Ethiopian airliner down in Africa

[Avionista]

wheelsright:

However, the question is why substantial disagreement between sensors was not regarded as an important factor in disabling MCAS automatically?

This is the question which Boeing needs to answer.

Boeing has now revealed that the MAX had a system which compared the values supplied by the Left and Right AoA sensors. This system was supposed to flag an alert to the crew when the disagreement between the sensor values exceeded, presumably a set threshold. This AoA disagree alert was not actually implemented due to an error/oversight which the company discovered in 2017.

Thus, it seems the MAX had a means of checking the validity of AoA sensor values from day one. I cannot comprehend why this AoA disagree signal was not used by the MCAS system to inhibit nose-down trim inputs to the HS for as long as the AoA disagree signal=TRUE. Had this been done, it is unlikely the Lion Air and Ethiopian crashes would have occurred.

[737 Driver]

What is the published procedure for AoA disagree notification when installed?
.


The "AOA Disagree" procedure is a simple redirect to the "IAS Disagree" or "ALT Disagree" procedure because that is the immediate impact of a bad AOA input. The "IAS Disagree" procedure is a redirect to the "Airspeed Unreliable" procedure.

What is currently not well covered in any of the current 737 procedures is that a faulty stall signal that is generated by a bad airspeed or AOA input will create a number of ancillary system issues that must also be addressed. On the other end of the spectrum, an erroneous high airspeed input will cause a few problems, but not nearly as many as the low airspeed case.

[wheelsright]

Uh...., no. I could go into all the reasons why one shouldn't, but can you just take my word for it?

Actually, I think it would be better to go into it and not take your word for it. I for one would like a full explanation. Many people are clearly missing something. PS Most people know the memory items and publications from Boeing... the issue is whether following them definitely solves the issue.

[RatherBeFlying]

From 737 Driver Apparently no one [at Boeing] connected the dots that by removing the control column cutout switches from the circuit, MCAS was now set up to malfunction in a novel and hazardous manner.

This has been mentioned a number of times, but really was the final straw that broke two airplanes.

More thorough engineering would have looked at flight path angle before trimming nose down. Airspeed and radio altimeter are also worthwhile components in determining whether additional nose down trim is advisable. But then that would increase software development and testing costs.

The Boeing press release seems to have been written by the AoA department, which apparently has nothing to do with the MCAS department:confused:

[MemberBerry]

It is very clear you're unable to grasp the concept of how a memory item procedure is conducted; it is certainly not how you suppose it to be. You are conflating a NNC procedure and a memory item procedure. Stop wasting our time sharing your opinions on things you know nothing about. This is rubbish speculation and it is also happens to be 100% wrong.

I understand that the memory items are so time critical that you need to be able to perform them immediately. However, when such a procedure contains "ifs" that require you to check if the problem stopped before progressing to the next step, even if you do everything in complete silence without any communication 5 seconds doesn't seem enough.

I found a study called "LINE PILOT PERFORMANCE OF MEMORY ITEMS" on the FAA's site that discusses among other things two conflicting concerns regarding performance under stress: doing things as fast as possible vs doing things as accurately as possible:

https://www.faa.gov/about/initiatives/maintenance_hf/library/documents/media/human_factors_maintenance/line_pilot_performance_of_memory_items.pdf

From the study:

Discussions with pilot participants in this study suggest that the requirement to perform certain actions from memory implies a sense of urgency in the performance of those actions. This introduces another potential source of error due to the loss of accuracy as speed is increased, an effect that is best described by the speed-accuracy operating characteristic (SAOC). The SAOC is a function that represents the inverse relationship between accuracy and speed. As the performance of a task requires more speed, accuracy is reduced until it approaches chance. If accuracy is excessively emphasized, then the time required to complete a task increases greatly with little improvement in accuracy.

...

Using an emergency descent as an example, an earlier study [2] showed that crews performing an emergency descent from memory took longer to descend than crews using the checklist. The difference in descent time resulted from omission errors by crews performing memory items. They occasionally omitted deploying the speedbrake, causing the airplane to descend slower. On the other hand, crews that performed the procedure by reference to the checklist did not make these errors, but took longer to complete the checklist. Regardless of the time required to read through the checklist, the crews performing the procedure by reference descended to a safe altitude in less time because of the use of the speedbrake.


This was also demonstrated in the Ethiopian flight, with the pilots forgetting to disable the auto throttles as part of the runaway stabilizer memory items.

The entire study is a very interesting read. Sorry if it has been posted here before, I searched the thread and I couldn't find it.

[737 Driver]

Actually, I think it would be better to go into it and not take your word for it. I for one would like a full explanation. Many people are clearly missing something. PS Most people know the memory items and publications from Boeing... the issue is whether following them definitely solves the issue.

First of all, we must recognize that MCAS is currently being redesigned and whatever techniques that are discussed here may be entirely moot by the time the MAX is cleared for operations. That being said, and assuming the MCAS design as it existed at the time of the MAX grounding, the short answer is that an "AOA Disagree" message can occur in situations where an unwanted MCAS activation would not happen. MCAS requires a number of conditions to be present before it kicks in, and disconnecting the electric trim prematurely potentially introduces other hazards into the operation. If the pilot was concerned about the potential for an unwanted MCAS activation, the two clear avenues to inhibit MCAS is to engage the autopilot or extend the flaps. Use of the autopilot was precluded in the accident aircraft due to the effects of the erroneous stall signal.

[wheelsright]

First of all, we must recognize that MCAS is currently being redesigned and whatever techniques that are discussed here may be entirely moot by the time the MAX is cleared for operations. That being said, and assuming the MCAS design as it existed at the time of the MAX grounding, the short answer is that an "AOA Disagree" message can occur in situations where an unwanted MCAS activation would not happen. MCAS requires a number of conditions to be present before it kicks in, and disconnecting the electric trim prematurely potentially introduces other hazards into the operation. If the pilot was concerned about the potential for an unwanted MCAS activation, the two clear avenues to inhibit MCAS is to engage the autopilot or extend the flaps. Use of the autopilot was precluded in the accident aircraft due to the effects of the erroneous stall signal.

Sorry to push you on this, but that is not a clear answer. What precisely is the procedure that the ET302 pilots should have followed? ie What would you have done? That is not in any way suggesting the the ET302 followed the correct procedure.

[Smythe]

That statement about the first meeting seems really wrong. The AOA won't work without the plane moving through the air (preferably in the direction the nose is pointed). Because the vane has a counterweight inside it will be more than happy to sit at a random angle, until somewhere during the T/O roll the will start indicating AOA. The 400' sounds more reasonable to me, as it will give time for factors as side-slip due to crosswind T/O to dissipate.

That is a reasonable assumption, provided both vanes are working while on the ground. Frozen AoA, broken AoA, misaligned AoA...a first line of defense would be to determine if the AoA vane is bad while still on the ground.

[737 Driver]

.
I understand that the memory items are so time critical that you need to be able to perform them immediately. However, when such a procedure contains "ifs" that require you to check if the problem stopped before progressing to the next step, even if you do everything in complete silence without any communication 5 seconds doesn't seem enough.


Okay, since I apparently started this particular discussion point, let me be absolutely clear - again - that just because something CAN be done in 5 seconds doesn't mean it MUST be done in 5 seconds. One of my favorite sayings is, "It is usually more important to do something right than it is to do it quickly." In all "memory item" tasks, it is far, far more important for the crew to proceed methodically and get every step done correctly than it is do it quickly. I am sorry if I gave any other impression.

That being said, the accident crews really did have all the time they needed to execute the runaway trim procedure as long as one of the pilots was actively flying the aircraft, which of course includes actively trimming against the MCAS input.

[wonkazoo]

FWIW from and ex non-pilot military aircrew viewpoint, I have been in a few crappy situations when the day has just gone bad. In mil ops we operated close to the envelope in unfamiliar environments and it's the nature of these ops that means that sometimes, on thankfully very rare occasions, guys didn't come home. We all read the accident reports and make mental notes to ourselves...must be wary of that...must not do that ...must make sure I communicate that better...take another look at that checklist etc etc. But when it happens, the engine fire, the stuck main landing gear, the assymetric flap, the loss of hydraulics, smoke and fume, lightening strikes, severe CAT in the middle of an otherwise smooth moonlit cruise, flapless over the fence on short runway at 160 kts etc etc, there is a startle factor, there is time when you hear nothing and see nothing or can't make sense of anything, there is puzzlement and a fear that your event could well be the subject of the next accident report, and yes, a not unnatural fear that this could be your last flight. There is no immediate recall capacity because your senses are so overwhelmed with incoming information that you just can't assemble any course of action except whats right in your face and that leads to target fixation, like trying to control and uncontrollable wildly spinning aircraft, like trying to select the autopilot on, again and again and again!. It takes a few moments, but eventually, the haze clears. The airplane is still flying, (not in Wonkazoos case) new information is not coming and it seems like time has slowed down. Things start switching back on, you start to interpret the sounds you are hearing, the things you can see and thankfully, you start to recall memory actions. In Wonkazoos case the information didn't stop coming. Excessive and continuous G force is an overwhelming inhibitor to clear thinking. But fortunately he broke the target fixation and bailed. Everyone who has experienced hypoxia training will have experienced target fixation and how difficult it is to self recognise it let alone break it. Unlike Wonkazoos rather more desperate situation, my personal experiences were the type of things you might train for in a simulator. So much so that once you are over the startle and the haze, the immediate actions are almost routine. Importantly, you burst into pre-trained action safe in the knowledge that the event didn't kill you, that the bird still has its feathers and is flying and that if everyone does exactly as they are trained to do we'll get this thing on the ground even if the aircraft may not be reusable afterwards!

Wonkazoo and 737 Drivers' positions are so far apart but can easily be explained by the entirely different nature of events these guys have experienced and/or trained for. My experiences would lead me to agree with 737 Drivers view. That is, you get a scare, the event stabilises, you shake yourself off and go to memory recall. All going well, you, rather than someone else gets to write the event report afterwards. But now we come to ET. This should have been non-threatening 'routine' emergency. I know, using 'routine' and 'emergency' together is an oxymoron but you are trained for this right? That's why we are checked to fly. We are supposed to know what to do in these circumstances in the air because for all those recall items we maintain 100 percent recall training for them on the ground. The ET Captain would have been living under a rock and the airline grossly negligent if he wasn't aware of the Lion Air accident and what Boeing subsequently directed was his best and only courses of action to avoid disaster.

So why didn't he handled it correctly? Why didn't he just manage the UAS, turn back and land? My belief is that he didn't feel he was experiencing a routine UAS, or shall we call this a 737 Driver type of emergency, but rather that this nasty MCAS beast, that he only relatively recently become aware of, presaged by a UAS event had selected him that day. I believe there was too much information coming in for him to get out of startle mode and that this was aggravated by an early immediate assessment that he was in a fight for survival with MCAS right from the get go. He was thinking too far down track, to something that hadn't even happened yet but which led to target fixation on selecting auto pilot and his subsequent cognitive inability to deal with flaps, Vmo or cutout switches. He was not experiencing a 737 Driver "do the checklist your trained for" type of emergency but rather the "Oh no, not this" or Wonkazoo type of emergency where a fight to the death was about to start.

If the ET Captain had never heard of MCAS, he probably would have carried out the UAS and landed safely. Basically, his mere knowledge of MCAS but lack of full understanding of it may have scared the c##p out of him. How many reports have their since been of pilots that wont fly the airplane again until they are satisfied Boeing's fix and training solutions are 100 percent and in some cases others saying they just wont fly it again regardless. The ET Captain would have been deeply concerned about the possibility of a MCAS event and this self - fulfilling prophecy may have led him into the clutches of MCAS from which there was no escape.

Watch this scene from "Glory". https://www.youtube.com/watch?v=90x6kAcVP54 and identify the difference between the 737 Driver correct actions and satisfactory outcomes and the Wonkazoo actions and outcomes. The soldier considers himself a pretty good shot but it doesn't take much to imagine the Colonel as MCAS and the soldier as the ET Captain. You see the soldier startle, you see his fumbling attempts to do a simple task, that previously he had done with aplomb and you see the utter disbelief at the outcome.

So sorry for the long opinionated post but I hope it provoked some thought. 737 Driver and Wonkazoo had an interesting, lively and ultimately respectful discussion some posts back from which I learnt a lot. I think ultimately they are both right..but for different reasons.

Thank you for finding a way to articulate one of the primary differences between my views and those of 737 Driver. (and as a consequence between two disparate groups here and probably around the world...) I've spent some time trying to noodle out a way to express them coherently and you have done better than I could have by far.

To be clear: I am agreement with most of what Mr. Driver says about training and the industry. The only real point where we diverge is on the reactions of the crews and the culpability of them or on them for the outcomes as they happened. As far as I can tell we are in agreement that industry across the board has set the stage for incidents like these, as well as that there is a ton of shared responsibility, from manufacturer to regulator to commercial operators and training systems down to (in a very minor way) the crews themselves. The difference between us is (I think) that I give the crews a pass because if all the previous people (or even some of them) had done their jobs even half competently then those six pilots would not have been sitting on a hot seat in the pointy end in the first place.

No, you cannot design an idiot-proof or perfectly safe airplane, but you can design one that won't try to kill the crews flying it if one of your data devices goes south. If you do design (and certify!!) such a contraption, no matter the cause, you should be held to very high account indeed.

Warm regards,
dce

[737 Driver]

Sorry to push you on this, but that is not a clear answer. What precisely is the procedure that the ET302 pilots should have followed? ie What would you have done? That is not in any way suggesting the the ET302 followed the correct procedure.

This has been covered before, but here it is again. This particular malfunction (AOA failure generating an erroneous stall signal) first presents itself as an unreliable airspeed event. The 737 has a procedure called "Airspeed Unreliable" which if properly followed, would have put the aircraft in a stabilized configuration at a safe altitude. An important point is that the flap configuration should not have been changed (i.e. flaps left extended) until the "Airspeed Unreliable" checklist had at least proceeded far enough to identify if either pilot actually had a reliable airspeed. In theory, the ET302 crew should have also been in possession of the information on MCAS that came out after the Lion Air 610 accident, and given this information they should have left the flaps extended and returned to the departure airport for landing. In this case, MCAS would never had activated.

There is some suggestion that the information on MCAS was not properly distributed to the crews. However, in this case I still question whether the flaps should have been retracted given the nature of the malfunction. Even so, if the crew had first completed the Airspeed Unreliable checklist, they would have been in a stabilized aircraft at a higher altitude. Once the flaps were retracted, the erroneous MCAS activation would have presented itself as runaway stab trim. Those procedures have already been discussed, but they were not followed either. So in short, there were two well-established procedures that were not used, and if used would have had a decidedly different outcome.

[Rated De]

No, you cannot design an idiot-proof or perfectly safe airplane, but you can design one that won't try to kill the crews flying it if one of your data devices goes south. If you do design (and certify!!) such a contraption, no matter the cause, you should be held to very high account indeed.


Succinct.

Whatever happened to the once proud and accountable philosophy driving human endeavour?

[safetypee]

Wheelsright, #5014

Re Old MCAS. We cannot assume that crews knew of MCAS interaction with trim, (Boeing did not publish details).
With some knowledge (ET), the procedure called for use of trim and / or deduction of trim malfunction. See discussions on time assumed to recognise malfunction - MCAS active/quiescent cycle would take at least 13 sec of dedicated observation, thus probably much longer; then follow the trim runaway drill.
(5 sec could have been the value used in certification for trim runaway - but MCAS is not continuous)
An AoA alert only adds to the general confusion of several alerts consequential to AoA malfunction.

-

Re ground inhibit of AoA. As reported the logic appears reasonable. AoA vane requires airflow thus is inaccurate until xxx kts, but it is required soon after rotate for the critical stick-shake function.
Disagree provides no benefit in this, but even with contrary arguments, inhibition of superfluous alerts below 400 ft is reasonable.

I suspect that the AoA mess originates from dominant customers request for AoA display (gauge), similar to 757 option. Their reasoning driven by cost to meet the then emergent upset recovery training - we have AoA display thus less / no additional training. Boeing said yes, but possibly added the disagree alert to overcome the ‘misleading’ information certification aspect with AoA malfunction - gauges show different values but not which is incorrect.
The better engineering solution is to remove the display - AoA Disagree not required, MCAS inhibited, … no additional training, install new alert that MCAS is inoperative.

[Takwis]

Uh...., no. I could go into all the reasons why one shouldn't, but can you just take my word for it?

What does TBC-19, the Boeing Flight Crew Operations Manual Bulletin, say you should do when there is an AOA disagreement?

Not that I agree, but they make no mention of an unreliable airspeed checklist...they jump right into fixing the trim problem.

[GordonR_Cape]

I understand that the memory items are so time critical that you need to be able to perform them immediately. However, when such a procedure contains "ifs" that require you to check if the problem stopped before progressing to the next step, even if you do everything in complete silence without any communication 5 seconds doesn't seem enough.

I found a study called "LINE PILOT PERFORMANCE OF MEMORY ITEMS" on the FAA's site that discusses among other things two conflicting concerns regarding performance under stress: doing things as fast as possible vs doing things as accurately as possible:

https://www.faa.gov/about/initiatives/maintenance_hf/library/documents/media/human_factors_maintenance/line_pilot_performance_of_memory_items.pdf

This was also demonstrated in the Ethiopian flight, with the pilots forgetting to disable the auto throttles as part of the runaway stabilizer memory items.

The entire study is a very interesting read. Sorry if it has been posted here before, I searched the thread and I couldn't find it.

I have not read that particular study before, but there are several focusing on errors in checklist processing. This one is quite thorough. Summary version, and full paper:
https://flightsafety.org/asw-article/designing-a-better-error-trap/
https://human-factors.arc.nasa.gov/publications/NASA-TM-2010-216396.pdf
Checklist deviations clustered into six types:
flow-check performed as read-do;
responding without looking;
checklist item omitted, performed incorrectly, or performed incompletely;
poor timing of checklist initiation;
checklist performed from memory;
and failure to initiate checklists
(in order of number of occurrence)
The first two types accounted for nearly half of the checklist deviations observed.

Monitoring deviations grouped in three clusters:
late or omitted callouts,
omitted verification,
and not monitoring aircraft state or position

Although this study focused mainly on checklist use and monitoring deviations, additional data on
primary procedure deviations provide context and allowed us to examine how effective checklists
and monitoring were at trapping primary procedure errors

[wheelsright]

safeteepee #5039

Do not disagree with anything in your post.

But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches? I feel there is something being missed here. Clearly, it is intended by Boeing that you can, and that is the information that has been provided. Given, two crews appear to have failed to apply sufficient nose-up trim, I have a niggling doubt it is the whole story. I want a reason they failed to apply sufficient nose-up other than they were stupid. I realise there may not be a reason...

[Zeffy]

https://youtu.be/QytfYyHmxtc

Compelling interviews with Chris Brady ( The Boeing 737 Technical Site (http://www.b737.org.uk/) ), Dennis Tajer, Peter Lemme, David Learmount and Dominic Gates.
43 minutes...

[737 Driver]

PART 1

In the interest in moving the conversation along, and in particular to help transition this thread from a rearview, reactive mode to a more forward-looking proactive one, I would like to tee up a subject that is hopefully familiar to many aviators - the Threat and Error Management Model. I have some more thoughts to share that build upon this model, so it would be helpful to have some familiarity with it.

Briefly, the TEM model examines aviation safety through a lens that assumes that pilots will always be faced with threats (known and unknown) and errors. It is assumes that there are no perfect aircraft, environments or people, but it tries to devise a resilient system that is capable of identifying and mitigating threats and trapping errors. Rather than cut and paste a full description of the TEM model, I would ask you to look at the links below:

Introduction to Threat and Error Management (http://montereynavyflyingclub.org/Safety%20Presentations/Intro%20to%20TEM%20Training%20v7a%20with%20VMax.pdf)

Wikipedia Threat and Error Management (https://en.wikipedia.org/wiki/Threat_and_error_management)

Part of the TEM model is the concept of barriers. Barriers are those things that can be put in place to mitigate threats and trap errors. Some people refer this to the "Swiss Cheese" model because it assumes that no barrier is perfect either. Even though there will be holes in each barrier, the concept is to have enough of the right type of barriers so the "holes" do not line up and lead to either an undesired aircraft state or worse, an incident or accident.
.

https://cimg6.ibsrv.net/gimg/pprune.org-vbulletin/687x435/tem_barriers_6e44c1029290218d2fbf9b81b8601ab554adf94e.jpeg

The MAX accidents can be analyzed using the TEM model to identify not only the particular threats and errors, but also whether there were sufficient barriers and/or why the existing barriers did not ultimately prevent these accidents. Armed with this information, then the goal is to identify how those barriers can be improved to prevent future incidents and accidents.

[737 Driver]

What does TBC-19, the Boeing Flight Crew Operations Manual Bulletin, say you should do when there is an AOA disagreement?

Not that I agree, but they make no mention of an unreliable airspeed checklist...they jump right into fixing the trim problem.

Had to go look up TBC-19. The information was incorporated into our company manuals a little differently, but it is essentially the same guidance. This supplement specifically discusses the impact of an erroneous AOA on the trim system. It does not address the effect of erroneous AOA (particularly of the "stall" variety) on other aircraft systems - of which there are quite a few. The crew still needs to deal with those problems, and we have existing procedures for most (but not all) of them. Unreliable airspeed is one of the outcomes of the AOA failure, but we have a NNC that is (mostly) suitable and thus did not need to be modified. Other than the erroneous stick shaker (for which there is no checklist) unreliable airspeed was the first manifestation of the AOA failure and should have been dealt with first.

A careful reading of TBC-19 basically states that a bad AOA input can create unwanted stab trim movement, and the proper response to the unwanted stab movement is to execute the Runaway Stabilizer Trim checklist. I might add that functionally while experiencing this malfunction in the air, we do not refer to this document (or its equivalent). We refer to the appropriate non-normal checklist.

[MurphyWasRight]

safeteepee #5039

Do not disagree with anything in your post.

But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches? I feel there is something being missed here. Clearly, it is intended by Boeing that you can, and that is the information that has been provided. Given, two crews appear to have failed to apply sufficient nose-up trim, I have a niggling doubt it is the whole story. I want a reason they failed to apply sufficient nose-up other than they were stupid. I realise there may not be a reason...

It has pretty well been established on this thread that pilot electric trim will work in all conditions (does not stall under load) and interrupts MCAS if active as shown by ET trace at ~05:40:27. This pilot trim input was possibly then interrupted by cutout switches.

Other than 'deer in headlights' loosing it I see a few possible factors:

1: Pilot accustomed to short blips not comprehending amount truly needed, this fits Lion Air when the FO was ineffective at the end when PIC handed over control while the Captain was mostly successful.

2: Trimming by column feel not position: May seem that AC is closer to trimmed than it is. In other words if you have been pulling really hard then just slightly hard may feel like close to trimmed, I am sure the pilot did not want to over trim given all the alarms.
This might explain ET first retrim at 05:4-:15. Unfortunately we don't have the column force graph, just position.

3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.

Hopefully the final reports will fully address this question.

[Cows getting bigger]

737 Driver, TEM incorporates the whole system, not just pilots being faced with issues. So, in this case one could view MCAS trim runaway as the threat with AOA failures, inadequate training, crew responses etc as errors.

Without going over the apportionment argument again (that’s one for the lawyers), MCAS brought a new TEM ‘flow’ that was not properly thought through. The slightly worrying thing is a similar flow could apply to any trim runaway; in hindsight the number of layers in place may be too few or, more likely, some of the layers have rather large holes.

TEM works, as long as everyone involved recognises the importance their role in the system. Some thousands of posts back I postulated that the overall risk may have been (inadvertently) ‘shuffled’ too far in the direction of the crews.

[Takwis]

3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.


Last time I was in the sim, doing stalls and falls, I had an unusual attitude recovery from somewhat inverted (120 degrees), nose low. There were several other stalls leading up to this, so the stick shaker had been going quite a bit. On this one, while trying to roll, push, get the speedbrakes out, and trim, my thumb slipped off the trim switch two or three times. I can easily see how hard it would be to pull with some force on the yoke, and keep your thumb on the trim, after a long period of stickshaker activation.

[737 Driver]

737 Driver, TEM incorporates the whole system, not just pilots being faced with issues. So, in this case one could view MCAS trim runaway as the threat with AOA failures, inadequate training, crew responses etc as errors.


You are correct. The TEM model can be applied to the entire chain including what went wrong during the design process. This model is so flexible that it is often used outside of aviation as well. However, as I have previously mentioned, my main interest is what can done at the flight crew level, so that is where my focus is.

[Smythe]

driver,

the flow of if/then logic in the system is lost with legacy and lack of a comprehensive logic flow chart.

As an example, the accident in DXB, when the pilots pressed TOGA, but then the ac bounced on the runway. The pilots had no idea of the logic switch in the system, and what was disabled with weight on wheels. The mantra, press TOGA, pull back...within 10 seconds the ac impacted the rwy.

The legacy commands, the if/thens, are lost in the FMS programming. Only on incidents, does the legacy and the myriad of if/then scenarios emerge.

MCAS was a poorly applied band-aid to a much larger problem. At least 3 different crews found the holes in the model, 2 of which, cant speak to the issues.

[meleagertoo]

What, exactly, is the use of an "A of A DISAGREE" with no A of A indication to back it up? I can't see it tells you anything useful at all, in fact it merely adds an unquantifiable and unanswerable question into the mix. Had it been fitted it would have required a QRH action to go with it. What could tgat possibly tell you to do about it?
Add another A of A sensor and a triage system and it becomes another matter of course, but it seems unnecessarily harsh to criticise Boeing for not incorporating procedures that can only confuse and not help.

[PJ2]

The Boeing whistleblower who is working with the FBI confirmed that making the MCAS flight control system reliant on only one sensor was a deliberate decision to avoid the need for expensive Level D or flight simulator training.

“MCAS was designed using data from only one of the sensors because we knew the FAA would not have certified a two-sensor system without Level D Training…”

https://www.youtube.com/watch?v=QytfYyHmxtc&feature=youtu.be at 35:30

Boeing is dead, at least the Boeing we all knew and loved. It’s sadly time to accept that reality.

Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.

[737 Driver]

Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.

It is an NG simulator. You could fake it by throwing in a bad AOA/stick shaker/unreliable airspeed and then introduce a runaway stab after flap retraction. Not what I would call "valid" but "illustrative."

[wonkazoo]

Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.

The simulation is meaningless and it is on an NG sim. The quote is purportedly from a Boeing whistleblower who is working with the FBI. IF from an accurate source it is not meaningless, it is instead a stunning indictment that Boeing put profit ahead of safety and knew it when they did.

Forget the demonstration- that was so much theater. Look at what the Boeing employee said- that is the important bit, which is why I posted it.

Regards,
dce

[Marian Blacharski]

Reading the back and forth on the conundrum of “Pilots completely at fault for being stupid” as set against “Pilots completely not at fault because Boeing designed a $hit system,” and I’ve decided to take a stand. Apologies in advance as this is long, but trust me- it is worth it.

Of all of you out there who have posted here- whether with a desire to blame the pilots entirely or the opposite, how many of you have actually experienced an imminent, binary and life-threatening emergency in your airplane?? One that is so explicit you will either get it right or you will die?? And you have maybe 30 seconds to make that choice.

My guess is the list of aviators who can answer honestly that they have been at that threshold of death is very very small.

I am on that list. And I survived, despite making bad choices along the way.

I share this story because I want people to understand once and for all that while it is fine to offer that the pilots could have done better (they totally could have) the root cause of the MAX crashes was one of design, and human failures only built on that edifice to achieve the final outcome.

I also share this story because I want to try to explain to everyone here, in terms we can all understand, what it is really like when your known world explodes and you have to improvise in order to survive.

In June of 1996 I was in a very high performance unlimited category biplane named the Goshawk. (N345RM) I had departed Livermore CA several minutes earlier and was headed to a legal practice box adjacent to the Tracy airport. While over the Altamont hills at an indicated altitude of 4000MSL I began warming up by pulling to a 45 degree upline and doing snap rolls to the right. I did this once or twice. On the third attempt, once again at approximately 4000+MSL I initiated the snap roll to the right and hit hard left rudder as the wings returned to level to stop the autorotation. When I did this the left rudder pedal/bar shot away from my foot instead of providing actual resistance. The left rudder cable had snapped.

The airplane (which was by design dynamically unstable) paused its rotation for a moment and then began again violently to the right, probably at about 360 degrees per second. And here’s where the chair-jockeys don’t get it. I probably went two or three full revolutions before my mind could accept what I already knew had happened. I immediately pulled power, but the aircraft was already entering a nose-down spin- at a rotational rate of at least 360 degrees per second.

The ROD of a spinning aerobatic biplane is pretty steep, probably on the 1500-2000FPM range. I checked my altimeter, saw I was descending through 4,000 feet and decided to try to recover the airplane before bailing out. AND HERE IS THE IMPORTANT POINT: BECAUSE I REFUSED TO ACCEPT THAT THE AIRPLANE WAS COMPLETELY EFFED I would nearly die. My mind knew before then, as it knows now, that if you put a Pitts-like airplane into an autorotational state the only thing that is going to get it out is opposite yaw. With no rudder THERE CANNOT BE ANY OPPOSITE YAW!! I had thousands of hours in similar aircraft, I was an unlimited category competition aerobatic pilot and instructor, and yet when faced with the obvious I could not process it quickly enough, despite having the evidence staring me squarely in the eye, to react quickly enough to prevent me from nearly dying.

So I frittered away precious moments trying to use opposite yaw via ailerons, shots of engine thrust, hell I might have even prayed, I don’t know. What I know now is I could have done better. What I also know now, and somehow managed to forget then, was that I was over the Altamont. When I saw 4000’MSL and thought “OK, I’ve got time to play with this” the reality was I was over a hill- that was 2134’ high. Tracy- just 20 miles away and where I was headed sits at 193’ MSL.

In my mind, because I was stupid overwhelmed, or just unable to process everything being thrown at me I had maybe 3500-4000’ to play with. So I could spend 30 seconds fighting the airplane to try to recover it before I had to bail.

In reality I had less than 2000’ before I would be dead.

I spent probably ½ to ¾ of the real time I had to get out of the airplane in it- fighting to try to save it, and I did this by deliberately ignoring what I already knew (I had lost rudder control completely) what I should have known (I was over the Altamont) and what I should have accepted (I had to go- the Goshawk was not going to survive this, the only real question was would I??)

I obviously did reach the (already foregone but stubbornly ignored by me) conclusion that the airplane was unrecoverable and decided to bail out- which is an interesting concept in a stable spinning airplane. I undid my harnesses as I had practiced, and I fought my way out of the airplane- pinned against the left side of the cockpit coaming by the rotational g-forces before eventually getting enough of my upper body into the slipstream that I was basically yanked out of the airplane. I was falling in a fetal position, thought about waiting to pull the ripcord, said eff-it and pulled, and after the shocking introduction to my first and (so far) only canopy opening was struck by the sound of the airplane smacking into the ground just a second or two later. Future calculation efforts would show that my chute opened between 134 and 200 feet above the ground, which at that rate of descent equaled a couple of seconds at best.

Surviving that incident has given me some small window of insight into what happens when your comfy world devolves in seconds into one where you know you are about to die.

The biggest lesson, and the greatest ego-killer was simple: I didn’t respond nearly as I would have hoped I would. It took me countless seconds to register the fact of the failure. I knew as soon as the pedal fired away from my foot what had happened. But my mind simply refused to accept that reality for some short period of time. The second error was equally simple: I thought I was the hero pilot (Neil Williams etc…) who would bring my crippled plane back to the airport, thereby saving the day. That thought nearly cost me my life, as I wasted precious seconds performing an absolutely useless dance of fancy “airmanship” that did nothing but allow my airplane to bring me closer and closer to the ground with every moment.

And now to the main point of this entirely too-long post: For those of you who suppose you will see everything clearly and “FTFA” when your own fatal opportunity presents itself please hear me when I say this: YOU WILL NOT!! The question that will determine your survival is how quickly will you move past that initial shock and be able to function properly again. In my case it was a single (albeit fatal) failure. I was extremely well trained, averse to panic-driven responses, and well-able to handle the emergency I had been presented with. Yet I wasted probably a full minute in an airplane I had no business being in any longer.

In the 737 crashes it was a cascade of failures. My own- very rare life experience tells me that those pilots had little chance given the stressors they were working under, as would the rest of you. These are not the words of someone who doesn’t know what it’s like. I’ve been there. I lived. So please trust me when I tell you that your vaunted talents will wither to nothing if someday you are in this unfortunate position. At best you will be semi-functional, at worst you will be functionally useless.

What you will not be, in any context, is a hero who defies these realities.

Final note: This isn’t about placing blame on anyone. Boeing designed an airplane with a crap system that had random and unmonitored control over the single most important control surface of the aircraft. The FAA paved the way for certification of the airplane, and once in the hands of pilots that airplane not once, but twice flew itself into the ground. (The pilots didn’t- it was MCAS that did, and that’s an important fact to take note of…) You can blame the pilots all you want, but it was the airplane itself that had a failure mode that required the pilots to be perfect or die. Boeing had years to create a functioning system that would not put the pilots in this position and they failed to create one. So the two (six really) pilots were left to defend themselves against an airplane that was trying to kill them. Four failed in that endeavor, and they have my utmost respect and gratitude.

Only those who have walked the path and survived can understand the fine line between winning and dying- which is why I have posted this ridiculously long post tonight.

Sorry for the sermon, just tired of reading the constant back and forth about who we should blame.

Link to the Final on my incident: Well despite being a member for years I haven't reached the vaunted 10-post threshold for posting URLs. Search "NTSB June 17, 1996 N345RM" for the final report.

Regards,
dce

Dear DCE, the only thing I disagree with is that Your "story" was too long. Not at all, it could not be shorter, though You are a talented writer.
//M

[737 Driver]

Part 2

Continuing the Threat and Error Management (TEM) discussion....

Necessary preamble.... Yes, there were many other factors leading to this accident, many of which were outside the control of the crew. The TEM model can be applied to those pieces of the puzzle, but my interest is in what can be learned and applied at the professional flight crew level. What are the takeaways so that pilots can avoid a similar situation in the future?

Using the TEM model to analyze the Ethiopian accident, we can look at the factors that were directly bearing on the crew. We can start by asking "What were the threats?"

Threats can be external or internal (inside or outside the crew's direct control). External threats are things such as weather, terrain, language barriers, external pressure to meet schedule, etc). Internal threats could include such things as fatigue, distraction, and crew experience. Threats can also be known and unknown (but not necessarily unknowable). A known threat might be an inoperative aircraft system that has been placarded. Unknown threats which could still be anticipated would include such things as possible aircraft malfunctions during the flight, a pop-up TCAS alert, or a sudden call by tower to execute a go-around from low altitude. Once identified, the next step is to attempt to mitigate the threat using the tools available to the flight crew.

For ET302, environmental threats might include field conditions (high altitude) and high terrain in the general area. Specific detail on the crew pairing and schedule has not been released, but we can probably categorized a low-time First Officer as a potential threat. If the crew had not flown together much, lack of familiarity with each other could have been a threat. Insufficient rest could have created a fatigue issue. It has been suggested that there may have been a steep authority gradient gradient at Ethiopian which would have discouraged a First Officer from correcting a Captain. If so, this would be a threat, but perhaps an unappreciated one if this authority gradient was deeply embedded in the airline culture. The primary unknown threat was the pending AOA malfunction. Another possible unknown threat was a lack of specific systems knowledge as it related to MCAS and the subsequent trim problem.

For each of the identified (known) threats, what could have the crew done to mitigate them? Primarily, by actually identifying the threats and briefing any appropriate procedures - forewarned is forearmed. For example, one thing I do whenever I fly with a new First Officer is that I explicitly state that anyone on the flight deck can make an error and it was the job of the other pilot to correct those errors. I want my FO's to feel free to speak up. Slowing down and methodically using checklists and flows is another good mitigation strategy. In the more extreme cases, simply refusing to depart until the situation has been satisfactorily changed for the better may be the most appropriate mitigation strategy.

The next question in this analysis is, "What were the errors?"

Errors are caused by human actions or inaction that increase the likelihood of an adverse event. The difference between an error and a threat is that an error can, with careful attention, be quickly identified and crew members can find prompt solutions to the error. This is sometimes known as "trapping" the error. The impact of an error can, therefore, be quickly reduced if properly managed. If not managed correctly, an untrapped error can lead to an undesired aircraft state or create a new threat (known or unknown). Examples of errors include procedural errors, perception errors, miscommunications, and violations of SOP's (intentional or unintentional).

The crew errors seem to fall in the following categories: perception errors (not picking up on obvious cues), procedural errors, CRM errors, and basic airmanship errors. Most of these have been extensively discussed, so I won't repeat them here.

The next question is what were the barriers that should have enabled the crew to trap any error before they led to an undesired aircraft state?

Traditional aviation barriers include policies and procedures, checklists, CRM, knowledge and aircraft handling skills, as well as external resources (ATC, maintenance, etc).

As we look at this accident through the TEM lens, I think there are two very important questions:

Why did the existing barriers fail?

What happens when a barrier actually becomes a threat?

[L39 Guy]

It has pretty well been established on this thread that pilot electric trim will work in all conditions (does not stall under load) and interrupts MCAS if active as shown by ET trace at ~05:40:27. This pilot trim input was possibly then interrupted by cutout switches.

Other than 'deer in headlights' loosing it I see a few possible factors:

1: Pilot accustomed to short blips not comprehending amount truly needed, this fits Lion Air when the FO was ineffective at the end when PIC handed over control while the Captain was mostly successful.

2: Trimming by column feel not position: May seem that AC is closer to trimmed than it is. In other words if you have been pulling really hard then just slightly hard may feel like close to trimmed, I am sure the pilot did not want to over trim given all the alarms.
This might explain ET first retrim at 05:4-:15. Unfortunately we don't have the column force graph, just position.

3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.

Hopefully the final reports will fully address this question.

Another factor is that given the dependence on automation these pilots may have never trimmed this aircraft or any others in their airline career.

Consider that if the airline policy was to use the autopilot to the max (sorry about the pun), their entire career of flying a Boeing product would be to takeoff, climb to 400 ft then engage the autopilot. For this short bit of flying there is no requirement to trim if the stabilizer trim was set properly. During any changes in speed or configuration the autopilot would automatically trim the aircraft. The aircraft would stay on autopilot until short final (1000 AGL or less), the autopilot would be disconnected and, assuming that no configuration or speed changes occur, the aircraft would not have to be manually trimmed.

In speaking with friends flying outside of “the western world” this is exactly what happens. In fact, if the flight data analysis (which, in some cases is analyzed after every flight at some carriers) shows manual flying, the Captain gets queried about why. If it happens too often they get docked pay.

To those of us that insist on doing some hand flying of our jets, this might seem preposterous however that is what is going on in many parts of the world.

I would be interested in hearing if others are under this practice or have colleagues that are.

[Lost in Saigon]

Another factor is that given the dependence on automation these pilots may have never trimmed this aircraft or any others in their airline career.

Consider that if the airline policy was to use the autopilot to the max (sorry about the pun), their entire career of flying a Boeing product would be to takeoff, climb to 400 ft then engage the autopilot. For this short bit of flying there is no requirement to trim if the stabilizer trim was set properly. During any changes in speed or configuration the autopilot would automatically trim the aircraft. The aircraft would stay on autopilot until short final (1000 AGL or less), the autopilot would be disconnected and, assuming that no configuration or speed changes occur, the aircraft would not have to be manually trimmed.

In speaking with friends flying outside of “the western world” this is exactly what happens. In fact, if the flight data analysis (which, in some cases is analyzed after every flight at some carriers) shows manual flying, the Captain gets queried about why. If it happens too often they get docked pay.

To those of us that insist on doing some hand flying of our jets, this might seem preposterous however that is what is going on in many parts of the world.

I would be interested in hearing if others are under this practice or have colleagues that are.

As airline pilots our recurrent training often emphasizes or incorporates items that were the causes of recent airline accidents or incidents:

I can just see it now.... My next session is going have some spot training involving hand flying while operating the electric trim switches up and down .

[shmerik]

Not a pilot - software engineer that started my career at a small company that produced hardware-in-the-loop testing and certification solutions for major aerospace and defense organizations. I experienced first-hand the sort of pressures and poor communications/management between entities that leads to audits/test results/certifications be pushed through too fast and in incomplete forms and to be honest it made me wonder if we wouldn't start to see failures like this tragedy unfold in the near future.

From the information available my gut feeling tells me that the systems design on the MAX was intentional, not an instance of well-meaning engineers making a mistake. There's the change of the rate of trim applied made late in the testing stages (from 0.6 units to 2.5 units per time period?) and the seeming lack of any sort of sanity checks in the MCAS system that just seems impossible to miss. There are very basic things that can be done in software even beyond bringing in more sensors to fall back on such as checking the values that come before (is it ever possible for AOA to jump over from 14 to 75 degrees in under a second?). This is something that should have been glaringly obvious to all involved in the process and if there was genuinely no bad intentions on Boeing's part then what this suggests is serious organizational rot. In either case I would hesitate to put confidence in other aspects of the design if this system is such a mess.

I've yet to see a satisfactory explanation behind the changes to the trim cutout switches. Sure, I've read that they are always used at the same time but how does that justify neutering the behavior but leaving the two switches except for different labels? In what world does it make sense to get rid of the ability to cutout the plane's automation (STS, MCAS, probably others that I'm not familiar with) while still allowing the pilot to enter trim commands using the stab motor? What does this improve upon the original design of the switches? A change like this involves multiple engineering departments in order to implement and everything is documented and cross checked along the way. I'm very curious as to what the justification is here.

And the mysterious short blips of trim shortly before MCAS dealt it's final blow... From following along in this thread and others I've come to the knowledge that trimming away pressure in the control column is one of the most basic aspects of flying that there is. The failures to get completely back into trim and then the final blips suggest to me that something else is wrong. From what I see other pilots saying it sounds like the equivalent of someone in the path of an oncoming semi-truck applying very slight turns of the steering wheel to get out of the way (sorry for the clumsy metaphor). If airline training has taken such a deep dive in quality over the years as to lead to pilots that don't have supposed basic airmanship skills, doesn't this imply that we should expect to see a steep increase in the amount of pilot errors leading to accidents?

So far they have been confined to two hulls of the same make and model within the first years of it entering into flight...

If you read all of that then thanks for taking the time to consider the viewpoint of someone from outside the profession. I've become somewhat obsessed with this MAX fiasco because just like it highlights the importance of airmanship to some pilots here, to me it highlights the importance of systems design and good engineering practices in the software and technology world. It is cheap and easy to alter products by manipulating lines of code but we must keep in mind that the impact that it has on the word is just as real as that of the other more "material" engineering professions.

[737 Driver]

As airline pilots our recurrent training often emphasizes or incorporates items that were the causes of recent airline accidents or incidents:

I can just see it now.... My next session is going have some spot training involving hand flying while operating the electric trim switches up and down .

Yep, always training for the last accident, kind of like generals fighting the last war.....

[safetypee]

wheelsright,

‘But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches?’

Overall, and biased by the accident outcome, I doubt that nose up trim would have been effective, particularly when considering time of recognition, realisation, and action.

Continued debate considers if trim would / was enabled to override MCAS.
Then, the erroneous rate / power of MCAS design would out perform trim by 9 sec down to 3 sec up.
Also, there is debate and interpretation if trim is restricted due to design (EASA questions) and further if the aerodynamic forces restrict nose up motion - tail / elevator interaction.
Then the above must consider the pilots perception of the situation, the need for trim and the extent of trim required in very stressful, surprising, and demanding conditions.

All that must be confined to history. Whatever is changed in the MCAS operation it must not be able to mis trim the aircraft to extreme.

As for judgement of crew performance, consider https://www.pacdeff.com/pdfs/Errors%20in%20Decision%20Making.pdf
Crews either fail to understand the situation, HF - thus choose the incorrect procedure
Or with correct understanding, the incorrect procedure is chosen - HF (or procedure is not available - documentation, training, novel failures)

[L39 Guy]

https://youtu.be/QytfYyHmxtc

Compelling interviews with Chris Brady ( The Boeing 737 Technical Site (http://www.b737.org.uk/) ), Dennis Tajer, Peter Lemme, David Learmount and Dominic Gates.
43 minutes...
That simulator sequence at the beginning was interesting to see. If that wasn't a stab trim runaway I don’t know what is. Uncommanded pitching of the nose (down in this case) and spinning of the trim wheel. someone hand flying that aircraft couldn’t miss that or mistake that as not being a textbook stab trim runaway.

Interesting too that arm strength with continuous trim recovers that aircraft. That would be an opportune time to hit the stab trim cutout switches.

[MurphyWasRight]

wheelsright,

‘But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches?’

Overall, and biased by the accident outcome, I doubt that nose up trim would have been effective, particularly when considering time of recognition, realisation, and action.

Continued debate considers if trim would / was enabled to override MCAS.
Then, the erroneous rate / power of MCAS design would out perform trim by 9 sec down to 3 sec up.

One last time: Please look at the ET traces from 05:40:00 (first MCAS) to 05:40:45.
This shows MCAS trimming down, an inadequate pilot retrim followed by another MCAS trim 5 seconds later, this second MCAS trim was interrupted after 6 seconds by pilot trim.
This pilot trim continues until trim cutout. Had they waited 10 more seconds while continuing to apply trim the AC would likely be in trim.
Each of these trim inputs clearly show on the pitch trim trace.

All of the above is exactly as described by original MCAS 'disclosure'.

Not sure where the '3 sec up' in your post comes from, the second pilot trim in above is 8 or 9 seconds (hard to read exactly from graph).

They did re-enable electric trim at end, likely a desperate measure, unfortunately they did not provide sustained trim inputs but did re-trigger MCAS one last time.
The trim position trace at 05:43:15 show a slight upward bump after the 2 'blip' showing the electric trim working against the aero loads.
The trim inputs would not show on the trace if still cutout due to cutout switch wiring.

[wheelsright]

One last time: Please look at the ET traces from 05:40:00 (first MCAS) to 05:40:45.
This shows MCAS trimming down, an inadequate pilot retrim followed by another MCAS trim 5 seconds later, this second MCAS trim was interrupted after 6 seconds by pilot trim.
This pilot trim continues until trim cutout. Had they waited 10 more seconds while continuing to apply trim the AC would likely be in trim.
Each of these trim inputs clearly show on the pitch trim trace.

All of the above is exactly as described by original MCAS 'disclosure'.

Not sure where the '3 sec up' in your post comes from, the second pilot trim in above is 8 or 9 seconds (hard to read exactly from graph).

They did re-enable electric trim at end, likely a desperate measure, unfortunately they did not provide sustained trim inputs but did re-trigger MCAS one last time.
The trim position trace at 05:43:15 show a slight upward bump after the 2 'blip' showing the electric trim working against the aero loads.
The trim inputs would not show on the trace if still cutout due to cutout switch wiring.

"One last time" the FDR trace does not track thumb switch trim inputs. Therefore, it cannot be said with certainty what the pilots were doing. The assumption is that Boeing advice is correct but it is not absolutely certain. Unless you can authoritatively show that MCAS has no authority during thumb switch input in all circumstances then you are speculating.

[MurphyWasRight]

"One last time" the FDR trace does not track thumb switch trim inputs. Therefore, it cannot be said with certainty what the pilots were doing. The assumption is that Boeing advice is correct but it is not absolutely certain. Unless you can authoritatively show that MCAS has no authority during thumb switch input in all circumstances then you are speculating.
Ok I will bite:
Unless you can authoritatively show the FDR trace does not track thumb switch trim inputs a reasonable interpretation of the traces is that it does. I have not seen anything that shows otherwise.

As to whether the switches tracked the pilots thumb and or intentions is possibly an open question, especially the blips at the end.

Don't know about "all circumstances" but the trace at 05:40:27 shows the manual trim stopping MCAS before the full 9 or seconds it would have run.

The schematic that was posted also shows manual electric trim overriding automatic,the 'trim motor' is shown as a block so can't 'prove' this.

In any case not clear where this is going, in ET case MCAS is clearly disabled by pilot trim (for 5 seconds) and cutout, had they succeeded with manual trim we would not be having this discussion.

No need for elaborate undisclosed actions, the stated behavior explains what is seen.
Occam's razor might be constructively considered here.

[Loose rivets]

Still concentrating on the Human Factor - the miserable consuming confusion while under stress.

Recently I said.

" there's a chance some pre-knowledge of the Lion Air accident had a negative effect on the ET skipper's actions. Firstly a greater shock factor - due to realising a very specific and serious danger was confronting him . . ."


However, Lord Farringdon put it far better, and in commoner's language.

If the ET Captain had never heard of MCAS, he probably would have carried out the UAS and landed safely. Basically, his mere knowledge of MCAS but lack of full understanding of it may have scared the c##p out of him.

Hopefully by now the ET captain may well have linked the duff AoA with an airspeed error and stick-shake, but not the failure of the AP to stay locked on for more than thirty seconds. He was probably processing that while the wheel spun for 9 seconds.

I recall leaving the classrooms after Type conversions with a reasonable knowledge of system interactions . . . at best. Usually, the light-bulb would come on after 300 to 500 hours and a lot of work. How one system affected another was the most difficult part of any type conversion for me, and in the modern world, I'd imagine the MAX is an order of magnitude more involved. I have to concede 737 Driver's 'Fly and then press on with the drills', rather than analyse too deeply is vital. It's simply too complex these days.

.

.

[MurphyWasRight]

Still concentrating on the Human Factor - the miserable consuming confusion while under stress.

Recently I said.


However, Lord Farringdon put it far better, and in commoner's language.



Hopefully by now the ET captain may well have linked the duff AoA with an airspeed error and stick-shake, but not the failure of the AP to stay locked on for more than three seconds. He was probably processing that while the wheel spun for 9 seconds.

I recall leaving the classrooms after Type conversions with a reasonable knowledge of system interactions . . . at best. Usually, the light-bulb would come on after 300 to 500 hours and a lot of work. How one system affected another was the most difficult part of any type conversion for me, and in the modern world, I'd imagine the MAX is an order of magnitude more involved. I have to concede 737 Driver's 'Fly and then press on with the drills', rather than analyse too deeply is vital. It's simply too complex these days.

Minor correction, after a couple of false starts the autopilot was engaged for more than 30 seconds, just long enough to provide a false sense of "not that bad"?
Then it all hit the fan on short order with AP disconnect followed by MCAS.

[737 Driver]

Part 3

Continuing the Threat and Error Management discussion..... If you are joining midway through, I highly recommend that you go back to the beginning (Part 1) starting with the post with the TEM graphic.

The TEM model posits that there will always be threats, that there will always be errors, but that by intelligently designing and employing sufficient barriers, threats can be identified and mitigated, and errors can be trapped before they lead to an undesired aircraft state, incident, or accident.

Threats and errors were covered in the previous post, and a list of potential barriers were identified. I left off with what I thought were two germane questions:

Why did the existing barriers fail?

What happens when a barrier actually becomes a threat?

​​​​​Once again, traditional aviation barriers that apply to flight deck operations include policies and procedures (SOP's), checklists, crew resource management (CRM), knowledge and aircraft handling skills, as well as external resources (ATC, maintenance, etc). CRM procedures would include briefings, communication, active monitoring, deviation callouts, assignment and execution of pilot flying/non-flying pilot (PF/NFP) duties. Knowledge and aircraft handling skills would determined by the particular training and experience of each pilot.

Which of these barriers failed? (easier question) Why did they fail? (harder question)

Unfortunately, not enough is known of the specific Ethiopian SOP's, crew discussions prior to takeoff, or specific training and experience to definitively address some of these questions. However, we can still make some (hopefully) useful observations. The data that has been released to date suggests that the ET302 Captain did not fully process the nature of the malfunction (perception error). Having not perceived the true nature of the malfunction, he proceeded to apply inappropriate procedures (attempting to engage A/P, retracting the flaps before the AOA/UAS malfunction was resolved). The repeated attempts to inappropriately engage the autopilot and subsequent aircraft handling (particularly the lack of aggressive trimming against the MCAS input) suggest a lack of comfort with hand-flying. At this point, it is impossible to say how much of the Captains actions were driven by a particular lack of knowledge or skill, or rather, the inability to draw upon that knowledge or skill under pressure. However, I think it is a reasonable observation that, to the degree that any barriers resided within the mind of the Captain (perception, SOP's, knowledge, aircraft skills), these barriers were ineffective. In short, the Captain could not trap his own errors. When errors are not properly trapped, they can convert to new threats. Or to put it another way, what should have been barriers actually became threats.

How did these barriers become threats? There are signs that the Captain was experiencing cognitive overload. Contributing issues could include fatigue, distraction, pressure to meet schedule, inadequate training, and/or perception that he was effectively single pilot (more on that in a moment). Whatever the reason, the TEM model does suggest an appropriate response when barriers become threats.

Before that discussion, I need to touch on one other aspect of this accident. Based upon some of the previous feedback, I suspect some of you are not going to like this part, but I feel this is a necessary exercise. There was another potentially useful barrier on the flight deck that day - the First Officer. This is an interesting case in that I have already identified a low-time FO and the possible existence of a steep authority gradient on the flight deck as potential threats. So was the FO a threat or a barrier? Or a little of both?

One piece of information we do not have is whether any steps were taken to mitigate the FO as threat. How well did the Captain know the FO and how did he perceive the FO's competency? Did he enquire as to his recent experience or if he had any particular questions? How thoroughly did the Captain brief his FO? Did the Captain perceive that there was a potentially hazardous authority gradient, and if so, did he attempt to mitigate it with clear guidance to the FO that he was expected to speak up as necessary?

Now let's discuss the FO as a potential barrier. In a two-pilot crew operation, each pilot is expected to back up the other and help identify and mitigate threats as well as trap errors. They are also expected to work together to resolve any non-normal procedure.

One of the remarkable aspects of the CVR discussions that have been released so far are not so much what was said, but what was not. There is very little discussion of the ongoing malfunction or the state of the aircraft. There is no discussion of airspeeds or altitudes. No one calls for any checklists, normal or otherwise. When the Captain tries to engage the autopilot with an active stick shaker (three times!) the First Officer does not question this action. By the time the aircraft reaches 1000' (and before MCAS ever showed up on the scene), the signs of unreliable airspeed were present. The Captain was absorbed in flying the aircraft and apparently greatly distracted. What was the First Officer doing? A fully qualified and proficient FO should have been monitoring both the aircraft and the Captain. He should have identified the UAS situation, but did not do so. If he had identified the UAS, he should have called for the appropriate NNC himself if the Captain did not do so. When the Captain called for the flaps to be retracted while they had an active stick shaker and before any non-normal procedure had been called for, the First Officer simply did as requested and did not question whether it was an appropriate action. As the airspeed increased toward VMO, the First Officer said nothing. When the Captain was obviously applying an excessive of back pressure on the control column without sufficient trimming, the First Officer did not prompt the Captain to trim or ask if the Captain needed help inputing trim. By not trapping any of the Captain's errors, those errors now converted to new threats. The First Officer failed to be an effective barrier.

Some have pointed out, seemingly to the First Officer's credit, that it was he who finally identified the runaway stab trim problem (we should note for the record that the First Officer only made this observation the second time MCAS began it's 9-second, 37 spin journey to oblivion). But rather than this being a positive result, it was actually the final link in a long chain of errors that doomed this aircraft. Yes, that's right, the First Officer introduced his own deadly error into the chain.

From the transcript:
.At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First- Officer confirmed stab trim cut-out.




When a non-normal checklist is needed, the procedure is for the first pilot seeing the problem to call out the problem (In this case "We have runaway stab trim") and then for the other pilot to confirm ("Yes, I agree. We have a runaway stab."). This is a quote from my airline's FCOM: "Prior to performing procedures, both pilots should communicate and verify the problem."

"Stab trim cutout" is not a problem. It is a command (maybe suggestion?). "Runaway Stab Trim" is a problem. When the First Officer said "stab trim cut-out", the (likely overloaded) Captain pounced on the suggestion, one of the pilots cutout the trim, and they were finally and fatally screwed with a stabilizer in an untenable position and no effective way to move it.

The next step in a non-normal situation is for one of the pilots (at some airlines it is the Captain, at some airlines it is the Pilot Flying) to call for the appropriate NNC procedure. Again from the FCOM: "Identifying the correct procedure is critical to properly managing the non-normal situation."

There is a bit of divergence here depending on whether the airline uses a Quick Reference Card (QRC) or the "Memory Item" method. My airline uses a QRC, but basically the goal is to work through the steps in a methodical fashion. Grabbing controls and switches without careful thought can lead to all sorts of misery. Think here of those accidents that resulted from crews shutting down the wrong engine during an engine fire/failure in flight response. From the FCOM: "Non-normal checklists use starts when the aircraft flight path and configuration are correctly established......Usually, time is available to assess the situation before corrective action is started. All actions must then be coordinated under the Captain's supervision and done in a deliberate, systematic manner. Flight path control must never be compromised." In other words, fly the aircraft first, and don't rush through the procedure.

Okay, I know some might find the preceding paragraphs tedious, but they are important to understand this final fatal error.

The Runaway Stabilizer checklist has been previously posted, so I won't duplicate it here except to enumerate two particular steps. Step 2 of this NNC states: "Autopilot (if engaged) .... Disengaged. Do not re-engage the autopilot. Control aircraft pitch attitude manually with control column and main electric trim as needed." It is not until Step 5 of this checklist that we get this: "If the runaway continues after the autopilot is disengaged: STAB TRIM CUTOUT switches (both)..... CUTOUT." It should be added that it is really not necessary that all the words be said correctly as long as all the actions are performed correctly.

By methodically following the published procedure (rather than responding reflexively to the First Officer calling out "Stab Trim Cutout!"), the Captain would have been prompted to trim the aircraft with the Main Electric trim - the very thing he most needed to do after MCAS kicked in. Only after the aircraft was returned to neutral trim was it appropriate to use the stab trim cutout switches, not before.

The First Officer should have been a barrier. Instead he was a threat.

The Captain should also have been a barrier to his own errors and the errors of his First Officer. Being unable to trap either set of errors, those errors became threats.

Too many threats, too many errors, not enough effective barriers.

So we are now left with (a variation of) my final question:

What should one do when a barrier actually becomes a threat?

[MurphyWasRight]

737 Driver
I see the wisdom in much of your post, one thing to keep in mind though is that we have glaringly incomplete CVR facts, not a transcript just some snips possibly selected to shore up a particular point of view.
This makes it impossible to know all of what was discussed etc during (and before) the flight or the full extent of interactions.

As I have said before something was going on while the trim was in cutout mode, we just have not been told what.

[737 Driver]

737 Driver
I see the wisdom in much of your post, one thing to keep in mind though is that we have glaringly incomplete CVR facts, not a transcript just some snips possibly selected to shore up a particular point of view.
This makes it impossible to know all of what was discussed etc during (and before) the flight or the full extent of interactions.

As I have said before something was going on while the trim was in cutout mode, we just have not been told what.

I agree it is an incomplete picture (which I did acknowledge), but there are some broad enough outlines from which we can draw some conclusions. If anything comes out that substantially alters our current understanding, then I'll be happy to make a correction.

As far as what was going on while the the trim switches were in the cutout position, are you referring to the gradual movement from 2.3 to 2.1 units? It apparently occurred over two and half minutes. I'm interested in seeing what the board's thoughts are on that as well, but I should point out that in the context of the overall trim movement, it is a very small and slow creep.

[wetbehindear]

737 Driver
"the possible existence of a steep authority gradient on the flight deck as potential threats."

Cue to possible existence of a steep authority gradient on a flight deck by employing metrics used to evaluate and judge Korean Air and third world cockpits.

Cactus fifteen fifty minus one, UsAir flight 1539 revisited.

15:29:45.4 hot-1 ok lets go put the flaps out, put the flaps out. ( this is not a proper command)
15:29:48 hot-2 flaps out? (Skiles not sure about what his captain wants him to do, Sully silent.)
15:30:01 hot-2 got flaps out.

15:30:06 cam-2 hundred and seventy knots.
15:30:09 cam-2 got no power on either one? try the other one.
15:30:16 hot-2 hundred and fifty knots.
15:30:17 hot-2 got flaps two, you want more? (Skiles somehow sensed that Sully wants to stay airborne so he gave him best glide flaps.)

Mitigated Speech and Plane Crashes (Outliers, p 195)

1- Command: “Turn thirty degrees right.” That’s the most direct and explicit way of making a point imaginable. It’s zero mitigation.
2- Crew Obligation Statement: “I think we need to deviate right about now.”Notice the use of “we” and the fact that hte request is now much less specific. It’s a little softer.
3- Crew Suggestion: “Let’s go around the weather.” Implicit in that statement is “we’re in this together.”
4- Query: “Which direction would you like to deviate?” That’s even softer than a crew suggestion, because the speaker is conceding that he’s not in charge.
5- Preference: “I think it would be wise to turn left or right.”
6- Hint: “That return at twenty-five miles looks mean.” This is the most mitigated statement of all.

In that scale above ” you want more?” is a “querry” in line 4 and a “hint” ( you should have more ) in line 6. Both indicative of mitigating speech is employed. By mitigating speech being employed we deduce that there is a strong authority gradient in the cockpit.

[ThreeThreeMike]

Imagine if your airplane had a third, previously unneeded engine that contributed nothing to the performance, stability, safety or functionality of the aircraft. I'm even going to give us the benefit of the doubt and say you know this third engine exists. If engines 1 or 2 fail you just do everything like you always have. Pull out the proper checklist, do your memory items and find someplace to land. But if engine #3 fails, well then you have 30 seconds to a minute to identify the correct engine, diagnose it and shut it down using an exact mechanism that has zero tolerance for deviation. If you fail to do this exactly right your third engine explodes and rips off the tail in the process and you and your airplane are toast on a stick.

That's what I mean when I say MCAS will try to kill you (it will...) and that's why I believe this is a unique circumstance and finally: That's why I place the responsibility for the entirety of the outcome for both flights at the feet of Boeing and the FAA.



The repetitive hyperbole in your posts masks any real content for discussion that may exist.

The above quoted strawman is not an accurate allegory for the actual events which occur when the MCAS system is activated. It does not demand "zero tolerance for deviation", nor does it require "using an exact mechanism" to diagnose what is essentially a runaway stabilizer trim event.

Mitigation does require correct diagnosis and reaction. The actions of the ET 302 crew were sadly deficient in both regards. Discussion of their response and examination of aircrew training and competency overall is of more interest to me than your insistent claims of nefarious negligence by Boeing and the FAA.

[rog747]

Are there any contributors here who are 737 pilots who transitioned to the MAX?

May I ask please,
If you did, did you have any SIM, classroom, or Line training on the MAX and it's differences, or was it purely on-line modules, thus was your first flight on a ''pax on board'' flight?

Were you made fully aware of the adverse pitch up changes, and CG issues of the new MAX due to the design enforced forward location of the new larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA? (which we now are aware, necessitated the MCAS software patch)

Were you (before the 2 fatal and 1 nearly accidents) fully informed/trained on the new MCAS systems and it's functionality, implications, and what to do if it went rogue?

Thanks.

[HundredPercentPlease]

Rog,

No one knew about MCAS until the AD a couple of weeks after the Lion Air accident. Have a look at the thread. The crew that saved the situation described the problem as the STS running the wrong way, possibly a huge clue as to how the human mind interpreted what was happening (rather than a trim runaway).

All operators used CBT rather than real training.

[rog747]

Rog,

No one knew about MCAS until the AD a couple of weeks after the Lion Air accident. Have a look at the thread. The crew that saved the situation described the problem as the STS running the wrong way, possibly a huge clue as to how the human mind interpreted what was happening (rather than a trim runaway).

All operators used CBT rather than real training.

OK thanks -
so what you are saying would also confirm that no pilots (putting aside MCAS as you say) were ever made aware of the adverse pitch up effect of the new MAX due to the location of the larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA?

[GordonR_Cape]

OK thanks -
so what you are saying would also confirm that no pilots (putting aside MCAS as you say) were ever made aware of the adverse pitch up effect of the new MAX due to the location of the larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA?

Its buried in the thread, but if you want an up to date reference, the 60 Minutes documentary (video and text) provides some interviews. For example Dennis Tajer (APA union). See: https://www.9news.com.au/national/60-minutes-inside-boeings-disaster-737-max-aircrafts/f5875c13-57d6-4957-8bf6-a0c47ddfe293
Days after the Lion Air disaster, Boeing finally revealed the existence of the MCAS system, shocking pilots around the world.

American Airlines veteran pilot Dennis Tajer told Hayes, “I called our safety experts and said, ‘Where is this in a book?" And they said, ‘It's not’.”

Tajer said the admission from Boeing felt like “betrayal”.“This is an unforgiving profession that counts very heavily on the pilot's knowledge, background, and training, and there are lives depending on that."

[HundredPercentPlease]

OK thanks -
so what you are saying would also confirm that no pilots (putting aside MCAS as you say) were ever made aware of the adverse pitch up effect of the new MAX due to the location of the larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA?

Rog - you don't have that quite right. It's high AoA that results in different stick forces. In normal operations the pilot would not ever create an AoA that would allow him to explore the new stick forces. Boeing logic was that if the pilot inadvertently found himself in such a high AoA condition, then all would feel normal because MCAS would trigger. Boeing just failed to explore what would happen if the single input to MCAS failed causing it to repeatedly trigger when not wanted.

[hans brinker]

Are there any contributors here who are 737 pilots who transitioned to the MAX?

May I ask please,
If you did, did you have any SIM, classroom, or Line training on the MAX and it's differences, or was it purely on-line modules, thus was your first flight on a ''pax on board'' flight?

Were you made fully aware of the adverse pitch up changes, and CG issues of the new MAX due to the design enforced forward location of the new larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA? (which we now are aware, necessitated the MCAS software patch)

Were you (before the 2 fatal and 1 nearly accidents) fully informed/trained on the new MCAS systems and it's functionality, implications, and what to do if it went rogue?

Thanks.

Not to derail the tread, but this is the standard today. I am only trained in the A 320 CEO, but fly A319/320/321/320NEO (which has different engine instrument). We just received a company memo (after over a year of flying the NEO) that is has a “Rotation Mode” to prevent tail strike. Nothing was mentioned in the manual.........

[dufc]

Rog - you don't have that quite right. It's high AoA that results in different stick forces. In normal operations the pilot would not ever create an AoA that would allow him to explore the new stick forces. Boeing logic was that if the pilot inadvertently found himself in such a high AoA condition, then all would feel normal because MCAS would trigger. Boeing just failed to explore what would happen if the single input to MCAS failed causing it to repeatedly trigger when not wanted.

Apart from this lack of 'fail safe', add the failure to inform pilots of MCAS having been fitted, to install an 'MCAS on' warning and to signal the need for appropriate training including how to disable MCAS if required. Did Boeing also not fail to advise the FAA of a change in the scale or parameters of MCAS*?

*Ref Schmerik above : "There's the change of the rate of trim applied made late in the testing stages (from 0.6 units to 2.5 units per time period?)"

[meleagertoo]

The crew that saved the situation described the problem as the STS running the wrong way, possibly a huge clue as to how the human mind interpreted what was happening (rather than a trim runaway).
Which rather vindicates Boeing's position on this; they reacted exactly as Boeing intended by identifying it as an STS runaway (which most assuredly is a runaway trim event) and dealt with it by using the correct pre-existing technique.

And as such, why is it really so necessary to inform pilots of this system? There is no specific control over it, just the generic runaway trim procedure. Surely telling people about systems they have no specific influence over is merely muddying the waters? If it presents itself as failure event X which is dealt with by checklist Y does anyone need to know that it could be system A or A.1 at fault, when both are addressed by the same checklist, show effectively the same symptoms and actually are components of the same system?

That, I am sure, was Boeing's rationale and though I'm not 100% comfortable with it I'm certainly not condemning it in the absolute and fundamental way some others are.

Boeing just failed to explore what would happen if the single input to MCAS failed causing it to repeatedly trigger when not wanted.
I very much doubt that could be the case. Single input failures would be top of the list to explore if the system only had one input. I think suggesting otherwise is being far too simplistic in automatically assuming gross incompetence where there really is no evidence of it. I read somewhere they spent 205 hours test-flying MCAS. What do you suppose they were looking at in all that time? That single-input failures hadn't occurred to anyone? No one at all? That is simply preposterous.

Boeing's big 'mistake' was to underestimate the public and to some extent the industry's interpretation of two failures due almost exclusively to bad handling and incorrect procedures that they could hardly have anticipated. At least, Boeing thought they could hardly have been anticipated at the time, and I doubt (m)any of us would have thought otherwise either before these accidents had we known about the system. Their mistake was to underestimate the amount and volume of criticism that would unexpectedly come their way because crews, maintenance and at least one airline screwed up in spades and the world retrospectively devined faults therefrom in Boeing that no one had thought were faults before and in a vindictive and vitriolic way unprecedented in the history of aviation.
Caught out by the 'told you so' all-seeing retrospective 'wisdom' of the internet more than anyting else.

I'm not saying they're whiter than white, just some light-ish shade grey a very long way from the midnight black some others are portraying.

We just received a company memo (after over a year of flying the NEO) that is has a “Rotation Mode” to prevent tail strike. Nothing was mentioned in the manual.........
Where are the howls of outrage over this 'cynical corporate cover-up' then, if adding automatic systems and not telling is so iniquitous?
Or could it be this falls into the same category as MCAS before the accidents? It's not hurt anyone so no one is outraged? (not suggesting this is an exact parallel but appears a similar concept). I expect Airbus' view on this was very similar to Boeing's on MCAS though; it is a sub-system of something else and failures in it can be identified and grouped under a common, pre-existing drill and as you have no control over it's operation what is the point of confusing people with knowledge of something they can't affect independently.

[excrab]

Are there any contributors here who are 737 pilots who transitioned to the MAX?

May I ask please,
If you did, did you have any SIM, classroom, or Line training on the MAX and it's differences, or was it purely on-line modules, thus was your first flight on a ''pax on board'' flight?

Were you made fully aware of the adverse pitch up changes, and CG issues of the new MAX due to the design enforced forward location of the new larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA? (which we now are aware, necessitated the MCAS software patch)

Were you (before the 2 fatal and 1 nearly accidents) fully informed/trained on the new MCAS systems and it's functionality, implications, and what to do if it went rogue?

Thanks.

I did my MAX transition for an operator in the ME. No sim, classroom or line training, just CBT on company iPad that was mandated to be done in the pilots time off. Completed the CBT and then flew the NG for four months before first flight in the MAX, which was also the F/O’s first flight in the MAX.

until the Lion Air crash there was no mention of MCAS and as far as I remember no mention of the change in aerodynamics due to the new engines and their installation, at least not on the CBT or in any manuals from the company I was working for. Obviously other companies could have had different training material.

[rog747]

Many thanks to you all for your honest and concise replies

[maxxer]

Continuing the Threat and Error
What should one do when a barrier actually becomes a threat?

If you only have the runaway trim nnc , but now there is a crash few months earlier and some vague ad from the manufacturer.
Which might flag uas or it might flag as and it might leave you aircraft in a state you cant manually trim it back.
There is nowhere in the nnc saying if trim goes weird after raising flaps drop flaps back and reduce power.

[Loose rivets]

Murphy's correction - Thanks.


Minor correction, after a couple of false starts the autopilot was engaged for more than 30 seconds, just long enough to provide a false sense of "not that bad"?
Then it all hit the fan on short order with AP disconnect followed by MCAS.


I had the AP time on as 3 seconds. Corrected. Indeed, the real 30 seconds it would give time for a feeling of having overcome the problem - until the 9 seconds of trim. But looking back again, it might be that feeling of success, coupled with the fact STS runs the wheels (albeit briefly) anyway, that made him miss the sheer length of the run time. Hard to imagine missing that clunking, but the Stick Shake is quite loud, and as we've discussed, very distracting.

Let's face it. Than run time of 9 seconds, the lack of sustained ANU via the electric trim and the power so high are the main indicators of his state of mind. It's a terrible shame that he'd not got more height as I've a feeling he was starting to go down the right logic route. But only just starting, and coping with too much of a handful to really focus.

Yes, AVIATE comes first, and it's really shouting loud that the stresses were drowning what skill he had.

[Portallo]

And as such, why is it really so necessary to inform pilots of this system? There is no specific control over it, just the generic runaway trim procedure.

Isn't that exactly the problem (next to MCAS operation relying on a single AoA vane naturally)?
Obviously, in case of the 737 MAX MCAS accidents there was a lack of a clean manual override path similar to that present in case of the 737 NG STS and/or allegedly the MCAS variant installed on the KC-46 tanker where, in both cases, the automatic trim procedure could be overridden by manual column input? Had that been in place in case of the 737 MAX MCAS along with appropriate pilot training and full disclosure of the new system(s) and changes, I dare say we would not be having this lengthy thread here.

Wasn't Boeing's design philosophy supposed to be "pilot can always override automation"? And why was it so poorly respected in this instance as opposed to the cases when similar systems were introduced by Boeing in the past ? These are the questions one truly needs to raise to assess the "what went wrong here?" conundrum.

[MurphyWasRight]

I agree it is an incomplete picture (which I did acknowledge), but there are some broad enough outlines from which we can draw some conclusions. If anything comes out that substantially alters our current understanding, then I'll be happy to make a correction.

As far as what was going on while the the trim switches were in the cutout position, are you referring to the gradual movement from 2.3 to 2.1 units? It apparently occurred over two and half minutes. I'm interested in seeing what the board's thoughts are on that as well, but I should point out that in the context of the overall trim movement, it is a very small and slow creep.
I was actually wondering more about what was discussed and actioned during that time. Two and and half minutes is long enough for the initial startle factor to dissipate, hopefully some insight can be gained into pilots actions during the preceding critical time.
The prelim report mentions only one attempt at manual trim at 05:41:46, roughly half way through the cutout period, surely there was other activity during that 150 seconds.

One possibility is that the trim creep was due to attempts at manual trim causing a bounce in the cables that each time resulted in slight movement in the wrong direction. In the mentour pilot video you can see this bounce as attempts are made.

Another possibility is that one of the brakes is not holding against the load but that would be a seperate failure/design flaw that is probably not needed to explain the traces.
Access to the raw FDR data should resolve this since if it was a slipping brake it would likely be continuous whereas manual trim efforts would be seen as (slight) steps with pauses.

[SamYeager]

Which rather vindicates Boeing's position on this; they reacted exactly as Boeing intended by identifying it as an STS runaway (which most assuredly is a runaway trim event) and dealt with it by using the correct pre-existing technique.


And as such, why is it really so necessary to inform pilots of this system? There is no specific control over it, just the generic runaway trim procedure. Surely telling people about systems they have no specific influence over is merely muddying the waters? If it presents itself as failure event X which is dealt with by checklist Y does anyone need to know that it could be system A or A.1 at fault, when both are addressed by the same checklist, show effectively the same symptoms and actually are components of the same system?

That, I am sure, was Boeing's rationale and though I'm not 100% comfortable with it I'm certainly not condemning it in the absolute and fundamental way some others are.
Except it was the jumpseater that identified the issue NOT the crew and it seems that neither the crew or the jumpseater understood what the issue was. No mention of stab trim runaway was made in the writeup as I recall.

[737 Driver]

Are there any contributors here who are 737 pilots who transitioned to the MAX?

May I ask please,
If you did, did you have any SIM, classroom, or Line training on the MAX and it's differences, or was it purely on-line modules, thus was your first flight on a ''pax on board'' flight?

Were you made fully aware of the adverse pitch up changes, and CG issues of the new MAX due to the design enforced forward location of the new larger engines (which can now cause lift) at low weights/high power applications resulting in a (unrecoverable?) high AOA? (which we now are aware, necessitated the MCAS software patch)

Were you (before the 2 fatal and 1 nearly accidents) fully informed/trained on the new MCAS systems and it's functionality, implications, and what to do if it went rogue?

Thanks.

MAX was added to our fleet of NG's about a year ago. All training was either online or bulletins pushed to our Ipads. There is a quick reference card in the cockpit with key reminders. I had a couple of opportunities to fly the MAX before it was grounded. It actually flies very nicely, and the only real issue for me was that some of the switches and indicators were in different places. It would be comparable to transitioning from a 2001 Ford F-150 to a 2019 model. Drives pretty much the same, some new bells and whistles, some new switchology for the radios and climate control, but still a Ford F-150.

Our company continually stressed that the transition would be relatively straightforward, and to a certain point that was true in the context of normal operations. However, my contention always was (and this is not 20/20 hindsight) that any issues with the MAX would be less a case of normals operations, but rather non-normal ops. As we have seen in aviation time and time again, it is very difficult to predict all the unique failure modes that may arise with a new aircraft. Given that, my concern with the MAX was not with adapting to any differences when things were going right, but rather how different it might be when things were going wrong. Sadly, those concerns were not misplaced.

[PiggyBack]

Boeing's big 'mistake' was to underestimate the public and to some extent the industry's interpretation of two failures due almost exclusively to bad handling and incorrect procedures that they could hardly have anticipated. At least, Boeing thought they could hardly have been anticipated at the time, and I doubt (m)any of us would have thought otherwise either before these accidents had we known about the system. Their mistake was to underestimate the amount and volume of criticism that would unexpectedly come their way because crews, maintenance and at least one airline screwed up in spades and the world retrospectively devined faults therefrom in Boeing that no one had thought were faults before and in a vindictive and vitriolic way unprecedented in the history of aviation..

I am not a pilot so my view may not be correct but I do design systems with functional safety requirments and I profoundly disagree with this. A system which cannot tolerate a single fault without entering a dangerous state which requires prompt action to prevent a catastrophe is not safe paticularily when at least one of the failures can occur in a high workload situation, must be responded to within a time limit and will generate misleading and distracting warnings. I am confident that I and all the teams I have worked in would have anticipated this would cause problems and would not have considered it an acceptable design.

Yes we are all human and may overlook failure modes with common causes or fail to understand complex interactions between sub-systems but this was just straightforwardly poor design which should have been identified as such.

The idea that Boeings big mistake was 'to underestimate the public and to some extent the industry's interpretation of two failures' is shockingly callous given the death toll and relatively small timespan. As far as we know the scenario concerned has occured three times and only been survived once and then perhaps a little fortuitously.

[Lost in Saigon]

I am not a pilot so my view may not be correct but I do design systems with functional safety requirments and I profoundly disagree with this. A system which cannot tolerate a single fault without entering a dangerous state which requires prompt action to prevent a catastrophe is not safe paticularily when at least one of the failures can occur in a high workload situation, must be responded to within a time limit and will generate misleading and distracting warnings. I am confident that I and all the teams I have worked in would have anticipated this would cause problems and would not have considered it an acceptable design.

Yes we are all human and may overlook failure modes with common causes or fail to understand complex interactions between sub-systems but this was just straightforwardly poor design which should have been identified as such.

The idea that Boeings big mistake was 'to underestimate the public and to some extent the industry's interpretation of two failures' is shockingly callous given the death toll and relatively small timespan. As far as we know the scenario concerned has occured three times and only been survived once and then perhaps a little fortuitously.

There are many systems on an aircraft where one failure can cause entry to a "dangerous state".

MCAS was designed to be easily disabled by simply trimming the aircraft. There is no prompt action required. All that is need is for the pilot to FLY THE AIRCRAFT just as they were taught in their very first lesson. ATTITUDES and MOVEMENTS (http://www.studyflight.com/attitudes-and-movements/)

Pilots are taught to always control the aircraft and to TRIM the aircraft to maintain that control. If the aircraft is not doing what you want it to, it is up to the pilot to MAKE it happen.

The MCAS "problem" is just a form of un-commanded or un-wanted trim. In addition to being a memory item, it is also just common sense to disable a system that is not performing correctly. In this case MCAS was causing nose down trim. If repeated nose up trim did not stop the unwanted nose down trim, turn off the electric trim.

Problem solved.

You can't really blame Boeing any more than you can blame Airbus for not predicting that the AF447 crew would forget that you need to lower the nose to unstall an aircraft, or that Airbus had designed the side sticks so that they cancel each other out.

[DCDave]

I am not a pilot so my view may not be correct but I do design systems with functional safety requirments and I profoundly disagree with this. A system which cannot tolerate a single fault without entering a dangerous state which requires prompt action to prevent a catastrophe is not safe paticularily when at least one of the failures can occur in a high workload situation, must be responded to within a time limit and will generate misleading and distracting warnings. I am confident that I and all the teams I have worked in would have anticipated this would cause problems and would not have considered it an acceptable design.

Yes we are all human and may overlook failure modes with common causes or fail to understand complex interactions between sub-systems but this was just straightforwardly poor design which should have been identified as such.

The idea that Boeings big mistake was 'to underestimate the public and to some extent the industry's interpretation of two failures' is shockingly callous given the death toll and relatively small timespan. As far as we know the scenario concerned has occured three times and only been survived once and then perhaps a little fortuitously.

Everyone who writes lousy software has the same excuse, blame the user.

[737 Driver]

Part 4

Continuing the Threat and Error Management discussion..... If you are just joining this sub-topic, please go back to the first post with the TEM graphic (Part 1)

First, a quick refresher. There are three components of the TEM model that are relevant here:

Threats are external and internal factors that can increase complexity or introduce additional hazards into a flight operations. Weather, unfamiliar airports, terrain, placarded aircraft systems, language barriers, fatigue, and distraction are examples of threats. Once a threat has been identified, the crew can take steps to mitigate that threat.

Errors are divergences from expected behavior caused by human actions or inaction that increase the likelihood of an adverse event. The difference between an error and a threat is that an error can, with careful attention, be quickly identified and crew members can find prompt solutions to the error. This is sometimes known as "trapping" the error. Untrapped errors can turn into new threats.

Barriers are structures, procedures and tools available to flight crew to trap errors and contain threats. Since no barrier is perfect, the goal is to build sufficient barriers so that all threats are contained and all errors trapped. Untrapped errors and uncontained threats can ultimately lead to an undesired aircraft state, incident, or accident.

The TEM model assumes that there are no perfect aircraft, perfect environments, or perfect humans. The goal is not to create a flawless system, but rater a resilient system.

The standard TEM model lists these available barriers for flight deck operations: Policies and procedures (SOP's), checklists, CRM, aircraft systems (particularly warning and alert systems), knowledge, and airmanship. Knowledge and airmanship are related to not only to training and experience, but also to an individual's commitment to develop their knowledge and airmanship. CRM includes such things as crew communications, monitoring, flight deck discipline, assignment and execution of specific duties. The Captain is the primary driver behind CRM, but the First Officer has obligations here as well.

In Part 3 of this series, I used the TEM model as a lens to analyze where and how the existing barriers failed. The primary reason that multiple barriers failed is that the effective employment of virtually all of these barriers depends heavily on the mental states of the two pilots. SOP's, checklists, CRM, knowledge, and airmanship only work as barriers when the crew can actually draw on them. It is unclear how much of this failure was due to lack of particular knowledge and/or skill as opposed to the inability to draw on existing knowledge and/or skill under pressure. There are indications that the Captain had achieved cognitive overload. This might have also applied to the First Officer, but we must also acknowledge that the FO had far less experience to draw on and may have had discomfort in speaking up. I believe one of the key takeaways from this accident is to appreciate the critical role of the First Officer in safe aircraft operations. A First Officer must not only be able operate the aircraft, run the checklists, and demonstrate knowledge of systems and procedures, he must be able to act as an effective barrier to trap not only his errors, but also the errors of the Captain.

When the traditional barriers failed, they effectively became new threats. These threats were subsequently uncontained and allowed errors to go untrapped leading ultimately to a hull loss and the death of all passenger and crew.

I ended Part 3 with the following question: What should one do when a barrier actually becomes a threat?

I'll be the first to admit that the "barrier as threat" is a bit different take on the TEM model, but I believe it is both valid and useful. From practical experience, I think TEM theory sometimes assumes that barriers are more resilient than they really are in practice and largely ignores the possibility that what was meant to be a barrier could actually become a threat.

However, by adopting a "barrier as potential threat" perspective, the TEM model actually provides some useful guidance. Threats should be identified or anticipated and steps should be taken to mitigate and contain those threats.

The key step here is awareness of the threat, or more specifically, awareness that what was initially considered a barrier might actually become a threat.

Let's go back to that list of potential barriers for flight deck operations - Policies and procedures (SOP's), checklists, CRM, aircraft systems, knowledge, and airmanship - and consider how these "barriers" might actually become threats.

Policy and procedures - I believe most airline SOP's provide useful barriers to the degree that the flight crew actually uses them. However, in some situations those policies may create unappreciated threats. For example, does the airline's policy drive an over-reliance on automation by mandating its use at all times? Do existing policies require/encourage Captains to do most of the actual flying leaving the First Officer ill-equipped to serve as an effective back-up? Do airline policies and/or culture create or sustain a steep authority gradient which discourages First Officers from speaking up or correcting errors by the Captain?

Checklists - Are the checklists (normal and non-normal) well designed? Do they help trap likely crew errors? If a crew member believes a checklist contains a potential threat, how amenable is their airline to modifying that checklist?

Crew resource management - Is the level of knowledge and proficiency of your Captain/First Officer sufficient to be an effective barrier? Is yours? Do the pilots use effective communication and social skills? Do they maintain cockpit discipline? Do they feel free to speak up and correct each other without creating tension?

Knowledge and airmanship - Does the crew receive the right kind of training to be effective? (Just refer to the "mantra" discussion if you need to be reminded of my position on this). Does that training prepare the crew for the known as well as the unknown? Does that training help mitigate the well-known startle and fear reflexes? Does that training emphasize systems management at the expense of basic aircraft skills? Does that training emphasize the need for the execution of NNC in a methodical and deliberate manner?

As we go through this list of questions (please add more if you like), we can develop a picture of where these barriers may actually morph into threats.

Once these new threats are identified, the next step is to attempt to mitigate those threats.

To be continued.....

[Cows getting bigger]

The problem with TEM is that it tends to encourage linear thought - actions will create the desired resolution. I spent some time in the UK RAF where we often quoted the Boyd`Cycle (OODA Loop) which was more of a circular decision making process - think DODAR. The advantage of the Boyd Cycle is that you review the efficacy of your actions and then, potentially, choose additional or even different actions.

Of course, such flexibility and decision making (including potential divergence from checklists) requires experience and deep theoretical. knowledge. In that area I think we all agree that aviation is struggling, not just due to the training system but also due to the manufacturers not telling the full story.

People quote Sully as an example in that he ‘got the job done’ regardless of checklist.

[safetypee]

To be continued..... Oh please no.

Is it really necessary to explain the complete TEM concept, to use this model to fit the few facts that are available, or is it that the facts are fitted the model in order to understand an individual’s (preconceived) viewpoint.

‘All models are wrong, but some are useful’ (George Box). The value of a model, like a tool is to select the appropriate one and know how it should be used; particularly its limits.

If you start with the human as a threat then you will conclude human error; alternatively starting with the human as an asset, pilot, designer, regulator, then with open thought, guided by a model, it may be possible to identify influencing factors, which in combination enabled the outcome.

Limitations of TEM Model
Assumes technical competency appropriate for role.
The threat-error-undesired states relationship is not necessarily straightforward and it may not always be possible to establish a linear relationship, or one-to-one linkage between threats, errors and undesired states. e.g. threats can on occasion lead directly to undesired states without the inclusion of errors;
and operational personnel may on occasion make errors when no threats are observable.
Essentially a ‘deficit’ model.
Benchmarks against a standard ‘safe’ or ‘safe enough’ i.e., other operators.
Descriptive: It describes an outcome or end state not how to get there.
Little focus on minimisation of error
Links the management of threats and errors to potential deficiencies in HF & NTS skills but not the processes supporting good TEM behaviour.
Same challenge as ‘Airmanship’
(https://www.casa.gov.au/sites/g/files/net351/f/_assets/main/lib100030/banks-tem.pdf)

[Smythe]

Given that, my concern with the MAX was not with adapting to any differences when things were going right, but rather how different it might be when things were going wrong. Sadly, those concerns were not misplaced.

Sadly, those concerns WERE misplaced.

There are the legacy commands that line up, not necessarily under non-normal ops. Look what happened when, what was it V10 of the HW FMS software came out? That one didnt last long.

The if/then sequence of commands can get one to a line in the code that has been long forgotten. A few that come to mind are the balked TOGA with a bounce, or after crossing a FO waypoint, the ac porpoises down to the AA level of the next waypoint, and of course, the lookup finding a simple radius of the Earth instead of the Geoid.

Unintended consequences of legacy programming. I would love to see a V1.0 of the FMS.

[737 Driver]

‘All models are wrong, but some are useful’ (George Box). The value of a model, like a tool is to select the appropriate one and know how it should be used; particularly its limits.


I agree. The TEM model has its limitations, but it also has its uses. One of its primary benefits is that is a key part of the language of aviation safety. Pilots are usually on the receiving end of this dialogue. I submit that it can be pointed in the other direction.

[737 Driver]

The problem with TEM is that it tends to encourage linear thought - actions will create the desired resolution. I spent some time in the UK RAF where we often quoted the Boyd`Cycle (OODA Loop) which was more of a circular decision making process - think DODAR. The advantage of the Boyd Cycle is that you review the efficacy of your actions and then, potentially, choose additional or even different actions.


If you go back and look at the original graphic, you will see that it does incorporate a cycle of input/output/review. I'm familiar with the Boyd Cycle, and it is appropriate in some circumstances, but it is less useful in setting up a resilient system in the first place. The OODA loop is more applicable once you are responding in the environment that has already been established.

[Cows getting bigger]

Yep, like an aircraft trying to kill you when you've lost your way through process. :)

[patplan]

Just another reiteration of some issues with MCAS' flawed logic, as discussed here and elsewhere... (with my emphasis)

Boeing says no flaws in 737 Max. Former engineer points to several

...Boeing CEO Dennis Muilenburg said the planes went down because of a chain of events.

"One of the links in that chain was the activation of the MCAS system because of erroneous angle attack data," he said at a recent news conference.

Peter Lemme, a former Boeing engineer and former FAA designated engineering representative, said MCAS is the main link. The flaws in that system, he said, need to be addressed...

***First, MCAS activated because of a single sensor with a false reading. On the Ethiopian jet, one indicator swung from showing a normal ascent to showing a steep ascent. Lemme said in that case it was a clear sign of failure.

"Having the vane change from 15 to 75 degrees in two seconds — it is immediately an indication of a fault. There's just no physical way to do that," he said. "And then 75 degrees is kind of a ridiculous number."

But MCAS acted on it, even though a sensor on the other side of the plane reported everything was fine.

"That was a big disappointment. If the systems had declared the signal failed then MCAS would not have fired and nothing would have happened," he said.

***Both planes were flying at a great speed when they crashed — another flaw, according to Lemme because MCAS should have stopped at that speed.

"There is no way to stall the airplane at that airspeed and MCAS should have had logic in place that would prohibit it from operating," Lemme said.

***The Lion Air flight pitched forward more than 20 times before that plane crashed into the sea. That is the greatest flaw in MCAS, Lemme said: the repeated descents.

"It persistently attempted to move the stabilizer down without giving up. I think if MCAS hadn't had the repeated feature where it could re-trigger, we probably would have been OK," he said.

Lemme said testing should have caught the problems with MCAS.

"That should have been found. You would expect the test program would look at the likely failure modes," he said. "That is a breakdown in the test program."...

- https://www.kuow.org/stories/engineer-gap-flaw-mcas

[Organfreak]

And the source of the above article is very well-respected as one of Seattle's NPR radio stations, KUOW, so should be taken seriously.

[fergusd]

There are many systems on an aircraft where one failure can cause entry to a "dangerous state".

MCAS was designed to be easily disabled by simply trimming the aircraft. There is no prompt action required. All that is need is for the pilot to FLY THE AIRCRAFT just as they were taught in their very first lesson. ATTITUDES and MOVEMENTS (http://www.studyflight.com/attitudes-and-movements/)

Pilots are taught to always control the aircraft and to TRIM the aircraft to maintain that control. If the aircraft is not doing what you want it to, it is up to the pilot to MAKE it happen.

The MCAS "problem" is just a form of un-commanded or un-wanted trim. In addition to being a memory item, it is also just common sense to disable a system that is not performing correctly. In this case MCAS was causing nose down trim. If repeated nose up trim did not stop the unwanted nose down trim, turn off the electric trim.

Problem solved.

You can't really blame Boeing any more than you can blame Airbus for not predicting that the AF447 crew would forget that you need to lower the nose to unstall an aircraft, or that Airbus had designed the side sticks so that they cancel each other out.

It may be interesting to note that what appears to be the vast majority of people who are responsible for designing, developing and delivering safety critical systems for a living (I am another example - high software content military life critical systems amongst other things) who have commented find the Boeing approach at best questionable, and for my part very concerning (as a very regular pax). I had expected better from the aviation regulation process.

Equally concerning are the folk that fly these machines who also appear to feel that this type of potentially inadequate (and demonstrably dangerous) systems design is acceptable, it may be the norm, and it may be what you are used to . . . but I'm surprised . . .

Edit : A wise man in the military safety community once told me that if I wasn't personally prepared to trust my life to the system I designed I shouldn't be in the industry . . . I wonder whether that ethos has been diluted in aviation . . . I hope not . . .

Fd

[GordonR_Cape]

Just another reiteration of some issues with MCAS' flawed logic, as discussed here and elsewhere... (with my emphasis)Peter Lemme, a former Boeing engineer and former FAA designated engineering representative, said MCAS is the main link. The flaws in that system, he said, need to be addressed...

[snip]

***Both planes were flying at a great speed when they crashed — another flaw, according to Lemme because MCAS should have stopped at that speed.

"There is no way to stall the airplane at that airspeed and MCAS should have had logic in place that would prohibit it from operating," Lemme said.

[snip]

Lemme said testing should have caught the problems with MCAS.

"That should have been found. You would expect the test program would look at the likely failure modes," he said. "That is a breakdown in the test program."...

- https://www.kuow.org/stories/engineer-gap-flaw-mcas

Isn't that statement a logical fallacy for two reasons:
- An aircraft can stall at any speed, if the altitude is sufficiently high, and the the wings are in a banked turn (accelerated stall).
- MCAS is not an anti-stall system, so that statement has no bearing on its activation.

[737 Driver]

Here's a polite challenge. Given your previously expressed views on what you consider to have been the inadequacy of this crew, are you sure you aren't levering your preconceptions into the TEMS model rather than applying it from first principles?

An astute observation. I am not conducting a first-order analysis for a very specific reason. A first-order analysis would step through the initial threats, the barriers, and the errors (trapped and untrapped) and the outcome of each untrapped error. I think that has already been done in spades, though not necessarily through the lens of TEM. We know there were errors, and we know many of those errors went untrapped despite the theoretical presence of numerous barriers. I am doing something more of a second-order (and in some cases third-order) analysis that suggests that the "barriers" did not function as expected because they actually contained unrecognized threats. Those threats, being unrecognized, had no mitigation strategy or barrier to contain them and thus led to a series of actions resulting in the loss of this aircraft.

As far as the "inadequacy" of the crew, I think the picture I've been painting here is the inadequacy of the system that put them in that cockpit. These pilots were a product of their training, experience, and environment. In theory, that system gave them the tools (i.e. the barriers) that would have made this accident avoidable. Rather, my conjecture is that instead of creating resilient barriers, their training and operating protocols were actually producing unperceived, and hence unmitigated, threats.

[Double07]

It has pretty well been established on this thread that pilot electric trim will work in all conditions (does not stall under load) and interrupts MCAS if active as shown by ET trace at ~05:40:27. This pilot trim input was possibly then interrupted by cutout switches.
Other than 'deer in headlights' losing it I see a few possible factors:
1: Pilot accustomed to short blips not comprehending amount truly needed, this fits Lion Air when the FO was ineffective at the end when PIC handed over control while the Captain was mostly successful.
2: Trimming by column feel not position: May seem that AC is closer to trimmed than it is. In other words if you have been pulling really hard then just slightly hard may feel like close to trimmed, I am sure the pilot did not want to over trim given all the alarms.
This might explain ET first retrim at 05:4-:15. Unfortunately we don't have the column force graph, just position.
3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.
Hopefully the final reports will fully address this question. Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRUNE thread entitled 737MAX Stab Trim architecture (https://www.pprune.org/tech-log/615709-737max-stab-trim-architecture.html), post #194), one can see that when MCAS is active, then STS in inactive.
And when MCAS is inactive, then STS is active.
Is it possible that after a pilot electrically trims the aircraft nose-up after an MCAS nose-down trim event, then the STS system will activate to trim the aircraft nose-down again before the next MCAS nose-down trim event? Recall that the STS system trims the aircraft in the direction opposite to the speed change. So if the pilot has just trimmed with a nose-up command, then wouldn’t the STS system counter with a nose-down trim command? This same operation would still apply if the autopilot thought the aircraft had a higher angle of attack as a result of a defective AoA sensor (the autopilot controls the STS trim even when the autopilot is off). Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?

One thing that confuses me here is that I’ve read that STS activates 5 seconds after release of the manual trim switches. MCAS has a similar 5 second delay. This may mean that any STS trim would be canceled by an MCAS trim event. But could there be a delay in MCAS activation relative to STS activation? By the way, STS trim and manual electric trim have the same trim rates, but differ in direction. Also, any STS trim should be canceled by the simultaneous activation of manual electric trim by the pilot. But if the pilot released the manual trim button when he believed the aircraft trim to be at neutral, then STS might give a short nose-down trim command before MCAS activates to give a larger nose-down command.

Also, the same schematic shows that the two pedestal cutout switches on the 737MAX operate as a logical “AND” function (“&” function) as follows:Manual electric trim = [PRI] & [B/U]
Autopilot trim = [PRI]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]


This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative. However, it would be a trivial change to have the switches operate as follows:Manual electric trim = [PRI]
Autopilot trim = [PRI] & [B/U]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

In this case the pilots would be able to turn off the autopilot trim and MCAS trim by turning off only the B/U cutout switch while keeping the manual electric trim and STS trim active by leaving the PRI cutout switch on. This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done? Is it because it would have required re-certification of the aircraft by giving the pilots control over the MCAS function? Was certification of the 737NG with new lift-causing engines dependent upon the MCAS correction function operating only in the background without control from the pilots?

[MurphyWasRight]

Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRUNE thread entitled “737MAX Stab Trim architecture”, post #194), one can see that when MCAS is active, then STS in inactive. And when MCAS is inactive, then STS is active.).
...
... Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?
...
This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative..
......
This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done?
...

Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
There is one brief NU automatic trim on the trace at 05:40:00 after the AP disconnect followed (or even interrupted by) MCAS for 9 seconds, this could be an STS input.

The only possible impact of this is that the pilot may have heard trim starting and glanced down to see normal looking (NU) trim, which was quickly reversed by MCAS.
Had not thought of that before but likely not significant, in any case it was short and "the right way".

BTW: The penultimate Lion Air crew wrote up the defect as "STS trimming in wrong direction".

Correct on cut out switch change from NG to MAX.

No one has offered an 'official' sounding reason for the change.
The most likely case is that training had shifted to always using both and it simplified some aspect (cert?) of MCAS to not have a seperate auto only cutout, but both switches were retained for commonality.

[Zeffy]

https://www.seattletimes.com/business/faa-asks-for-nasas-help-in-boeing-737-max-safety-upgrade-review/


FAA asks for NASA’s help in Boeing 737 MAX safety-upgrade review
May 7, 2019 at 12:40 pm Updated May 7, 2019 at 1:58 pm
By Alan Levin and Ryan Beene
Bloomberg

The Federal Aviation Administration is convening a panel of outside experts from the Air Force, NASA and a Transportation Department center to review Boeing’s software fixes for the grounded 737 MAX.

The agency announced the new Technical Advisory Board in a statement on Tuesday. The panel’s recommendations will “directly inform the FAA’s decision concerning the 737 MAX fleet’s safe return to service,” the agency said.

The plane was grounded on March 10 after the second fatal accident in less than five months claimed a total of 346 lives. Boeing designed the plane with a system that automatically forced down the nose in some circumstances and malfunctions on both flights caused it to repeatedly dive until pilots lost control.

The manufacturer is changing the software to make it less likely to fail and to limit how far it can drive down the nose. Boeing and the FAA have been working closely on the software fix, but the Chicago-based planemaker hasn’t completed its work.

The new panel is separate from two other existing reviews created by FAA. The DOT’s Volpe National Transportation Systems Center in Massachusetts is participating.

To contact the reporters on this story: Alan Levin in Washington at [email protected];Ryan Beene in Washington at [email protected]

[737 Driver]

Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRUNE thread entitled 737MAX Stab Trim architecture (https://www.pprune.org/tech-log/615709-737max-stab-trim-architecture.html), post #194), one can see that when MCAS is active, then STS in inactive.
And when MCAS is inactive, then STS is active.
Is it possible that after a pilot electrically trims the aircraft nose-up after an MCAS nose-down trim event, then the STS system will activate to trim the aircraft nose-down again before the next MCAS nose-down trim event? Recall that the STS system trims the aircraft in the direction opposite to the speed change. So if the pilot has just trimmed with a nose-up command, then wouldn’t the STS system counter with a nose-down trim command? This same operation would still apply if the autopilot thought the aircraft had a higher angle of attack as a result of a defective AoA sensor (the autopilot controls the STS trim even when the autopilot is off). Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?

STS respects the control column cutout switches, so any time that virtually any amount of forward or backward pressure was being applied to the yoke, STS would not be able to make any input. Additionally, STS has its own Stall ID mode which, in the presence of a stall signal, would command the trim nose down and override any other STS input. This nose down trim input is also inhibited by the control column cutout switches.

One thing that confuses me here is that I’ve read that STS activates 5 seconds after release of the manual trim switches. MCAS has a similar 5 second delay. This may mean that any STS trim would be canceled by an MCAS trim event. But could there be a delay in MCAS activation relative to STS activation? By the way, STS trim and manual electric trim have the same trim rates, but differ in direction. Also, any STS trim should be canceled by the simultaneous activation of manual electric trim by the pilot. But if the pilot released the manual trim button when he believed the aircraft trim to be at neutral, then STS might give a short nose-down trim command before MCAS activates to give a larger nose-down command.

Both have a 5 second delay because MCAS is actually a sub-function of STS (though MCAS is not inhibited by the control column cutout switches). STS can trim in both directions. If near neutral trim, STS might make an input (nose up or nose down) but any further inputs would be inhibited if the control column was displaced from neutral.

Also, the same schematic shows that the two pedestal cutout switches on the 737MAX operate as a logical “AND” function (“&” function) as follows:Manual electric trim = [PRI] & [B/U]
Autopilot trim = [PRI]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative. However, it would be a trivial change to have the switches operate as follows:Manual electric trim = [PRI]
Autopilot trim = [PRI] & [B/U]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

In this case the pilots would be able to turn off the autopilot trim and MCAS trim by turning off only the B/U cutout switch while keeping the manual electric trim and STS trim active by leaving the PRI cutout switch on. This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done?

Under current procedures, we never use the cutout switches individually on the 737NG or the MAX. We always use them together. There have been extensive discussions regarding the why's and wherefore's of the change in switch functionality, but procedurally it makes no difference at all.

Is it because it would have required re-certification of the aircraft by giving the pilots control over the MCAS function? Was certification of the 737NG with new lift-causing engines dependent upon the MCAS correction function operating only in the background without control from the pilots?

Pilots have never had direct control over the STS function, so I'll speculate that giving them direct control over MCAS never crossed anyone's mind. MCAS was required for certification, but I don't think those certification rules cared whether the system operated in the foreground or background.

[L39 Guy]

It may be interesting to note that what appears to be the vast majority of people who are responsible for designing, developing and delivering safety critical systems for a living (I am another example - high software content military life critical systems amongst other things) who have commented find the Boeing approach at best questionable, and for my part very concerning (as a very regular pax). I had expected better from the aviation regulation process.

Equally concerning are the folk that fly these machines who also appear to feel that this type of potentially inadequate (and demonstrably dangerous) systems design is acceptable, it may be the norm, and it may be what you are used to . . . but I'm surprised . . .

Edit : A wise man in the military safety community once told me that if I wasn't personally prepared to trust my life to the system I designed I shouldn't be in the industry . . . I wonder whether that ethos has been diluted in aviation . . . I hope not . .
Fd

I think everyone is in agreement that MCAS needs to be fixed.

None of the aviators that have defended Boeing or MCAS find this situation “acceptable” at all. What we have a hard time accepting is that “professional pilots” could not manage this situation in 2/3 of the events. If they had even done the UAS drill they likely would have survived as both crews lost control of the aircraft as they were racing around at an unacceptably high speed. If either of the crews had trimmed the pitch, a perfectly natural and instinctive reaction, they would have disabled MCAS each and every time. If the crews had done the Stab Trim Runaway memory checklist, which is for events just like this, they would have disabled MCAS just like the crew of the Lion Air incident did and indeed flew the aircraft for an hour and a half with unreliable airspeed and MCAS just waiting to rear its ugly head.

These drills (UAS and Stab Trim Runaway) are not complex; pulling the throttle back to control the airspeed is basic flying just as trimming the aircraft. What has aviators like myself, 737 Driver, Lost in Saigon and others deeply concerned about is that the basic flying skills to deal with these situations are no longer present in today’s professional pilot. When everything works it’s all good...just put ‘er on the autopilot and off you go. But when a curveball is thrown at you, you’re not there when you’re needed the most. That should be of serious concern to the airlines, the regulators, the manufacturers and the professional pilot community.

The measure I used as an instructor and a commercial airline pilot was “would I put my family on an aircraft flown by less than competent pilots”? If the answer is no then we have a problem and I would submit that there is a problem in parts of the world that seem to be crashing aircraft these days.

[gums]

Salute!

Losing credibility faith in you, Murph...... to wit:
Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
Even Driver has referenced STS and that MCAS was considered a sub-mode by some folks. And due to STS rolling that trim wheel a lot, the Lion crew commented that STS was working backwards. I would also like to hear the CVR on that flight, as all we hear via the rumor mill is the jump seat guy saved the day. Until we have the trial testimony and depositions, we may not know. Maybe the CVR had some of the conversation, as the FDR had a lotta hours. My not so humble opinion is that crew lucked out and "went manual" when the trim system was not acting as they expected. I give them a lotta credit for doing all that with then shaker goingon, but their CVR shoul give us a clue if it ever becomes public.

Comes down to same thing - longitudinal pitch moments and such, not simply back stick forces per AoA unless you are flying a pure cable and pulley plaine. The 737 variants added STS after a coupla generations because it had to satisfy FAR speed stability reuqirements. And BTW, I do not like that "speed" term. It's AoA and basic aero to force the nose down/up when decreasing/increasing speed/AoA from a reference speed/AoA. It's called "trim".And most here learned all about it back when learning in the Tiger Moth or Aeronica or Cessna or.........

Big B has a lotta public relations work in store, and I am not sure they will recover for long time. Irritates this old fart, as I always liked their control authority philosophy.

Gums sends...

[737 Driver]

Part 5

Continuing the Threat and Error Management discussion......

Okay, the question has been asked, "Why bother with the TEM model? What good is it?"

The TEM model is widely used in aviation, and it is a fundamental part of the language of aviation safety. It often is the language that is directed toward flight crews by their airlines in order to build a case for better safety practices. I am suggesting that it is also a useful tool not only for an individual pilot's safety assessment, but also as a way to engage in a dialogue back up the management chain. I am admittedly putting an unorthodox spin on TEM by raising the issue of "barriers as threats." However, sometimes when our airlines think they are creating barriers, they may actually be creating threats. By looking closely at some of the assumptions underlying many barriers, it is possible to identify these new potential threats. Once these threats are identified, steps can then be taken to mitigating those threats, perhaps by building additional barriers. Yes, there is a potential matryoshka doll type quality to this recursive analysis, but I don't it needs to be taken through too many layers.

In Part 4 of this series, I listed some questions to asked regarding the traditional barriers available to the flight crew. Perhaps you have some of your own. Those questions may lead to the identification of a threat in the guise of a barrier.

Examples of responses that raise some flags:
.

Our company SOP's emphasis on automation as a "safety" tool is causing my hand-flying skills to degrade.
Our company's established reporting system for for operational concerns is so onerous that most pilots don't bother using it.
Our training program's focus on standardization relies too much on rote actions, predetermined training events, and a "tick box" mentality that does not allow for the introduction of novel events that require higher order thinking. There are no attempts to induce a "startle" effect or create ambiguity.
Our company's hierarchical structure and emphasis on the Captain's authority makes First Officers reluctant to speak up and correct the Captain when necessary.
The First Officers I fly with know their systems, are whizzes at programming the box and have no problem with the automation, but they seem to have little "feel" for flying or having the "big picture."
When I point out that one of our checklists has a potential trap, the response is something like, "Smarter people than you made that checklist. Just stick to it."
We hire people from around the world, and frankly communicating with some of them outside the expected checklist responses is challenging.

.
In each of these cases, one of the traditional barriers of the TEM model was hiding a potential threat. Now what?

The TEM model shows the way. Once threats are identified, the flight crew (or individual pilot) should use whatever tools available to mitigate those threats or even develop a new barrier. How the pilot mitigates the threat will depend heavily to his company's openness to dialogue as well as that pilot's personal initiative to mitigate threats as they arrive in daily operations.

On a group or organizational level this may include lobbying the airline managers and/or regulators for appropriate changes to training standards, automation policy, and operational reporting system. Use the TEM model as a tool this dialogue. Push for enhanced training for First Officers that emphasizes their role as a proactive barrier on the flight deck, and recommend creating a forum where operational safety concerns can be freely discussed without fear of retribution. Where managements are resistant, engage with outside safety organizations or other entities that have influence. Remind managers that not all costs can be entered into a spreadsheet before the fact, but they can certainly be tallied later. Some of those costs are paid in bent metal and broken bodies. Carry a picture of the crater left by ET302 as a constant reminder of the consequences of ignoring these issues.

On an individual level, spend some time looking at your company's safety culture and identify existing threats. If the airline will not take appropriate steps to mitigate the threat (e.g. pressure to meet schedule or contain costs overrides your specific issue), use whatever tools you have to contain the threat even if it means walking off the airplane. Brief every flight as if it were your last. If you are a Captain, make your expectations clear to your First Officers and insist that they speak up as necessary. If you are a First Officer and you have a "difficult" Captain, remember its your butt up in the cockpit, too. Use diplomacy, social skills, and/or direct language as appropriate. If your airline won't provide the training you think you need, train yourself. Memorize the "mantra" and share it with the pilots you fly with. "Chair" flying is always available and desktop simulators are cheaper than ever. Click off the automation every chance you get. Review your procedures, memory items, and limitations regularly. Look for potential traps in those procedures and have a plan for them. If you have a concern in the cockpit, speak up! It may be nothing, it may be something. Don't assume the other person is aware of everything that you are aware of. Don't assume that you are aware of everything you need to be aware of. Get plenty of rest, and take care of your health.

Yes, it is a lot to ask, however, never forget that the pilots are usually the first ones to the scene of the accident. Our standards and expectations ought to be higher.
.

​​​​​​"Our problem is not that we aim too high and miss, but that we aim too low and hit." - Aristotle
.

[hans brinker]

Isn't that statement a logical fallacy for two reasons:
- An aircraft can stall at any speed, if the altitude is sufficiently high, and the the wings are in a banked turn (accelerated stall).
- MCAS is not an anti-stall system, so that statement has no bearing on its activation.


No, it really isn't, there is no way you can stall a 737 at 350kts indicated, because the wings will come off before you hit the critical angle of attack.

MCAS is not anti-stall. it just prevents the pilots from stalling (you see how that sounds?)

[MurphyWasRight]

Salute!

Losing credibility faith in you, Murph...... to wit:
Quote:
Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.

Even Driver has referenced STS and that MCAS was considered a sub-mode by some folks. And due to STS rolling that trim wheel a lot, the Lion crew commented that STS was working backwards. I would also like to hear the CVR on that flight, as all we hear via the rumor mill is the jump seat guy saved the day. Until we have the trial testimony and depositions, we may not know. Maybe the CVR had some of the conversation, as the FDR had a lotta hours. My not so humble opinion is that crew lucked out and "went manual" when the trim system was not acting as they expected. I give them a lotta credit for doing all that with then shaker goingon, but their CVR shoul give us a clue if it ever becomes public.

Comes down to same thing - longitudinal pitch moments and such, not simply back stick forces per AoA unless you are flying a pure cable and pulley plaine. The 737 variants added STS after a coupla generations because it had to satisfy FAR speed stability reuqirements. And BTW, I do not like that "speed" term. It's AoA and basic aero to force the nose down/up when decreasing/increasing speed/AoA from a reference speed/AoA. It's called "trim".And most here learned all about it back when learning in the Tiger Moth or Aeronica or Cessna or.........

Big B has a lotta public relations work in store, and I am not sure they will recover for long time. Irritates this old fart, as I always liked their control authority philosophy.

Gums sends...
What I mean is that in ET case it was clear from the traces that although there was one probable STS trim it had no impact on the accident sequence.
I was attempting to answer a question about STS possible active involvement in the ET accident.
.
Not at all saying that STS was not of overall significance, possibly by adding confusing expectation of intermittent auto trim, although the magnitude and other behavior is much more benign than MCAS.

While MCAS is a subsystem of STS it would be confusing (to say the least) to blame "STS" for the difficulties faced by the crews.

BTW: 737 driver STS explanation is much better than mine since it also includes response to column cutout switches etc further supporting the case that it had no direct role in ET.

[KRUSTY 34]

Just another reiteration of some issues with MCAS' flawed logic, as discussed here and elsewhere... (with my emphasis)

Boeing says no flaws in 737 Max. Former engineer points to several



- https://www.kuow.org/stories/engineer-gap-flaw-mcas

Muilenburg really needs to stop trying to dodge the reality of this thing. Although knowing what I do of the Corporate mindset, I reckon Hell will freeze over before that happens!

At the end of the day though, I believe that MCAS should go down as an example of the most monstrous Corporate and Regulator failure in the history of modern commercial aviation.

[KRUSTY 34]

I think everyone is in agreement that MCAS needs to be fixed.

None of the aviators that have defended Boeing or MCAS find this situation “acceptable” at all. What we have a hard time accepting is that “professional pilots” could not manage this situation in 2/3 of the events. If they had even done the UAS drill they likely would have survived as both crews lost control of the aircraft as they were racing around at an unacceptably high speed. If either of the crews had trimmed the pitch, a perfectly natural and instinctive reaction, they would have disabled MCAS each and every time. If the crews had done the Stab Trim Runaway memory checklist, which is for events just like this, they would have disabled MCAS just like the crew of the Lion Air incident did and indeed flew the aircraft for an hour and a half with unreliable airspeed and MCAS just waiting to rear its ugly head.

These drills (UAS and Stab Trim Runaway) are not complex; pulling the throttle back to control the airspeed is basic flying just as trimming the aircraft. What has aviators like myself, 737 Driver, Lost in Saigon and others deeply concerned about is that the basic flying skills to deal with these situations are no longer present in today’s professional pilot. When everything works it’s all good...just put ‘er on the autopilot and off you go. But when a curveball is thrown at you, you’re not there when you’re needed the most. That should be of serious concern to the airlines, the regulators, the manufacturers and the professional pilot community.

The measure I used as an instructor and a commercial airline pilot was “would I put my family on an aircraft flown by less than competent pilots”? If the answer is no then we have a problem and I would submit that there is a problem in parts of the world that seem to be crashing aircraft these days.


Well L39 Guy,

I’m sincerely hopeful that as part of your instructing duties you are not responsible for matters concerning Human Factors. Hopefully we will never be thrust into such an unexpected and mind numbing situation as befell these poor crews.

[Capn Bloggs]

pulling the throttle back to control the airspeed is basic flying just as trimming the aircraft.
Trimming. Now there's an interesting concept. Let's see. AP on at 500ft after takeoff. No pilot trim required. AP out at 500ft on final approach. No pilot trim required. In some companies, this is the recommended/preferred SOP.

How is a pilot expected to instinctively trim in such a diabolical scenario when he doesn't do it at any other time?

[MurphyWasRight]

...as both crews lost control of the aircraft as they were racing around at an unacceptably high speed.
If the crews had done the Stab Trim Runaway memory checklist, which is for events just like this, they would have disabled MCAS just like the crew of the Lion Air incident did and indeed flew the aircraft for an hour and a half with unreliable airspeed and MCAS just waiting to rear its ugly head.
...
ET was at ~250 when MCAS dumped in 9 seconds of ND trim which led to sharp speed increase. Even so they were still well under VMO when they disabled all electric trim and were apparently unable to manually trim due to aero loads possibly compounded by lack of training in the unloading technique.

This period is unfortunately not well covered in the prelim report but to say they were 'racing around' does seems a bit harsh.

Other pilots have stated that chopping power would need to be done very carefully given the conditions and altitude.
I am not saying they did not simply miss the 'autothrottle off' step but that only added to problems later on.

[Water pilot]

The measure I used as an instructor and a commercial airline pilot was “would I put my family on an aircraft flown by less than competent pilots”? If the answer is no then we have a problem and I would submit that there is a problem in parts of the world that seem to be crashing aircraft these days.

Do you mean Texas (https://www.cbsnews.com/news/amazon-cargo-plane-crash-2nd-black-box-found-near-houston-trinity-bay-today-2019-03-02/) or Florida? (https://www.usatoday.com/story/news/nation/2019/05/04/pets-still-not-found-plane-crashed-landed-jacksonville/1100509001/)

[EDLB]

Erasing culpability for a bad certificate won't erase the design issues that make the certificate bad.

Edmund

There are industry wide standards for the hard and software when flight control surfaces are moved outside the direct control of the pilots i.e. for fly by wire aircraft.

It smells that Boeing tries to get away with the next substandard solution to save some bucks. Panels or groups tend to agree on more risky solution than single persons or entities where their name would be written alone on the next fatality case.

[BDAttitude]

To me it also sounds like a plan B if the international sister *AAs are not as servile as expected in providing a waiver for the design.

Having read most of the 256 pages - did we have somewhere a comparison of the implementation of MD11s LSAS and MCAS?
IIRC LSAS hat two computers (left and right) selectable by flight crew? Can't remember if each of those two computers had a left and right channel as well.
Is MCAS and LSAS a good comparison, given that the one is active most of the time and the other only in a very specific corner of the envelope? What does that mean in terms of safety requirements?

[atpcliff]

Here is a good recent article on Boeing certification problems:

https://www.seattletimes.com/business/boeing-aerospace/engineers-say-boeing-pushed-to-limit-safety-testing-in-race-to-certify-planes-including-737-max/

Fly SAFE!

God bless, and Namaste...

[Bend alot]

To me it also sounds like a plan B if the international sister *AAs are not as servile as expected in providing a waiver for the design.

Having read most of the 256 pages - did we have somewhere a comparison of the implementation of MD11s LSAS and MCAS?
IIRC LSAS hat two computers (left and right) selectable by flight crew? Can't remember if each of those two computers had a left and right channel as well.
Is MCAS and LSAS a good comparison, given that the one is active most of the time and the other only in a very specific corner of the envelope? What does that mean in terms of safety requirements?

Just another thing - seems the simulator does not simulate MCAS, another over site to rectify.

https://edition.cnn.com/2019/03/28/africa/ethiopian-airlines-boeing-max-8-simulator-manual-intl/index.html

Chief Pilot and Vice President of Flight Operations Yohannes HaileMariam is at the helm of our simulated flight. Everything during the re-creation is designed to be as real as possible, including videos of runways and airports around the world that play on the screens, simulating the cockpit's wind screen. Guided by HaileMariam, our simulated flight rises and is airborne for 15 minutes before gliding to a stop.
During our simulated flight, there is no sign of a downward tug on the plane's nose, a concern at the center of investigations into the two crashes. The 737 Max 8's MCAS lowers the plane's nose when a sensor detects that the aircraft is at risk of stalling.

[BDAttitude]

Just another thing - seems the simulator does not simulate MCAS, another over site to rectify.

...

Chief Pilot and Vice President of Flight Operations Yohannes HaileMariam is at the helm of our simulated flight. Everything during the re-creation is designed to be as real as possible, including videos of runways and airports around the world that play on the screens, simulating the cockpit's wind screen. Guided by HaileMariam, our simulated flight rises and is airborne for 15 minutes before gliding to a stop.
During our simulated flight, there is no sign of a downward tug on the plane's nose, a concern at the center of investigations into the two crashes. The 737 Max 8's MCAS lowers the plane's nose when a sensor detects that the aircraft is at risk of stalling.
Would be very suprised if it was so. FCCs should have the same Software as in the real plane, shouldn't they?

[Bend alot]

Would be very suprised if it was so. FCCs should have the same Software as in the real plane, shouldn't they?
Lots of us are very surprised about a lot of things coming to light, on the MAX systems/changes and it's certification.

What cost cutting measures were applied to the simulators that "are not really required anyway" as it basically fly's like a NG and MCAS only operates in the back ground.

[BDAttitude]

Lots of us are very surprised about a lot of things coming to light, on the MAX systems/changes and it's certification.

What cost cutting measures were applied to the simulators that "are not really required anyway" as it basically fly's like a NG and MCAS only operates in the back ground.
It's just that I don't see the costs that could have been cut by doing so.
The CNN feature you have linked seems to be very superficial. I can't see them trying to stall the aircraft or introducing a AOA fault. So where should MCAS come into action. It's a scenic flight in the simulator and the statement that there was no MCAS intervention is ambiguous to me.

However there is still negligence and the bad suprises are many.
Maybe someone has more detailed knowledge one the capabilities of the 8 MAX simulators (one of which seems to be located in Ethopia, which is at least suprising to me).

[L39 Guy]

Well L39 Guy,

I’m sincerely hopeful that as part of your instructing duties you are not responsible for matters concerning Human Factors. Hopefully we will never be thrust into such an unexpected and mind numbing situation as befell these poor crews.

I spent part of my instructing time in standards, i.e. upholding the standards. And part of the "standard" is human factors such as being able to cope with emergencies complete with bells and whistles going off, the startle factor, unfamiliarity of the situation, etc. In fact, one of the interesting things teaching flying in the military jets is that everyone wears oxygen masks and one can hear the other person breathing. And sure enough, when giving a student an emergency such as a simulated engine failure, one could hear the breathing rate increase - perfectly natural and visceral response. It was always instructive to tell the student to listen to their breathing as a means to settle things down.

I guess I am kind of old fashioned; I expect professional pilots - those who are being paid by someone to transport them from A to B - to be able to cope with emergencies. That is part of the contract between the passenger and the airline and the pilot. I expect that the pilot be properly trained and evaluated to handle the known emergencies - that is the responsibility of the airline and the regulator. I expect that professional pilots know their emergencies, particularly the memory drills, 12 months of the year not just before simulator sessions. And that might mean dragging out the checklist during cruise to go over an emergency or two just to keep them fresh. That is all part of being a "professional" much like I expect an emergency room physician to know their emergencies.

BTW, there is no such thing as an "expected" emergency. Emergencies happen out of the blue often with no warning. That's the nature of the beast and the startle factor is always there.

Nobody wants to be thrusted into emergency situations but they happen in aircraft - that's the nature of the business, systems fail, parts break and you simply can't pull over to the side of the road to figure it out. But this MCAS situation is not mind numbing - what is mind numbing is a double engine failure after take-off, flying into volcanic dust at night, losing all of the hydraulics in an aircraft that supposedly can't fly without them (United DC10, Sioux City), etc. None of these emergencies had checklists or an opportunity to be exposed to them in a simulator first.

An unreliable airspeed after take-off complete with stick shaker is not a "mind numbing" emergency. There is a memory checklist for it, it is something that one could have or should have seen in a simulator as part of getting a type rating, and it is a really easy emergency - magic off, set and attitude and power setting then get the checklist out. Then, and always, fly the aircraft. Ain't that hard regardless of how many bells and whistles are sounding. Not doing this simple emergency drill prior to raising the flaps and MCAS starting up (about two minutes after take-off) would have lead to an entirely different outcome, as the Lion Air incident flight showed. I am not going to repeat the rest of the stuff about stab trim runaway, etc. as that has been beaten to death on this forum already.

[L39 Guy]

Do you mean Texas (https://www.cbsnews.com/news/amazon-cargo-plane-crash-2nd-black-box-found-near-houston-trinity-bay-today-2019-03-02/) or Florida? (https://www.usatoday.com/story/news/nation/2019/05/04/pets-still-not-found-plane-crashed-landed-jacksonville/1100509001/)

Runway overrun in Florida and the B767 in Houston? Fair enough although let's see what caused the B767 accident first. But if you want to delve into overruns, check out avherald.com and see the Lion Air incidents.

Quick quiz: how many jet aircraft fatalities in the US in the past 10 years? In Canada in the past 30? Same for Australia, New Zealand, Singapore, Hong Kong, Japan, Western Europe (UK, France, Germany, Italy, etc)? Answer to the first two is 1 and 16, respectively.

[GordonR_Cape]

It's just that I don't see the costs that could have been cut by doing so.
The CNN feature you have linked seems to be very superficial. I can't see them trying to stall the aircraft or introducing a AOA fault. So where should MCAS come into action. It's a scenic flight in the simulator and the statement that there was no MCAS intervention is ambiguous to me.

However there is still negligence and the bad suprises are many.
Maybe someone has more detailed knowledge one the capabilities of the 8 MAX simulators (one of which seems to be located in Ethopia, which is at least suprising to me).

Since Ethiopian Airlines has only 4 (or 5) MAX aircraft delivered, and a total of 26 other B737 models in service, it would be rather surprising if they have one of the very few MAX simulators available worldwide. We do not know for sure (it may have been filmed elsewhere), and the CNN story is hardly proof either way. I don't think even Boeing have (or had) the ability to trigger an AOA fault, so this version seems rather irrelevant.

[infrequentflyer789]

It's just that I don't see the costs that could have been cut by doing so.
The CNN feature you have linked seems to be very superficial. I can't see them trying to stall the aircraft or introducing a AOA fault. So where should MCAS come into action. It's a scenic flight in the simulator and the statement that there was no MCAS intervention is ambiguous to me.

Way back in the LionAir threads it was revealed that Max simulator data packs are delivered as binaries with a fixed set of malfunctions, this is another change from NG, and almost certainly is cost-cutting. Result?:

operators no longer have any ability to pick and choose nor introduce malfunctions into their training programs
See post 813 on Lion thread: https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-41.html#post10305278

If you cannot simulate an AOA failing high (and not all AOA failures will trigger MCAS) then you could only trigger MCAS by flying into a part of the envelope where it is designed to activate in which case the result would be that, in terms of stick feel at least, MCAS counters the additional nacelle lift and it flies like an NG would. That isn't really any help...

It may well be that the only way to accurately simulate MCAS is in the engineering sims at Boeing (or arrange a test flight in an actual Max - plenty spare at the moment - and knock a vane off before you go...).

[Bend alot]

Since Ethiopian Airlines has only 4 (or 5) MAX aircraft delivered, and a total of 26 other B737 models in service, it would be rather surprising if they have one of the very few MAX simulators available worldwide. We do not know for sure (it may have been filmed elsewhere), and the CNN story is hardly proof either way. I don't think even Boeing have (or had) the ability to trigger an AOA fault, so this version seems rather irrelevant.
Having worked in Africa for a number of years, I do not find it at all surprising that Ethiopian Airlines would have a MAX 8 simulator.

It is very possible that is standard practice in the company. An Aircraft division and a training division each with different managers. Both managers hold a cheque book and both get wined and dinned, I hardly see the training manager saying "Nah I do not need to go to the USA - it's the same as the NG"

Not having a trigger for a (or both) AoA fault/s in a simulator would be a very big surprise as they input a few systems.

L39 Guy - what would you class Botswana's safety record as?

Airline commercial obviously.

[BDAttitude]

Way back in the LionAir threads it was revealed that Max simulator data packs are delivered as binaries with a fixed set of malfunctions, this is another change from NG, and almost certainly is cost-cutting. Result?:

operators no longer have any ability to pick and choose nor introduce malfunctions into their training programs
See post 813 on Lion thread: ...
If you cannot simulate an AOA failing high (and not all AOA failures will trigger MCAS) then you could only trigger MCAS by flying into a part of the envelope where it is designed to activate in which case the result would be that, in terms of stick feel at least, MCAS counters the additional nacelle lift and it flies like an NG would. That isn't really any help...

It may well be that the only way to accurately simulate MCAS is in the engineering sims at Boeing (or arrange a test flight in an actual Max - plenty spare at the moment - and knock a vane off before you go...).
Thank you very much for clarification and the link.
This is indeed another concerning development - and should have been vigorously fought by the Training Device Manufacturers and their customers!

So I would consider this not so much as a cost saving meassure but yet another a**h*** company culture thing trying to gain dominance over TDMs by revoking access to something one considers as Boeings intellecutal property.

[LegioX]

10 million views more than 5000 posts...and still discussing the same stuff

[GordonR_Cape]

10 million views more than 5000 posts...and still discussing the same stuff

Even if it does seem repetitive, this discussion is not going to go away. More than 300 people are dead, and Boeing still won't accept responsibility...

[L39 Guy]

L39 Guy - what would you class Botswana's safety record as?

Airline commercial obviously.

Funny guy. First, there appears to be no jet aircraft in Botswana's airline industry (https://en.wikipedia.org/wiki/List_of_airlines_of_Botswana) so that was a bad choice to make jet comparisons.

Secondly, the relative accident rate is equally as important as the absolute - accidents per million flying hours, accidents per aircraft in fleet, etc. So, go and do some homework on that and provide us with the results.

[L39 Guy]

Even if it does seem repetitive, this discussion is not going to go away. More than 300 people are dead, and Boeing still won't accept responsibility...

So Gordon, what would make you happy? A massive mea culpa from Boeing saying something like "It's all our fault. We screwed up. We gamed the system. We were naughty."

As many pilots like myself (and I note that you are not one) and engineers have pointed out on this forum, there is no single cause of an accident, it is a chain of events. And, all of the links on that chain bear some responsibility too - the regulators overseeing the airlines and their training, the airlines and their training systems and the pilots charged with the responsibility of flying an aircraft, even with those bells and whistles going off.

And you're right, this is getting repetitive.

[Bend alot]

Funny guy. First, there appears to be no jet aircraft in Botswana's airline industry (https://en.wikipedia.org/wiki/List_of_airlines_of_Botswana) so that was a bad choice to make jet comparisons.

Secondly, the relative accident rate is equally as important as the absolute - accidents per million flying hours, accidents per aircraft in fleet, etc. So, go and do some homework on that and provide us with the results.

Thanks for your contribution to this forum.
Was not aware that jets was a requirement of being an airline - but they have had jet 4 burners and all and at the time I was there.
Do not need to do homework, I have experience it.

But thanks for standing on me, like I ironed your shirt incorrectly.

One in a million.

And thanks for your thanks, but with respect as your theory as posted is very good.

https://www.airliners.net/photo/Air-Botswana/British-Aerospace-BAe-146-100/1204892

[PPRuNe Towers]

Abrasive posturing and in fighting has become the dominant feature of the thread. We'll wait until there is substantive news.

Rob