a domino.[/QUOTE]

Nobody denies I think that MCAS needs a redesign. That’s how we make aviation safer. Eliminate all causes of future events. The. MCAS is one. It is being done. It will be certified .Now to the much bigger potential problem. What if the are pilots- and I’m ignoring these two crashes- who can’t handle things when it’s not a simple failure but a compound failure. ? Thousands , maybe of a generation of pilots who only know what they can read in a manual or have been taught? Compare with good surgeon. I wouldn’t want one going near me who wasn’t able to handle complications beyond what he normally sees. Who has in depth knowledge of his complex world as a result of constantly keeping ahead of the curve. Not barely able to manage the basics, never mind the unexpected.

[oggers]

We do not yet know how effective electric trim is when the stick shaker is operating. Possibly the usual light touch on the switch may not be enough to sustain electric contact with stick shaker on. Have to wait for the report on that unless somebody finds time to research it on a sim..

The ET302 preliminary report shows the electric trim working normally with the stick shaker activated.

[deltafox44]

The ET302 preliminary report shows the electric trim working normally with the stick shaker activated.It shows it has been working on several instances. It does NOT show whether it has failed on other instances, due to stick shaker or anything else, which could explain why they did not use it to trim back to normal...

[oggers]

It shows it has been working on several instances. It does NOT show whether it has failed on other instances, due to stick shaker or anything else, which could explain why they did not use it to trim back to normal...

It is a possibility. However on the last occasion before selecting cutout the trim switch was operating for 10 seconds continuously whilst the stick shaker was activated so I don't think it likely that the stick shaker can actually break the contact. We also have the Lion Air data and it doesn't speak to me of an issue with the stick shaker interfering with the operation of the electric trim switch.

[rog747]

As the starter of this evocative thread of the first early morning report of a 737 accident in Africa, I have of course followed it all closely - The shock that morning that it was a 2nd new 737 MAX that actually had crashed in astonishingly similar circumstances to Lion Air has rocked the aviation world, and the public.

I do think most of you now need to go have have a nice cup pf tea and try to stop pontificating on weird and wonderful graphs, text and charts, (I do not of course mean the revealed readouts we know of so far) and to really now stop putting blame on the crews that simply were trying to save their aircraft due to unknown phenomena seemingly trying to kill them, which has seen 2 brand new jets of a design from the early 1960's dive into the ground at high speed minutes from take off.

This is unprecedented in our industry in many years - Last seen when the DC-10 was in service 40 years ago - Also long before social and digital media, and the likes of Pprune and YouTube and the freedoms of getting information quickly.

Many of the posts on here have shown much sense and empathy even at such an early stage in the investigations, and of course many pilots and crews are worried, however, we have descended somewhat that some here will brush it off as if the crews should have done this, and done that, or ''I could have saved the plane''...

No one knows as yet as to why these 2 new jets dived into the ground and lost over 300 lives.

The 3 Comet 1 structural failure crashes claimed 99 lives - those investigations were undertaken at a time when FDR or CVR data was not available -
How we have evolved from 65 years ago.

Can we calm down a wee bit over the MAX theories - except we do know that MCAS was implicated and functioned each time -

As I see it 2 have been lost (another 1 was an almost lost) and in all 3 the flight crews were faced with, and then all were startled with rapidly unfolding, and unknown dilemmas as to why their aircraft was trying to kill them just after lift off trying in vain to save it.

At this stage none of us know for sure why.

edited 11.43

[A0283]

I previously posted this on the related software thread - it might provide some additional context to the discussions that are going on here:

I stumbled upon an interesting case study on the use of memory items and (subsequent) checklists using 15 volunteer current 737 line pilots that were present at a crew base of a major US airline. Half captains, half FO’s. Half of all pilots had (varied) military experience. Pilots reported being trained in both 737 Classic and 737 NG. The 737 Classic flight deck was used.

I summarize ...

Each scenario began by describing a normal flight situation, and then interjecting cues that suggest a particular failure. Subjects were asked to react to the cues as they would inflight, performing any procedures they felt were necessary. The participants were provided with their airline QRH, and were allowed to select the checklist they felt was most appropriate for the situation.

Five non-alerted abnormal procedures that contain memory items were used.
1. aborted engine start ----- correct checklist by 10 of 15, ..
2. engine limit/surge/stall - correct checklist by 2 of 15, ..
3. rapid depressurization -- correct checklist by 14 of 15, two pilots added memory item steps,
4. runaway stabilizer trim - correct checklist by 14 of 15, four pilots added memory item steps,
5. dual engine failure ------ correct checklist by [12] of 15, this scenario had most errors in memory item steps of all 5 scenarios, multiple item steps were added by pilots.

The pilots in this study demonstrated a tendency to fixate on the most prominent cue, and perform the checklist appropriate to that cue. However, a thorough analysis of the situation can reveal that the single most prominent cue does not always lead the pilot to the correct checklist. There were 23 checklist selection errors. With three exceptions, the errors appear to be caused by the pilots’ fixation on a single cue.

There appear to be consistent patterns in the observed checklist step errors. Many of the ‘adding item steps’ errors appear to result from the pilots’ creativity (read: (experience based) troubleshooting) in dealing with an abnormal situation. It was observed that many pilots perform steps in addition to what was required based on their understanding of how the airplane systems functioned, even though their understanding of the systems may be incorrect.

... End of summary.

You might think on reading the study that: A single study aimed at being as realistic and objective as possible does not present a ‘truth’. But, that not everybody is perfect, might be a reasonable conclusion.

[Bend alot]

I previously posted this on the related software thread - it might provide some additional context to the discussions that are going on here:

Did Sully not turn on the APU early to save the day?

[spornrad]

... it doesn't speak to me of an issue with the stick shaker interfering with the operation of the electric trim switch.
If you look closely at the FDR traces, the Lionair captain who faithfully trimmed back up umpteen times did loose the trim switch ever now and then. There are off-blips in almost every long nose-up trim command. Therefore, I do believe, that the ergonomics of the yoke with shaker and high feel forces can make it difficult to actuate the thumb switch continuously. Maybe they had to cradle the column for prolonged high force, hands not in standard position.
Try thumb typing on your phone after you attached a 50 pound brick, while a friend is rattling it...

[gmx]

As the starter of this evocative thread of the first early morning report of a 737 accident in Africa, I have of course followed it all closely - The shock that morning that it was a 2nd new 737 MAX that actually had crashed in astonishingly similar circumstances to Lion Air has rocked the aviation world, and the public.

I do think most of you now need to go have have a nice cup pf tea and try to stop pontificating on weird and wonderful graphs, text and charts, (I do not of course mean the revealed readouts we know of so far) and to really now stop putting blame on the crews that simply were trying to save their aircraft due to unknown phenomena seemingly trying to kill them, which has seen 2 brand new jets of a design from the early 1960's dive into the ground at high speed minutes from take off.

This is unprecedented in our industry in many years - Last seen when the DC-10 was in service 40 years ago - Also long before social and digital media, and the likes of Pprune and YouTube and the freedoms of getting information quickly.

Many of the posts on here have shown much sense and empathy even at such an early stage in the investigations, and of course many pilots and crews are worried, however, we have descended somewhat that some here will brush it off as if the crews should have done this, and done that, or ''I could have saved the plane''...

No one knows as yet as to why these 2 new jets dived into the ground and lost over 300 lives.

The 3 Comet 1 structural failure crashes claimed 99 lives - those investigations were undertaken at a time when FDR or CVR data was not available -
How we have evolved from 65 years ago.

Can we calm down a wee bit over the MAX theories - except we do know that MCAS was implicated and functioned each time -

As I see it 2 have been lost (another 1 was an almost lost) and in all 3 the flight crews were faced with, and then all were startled with rapidly unfolding, and unknown dilemmas as to why their aircraft was trying to kill them just after lift off trying in vain to save it.

At this stage none of us know for sure why.

edited 11.43

Generally sensible post, however, it is absolutely reasonable to ask whether pilot skill / training was a factor.

The LionAir pre accident crew defused the situation with the help of a jump seat pilot. Once they had the aircraft under control, they re-enabled electric trim only to discover it attempting to nose the plane down again, before disabling it again and flying manually to destination.

That crew defeated AoA-failure-induced MCAS twice, not once.

One lesson which the industry has to learn from this is that all flight crews must know how to restore orderly flight and disable all automation in the case of misbehaving flight control systems. If that's not possible, the cockpit is no longer a place for human beings.

[A0283]

Adding to my post https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-205.html#post10447934

If we assume that pilots make such errors (as described in that study) regularly, then we might say that,

considering the overall high level of safety of commercial aerospace,

- we might conclude that the system is 'robust' enough to deal with such pilot errors,
- that airplanes might be so 'solid' that few situations arise that require the use of such checklists,

and,

that the question in these two cases would not be if errors were made (if they turn out to be real human errors or airplane induced errors), but why these errors may or may not have contributed to the chain of events that created two all fatal accidents,

The essence of aerospace accident investigation is not the apportioning of blame. We still have to go through the process of further fact finding, analysis, concluding, recommending. Now is not the time for blame ... yet ... I guess that those who want to should still be patient.

[Loose rivets]

A0283's post

I'm not so much worried by the poor checklist selection as I am about so much time footling around looking up sets of rules while still in the 'Aviate' phase of an emergency.

I know PNF's task, but is it not a time even they should be soaking up technical details - facts about just what is going on and applying immediate assistance when possible? I'm dreaming, aren't I? It just doesn't seem to happen anymore, except I get the feeling the older crews still demand to know just how things work while the newer generation seem more content with 'just fly the thing'. Does that go with the 'magenta line' kids, or is it only some people have a natural need to know every nut, bolt and washer?

[CaptainMongo]

“The boat equipment was in accordance with the Board of Trade requirements.” The Board of Trade was the regulator of British registered ocean going vessels. Board of trade regulations did not require enough life boats to carry all passengers off a vessel in distress. Thus the Titanic only had enough life boat capacity for ½ of the passengers she carried, in complete compliance with the then current regulations. The Titanic went down 107 years ago today.

The Max was certified for flight by aviation regulators world wide. These same regulators decreed no additional simulator training was required, (and if they did what would they have trained in that additional sim? Certainly not Left AOA vane failure at low altitude...). While I will point a big finger at the FAA’s head, I will also ask where were the other world wide regulators? Did they simply outsource their job to the FAA? And how much pressure was placed on Boeing by 737 operators world wide to minimize training costs associated with introducing the Max? Some of these operators have a very long history of operation of the 737 series. Did that experience cloud their judgement? Did other operators world wide without that historical knowledge simply accept what Boeing offered as adequate - training by bulletin?

And what about airline training departments? What is the quality of classroom and simulator training? What is the quality of the classroom and simulator instructors, Standards Captains, and Check Airmen? Lastly we need to take a hard, honest look at ourselves. We need to look in the mirror and see the pilot we are, not the pilot we think we are.

Sure I’ll throw bricks at Boeing and the FAA, but any honest assessment wouldn’t stop there.

[oggers]

Therefore, I do believe, that the ergonomics of the yoke with shaker and high feel forces can make it difficult to actuate the thumb switch continuously. Maybe they had to cradle the column for prolonged high force, hands not in standard position.


I think we can agree that it is easier to hold the trim switch with the stick shaker off. Nonetheless, the data shows clearly that the thumb switch can be held closed with the stick shaker on.

If you look closely at the FDR traces, the Lionair captain who faithfully trimmed back up umpteen times did loose the trim switch ever now and then. There are off-blips in almost every long nose-up trim command.

But the Lion Air data also shows "off-blips" during automatic trim every now and then, so based on that you can't attribute it to the thumb switch. Also, none of these "off-blips", as you call them, appear on the ET302 data which suggests they have more to do with how the two different investigations have processed the data into the graphics we see..

Try thumb typing on your phone after you attached a 50 pound brick, while a friend is rattling it...

Because you really really believe that holding down the trim switch is like typing on a phone :confused:

[aterpster]

If that's not possible, the cockpit is no longer a place for human beings.
Nor is the cabin.

[ams6110]

This is unprecedented in our industry in many years - Last seen when the DC-10 was in service 40 years ago - Also long before social and digital media, and the likes of Pprune and YouTube and the freedoms of getting information quickly.

I remember the DC-10, though I was a child at the time. There are some similarities and some differences. The cargo door design was closest to the MCAS situation today. A poorly engineered design was certified; after the first accident, the problem was discovered, but there was no grounding order, and no AD issued, due to a close relationship between the heads of the FAA and MD. Following the second nearly identical disaster, there was a congressional investigation into the FAA's certification of the design, and an AD was issued mandating changes.

The other big issue with the DC-10 was the improvised maintenance procedures at AA that were the cause of the AA 191 disaster, though that accident did also reveal some design flaws, as did the UAL 232 accident ten years later.

In none of the major DC-10 crashes and incidents could the pilots have employed some simple recognition and standard procedures to save the aircraft. Yet despite significant physical damage and loss of flight controls, in the case of AA 96 the pilots were able to return and land using the limited working control surfaces that they still had. And the pilots were able to bring UAL 232 back to the runway using only engine thrust of the two wing engines after the uncontained failure of the tail engine caused total loss of hydraulic pressure. I consider both of those incidents to be beyond Sully-level performances by the pilots, yet nobody could have realistically blamed them if they had failed. Had PPRuNE existed at that time, I don't think anyone would be here posting "Why didn't they just perform the memory items for the cargo door blowing out and collapse of the cabin floor onto the control cables." And yet in those two cases the crews were able to maintain awareness, figure out what still worked and what didn't, and fly the aircraft with what they had.

As a (now grown adult) passenger, I don't have a loss of confidence in the MAX. They are not blowing out doors, or shedding engines. They are 100% physically intact and completely flyable, even with the flawed MCAS system, which is now understood, and will be fixed. I don't blame the pilots so much as I recognize the difference that in theory it seems that it should have been possible to run a few simple memory procedures, flip a few switches, and fly back and land. I don't see exceptional piloting skill being required there, in contrast to what some of the DC-10 crews were facing.

Whether the public at large will see it that way, especially given today's outrage-oriented media, remains to be seen.

[neville_nobody]

One lesson which the industry has to learn from this is that all flight crews must know how to restore orderly flight and disable all automation in the case of misbehaving flight control systems. If that's not possible, the cockpit is no longer a place for human beings.

The other lesson would be why on earth are pilots having to do this in the first place? Why are manufacturers building 1960 era aircraft?? Why did Boeing hide knowledge of the MCAS? Nothing else in the world would be built to a 50 year old design yet somehow in aviation it is acceptable.

[patplan]

Generally sensible post, however, it is absolutely reasonable to ask whether pilot skill / training was a factor.

The LionAir pre accident crew defused the situation with the help of a jump seat pilot. Once they had the aircraft under control, they re-enabled electric trim only to discover it attempting to nose the plane down again, before disabling it again and flying manually to destination.

That crew defeated AoA-failure-induced MCAS twice, not once.
...snipped...

That one in bold and underlined meant:
1. The crews got lucky they found temporary solution to their "STS running the opposite way" problem.
2. Then they realized they needed an electric motor to trim after all. So, they turned it back on.
3. When the "STS running the wrong way trouble" showed up again, they killed off the electric motor for good.

The crew DIDN'T actually perform the so-called "Runaway Trim NNC", otherwise they'd written about that on their log and/or the ASHOR. They didn't even mention about the stick shaker incident which had consumed their entire flight until they'd landed safely at destination.

As written on the preliminary accident report:Page 22 KNKT Preliminary Report
https://i.ibb.co/St1J4gK/prel-pp22.jpg (https://imgbb.com/)

AFML
https://i.ibb.co/4tTXH8j/exb4-2.jpg (https://ibb.co/mTq239H)To the MX, they'd written: "IAS (Indicated Air Speed) and ALT (altitude) Disagree and FEEL DIFF PRESS (Feel Differential Pressure) light problem" on the Aircraft Flight Maintenance (AFML).
Page 9 KNKT Preliminary Report

https://i.ibb.co/Z1FFG9R/pp9-knkt.jpg (https://ibb.co/fGyyqJV)The mystery is the pilot claimed they'd performed the "Runaway Trim NNC" to the Indonesian crash investigator when infact they'd just killed the motor directly without even following any known procedure. As explained here...
Page 20 "Preliminary Aircraft Accident Investigation Report" KNKT
https://i.ibb.co/g9f01yx/pagexyx.jpg (https://ibb.co/7CZ3cvq)

When they declared that they performed three NNC's, including the Runaway Stabilizer one, to the investigator, they had just exaggerated some of their actions and/or had obscured certain details after the fact. Indeed, they conveniently omitted a very important fact: a dead head sitting on jumper seat had been the one suggesting to kill the trim motor during the cockpit's highly tense full-of-warning-and-alarm episode. We now know about this "dead head hero" because there was a leak from the media.

The Indonesian accident investigators need to get to the bottom of these discrepancies, among other things, before reaching their final conclusion within the next 3-4 months.

[YYZjim]

As a life-long apostle of Boeing (I am just a private pilot), I feel betrayed by this MCAS fiasco. They abandoned their bedrock principle that pilots can take over complete control if and when they want it.

My suspicion that Boeing is going to get off the hook frustrates me even more.

But, history shows that Boeing will survive this. Remember 737 rudder hardovers?

1. March 1991, United585 in Colorado Springs. It rolled to the right on approach and crashed. What shocked everybody was that the NTSB could not figure out the cause. Their final report (December 1992) guessed that it might be: (i) loss of directional control, or (ii) turbulence.
2. September 1994, USAir427 in Pittsburg. It rolled to the left on approach and crashed. While the second investigation was still underway, there was a third incident. In June 1996, Eastwind517 experienced two episodes of rudder reversal while on approach to Trenton, New Jersey. With the help of a live pilot and a malfunctioning aircraft still in one piece, the NTSB had some clues. Their final
report (March 1999) implicated the PCU servo.

It's long since forgotten now (that's the point of my post), but the 737 was thought to be dangerous. Even the travelling public knew that it could without warning fly you into the ground.

The MCAS crashes will be easier for the public to digest. There is no unknown to fear. Boeing made a big mistake, but at least they knew what they were doing.
Pilots who were more experienced, or faster with their NNCs, or better trained to carry through the action items on the checklists, might have saved the day.
As soon as the public hears that Boeing has fixed their mistake and believes that all pilots know how to handle the fix, the re-branded MAX will be airborned once again.

But, I still feel B-trayed. Growing within me is a little more willingness to look at A's design philosophy.

[PJ2]

. . .
The Max was certified for flight by aviation regulators world wide. These same regulators decreed no additional simulator training was required, (and if they did what would they have trained in that additional sim? Certainly not Left AOA vane failure at low altitude...). While I will point a big finger at the FAA’s head, I will also ask where were the other world wide regulators? . . . Long-time operators of the B737, the Brazillians examined the type and created 3 types for the B737 in their 2018 ANAC Report.

First, the FAA FSB Report, then the Brazillian Report:

From the FAA FSB Report 2018 (http://fsims.faa.gov/PICDetail.aspx?docId=FSB%20B-737%20Rev%2016)

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/477x450/2019_04_15_070805_faa_fsb_typerating_b737_m_b83d1db7822b34d9 0140689dead3276df200723f.jpg

--------------------------------

From the ANAC, Agência Nacional de Aviação Civil
GRUPO DE AVALIAÇÃO DE AERONAVES – GAA
BRAZILIAN AIRCRAFT EVALUATION GROUP

Operational Evaluation Report - B737 (http://www.anac.gov.br/assuntos/setor-regulado/profissionais-da-aviacao-civil/avaliacao-operacional-1/Boeing_737_OE_Report_Revoriginal.pdf)

From the ANAC Report, pg. 8 - 9:The Boeing 737 series have been in service for many years in Brazil, even before the ANAC Aircraft Evaluation Group (GAA) was established. For that reason, this is the first Operational Evaluation conducted by ANAC on the B-737, specifically the B-737-8MAX. An operational evaluation was conducted by ANAC Aircraft Evaluation Group (GAA) in Miami, FL, USA, during October 2017, where the proposed differences training for the B-737-8MAX was evaluated, considering the B-737-800 as the base aircraft. The evaluation was conducted using the methods described in ANAC IAC 121-1009.

The results presented here for the previous B-737 models (737-200, 737-300, 737-400, 737-500, 737-600, 737-700 and 737-800) are based on the Boeing 737 FAA FSB Report revision 14.

1.2. Objective

The objective of this report is to present the results from the operational evaluation of the B-737 series aircraft.
The content of this report is applicable to operations under the framework of ANAC.

1.3. Purpose
The purpose of this report is to:

Determine the Pilot Type Rating assigned for the B-737 series;
Recommend the requirements for training, checking and currency applicable to flight crew for the B-737 series, and functionalities; and
Present the compliance of the B-737 series with the requirements of the RBHA 91 and RBAC 121.

1.4. Applicability

This report is applicable to:

Brazilian operators of the B-737 series under RBHA 91 and RBAC 121 requirements;
Approved Training Organizations certified under RBAC 142 (Training Centers);
Civil Aviation Inspectors related to safety oversight of the B-737 series;
ANAC Principal Operations Inspectors (POIs) of the B-737 series operators.

2.PILOT TYPE RATING The GAA stablished [sic] 3 (three) different type ratings for the B-737 series aircraft and recommends the update of publication “Instrução Suplementar – IS 61-004” (ANAC type rating list) with the following information:

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/598x193/2019_04_15_070913_brazillianfsb_typerating_b737_m_56b806b4a7 eaf93bf4a319ce1f2f044cb9900144.jpg

[jimtx]

Long-time operators of the B737, the Brazillians examined the type and created 3 types for the B737 in their 2018 ANAC Report.

First, the FAA FSB Report, then the Brazillian Report:

From the FAA FSB Report 2018 (http://fsims.faa.gov/PICDetail.aspx?docId=FSB%20B-737%20Rev%2016)

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/477x450/2019_04_15_070805_faa_fsb_typerating_b737_m_b83d1db7822b34d9 0140689dead3276df200723f.jpg

--------------------------------

From the ANAC, Agência Nacional de Aviação Civil
GRUPO DE AVALIAÇÃO DE AERONAVES – GAA
BRAZILIAN AIRCRAFT EVALUATION GROUP

Operational Evaluation Report - B737 (http://www.anac.gov.br/assuntos/setor-regulado/profissionais-da-aviacao-civil/avaliacao-operacional-1/Boeing_737_OE_Report_Revoriginal.pdf)

From the ANAC Report, pg. 8 - 9:The Boeing 737 series have been in service for many years in Brazil, even before the ANAC Aircraft Evaluation Group (GAA) was established. For that reason, this is the first Operational Evaluation conducted by ANAC on the B-737, specifically the B-737-8MAX. An operational evaluation was conducted by ANAC Aircraft Evaluation Group (GAA) in Miami, FL, USA, during October 2017, where the proposed differences training for the B-737-8MAX was evaluated, considering the B-737-800 as the base aircraft. The evaluation was conducted using the methods described in ANAC IAC 121-1009.

The results presented here for the previous B-737 models (737-200, 737-300, 737-400, 737-500, 737-600, 737-700 and 737-800) are based on the Boeing 737 FAA FSB Report revision 14.

1.2. Objective

The objective of this report is to present the results from the operational evaluation of the B-737 series aircraft.
The content of this report is applicable to operations under the framework of ANAC.

1.3. Purpose
The purpose of this report is to:

Determine the Pilot Type Rating assigned for the B-737 series;
Recommend the requirements for training, checking and currency applicable to flight crew for the B-737 series, and functionalities; and
Present the compliance of the B-737 series with the requirements of the RBHA 91 and RBAC 121.

1.4. Applicability

This report is applicable to:

Brazilian operators of the B-737 series under RBHA 91 and RBAC 121 requirements;
Approved Training Organizations certified under RBAC 142 (Training Centers);
Civil Aviation Inspectors related to safety oversight of the B-737 series;
ANAC Principal Operations Inspectors (POIs) of the B-737 series operators.

2.PILOT TYPE RATING The GAA stablished [sic] 3 (three) different type ratings for the B-737 series aircraft and recommends the update of publication “Instrução Suplementar – IS 61-004” (ANAC type rating list) with the following information:

https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/598x193/2019_04_15_070913_brazillianfsb_typerating_b737_m_56b806b4a7 eaf93bf4a319ce1f2f044cb9900144.jpg

And in that Brazilian OER you will see that they identified MCAS as a category B training item. The question is what training the operators in Brazil implemented. GOL grounded their fleet after the Ethiopian crash even though they would have had training on MCAS.*

[dufc]

Published on Monday, April 15, 2019Boeing completes nearly 100 test flights with new 737 Max software fixBoeing says flight crews have already completed 96 flights without incident on 737Max jets with a new software update.
It has flown more than 159 hours in total.
No issues have been identified but Boeing will continue to operate test flights for several more weeks before applying for new approval from the FAA.
Southwest Airlines isn't too confident the Max will get the green light any time soon.
The airline will now keep the planes off its schedules until at least August 5.
That will result in about 160 flight cancellations a day during the busy summer season.
America Airlines said it will also ground its Max jets until August 19 at the earliest.
Meanwhile, Sen. Edward Markey and other lawmakers have introduced a bill that would require aircraft makers to provide all safety equipment as standard at no extra charge.
The Air Line Pilots Association has backed the bill proposal.
The planes involved in crashes in Indonesia and Ethiopia did not have the optional tools that may have been able to alert pilots to malfunctioning sensors which are thought to have played a role in the accidents.
https://www.travelmole.com/news_feature.php?c=setreg&region=3&m_id=s~Y!s~bs~b&w_id=36025&news_id=2037018

[armchairpilot94116]

Generally sensible post, however, it is absolutely reasonable to ask whether pilot skill / training was a factor.

The LionAir pre accident crew defused the situation with the help of a jump seat pilot. Once they had the aircraft under control, they re-enabled electric trim only to discover it attempting to nose the plane down again, before disabling it again and flying manually to destination.

That crew defeated AoA-failure-induced MCAS twice, not once.

One lesson which the industry has to learn from this is that all flight crews must know how to restore orderly flight and disable all automation in the case of misbehaving flight control systems. If that's not possible, the cockpit is no longer a place for human beings.

I , for one, don't want to fly in a plane flown by HAL. Someone previously said something about a big switch that turns Everything Automatic OFF and leaves the pilots in charge. This could work well provided pilots are well trained and have not been worked to fatigue and have plenty of hand flying experience that is kept up to date and all the systems of the aircraft still work at the pilots command. Trying to trim by hand being shown to be not effective (to put it lightly) as an example.

We have unmanned drones that are commanded from the ground. I don't want to fly in a unmanned drone flown by someone on the ground either. So let's get pilots working with all the tools available with a big ALL AUTOMATICS OFF switch but all flight controls , gauges, etc all working. Let's keep the pilots well practiced and well trained.

Better than HAL. At least until we fly regularly into SPACE because manual flight won't really be possible. When we do NYC to TOKYO in 90 mins by flying into space, pilots may still be in the cockpit but they probably will be pushing buttons . Me thinks.

[PJ2]

. . . The question is what training the operators in Brazil implemented. . . .
Precisely. Did they follow their own advice...?

[GordonR_Cape]

Useful video on the MCAS software updates from pilot Juan Browne:

https://www.youtube.com/watch?v=zGM0V7zEKEQ

[Organfreak]

Useful and informative, although we've heard most of this already. It was important that he emphasized keeping in practice with hand-flying, even for very experienced pilots, but in briefly mentioning why hand-flying isn't practiced more, he completely blew off what I thought was a major factor in that: airlines don't WANT you to hand-fly, one of the main reasons being, supposedly, better gas mileage. Is it time for regulators to mandate a certain amount of hand-flying by pilots so that they won't get fired for doing it? (Given the pilot shortage, it seems unlikely that ppl should lose their jobs for it.)

[slacktide]

Stabilizer trim was not mentioned in my MAX training at all. The labels, or functions, of the cutout switches were not mentioned or noticed.

That's very interesting. WAAAAY back right after Lion Air first happened we were discussing the switch nomenclature change, and user TriStar_drvr posted this picture of his MAX computer-based training... so it was covered in at least some airline's training, in a very superficial manner.

https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-68.html#post10313316


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/2000x1377/b6b3ef0c_5355_4186_a50f_d9acb9d4d9ad_bb0b8e86c2f13b5ef7c18a3 74eafb7916d9ea319_jpeg_34cbdc17779eb0b6d7c3243be0d61ea7b16f7 96e.jpg

[GordonR_Cape]

That's very interesting. WAAAAY back right after Lion Air first happened we were discussing the switch nomenclature change, and user TriStar_drvr posted this picture of his MAX computer-based training... so it was covered in at least some airline's training, in a very superficial manner.

https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-68.html#post10313316

Interesting, but inconclusive. My first reaction is that like many words in English "both" is ambiguous, it can mean "together" (noun) or "either" (adverb), which have very different connotations. The placard does not state that the function of the switches has changed, it is only implied if you already understand the consequences of the MCAS trim changes. I may be being obtuse, but a competent lawyer will see right though that...

[Sucram]

The other lesson would be why on earth are pilots having to do this in the first place? Why are manufacturers building 1960 era aircraft?? Why did Boeing hide knowledge of the MCAS? Nothing else in the world would be built to a 50 year old design yet somehow in aviation it is acceptable.
The 737 is still an old generation aircraft, with lots of old generation failings.
Most of the development on it has been to increase its profitability not it's safety........ It does make a lot of money for operators and Boeing though. So far.

[MurphyWasRight]

Interesting, but inconclusive. My first reaction is that like many words in English "both" is ambiguous, it can mean "together" (noun) or "either" (adverb), which have very different connotations. The placard does not state that the function of the switches has changed, it is only implied if you already understand the consequences of the MCAS trim changes. I may be being obtuse, but a competent lawyer will see right though that...

Given the grammar ambiguity the title of the bullet/callout "nomenclature has changed" adds to the possibility to interpret it either way, much clearer would be "function has changed".
Another try to minimize difference ?

Accurate description is "EITHER switch will deactivate both"

[Sucram]

But, history shows that Boeing will survive this. Remember 737 rudder hardovers?

1. March 1991, United585 in Colorado Springs. It rolled to the right on approach and crashed. What shocked everybody was that the NTSB could not figure out the cause. Their final report (December 1992) guessed that it might be: (i) loss of directional control, or (ii) turbulence.
2. September 1994, USAir427 in Pittsburg. It rolled to the left on approach and crashed. While the second investigation was still underway, there was a third incident. In June 1996, Eastwind517 experienced two episodes of rudder reversal while on approach to Trenton, New Jersey. With the help of a live pilot and a malfunctioning aircraft still in one piece, the NTSB had some clues. Their final
report (March 1999) implicated the PCU servo.
.

I do remember this, we used to practice recoveries in the SIM, not at all easy. You had to maintain extra speed on the approach so the ailerons would have enough authority over the full rudder. As far as I remember the 737 wasn't grounded then but it was a long time ago.

[ams6110]

Interesting, but inconclusive. My first reaction is that like many words in English "both" is ambiguous, it can mean "together" (noun) or "either" (adverb), which have very different connotations. The placard does not state that the function of the switches has changed, it is only implied if you already understand the consequences of the MCAS trim changes. I may be being obtuse, but a competent lawyer will see right though that...

Just curious, how many would read that slide, take perfunctory note of the change, and move on, and how many would stop short, and start asking "What? What does this change mean? Is this just a labeling change? Can I still cut out the auto trim separately from the manual electric trim? What has changed about the trim operation? Where can I find out more?" and what would be the result of such inquiries made to the company training department/chief pilot?

[MurphyWasRight]

Just curious, how many would read that slide, take perfunctory note of the change, and move on, and how many would stop short, and start asking "What? What does this change mean? Is this just a labeling change? Can I still cut out the auto trim separately from the manual electric trim? What has changed about the trim operation? Where can I find out more?" and what would be the result of such inquiries made to the company training department/chief pilot?
Given the "nomenclature changed" label and awkward text I would guess that at least some who might have gone "huh" would decide it had to a be label change only since it would be hard to believe that critical core functionality had changed, at least without a strong warning.

[yanrair]

I do remember this, we used to practice recoveries in the SIM, not at all easy. You had to maintain extra speed on the approach so the ailerons would have enough authority over the full rudder. As far as I remember the 737 wasn't grounded then but it was a long time ago.That is spot on Sucram. 220 kts permitted safe flight with aileron countering full rudder. If below 220 a quick acceleration to 220 did the trick.
Y

[737 Driver]

Just curious, how many would read that slide, take perfunctory note of the change, and move on, and how many would stop short, and start asking "What? What does this change mean? Is this just a labeling change? Can I still cut out the auto trim separately from the manual electric trim? What has changed about the trim operation? Where can I find out more?" and what would be the result of such inquiries made to the company training department/chief pilot?

I posted this yesterday morning, but I think it got buried awaiting moderator approval (hopefully I'll be off probation soon :O )

Procedurally, it does not matter what the switches do or how they are labeled. You could call the switches "Hank" and "Frank", and it does not matter. From Boeing's perspective, you don't have to know what these switches are connected to. Whether the NG or the MAX, you always cutoff BOTH switches when called for in the NNC.

It wasn't always so on the NG. A while back, the 737NG stab runaway procedure was changed so that BOTH cutout switches are always selected together, and we no longer try to isolate the offending circuit. I was kind of curious why the change, but I was simply told that Boeing thought this was a better to handle runaway trim. The conspiracy theorist in me now says that Boeing did this because they were looking down the road at the MAX certification and were looking for any opportunity to harmonize procedures.

[Icarus2001]

I for one, don't want to fly in a plane flown by HAL. Are you a pilot?

Have you ever flown in a modern Airbus?

You do realise that if HAL had been flying (AP in) then the MCAS would not have activated?

[Smythe]

Boeing’s 767-based tankers use a version of the pitch augmentation system that grounded the 737 Max 8 fleet, the manufacturer and U.S. Air Force officials say.
The disclosure provides a new data point in the unfolding story of how Boeing installed the Maneuvering Characteristics Augmentation System (MCAS) on narrowbody airliner fleet.
Both the KC-767 and KC-46 fleets delivered to air forces in Italy, Japan and the U.S. rely on the MCAS to adjust for pitch trim changes during refueling operations.
In the 1980s, Boeing’s engineers considered using a pitch augmentation system for the commercial version of the 767, but dropped the idea after finding that vortex generators provided adequate control.
Boeing designed the integration on the KC-767 and KC-46 slightly differently than on the 737 Max family.
The single-aisle airliner uses one angle of attack vane — either the captain’s or first officer’s — to generate the data used by the flight computer to activate the MCAS.
By comparison, the KC-767 and KC-46 are designed to use two sensor inputs to feed angle of attack data, Boeing says.
Boeing spokesmen declined to elaborate on which sensor inputs are used to provide the data in the tanker design. The options include using data from the angle of attack vanes on both sides of the cockpit, or an angle of attack vane an inertial gyroscope.

I find the last sentence interesting, although mis-spelled... angle of attack vane AND inertial gyroscope? The unmanned drones use the inertial system for AoA...


https://www.mro-network.com/airframe/boeing-s-767-tankers-also-use-augmented-pitch-system

[FrequentSLF]

Given the "nomenclature changed" label and awkward text I would guess that at least some who might have gone "huh" would decide it had to a be label change only since it would be hard to believe that critical core functionality had changed, at least without a strong warning.
Not a pilot
still I wonder why the MAX needs a PRI and B/U cut off! Forget the label changing, what surprises me, is that on a new design the two switches are in connected basically in series, and either one is doing a cut off! Means the previous design was faulty? And in the new design was considered safermto have a back up cut off switch, just in case the primary fails? What kind of engineer will design a system with a single sensors, single computer, single motor to drive a flight control, and feels the need to add a back up cut off?

[Portallo]

I find the last sentence interesting, although mis-spelled... angle of attack vane AND inertial gyroscope? The unmanned drones use the inertial system for AoA...

This is not new. It has been covered e.g. by Mentour Pilot in his 737 MAX Q&A video (sorry, can't post links yet, look it up on Youtube under Mentour Pilot - Five questions about the Boeing 737 MAX).
Key thing is that the MCAS built into the KC-46 was meant to counter a slightly different phenomenon than in case of the 737 MAX. It was designed specifically to counter CoG shifts from the moving fuel as opposed to countering the aircraft's nose-up tendency in high AoA conditions in case of the 737 MAX MCAS variant. That being said, the KC-46 potentially could have used a different selection of sensors.

However, the fact that the KC-46 did make use of sensor redundancy as well as introduced a simple manual override by the pilot's column movement, points pretty clearly to the fact, that these good engineering practices were once present at Boeing and their absence in case of the 737 MAX MCAS design constitutes a gross negligence. It should now be the role of authorities to determine, why this has been the case.

[Sublogic]

Not a pilot
still I wonder why the MAX needs a PRI and B/U cut off! Forget the label changing, what surprises me, is that on a new design the two switches are in connected basically in series, and either one is doing a cut off! Means the previous design was faulty? And in the new design was considered safermto have a back up cut off switch, just in case the primary fails? What kind of engineer will design a system with a single sensors, single computer, single motor to drive a flight control, and feels the need to add a back up cut off?

Well, that is precisely the point: It is so unreliable that you want to make double sure that it can be switched off. Being able to switch it on is not guarded by a backup switch.

[Alchad]

OK, not a pilot or anything to do with aviation, but being basically housebound for the past few months have followed the LIon Air and Ethiopian accidents and the resulting Max saga on here and elsewhere (and have tried to DMOR before asking questions). They are fascinating from so many aspects which the ongoing debate on here and other forums have sought to draw out, it is just sad that it has to be on the back of such a tragic loss of life.

This post is promoted by watching the Mentour video, and in particular the struggle they had trying to use the manual wheel trim to restore stab trim. My understanding is that a flight simulator is programmed to simulate real aircraft behaviour by using test flight data from all of the flight envelope and no doubt from wind tunnel testing and other research?

So watching the struggle to manually trim under the flight conditions they were attempting to simulate gave me the obvious thought that manual trim reaction was being supplied by some algorithm, look up chart, whatever which said in my layman understanding “these are the simulated flight conditions, therefore apply a force of x to the manual trim wheel”.

If this is correct, if I were a regulator looking to recertify the MAX, or more so if I was a lawyer looking to build a case, I would be very keen to see this background data, and exactly how much of the flight envelope is actually covered while still allowing the manual trim wheel to retain authority, and not assuming the pilot was superhuman.

Alternatively, probably not sure how realistic, but if the data wasn't complete, wouldn't it be “relatively easy” for interested parties to commission wind tunnel testing to obtain the countering manual trim force required throughout a complete range of speed, altitude, stab trim angle and with say a maximum countering column elevator force being applied ?

Apologies if this is ignorant nonsense, if it is “move on nothing to see here!” If there is any logic in what I say I'd love feedback.

Alchad

[safetypee]

Alchad, timely and relevant questions; as to be expected from ‘West of the M5’ ;)

“ …very keen to see this background data, and exactly how much of the flight envelope is actually covered …’

This is an important issue. One scenario is that Boeing FAA accepted previous data from the 737 NG, or even 737 classics for the MAX; based on the aerodynamic design, wind tunnel and flight tests - grandfather rights. This probably involved some extrapolation, thus the associated processes are of interest.
Did Boeing convince themselves - and then the FAA, that the MAX is sufficiently similar to the NG so that deep questioning was glossed over. Unfortunately the MAX is not the same as witnessed by MCAS - probably a late addition to meet certification (not to be the same as precious variants), etc, etc.

From a flight test viewpoint (hindsight), the tests required would be very hazardous; thus data as far as was flown for certification opposed to simulator information beyond the recognised flight envelope would depend on extrapolation. Without ‘real’ data, the aircraft and simulator certification could be based on previous variants and ‘linear’ interpretations (not mathematically linear) for simulation - it’s good enough for training, because the pilots won’t get into that situation, the system does not fail that way, etc, etc.

Thus the FAA and other regulators could (should) be reconsidering these aspects, and based on piloting experiences, the concerns about trim forces and practicality of recovery for trim runaway (not MCAS because that won’t malfunction in the same way post mod) could be well founded, and thus a much bigger problem for Boeing.

If the certification approvals for the aircraft and simulator meet current requirements there should not be need for more data; this should be (has been) collected for certification approval, proof that the failures can be managed by human alleviation, and that pilots ‘will not’ (certification probability) encounter such situation again.

No need to move on, dig-in for the long battle; certification ramifications and possibly Boeing rework / rethink.

[spornrad]

I think we can agree that it is easier to hold the trim switch with the stick shaker off. Nonetheless, the data shows clearly that the thumb switch can be held closed with the stick shaker on.
But the Lion Air data also shows "off-blips" during automatic trim every now and then,

Nope. There is a clear temporary loss of input in many of the manual, but none of the automatic commands. The latter show only "ragged" flanks.
https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/888x334/lionair_trim_inputs_37ecc757a3bc821011776b613267bc6952148c88 .jpg
Lionair Upper: manual trim middle: automatic trim

On the ET FDR PF asks PNF to help him with the manual electric trim. So he may have had difficulties actuating his thumb switch.

[oggers]

Nope. There is a clear temporary loss of input in many of the manual, but none of the automatic commands. The latter show only "ragged" flanks.
https://cimg5.ibsrv.net/gimg/pprune.org-vbulletin/888x334/lionair_trim_inputs_37ecc757a3bc821011776b613267bc6952148c88 .jpg
Lionair Upper: manual trim middle: automatic trim

On the ET FDR PF asks PNF to help him with the manual electric trim. So he may have had difficulties actuating his thumb switch.

I do not agree with your analysis. We will know in the end if that is identified as a contributing factor. I predict it will not be.

[NoelEvans]

There is an excellent article in Flight International this week: "Questions persist after Ethiopian loss".

If there are questions about pilot training, I feel that they should be directed not so much at type-rating and airline training, but rather at the first 200 hours of a pilot's training. There have been too many crashes where the very, very basics of flying an aeroplane seems to have been forgotten.

Quote from the 'Effect of Controls' lesson at the very beginning of flying training: "At high airspeeds, typically with a low nose attitude, the controls are harder to move, very effective and require only small movements to bring about a change of flight path. They feel firm." The last paragraph of that Flight article is very very pertinent.

[737 Driver]

Not a pilot
still I wonder why the MAX needs a PRI and B/U cut off! Forget the label changing, what surprises me, is that on a new design the two switches are in connected basically in series, and either one is doing a cut off! Means the previous design was faulty? And in the new design was considered safermto have a back up cut off switch, just in case the primary fails? What kind of engineer will design a system with a single sensors, single computer, single motor to drive a flight control, and feels the need to add a back up cut off?

Am a 737 pilot.

Reason I was given was to provide redundancy in case of a rare instance of switch (or actually relay) welding. That phenomenon occurs when a relay remains in a set position for so long that it basically welds the contacts closed. I'm not an electrical engineer, so I don't know how to evaluate this statement, but it is not unlike the rationale for the split thumb switches on the yoke.

I suspect another unspoken reason was to maintain the look and feel of the 737NG switches. As long as there were two switches that were always used together, then Boeing could take the position that no additional training was required.

[MurphyWasRight]

There is an excellent article in Flight International this week: "Questions persist after Ethiopian loss".

If there are questions about pilot training, I feel that they should be directed not so much at type-rating and airline training, but rather at the first 200 hours of a pilot's training. There have been too many crashes where the very, very basics of flying an aeroplane seems to have been forgotten.

Quote from the 'Effect of Controls' lesson at the very beginning of flying training: "At high airspeeds, typically with a low nose attitude, the controls are harder to move, very effective and require only small movements to bring about a change of flight path. They feel firm." The last paragraph of that Flight article is very very pertinent.
That could be one explanation of the seemingly tentative trim inputs especially by Lion Air FO, although the (possible) ergonomic factors discussed above are intriguing.

[gmx]

I do not agree with your analysis. We will know in the end if that is identified as a contributing factor. I predict it will not be.

As has been pointed out many times in the two main threads discussing the 737 MAX crashes, the LT610 PF counteracted uncommanded (MCAS) nose-down trim on 21 separate occasions, yet for whatever reason did not believe he was experiencing a stab trim runaway, and failed to activate the CUTOUT switches.

There are two big questions:

why did he fail to recognize the stab trim runaway and activate the CUTOUT ?
why did he hand control of the trim to the FO with such a critical malfunction occurring ?

[Maninthebar]

As has been pointed out many times in the two main threads discussing the 737 MAX crashes, the LT610 PF counteracted uncommanded (MCAS) nose-down trim on 21 separate occasions, yet for whatever reason did not believe he was experiencing a stab trim runaway, and failed to activate the CUTOUT switches.

There are two big questions:

why did he fail to recognize the stab trim runaway and activate the CUTOUT ?
why did he hand control of the trim to the FO with such a critical malfunction occurring ?


Good questions, but as I said much much earlier, I think we can turn this one on its head and ask "what enabled the supernumerary Captain on the prior flight to recognise, at least in part, that CUTOUT was the solution?". I believe that, even then, electric trim was re-engaged albeit briefly.

So, even with 3 heads in the cockpit, one of whom was free from immediate control issues, it did not appear to that crew the Trim Runaway NNC was the obvious choice.

[oggers]

There is an excellent article in Flight International this week: "Questions persist after Ethiopian loss".

Thankyou for the heads-up. When looking for that I also saw this previous article from Flight Global:Investigation into the Ethiopian Airlines Boeing 737 Max crash is likely to be scrutinised as much for impartiality and independence as for its analysis of technical and operational circumstances.

Under ICAO standards Ethiopian authorities are poised to lead the inquiry into the 10 March accident involving the Nairobi-bound flight ET302, which occurred just outside Addis Ababa.But Ethiopian investigators are likely to face pressure for full transparency – not just to satisfy concerns over the 737 Max, following the airline’s decision to ground the type, but to ensure there is no repeat of the controversy which tainted a previous fatal 737 accident probe involving the same carrier.

Lebanese investigators conducted an inquiry into the loss of Ethiopian flight ET409, a Boeing 737-800, which crashed into the sea just 4min after taking off from Beirut in February 2010.The inquiry concluded that the crew lost control of the jet as a result of “inconsistent” flight-control input and “mismanagement” of airspeed, altitude and attitude, adding that the aircraft was out of trim.It stated that the first officer failed to demonstrate sufficient assertiveness to intervene despite multiple warnings – including stick-shaker activation – and evidence that the captain, who was flying, was showing signs of disorientation and loss of situational awareness.The inquiry attributed the crash to a combination of “failure in basic piloting skills” by the captain, combined with inadequate crew resource management from the first officer, and queried the decision to pair the two.While the pilots met Ethiopian’s criteria for pairing the inquiry pointed out that their levels of experience “did not constitute a comfortable margin”, particularly for operation under demanding conditions.

Despite the in-depth analysis by the Lebanese investigators, both Ethiopian Airlines and the Ethiopian Civil Aviation Authority strongly condemned the conclusions.The ECAA claimed the inquiry report was an “unbalanced account” containing “factual inaccuracies, internal contradictions and hypothetical statements” which were not supported by evidence.In an extraordinary formal statement the authority insisted that the most probable cause of the crash was the break-up of the jet following an explosion – the result of sabotage, a lightning strike, or being shot down.The ECAA rejected the findings of crew mismanagement of the 737-800, claiming that flight-data recorder information revealed stabiliser and roll movements suggestive of damage to the tail section.....[etc]

[gmx]

Good questions, but as I said much much earlier, I think we can turn this one on its head and ask "what enabled the supernumerary Captain on the prior flight to recognise, at least in part, that CUTOUT was the solution?". I believe that, even then, electric trim was re-engaged albeit briefly.

So, even with 3 heads in the cockpit, one of whom was free from immediate control issues, it did not appear to that crew the Trim Runaway NNC was the obvious choice.

I disagree. It appears it occurred to someone (the jump seat pilot) pretty quickly that it was a runaway. They got pitch under control and hit the cutouts. My guess is they re-enabled stab trim in a troubleshooting / curiosity activity (lets see if its still doing it?) because clearly they did not need the electric trim to fly the plane.

[MurphyWasRight]

Good questions, but as I said much much earlier, I think we can turn this one on its head and ask "what enabled the supernumerary Captain on the prior flight to recognise, at least in part, that CUTOUT was the solution?". I believe that, even then, electric trim was re-engaged albeit briefly.

So, even with 3 heads in the cockpit, one of whom was free from immediate control issues, it did not appear to that crew the Trim Runaway NNC was the obvious choice.

The jump seat pilot was in a better position to see the trim wheels spinning, watching the videos of runaway trim it is blindingly obvious from jumpseat view, likely much less so for pilots where it would be in peripheral vision, and has been pointed out hearing it over the stick shaker is questionable.

As to why it was not handled exactly per Trim Runaway NNC once recognised (re-enabling trim) one factor is that it did not match the at the time checklist perfectly since the 'runaway' was not continuous.

[Lake1952]

By
Andy Pasztor

Updated April 15, 2019 5:33 p.m. ET American Airlines Group (https://quotes.wsj.com/AAL) Inc., AAL +0.06% (https://quotes.wsj.com/AAL?mod=chiclets) after saying for months that its pilots didn’t need additional ground-simulator experience on Boeing (https://quotes.wsj.com/BA) Co. BA +0.26% (https://quotes.wsj.com/BA?mod=chiclets) 737 MAX jets, now plans to include such instruction in training sessions for the aircraft, according to industry officials.

The decision, these officials said, means as soon as late summer, American 737 MAX pilots will start encountering some simulator scenarios tied to problems with an automated flight-control system (https://www.wsj.com/articles/investigators-believe-737-max-stall-prevention-feature-activated-in-ethiopian-crash-11553836204?mod=article_inline&mod=article_inline), called MCAS, that has been implicated in two fatal nose-dives (https://www.wsj.com/articles/the-final-minutes-of-ethiopian-airlines-doomed-boeing-737-max-11553876300?mod=article_inline&mod=article_inline) of the plane in less than five months.

The enhanced training also will deal with similar emergency situations in which pilots need to intercede to manually correct movement of flight-control surfaces on the jet’s tail.

American’s choice highlights growing differences between carriers—and in American’s case, with federal air-safety regulators—regarding the best way to ensure flight crews will be able to safely operate 737 MAX jets once they resume service.

At this point, the Federal Aviation Administration isn’t planning to mandate simulator training targeting potential MCAS misfires. American’s voluntary effort to go beyond minimum federal requirements hasn’t been reported before.

Southwest Airlines (https://quotes.wsj.com/LUV) Co. and United Continental Holdings (https://quotes.wsj.com/UAL) Inc., the other U.S. carriers with MAX aircraft, don’t intend to adopt similar training changes, the officials said. Some overseas carriers, however, have signaled they may opt for enhanced simulator training.

In the immediate wake of a Lion Air jet crash in Indonesia (https://www.wsj.com/articles/summer-travel-season-to-take-hit-from-737-max-grounding-11555239601?mod=article_inline) in October, American said it continued “to believe the Boeing 737 MAX aircraft is safe and that our pilots are well-trained and well-equipped to operate it.”


https://www.wsj.com/articles/american-airlines-devising-extra-simulator-training-for-boeing-737-cockpit-crews-11555340001?mod=itp_wsj&mod=&mod=djemITP_h
https://m.wsj.net/video/20190404/040419ethiopia/040419ethiopia_960x540.jpg
Investigators Blame Boeing Flight-Control System in Ethiopian Crash
An initial probe into the crash of the Ethiopian Airlines Boeing 737 MAX 8 found that the pilots followed emergency procedures. Investigators went on to recommend that the MAX fleet stay grounded until authorities validate changes that Boeing has made to the aircraft. WSJ’s Robert Wall explains. Photos: Getty ImagesAmerican’s pilots were critical of Boeing (https://www.wsj.com/articles/lion-air-crash-prompts-some-carriers-to-boost-pilot-training-1544218191?mod=article_inline) for not providing enough information initially about the MCAS system, but determined that they had learned enough about how MCAS worked to continue flying the plane without additional simulator training. But on Sunday, a spokesman for American Airlines said the carrier is “looking at the potential for additional training opportunities” in coordination with the FAA and representatives of the pilot union.

A Southwest spokeswoman said the airline’s current training covers operating in conditions present during “an MCAS misfire.” She added, “We briefed our pilots on MCAS post-Lion Air and emphasized the training for operating in unreliable airspeed conditions.”

On Monday, United said, “Our training is consistently refreshed and updated, and we will make any updates to our training necessary should the FAA decide more is required as part of their ongoing investigation.”

Within weeks of the Lion Air crash, American already was working behind the scenes on possible training changes. Without any prodding from the FAA, the carrier’s safety and training experts began considering possible additional simulator training, according to internal FAA documents reviewed by The Wall Street Journal.

According to one email at the time from a senior FAA inspector, the carrier was developing new simulator scenarios for the MCAS system malfunctions and potential consequences. The email added that FAA and American officials determined “it would be better to wait for further guidance” from the plane maker and agency certification experts before proceeding to develop full-blown simulator scenarios.

The carrier, according to one industry official familiar with the details, didn’t follow through with the proposal at the time because managers decided there was too much uncertainty about the cause of the Lion Air crash. But now, after a second fatal 737 MAX crash—in Ethiopia in March—in which MCAS was implicated, American is working in earnest to implement extra simulator training for MCAS-related events, this official said.

[MurphyWasRight]

I disagree. It appears it occurred to someone (the jump seat pilot) pretty quickly that it was a runaway. They got pitch under control and hit the cutouts. My guess is they re-enabled stab trim in a troubleshooting / curiosity activity (lets see if its still doing it?) because clearly they did not need the electric trim to fly the plane.
Possibly they were trying to understand the (changed) function of the cutout switches:

"I thought the right switch killed auto but allowed manual electric trim"

tries various combinations of switch positions, ending with both up..

"There it goes again"

"That's strange, I have the conversion notes in my carry on, let me go get them"

[Maninthebar]

Possibly they were trying to understand the (changed) function of the cutout switches:

"I thought the right switch killed auto but allowed manual electric trim"

tries various combinations of switch positions, ending with both up..

"There it goes again"

"That's strange, I have the conversion notes in my carry on, let me go get them"

This

Except I **believe** that s/he had already gotten the documentation out. It is interesting that the (altered) function of the cutout switches appears to have required clarification on this forum.

[MurphyWasRight]

This

Except I **believe** that s/he had already gotten the documentation out. It is interesting that the (altered) function of the cutout switches appears to have required clarification on this forum.
Not sure it has been confirmed either way on when the library run occurred relative to cutout.

[ams6110]

Possibly they were trying to understand the (changed) function of the cutout switches:

"I thought the right switch killed auto but allowed manual electric trim"

tries various combinations of switch positions, ending with both up..

"There it goes again"

"That's strange, I have the conversion notes in my carry on, let me go get them"

"What did you say? I can't hear you over that stick shaker racket...."

[MemberBerry]

I disagree. It appears it occurred to someone (the jump seat pilot) pretty quickly that it was a runaway. They got pitch under control and hit the cutouts. My guess is they re-enabled stab trim in a troubleshooting / curiosity activity (lets see if its still doing it?) because clearly they did not need the electric trim to fly the plane.

I'm not quite sure why this myth that the previous Lion Air crew quickly realized they had a stabilizer runaway and used the cutout switches is still going strong.

It's obvious from the FDR traces that is not the case, and that they actually fought MCAS for about 5 minutes before using the stab trim cutout switches. For the Ethiopian flight, 4 minutes after they experienced the first MCAS activation they were already hitting the ground.

And the Ethiopian crew used the cutout switches about 40 seconds after MCAS first activated. So about 7 times faster than the Lion Air crew. It still didn't save them. In fact it may have made things worse for them, because it appears that they could not use either the manual electric trim or the trim wheels after using the cutout switches.

I was trying to understand why the Ethiopian pilots have retracted the flaps, which allowed MCAS to activate. Looking at their FDR traces it seems to have happened when they were getting close to 250 knots. The VFE on the 737-800 is 250 KIAS at flaps 1, 2 and 5, and it's probably similar on the MAX. So it's not surprising they retracted them. About 20 seconds later, when the flaps completed retraction, they were over 250 knots. I wonder what would have happened if they didn't retract them and they got close to 340 knots. Would they fully retract automatically at some point to prevent damage to them?

[Ian W]

Originally Posted by Maninthebar https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10448862.html#post10448862)This

Except I **believe** that s/he had already gotten the documentation out. It is interesting that the (altered) function of the cutout switches appears to have required clarification on this forum.

Not sure it has been confirmed either way on when the library run occurred relative to cutout.

Amazing.
We have been reliably informed that nobody was told about MCAS - but a pilot before any crashes not only had knowledge of procedure (cut out Stab Trim) which saved the aircraft; but also had documentation of the effect on MCAS in his carryon?

[Maninthebar]

Amazing.
We have been reliably informed that nobody was told about MCAS - but a pilot before any crashes not only had knowledge of procedure (cut out Stab Trim) which saved the aircraft; but also had documentation of the effect on MCAS in his carryon?

Ian, I don't believe that this is a claim that MCAS was in the documentation, the suggestion is that a) the difference in CUTOUT switches was and b) that it took another head in the cockpit to suggest trying the CUTOUT as if there was runaway trim. As the previous poster indicates, it took them a while to get there and they subsequently reported STS running in REVERSE (and not MCAS)

[MurphyWasRight]

Amazing.
We have been reliably informed that nobody was told about MCAS - but a pilot before any crashes not only had knowledge of procedure (cut out Stab Trim) which saved the aircraft; but also had documentation of the effect on MCAS in his carryon?

The documentation would have described the changed functionality of the trim cutout switches, which appears to have been glossed over in at least some conversion slideware.
No need to know about MCAS (why) to use the cutout switches to kill uncommanded trim (what).

[infrequentflyer789]

I was trying to understand why the Ethiopian pilots have retracted the flaps, which allowed MCAS to activate. Looking at their FDR traces it seems to have happened when they were getting close to 250 knots.

Also they had autopilot engaged. On LionAir accident flight MCAS problems appeared to start with flaps up, on ET it was with autopilot disengage.

By the time of the ET flight it was known that autopilot was a protection against MCAS, from one of the ASRS reports:

It was my leg, normal Ops Brief, plus I briefed our concerns with the MAX issues, bulletin, MCAS, stab trim cutout response etc. I mentioned I would engage autopilot sooner than usual (I generally hand fly to at least above 10,000 ft.) to remove the possible MCAS threat.

Unfortunately the autopilot didn't stay engaged - not sure why.

It also appears to have pitched, and trimmed, them down when apparently set to climb, this I do not understand. I cannot find any autopilot-engage preconditions other than "no stick force", but if the autopilot actually cares about AOA why on earth would it engage at 74deg - if that is true there is no way you are flying. On the other hand if it didn't care about AOA what on earth was it doing with the pitch when set to climb? One of several WTFs on this one.

Autopilot pitching down unexpectedly was also a feature of some of the MAX ASRS reports, including the one I quoted - issues may or may not be related.

[MurphyWasRight]

I posted this yesterday morning, but I think it got buried awaiting moderator approval (hopefully I'll be off probation soon :O )

Procedurally, it does not matter what the switches do or how they are labeled. You could call the switches "Hank" and "Frank", and it does not matter. From Boeing's perspective, you don't have to know what these switches are connected to. Whether the NG or the MAX, you always cutoff BOTH switches when called for in the NNC.

It wasn't always so on the NG. A while back, the 737NG stab runaway procedure was changed so that BOTH cutout switches are always selected together, and we no longer try to isolate the offending circuit. I was kind of curious why the change, but I was simply told that Boeing thought this was a better to handle runaway trim. The conspiracy theorist in me now says that Boeing did this because they were looking down the road at the MAX certification and were looking for any opportunity to harmonize procedures.

Missed this when it first appeared:
Interesting info on the runaway procedure change, hard to see what advantage it would have other than keeping things simple at the cost of eliminating the possibility of using manual electrical trim.

And from a later post:

Am a 737 pilot.

Reason I was given was to provide redundancy in case of a rare instance of switch (or actually relay) welding. That phenomenon occurs when a relay remains in a set position for so long that it basically welds the contacts closed. I'm not an electrical engineer, so I don't know how to evaluate this statement, but it is not unlike the rationale for the split thumb switches on the yoke.

I suspect another unspoken reason was to maintain the look and feel of the 737NG switches. As long as there were two switches that were always used together, then Boeing could take the position that no additional training was required.

While relays can get stuck (welded) it is much more likely to happen as it closes due to arcing while the contacts are bouncing. The length of time in the closed position is very unlikely to be a factor.
Toggle switches are very unlikely to get stuck, especially when infrequently operated, the contacts are positively driven, not relying on a spring to open as in the case of a relay or momentary contact switches such as thumb switches on the yoke.

The previous (NG) switches had multiple paths to disable trim with the left disconnecting the main power to the motor via a (single) relay, while the right (autopilot) disabled inputs from the autopilot. The max has 2 switches in series, either of which kills the main power via the same single relay.

[Europa01]

I'm SLF but have enough of a technical background to add something here. My understanding is that the control column stab trim switches have two series contacts specifically to minimise the probability of single switch contact fault causing a stabilizer runaway. The first contact operates an arming relay regardless of the trim direction and the second contact provides the trim direction control. Signals from both contacts are required to be present to operate the stabilizer electrical trim. (the schematic diagram in #3882 shows this nicely). The arrangement is a sound and common principle which I think was derived from bitter experience.

As for the Stab Trim Cutout switches on the Max, if the schematic is correct then selecting the Main cutout switch to CUTOUT stops all electrical trim (including MCAS) by, amongst other things, de-energising the main trim control relay which cuts power to the stab actuator. The Backup switch is in series and since a series switch has never been needed on any previous 737 seems to be superfluous so I'd agree that Boeing put it there because there have always been two switches.

With both switches selected to CUTOUT as they seem to have been on ET302 then re-selecting the Backup switch to NORMAL would have no effect on anything. If the Main switch is then selected to NORMAL then both main electrical trim and MCAS would be active. If only the cutout switch nomenclature and not the new functionality on the Max was communicated by Boeing then the cockpit of ET302 must have been a bad place to be learning about it.

[HarryMann]

Ian, I don't believe that this is a claim that MCAS was in the documentation, the suggestion is that a) the difference in CUTOUT switches was and b) that it took another head in the cockpit to suggest trying the CUTOUT as if there was runaway trim. As the previous poster indicates, it took them a while to get there and they subsequently reported STS running in REVERSE (and not MCAS)
now that makes sense !
there's just so much mud flying around
it seems, a little clarity is very welcome 👍

[Loose rivets]

Single relay!? That would seem to obviate the safety factor that the series switch modification gives. Well, at least in part. I would be horrified to learn there was truly only one point of cut off to that vital flying surface motor.

It wouldn't surprise me to learn it stayed on with a delayed opening, to avoid stop-starts as different inputs to the HStab came in quick succession.


The last relay I had fail was on a Mercedes. It left the secondary air fan on, which wrecked it as it was not continuously rated. When I finally found the darn thing the welded points took a lot of parting. In the car case the fan runs at start-up and shut down. So regular use. On the Boeing, I don't know what current that isolation relay would have to switch during (I presume) pre-flight checks. There was talk in this thread of the motor running - and the clutches choosing the driving logic. I have never found out just how long the H-Stab motor runs for during normal ops.

[MurphyWasRight]

Single relay!? That would seem to obviate the safety factor that the series switch modification gives. Well, at least in part. I would be horrified to learn there was truly only one point of cut off to that vital flying surface motor.

It wouldn't surprise me to learn it stayed on with a delayed opening, to avoid stop-starts as different inputs to the HStab came in quick succession.

The last relay I had fail was on a Mercedes. It left the secondary air fan on, which wrecked it as it was not continuously rated. When I finally found the darn thing the welded points took a lot of parting. In the car case the fan runs at start-up and shut down. So regular use. On the Boeing, I don't know what current that isolation relay would have to switch during (I presume) pre-flight checks. There was talk in this thread of the motor running - and the clutches choosing the driving logic. I have never found out just how long the H-Stab motor runs for during normal ops.
There is one main (3 phase) power relay to the the trim motor block, on the MAX at least it is shown feeding a AC/DC/ converter so not an inductive load.
The NG diagram has less detail in the motor block.
This relay is controlled by the cutout switches but is normally on (energized).
There are also a number of 'enable' as well as direction input shown connected to the motor block, on the NG the autopilot signals are interrupted by the right hand switch. The left switch kills power to the power relay. On MAX either switch kills power (and control inputs)..

Note both of these are labelled "functional description" so don't include all details.

[SLF3]

Foreign regulators approved MCAS based on 0.5 degree authority. They are off the hook for 2.5 degree authority.

Whether they will accept updated software given the fundamental design issue of engine location relative to the wing is an open question: but the political pressure to do so will be enormous.

Flew on a neo today. Nice plane, significantly quieter than the previous version. And full size emergency exits....

[Smythe]

Just a curious observation. The focus has been on DEP and AoA. this is understandable, as the ac in the climb.
In the first instance, the MCAS issues were first noted on ARR, (and corrected) not DEP.
From what has been reported, all pilot reports were issues on DEP....

[FullWings]

All good George and seems sensible and expressed by numerous other 737 drivers in this long thread. Especially the 80 percent and 10 degrees. I mean that's just physics isn't it. On a dark night (terrain allowing) you can keep the blessed thing flying while the rest is sorted out. But one thing I wonder about. Is that power and pitch based on any given percent MAC being inside the authorised Cof G envelope? I mean, if you are unknowingly heavier than MAXTOW and with a C of G outside the envelope, in a hot and high airfield with V2 calculated to occur a little closer to the end than you would normally like, is that checklist going to help you stay airborne while you establish why your airspeed has gone to crap and the stick is shaking? Not saying that was the case in this event (especially with in daylight and CAVOK) but seriously just wondering how quick you need to decide that UAS checklist may not be your first and best port of call when the stick is shaking and your decaying airspeed is actually reliable! I suppose a wing drop like Cubana de Aviación Flight 972 might be the teller but I imagine it's all a bit late by then. An agressive pitch up immediatley after take off might also be a clue. Serious question, not trying to be smart a*** . (Ex Mil Loadmaster C130/B727).
Good questions.

I’m seeing quite a few posts of “should have done this”, “should have done that” and "I would have immediately xyz”.

When you get a stick shake during/after rotation or early in the climb out, which may or may not be associated with UAS symptoms, what are you going to do? Well, before you do anything, you need to have some idea if it is genuine or not.

How do you ascertain that? The traditional answer is performance attitudes (which we see a lot of in postings) but an aeroplane can be approaching a stall in a normal takeoff/climb attitude for many reasons, such as: strong adverse wind gradient, temperature inversion (often combined with the item before), incorrect loading, wrong flap setting, incorrect performance data and/or incorrect FMC weight/speed entries. If you leap straight into the UAS checklist at that moment, what will happen if you really *are* on the stick shake? I never tried this in the 737 sim but my gut feeling is that isn't a good place to be: on the back of the drag curve, keeping the nose high and likely take a bit of power off... Hmmm.

Remember, this is at 7,600’ASL, density altitude of nearly 9,500’ at the airport with MSAs of 14-16,000’, so close to the edge of the envelope in many respects. Some thought required before rushing into actions that may make the situation worse and that’s before MCAS rears its ugly head. Will flying the UAS pitch and power give enough of a climb gradient for terrain separation here? I can quite understand any reluctance to reduce power in this scenario, although it’s quite possible the workload was such that it didn’t get actively examined.

TL;DR If you have multiple scenarios with different required actions but similar symptoms, if you don’t do a bit of analysis first you are relying on luck...

[meleagertoo]

How do you ascertain that? The traditional answer is performance attitudes (which we see a lot of in postings) but an aeroplane can be approaching a stall in a normal takeoff/climb attitude for many reasons, such as: strong adverse wind gradient, temperature inversion (often combined with the item before), incorrect loading, wrong flap setting, incorrect performance data and/or incorrect FMC weight/speed entries. If you leap straight into the UAS checklist at that moment, what will happen if you really *are* on the stick shake? I never tried this in the 737 sim but my gut feeling is that isn't a good place to be: on the back of the drag curve, keeping the nose high and likely take a bit of power off... Hmmm.
Good question. How indeed?
For a moment or two after rotation when the stickshaker and stall warning burst out you are doubtless momentarily and firmly in the land of half-crown, threepenny bit, dustbin lid. But within a very short period of time you see TOGA thrust confirmed, airspeed/groundspeed confirmed, attitude correct and your sphincter begins to relax the dustbin lid to manageable proportions; then you see the usual huge Boeing ROC and realise the thing is flying as normal and thus the warnings must be false and the laundry-threatening event is all but over. The mere fact you're not mushing along the runway at thirty feet and 20' pitch in ground effect should tell you this. IMMEDIATELY.
Then you know the next thing to do is AIRSPEED UNRELIABLE chex. - What else fer chrissakes? WHAT tf ELSE???
If you don't - in the sim - you've just failed that check. Bombed it.
That's why we train these events in the sim, so we learn to recognise them and know better than to repeat them on the line.
I know I won't be thanked for it but it appears to me that these crews hadn't left this lesson behind in the sim.

Why?
Well, that's quite another matter...and one I suspect will become the crux of investigation in the months to come.

There can be little doubt that merely carrying out AIRSPEED UNRELIABLE chex would have pevented these accidents altogether.
(as would a number of other fundamental vital/airmanship actions too)

The more I think about this the more I see this as a training/culture/airmanship/professionalism/HF failure than anything else.
That's not to exonerate Boeing by any means, but when all else is said and done all 4 pilots had it entirely within their power and ostensibly within their training (tbc) to avoid both these accidents regardless of what the airplane seems to have done. In neither case did the airplane begin the event in anything approaching an unflyable condition, but just as in AF 447 the pilots very quickly and unnecessarily managed to put it in one through gross mishandling.

[Bleve]

When you get a stick shake during/after rotation or early in the climb out, which may or may not be associated with UAS symptoms, what are you going to do? Well, before you do anything, you need to have some idea if it is genuine or not.

I would suggest that if a stick shaker is genuine at rotation, you wouldn't be getting airborne, you would be tail scraping your a*** down the runway. If the take-off has been normal (ie normal acceleration, rotation and lift-off at the expected distance to run, airspeed and pitch attitude) and you get a stick-shaker, it's the stick-shaker that is not normal. In which case the Airspeed Unreliable checklist is the correct procedure to follow.

Interestingly in Airbus world, they have a memory checklist procedure for Stall Warning at Lift-Off. It says to set TOGA thrust, 15° nose up and wings level, which unsurprisingly are essentially the same initial actions as their Unreliable Speed checklist. No wasting time in a time critical situation - go straight to the Power + Attitude settings that will give you the fly away from the ground Performance that you want.

[meleagertoo]

If Bleve appears to have mimiced my post above it is only fair to say they were posted simultaneously.

[Bleve]

Thanks meleagertoo. Yes simultaneous postings. Thankfully with the same message. As they say out in my part of the world: 'Happy Landings'.

[Loose rivets]

Do the engines in the MAX have a time limit at TOGA?

[ILUVHOKE]

Do the engines in the MAX have a time limit at TOGA?

In my AOM, the only time limit on TOGA is associated with max EGT. 1038 C for 5 mins, with a 30 sec exceedence allowed to 1048.

Hoke

[FullWings]

Good question. How indeed?
For a moment or two after rotation when the stickshaker and stall warning burst out you are doubtless momentarily and firmly in the land of half-crown, threepenny bit, dustbin lid. But within a very short period of time you see TOGA thrust confirmed, airspeed/groundspeed confirmed, attitude correct and your sphincter begins to relax the dustbin lid to manageable proportions; then you see the usual huge Boeing ROC and realise the thing is flying as normal and thus the warnings must be false and the laundry-threatening event is all but over. The mere fact you're not mushing along the runway at thirty feet and 20' pitch in ground effect should tell you this. IMMEDIATELY.
So. Imagine for some reason you’ve cocked up the performance calculation and/or entered the wrong weights in the FMC, like EK407 (https://en.wikipedia.org/wiki/Emirates_Flight_407), maybe even not as grossly. What are you going to see? Thrust - what you intended, airspeed - as bugged, attitude - somewhere in the takeoff range. Nothing *obviously* wrong? Given differing density altitudes, runway parameters, terrain constraints, variable flap settings, ATM & fixed derates, etc. there is no “one size fits all” measure of performance these days. In a FBW aircraft, any “feel” in the controls will be based on false data.
Then you know the next thing to do is AIRSPEED UNRELIABLE chex. - What else fer chrissakes? WHAT tf ELSE???
If the crew on the BA56 (https://www.flightglobal.com/news/articles/ba-747-crew-commended-for-escaping-near-stall-on-tak-343738/) had dismissed the stall warning as false, things would most likely not have gone well from then on. They had no indication that anything was amiss but they respected the stick shaker.

JK5022 (https://en.wikipedia.org/wiki/Spanair_Flight_5022) is what can happen when you ignore a stall warning at low-level.

If you don't - in the sim - you've just failed that check. Bombed it.
That's why we train these events in the sim, so we learn to recognise them and know better than to repeat them on the line.
I know I won't be thanked for it but it appears to me that these crews hadn't left this lesson behind in the sim.
You could also say that you are training a single response to something that is much more nuanced in reality. Yes, you can pass the sim but fail dramatically in real life...

[Icarus2001]

You could also say that you are training a single response to something that is much more nuanced in reality. Yes possibly but that single response is a bloody starting point.

Fullwings are you a pilot?

[Rananim]

Lots of people getting upset at experienced B737 drivers being “ judgmental” and assuming they would have done better.
Well, back to basics.
- Stick shaker on rotation. Do NOT engage the autopilot.
- Commence Airspeed Unreliable Checklist.
Yes you DO reduce thrust to 80% and maintain 10 degrees nose up.
The procedure is specifically designed to keep you flying at a safe speed and rate of climb. Just do it.
Disconnect the auto throttle as per the checklist.
-Fly the aircraft
-DO NOT maintain straight and level with autopilot and autothrottle engaged and allow aircraft to continue to accelerate to VNE while failing to ensure terrain clearance.
-Uncommanded Trim? Complete Runaway Stabilizer checklist as per training and specific Boeing recommendation in AD briefing we have all read ,and presumably understood ,as a result of previous accident.
-DO NOT allow airspeed and trim status to runaway to the extent that recovery becomes difficult or impossible.
Anything so far beyond the wit of a well trained Pilot?
Am I a Boeing troll? No, just an experienced B737 Pilot who still cant understand how you can get an aircraft so out of shape.
What do you think we get paid for?
George Glass

All good but...what you're saying is that in the case of the Birgenair crash,The Captain should have set 80% N1 and 10 degrees instead of......simply handing control to the FO whose ASI was totally functional?
IAS DISAGREE is not UAS.
We dont wish to criticize dead men.We all now know MCAS design was erroneous but that doesnt excuse a pilot from flying the plane does it now?
Some have said that establishing that the stick shaker activation was spurious was not possible and that the crew should have flown the UAS procedure.
This is not correct.
Flaps were set,takeoff power was confirmed,pitch attitude consistent with takeoff(a stable flight regime),no windshear warning,stick shaker active on Captains side only,disagree warnings are seen,FO's ASI agrees with ISFD....all point to a faulty sensor and not a real stall warning.
Its not wrong or dangerous for the Captain to retain control,set 80% N1 and fly 10 degrees but why?Why would you do that ?
In reflection,these 2 accidents are more about airmanship and crew composition than MCAS.
MCAS is stealing the headlines but actually an experienced FO would immediately say "I have control",just as the Birgenair FO should have done 23 years ago.
Rananim sends....for the last time

[FullWings]

Yes possibly but that single response is a bloody starting point.
Yes. But it might be an ending point as well, if you are doing it for the wrong reasons. Try the UAS drill from *actually* being close to stalled and see how that goes. In the 747 incident I linked above, had they done the UAS drill instead of reducing pitch because of the stick shake, I doubt they’d be around now to talk about it.

Fullwings are you a pilot?
Are you?

All I’m doing is pointing out that in a scenario which may have multiple causes and multiple recovery (or not) options, a hasty reflex action may not always work as expected. A situation with warnings, some possibly true, some possibly false is difficult to evaluate when the data you are using to make that evaluation may itself be compromised. This is just to balance the assertions that it was an “easy” recovery for the two lost 737s.

[737 Driver]

Yes. But it might be an ending point as well, if you are doing it for the wrong reasons.

I think what some of us are trying to say is that if you are in tune with your aircraft, it becomes apparent very quickly what kind of situation you are dealing with. Initial rotation is approximately 10 degrees. No matter what alarms are going off, if the aircraft rises into the air as it normally does then it is almost certain that you are not approaching a stall. Maintain takeoff power setting, continue rotation to 15 degrees and get some space between you and the ground. At some point later, according to preference, execute the Airspeed Unreliable procedures.

On the other hand, if the aircraft acts mushy and hovers in ground effect, then respect the stick shaker. Gingerly apply full power, carefully manage the pitch, accelerate and climb.

If a pilot puts the aircraft into the proper rotation attitude and the PIC can't tell the difference between these two situations within seconds, then, quite frankly, they are not qualified to be in that seat. People's lives are literally hanging in the balance as to whether the Captain can make this distinction.

Let me stress, however, the crew's actions in either of the MAX accidents are not necessarily because they were "bad" pilots. I do not have any personal experience with the training and operational cultures at either Ethiopian or Lion Air. If these crews were simply responding according to their training, then the scrutiny should be placed there.

I strongly suspect that there is a mismatch between the proficiency standard implicit in the aircraft design and the actual training and experience level in the field. Sadly, I think Boeing, the airlines and the certificate authorities are all aware of this mismatch, but fail to either 1) insist the aircraft design be sufficiently fault tolerant, or 2) emphasize the need for better training and deeper experience.

[42go]

Icarus
"Fullwings are you a pilot?"
I have to observe, having trawled these forums for over 20 years (and knowing 'FullWings' for most of those ), that your response is typical of those who flee into a batcave when people do not seem to agree with them/worship their utterances/genuflect before them. They find, scrawled on the wall of the cave, in ancient hieroglyphics, the words 'Is u a pilut' which they then copy and paste (with spellchecker, of course) into their next post.

I can assure you that
a) 'Fullwings' is indeed a pilot
b) 'Fullwings' is very experienced in jet transport operation
c) 'Fullwings' is indeed capable of measured and logical thought processes.


Which, if any of the above, do you fit?

[Icarus2001]

Great, well not why not just answer the question? I also fly jet transport category aircraft. Now, the reason I asked is that there seems to be a rough split, in that actual pilots seem to be more likely to be critical of the crews actions whereas the non pilots, indeed non aviation posters, seem to be blaming Boeing more. I find this interesting.
Settle down 42g all good, I just asked a question.

ps. I meant to write"...a bloody good starting point" but finger on phone trouble.

[HPSOV L]

Now hang on a minute. Nowhere in any Boeing document does it say that stick shaker alone is necessarily Airspeed Unreliable.

Here is the text from the Boeing QRH for items that may be evidence of Airspeed Unreliable:

Speed/altitude information not consistent with pitch attitude and thrust setting
•Airspeed or Mach failure flags
•PFD current airspeed box amber
•An amber line through one or more PFD flight mode annunciations
•Blank or fluctuating airspeed display
•Variation between captain and first officer airspeed displays
•Radome damage or loss
•Overspeed warning
•Simultaneous overspeed and stall warnings

If the stick shaker activates after lift off and power, pitch, flap position, aircraft performance and primary and secondary Airspeed indications are normal the decision whether or not to perform QRH Airspeed Unreliable actions is purely discretionary.The whole point of the checklist is to determine which, if any, ASI is reliable. Even engaging the autopilot is not prohibited and I would say that by the time it was engaged there would have been time to assess that the stick shaker was spurious and no hazard would result from engaging it, given that it could be immediately disconnected.

So let’s not start making opinion fact and tarnishing those who aren’t around to defend themselves.

[737 Driver]

Now, the reason I asked is that there seems to be a rough split, in that actual pilots seem to be more likely to be critical of the crews actions whereas the non pilots, indeed non aviation posters, seem to be blaming Boeing more. I find this interesting.


I will also make the observation that much of the critical commentary toward the crew's action is focusing on their initial response to the event (stick shaker at rotation) before they ever got to the point where MCAS activated (flaps retracted). Up to that point, there was no significant difference between how a MAX responds vs an NG, so you can't really pin their initial response on Boeing's hash job with MCAS. The fact that these crews were struggling with basics of airmanship and compliance with a well known procedure is suggestive of an overall human factors issue.

[GordonR_Cape]

Great, well not why not just answer the question? I also fly jet transport category aircraft. Now, the reason I asked is that there seems to be a rough split, in that actual pilots seem to be more likely to be critical of the crews actions whereas the non pilots, indeed non aviation posters, seem to be blaming Boeing more. I find this interesting.
I am not a pilot, but having followed this thread (and others) very carefully, there seems to be not just a simple split, but a culture-gulf spanning a broad spectrum. Excuse the bluntness, but it may help emphasize the polarisation:
1. Anything that happened was entirely the fault of the 3rd world pilots, and our glorious Boeing is perfect (the "Trump" option).
2. Boeing made a boo-boo, but any half-competent pilot could easily have recovered the situation, and this would never have happened to my airline.
3. Boeing made a very serious error, but the pilots should have done better, and could have recovered the situation.
4. There is a chain of errors, from Boeing, the FAA , the documentation and pilots training, all of which need remediation.
5. Boeing is a criminal enterprise, and entirely responsible (the "Ralph Nader" option).

Fortunately in most posts on this informed but open forum, the extreme options do not come up. However, it is sometimes hard to distinguish the nuances between the remaining human-factors arguments, without lengthy examination of the whole decision making tree.

[737 Driver]

If the stick shaker activates after lift off and power, pitch, flap position, aircraft performance and primary and secondary Airspeed indications are normal the decision whether or not to perform QRH Airspeed Unreliable actions is purely discretionary.


If you look at the DFDR data, the indicated airspeeds were already diverging from liftoff, so no, they were not "normal".

The preliminary accident report contains a synopsis of the discussion between the Captain and the First Officer. At 400', the FO selected VNAV and the Captain called for "Command", but the A/P did not engage. The Captain called out for "Command" again. The A/P did not engage. He asked the FO to change to a new ATC frequency. The FO checked in with radar, received an ATC instruction, and responded. The Captain called for flap retraction, and the FO responded. The Captain asked the FO to request runway heading from ATC. The FO did so.

What is conspicuously absent from the dialogue is any attempt to confirm that their airspeeds were indeed "normal". They were not. Despite having multiple warnings that are explicitly stated in AD 2018-23-51 (the 737 AD published post Lion Air), this crew made no apparent attempt to determine this crucial fact. If they had done so, then performance of the Airspeed Unreliable non-normal would have been anything but discretionary.

[AAKEE]

Icarus
"Fullwings are you a pilot?"

I can assure you that
a) 'Fullwings' is indeed a pilot
b) 'Fullwings' is very experienced in jet transport operation
c) 'Fullwings' is indeed capable of measured and logical thought processes.


Yes, to often that isn't the case any more. I think it would be clear to anyone that actually did read Fullwings post(very mature post in terms of how a preconceived problem identification could kill you) that he is a experienced thinking pilot.

[L39 Guy]

I am not a pilot, but having followed this thread (and others) very carefully, there seems to be not just a simple split, but a culture-gulf spanning a broad spectrum. Excuse the bluntness, but it may help emphasize the polarisation:
1. Anything that happened was entirely the fault of the 3rd world pilots, and our glorious Boeing is perfect (the "Trump" option).
2. Boeing made a boo-boo, but any half-competent pilot could easily have recovered the situation, and this would never have happened to my airline.
3. Boeing made a very serious error, but the pilots should have done better, and could have recovered the situation.
4. There is a chain of errors, from Boeing, the FAA , the documentation and pilots training, all of which need remediation.
5. Boeing is a criminal enterprise, and entirely responsible (the "Ralph Nader" option).

Fortunately in most posts on this informed but open forum, the extreme options do not come up. However, it is sometimes hard to distinguish the nuances between the remaining human-factors arguments, without lengthy examination of the whole decision making tree.


I think your analysis and continuum of blaming the pilots/Boeing and everyone else harmless to blame Boeing and everyone else/pilots harmless is a nice summary.

I will tell you where I sit on this, based upon 36 years of professional flying (31 airline, 5 military), type rated on B737-200/767/777/787 and Airbus A330/A340, and a Professional Engineer.

First, aircraft are amazing and complex machines. Aircraft do what man was never intended to do naturally so there is an inherent risk in that alone. But even the best designed and best maintained aircraft have components that break and the human onboard is the last line of defense in many of those instances. Hydraulic systems, electrical systems, pressurization systems, propulsion systems (engines) all fail and often there is not double or triple redundancy due to weight issues, cost issues, probability of failure and the impact of a failure. As an example, there is no level of redundancy that will offset an engine failure no matter how many engines the aircraft has; the adverse yaw, the reduced performance, etc cannot be compensated for by having more engines, although the more engines an aircraft has, the less effect a single engine failure has. Aircraft manufacturers, at the urging of their airline customers, like two engine aircraft for the economics (one engine versus two, reduced fuel, reduced weight, etc). So we accept that fact that an engine failure on a two engine aircraft will have big affect when one fails, more than a single engine failure on an eight engine aircraft.

So when an engine (or hydraulic, or electric, or pressurization) system fails a pilot is in the loop to manage the situation. That is why we are highly trained and, hopefully, well compensated financially for that knowledge and judgement. The level of training lies with the individual knowing their stuff including their emergencies, particularly emergencies that are memory items - that is a personal responsibility of any professional pilot. The airline and country CAA is responsible too for insuring that the pilots charged with responsibility for that aircraft and those lives in the aircraft are also trained properly initially and on a recurrent basis.

Where do I sit on your continuum? Somewhere between 2 and 3. MCAS is a required stall protection however it needs to be toned down a bit as it can move the stabilizer trim to very large aircraft nose down angles. Should pilots be aware of MCAS in their technical training on the MAX; sure, but it would not have affected the outcome regardless as, I will describe shortly, MCAS failure presents characteristics identical to a stabilizer trim runaway, an emergency checklist item that has been around since the original B737 fifty years ago.

I would expect that any pilot with a type rating for a Boeing 737, MAX included, should be able to identify an Unreliable Airspeed (UAS). That is basic stuff, stick shaker when the aircraft if flying normally, disparity between the indicated airspeeds, etc. Any professional pilot should be able to recognize this regardless of what aircraft they are flying as every aircraft in the world is subject to this problem.

Only 2 of the 3 non-US MCAS incidents saw the pilots recognize the UAS and do something about it. This was long before MCAS reared its ugly head so that begs the question: Why? Training and experience would be my answer. And, as it turned out, the crew that did execute the UAS drill were the ones that ultimately saved the aircraft. Bear in mind that UAS is a memory drill. To me, there is no excuse why this was not done as it was a textbook UAS; to me also, in the Ethiopian case, engaging the autopilot at 400 ft is a definite faux pas as it is contrary to the memory UAS drill and, if the aircraft was indeed stalled, another definite faux pas as one does not recover from a stall with the autopilot. This points to a training/experience issue too but it also points to an over reliance on the use of the autopilot at the expense of hand flying an airplane. This too is likely an airline/CAA issue as well as an individual pilot issue. And, not to imply that this is a "third world" country issue as I am seeing this more and more with the FO's I fly with; they are terrified to hand fly the aircraft and hence their hand flying skills begin to decline.

When all of these crews experienced MCAS, 0 of 3 were able to recognize a classic stab trim runaway; while manually flying the aircraft, the nose pitches down all by itself. You simply can't miss it, with or without seeing the stab trim wheel moving. In the Lion Air case where the aircraft was saved, it took a third pilot from a different airline to tell the crew what to do; in the case of the fatal Lion Air accident, the Captain handed control to the First Officer so he could go hunting through the checklist for something to do - this is a memory drill! I fault the individual pilots for not knowing their memory emergencies - harsh as that may sound, that is what we are paid for. (Personally, I do a study of the memory emergencies regularly as the memory isn't what it used to be and I like to think that most professionals pilots do the same).

I am not going to rehash the rest of the issues (flying to destination with this problem, not controlling the aircraft speed in the Ethiopian case, etc) as that would be covering old ground but there are lots of basic airmanship issues that are highly questionable.

In conclusion, all of these MCAS issues were recoverable situations by a trained and competent crew. I do not blame the individuals entirely as the airline, their training, their hand flying policies as well as the CAA overseeing them deserve scrutiny too however. Let me repeat that: These MCAS accidents were all recoverable. Boeing's mistake, in addition to what I noted earlier, is assuming that B737 type rated pilots would be able to do even the most basic, memory emergency drills. This, however, begs the question: If pilots cannot even do a simple UAS emergency, what hope do they have for a more complex one such as an engine failure at rotation or an engine failure followed by a cabin depressurization which that Southwest crew handled masterfully?

What this MCAS situation points to, in my estimation, is that the aviation industry has been "whistling past the graveyard" for a little too long and that the underlying problems quickly manifest themselves with even the slightest irregularity - the Turkish B737 accident at Schipol, the Korean 777 in SFO, etc.. A complete rethink of pilot training, basic flying skills and airmanship are in order as there is a finite limit to what Boeing, Airbus, Embraer or any other aircraft manufacture can do to design and build airplanes without human intervention being required a certain times by competent aviators.

[pilot9250]

I think your analysis and continuum of blaming the pilots/Boeing and everyone else harmless to blame Boeing and everyone else/pilots harmless is a nice summary.

I will tell you where I sit on this, based upon 36 years of professional flying (31 airline, 5 military), type rated on B737-200/767/777/787 and Airbus A330/A340, and a Professional Engineer.

First, aircraft are amazing and complex machines. Aircraft do what man was never intended to do naturally so there is an inherent risk in that alone. But even the best designed and best maintained aircraft have components that break and the human onboard is the last line of defense in many of those instances. Hydraulic systems, electrical systems, pressurization systems, propulsion systems (engines) all fail and often there is not double or triple redundancy due to weight issues, cost issues, probability of failure and the impact of a failure. As an example, there is no level of redundancy that will offset an engine failure no matter how many engines the aircraft has; the adverse yaw, the reduced performance, etc cannot be compensated for by having more engines, although the more engines an aircraft has, the less effect a single engine failure has. Aircraft manufacturers, at the urging of their airline customers, like two engine aircraft for the economics (one engine versus two, reduced fuel, reduced weight, etc). So we accept that fact that an engine failure on a two engine aircraft will have big affect when one fails, more than a single engine failure on an eight engine aircraft.

So when an engine (or hydraulic, or electric, or pressurization) system fails a pilot is in the loop to manage the situation. That is why we are highly trained and, hopefully, well compensated financially for that knowledge and judgement. The level of training lies with the individual knowing their stuff including their emergencies, particularly emergencies that are memory items - that is a personal responsibility of any professional pilot. The airline and country CAA is responsible too for insuring that the pilots charged with responsibility for that aircraft and those lives in the aircraft are also trained properly initially and on a recurrent basis.

Where do I sit on your continuum? Somewhere between 2 and 3. MCAS is a required stall protection however it needs to be toned down a bit as it can move the stabilizer trim to very large aircraft nose down angles. Should pilots be aware of MCAS in their technical training on the MAX; sure, but it would not have affected the outcome regardless as, I will describe shortly, MCAS failure presents characteristics identical to a stabilizer trim runaway, an emergency checklist item that has been around since the original B737 fifty years ago.

I would expect that any pilot with a type rating for a Boeing 737, MAX included, should be able to identify an Unreliable Airspeed (UAS). That is basic stuff, stick shaker when the aircraft if flying normally, disparity between the indicated airspeeds, etc. Any professional pilot should be able to recognize this regardless of what aircraft they are flying as every aircraft in the world is subject to this problem.

Only 2 of the 3 non-US MCAS incidents saw the pilots recognize the UAS and do something about it. This was long before MCAS reared its ugly head so that begs the question: Why? Training and experience would be my answer. And, as it turned out, the crew that did execute the UAS drill were the ones that ultimately saved the aircraft. Bear in mind that UAS is a memory drill. To me, there is no excuse why this was not done as it was a textbook UAS; to me also, in the Ethiopian case, engaging the autopilot at 400 ft is a definite faux pas as it is contrary to the memory UAS drill and, if the aircraft was indeed stalled, another definite faux pas as one does not recover from a stall with the autopilot. This points to a training/experience issue too but it also points to an over reliance on the use of the autopilot at the expense of hand flying an airplane. This too is likely an airline/CAA issue as well as an individual pilot issue. And, not to imply that this is a "third world" country issue as I am seeing this more and more with the FO's I fly with; they are terrified to hand fly the aircraft and hence their hand flying skills begin to decline.

When all of these crews experienced MCAS, 0 of 3 were able to recognize a classic stab trim runaway; while manually flying the aircraft, the nose pitches down all by itself. You simply can't miss it, with or without seeing the stab trim wheel moving. In the Lion Air case where the aircraft was saved, it took a third pilot from a different airline to tell the crew what to do; in the case of the fatal Lion Air accident, the Captain handed control to the First Officer so he could go hunting through the checklist for something to do - this is a memory drill! I fault the individual pilots for not knowing their memory emergencies - harsh as that may sound, that is what we are paid for. (Personally, I do a study of the memory emergencies regularly as the memory isn't what it used to be and I like to think that most professionals pilots do the same).

I am not going to rehash the rest of the issues (flying to destination with this problem, not controlling the aircraft speed in the Ethiopian case, etc) as that would be covering old ground but there are lots of basic airmanship issues that are highly questionable.

In conclusion, all of these MCAS issues were recoverable situations by a trained and competent crew. I do not blame the individuals entirely as the airline, their training, their hand flying policies as well as the CAA overseeing them deserve scrutiny too however. Let me repeat that: These MCAS accidents were all recoverable. Boeing's mistake, in addition to what I noted earlier, is assuming that B737 type rated pilots would be able to do even the most basic, memory emergency drills. This, however, begs the question: If pilots cannot even do a simple UAS emergency, what hope do they have for a more complex one such as an engine failure at rotation or an engine failure followed by a cabin depressurization which that Southwest crew handled masterfully?

What this MCAS situation points to, in my estimation, is that the aviation industry has been "whistling past the graveyard" for a little too long and that the underlying problems quickly manifest themselves with even the slightest irregularity - the Turkish B737 accident at Schipol, the Korean 777 in SFO, etc.. A complete rethink of pilot training, basic flying skills and airmanship are in order as there is a finite limit to what Boeing, Airbus, Embraer or any other aircraft manufacture can do to design and build airplanes without human intervention being required a certain times by competent aviators.

A really great post but the conclusion that the answer lies only in training cannot be other than seriously debatable.

You led off with experience for a very good reason. Experience is profoundly important.

Training doesn't provide experience. It's only the entry point.

Automation denies experience.

As an overall improvement we need either reduced reliance on automation enabling greater experience, or improved automation.

We both know which one of those is more likely.

[Bend alot]

MCAS is a required stall protection however it needs to be toned down a bit as it can move the stabilizer trim to very large aircraft nose down angles.
.
34 years aircraft maintenance.

Good post L39 - but MCAS is far from a stall protection (system). MCAS is a system that supplies an a feel to the control column, and the aircraft can fly perfectly without it.

But without MCAS the 737 MAX could not meet the certification requirements for Grandfather rights. Without the Grandfather rights the 737 MAX requires more certification and pilots will require extra training - this would make the MAX less desirable/competitive.

So the task was to incorporate a new system without calling it "new" and retain Grandfather rights. It seems to me that the priority was the "extra training" being minimal between the MAX and other 737's (you heavily touched training in your reply) and the result was a few hours of slides on an iPad that included nothing on the new system.

If the Grandfathering certification allowed for MCAS as a new system, and it was designed and implemented as a stand alone system with dedicated on/off switches and proper training - I doubt we would have had the crashes.

Even now MCAS seems to be strange! (I do not recall exact numbers) but MCAS was said to have a limit of 0.6 in certification. From memory that was not enough so it was increased to 2.5 to get the required "feel" to pass the test. Yet the "software update" will reduce this to either 0.6 or 0.9 ( I do not recall) so how then can it pass the test when 2.5 was required?

There also still seems to be far too much effort, to not have this aircraft require "extra" training, particularly in the sim. My view is that this "fix" will have put the "feel" somewhat less than what the original MAX had, this feel was to give the pilot an aid to prevent pulling back too far preventing a stall. So I believe that simulator training should be carried out on the MAX around the stall area in the parameters that MCAS is enabled. Obviously this training should be with and without MCAS engaged as there is included in the fix more ways the MCAS can be disengaged, and pilots left with a soft stick around the stall zone.

Further more, given it seems decisions at Boeing have been made heavily for financial reasons on the MAX project - I would hope a full review of the certification is/has been made external of Boeing.

Training - FAA and Boeing seem against it other than an iPad slide show, a few more craters till that changes.

The faults in the US reported of altitude change when AP selected - has this problem been identified and rectified?

[HPSOV L]

What is conspicuously absent from the dialogue is any attempt to confirm that their airspeeds were indeed "normal". They were not. Despite having multiple warnings that are explicitly stated in AD 2018-23-51 (the 737 AD published post Lion Air), this crew made no apparent attempt to determine this crucial fact. If they had done so, then performance of the Airspeed Unreliable non-normal would have been anything but discretionary.

AD 2018-23-51 does not address Airspeed Unreliable. It is concerned with identifying a Runaway Stabilizer condition. It merely mentions symptoms that may indicate this condition. It does not direct pilots to perform Airspeed Unreliable actions in the event of stick shaker.
Yes, there was a slight difference between ASIs during climb out but at that stage was in the order of a few knots and practically speaking would probably be unnoticed in the dynamic period after liftoff, particularly in the absence of any alerts.
you are retrospectively creating a process based on assumptions that involve hindsight.

[737 Driver]

Yes, there was a slight difference between ASIs during climb out but at that stage was in the order of a few knots and practically speaking would probably be unnoticed in the dynamic period after liftoff, particularly in the absence of any alerts.


I'm not sure what you mean by "absence of any alerts." The stick shaker was activated. Is that an "alert"? They had a Master Caution associated with the alpha vane right after rotation. Was that an "alert"? The IAS Disagree annunciation appears on the PFD's when there is greater than a 5 knot difference for more than 5 seconds. That criteria was met in this case, so I'm fairly confident that this "alert" was also present. Despite these indications, there was no apparent attempt to cross check airspeeds even with an active stick shaker.

I'm not really sure what you are looking for here, because it doesn't get any more basic than this. The signs were there. We all agree they were unnoticed. Why those signs were unnoticed clearly points to a human factors issue.

[LowObservable]

We have an issue here that was fatal two times out of three. As far as we know.

Every airline in the world has contributed to an improving safety record over the years.

But people here are still pushing the "well, actually, had the crew had more basic flying skills, like us [adjective noun,unspoken] , it woulda been fine."

Would it?

[Bend alot]

We have an issue here that was fatal two times out of three. As far as we know.

Every airline in the world has contributed to an improving safety record over the years.

But people here are still pushing the "well, actually, had the crew had more basic flying skills, like us [adjective noun,unspoken] , it woulda been fine."

Would it?
A simply question - had these 3 crews been flying any other B737 predecessor, would the aircraft have crashed?

C/Would it?

[Capn Bloggs]

A simply question - had these 3 crews been flying any other B737 predecessor, would the aircraft have crashed?

C/Would it?
Obviously!

[Sinusoid]

A simply question - had these 3 crews been flying any other B737 predecessor, would the aircraft have crashed?

C/Would it?

No, I’m of the opinion that neither aircraft would have crashed had it been a pre-MAX 737. MCAS is solely responsible for the spurious AND trim. Compared to previous 73s this was an entirely new failure mode.

[HighWind]

Since this was a refurbished unit it is possible that it was mis-assembled or damaged on installation/test, only other possibility is a wiring issue, which might fit with prior unit being intermittently bad. One can be sure the investigators will be looking at this in depth.
Does the system have protection against using data from a sensor with internal or wiring issues?
Safety related angular encoders used in other industries are having a dual architecture inside, the labeling of signals SIN,COS, and COM on an conceptual drawing could indicate this. (Two independent channels: one analogue, and one digital)
This does however not protect against a sensor with a frozen, or damaged mechanical vane from providing false data.

[Bend alot]

Is that a obviously yes or a obviously no answer Capn Bloggs?

Keeping in mind, no other breed of the 737 would have put a nose down input to the stabiliser.

As a side, a run away stabiliser you would expect after a input was made and a stop of input expected, but did not happen. That is not what happened in these two cases as no nose down input should have happened (it was not an over run, but more like a 1958 red Plymouth Fury event)

[HPSOV L]

I'm not sure what you mean by "absence of any alerts." The stick shaker was activated. Is that an "alert"?

Not in Boeing parlance.

They had a Master Caution associated with the alpha vane right after rotation. Was that an "alert"?

Yes

The IAS Disagree annunciation appears on the PFD's when there is greater than a 5 knot difference for more than 5 seconds. That criteria was met in this case, so I'm fairly confident that this "alert" was also present.

"Fairly confident". Would you agree if the discrepancy at that stage was less than five knots there would be no such annunciation?


Despite these indications, there was no apparent attempt to cross check airspeeds even with an active stick shaker.

"apparent". ie nothing recorded on the CVR. You exclude the possibility of non-verbalised assessment?

I'm not really sure what you are looking for here, because it doesn't get any more basic than this. The signs were there. We all agree they were unnoticed. Why those signs were unnoticed clearly points to a human factors issue.

It would only be a human factors issue, in the negative sense, if it could be shown that there was a significant deviation from the performance that could be expected of an average crew on an average day. Your use of words such as "clearly" and "basic" are argumentative strategies to support your point of view but are not justified.
You are not building a watertight case.

[Capn Bloggs]

Is that a obviously yes or a obviously no answer Capn Bloggs?

Keeping in mind, no other breed of the 737 would have put a nose down input to the stabiliser.
Sorry there BAL, I misread your question. If you're used to manually trimming ie hand-flying, you're in a much better position to detect when the trim has gone haywire, and much more likely to do something about it ie trim back to neutral. It goes without saying that if you are used to handflying and trimming, when you are forced to, it won't be a total shock to have to do so and you'll have more spare brainspace to think about what is occurring and take action (or instruct your mate) to resolve the situation.

[GordonR_Cape]

Sorry there BAL, I misread your question. If you're used to manually trimming ie hand-flying, you're in a much better position to detect when the trim has gone haywire, and much more likely to do something about it ie trim back to neutral. It goes without saying that if you are used to handflying and trimming, when you are forced to, it won't be a total shock to have to do so and you'll have more spare brainspace to think about what is occurring and take action (or instruct your mate) to resolve the situation.

Not a pilot. To paraphrase what you seem to be saying: When all the trim automation (including MCAS) fails, it hands you a manually controlled aircraft, in a mis-trimmed configuration, that a pilot without frequent practice is unfamiliar with. Sounds like ET302, or is the problem more widespread?

[Icarus2001]

I will tell you where I sit on this, based upon 36 years of professional flying (31 airline, 5 military), type rated on B737-200/767/777/787 and Airbus A330/A340, and a Professional Engineer.

Thread drift...I clearly need to lift my game, respect sir.

[Bend alot]

Not a pilot. To paraphrase what you seem to be saying: When all the trim automation (including MCAS) fails, it hands you a manually controlled aircraft, in a mis-trimmed configuration, that a pilot without frequent practice is unfamiliar with. Sounds like ET302, or is the problem more widespread?
Automation generally will not trip/cut out when the flowers are in bloom, it trips out on during the hurricane/cyclone cat 5+

So say the autopilot - it will hold a wing out of balance until it can hold it no longer, then disengage from wings level. You will get a hard and fast roll.

[Dani]

IMHO the discussion goes in the wrong direction. We all know by now that it was a combination of technical and human errors that led to the accident of two 737MAX. Whether Boeing or the crews bear more responsibility is debatable.

The real question is: Why did the aircraft behave this way? We have to find out why they got into this situation, and only then we know how the problem can be solved, so the MAX goes in the air again. Some say it was MCAS and some say it was UAS, probe fault, whatever.

For me it is not a probe fault and not a MCAS fault. It is absolutely not logical that on a new aircraft in two instances a probe brakes. Very remote probability. It has been said after the accident that data calculation or computation from the AOA sensor might be missprogrammed. Only then MCAS calculates rubbish (old hacker's saying goes: rubbish in, rubbish out).

I don't know what Boeing tested a few days ago in the air, but hope it's not only MCAS software they changed...

Dani

[Cows getting bigger]

Some safety management thoughts. Below is a very basic and generic risk management matrix, something many of us will be familiar with and probably far more basic that the management system Boeing use.


https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/1272x587/5x5_risk_matrix_d51a054bee9784f6f3562bf19bfb3b89bcf99b01.png

Playing hypothetical, let's put ourselves in Boeing's safety management empire and apply this simple matrix to the issue of trim runaways. For the 737NG we may have assessed the likelihood of a runaway to be Possible with the impact being Low. This would 'score' a Yellow 6. We may then choose to reduce (mitigate) this score by applying a set procedure (stab switches etc) for an 'average' crew reducing the score to a Green 3.

Now add MCAS. The first thing we must do is assess the new likelihood of a trim runaway. It doesn't take the brains of a rocket scientist to realise that the likelihood has increased as you have an additional mechanism/bit of software that could instigate a runaway. Add-on the single-source AOA piece and the trim runaway likelihood probably jumps up quite a bit. So, one could now envisage a new likelihood score of Probable but still Low impact as, after all, it's still only a trim runaway. However, you now have a scored a Yellow 8. Add exactly the same 'average' crew and stab switch mitigation procedure and you have only reduced the score to a Yellow 4.

For sure, my scenario above is extremely basic but it is meant to offer that MCAS probably brought increased likelihood of a trim runaway but there appears to have been no effort (certainly prior to the LionAir crash) to put enhanced measures (hardware, software, training) in place to retain the original risk assessment score for such a failure. Introduction of MCAS without additional mitigations increased the overall risk associated with a trim runaway event. Boeing should have number crunched this one and it would be very interesting to see the numbers.

[737 Driver]

https://leehamnews.com/2019/04/15/training-is-a-factor-in-max-crashes/

[GordonR_Cape]

Cows getting bigger
Some safety management thoughts. Below is a very basic and generic risk management matrix, something many of us will be familiar with and probably far more basic that the management system Boeing use.

Introduction of MCAS without additional mitigations increased the overall risk associated with an unsatisfactory trim runaway event. Boeing should have number crunched this one and it would be very interesting to see the numbers.

If you change the scale in the matrix from linear to exponential, and divide by a standard of 1 in 10^9 flight hours, that might be a starting approximation. The introduction of MCAS seems to have produced an additional risk of the order of 10^2, or 100 times what might be expected from a new and untested system. The mitigating factors noted in the emergency AD may have been assumed to reduce the risk by a factor of 10^4, but probably did not by a factor 10^2, under real world conditions and with actual pilots.

[A37575]

Apologies if a similar posting has already been made among the over 4000 posts on the subject. Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity. Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim:

. "In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column

. This, combined with flap extension and reduced speed should permit easier manual trimming.If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim.

If nose-down trim is required, slowing down and extending the flaps will account for a large degree of nose-up pitch. If this does not allow manual trimming then the reverse "roller coaster" can be performed to permit manual trimming."

Boeing "Airliner" magazine published in May 1961 discussed the above subject as it applied to the Boeing 707 by stating: "To trim the stabilizer manually while holding a high stick force on control column. As the airplane changes altitude, crank in the desired trim change. Correct airplane attitude after a few seconds with elevators. Relax stick force again and crank in more trim. Repeat this procedure as necessary until proper 'trim' position of stabilizer is established."

We learned all about these maneuvers in the 1950-60s. Yet, for some inexplicable reason, Boeing manuals have since deleted what was then - and still is - vital handling information for flight crews. Finally, author D.P.Davies comprehensively covers the subject of large trim changes, failure cases and Mach number effect on stabilizers, at pages 38 to 42 in his fine book "Handling the Big Jets," A good case for current airline pilots to buy his book as it is still the best on the market,

IMHO, perhaps if the crews of the ill-fated Boeing 737-800MAX aircraft were familiar with this advice, current as far back as in 1982 and further back still to Boeing 707 types, they could have applied the roller coaster method to gain manual stabiliser control sooner; rather than be caught out by the stabiliser reaching full forward before attempting to trim manually.

[Ian W]

Is that a obviously yes or a obviously no answer Capn Bloggs?

Keeping in mind, no other breed of the 737 would have put a nose down input to the stabiliser.

As a side, a run away stabiliser you would expect after a input was made and a stop of input expected, but did not happen. That is not what happened in these two cases as no nose down input should have happened (it was not an over run, but more like a 1958 red Plymouth Fury event)

Your aside is very interesting and highlights a training issue. What you are saying is that in all your training, 'runaway stabilizer' is triggered by an input; consequently you believe that any other uncommanded running of the stabilizer should not be met with the runaway stabilizer NNC. Generalized, this becomes a requirement for every possible failure to be given its own NNC and trained specifically in the simulator which is obviously not sensible.

This highlights a problem in training which is almost certain with the limitations on time spent and a tick box approach. It would seem that there is a requirement for complex failures that do not fit in simple 'trigger an NNC' by rote responses, but which require some thought and it should be the analytical approach to some failures that is taught rather than only a limited set of [ -simple failure- -> by-rote-unthinking-response] exercises that require no understanding of what is being done.

[bill fly]

Apologies if a similar posting has already been made among the over 4000 posts on the subject. Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity. Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim:

. "In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column

. This, combined with flap extension and reduced speed should permit easier manual trimming.If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim.

If nose-down trim is required, slowing down and extending the flaps will account for a large degree of nose-up pitch. If this does not allow manual trimming then the reverse "roller coaster" can be performed to permit manual trimming."

Boeing "Airliner" magazine published in May 1961 discussed the above subject as it applied to the Boeing 707 by stating: "To trim the stabilizer manually while holding a high stick force on control column. As the airplane changes altitude, crank in the desired trim change. Correct airplane attitude after a few seconds with elevators. Relax stick force again and crank in more trim. Repeat this procedure as necessary until proper 'trim' position of stabilizer is established."

We learned all about these maneuvers in the 1950-60s. Yet, for some inexplicable reason, Boeing manuals have since deleted what was then - and still is - vital handling information for flight crews. Finally, author D.P.Davies comprehensively covers the subject of large trim changes, failure cases and Mach number effect on stabilizers, at pages 38 to 42 in his fine book "Handling the Big Jets," A good case for current airline pilots to buy his book as it is still the best on the market,

IMHO, perhaps if the crews of the ill-fated Boeing 737-800MAX aircraft were familiar with this advice, current as far back as in 1982 and further back still to Boeing 707 types, they could have applied the roller coaster method to gain manual stabiliser control sooner; rather than be caught out by the stabiliser reaching full forward before attempting to trim manually.

Yes it has been discussed here. It was intended to deal with a jet upset at higher level. Davies’ advice likewise.
If you relaxed pull at treetop height you would be in the deck before you could trim.

[caligul]

34 years aircraft maintenance.

Good post L39 - but MCAS is far from a stall protection (system). MCAS is a system that supplies an a feel to the control column, and the aircraft can fly perfectly without it.

But without MCAS the 737 MAX could not meet the certification requirements for Grandfather rights. Without the Grandfather rights the 737 MAX requires more certification and pilots will require extra training - this would make the MAX less desirable/competitive.

So the task was to incorporate a new system without calling it "new" and retain Grandfather rights. It seems to me that the priority was the "extra training" being minimal between the MAX and other 737's (you heavily touched training in your reply) and the result was a few hours of slides on an iPad that included nothing on the new system.
...

This is a critical aspect to me. Is this 100% confirmed that the reason for MCAS was to be grandfathered into the lightweight certification process? More precisely, could this exact same plane be normally certified *without* MCAS?

Thanks for your replies.

[L39 Guy]

34 years aircraft maintenance.

Good post L39 - but MCAS is far from a stall protection (system). MCAS is a system that supplies an a feel to the control column, and the aircraft can fly perfectly without it.

But without MCAS the 737 MAX could not meet the certification requirements for Grandfather rights. Without the Grandfather rights the 737 MAX requires more certification and pilots will require extra training - this would make the MAX less desirable/competitive.



FCeng84 earlier in this thread provided a really good explanation of what MCAS is all about; it's not there to provide a "feel" but rather to provide positive stability at high angles of attack (alphas). This is FAR's, EASA and every other certification agency requirement that the aircraft not be neutrally stable (nothing happens) or negatively stable (gets worse) near the stall but instead is positively stable (gets better but lowering the alpha). It only kicks in near the stall, assuming the sensors are working properly.

An MCAS failure, owing to the sensor failure (birdstrike or whatever other cause), causing the nose to pitch down in manual flight with the flaps up, presents identical characteristics to the pilot as a stab trim runaway (nose down) which has been taught on this aircraft forever. I can see why Boeing did not want to complicate things by creating a separate MCAS procedure as this would cause pilots to try to differentiate between a classic stab trim runaway and an MCAS failure while the aircraft is out-of-control. And since the emergency response is identical there is nothing to be gained either by trying to diagnose the problem in the air.

Although it might be politically more correct (optics) to insist on simulator training as the Transport Minister in Canada is doing, what is one going to practice? Airspeed Unreliable, which is part of the training and type certificate already? Stab trim runaway, which is part of the training and type certificate already too?

[Organfreak]

FCeng84 earlier in this thread provided a really good explanation of what MCAS is all about; it's not there to provide a "feel" but rather to provide positive stability at high angles of attack (alphas).

I have no authority or credibility here since I'm no pilot, but I've been carefully following this thread from post #1, and the above statement is simply incorrect, if you'll excuse my saying so. (I thought your long post was superb in its clarity.) MCAS was specifically put in place to satisfy regulatory requirements for "feel." I think that info is on Page 1 of this thread.

[MurphyWasRight]

An MCAS failure, owing to the sensor failure (birdstrike or whatever other cause), causing the nose to pitch down in manual flight with the flaps up, presents identical characteristics to the pilot as a stab trim runaway (nose down) which has been taught on this aircraft forever. I can see why Boeing did not want to complicate things by creating a separate MCAS procedure as this would cause pilots to try to differentiate between a classic stab trim runaway and an MCAS failure while the aircraft is out-of-control. And since the emergency response is identical there is nothing to be gained either by trying to diagnose the problem in the air.


Not exactly the same signs as stab trim runaway which would be trained/expected to be continuous whereas MCAS (unpatched) worked in up to 10 second bursts then stops until the next pilot trim input.

A MCAS checklist could stress both the need for and safety of -fully- trimming before using the cutout switches to avoid possibility of manual trim not working due to aero loads.

Had this been included in the AD in response to Lion Air it may have helped.

In roughly the time it takes to read this post MCAS provided 2 nose down inputs to ET.

[ManaAdaSystem]

FCeng84 earlier in this thread provided a really good explanation of what MCAS is all about; it's not there to provide a "feel" but rather to provide positive stability at high angles of attack (alphas). This is FAR's, EASA and every other certification agency requirement that the aircraft not be neutrally stable (nothing happens) or negatively stable (gets worse) near the stall but instead is positively stable (gets better but lowering the alpha). It only kicks in near the stall, assuming the sensors are working properly.

An MCAS failure, owing to the sensor failure (birdstrike or whatever other cause), causing the nose to pitch down in manual flight with the flaps up, presents identical characteristics to the pilot as a stab trim runaway (nose down) which has been taught on this aircraft forever. I can see why Boeing did not want to complicate things by creating a separate MCAS procedure as this would cause pilots to try to differentiate between a classic stab trim runaway and an MCAS failure while the aircraft is out-of-control. And since the emergency response is identical there is nothing to be gained either by trying to diagnose the problem in the air.

Although it might be politically more correct (optics) to insist on simulator training as the Transport Minister in Canada is doing, what is one going to practice? Airspeed Unreliable, which is part of the training and type certificate already? Stab trim runaway, which is part of the training and type certificate already too?

Except it’s not the same. MCAS does not present itself as a standard runaway trim. It only works with flaps up. It doesn’t trim non stop. And it trims with high speed where a normal trim trims with reduced speed.
It’s a different animal and doesn’t bite the same way.

[Smythe]

The information states that MCAS trims nose down 2.5 degrees in 10 seconds. Is this all or nothing?

Is there an indication at what AoA the bump in lift occurs?

[Organfreak]

The information states that MCAS trims nose down 2.5 degrees in 10 seconds. Is this all or nothing?

Yep. It's going to be changed.

Is there an indication at what AoA the bump in lift occurs?

Depends on many other factors. (All I know is what I read here.)

[Smythe]

Quote: Is there an indication at what AoA the bump in lift occurs?
Depends on many other factors. (All I know is what I read here.)
Thanks, I understand this, but if one follows the scenario that the 738 and the 737-8 are so similar that a powerpoint is all that is required, then considering all of the factors being the same or similar, when does the 737-8 pitch up vs the 738?
I am trying to word this correctly...

[GordonR_Cape]

The information states that MCAS trims nose down 2.5 degrees in 10 seconds. Is this all or nothing?

Is there an indication at what AoA the bump in lift occurs?

Many pages back, in another thread LEOCh posted a schematic chart showing a nasty inflection between 10 and 15 degrees AOA, which is when MCAS kicks in. Once AOA is below 10 degrees, MCAS unwinds the nose-down trim (unless the pilots intervene with electrical trim inputs).

for want of more accurate values, the nacelle lift region stretches from AoA 8' to 14' (where the wing stalls)

See: https://www.pprune.org/showthread.php?p=10423226


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/782x523/737max_42ba748ff04066af5c42a57f1265dc0bd62f9898_06ff519b7dac 6772c77a76f7ed7fa340be861f61.jpg

[GordonR_Cape]

It is a shame that the Mentour Pilot video has been disabled, I managed to watch it and it showed what happens when the IAS disagree and runaway trim checklist are followed in the (presumed) ET MCAS case. Overall fairly similar to your scenario.

The pilots in the sim calmly and methodically followed the checklists in what I would call a demonstrating or teaching mode, certainly not stressed or surprised. Don't believer they even had a stick shaker going.

Even so they ended up in a state where manual trim inputs were physically close to impossible after electrical trim cutout due to the air speed.
My takeaway was that unless the pilot trimmed close to neutral before electrical tim cutout there was no way to manually trim.
Note that this should be possible (as shown in both lion air flights) since pilot trim cancels (for 5 seconds) MCAS trim actions.

One other observation from the video is that from the jumpseat camera point of view the trim wheel action is very obvious. I suspect it might be much less so for stressed pilots trying to make sense of the situation. This may be why the jumpseat pilot was able to save the penultimate Lion air flight.

Mentour pilot's video was fantastic, it was uploaded prior to the publication of the preliminary report, it's a shame he has removed it.

Mentour pilot has uploaded a completely new video about B737 trim issues. It covers a lot of familiar territory, but does include some of the relevant footage from the (deleted) video that was referred to in the Leeham News article:

Edit: Skip forward to 10 mins to see the actual footage.

https://www.youtube.com/watch?v=aoNOVlxJmow

[TryingToLearn]

OK, first: I'm not a pilot, I'm a functional safety engineer, mostly working for automotive.
Second: I read this thread from the beginning and learned a lot, thanks!

But I think I can explain one tendency which went up:
Pilots blame the pilots, engineers blame the Boeing engineers.

From my point of view, the reason in both cases is the same:
Pilots know the processes and trained procedures for pilots and learned, that the crews didn't follow them completely and textbook-like but rather improvised. But they do not know the engineering process regarding safety-critical systems/hardware/software.
With the engineers it is exactly otherwise. They see a crew overwhelmed by alarms, shakers and informations caused by an engineering error. For them (sorry) the pilot is the last line of defense in case they did not do their job of everything goes wrong (multiple point fault).

Pilots follow procedures which e.g. minimize the risk to take off with a wrong configuration, They double-check and check again and have proven-in-use procedures which make sure that such things happen less than one in a million flights.
Engineers know proven-in-use processes which make sure that something like the current MCAS system effectively never happens.
Still it happened.

Boeing knows why they put all focus on how great they fix MCAS because if someone asks the right question, they are in much deeper trouble like, for example Volkswagen:
The big punishment for them was not fixing the cars but they had to implement a process that makes sure that this never happens again.

So far nobody asked Boeing how something so obvious and big could slip thru their safety process including document reviews, walk-thru, inspections, accessments and linked documents on several layers of detail. And, in addition, how this would not be found in all the classic safety/quality analysis methods (FMEDA, FMEA, FTA, DFA...).
Safety is not based on the genius of the one great programmer who is also a pilot and simulates every thin in his head (but makes a mistake after having too much pizza) but rather a strict process including a lot of people and a lot of documentation and testing.

Within this thread, pilots question the training and qualification of mainly all pilots regarding critical situations. But they are the last line of defense.
Following the same logic, one could question the qualification, independence and culture of Boeing safety engineers.
And yes, that would lead to the question if there are other functions like MCAS still hidden...

Maybe the pilots may have been able to safe a few lives, but the biggest mistakes happened years before driven by
-> Strange laws (Grandfather rights)
-> Commercial interest (no training)
-> inconsistent requirements / documentation (0,6 within risk analysis and 2.5 within SW)
-> Maybe bad safety culture if this was done on purpose and not by mistake
-> Mistakes within the impact analysis of a wrong MCAS activation

If I would be a member of the FAA or similar organization, I would not focus on MCAS and the bugfix, I would simply aks: What went wrong within the engineering process and how can you prove that no other hazards excaped thru the exact same hole in your process.
The deviation from established engineering rocesses I assume here in my opinion far exceeds the deviation between the trim runaway procedure and what actually happened.

But as mentioned: I'm not a pilot.

[Chronus]

There was a time when pilots talked about the laws of aerodynamics in a language that was clear, concise and understood by the aviation community. Now the language has changed, it is full of computer terminology. Yet despite all that talk about all sorts of wizardry with computers, the laws of aerodynamics remain unchanged. It is those that have resulted in a ten meter crater in this instance, it is that very combat between this new phenomenon and the basics of aerodynamics that we seem to put our faith and trust . I ask this question, Is the whole scenario really that much different to the VW emissions scandal.

[L39 Guy]

Not exactly the same signs as stab trim runaway which would be trained/expected to be continuous whereas MCAS (unpatched) worked in up to 10 second bursts then stops until the next pilot trim input.

A MCAS checklist could stress both the need for and safety of -fully- trimming before using the cutout switches to avoid possibility of manual trim not working due to aero loads.

Had this been included in the AD in response to Lion Air it may have helped.

In roughly the time it takes to read this post MCAS provided 2 nose down inputs to ET.

The Runaway Stabilizer checklist states "Condition: Uncommanded stabilizer trim movement occurs continuously". I think we can agree that an MCAS event is "uncommanded".
What does continuous mean? 5 seconds, 10 seconds, 1 minute, one hour? And let's say that the uncommanded stabilizer trim movement is caused by an intermittent short circuit somewhere (trim switch, wiring harness, etc) that produces a 5 second, 10 second, 1 minute uncommanded stabilizer trim movement? How can you tell the difference? Do you really care what the source is? Does the source affect the outcome? Do you really think that someone flying along, fat, dumb and happy and suddenly has the nose pitch down will have the presence of mind to count how long the trim is moving? I would suggest the shock value would preclude that.

As well, one does not want to get into the game of diagnosing the source of the failure (MCAS or otherwise) while the control of the aircraft is at stake. One checklist to cover all scenarios is more than adequate. Secure the malfunction, fly the airplane and land asap and save the diagnosis and troubleshooting once you're back on terra firma.

[Loose rivets]

We keep going back to the limited electrical trimming applied by the captain. Or should it be electrical trimming achieved?

I'm really puzzled by the fuzzy inputs - just about on the centre vertical of the graph. More like noise than a specific thumb input, or even a few inputs.


https://cimg9.ibsrv.net/gimg/pprune.org-vbulletin/888x334/trim_switch_difficulties_3c99c08ee6813db023b07efb5be2a82ee9f 717fb.jpg

[Jetman346]

Hi all

just read an interesting news story about all cirrus vision jets being grounded due to faulty aoa information forcing the nose down in some instances

https://www.flyingmag.com/faa-grounds-cirrus-vision-jets

[MurphyWasRight]

The Runaway Stabilizer checklist states "Condition: Uncommanded stabilizer trim movement occurs continuously". I think we can agree that an MCAS event is "uncommanded".
What does continuous mean? 5 seconds, 10 seconds, 1 minute, one hour? And let's say that the uncommanded stabilizer trim movement is caused by an intermittent short circuit somewhere (trim switch, wiring harness, etc) that produces a 5 second, 10 second, 1 minute uncommanded stabilizer trim movement? How can you tell the difference? Do you really care what the source is? Does the source affect the outcome? Do you really think that someone flying along, fat, dumb and happy and suddenly has the nose pitch down will have the presence of mind to count how long the trim is moving? I would suggest the shock value would preclude that.

As well, one does not want to get into the game of diagnosing the source of the failure (MCAS or otherwise) while the control of the aircraft is at stake. One checklist to cover all scenarios is more than adequate. Secure the malfunction, fly the airplane and land asap and save the diagnosis and troubleshooting once you're back on terra firma.

Totally agree that no one is going to time the length of the runaway, at least I would hope not - act as soon as it is seen.

My point was more about the nature of the emergency AD that could have been much clearer about uncommanded trim that stops with any pilot trim then restarts about 5 seconds later.
In that case stress importance of first fully trimming then hitting cutout.
This is hinted at in a note at the end of the procedure, I say it should have been highlighted.

Unlike 'stuck switch" uncommanded trim the MCAS case does allow for pilot electrical trim first then followed by cutout, a quick blip of the switch is all that would be needed to test if this was possible. That could be a step in the runaway trim procedure, I agree do not need a seperate MCAS checklist if that was included.

As I said before I am sure Boeing pilots/engineer could come up with a clear procedure if given the mandate to do so.

[Smythe]

So far nobody asked Boeing how something so obvious and big could slip thru their safety process including document reviews, walk-thru, inspections, accessments and linked documents on several layers of detail.

Boeing must have known something was up if the computer modelling showed that MCAS needed to provide 0.6 degrees correction, and in flight testing, 2.5 degrees was required. That is a big disconnect between design assumptions and actual.

What went wrong within the engineering process and how can you prove that no other hazards excaped thru the exact same hole in your process.

There are 4 interfaces for the Horizontal Stabilizer portion of the Flight Control System (FCS), which link the autopilot trim, electric trim, manual trim, and MCAS trim to the stabilizer trim system.

EDIT: Just read this...
Boeing is currently examining whether or not the current MCAS interface between the MCAS computers and the horizontal stabilizer trim motors and Horizontal Stabilizer Jackscrew is compatible with the MCAS software updates.

As MCAS was an option for other 737 variants, (as well as other Boeing aircraft) it would be interesting to see what those systems provided as a correction. (perhaps to the 738?)

On a historical note, it appears that MCAS has been considered for most Boeing aircraft, but that the vortex tabs solved the problem....now we know why they are still on all of the wings.

[L39 Guy]

My point was more about the nature of the emergency AD that could have been much clearer about uncommanded trim that stops with any pilot trim then restarts about 5 seconds later.
In that case stress importance of first fully trimming then hitting cutout.
This is hinted at in a note at the end of the procedure, I say it should have been highlighted.

Unlike 'stuck switch" uncommanded trim the MCAS case does allow for pilot electrical trim first then followed by cutout, a quick blip of the switch is all that would be needed to test if this was possible. That could be a step in the runaway trim procedure, I agree do not need a seperate MCAS checklist if that was included.

I think that’s a good observation. Sorry for misinterpreting your original intent.

[FrequentSLF]

The Runaway Stabilizer checklist states "Condition: Uncommanded stabilizer trim movement occurs continuously". I think we can agree that an MCAS event is "uncommanded".
What does continuous mean? 5 seconds, 10 seconds, 1 minute, one hour? And let's say that the uncommanded stabilizer trim movement is caused by an intermittent short circuit somewhere (trim switch, wiring harness, etc) that produces a 5 second, 10 second, 1 minute uncommanded stabilizer trim movement? How can you tell the difference? Do you really care what the source is? Doesa) the source affect the outcome? Do you really think that someone flying along, fat, dumb and happy and suddenly has the nose pitch down will have the presence of mind to count how long the trim is moving? I would suggest the shock value would preclude that.

As well, one does not want to get into the game of diagnosing the source of the failure (MCAS or otherwise) while the control of the aircraft is at stake. One checklist to cover all scenarios is more than adequate. Secure the malfunction, fly the airplane and land asap and save the diagnosis and troubleshooting once you're back on terra firma.

other than MCAS can be stopped by a simple use of the thumb switch on the yoke, MCAS will not be keep going runaway, will just pause for 5 seconds and than restart.
MCAS has also a much different logic, including new cutoff logic than previous versions, a runaway trim can be in both directions, while MCAS is only in nose down, and can be stopped without cutout...to me as non pilot does not look like a memory item

[ozaub]

TryingtoLearn #4154 rightly asks “What went wrong within the engineering process and how can you prove that no other hazards excaped thru the exact same hole in your process.”
787 was first aircraft certificated (partly) under new ''Organisation Designation Authorisation'' (ODA) arrangements, specifically intended to reduce FAA involvement. NTSB Report 2014/AIR1401 tells us what went wrong and how hazardous batteries slipped thru.
“Boeing’s electrical power system safety assessment did not consider the most severe effects of a cell internal short circuit and include requirements to mitigate related risks, and the review of the assessment by Boeing authorized representatives and Federal Aviation Administration certification engineers did not reveal this deficiency"
.”Boeing failed to incorporate design requirements in the 787 main and auxiliary power unit battery specification control drawing to mitigate the most severe effects of a cell internal short circuit, and the Federal Aviation Administration failed to uncover this design vulnerability as part of its review and approval of Boeing’s electrical power system certification plan and proposed methods of compliance".
"Unclear traceability among the individual special conditions, safety assessment assumptions and rationale, requirements, and proposed methods of compliance for the 787 main and auxiliary power unit battery likely contributed to the Federal Aviation Administration’s failure to identify the need for a thermal runaway certification test.”
787 battery fires could easily have cost two planes and all on board. Boeing/FAA Corp. failed to learn. 737 Max is second Boeing certificated under ODA.

[DaveReidUK]

As MCAS was an option for other 737 variants

Can you expand on that? Have any (non-Max) 737 operators opted for MCAS on their aircraft? Why would they need it?

[Rated De]

OK, first: I'm not a pilot, I'm a functional safety engineer, mostly working for automotive.
Second: I read this thread from the beginning and learned a lot, thanks!

But I think I can explain one tendency which went up:
Pilots blame the pilots, engineers blame the Boeing engineers.

From my point of view, the reason in both cases is the same:
Pilots know the processes and trained procedures for pilots and learned, that the crews didn't follow them completely and textbook-like but rather improvised. But they do not know the engineering process regarding safety-critical systems/hardware/software.
With the engineers it is exactly otherwise. They see a crew overwhelmed by alarms, shakers and informations caused by an engineering error. For them (sorry) the pilot is the last line of defense in case they did not do their job of everything goes wrong (multiple point fault).

Pilots follow procedures which e.g. minimize the risk to take off with a wrong configuration, They double-check and check again and have proven-in-use procedures which make sure that such things happen less than one in a million flights.
Engineers know proven-in-use processes which make sure that something like the current MCAS system effectively never happens.
Still it happened.

Boeing knows why they put all focus on how great they fix MCAS because if someone asks the right question, they are in much deeper trouble like, for example Volkswagen:
The big punishment for them was not fixing the cars but they had to implement a process that makes sure that this never happens again.

So far nobody asked Boeing how something so obvious and big could slip thru their safety process including document reviews, walk-thru, inspections, accessments and linked documents on several layers of detail. And, in addition, how this would not be found in all the classic safety/quality analysis methods (FMEDA, FMEA, FTA, DFA...).
Safety is not based on the genius of the one great programmer who is also a pilot and simulates every thin in his head (but makes a mistake after having too much pizza) but rather a strict process including a lot of people and a lot of documentation and testing.

Within this thread, pilots question the training and qualification of mainly all pilots regarding critical situations. But they are the last line of defense.
Following the same logic, one could question the qualification, independence and culture of Boeing safety engineers.
And yes, that would lead to the question if there are other functions like MCAS still hidden...

Maybe the pilots may have been able to safe a few lives, but the biggest mistakes happened years before driven by
-> Strange laws (Grandfather rights)
-> Commercial interest (no training)
-> inconsistent requirements / documentation (0,6 within risk analysis and 2.5 within SW)
-> Maybe bad safety culture if this was done on purpose and not by mistake
-> Mistakes within the impact analysis of a wrong MCAS activation

If I would be a member of the FAA or similar organization, I would not focus on MCAS and the bugfix, I would simply aks: What went wrong within the engineering process and how can you prove that no other hazards excaped thru the exact same hole in your process.
The deviation from established engineering rocesses I assume here in my opinion far exceeds the deviation between the trim runaway procedure and what actually happened.

But as mentioned: I'm not a pilot.

Normailisation of Deviance.

It happens an increment at a time.

[HighWind]

"Maybe the pilots may have been able to safe a few lives, but the biggest mistakes happened years before driven by
-> Strange laws (Grandfather rights) "

Within the machine industry there is no 'Grandfather rights', not in the European Machinery Directive, and US NFPA
https://www.robotics.org/content-detail.cfm/Industrial-Robotics-Tech-Papers/You-Can-t-Grandfather-Safety/content_id/6622

[Nigel Tufnel]

Been following most of this thread with interest since it stared, but appologise if this has already been posted. I can't post the URL as I haven't posted 10 times , but its a page from Spectrum.ieee org by a software developer and pilot, and looks at the 737 Max disaster from a software developers point of view.


This bit in particular sums it all up for me, whereby the author compares the installation of fitting an Autopilot to his Cessna 172 and the certification of MCAS on the Max 8

"As you can see, the similarities between my US $20,000 autopilot and the multimillion-dollar autopilot in every 737 are direct, tangible, and relevant. What, then, are the differences?
For starters, the installation of my autopilot required paperwork in the form of a “Supplemental Type Certificate,” or STC. It means that the autopilot manufacturer and the FAA both agreed that my 1979 Cessna 172 with its (Garmin) autopilot was so significantly different from what the airplane was when it rolled off the assembly line that it was no longer the same Cessna 172. It was a different aircraft altogether.
In addition to now carrying a new (supplemental) aircraft-type certificate (and certification), my 172 required a very large amount of new paperwork to be carried in the plane, in the form of revisions and addenda to the aircraft operating manual. As you can guess, most of those addenda revolved around the autopilot system.
Of particular note in that documentation, which must be studied and understood by anyone who flies the plane, are various explanations of the autopilot system, including its command of the trim control system and its envelope protections.
There are instructions on how to detect when the system malfunctions and how to disable the system, immediately. Disabling the system means pulling the autopilot circuit breaker; instructions on how to do that are strewn throughout the documentation, repeatedly. Every pilot who flies my plane becomes intimately aware that it is not the same as any other 172.

This is a big difference between what pilots who want to fly my plane are told and what pilots stepping into a 737 Max are (or were) told.

Another difference is between the autopilots in my system and that in the 737 Max. All of the CAN bus–interconnected components constantly do the kind of instrument cross-check that human pilots do and that, apparently, the MCAS system in the 737 Max does not. For example, the autopilot itself has a self-contained attitude platform that checks the attitude information coming from the G5 flight computers. If there is a disagreement, the system simply goes off-line and alerts the pilot that she is now flying manually. It doesn’t point the airplane’s nose at the ground, thinking it’s about to stall.

Perhaps the biggest difference is in the amount of physical force it takes for the pilot to override the computers in the two planes. In my 172, there are still cables linking the controls to the flying surfaces. The computer has to press on the same things that I have to press on—and its strength is nowhere near as great as mine. So even if, say, the computer thought that my plane was about to stall when it wasn’t, I can easily overcome the computer.

In my Cessna, humans still win a battle of the wills every time. That used to be a design philosophy of every Boeing aircraft, as well, and one they used against their archrival Airbus, which had a different philosophy. But it seems that with the 737 Max, Boeing has changed philosophies about human/machine interaction as quietly as they’ve changed their aircraft operating manuals."

[Smythe]

Quote: As MCAS was an option for other 737 variants
Can you expand on that? Have any (non-Max) 737 operators opted for MCAS on their aircraft? Why would they need it?

In reading through the volumes of data, on AoA...I did read where it was either offered or going to be offered on the entire 737 line. I dont know if and when it was offered. The issue of the vortex tabs was included in this explanation. It may be when they were trying to get rid of the tail tabs, but unclear when it stated vortex tabs, which ones they were talking about.
Perhaps they were just going to offer MCAS for stall protection, I dont know. Now that the internet is inundated with information on this, it will have to dig to find this.

MCAS is standard on the 767 tanker, but is different..this seems to be a much better system , 2 sensors, and disco on pilot input.
The KC-46 uses a similar system because the weight and balance of the tanker shifts as it redistributes and offloads fuel. The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.
Moreover, while the MAX 8 MCAS will reset and come back on automatically, the KC-46’s system is “disengaged if the pilot makes a stick input,” according to the Air Force. “The KC-46 has protections that ensure pilot manual inputs have override priority.”

[MemberBerry]

OK, first: I'm not a pilot, I'm a functional safety engineer, mostly working for automotive.
Second: I read this thread from the beginning and learned a lot, thanks!

But I think I can explain one tendency which went up:
Pilots blame the pilots, engineers blame the Boeing engineers.


Good point. I also read this thread from the beginning and, to add another data point to the tendency you noticed, I'm a software engineer and I tend to blame Boeing more than the pilots. Boeing's attitude after the Lion Air accident contributed to that. If they didn't try to downplay the gravity of experiencing an incorrect MCAS activation, I would have probably been more sympathetic towards them.

Just like there seems to be a deficit of pilots in the aviation world, I think that generally there is a deficit of good software developers, and it's getting worse. I think the quality of software took a nosedive during the last decade. Software from a decade ago was way more polished than what I see today, and this is very frustrating.

Sure, just as the safety of air travel is getting better and better, a lot of lessons have been learned from the past in the software industry, and some types of bugs and quality issues are becoming less and less frequent. But there seems to be a lot less attention to detail, and I find it unbelievable that large software companies repeatedly release software products with significant bugs, that should are obvious to anyone after only a few minutes of using the product.

And I don't think it's just the deficit of good software developers causing this. I see a variety of other factors contributing to the decline in the quality of software, for example a tendency to spend less on quality assurance, and relying more and more on the end users to find and report quality issues with the software products. I hoped this trend would affect mostly regular consumer products, and not software that is critical for safety, but unfortunately that doesn't seem to be the case, some recent examples being the Tesla self driving car software, and possibly MCAS.

Anyway, back to the MCAS topic, I watched Mentour's recent video about being unable to trim manually at high speeds when the aircraft is severely out of trim. One thing that surprised me is that the simulator, which Mentour described as: "this is a level D FFS. That’s as real as it gets", is not able to replicate a stabilizer runaway similar to an incorrect MCAS activation, the runaway stabilizer failure is not able to bring the trim to full AND.

I guess the reason the simulated failure is not able to apply more AND trim is that it simulates something similar to stuck yoke trim switches. In such a situation, after reaching about 4 units with the flaps retracted, the trim limit switches would activate. That would prevent the trim from going lower than 4 units. I think that's why they have to trim manually the wrong way in the video, to try to simulate a worse mistrim, similar to that experienced by the Lion Air and Ethiopian pilots, because the simulator doesn't seem to be able do that.

If that's the case, I'm even more annoyed by Boeing's initial response that the pilots they should have just applied the runway stabilizer procedure. If the simulators are not able to replicate a mistrim as severe as one caused by a malfunctioning MCAS, clearly the existing simulator training for a stabilizer runaway failure is not entirely adequate for dealing with an MCAS induced trim runaway.

[EPHD75]

I think your analysis and continuum of blaming the pilots/Boeing and everyone else harmless to blame Boeing and everyone else/pilots harmless is a nice summary.

I will tell you where I sit on this, based upon 36 years of professional flying (31 airline, 5 military), type rated on B737-200/767/777/787 and Airbus A330/A340, and a Professional Engineer.

First, aircraft are amazing and complex machines. Aircraft do what man was never intended to do naturally so there is an inherent risk in that alone. But even the best designed and best maintained aircraft have components that break and the human onboard is the last line of defense in many of those instances. Hydraulic systems, electrical systems, pressurization systems, propulsion systems (engines) all fail and often there is not double or triple redundancy due to weight issues, cost issues, probability of failure and the impact of a failure. As an example, there is no level of redundancy that will offset an engine failure no matter how many engines the aircraft has; the adverse yaw, the reduced performance, etc cannot be compensated for by having more engines, although the more engines an aircraft has, the less effect a single engine failure has. Aircraft manufacturers, at the urging of their airline customers, like two engine aircraft for the economics (one engine versus two, reduced fuel, reduced weight, etc). So we accept that fact that an engine failure on a two engine aircraft will have big affect when one fails, more than a single engine failure on an eight engine aircraft.

So when an engine (or hydraulic, or electric, or pressurization) system fails a pilot is in the loop to manage the situation. That is why we are highly trained and, hopefully, well compensated financially for that knowledge and judgement. The level of training lies with the individual knowing their stuff including their emergencies, particularly emergencies that are memory items - that is a personal responsibility of any professional pilot. The airline and country CAA is responsible too for insuring that the pilots charged with responsibility for that aircraft and those lives in the aircraft are also trained properly initially and on a recurrent basis.

Where do I sit on your continuum? Somewhere between 2 and 3. MCAS is a required stall protection however it needs to be toned down a bit as it can move the stabilizer trim to very large aircraft nose down angles. Should pilots be aware of MCAS in their technical training on the MAX; sure, but it would not have affected the outcome regardless as, I will describe shortly, MCAS failure presents characteristics identical to a stabilizer trim runaway, an emergency checklist item that has been around since the original B737 fifty years ago.

I would expect that any pilot with a type rating for a Boeing 737, MAX included, should be able to identify an Unreliable Airspeed (UAS). That is basic stuff, stick shaker when the aircraft if flying normally, disparity between the indicated airspeeds, etc. Any professional pilot should be able to recognize this regardless of what aircraft they are flying as every aircraft in the world is subject to this problem.

Only 2 of the 3 non-US MCAS incidents saw the pilots recognize the UAS and do something about it. This was long before MCAS reared its ugly head so that begs the question: Why? Training and experience would be my answer. And, as it turned out, the crew that did execute the UAS drill were the ones that ultimately saved the aircraft. Bear in mind that UAS is a memory drill. To me, there is no excuse why this was not done as it was a textbook UAS; to me also, in the Ethiopian case, engaging the autopilot at 400 ft is a definite faux pas as it is contrary to the memory UAS drill and, if the aircraft was indeed stalled, another definite faux pas as one does not recover from a stall with the autopilot. This points to a training/experience issue too but it also points to an over reliance on the use of the autopilot at the expense of hand flying an airplane. This too is likely an airline/CAA issue as well as an individual pilot issue. And, not to imply that this is a "third world" country issue as I am seeing this more and more with the FO's I fly with; they are terrified to hand fly the aircraft and hence their hand flying skills begin to decline.

When all of these crews experienced MCAS, 0 of 3 were able to recognize a classic stab trim runaway; while manually flying the aircraft, the nose pitches down all by itself. You simply can't miss it, with or without seeing the stab trim wheel moving. In the Lion Air case where the aircraft was saved, it took a third pilot from a different airline to tell the crew what to do; in the case of the fatal Lion Air accident, the Captain handed control to the First Officer so he could go hunting through the checklist for something to do - this is a memory drill! I fault the individual pilots for not knowing their memory emergencies - harsh as that may sound, that is what we are paid for. (Personally, I do a study of the memory emergencies regularly as the memory isn't what it used to be and I like to think that most professionals pilots do the same).

I am not going to rehash the rest of the issues (flying to destination with this problem, not controlling the aircraft speed in the Ethiopian case, etc) as that would be covering old ground but there are lots of basic airmanship issues that are highly questionable.

In conclusion, all of these MCAS issues were recoverable situations by a trained and competent crew. I do not blame the individuals entirely as the airline, their training, their hand flying policies as well as the CAA overseeing them deserve scrutiny too however. Let me repeat that: These MCAS accidents were all recoverable. Boeing's mistake, in addition to what I noted earlier, is assuming that B737 type rated pilots would be able to do even the most basic, memory emergency drills. This, however, begs the question: If pilots cannot even do a simple UAS emergency, what hope do they have for a more complex one such as an engine failure at rotation or an engine failure followed by a cabin depressurization which that Southwest crew handled masterfully?

What this MCAS situation points to, in my estimation, is that the aviation industry has been "whistling past the graveyard" for a little too long and that the underlying problems quickly manifest themselves with even the slightest irregularity - the Turkish B737 accident at Schipol, the Korean 777 in SFO, etc.. A complete rethink of pilot training, basic flying skills and airmanship are in order as there is a finite limit to what Boeing, Airbus, Embraer or any other aircraft manufacture can do to design and build airplanes without human intervention being required a certain times by competent aviators.

Hello all:
Today I registered for this board although I probably will never post here again. I have lurked for years as I find the topics here of great interest. First, I am not a pilot but a doctorate level engineer who has spent close to 40 years in aerospace design and engineering in the United States.
I am posting today to express my deep appreciation to L39 for his insightful, articulate, and erudite post. In my profession and leisure life I am a (very) frequent flyer. Many of the locations my wife and I travel require one or more 737 flights. I have been following the terrible Max accidents from the initial Lion Air loss, as many of my business and leisure legs have been assigned to 737 Max aircraft. After the second loss I was prepared to find other means rather than board a Max flight, but of course the grounding eliminated the need. Reading every Max related post on this board I must say that I was not encouraged by the tone of many, but not all, of the posts. There seemed to be a widespread feeling expressed among many of the professional pilots that seemed to me as rejection of any thought that the unfortunate crews had any blame in the losses, and that Boeing was to blame completely. The reason that disturbed me so much was that we in the traveling public depend totally on the skill and knowledge of the flight crew. We are totally in your hands. From my background I do understand technically what happened in these accidents and to me, from a technical perspective, it seemed that they should have been recoverable. Despite the challenging human factors environment.
Then finally after 3 months, L39 comes along and tells me exactly what I was looking for in all these posts. If I may repeat your words "....These MCAS accidents were all recoverable......" When I board a flight I need to feel confident that the crew in the cockpit can fly me (and themselves) to our destination safely. After L39's post my confidence is now coming back. I just hope that the confidence and preparation L39 exemplifies is widespread beyond just the people who post here.
Thank you L39 once again.

[boofhead]

The real problem is not the MCAS system. It is the lack of experience and ability of the pilots to handle a simple mechanical failure. That is their job; the last defense against disaster. There were many ways the pilots on those airplanes could have safely landed their aircraft but they failed. As we replace experienced pilots with newbies who only see the career of an airline pilot as a job that is easier to get than that of a doctor or engineer and pays more with more time off, we will see the same errors and failures here too. I forecast that our safest days in aviation are behind us and we will see a strong uptick in pilot error accidents. We should be using this MAX8 affair as a wakeup call to improve the skills and experience of our flight crews. If we cannot train pilots and give them a chance to gain experience before they start sitting in the left seat they will be what we are producing now: Button Pushers.

[patplan]

I think your analysis and continuum of blaming the pilots/Boeing and everyone else harmless to blame Boeing and everyone else/pilots harmless is a nice summary...snipped...

Only 2 of the 3 non-US MCAS incidents saw the pilots recognize the UAS and do something about it.
I'm confused had there been any US MCAS incidents?? Can you at least cite me one case?

...And, as it turned out, the crew that did execute the UAS drill were the ones that ultimately saved the aircraft.
I will just concentrate on Lion Air Flight JT610.
How do you know the CAPT on that flight didn't perform UAS NNC? Did you get a hold of the CVR's transcript? We know there wasn't any CVR's transcript on Lion Air JT610 Preliminary Crash Investigation because they still haven't recovered the JT610's CVR at that juncture. The CVR was buried beneath a thick mud of Java Sea for almost 60 days before they finally recovered it. And, no official transcript has been released by the officials thus far.

Furthermore, the crew had been briefed about the malfunctions and the fixes by the MX on the ground, plus there was a log left by the previous crews [Flight JT043] written as:

"Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the
wrong direction, suspected because of speed difference, identified that CAPT instrument
was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT
disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L."

Wouldn't you think the first thing flashed on the CAPT's mind should there be trouble with the aircraft is to recall the previous flight's log entry which explained, among other things, the crews' execution of the Airspeed Unreliable NNC and also ALT disagree memory items?

[TryingToLearn]

Just like there seems to be a deficit of pilots in the aviation world, I think that generally there is a deficit of good software developers, and it's getting worse. I think the quality of software took a nosedive during the last decade. Software from a decade ago was way more polished than what I see today, and this is very frustrating.

Please, don't make the mistake and put your best programmers on functional safety coding. Trust me, they will quit!

That's the whole point about safety: Even if a brain-dead, a greenpeace airplane-hating terrorist or an ape would program the code, you would find out before the first passenger boards the plane. There is a complete description of the functionality within several layers of requirements and every requirement has it's own validation criterion, test cases and in the end you have 100% test coverage on software module, software system, system, item (flight control) and vehicle/airplane/machine/... level.
As sad as it seems, the MCAS software did work exactly as specified. No programmer to blame.

At the time of the initial safety analysis someone defined 0.6° as the max. impact this system is allowed to have.
At this time someone wrote or should have written a requirement specifying that MCAS must never turn the trim by more than this (together with a minimum time in case of repeated action).
Every final software, every MCAS SW-module, every configuration should have been checked against this requirement and validation criterion by appropriate automated and documented test cases.
That's how safety works!

Now how did it happen? I don't know:
a) They knew but management forced them -> safety culture problem, on purpose...
b) They never wrote the tests -> process problem, nobody should release something for series without finishing all test runs
c) They ignored the test results -> safety culture problem, process problem
d) They changed the requirement after changing the SW but did not touch the safety analysis -> tracability problem, that's what ALM software systems are made for. Of course you have a problem if 99% of your requirements are blueprints from 1968... (-> grandfather rights, which should not apply to anything which is not 100% proven in use within exactly the old configuration)
e) The trim motor was supposed to turn slowly (10 sec -> 0.6°), instead it turned 4 times faster -> Item level testing, hardware in the loop testing?
f) They never wrote down their analysis assumptions as requirements -> fire the system requirement engineers, not the programmer. Ask yourself what your reviews are worth, are your reviewers just interested in the cookies/donuts?
etc.

Safety programming is brain-dead translation of UML into code. There is absolutely no room for creativity or interpretation. The main job within safety is sitting (+thinking, not just physical presence) in reviews and questioning every single line somebody wrote as a requirement (on functional, system, SW system or SW module level) several times. Do never rely on the genius of a requirement author, programmer or test engineer. Everything goes thru several reviews, accessments etc.

Second problem, which worries me the most, is the use of just one input. There are 2 sensors, use them! Relying one only one probe with very low diagnostic coverage is just bad. Safety-critical systems should be single-point-fault tolerant. But this is also a technical system requirement. Such a decision is made 6 months before coding. Nobody questioned this?
If this was, as claimed earlier within the thread, a commercial decision to avoid training on a simple diagnostic message, then the safety culture went down the drain, flushed by commercial interest (since it was also claimed that the safety level was estimated high enough to require redundancy). Such a finding would put a question mark on every difference between NG and MAX.
The very sad thing is that this AoA sensor comparison seems to be implemented and working, but sold as an extra. Maybe Boeing just wanted to earn extra money but on the other hand there is this strange coincidence that this feature compromises the sales argument ('no training') on one hand and does rescue airplanes on the other ('If you buy the sensor comparison for peanuts, it's your fault if you need to train your pilots'). -> Before talking about 'better' US/European pilots, better check if they simply had the option installed and where surprisingly not overwhelmed by a simple message instead of a spinning trim wheel :D

Safety engineers are not very popular within companies because this process takes time and often delays a development a lot if done as required. There is no space for agile programming, scrub etc. It's a V-Model lifecycle at it's best.
Guess what Boeing didn't have during the MAX development?

Oh, and one fun fact about european rail safety: Signals are a fail-safe system. In case something goes wrong, all signals are red, every train stops. Then there are operator which can manually override signals after making sure (by phone) that only one train is on one rail a a time. Fine...
Still, the automatic system and collision avoidance have availability requirements, they are required to work most of the time. The reason is simple: humans are error-prone, in case the signals would be operated manually for more than a very limited time, the average error-probability would be too high.
An autopilot is far more reliable than a pilot, pilots would make more mistakes (That's why there are two). Still the pilot has to be trained to every situation and manual flying. Maybe (non-pilot assumption) there is just not enough costly simulator training? Why would you (risk to) do the training with passengers on board?
Oh, I forgot, simulator time is expensive...

[737 Driver]

Second problem, which worries me the most, is the use of just one input. There are 2 sensors, use them! Relying one only one probe with very low diagnostic coverage is just bad. Safety-critical systems should be single-point-fault tolerant. But this is also a technical system requirement. Such a decision is made 6 months before coding. Nobody questioned this?



I've pondered this question myself quite a bit. I'm not sure we will ever know the correct answer, but let me offer an observation. While the 737 has a lot of redundancy, that redundancy does not generally extend to two sensors coming to an agreement before one of them causes a system response.

The most obvious example is that if one stall computer (SMYD) senses an approach to stall condition, it will turn on one stick shaker and activate the Elevator Feel Shift Module (EFSM). I believe one SMYD can also activate the Speed Trim Stall ID function and the autoslats (I'm actually trying to confirm these last two. The aircraft maintenance manual (AMM) suggests this is the case, but I haven't found anyone at my company who can say for sure). If the left and right inputs disagree, you will get some kind of message, but the system response still occurs.

I could envision a scenario in which someone on the MCAS design team looked at how previous 737 models treated these system inputs and simply followed suit. The difference this time was the system response was more than an annoyance - it was, sadly in hindsight, an existential threat.

[TryingToLearn]

The difference this time was the system response was more than an annoyance - it was, sadly in hindsight, an existential threat.
In case of an important 'warning' function you may want something fail-operational, your safe state is 'warn'. So you place an 'OR' logic within your redundancy.
In case of a -maybe dangerous- reaction and a fail-safe ('better do nothing') system, AND is the only solution.

Next question, where is MCAS?
a) Do you need fail-operational performance? Is this 'feel' in case of being close to stall very important? ->OR
b) Do you need to be fail-safe? Is a wrong activation critical? -> AND
c) Both? -> 3 Sensors, 2oo3 reaction, 3oo3 maintainance message
d) nice feature, doesn't do any harm? -> single sensor
There's no rocked science behind such systems.

But even if this system would rely on a single sensor. Range checks are also a valid method.
Close to stall at 75°AoA? Oh, we may need to adjust the feel a bit?!?
Even a 'no-brain' range plausibilization within the 1 sensor would have rescued one of 2 planes (fun fact: Such a range check is considered a 'low-coverage' method in automotive, estimated to catch 60% of all errors (ISO26262 part 5 annex D sensors...)).

[robocoder]

I've pondered this question myself quite a bit. I'm not sure we will ever know the correct answer, but let me offer an observation. While the 737 has a lot of redundancy, that redundancy does not generally extend to two sensors coming to an agreement before one of them causes a system response.

The most obvious example is that if one stall computer (SMYD) senses an approach to stall condition, it will turn on one stick shaker and activate the Elevator Feel Shift Module (EFSM). I believe one SMYD can also activate the Speed Trim Stall ID function and the autoslats (I'm actually trying to confirm these last two. The aircraft maintenance manual (AMM) suggests this is the case, but I haven't found anyone at my company who can say for sure). If the left and right inputs disagree, you will get some kind of message, but the system response still occurs.

I could envision a scenario in which someone on the MCAS design team looked at how previous 737 models treated these system inputs and simply followed suit. The difference this time was the system response was more than an annoyance - it was, sadly in hindsight, an existential threat.

I remember someone explaining that if they went with two sensors, the system would have to notify on disagreement and generate a warning, and that would need extra training and/or somehow impact the constraints under which the MAX was being designed.

I don't remember who said that and how accurate that is. Because if true, that raises the question: if the modified MCAS now accepts two inputs and self-disables on disagreement, is the no-training card already lost? With the penalty millions of certain airlines?

[Dani]

I repeat my post again gladly, where I wrote that it's not the MCAS which was the main problem but the data gathering unit (I'm not a B guy) from the AOA probe to the flight control computer. People insist that it was a probe failure, but this is highly inprobable. 2 probe failure on a new plane within months, on top of all the MCAS incidents on US airliners. I have never heard of a AOA probe failure, it happens very rarely.
It must have been the AOA data that was corrupted, not the AOA probe itself.
Only then MCAS made the mixup with the data (rubish in, rubish out). MCAS reacted as programmed, it received the wrong data.

[737 Driver]

In case of an important 'warning' function you may want something fail-operational, your safe state is 'warn'. So you place an 'OR' logic within your redundancy. In case of a -maybe dangerous- reaction and a fail-safe ('better do nothing') system, AND is the only solution.

Next question, where is MCAS?


Again, just speculating. According to initial reports, MCAS was only supposed to make a 0.6 nose down input. That is entirely manageable and wouldn't pose a threat, particularly if it occurred only once. Multiple 2.5 degree nose down inputs is an altogether different story. We don't why this change to MCAS authority was made, but apparently someone didn't connect the dots.

[737 Driver]

I repeat my post again gladly, where I wrote that it's not the MCAS which was the main problem but the data gathering unit (I'm not a B guy) from the AOA probe to the flight control computer.

I would have to look at the system architecture to be sure, but I'm almost positive that the AOA output does NOT go direct to the FCC. AOA is an input to both the Stall Management Yaw Damper (SMYD) computers and the Air Data Inertial Reference Units (ADIRU's). AOA is just one input into the SMYD's and ADIRU's. A bad pitot tube input could also have generated a false stall signal.

The primary responsibility of generating an approach to stall signal belongs to the SMYD which then activates various other aircraft systems (including the FCC) in response to the impending stall. I believe MCAS is a subroutine within the FCC. As I posted earlier, in many respects the two SMYD's act independently requiring only one "vote" to activate various systems, though there will be some other alerts to indicate the disagreement.



People insist that it was a probe failure, but this is highly inprobable. 2 probe failure on a new plane within months


Not sure if you are talking about the two AOA failures at Lion Air, or the two failures at two different airlines. At Lion Air, the accident aircraft had a defective AOA on a previous flight which was then replaced. We don't yet know why the first AOA was defective. Perhaps a ground worker bumped a piece of equipment into it. We do have evidence that the replacement AOA was 20 degrees out of calibration. Its DFDR readout exactly paralleled the good AOA, just 20 degrees higher. How this came to be is one of the subjects of the investigation. At Ethiopian, the DFDR data suggests that the AOA was working during the takeoff run, but was disabled shortly after liftoff, possibly by a bird strike.


I have never heard of a AOA probe failure, it happens very rarely. It must have been the AOA data that was corrupted, not the AOA probe itself. Only then MCAS made the mixup with the data (rubish in, rubish out). MCAS reacted as programmed, it received the wrong data.

AOA failures do happen, but until recently they did not result in a major accident. The DFDR records the AOA output, so we really do know that it was a faulty AOA, though the reason for the failure was different in the two accidents. Again, it wasn't MCAS's job to determine the stall condition. That responsibility belongs to the SMYD's. The problem was that it only took one SMYD to activate MCAS.

[LandIT]

Automation generally will not trip/cut out when the flowers are in bloom, it trips out on during the hurricane/cyclone cat 5+

So say the autopilot - it will hold a wing out of balance until it can hold it no longer, then disengage from wings level. You will get a hard and fast roll.
I think this is a very good point. Don't suppose a warning would be possible? Status screen showing any difficulties being handled? Option to return control surfaces to neutral?!

[Dani]

At Ethiopian, the DFDR data suggests that the AOA was working during the takeoff run, but was disabled shortly after liftoff, possibly by a bird strike.

Thanks for taking your time taking me with you on the matter.
Still, who tells us that it was a bird strike? It could be very well that the flight computer software delivers correct AOA data to the stall computer on ground and then starts to mix them up in the air. I read nothing of a bird strike in the preliminary.

Avherald says:
A false AoA value, probably produced by the Air Data Reference unit rather than a mechanical fault, which activated the stick shaker and MCAS.
This does not mean that the AOA is broken, but the AOA data.

That's why it is not wise to critisize the MCAS (alone), but the data handling of the whole system. I think Boeing and FAA know very well that it's not an isolated MCAS problem, but a flight control computer software problem on a wider scale.

Dani

[HarryMann]

I think this is a very good point. Don't suppose a warning would be possible? Status screen showing any difficulties being handled? Option to return control surfaces to neutral?!

whilst it may well be or have been the long standing protocol /default behaviour of autopliot and other automatic flight functions

Seems incredibly naive not to fully inform what any automation is actually up to... if that's right, a whole sysyem function is missing... comumucation

[AAKEE]

Still, who tells us that it was a bird strike? It could be very well that the flight computer software delivers correct AOA data to the stall computer on ground and then starts to mix them up in the air. I read nothing of a bird strike in the preliminary.

This does not mean that the AOA is broken, but the AOA data.

Dani

Bird strike theory isnt in the preliminary but in this thread a logical solution for the AoA values was presented earlier. If the AoA vane detaches due to for example a bird strike, the heating failure warning is explained. Also, the counterweight would case it to turn to 90 degree, exept for acceleration forces. It seems to reach 75 degree(measuring limit?) and stay there until A/C enters negative G, then the reading seems to follow the minus G. It seems to be affected by negative G-forces as a free turning counterweight would.

[GordonR_Cape]

I remember someone explaining that if they went with two sensors, the system would have to notify on disagreement and generate a warning, and that would need extra training and/or somehow impact the constraints under which the MAX was being designed.

I don't remember who said that and how accurate that is. Because if true, that raises the question: if the modified MCAS now accepts two inputs and self-disables on disagreement, is the no-training card already lost? With the penalty millions of certain airlines?

There is still much to discuss about the failure of the "initial" MCAS design, particularly the points made by TryingToLearn. The whole story is a very complex chain of decisions, most of which have been described in detail earlier in this thread, and sure to be covered by the accident investigation and FAA review.

The "revised" MCAS tries to satisfy both requirements, by having a complex series of validations to reduce false activation, while still maintaining the same 2.5 degree increment of nose-down trim (rather than reverting to the original 0.6 degrees). News reports suggest that expensive additional training will not be mandated by the FAA, though some airlines will choose to do so voluntarily.

By now the costs to Boeing (direct losses and share price reduction) are in the billions, not millions, so that penalty card is somewhat irrelevant.

[Bend alot]

There is still much to discuss about the failure of the "initial" MCAS design, particularly the points made by TryingToLearn. The whole story is a very complex chain of decisions, most of which have been described in detail earlier in this thread, and sure to be covered by the accident investigation and FAA review.

The "revised" MCAS tries to satisfy both requirements, by having a complex series of validations to reduce false activation, while still maintaining the same 2.5 degree increment of nose-down trim (rather than reverting to the original 0.6 degrees). News reports suggest that expensive additional training will not be mandated by the FAA, though some airlines will choose to do so voluntarily.

By now the costs to Boeing (direct losses and share price reduction) are in the billions, not millions, so that penalty card is somewhat irrelevant.

But Gordon the problem is there are things NOT up for discussion (seems under any and all circumstances - even before final reports) by Boeing and the FAA.

Training clearly being one of them - there will be no compromise it seems, there will be no required sim training or "detailed" training for the MAX.

That spells corruption to me.

[GordonR_Cape]

But Gordon the problem is there are things NOT up for discussion (seems under any and all circumstances - even before final reports) by Boeing and the FAA.

Training clearly being one of them - there will be no compromise it seems, there will be no required sim training or "detailed" training for the MAX.

That spells corruption to me.

I am not privy to any of the details, but it seems the joint investigation has not come to any conclusions, so the decisions by Boeing and the FAA are merely the first steps: https://en.businesstimes.cn/articles/111020/20190420/boeing-737-max-initial-certification-questioned-by-countries-and-agencies.htm
The initial certification of Boeing's now infamous 737 Max models has been questioned by multiple countries and American agencies rallying to investigate the issue. The investigation of a joint international panel is expected to run for three months.

https://www.apnews.com/41d5aca3f27e4c97b6980b245af5c3fc
A global team of experts next week will begin reviewing how the Boeing 737 Max’s flight control system was approved by the U.S. Federal Aviation Administration.

The FAA says experts from nine international civil aviation authorities have confirmed participation in a technical review promised by the agency.

Former National Transportation Safety Board Chairman Chris Hart will lead the group, which also will have experts from the FAA and NASA. They will look at the plane’s automated system including the way it interacts with pilots. The group will meet Tuesday and is expected to finish in 90 days.

[Bend alot]

I am not privy to any of the details, but it seems the joint investigation has not come to any conclusions, so the decisions by Boeing and the FAA are merely the first steps: https://en.businesstimes.cn/articles/111020/20190420/boeing-737-max-initial-certification-questioned-by-countries-and-agencies.htm


https://www.apnews.com/41d5aca3f27e4c97b6980b245af5c3fc

A few days ago.

The draft report from the FAA Flight Standardization Board (FSB) said additional training was needed for MCAS, but not required to be done in a simulator.

https://www.businessinsider.com/faa-calls-boeing-737-max-software-fix-operationally-suitable-2019-4/?r=AU&IR=T

Then why all ready, state the exclusion of a simulator training being or not being a requirement? At this point I do not think the FAA have been given the submission of the fix!!!

[GordonR_Cape]

A few days ago.

The draft report from the FAA Flight Standardization Board (FSB) said additional training was needed for MCAS, but not required to be done in a simulator.

https://www.businessinsider.com/faa-calls-boeing-737-max-software-fix-operationally-suitable-2019-4/?r=AU&IR=T (https://www.businessinsider.com/faa-calls-boeing-737-max-software-fix-operationally-suitable-2019-4/?r=AU&IR=T)

Then why all ready, state the exclusion of a simulator training being or not being a requirement? At this point I do not think the FAA have been given the submission of the fix!!!

The clue is in the target audience of the report (hint, its PR fluff, not aimed at the flying public).
Boeing shares rose 2 percent after the news.

[bill fly]

If the revised MCAS software (with a one time AND stab input up to 2.5deg) gets certified, then Boeing will have to publish a new failure mode procedure, because the runaway stab procedure would apply even less.

A specific MCAS failure mode procedure would need thinking through.

[Bend alot]

The clue is in the target audience of the report (hint, its PR fluff, not aimed at the flying public).
Target audience?

Simulator required training will hurt Boeing in the USA and outside- the fact there simply is not enough MAX simulators is a secondary factor - the target audience is the airlines and the launch customer has a bet each way on training!

Why would you bet each way?

[Loose rivets]

And the Million $ per aircraft promised payment, though I think that might be AA specific.


I'm still reeling from the shock of watching the subcontracting issues on the parallel thread. I was totally unaware of this. The gist I got was that the problem is so serious that no one seems able to face addressing it.

Current crews and engineers will no doubt be au fait with the issue. Just what is going on?

Rather drawn out, but so bewildering it took my mind off MCAS.

https://www.pprune.org/rumours-news/618252-boeing-737-max-software-fixes-due-lion-air-crash-delayed-35.html#post10450972

[safetypee]

Some discussions and media articles risk confusing complementary but different processes in certification.
Aircraft certification - CS 25 requirements, essentially relates to design aspects, but including crew activities (HF).
Flight Standards reviews are more focussed on operational implementation, guided by Ops requirements (121) and Advisory materials; this includes the level / extent of training and judgement of same type rating.

Aircraft type certification is initiated and led by the host nation (Boeing / FAA); other certification authorities can validate / accept the basis of certification Part 25 ~ CS 25, add special requirements, or apply specific interpretations.
Operational approval is less well defined; the lead authority’s position can be used as a basis, but more often reinterpreted and adjusted by others to meet national requirements.
Thus aircraft certification by the lead authority is widely agreed, but operational approval less so.

In this instance, the certification aspect of the MCAS modifications have to meet FAA Part 25; each national authority considers acceptance, validation, or applies special conditions. It would be surprising if there was not an agreed positon, even if not as the initial Boeing / FAA proposal (normally closed doors meetings).

The FAA Flight Standards (re) review, could agree that their initial position is still valid after modification; i.e. the intention and effect of MCAS is unchanged even though its initial mechanisation and notification were flawed (Fight Ops didn’t know) - a public view, link below.
A weakness in this process is that local viewpoints (operators) can sway operational decisions, such that there could be significant differences with other authorities who represent more worldly views. In this instance the latter is very important due to the nature and location of the accidents (Boeing / FAA should build and certificate aircraft for the world; not just local operators).

Having an independent international group consider ’certification’ issues is very unusual, even more so with ex NTSB chairmanship. Its task is reported as “… evaluate the automated flight control design and determine whether it complies with regulations. It also will decide if changes need to be made in the FAA’s approval process.” (90 days!)
It would be surprising if ‘aircraft certification’ (part 25) of MCAS modification were to be reviewed; this would question the FAAs fundamental right (ability) for approval (a US issue not international). Thus probably not an international public review of the failings in certification (Boeing / FAA); but a US investigation is still required.

However, a wider review of technical certification aspects based on what has been learnt from the accidents would be most valuable, even if not helpful to Boeing /FAA. Link to discussions below.
More likely the task is to agree a common operational view, or sufficiently similar so that the FAA is not isolated, and restores credibility. The timescales for this might not restrict a return to operations, even though some authorities could differ from the FAAs position.

Some of the technical issues, overlapping both certification and operational aspects are discussed in #696 https://www.pprune.org/showpost.php?p=10450645&postcount=696 and #703

https://www.faa.gov/aircraft/draft_docs/media/afx/FSBR_B737_Rev17_draft.pdf

FAA update https://www.faa.gov/news/updates/?newsId=93206

[syseng68k]

Good point. I also read this thread from the beginning and, to add another data point to the tendency you noticed, I'm a software engineer and I tend to blame Boeing more than the pilots. Boeing's attitude after the Lion Air accident contributed to that. If they didn't try to downplay the gravity of experiencing an incorrect MCAS activation, I would have probably been more sympathetic towards them.

Just like there seems to be a deficit of pilots in the aviation world, I think that generally there is a deficit of good software developers, and it's getting worse. I think the quality of software took a nosedive during the last decade. Software from a decade ago was way more polished than what I see today, and this is very frustrating.

Sure, just as the safety of air travel is getting better and better, a lot of lessons have been learned from the past in the software industry, and some types of bugs and quality issues are becoming less and less frequent. But there seems to be a lot less attention to detail, and I find it unbelievable that large software companies repeatedly release software products with significant bugs, that should are obvious to anyone after only a few minutes of using the product.

And I don't think it's just the deficit of good software developers causing this. I see a variety of other factors contributing to the decline in the quality of software, for example a tendency to spend less on quality assurance, and relying more and more on the end users to find and report quality issues with the software products. I hoped this trend would affect mostly regular consumer products, and not software that is critical for safety, but unfortunately that doesn't seem to be the case, some recent examples being the Tesla self driving car software, and possibly MCAS.

Anyway, back to the MCAS topic, I watched Mentour's recent video about being unable to trim manually at high speeds when the aircraft is severely out of trim. One thing that surprised me is that the simulator, which Mentour described as: "this is a level D FFS. That’s as real as it gets", is not able to replicate a stabilizer runaway similar to an incorrect MCAS activation, the runaway stabilizer failure is not able to bring the trim to full AND.

I guess the reason the simulated failure is not able to apply more AND trim is that it simulates something similar to stuck yoke trim switches. In such a situation, after reaching about 4 units with the flaps retracted, the trim limit switches would activate. That would prevent the trim from going lower than 4 units. I think that's why they have to trim manually the wrong way in the video, to try to simulate a worse mistrim, similar to that experienced by the Lion Air and Ethiopian pilots, because the simulator doesn't seem to be able do that.

If that's the case, I'm even more annoyed by Boeing's initial response that the pilots they should have just applied the runway stabilizer procedure. If the simulators are not able to replicate a mistrim as severe as one caused by a malfunctioning MCAS, clearly the existing simulator training for a stabilizer runaway failure is not entirely adequate for dealing with an MCAS induced trim runaway.Haven’t posted here for a while and semi retired now, but also electronics / software engineer, three decades plus including avionics systems exposure. Have read this thread and amazed that such a system with a single point of failure could ever have passed certification, either internally or regulatory. Although the circumstances differ, am reminded of the AF447 episode, where the crew were completely disoriented by the system going awol and dumping the a/c in an unknown state, misleading signals, onto an overloaded crew, who really did not stand a chance. Seems to me yet another example of the gap in the man / machine interface. Ideally, such systems should be designed to provide an unambiguous view of the machine state at all times, but seems far from it. Should be a basic design requirement that no crew should be expected to “guess” the state of the system at any time.

What is clear is a gross failure of systems engineering. Design, attention to detail and oversight. The big picture view of how the overall system works and how the individual parts interact and communicate. I don’t think you can blame software engineers or the software for any of this, as faults vs spec at that level would have been found during rigorous testing, but if the fundamental design is wrong, or full of uncovered corner cases, no software can compensate for that. The problem is that modern systems are now so complex that it may in fact be nigh impossible to test for every possible situation, or component failure. However, that is no excuse for not trying.

Reminded of another company: Hewlett Packard, who built a reputation over decades for building the most innovative and highest quality test equipment in the business. They spent a fortune on R&D and were widely diversified into science, healthcare and more. Then, bean counters and “shareholder value”, gross mismanagement and greed turned a hard won reputation and pursuit of excellence into a laughing stock. Fortunately, the test gear division was spun off, but now a pale shadow of their former selves and not sure how much r&d they do now. Really, does anyone care anymore, or is it already too late ?...

[derjodel]

Haven’t posted here for a while and semi retired now, but also electronics / software engineer, three decades plus including avionics systems exposure. Have read this thread and amazed that such a system with a single point of failure could ever have passed certification, either internally or regulatory. Although the circumstances differ, am reminded of the AF447 episode, where the crew were completely disoriented by the system going awol and dumping the a/c in an unknown state, misleading signals, onto an overloaded crew, who really did not stand a chance. Seems to me yet another example of the gap in the man / machine interface...

AF447 was perfefectly flyable - it was the PF who keept pulling up, making the fatal error. Perhaps the underlying issue is that the frame, when on full thrust and full elevator up, will not drop the nose which would make it clear it was stalled.

Anyways, the MAXes which crashed were not flyable, period. The trim could not have been changed - too much resistance to do it manually and another mcas event if you try electric trim.

Quite different situation, IMO. AF447 had much more time to react (but they burned it and who knows how much altitude they needed to recover). They had lots of energy and flyable plane.

[MurphyWasRight]

...

Anyways, the MAXes which crashed were not flyable, period. The trim could not have been changed - too much resistance to do it manually and another mcas event if you try electric trim.
...

Not true,MCAS is disabled for 5 seconds after pilot trim so they could have used electric trim and -then- disabled. Alternating up/down blips at 3 second intervals would have kep MCAS disabled as long as needed.
Of course this is after the fact but should have been highlighted (not hinted at in a note) in the emergency AD following Lion Air.

The alternate method of briefly relaxing column inputs and cranking 'might' have been possible although nerve wracking at best given the altitude.

[TryingToLearn]

What is clear is a gross failure of systems engineering. Design, attention to detail and oversight. The big picture view of how the overall system works and how the individual parts interact and communicate. I don’t think you can blame software engineers or the software for any of this, as faults vs spec at that level would have been found during rigorous testing, but if the fundamental design is wrong, or full of uncovered corner cases, no software can compensate for that. The problem is that modern systems are now so complex that it may in fact be nigh impossible to test for every possible situation, or component failure. However, that is no excuse for not trying.
.
It's always the same story:
a) System engineering (writing system requirements and designing a 'system' before jumping on code and PCBs) is completely underestimated but failures at this stage have a huge impact.
b) People care about 'functional safety' (bugs) but completely underestimate the importance of 'safety of use', a clear and understandable user interface, also in automotive (https://en.wikipedia.org/wiki/Anton_Yelchin#Lawsuit)
c) Complexity, which everyone claimes. But: High complexity in most cases is just bad (or missing) architecture.

Sorry, but the longer I think about this MCAS, the more I get angry that such a system was able to make it's way into production.

[Chronus]

Haven’t posted here for a while and semi retired now, but also electronics / software engineer, three decades plus including avionics systems exposure. Have read this thread and amazed that such a system with a single point of failure could ever have passed certification, either internally or regulatory. Although the circumstances differ, am reminded of the AF447 episode, where the crew were completely disoriented by the system going awol and dumping the a/c in an unknown state, misleading signals, onto an overloaded crew, who really did not stand a chance. Seems to me yet another example of the gap in the man / machine interface. Ideally, such systems should be designed to provide an unambiguous view of the machine state at all times, but seems far from it. Should be a basic design requirement that no crew should be expected to “guess” the state of the system at any time.

What is clear is a gross failure of systems engineering. Design, attention to detail and oversight. The big picture view of how the overall system works and how the individual parts interact and communicate. I don’t think you can blame software engineers or the software for any of this, as faults vs spec at that level would have been found during rigorous testing, but if the fundamental design is wrong, or full of uncovered corner cases, no software can compensate for that. The problem is that modern systems are now so complex that it may in fact be nigh impossible to test for every possible situation, or component failure. However, that is no excuse for not trying.

Reminded of another company: Hewlett Packard, who built a reputation over decades for building the most innovative and highest quality test equipment in the business. They spent a fortune on R&D and were widely diversified into science, healthcare and more. Then, bean counters and “shareholder value”, gross mismanagement and greed turned a hard won reputation and pursuit of excellence into a laughing stock. Fortunately, the test gear division was spun off, but now a pale shadow of their former selves and not sure how much r&d they do now. Really, does anyone care anymore, or is it already too late ?...

Design and manufacture concepts are the result of mass market demands. Aviation is now a mass market form of transportation, seeking to satisfy a demand for ever cheaper fares for every destination against the ever increasing costs of every resource on the planet. Automation is therefore the way forward and that involves a cost for knowledge and learning from many mistakes. It was so in the past, where the process involved the misfortunes of many, so it will be in the future. This particular incident shows that until such time when machines are free from mistake, human fallibility shall remain. For reason that their fallibility is replicated in any machine they design and manufacture. Perhaps AI will resolve this weakness and we shall have machines designed by machines. Then we shall have fulfilled our pursuit for excellence. Don`t you remember when you were first instructed in Instrument Flying, I do. I was told trust your instruments.

[L39 Guy]

I'm confused had there been any US MCAS incidents?? Can you at least cite me one case?


I will just concentrate on Lion Air Flight JT610.
How do you know the CAPT on that flight didn't perform UAS NNC? Did you get a hold of the CVR's transcript? We know there wasn't any CVR's transcript on Lion Air JT610 Preliminary Crash Investigation because they still haven't recovered the JT610's CVR at that juncture. The CVR was buried beneath a thick mud of Java Sea for almost 60 days before they finally recovered it. And, no official transcript has been released by the officials thus far.

Furthermore, the crew had been briefed about the malfunctions and the fixes by the MX on the ground, plus there was a log left by the previous crews [Flight JT043] written as:

"Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the
wrong direction, suspected because of speed difference, identified that CAPT instrument
was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT
disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L."

Wouldn't you think the first thing flashed on the CAPT's mind should there be trouble with the aircraft is to recall the previous flight's log entry which explained, among other things, the crews' execution of the Airspeed Unreliable NNC and also ALT disagree memory items?

About 4,000 posts ago on this thread others cited previous MCAS incidents from NASA's ASRS. More recently, others backed me up on that from a previous post of mine.

You're correct about the CVR however the official, preliminary report page 2, the aircraft had a ground speed (from the radar controller) of 322 knots with an altitude somewhere between 2,000 and 5,000 ft ( 23:22:56 UTC) - there is no way the aircraft would be going that fast with 80% N1 per the NNC UAS with flaps extended or 70% clean. Also, if you look at the FDR printout at that time, there is no evidence of a thrust reduction from take-off power (N1, N2, fuel flow).

I would agree that given the previous flight log entry that one would have a greater than normal awareness of an unreliable airspeed potential but evidently that checklist was not executed, given the inordinately high ground speed and the absence of changes to the engine power.

[DaveReidUK]

About 4,000 posts ago on this thread others cited previous MCAS incidents from NASA's ASRS. More recently, others backed me up on that from a previous post of mine.

To clarify, there are no MCAS-related events in NASA's SRS system.

[TryingToLearn]

[QUOTE=Chronus;10452687Automation is therefore the way forward and that involves a cost for knowledge and learning from many mistakes. It was so in the past, where the process involved the misfortunes of many, so it will be in the future. This particular incident shows that until such time when machines are free from mistake, human fallibility shall remain. For reason that their fallibility is replicated in any machine they design and manufacture. Perhaps AI will resolve this weakness and we shall have machines designed by machines. Then we shall have fulfilled our pursuit for excellence. Don`t you remember when you were first instructed in Instrument Flying, I do. I was told trust your instruments.[/QUOTE]

Do we also need to learn again how tires are manufactured? Millions of cars are driving perfectly safe but still cheap chinese wheels crack because they are manufactured cheap and without x-ray check.
Hundreds of millions of cars have ESP, a system which could easily block single tires on the highway without a chance to react before hitting a tree. Still I have not heard of a single accident. Cost pressure on such systems (ESP, engine ECU, gearbox ECU...) is by orders of magnitude higher than in aviation. You're not counting fractions of cents in aviation. On the other hand lines of code are not considered cost-relevant within automotive, a programmer more or less does not really matter. It should be the same in aviation.

Almost every function within a car is single-point-fault tolerant if a defect would stop the car. Single point fault tolerance is not restricted to safety, but also extended to 'limp-home' to the garage and any other function which would be more than annoying in case of an error. So why the heck didn't they just compare 2 (already existing) sensors? Every system engineer would (if allowed to). Emission standards require such a 2oo2 to avoid abnormal emission (..of a single car in case of random HW defects).
In addition, EVERY sensor is usually range-checked. Why would you activate a 'stall-avoidance feel' if the AoA is at its mechanical limit which would mean the aircraft is flying backwards or is in free-fall?
Designing such a system in a safe way is nothing new, it is state of the art for >20 years. SW is controlling your car's engine and acceleration, brake (ESP), airbag, gearbox, there are fly-by-wire systems, trains, signals and so on. If you want to see state of the art safety: https://www.youtube.com/watch?v=R9kkeGgZpZI This robot could break their necks or dump them into the ground with a fraction of it's available force. Instead it' perfectly safe.

But the process is costly and takes time. And it requires qualified engineers and a safety culture and a certain independence & priority between commercial interest and safety requirements.

To me it looks like Boeing was putting the priority on sales, not on safety.

Open any ISO/IEC on safety, you will probably find a list of sensor plausibilisation methods and how safe they are considered to be. The simple ones (range check, considered 60%) would have saved 1 aircraft, the better ones (2oo2, linearity... (90%/99%)) both.

[etudiant]

To clarify, there are no MCAS-related events in NASA's SRS system.

Seen that the existence of MCAS was unknown even to the SW Airline pilots until the Lion Air crash, how would pilots report an MCAS related event?

[Poorpitifulme]

Easy--trim the airplane. After a few series of "arguments" with the MCAS, turn off the trim via the Runaway Stabilizer checklist.

[DaveReidUK]

Seen that the existence of MCAS was unknown even to the SW Airline pilots until the Lion Air crash, how would pilots report an MCAS related event?

I think we can safely assume that such an event would be reported, even if not identified as such.

There were none.

[TryingToLearn]

I think we can safely assume that such an event would be reported, even if not identified as such.
There were none.
Maybe all the 'first world' planes have the options 'plausibilization' and 'AoA display' ordered, so a single AoA failure is just worth a small note in the log?

[Bend alot]

And the Million $ per aircraft promised payment, though I think that might be AA specific.


I'm still reeling from the shock of watching the subcontracting issues on the parallel thread. I was totally unaware of this. The gist I got was that the problem is so serious that no one seems able to face addressing it.

Current crews and engineers will no doubt be au fait with the issue. Just what is going on?

Rather drawn out, but so bewildering it took my mind off MCAS.

https://www.pprune.org/rumours-news/618252-boeing-737-max-software-fixes-due-lion-air-crash-delayed-35.html#post10450972

Link not working.

It seems the $1M deal was with at least the company with the largest single order of 280 aircraft - Southwest Airlines.

That seems a very high number to compensate for simulator training being a requirement - $1M is a lot of simulator hours.

https://www.forbes.com/sites/petercohan/2019/03/28/did-airbus-rivalry-drive-dangerous-tradeoffs-for-boeings-737-max/#1dc5a8462e18

[737 Driver]

That seems a very high number to compensate for simulator training being a requirement - $1M is a lot of simulator hours.


Well, first you need to buy the simulators, and they are not cheap. And I do mean simulators, as in plural, because if you're Southwest, you cannot quickly cycle your pilots through a single sim.

[Loose rivets]

When we moved up the ladder to more modern iterations in the old days, we did a 'Differences' course, which was about a working week in the classroom. I recall having to do performance etc., again as well. Flying was all on the real aircraft, the BAC 1-11. Yes, we stalled to the push. All in the Swinging Sixties.


"Link not working" Try direct to the Tube below.

I just don't know what to make of this, though I assume pre-MAX era.

Is it history that's faded? because it seems to be a bigger problem than the MAX. A head honcho in the FAA who admits that Boeing wrote his assessment and he signed it. Banging major fuselage parts into place that should be accurate to 1/3000" over entire production runs but turn out to be hand made.

Sully's statement. 'Unprecedented in aviation history.'
$27 billion down today. Though hey, a slight rallying.
This lurking in the background: https://www.youtube.com/watch?time_continue=253&v=vWxxtzBTxGU

[Bend alot]

Well, first you need to buy the simulators, and they are not cheap. And I do mean simulators, as in plural, because if you're Southwest, you cannot quickly cycle your pilots through a single sim.

If you need to buy new simulators to train for the MAX fleet, then the aircraft is different to other 737's.

So Boeing and FAA claims, of they are basically the same and do not require simulator training gets hard to swallow.

Now I can live with larger TV screens and more powerful engines as a reasonable change not requiring simulation, just look at the Toyota Hilux range - different engines and gauges but they drive similar.
But changes like that made on the MAX, to the spoilers and introduction of MCAS (flight controls) should have appropriate training. My personal opinion is a short read and sign on a iPad is not good enough.

Here is a link to the changes.

Boeing 737 MAX - Differences (http://www.b737.org.uk/737maxdiffs.htm)

[HarryMann]

NG / New differences
Flight Control Systems
Only the F/Os column cutout switch module is affected because it is the only module that interfaces with the FCC..

Help... think I must've missed something earlier.on that rin-down of changes.. Anyone else wondering where that jumped out of...

[ozaub]

FAA has an express statutory power to reinspect, re-examine, suspend, or revoke any certificate, including a type certificate, where "safety ... and the public interest require that action”. Read about Special Certification Reviews and examples such as MD-11 at https://scholar.smu.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=1433&context=jalc.

Hopefully FAA led Joint Authorities Technical Review of MCAS will amount to a multi-national SCR. See https://www.faa.gov/news/updates/?newsId=93206.

Bad news for Boeing is that MAX grounding is not likely to be lifted before JATR reports in 90 days.

[Bend alot]

Bad news for Boeing is that MAX grounding is not likely to be lifted before JATR reports in 90 days.

I do not think the family and friends of the 346 fatalities consider it bad news at all.

[safetypee]

Re: Joint Authorities Technical Review. This is a very unusual move by the FAA.
Political positioning, need for world consensus to protect FAAs standing?
Or a much needed safety initiative to look at issues arising?

‘The team will evaluate aspects of the 737 MAX automated flight control system, including its design and pilots’ interaction with the system, to determine its compliance with all applicable regulations and to identify future enhancements that might be needed.’

Is this just an ‘evaluation’. Or if aspects are not compliant with regulations (whose regulations), will change be mandated or only treated as ‘enhancements’, or aspects which should be incorporated in future (non-grandfather rights) regulations?

Previous regulatory overview https://www.pprune.org/showpost.php?p=10452510&postcount=4193

and technical / training areas requiring review https://www.pprune.org/showpost.php?p=10450645&postcount=696

[groundbum]

Re: Joint Authorities Technical Review.
‘The team will evaluate aspects of the 737 MAX automated flight control system, including its design and pilots’ interaction with the system, to determine its compliance with all applicable regulations and to identify future enhancements that might be needed.’

Boeing had better have every single expert to hand with every schematic and line of code ready to be looked at. If the inspecting Engineers ask for clarification on X,Y and Z it could take Boeing another month to go get the information and come back. This could be a simple exercise or could be months depending on what depth it goes to..And the final answer may not be positive. I was worried when I heard since MCAS was fingered that a cross FCC bus was added to handle it better. That's major tinkering with major components. Not the sort of thing to be done in a few months as an add-on!

Hopefully none of the regulators will take any notice of the commercial imperatives to getting the MAX back in the air. Trump's White House might browbeat the FAA but none of the foreign regulators..

G

[infrequentflyer789]

I was worried when I heard since MCAS was fingered that a cross FCC bus was added to handle it better. That's major tinkering with major components.

Pretty sure cross FCC bus is already there, not absolutely sure AOA is on it, but if not, adding it would be a lot different to creating entirely new bus.

MCAS could have been done with two AOA sources in the first place, it wasn't (allegedly - see whistleblower quotes further up thread) because that would require an MCAS-fail warning light and sim-training. This now appears to be being done in a half-arsed way by using AOA-disagree as a de-facto MCAS-fail warning, which means operators who don't currently have AOA-disagree option will presumably need to implement extra training (or get blamed for future MCAS prangs) but the US operators with the no-sim-training penalty clauses will not because they already have the AOA disagree option. Funny that...

[Organfreak]

Pretty sure cross FCC bus is already there, not absolutely sure AOA is on it, but if not, adding it would be a lot different to creating entirely new bus.

MCAS could have been done with two AOA sources in the first place, it wasn't (allegedly - see whistleblower quotes further up thread) because that would require an MCAS-fail warning light and sim-training. This now appears to be being done in a half-arsed way by using AOA-disagree as a de-facto MCAS-fail warning, which means operators who don't currently have AOA-disagree option will presumably need to implement extra training (or get blamed for future MCAS prangs) but the US operators with the no-sim-training penalty clauses will not because they already have the AOA disagree option. Funny that...

I thought I'd read that AoA-Disagree was going to be added by default as part of the fix(?).

[Water pilot]

I was worried when I heard since MCAS was fingered that a cross FCC bus was added to handle it better. That's major tinkering with major components. Not the sort of thing to be done in a few months as an add-on!

G
They say that it is a software only fix which raises the uncomfortable question of why it was not implemented to read both sensors in the first place. I am still not onboard with the idea that any engineer would make such a decision simply to hide the feature from the regulatory process but it makes one wonder. If so then manslaughter charges are appropriate and I am not kidding, that would be like designing a commercial kitchen without fire suppression because you did not want to involve the fire department in the permit. (And then blaming the cook for starting a fire!)

[TryingToLearn]

They say that it is a software only fix which raises the uncomfortable question of why it was not implemented to read both sensors in the first place. I am still not onboard with the idea that any engineer would make such a decision simply to hide the feature from the regulatory process but it makes one wonder. If so then manslaughter charges are appropriate and I am not kidding,
Safety culture and a certain independence within the organisation between the responsible safety managers and commercial decisions, is, at least within automotive & machine, part of the ISO26262/IEC61508 and therefore state of the art.
They may have a few things to explain...

[L39 Guy]

If you need to buy new simulators to train for the MAX fleet, then the aircraft is different to other 737's.

So Boeing and FAA claims, of they are basically the same and do not require simulator training gets hard to swallow.

Now I can live with larger TV screens and more powerful engines as a reasonable change not requiring simulation, just look at the Toyota Hilux range - different engines and gauges but they drive similar.
But changes like that made on the MAX, to the spoilers and introduction of MCAS (flight controls) should have appropriate training. My personal opinion is a short read and sign on a iPad is not good enough.

Here is a link to the changes.

Boeing 737 MAX - Differences (http://www.b737.org.uk/737maxdiffs.htm)

So what simulator exercises would you incorporate to reflect the differences in the MAX, specifically the MCAS? How about an uncommanded nose down trimming? That is already incorporated in a conventional stab trim runaway, a basic requirement of getting a type rating on any B737. Or how about an unreliable airspeed including stick shaker? An unreliable airspeed exercise is also part of a type rating on any B737. In other words, there is nothing so uniquely different with the MAX that justifies a new simulator let alone MAX (MCAS) specific training. And even if you were to provide this (redundant) training, there is no guarantee that the crews would do the drill anyways as we have tragically witnessed with these accidents.

Not having the exact simulator for training has loads and loads of precedents - I can guarantee that the simulator configurations at a non-airline specific training facility (Flight Safety, CAE, Boeing, Airbus) would be different than what one would find on the aircraft of a particular airline. And even airline specific training facilities often don't have simulators that match their fleet as the fleet may have many configurations. As an example, where I work we have B767-300's with GE and Pratt engines, those engines start and behave completely differently (GE uses N1 as the reference power, Pratt uses EPR). Or an A340 simulator that is used for both the -300 and -500 which have entirely different fuel systems, different engines (CFM vs Rolls Royce), B787 simulators where the -800 and -900 are different (the -900 has more flaps settings for example).

The point is is that is both impractical and unrealistic to have "perfect" simulators; instead one has relied upon professional and experienced pilots to deal with differences between the simulator and the aircraft and also deal with different aircraft within a fleet.

[pilot9250]

So what simulator exercises would you incorporate to reflect the differences in the MAX, specifically the MCAS? How about an uncommanded nose down trimming? That is already incorporated in a conventional stab trim runaway, a basic requirement of getting a type rating on any B737. Or how about an unreliable airspeed including stick shaker? An unreliable airspeed exercise is also part of a type rating on any B737. In other words, there is nothing so uniquely different with the MAX that justifies a new simulator let alone MAX (MCAS) specific training. And even if you were to provide this (redundant) training, there is no guarantee that the crews would do the drill anyways as we have tragically witnessed with these accidents.

Not having the exact simulator for training has loads and loads of precedents - I can guarantee that the simulator configurations at a non-airline specific training facility (Flight Safety, CAE, Boeing, Airbus) would be different than what one would find on the aircraft of a particular airline. And even airline specific training facilities often don't have simulators that match their fleet as the fleet may have many configurations. As an example, where I work we have B767-300's with GE and Pratt engines, those engines start and behave completely differently (GE uses N1 as the reference power, Pratt uses EPR). Or an A340 simulator that is used for both the -300 and -500 which have entirely different fuel systems, different engines (CFM vs Rolls Royce), B787 simulators where the -800 and -900 are different (the -900 has more flaps settings for example).

The point is is that is both impractical and unrealistic to have "perfect" simulators; instead one has relied upon professional and experienced pilots to deal with differences between the simulator and the aircraft and also deal with different aircraft within a fleet.

I'm sorry but this is genuinely disengenous.

You can't argue what about this, or that.

They didn't have this, or that.

They had all of it.

What you are arguing is that because individual elements of the failure were trained independently, that there was no combination of trained failures that could be expected to overcome the flight crew.

That no matter what the automation did and no matter how many failure modes were presented concurrently, that the flight crew should be expected to compensate regardless.

This just doesn't make sense.

The problem here is precisely that the combination of so many individually trained and for that matter untrained failures was too numerous to encourage and support successful and timely diagnosis by a typical crew.

[Lost in Saigon]

The problem here is precisely that the combination of so many individually trained failures was too numerous to encourage and support successful timely diagnosis.


I don’t see a “combination of individual failures”. The failure of the Angle of Attack was only ONE failure. The crew did not correctly deal with that failure and made things worse for themselves.

[pilot9250]

I don’t see a “combination of individual failures”. The failure of the Angle of Attack was only ONE failure. The crew did not correctly deal with that failure and made things worse for themselves.

Angle of Attack failures weren't even on the list of problems presented to the crew.

[FullWings]

So what simulator exercises would you incorporate to reflect the differences in the MAX, specifically the MCAS? How about an uncommanded nose down trimming? That is already incorporated in a conventional stab trim runaway, a basic requirement of getting a type rating on any B737.
Scenario 1: In the simulator, doing a “runaway trim exercise”. There you are at 6,000’ straight and level, 220kts, nothing happening. Oh look, the trim has started moving on its own, can’t stop it, I wonder if this is right? No? OK, do the runaway checklist. Sim passed! Easy, this trim runaway.

Scenario 2: In the aeroplane, cleaning up. Trim starts moving forward, then stops. Is that MCAS gone wrong (or even possibly functioning correctly), is it STS doing its job or is it the other guy who’s flying it trimming the aircraft? Hmmm. There goes the trim again...

Scenario 3: All the above plus continuous stick shaker, aural warnings and UAS symptoms.

Honestly, I’m not quite sure how you would train an MCAS runaway in the sim, if disconnecting the trim when there wasn’t an actual runaway = fail. It’s easy to say “they should have done the trim runaway checklist” but how do you tell NORMAL operation of MCAS/STS from ABNORMAL in a very limited timeframe? If you disconnect the trim every time it moves, you’re going to be doing lots of very short flights...

[Loose rivets]

That last paragraph has been said before, but seems to be forgotten time and time again. IMHO, it is the crux of the matter.

Getting into the mind of an average pilot, whatever that might be these days. One thing's for sure, it's not one that's had his senses sharpened by months of focussed discussion on this specific crisis, and not necessarily comparable to some of the pilots on here that have a wealth of experience on a wide range of Boeing products.

[Bend alot]

So what simulator exercises would you incorporate to reflect the differences in the MAX, specifically the MCAS? In other words, there is nothing so uniquely different with the MAX that justifies a new simulator let alone MAX (MCAS) specific training.

The only uniquely different thing is that the MAX could not meet certification requirements without MCAS (or other major changes)- that is a basic fact and not been disputed. No other 737 has MCAS that is a unique feature.

MCAS version 1 had different training requirements as it had a lot of authority and travel (far great was required than design plans) - but it did meet certification requirements with this authority.

MCAS version 2 has a large number of cut out features and is limited to a once of small movement. This puts the question as to have now can it still meet the certification requirements? My guess is it technically can depending on how grey you wish to read the data.

So my opinion is that it is not only possible, but very likely that the MAX will operate in the zone that fails certification limits. Reason is it either will not engage when "required", not input enough travel or be accidentally shut down prematurely.

I would expect that it be appropriate to have simulator training that included the actual stick forces encountered when MCAS did not active or only partially activated - my reasons for this is that this lack of feel is not evident in the previous aircraft and given MCAS involvement will be reduced, there is a greater possibility pilots will be exposed to this insufficient feel that does not meet certification levels.

Most people would find it reasonable to expect a pilot to have experienced flight conditions in the area outside the certification limits, if it is reasonably probable that the aircraft will be in this condition. With the proposed changes to MCAS there are now many conditions that will stop it from operating or only give partial operation, so a far greater possibility of flight outside the certified limit.

One would also assume it very handy to experience the MCAS experience just after takeoff operating normally, then again when it fails to disengage and turns into a runaway.

Might help to get the high AOA on a flapless landing.

[RatherBeFlying]

Some decades ago I spent several sessions in a Viscount simulator (with a variety of abilities in the other seat) run by a serial killer who diligently added failures until a simulated smoking hole was commonly produced. You learned prioritization or got snuffed.

These days it seems simulator time is too expensive for crews to really get to know the airplane.

And now we see Boeing trying to put out a model that earlier model crew can step into without any simulator time.

I am reminded of the time as a 12 year old on my bike racing another kid downhill on a suburban street. Kids were playing jump rope on the other side. Half the street was clear. No problem. Then a kid began running across our side of the street. He'd be across the street by the time we got there. No problem. Then the kid stopped when he saw us. Lots of room between him and the curb. No problem.

Then the kid started running again when I was maybe ten feet away:eek:

It turned out he had a history of getting hit by bikes and the odd car.

The start / stop cycles of MCAS remind me of this kid. The crews got painted into a corner. Stick shaker and airspeed disagree distracted them from the real problem until it was too late. It definitely didn't help that the underfloor trim cutout switch no longer blocked automatic trim.

There's still an open question on the ergonomics of the control wheel trim switches when the stick shaker is operating. I suspect that the electrical contact has to be maintained for a minimum period (perhaps sub-second) for the relay to begin driving the trim motor. How much pressure is required to sustain the electric contact when stick shaker is operating?

[Bergerie1]

FullWings,

Never a 737 pilot and now long out of date. But I believe your post sums up the problem pretty accurately. How many of us would have diagnosed the problem correctly in the time available?

[Loose rivets]

RatherBeFlying #2447

There's still an open question on the ergonomics of the control wheel trim switches when the stick shaker is operating. I suspect that the electrical contact has to be maintained for a minimum period (perhaps sub-second) for the relay to begin driving the trim motor. How much pressure is required to sustain the electric contact when stick shaker is operating?

Quite. Could I be boring and again point to the switch 'noise' just on the centreline of the graph. I've always felt it might say far more than is being allotted to it in our discussions but have no knowledge of this graph's validity.

Lionair Upper: manual trim middle: automatic trim is a tad confusing but blue surely must be thumb switch inputs. If so, where did this microscopic data come from?

It's from spornrad # 4076


https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-204.html#post10448732

[Alchad]

came across this thread, relevant quote from it below. Obviously no way of knowing if genuine or not, but given what else has been posted on the difficulty of operating the manual trim wheel, it does sound plausible.


Shutdown caused Boeing crash. - Page 4 - International Skeptics Forum (http://www.internationalskeptics.com/forums/showthread.php?t=335236&page=4)

Quote...

"I agree it's a flawed design. And I used to work there. I'm glad I don't now.

Regarding the trim wheels: When the NG was being introduced, I happened to be the Lead Engineer in charge of them and a whole lot of other stuff. There were some issues. The new display system created a pinch point between the dash and the wheel. We had to make the wheel smaller. And the new trim motor resulted in the wheel, which is directly connected to the stabilizer by a long cable, springing back when electric trim was used. It was an undamped mass on the end of a spring. We had to add a damper.
Result: Depending on the flight conditions, the force to manually trim can be extremely high. We set up a test rig and a very fit female pilot could barely move it.
As I said, I'm glad I'm no longer there."

Alchad

[GordonR_Cape]

came across this thread, relevant quote from it below. Obviously no way of knowing if genuine or not, but given what else has been posted on the difficulty of operating the manual trim wheel, it does sound plausible.


Shutdown caused Boeing crash. - Page 4 - International Skeptics Forum (http://www.internationalskeptics.com/forums/showthread.php?t=335236&page=4)

Quote...

"I agree it's a flawed design. And I used to work there. I'm glad I don't now.

Regarding the trim wheels: When the NG was being introduced, I happened to be the Lead Engineer in charge of them and a whole lot of other stuff. There were some issues. The new display system created a pinch point between the dash and the wheel. We had to make the wheel smaller. And the new trim motor resulted in the wheel, which is directly connected to the stabilizer by a long cable, springing back when electric trim was used. It was an undamped mass on the end of a spring. We had to add a damper.
Result: Depending on the flight conditions, the force to manually trim can be extremely high. We set up a test rig and a very fit female pilot could barely move it.
As I said, I'm glad I'm no longer there."

Alchad


Posted a few (hundred?) pages back in this thread: https://www.pprune.org/showthread.php?p=10438165

[pilotmike]

We set up a test rig and a very fit female pilot could barely move it.
Accepting that beauty is in the eye of the beholder, surely how much one fancies a lady has little if any bearing upon her ability to trim the 737 manually... :ok:

[737 Driver]

Scenario 1: In the simulator, doing a “runaway trim exercise”. There you are at 6,000’ straight and level, 220kts, nothing happening. Oh look, the trim has started moving on its own, can’t stop it, I wonder if this is right? No? OK, do the runaway checklist. Sim passed! Easy, this trim runaway.

Scenario 2: In the aeroplane, cleaning up. Trim starts moving forward, then stops. Is that MCAS gone wrong (or even possibly functioning correctly), is it STS doing its job or is it the other guy who’s flying it trimming the aircraft? Hmmm. There goes the trim again...

Scenario 3: All the above plus continuous stick shaker, aural warnings and UAS symptoms.

Honestly, I’m not quite sure how you would train an MCAS runaway in the sim, if disconnecting the trim when there wasn’t an actual runaway = fail. It’s easy to say “they should have done the trim runaway checklist” but how do you tell NORMAL operation of MCAS/STS from ABNORMAL in a very limited timeframe? If you disconnect the trim every time it moves, you’re going to be doing lots of very short flights...

I understand what you are trying to say, but let me make this observation.

We know that the MCAS input stops if any pilot puts in manual electric trim. It then restarts after a 5 second delay. If a pilot is regularly responding to the changing trim pressures by inputting nose up trim (MCAS trims some nose down, pilot trims some nose up, MCAS trim nose down, pilot trims nose up, repeat), then yes, it looks a lot different than a classic runaway trim.

In the case of ET302, however, the MCAS input lasted 9 continuous seconds which equates to around 37 spins of the manual trim wheel. The entire time, the Captain has the yoke in his hands and the control pressures increase dramatically. This happened at least twice. What about this does not scream runaway trim?

[FullWings]

In the case of ET302, however, the MCAS input lasted 9 continuous seconds which equates to around 37 spins of the manual trim wheel. The entire time, the Captain has the yoke in his hands and the control pressures increase dramatically. This happened at least twice. What about this does not scream runaway trim?
I agree that’s a bit more obvious but we are now in the “end game” where the goose is close to being irreversibly cooked. What it screams to me is that the pilot(s) were so overloaded by control forces / stick shake / aural and visual warnings / general confusion that they had reverted to “pull back to make the houses look smaller” and had fixated on this due to saturation of their input channels. The trim running could well be the gorilla in the room, if you’ve seen the video.

As many have worked out, the stabiliser is a very powerful pitch control on the 737 and the elevator is just a trim, really. I’m not sure how much emphasis is put on that in training these days.

[spornrad]

RatherBeFlying #2447
is a tad confusing but blue surely must be thumb switch inputs. If so, where did this microscopic data come from?

It is just a magnified screen shot from the prelim. report of the Lionair crash

Reason I posted this is the weird question of the ET captain to the FO to help him with the electric, manual trim, plus the (way too) short trim blips late in the traces of ET as well as the too short trim blips late in the Lionair traces. I was simply wondering if there could be a hint here to a common ergonomic problem due to artificial feel stick force and shaker.

[fizz57]

How many of us would have diagnosed the problem correctly in the time available?

At least three if these columns are anything to go by ;)

[Fortissimo]

Most people would find it reasonable to expect a pilot to have experienced flight conditions in the area outside the certification limits, if it is reasonably probable that the aircraft will be in this condition.

I don't find it reasonable at all. Unless you are a qualified test pilot, you should not be going outside the certification envelope.

[OldnGrounded]

In response to this:
Most people would find it reasonable to expect a pilot to have experienced flight conditions in the area outside the certification limits, if it is reasonably probable that the aircraft will be in this condition.

Fortissimo posted this:
I don't find it reasonable at all. Unless you are a qualified test pilot, you should not be going outside the certification envelope.

That's fine, as long as non-test pilots can be reasonably confident that it is not "reasonably probable" that the aircraft will end up outside the envelope on any given flight.

[Bergerie1]

fizz,

It's very easy to sort these things out with hindsight and when sitting comfortably in an armchair!

[737 Driver]

How many of us would have diagnosed the problem correctly in the time available?

If any of the accident pilots had simply flown the aircraft and kept the aircraft in a reasonably in-trim state (the thumb switch will trump the automation every single time), then the time available would have been equal to the fuel available. There was no ticking time bomb here.

[737 Driver]

- What it screams to me is that the pilot(s) were so overloaded by control forces / stick shake / aural and visual warnings / general confusion that they had reverted to “pull back to make the houses look smaller” and had fixated on this due to saturation of their input channels. The trim running could well be the gorilla in the room, if you’ve seen the video.

Yes, I’ve seen the video, and yes I agree that it appears the Captain had achieved cognitive overload. Where I differ is that I feel the circumstances were not so extreme that cognitive overload would have been a reasonable expectation of a 737 type-rated Captain.

I used to do basic flight instruction, and I’ve seen many types of students. I would often tell them that flying an aircraft on a nice day really wasn’t that difficult once you had a little time under your belt, not too unlike learning to drive an automobile. The huge difference between a car and a plane, of course, is that you just can’t pull an aircraft over on the shoulder when things go wrong. You have to take whatever comes, work with whatever you have, and do your damnedest to get the aircraft safely back on the ground. I would tell my students that if they could not deal with that reality, then they should not become a pilot.

As professional pilots, we ought to meet an even much higher standard. When things started to go wrong, at least one of these pilots needed to look past the noise, place their hands firmly on the yoke and throttles, set the proper attitude and power settings, keep the aircraft in trim, and stay away from the rocks. That was all that was required. Everything else could have waited. The plane wasn’t on fire, the wing didn’t fall off, there were no bombs on board. This plane was flyable.

Yes, Boeing fracked up. Yes, the FAA and the airlines were culpable of going along with the fiction that the MAX wasn’t really that much different from the NG. But you know what? On any given day someone else could screw up and give us an aircraft that will malfunction in a unique and potentially dangerous way. And as always, the pilots are the last line of defense. We need to be mentally prepared for that reality or find another line of work.

[Water pilot]

Many pages back, in another thread LEOCh posted a schematic chart showing a nasty inflection between 10 and 15 degrees AOA, which is when MCAS kicks in. Once AOA is below 10 degrees, MCAS unwinds the nose-down trim (unless the pilots intervene with electrical trim inputs


This seems like rather complex behavior for the pilots not to be informed about or trained on, especially in a plane that is not advertised as a fly by wire plane. When exactly does MCAS start to unwind the trim and in the worst case scenario how much uncommanded nose down trim does the pilot have to unwind if they happen to have blipped the trim switch at the wrong point in the unwind scenario?

[GordonR_Cape]

This seems like rather complex behavior for the pilots not to be informed about or trained on, especially in a plane that is not advertised as a fly by wire plane. When exactly does MCAS start to unwind the trim and in the worst case scenario how much uncommanded nose down trim does the pilot have to unwind if they happen to have blipped the trim switch at the wrong point in the unwind scenario?


I am not a pilot, but interesting questions (some of which I may have hinted at very early in this thread). The simple answer is that the amount of nose down trim should be limited to 2.5 degrees, and the trim unwind process should only begin once AOA is below 10 degrees.

The assumption must be that the pilot would not "porpoise" the aircraft with the elevator, alternately crossing the MCAS 10 degree AOA threshold. This criterion requires time-smoothing, to avoid random fluctuations of the AOA values (as per the new specification).

Blipping the electric trim (either up or down) during the unwind process, could theoretically put the aircraft in a semi-unstable situation, since MCAS would be disabled, and cannot reactivate again (as per the new specification). Again we must assume that the pilot intentionally wants to keep the nose high for specific reasons (such as high-altitude terrain proximity avoidance). In this scenario MCAS should not try to second guess the flight situation, but rather wait for the pilot to release the elevator yoke (and sort out any trim issues later).

Presumably the MCAS system will be clearly documented to the point where pilots are assured that:
- MCAS will not inhibit the necessary elevator yoke authority during escape maneuvers
- The overall flight system will not produce an out of trim condition when exiting from a maneuver

I seems obvious that Boeing and the FAA will flight test all of this in great detail. Whether an average pilot needs to experience this in a simulator, is an entirely different question (conditions outside the normal flight envelope). The time-delay feedback process is indeed new, and somewhat uncharted territory.

[Chronus]

-

Yes, I’ve seen the video, and yes I agree that it appears the Captain had achieved cognitive overload. Where I differ is that I feel the circumstances were not so extreme that cognitive overload would have been a reasonable expectation of a 737 type-rated Captain.

I used to do basic flight instruction, and I’ve seen many types of students. I would often tell them that flying an aircraft on a nice day really wasn’t that difficult once you had a little time under your belt, not too unlike learning to drive an automobile. The huge difference between a car and a plane, of course, is that you just can’t pull an aircraft over on the shoulder when things go wrong. You have to take whatever comes, work with whatever you have, and do your damnedest to get the aircraft safely back on the ground. I would tell my students that if they could not deal with that reality, then they should not become a pilot.

As professional pilots, we ought to meet an even much higher standard. When things started to go wrong, at least one of these pilots needed to look past the noise, place their hands firmly on the yoke and throttles, set the proper attitude and power settings, keep the aircraft in trim, and stay away from the rocks. That was all that was required. Everything else could have waited. The plane wasn’t on fire, the wing didn’t fall off, there were no bombs on board. This plane was flyable.

Yes, Boeing fracked up. Yes, the FAA and the airlines were culpable of going along with the fiction that the MAX wasn’t really that much different from the NG. But you know what? On any given day someone else could screw up and give us an aircraft that will malfunction in a unique and potentially dangerous way. And as always, the pilots are the last line of defense. We need to be mentally prepared for that reality or find another line of work.





I couldn`t disagree more. To fly the modern airliners you fly the automatics. If for whatever reason you cannot do that then its very much up to the avionics to do whatever they have been setup to do. These guys did not have a cats in hell chance of persuading the automatics to allow them to interfere. They simply lost the very short argument with the machine. What sort of last line of defense is that, is it a bit like the Maginot Line, invincible until proven otherwise and how many times does it need to be demonstrated before someone realises it aint working. Give me human error any day, I can understand that, computers, electronics and all that wizardry that goes with them, let the kids addicted to them play with it all, that would be a whole load safer.

[formulaben]

I couldn`t disagree more. To fly the modern airliners you fly the automatics. If for whatever reason you cannot do that then its very much up to the avionics to do whatever they have been setup to do. These guys did not have a cats in hell chance of persuading the automatics to allow them to interfere. They simply lost the very short argument with the machine. What sort of last line of defense is that, is it a bit like the Maginot Line, invincible until proven otherwise and how many times does it need to be demonstrated before someone realises it aint working. Give me human error any day, I can understand that, computers, electronics and all that wizardry that goes with them, let the kids addicted to them play with it all, that would be a whole load safer.

And I couldn't disagree any more with this. You're basically endorsing no airmanship.

[hawk76]

As professional pilots, we ought to meet an even much higher standard. When things started to go wrong, at least one of these pilots needed to look past the noise, place their hands firmly on the yoke and throttles, set the proper attitude and power settings, keep the aircraft in trim, and stay away from the rocks. That was all that was required. Everything else could have waited. The plane wasn’t on fire, the wing didn’t fall off, there were no bombs on board. This plane was flyable.

Yes, Boeing fracked up. Yes, the FAA and the airlines were culpable of going along with the fiction that the MAX wasn’t really that much different from the NG. But you know what? On any given day someone else could screw up and give us an aircraft that will malfunction in a unique and potentially dangerous way. And as always, the pilots are the last line of defense. We need to be mentally prepared for that reality or find another line of work.

I couldn't agree more. With modern airliners, it is part of the pilot's job to be able to fly the plane when the automatic systems fail. Otherwise, what are we doing? If the automatics always work, pilots are out of a job. And if we can't get the plane out of trouble, we might as well not be sitting up front, either. Yes, in this instance Boeing, etc. made the job harder. And they need to fix that. In the Ethiopian case, they had stick shaker shortly after liftoff. Had one minute and 15 seconds to absorb that. Then an uncommanded, continuous nose-down trim for 9 seconds. Count that out, it's a long time. I don't fly the B737, but I would hope I would catch that in my aircraft!

I couldn`t disagree more. To fly the modern airliners you fly the automatics. If for whatever reason you cannot do that then its very much up to the avionics to do whatever they have been setup to do. These guys did not have a cats in hell chance of persuading the automatics to allow them to interfere. They simply lost the very short argument with the machine. What sort of last line of defense is that, is it a bit like the Maginot Line, invincible until proven otherwise and how many times does it need to be demonstrated before someone realises it aint working. Give me human error any day, I can understand that, computers, electronics and all that wizardry that goes with them, let the kids addicted to them play with it all, that would be a whole load safer.

I would hope any aircraft has some way of overriding the automatics and flying by hand, in case of multiple unmodeled failures. Be it cables, direct law, or whatever. And I would hope to train to be proficient in flying in that mode as well. I'm not trying to argue whether or not any plane is up to that standard, but that would be my goal. Either that or an ejection seat, but that doesn't work so well with pax. :hmm:

[Chronus]

And I couldn't disagree any more with this. You're basically endorsing no airmanship.

Try as one might, to endorse airmanship, computer says Nooo and coughs .

[EPHD75]

- When things started to go wrong, at least one of these pilots needed to look past the noise, place their hands firmly on the yoke and throttles, set the proper attitude and power settings, keep the aircraft in trim, and stay away from the rocks. That was all that was required. Everything else could have waited. The plane wasn’t on fire, the wing didn’t fall off, there were no bombs on board. This plane was flyable.
On any given day someone else could screw up and give us an aircraft that will malfunction in a unique and potentially dangerous way. And as always, the pilots are the last line of defense. We need to be mentally prepared for that reality or find another line of work.

Thank you 737 Driver. Your sentiment is exactly what we the flying public expects.

[LowObservable]

I am amazed at the continued "any real airman could have handled this... obvious trim runaway... follow the procedures" drumbeat from people who identify as US- or Euro-based pilots. (I say "identify" because at least one such got outed as a sim player.)

People! So far we know of only three occurrences of the basic failure (AoA sensor is bad from the start of roll, falsely high reading, high enough for stall warning, and it's the one driving MCAS today). Two resulted in total loss. The third was saved by a jumpseat rider who had attention to spare and a better view of the trim wheels. That is stark evidence that this failure sequence is dangerous in the extreme.

Moreover, airlines all over the world have, in recent years, contributed to the industry's excellent safety record. Not too many signs that (not to put too fine a point on it) the ethnicity of the pilots or management is a big deal.

[Loose rivets]

Quote:Originally Posted by GordonR_Cape https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10451495.html#post10451495)
Many pages back, in another thread LEOCh (https://www.pprune.org/members/484262-leoch) posted a schematic chart showing a nasty inflection between 10 and 15 degrees AOA, which is when MCAS kicks in. Once AOA is below 10 degrees, MCAS unwinds the nose-down trim (unless the pilots intervene with electrical trim inputs
.







Water pilot: #4242 My bold.
This seems like rather complex behavior for the pilots not to be informed about or trained on, especially in a plane that is not advertised as a fly by wire plane.

Water pilot continues below, but a point I've been wondering about for ages. MCAS winds back after it's done its thing? So little has been made of this - apart from me - that I wondered if I'd misunderstood. However, it seems that if the PF uses the electric trim, this will not happen. Since there was extensive use of the thumb switch trim, I guess this is why MCAS at no stage put things back where it found them. Erm, did it?

When exactly does MCAS start to unwind the trim and in the worst case scenario how much uncommanded nose down trim does the pilot have to unwind if they happen to have blipped the trim switch at the wrong point in the unwind scenario?

What a vital observation.

GordonR carries the logic forward in the next thread.

[737 Driver]

I am amazed at the continued "any real airman could have handled this... obvious trim runaway... follow the procedures" drumbeat from people who identify as US- or Euro-based pilots. (I say "identify" because at least one such got outed as a sim player.)

People! So far we know of only three occurrences of the basic failure (AoA sensor is bad from the start of roll, falsely high reading, high enough for stall warning, and it's the one driving MCAS today). Two resulted in total loss. The third was saved by a jumpseat rider who had attention to spare and a better view of the trim wheels. That is stark evidence that this failure sequence is dangerous in the extreme.

Moreover, airlines all over the world have, in recent years, contributed to the industry's excellent safety record. Not too many signs that (not to put too fine a point on it) the ethnicity of the pilots or management is a big deal.

Okay, as one of the posters who has been highly critical of the airmanship displayed by the accident pilots, would you please show me where I said anything denigrating about their ethnicity or nationality? Poor airmanship is poor airmanship regardless of race, creed, gender, citizenship, favorite football squad, or whatnot. And if it makes you feel any better, I believe the problem lies more in the training and airline culture in which they were raised than any individual shortcomings.

As a side note, I have invested a fair amount of personal time researching issues related to these accidents to include sifting through available aviation safety and accident databases. There have been plenty of other cases of commercial airline instrument failures leading to unexpected system responses and confusion among the crew. You just don’t hear about them because these events had a successful conclusion.

The notable exception was AF447 - loss of airspeed, confusing alerts, systems reacting in ways the pilot flying wasn’t expecting, improper crew response, followed by a hull loss and major loss of life. This was another clear example of the pilots’ failure to revert to basics and fly the aircraft. Their ethnicity or employment at a major European carrier granted them no special protection from a failure of airmanship.

[SquintyMagoo]

Quote:Originally Posted by GordonR_Cape https://www.pprune.org/images/buttons/viewpost.gif (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-post10451495.html#post10451495)

.Water pilot: #4242 My bold.


Water pilot continues below, but a point I've been wondering about for ages. MCAS winds back after it's done its thing? So little has been made of this - apart from me - that I wondered if I'd misunderstood. However, it seems that if the PF uses the electric trim, this will not happen. Since there was extensive use of the thumb switch trim, I guess this is why MCAS at no stage put things back where it found them. Erm, did it?



What a vital observation.

GordonR carries the logic forward in the next thread.

Doesn't there need to be a *working* AOA sensor that actually provides decreased AOA with the application of stabilizer by MCAS before MCAS will unwind? Why would unwind if it still thinks the AOA is too high?

[737 Driver]

When exactly does MCAS start to unwind the trim and in the worst case scenario how much uncommanded nose down trim does the pilot have to unwind if they happen to have blipped the trim switch at the wrong point in the unwind scenario?

MCAS does not “unwind” any of the nose down trim it has inputted. The expectation is that the pilots will put in the correct trim as they recover from the impending stall. We do stall recovery training regularly in the sim, and there is always a lot of retrimming involved.

[Loose rivets]

Well at some stage waaaaaaaay back I read the unequivocal statement that it does. As mentioned, I couldn't understand why I wasn't hearing more about that.

Now, Squinty makes this vital point as well as the thumb switch factor.

Doesn't there need to be a *working* AOA sensor that actually provides decreased AOA with the application of stabilizer by MCAS before MCAS will unwind? Why would unwind if it still thinks the AOA is too high?

The issue is, does it if fact do it, (when all but a high AoA is normal)

[G-V]

-
You have to take whatever comes, work with whatever you have, and do your damnedest to get the aircraft safely back on the ground. I would tell my students that if they could not deal with that reality, then they should not become a pilot.


Unfortunately there's not enough people of this kind on earth who are willing to become a pilot to satisfy this requirement.
It is manufactures, authorities and airlines obligation to cater for this reality. Once again, unfortunately.

[Icarus2001]

As professional pilots, we ought to meet an even much higher standard. When things started to go wrong, at least one of these pilots needed to look past the noise, place their hands firmly on the yoke and throttles, set the proper attitude and power settings, keep the aircraft in trim, and stay away from the rocks. That was all that was required. Everything else could have waited. The plane wasn’t on fire, the wing didn’t fall off, there were no bombs on board. This plane was flyable.

Yes, Boeing fracked up. Yes, the FAA and the airlines were culpable of going along with the fiction that the MAX wasn’t really that much different from the NG. But you know what? On any given day someone else could screw up and give us an aircraft that will malfunction in a unique and potentially dangerous way. And as always, the pilots are the last line of defense. We need to be mentally prepared for that reality or find another line of work. I completely agree with your post. The fact that the day before the Lionair crash another crew flew on safely and landed, to be able to write up the defect, speaks volumes.

[Bend alot]

Only thing Icarus it was not the crew that saved that flight (from the reports).

There seems very little info on this previous Lion Air flight and I/we do not know when the incorrect MCAS input was given. We do know on the two crash flights it was soon after take off, and either after flaps 0 selected or the flaps had fully retracted.

From memory a number of pilots have done the Lion Air & Ethiopian events in the MAX simulator (knowing they will have a MCAS simulation) and they did manage to land safely but said it was "very challenging" - so in a surprise event, the numbers of successful outcomes will reduce. I would have very little doubt the pilots used to do these simulator events, post crashes were nothing but extremely capable pilots selected by Boeing. So in reality it should not have been a challenge at all as many have mentioned, but a breeze or a non event - or did Boeing use substandard pilots for this simulation?

[GordonR_Cape]

MCAS does not “unwind” any of the nose down trim it has inputted. The expectation is that the pilots will put in the correct trim as they recover from the impending stall. We do stall recovery training regularly in the sim, and there is always a lot of retrimming involved.


MCAS absolutely should unwind the nose down trim once the AOA drops below 10 degrees (as long as no pilot trim input occurs). I don't have the detailed reference, but this was the whole point of MCAS. It would operate silently in the background, provide a simulated yoke force feedback (or longitudinal stability), and then disengage once the maneuver is completed.

Any automated (and previously undocumented) system that left an aircraft out of trim after a "simple" maneuver, could never possibly be certified. Stall escape implementated by the pilots is an entirely different matter, as was the runaway behaviour of MCAS due to a stuck AOA sensor.

This discussion is around a not previously considered human/machine feedback process, driven by a delayed trim unwinding process, and subject to interruption by pilot trim inputs. This point seems not to have been covered in any other forum, other than the brief hint, and useful chart, referenced earlier in this thread.

This may turn out to be a non-issue, if properly implemented and documented. It is definitely the kind of concern to be discussed by the Joint Authorities Technical Review.

[edmundronald]

Okay, as one of the posters who has been highly critical of the airmanship displayed by the accident pilots, would you please show me where I said anything denigrating about their ethnicity or nationality? Poor airmanship is poor airmanship regardless of race, creed, gender, citizenship, favorite football squad, or whatnot. And if it makes you feel any better, I believe the problem lies more in the training and airline culture in which they were raised than any individual shortcomings.

As a side note, I have invested a fair amount of personal time researching issues related to these accidents to include sifting through available aviation safety and accident databases. There have been plenty of other cases of commercial airline instrument failures leading to unexpected system responses and confusion among the crew. You just don’t hear about them because these events had a successful conclusion.

The notable exception was AF447 - loss of airspeed, confusing alerts, systems reacting in ways the pilot flying wasn’t expecting, improper crew response, followed by a hull loss and major loss of life. This was another clear example of the pilots’ failure to revert to basics and fly the aircraft. Their ethnicity or employment at a major European carrier granted them no special protection from a failure of airmanship.



AF447 impacted the manufacturer not because of ethnicity issues but BECAUSE THE VICTIMS, PILOTS AND THE AIRLINE WERE SITED IN THE COUNTRY THAT BUILT THE PLANE AND CERTIFIED IT. So basically everyone concerned ended strung up in front of the same investigation system with an angry populace, and investigators could speak to all actors, and in the end everyone got blamed, AF for not swapping out the pitots, the pilots for winning the Darwin award, and the manufacturer for a tech failure and bad ergonomics.

In the case of the Max, the issue of "foreign carriers, foreign pilots" is getting raised as a way for Boeing and the FAA critters to wrangle their way out of a proper accounting for a design and certification process failure, with the dog whistle that the "foreigners" shouldn't be allowed to cash in on the liability payments generously provided by US courts to US victims.

Everyone here is very aware that if 400 US citizens had died in 2 plane crashes, Boeing would be facing serious financial consequences, and there would be a real congressional inquiry re. the FAA's somewhat lax certification practices.

Nobody anywhere in the world believes that the pilots on board the two sadly doomed airframes were anything other than perfectly average trained individuals. In fact Boeing's customers mostly employ pilots of average abilities, because they employ a lot of pilots. There may be some retired fastjet pilots in the trade, but they are now outnumbered by civilians.

Interestingly, on this forum, pilots seem to blame the Max pilots for not flying their planes, while engineers blame the design and the process. Quite possibly both are correct.

Edmund

[Mach1.]

Anyone know if the trouble with Max8 has led to increased orders for Airbus and price increases?

[DaveReidUK]

MCAS absolutely should unwind the nose down trim once the AOA drops below 10 degrees (as long as no pilot trim input occurs). I don't have the detailed reference, but this was the whole point of MCAS.

I'd be very interested to see a reference that says that.

[olster]

There is a lot of drivel written here quite obviously from people who have never flown a B737, have no real understanding of swept wing aerodynamics yet appear willing to pontificate on how the pilots should have gone back to basics etc etc. The MCAS system was built into the Max, no information was given to the pilots who then found themselves with a stabilizer so far out that essentially and eventually left zero elevator authority. Ambiguity for experienced 737 pilots would partly be due to the speed trim system which also operates independently of the pilots. I have the greatest sympathy for the pilots in these terrible accidents and not sure how I would have reacted. I usually avoid the willy waving but I have over 10,000 hours 737, mainly pic plus usual training qualifications. You 20/20 hindsight experts must be utterly brilliant of course.

[GordonR_Cape]

I'd be very interested to see a reference that says that.

I can't find primary references stating that, other than the text and chart by LEOCh previously mentioned: https://www.pprune.org/showthread.php?p=10423226

The best simple description is a single sentence from b737.org.uk: 737 MAX - MCAS (http://www.b737.org.uk/mcas.htm#techdes)
After AoA falls below the hysteresis threshold (0.5 degrees below the activation angle), MCAS commands nose up stabilizer to return the aircraft to the trim state that existed before the MCAS activation.

Edit: There is an intriguing extra sentence (mangled meaning?) about the proposed improvements:
Furthermore the logic for MCAS to command a nose up stab trim to return to trim following pilot electric trim intervention or exceeding the forward column cutout switch, will also now be improved.

[DaveReidUK]

Thanks for that. It does sound rather counter-intuitive that as soon as AoA drops below the threshold for MCAS commanding AND trim, it then does the opposite.

I note that the extract from the Max System Differences Training Manual (presumably a Boeing publication) on Chris's site makes no mention of MCAS commanding ANU trim:


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/640x475/mcas_mtm_671345698088fa78ae2c846dab705782503bd83a.jpg
http://www.b737.org.uk/images/mcas-mtm.jpg

[GordonR_Cape]

Thanks for that. It does sound rather counter-intuitive that as soon as AoA drops below the threshold for MCAS commanding AND trim, it then does the opposite.

I note that the extract from the Max System Differences Training Manual (presumably a Boeing publication) on Chris's site makes no mention of MCAS commanding ANU trim:


Yes, several people (including myself) have pointed out that definition leads to an "unstable" outcome when AOA fluctuates close to the 10 degree threshold. Not an elegant algorithm at all...

[737 Driver]

I can't find primary references stating that, other than the text and chart by LEOCh previously mentioned: https://www.pprune.org/showthread.php?p=10423226

The best simple description is a single sentence from b737.org.uk: 737 MAX - MCAS (http://www.b737.org.uk/mcas.htm#techdes)



The description cited above is not an official Boeing source. I have seen not any system description from Boeing that states that MCAS will ever input nose up trim. In this way, it is not unlike what the Speed Trim System does approaching a stall when the flaps are extended.

[Bend alot]

The description cited above is not an official Boeing source. I have seen not any system description from Boeing that states that MCAS will ever input nose up trim. In this way, it is not unlike what the Speed Trim System does approaching a stall when the flaps are extended.
The more that comes out - the simple power and pitch pilots will save the day, seems less likely as hidden automation seems to kill those egos.

MCAS version 1 had big problems - version 2 has the same but different problems.

Just recall guys no, or low MCAS input = possible flight outside certification limits within the flight envelope is possible. Thus pitch and power is not relevant as it is not proven and unless you are a Test Pilot commenting on 737 flight outside the certification limits is no more relevant than a pax.

Clearly even today MCAS is not understood and there seem many secrets - that should have never been the case. But it seems to be the future.

[infrequentflyer789]

The description cited above is not an official Boeing source. I have seen not any system description from Boeing that states that MCAS will ever input nose up trim. In this way, it is not unlike what the Speed Trim System does approaching a stall when the flaps are extended.

Correct, but there are multiple credible sources saying effectively the same thing. It was in point (1) of FCEng84's long clarification post earlier in thread: link (http://www.pprune.org/showpost.php?p=10430828&postcount=2589)

FCEng84 has posted good, readable, and apparently accurate information on MCAS from the start, I haven't had reason to dispute any of the other information so I would tend to trust this part too.

[bill fly]

Thanks for that. It does sound rather counter-intuitive that as soon as AoA drops below the threshold for MCAS commanding AND trim, it then does the opposite.

I note that the extract from the Max System Differences Training Manual (presumably a Boeing publication) on Chris's site makes no mention of MCAS commanding ANU trim:


https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/640x475/mcas_mtm_671345698088fa78ae2c846dab705782503bd83a.jpg
http://www.b737.org.uk/images/mcas-mtm.jpg

The training guide quoted states of MCAS that it “allows the stabiliser to move in the nose down direction etc.” It does more than allow if it causes it to move...

[HundredPercentPlease]

Interestingly, on this forum, pilots seem to blame the Max pilots for not flying their planes, while engineers blame the design and the process. Quite possibly both are correct.

Edmund

There are a handful of skygods on here who continuously say "they should have" or "all they needed to do was" or "I would have just" and so on.

In my opinion, pilots with these outlooks are less than safe.

They have a high opinion of themselves.
They have not appreciated the HF elements of these accidents.
They have not considered how HF will affect their operation, in the event of a serious problem.
They are therefore not prepared.

If we just blame the pilots for being a bit crap, then nothing in the industry will improve. We need to understand why these pilots, despite all of their efforts, could not keep the aircraft from the ground. Only when we understand, can we make the correct changes to stop it happening again.

Even the finest pilots in the world, when suddenly presented with a simple failure (double engine failure, for example), will sit there and think "no - this can't be happening" followed by "what on earth do I do".

It is inexcusable that Boeing and the FAA allowed a pretty ropy old aircraft with some dodgy characteristics to be released with even poorer characteristics. It is a demonstration of how multiple signals during a critical phase of flight can make it very difficult for pilots to overcome startle, then diagnose, fly and solve a problem.

As an aside - in my airline it was discovered that UAS events were handled badly. So in one sim cycle we were trained. In the next sim cycle we were tested, and still it was handled badly. So in the next sim cycle again we were trained a lot more. It transpires that real UAS is really a HF event of great complexity, and is therefore very difficult to get right. The technical side of it is a doddle.

Can we please focus on how we contribute to make the industry better (safer)?

[LowObservable]

There have been plenty of other cases of commercial airline instrument failures leading to unexpected system responses and confusion among the crew. You just don’t hear about them because these events had a successful conclusion.

That's a diversionary response. This was not just a case of "unexpected system responses". MCAS commandeered the most powerful control surface on the airplane and, in effect, caused an intermittent runaway, something for which nobody was trained.