Ethiopian airliner down in Africa

[Smythe]

A software patch to fix and inherently unstable aircraft. brilliant. Cant wait for it!

[SteinarN]

I found a picture of the A320. It seems like the elevator, as a percentage of the stabilizer, is quite a bit larger.


https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/1831x1335/a32xfamilyv1_0_c81328f252e60e8ab890e8e6e21171c7123e7865.png

Compared the the B737


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/1024x911/737ng_vs_max_planform_1024x911_73cfb9960ebe760ba6766f7df1903 282d8280935.png

[PJ2]

March 17, 2019 12:15 p.m. ET https://www.wsj.com/articles/ethiopian-airlines-black-boxes-showed-clear-similarities-with-lion-air-crash-11552839318?mod=hp_lead_pos4 (https://www.wsj.com/articles/ethiopian-airlines-black-boxes-showed-clear-similarities-with-lion-air-crash-11552839318?mod=hp_lead_pos4)*

Analysis of Black Boxes of Crashed Ethiopian Airlines Flight Showed ‘Clear Similarities’ With Crashed Lion Air Flight —Ethiopian Transport Minister

*Data from ET302 Black Boxes Has Been Validated by Ethiopian, U.S. Investigators—Minister
*Investigators Were Able to Recover All Relevant Data from ET302 Black Boxes—Minister
*Preliminary Report on Crash to Be Released Within 30 Days—Minister

[4runner]

Light aircraft pilot since the mid 70s... under what circumstances would a 737 variant require full UP trim or full DOWN trim? On the aircraft that I have flown, the trim spends all its time somewhere in the middle of the range. So again I ask, what purpose is there to having such extreme ranges of trim that it requires huge control forces to counter?
the speed envelope and cg envelope on a swept wing, transport category aircraft is much greater than a GA aircraft.

[OldnGrounded]

The Electra was shedding wings but was not grounded, even after the second one, and the entire industry pitched in to find the cause, fix the problem and get it out of the headlines. There are many reasons why that will not happen now . . .

Just a reminder: Ultimately, a third of the Electras ever built were either lost in crashes or written off as too damaged to repair. Perhaps it will be a good thing if "that" does not happen now.

[Sailvi767]

Read all that. Stab screw found pointed down. Are you suggesting pilots pushed it that way? Right. So furthermore they couldn't pull it back in time. Not a good system then right?

If MCAS ran the stab full down it occurred through a number of cycles and over a significant period of time. Where were the pilots?

[gearlever]

If MCAS ran the stab full down it occurred through a number of cycles and over a significant period of time. Where were the pilots?

Two crews went into that trap. Doesn't this make you think more critical about the design of MCAS?

[gearlever]

However, pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway (https://www.seattletimes.com/business/boeing-aerospace/faa-evaluates-a-potential-design-flaw-on-boeings-737-max-after-lion-air-crash/), because that is defined as continuous uncommanded movement of the tail.On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times.In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled. These differences certainly could have confused the Lion Air pilots as to what was going on.Since MCAS was supposed to activate only in extreme circumstances far outside the normal flight envelope, Boeing decided that 737 pilots needed no extra training on the system — and indeed that they didn’t even need to know about it. It was not mentioned in their flight manuals.

[groundbum]

I give full respect to the Ethiopian safety board investigating this crash.

but given that the two 737max crashes raise such massive questions about aircraft manufacturing,government and trans national oversight and trillion dollar industries as well national interests for the US aircraft msnufacturing industry vis a vis China snd Europe ,are tje Ethiopians a tiny bit out of their depth?

[DCDave]

On many of the accidents discussed here on PPRuNe, commentators are regularly criticised for "not waiting until the accident report is released".

I wonder why, in contrast, it seems accepted that Boeing can have a software fix done in weeks, way before any reports are produced, to get the aircraft back in the air.
Wonder no more --> $

[911slf]

Naive question from slf. I seem to recall that T tail aircraft had stick pushers that operated if you got very close to the stall, but that you normally would not get that close.

At what angle of attack does MCAS operate and how far from the normal post take off angle of attack is this?

[derjodel]

Two crews went into that trap. Doesn't this make you think more critical about the design of MCAS?

this forum is full of people who severely overestimate the capacity of human brain, also (or speciall) their own.

At the same time, most would fail a simple attention test https://m.youtube.com/watch?v=vJG698U2Mvo

not that it’s their fault. It’s due to the design of human brain. Yet we design machines pretending this is not the case. Just another human fault i suppose.

[abdunbar]

Just a reminder: Ultimately, a third of the Electras ever built were either lost in crashes or written off as too damaged to repair. Perhaps it will be a good thing if "that" does not happen now.
otoh, the Electra continued as the Navies P-3. For a very long time. One of the last Electra crashes I recall was attitude indicator failure.

[Royale]

Here is a thought.

Rumors will have it that Boeing has an MCAS software fix by the end of March, a mere five months after the Lion Air crash, and if this fix is indeed a real fix, and not just a small tweak of some parameters, doesn't this show that Boeing has the knowledge, skills and capacity to crate safe MCAS software.

So this leads me to ask, if this is really true, why the hell did they not do it correctly from the beginning. I am certain that if it comes out that this is an easy fix, and that Boeing did not prioritize it the first time around, that Boeing will be open to severe liability claims.

Clearly this shows that the priority was to get the MAX out fast, and grab as many costumers from the NEO as possible.

I really think that a fast fix shows that Boeing could have done it correctly from the beginning, but chose not to spend the required resources on it.

[Fonsini]

It seems as if the bottom line is that the safety margin of the legacy 737 was simply eroded to an unacceptable degree with the new engines and became “cigarette paper” thin with the MAX in the search for ever better fuel economy. Boeing recognized this during the development phase and tried to code their way out of it with MCAS thereby creating a solution which may well be more dangerous than the original risk.

Is that reasonable summary ?

I wonder what parameters have been changed with the new software patch, and I’m still curious about the purpose of the 5 second delay which could easily trick pilots into believing there was no problem with the system.

[abdunbar]

No, i dont believe most are saying that exactly . . But aren't you equally saying engineers no longer need to be engineers (that live and breathe aeronautic and human interfaces, and are proactive designers, whilst this sounds a somewhat reactive solution ).
Amazed spinning that trimwheel about like that ever passed muster at Boeing let alone nodded through by AW @ FAA - a dozen things could be predicted to go wrong day one of concept by a brainstorming group of experienced systems and aeronautic engineers.

assuming that trim wheel is just like in the 727 and the stab does not move without that big wheel spinning and that it is as loud as it ever was? It is a powerful visual and aural que of what is going on. If it is turning then it should be because speed and or configuration is changing and if I have commanded neither and that stab is moving, I want to know about it.

[Icarus2001]

A software patch to fix and inherently unstable aircraft. brilliant. Cant wait for it

The aircraft is not inherently unstable. Where on earth did you get that idea? MCAS is about reducing AoA at extremes due engine nacelle effects. The fact that a faulty AoA sensor can activate it is the issue. Then that SOME crews have been unable to process what is occurring and turn off the stab trim, or hold manual wheel, or use electric trim against MCAS input.

[Ian W]

Lion air's FDR show that the trim was moved to full of the available 7 notches (it's not clear how those translate to degrees). They would certainly still be alive if there as a limit. They kept it in air at ~ 3 notches. If max needs more to get out of stall, perhaps it does need a larger hstab/eleveator instead of a hacked together software?

Or perhaps the key really is the reset. Does mcas reset with each trim input and takes the current position as the new neutral? If AoA vane is sending wrong data it's easy to see how this would result in a runaway trim.

This image (https://leehamnews.com/wp-content/uploads/2018/11/737NG-vs-MAX-planform-1024x911.png) shows the difference between a 737-800 (yellow) and MAX (magenta). Notice the bigger nacelles and same hstab size.

I thought 0.6 was a hard limit... e.g, we move this much and then it's up to the pilot. If it was 0.6 every 5 seconds it's still bad, but at least easier to manage.

It would appear that MCAS has no memory of previous activations after each reset its world starts again it is totally context free. So when it wakes up it looks at the AoA and if it is above limits (and perhaps other conditions pertain ) it activates and puts in 0.6 nose down on whatever the trim currently is pilot blips the trim pickle switch and MCAS goes to sleep and 5 seconds later MCAS wakes up and repeats the exercise as it is context free it has no knowledge of the previous activation. That would appear to be the fault in the system that means an incorrect AoA will result in repeated nose down trim increments for which there is no need. A nose down trim sensor that would inhibit MCAS trimming more nose down than a parameter value that would be calculated based on nose down trim and speed would prevent the over application of nose down trim.

[VFR Only Please]

The aircraft is not inherently unstable. Where on earth did you get that idea?

Perhaps from the circumstance that the engines are now mounted so far forward that application of power within the normal envelope sends the aircraft into stall territory?

[CONSO]

Perhaps from the circumstance that the engines are now mounted so far forward that application of power within the normal envelope sends the aircraft into stall territory?

from many previous discussions in this thread - no it has to do with at high AOA, the engine cowling provides extra lift which drives the nose up- as compared to previous locations which may partly negate lift at high AOA

At least thats how this SLF understands ..

[Chesty Morgan]

Yes, it's to prevent reducing stick force at increasing alpha which is a certification failure. It's not for stall prevention.

[Rananim]

I counted 14 and missed the gorilla.But thats not important.Whats important is that
Mullenberg doesnt miss the elephant in the room the next time round.
Boeing screwed the pooch on 3 counts:
-------->clandestine installation of MCAS
-------->MCAS activation based on single sensor
-------->failure to provide MAX simulators in good time for an aircraft whose differences cannot be trained on an ipad

Mullenberg is an MA in aeronautics and by all accounts a well-rounded guy.He has a good engineering background.
Hopefully hes the type who knows exactly whats going on on that assembly line and involved in the "nuts and bolts"
from the ground up.
The MAX can be safe,they just have to come clean and fix it.....and then win the flying public back again.I wish them
luck because in general they build great airplanes.

[WHBM]

I give full respect to the Ethiopian safety board investigating this crash.

but given that the two 737max crashes raise such massive questions about aircraft manufacturing,government and trans national oversight and trillion dollar industries as well national interests for the US aircraft msnufacturing industry vis a vis China snd Europe ,are the Ethiopians a tiny bit out of their depth?
Boeing don't seem to have thought the Ethiopians were "out of their depth" when they sold them, in recent years, significant quantities of 767s, 777s, 787s, 737NG's, 737 Max's ...

[Peristatos]

Interesting Twitter thread
https://twitter.com/trevorsumner/status/1106934362531155974?s=21

[Banana Joe]

A preview of a possible future QRH excerpt:


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/999x1008/mcas_qrh_v5_f1fa8c8d2fdaedd632327ee73f690bf0afce0b18.jpg
Applying nose up trim with the trim switches on the control column should help ease loads before operating the stab trim cutout switches.

[deltafox44]

I really think that a fast fix shows that Boeing could have done it correctly from the beginning, but chose not to spend the required resources on it.
Good thought. But I'd rather think they just weren't aware of any risks with their first software. And this is because they didn't spend the required ressources on safety analysis.

[Icarus2001]

MCAS and autopilot together?

[CONSO]

8 years ago, An Airbus crashed due to a blocked' AOA sensor- which fooled both the pilots AND HALBUS .
So a few years later during gestation-certification of MAX, Boeing played word games re critical definitions in how failures affect safety of flight- which allowed a single point ' failure' to take control from pilot ( for the first time ever ? ) and then decdided to not notify anyone via some oversight or creative pencil whipping

https://news.aviation-safety.net/2010/09/17/report-blocked-aoa-sensors-caused-loss-of-control-during-a320-check-flight/


Report: blocked AOA sensors caused loss of control during A320 check flight

note this was with experienced pilots !!

[LDRA]

assuming that trim wheel is just like in the 727 and the stab does not move without that big wheel spinning and that it is as loud as it ever was? It is a powerful visual and aural que of what is going on. If it is turning then it should be because speed and or configuration is changing and if I have commanded neither and that stab is moving, I want to know about it.

Wonder if stick shaker noise will mask trim wheel clicking

[StrongEagle]

Isn't this rather similar to a Lufthansa A321 incident that occurred Nov 5th 2014, near Bilbao, (Spain), where the aircraft experienced a rate of descent of 4,000 FPM before the pilots got the aircraft back under control?

Incident recorded here: https://avherald.com/h?article=47d74074

And here: https://aviation-safety.net/wikibase/wiki.php?id=171411

[KRUSTY 34]

this forum is full of people who severely overestimate the capacity of human brain, also (or speciall) their own.

At the same time, most would fail a simple attention test https://m.youtube.com/watch?v=vJG698U2Mvo

not that it’s their fault. It’s due to the design of human brain. Yet we design machines pretending this is not the case. Just another human fault i suppose.


How ironic.

When the airline I was working at introduced CRM quite a few years ago now, this video featured in the syllabus.

Perhaps something all the critics of these poor crews should think about.

[Banana Joe]

Wonder if stick shaker noise will mask trim wheel clicking
Possible, especially if you get some EGPWS warnings.

[Chronus]

I give full respect to the Ethiopian safety board investigating this crash.

but given that the two 737max crashes raise such massive questions about aircraft manufacturing,government and trans national oversight and trillion dollar industries as well national interests for the US aircraft msnufacturing industry vis a vis China snd Europe ,are tje Ethiopians a tiny bit out of their depth?

That very same allegation was also made 45 years ago after the Turkish DC10 went down out in the forest of Ermenonville outside Paris, France. Could the Turks be trusted with such a technological marvel. Were they not out of their depths. That as we all now know was far from the truth, the real cause was a web of corruption, lies and deceit that shook the aviation industry to its core. Have a look how the Turks have fared since then. How about THY now could anyone say they are out of their depths.

[Rx7man]

First time poster here... I've read the first 20ish pages and last 5.. and I haven't seen it mentioned... I'm just an armchair observer, so I'd welcome some clarification on this

AoA vs pitch hasn't been mentioned, and while they're related, I'm quite certain they're not the same thing, and from reading the posts it sounds like the two terms are kinda used interchangeably..
AoA is the angle at which the air meets the wing, pitch is the angle at which the plane is flying relative to level.
boeing.com/commercial/aeromagazine/aero_12/whatisaoa.pdf

Depending on inputs, load, CoG,thrust, and configuration (Slats, flaps) you can keep the plane flying level but have various AoA's?

From this, it would seem that pulling back and nosing up (in and of itself) does little to change the AoA unless you're increasing the lift from the wings.


silverstrata I've really enjoyed your posts throughout this thread :)

MCAS.. to me, it sounds like it has far too much authority to do what it wants.. perhaps if it was limited to half (or quarter, or whatever) the authority it has currently it would still be functional but not provide so much input that the pilots have to be superman pulling on the stick to negate what it's doing... Now at the risk of assuming, does it have an indicator that shows when it's active and how much it's compensating? An intermittent input from MCAS is also bound to be confusing, but that's been said a few times.

What I know is at 1000ft AGL I wouldn't want any automation nosing me down unexpectedly. First, realize something is wrong, Pick up the book, find the page, read the troubleshooting procedure and then start doing something about it, no matter how much training I have.

All this is moot if the MCAS wasn't at fault here of course.

[CONSO]

I found a picture of the A320. It seems like the elevator, as a percentage of the stabilizer, is quite a bit larger.


https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/1831x1335/a32xfamilyv1_0_c81328f252e60e8ab890e8e6e21171c7123e7865.png

Compared the the B737


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/1024x911/737ng_vs_max_planform_1024x911_73cfb9960ebe760ba6766f7df1903 282d8280935.png

basic lever - the shorter the body length and the shorter the length from CG, the more ' force' is needed to tilt ( aoa ) or stop yaw ( if one engine out ). The longer the body- distance from CG, the less the force needed for normal AOA correction or yaw correction. Since the force needed is generally a function of size or AREA acted on by air pressure/lift - a longder body can allow a smaller area for control surfaces ( overly simplified ) then come the cost of designing a new smaller area or simply staying the same as current production, etc

And I think you ment the horizontal stabilizer- not the elevator ??

And if yoiu not the hight of the smallet airbus VERTical stabilizer it is longer than the longer airbus - for generally the same reasons

[KRUSTY 34]

How many will respond as a 'Pitch Trim Runaway?.

In all probability a 18000 hrs old grey beard would have extracted from his 'internal database' and responded accordingly.

I fit this profile, and forgive me Cody if I’m quoting you out of context, but I pray to God that my aircraft never attempts to kill me in such a confusing and violent manner.

Especially with precious little time and altitude to play with!

[SteinarN]

How ironic.

When the airline I was working at introduced CRM quite a few years ago now, this video featured in the syllabus.

Perhaps something all the critics of these poor crews should think about.





I saw the video. I stopped counting the passes after a couple seconds as it was way to difficult. So I looked at the other things going on, saw the gorilla immediately. But then I knew it was a trick video.

But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.

[CONSO]

In the Airbus, a faulty AOA or ADR causes the airplane to either:
1. Do nothing, or
2. Turn off Normal Law.


maybe
For example

https://news.aviation-safety.net/2010/09/17/report-blocked-aoa-sensors-caused-loss-of-control-during-a320-check-flight/

[dakarman]

Hi, another question from SLF and PPL, hope you dont mind.
I have followed this thread from the beginning and only seen this question asked once with no definitive replies.
How many other 'patches' are there on aircraft such as the MAX or that matter any aircraft from any manufacturer (particularly old designs dragged into the modern age to avoid complex certification) waiting in the background to cause future problems?
Does the situation with Boeing and the MAX possibly require a detailed review of all other aircraft system updates and work arounds to see if another similar issue is waiting in the background for exceptional circumstances?
One would like to think not but this thread indicates this is possible.
I propose this scenario (from insufficient technical knowledge to know the answer - but just as an example so please don't jump on me too hard). The Weight on Wheels sensor. Does it have multiple redundancy? Does it have one sensor each UC feeding one pilots computer and if so does it have a cross check system? What happens in the event of a sensor failure? I am only using this as an example as it springs to mind. No doubt hundreds of other possibilities exist.
If you lock all the toilet doors simultaneously, does the pilots coffee machine stop working?

Finally another small question, how strong is the drive motor on the auto trim on the MAX or similar? Could you stall it out by grabbing the spinning trim wheel or will it try and take your fingers off?

[SteinarN]

basic lever - the shorter the body length and the shorter the length from CG, the more ' force' is needed to tilt ( aoa ) or stop yaw ( if one engine out ). The longer the body- distance from CG, the less the force needed for normal AOA correction or yaw correction. Since the force needed is generally a function of size or AREA acted on by air pressure/lift - a longder body can allow a smaller area for control surfaces ( overly simplified ) then come the cost of designing a new smaller area or simply staying the same as current production, etc

And I think you ment the horizontal stabilizer- not the elevator ??

And if yoiu not the hight of the smallet airbus VERTical stabilizer it is longer than the longer airbus - for generally the same reasons

Yes, I am aware of the moment arm and how that affects the size requirement, especially for the rudder.

I had in mind the size of the elevator compared with the full horizontal stabilizer.

I tried to measure the relative size on the drawings, as far as they are accurate, which I ofc dont know for sure.
I get the A320 elevator is marginally larger than 1/3 of the full horizontal stabilizer including the elevator.
The B737 on the other hand seems to have an elevator only marginally smaller than 1/4 of the full horizontal stabilizer including the elevator.
This must be a significant difference.

It seems like the A320, if we make that aircraft the comparison, because of its larger percentage elevater/stabilizer ratio to a much larger extent can rely on only the elevator in maintaining pitch control in demanding areas of the flight envelope, whereas the B737 much quicker runs out of elevater authority, and therefore Boeing has no option other than to use the very slow acting stabilizer trim function when controlling pitch in the most demanding areas of the flight envelope. And couple this with the likely worse naturable stability of the aircraft due to the very forward placement of the engines. This might be a reason why they couldnt make use of a redesign of the EFS acting on the yoke/elevator which would have been in my mind a much more quickly acting system. But ofc, such a system would also need a good software, and not the cludge MCAS seems to have been.

[derjodel]

But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.

Try it on random people who havent seen it before. Just share it in the way they don't suspect something. You'll be surprised.

For the record, I failed it.

[CONSO]

...The B737 on the other hand seems to have an elevator only marginally smaller than 1/4 of the full horizontal stabilizer including the elevator.
This must be a significant difference.


That MAY- repeat MAY be due to basic design for FBW versus ' cable ' control backup design for 737 and prior.

I note that seattle times article today mentions that initial stab movement was supposedly limited to .6 degrees for flight envelope and even for extreme csse. Flight test apparently showed/proved it needed to be 2.5 degrees for extreme conditions- due to extra lift from engine cowlings at high AOA- but somehow the documentation approved never got that number changed And/OR even thenit was not considered critical, etc
NO matter how one slices it- the ' fix' was FUBAR - and forgot that AOA sensors can easily be bent orhit by birds etc

[bullfox]

Link to Seattle Times Article. Excellent journalism with much new information regarding the process that game us MCAS:

https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/

[Rated De]

Link to Seattle Times Article. Excellent journalism with much new information regarding the process that game us MCAS:

https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/

Like all 737s, the MAX actually has two of the sensors, one on each side of the fuselage near the cockpit. But the MCAS was designed to take a reading from only one of them.

A single point of failure

But several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing.A former FAA safety engineer who was directly involved in certifying the MAX said that halfway through the certification process, “we were asked by management to re-evaluate what would be delegated. Management thought we had retained too much at the FAA.”

Regulatory Capture.


A normailsation of deviance.
The incremental degradation of robust system design, implementation and testing continued unabated.

Delegated to Boeing

The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes.

Always in the ear of management is the cost reduction mantra.

Some posters suggest case studies. Humanity never learns,
As it was before it will be again, usually as sufficient time elapses for the human ego to proudly boast, "this time is different"

[SteinarN]

That MAY- repeat MAY be due to basic design for FBW versus ' cable ' control backup design for 737 and prior.

I note that seattle times article today mentions that initial stab movement was supposedly limited to .6 degrees for flight envelope and even for extreme csse. Flight test apparently showed/proved it needed to be 2.5 degrees for extreme conditions- due to extra lift from engine cowlings at high AOA- but somehow the documentation approved never got that number changed And/OR even thenit was not considered critical, etc
NO matter how one slices it- the ' fix' was FUBAR - and forgot that AOA sensors can easily be bent orhit by birds etc

That they found it was necessary with 2,5 degrees might indicate that the aircraft might be way off the required natural stability without the help of any system.

[NWSRG]

I'm not a pilot (well, only ex-PPL), but I am an engineer, working in safety-critical infrastructure. These two accidents are going to shake this industry. I know they have not yet been linked, but the gun is smoking.

Three massive issues stand out for me.

1. What has gone wrong at Boeing, that could allow a system to intervene, unknown to the flightdeck, but which had no redundancy on a vital input? Any systems analysis of this solution should have picked up this critical flaw...if it didn't, then the analysis (or analysors) was patently in error.
2. What has gone wrong at Boeing, that allowed a system to be designed, which used trim as a primary flight control? Correct me here if I'm wrong, but is trim not there to alleviate control forces once a flightpath has been established? Any system where trim is used in a primary manner is completely counterintuitive to flight crew. (maybe my understanding is wrong here, so happy to be corrected)
3. What has gone wrong at the FAA, that no-one caught this system? It seems they tried to devolve responsibility back to Boeing, but the FAA cannot do that...they are on the hook for this regulatory failure.

Corporate and regulatory culture is the problem here, and it stinks. I've always assumed Boeing were good guys, with a track record second to none. But something has gone wrong. And the FAA? I just find the whole thing staggering.

Pity the poor flightcrew...left with an airplane that had systems they didn't know about, without the necessary redundancy, and which was doing things they couldn't hope to assimilate at a crtical juncture in the flight.

The safest form of transport is facing a lot of questions just now.

[Chesty Morgan]

Finally another small question, how strong is the drive motor on the auto trim on the MAX or similar? Could you stall it out by grabbing the spinning trim wheel or will it try and take your fingers off?
Well, that actually forms part of the runaway stab trim checklist. If the cutout switches dont stop the trim then grab the wheel which is supposed to stop it.

Never tried it, don't want to.

[SteinarN]

I'm not a pilot (well, only ex-PPL), but I am an engineer, working in safety-critical infrastructure. These two accidents are going to shake this industry. I know the yhave not yet been linked, but the gun is smoking.

Three massive issues stand out for me.

1. What has gone wrong at Boeing, that could allow a system to intervene, unkown to the flightdeck, but which had no redundancy on a vital input? Any systems analysis of this solution should have picked up this critical flaw...if it didn't, then the analysis (or analysors) was patently in error.
2. What has gone wrong at Boeing, that allowed a system to be designed, which used trim as a primary flight control? Correct me here if I'm wrong, but is trim not there to alleviate control forces once a flightpath has been established? Any system where trim is used in a primary manner is completely counterintuitive to flight crew.
3. What has gone wrong at the FAA, that no-one caught this system? It seems they tried to devolve responsibility back to Boeing, but the FAA cannot do that...they are on the hook for this regulatory failure.

Corporate and regulatory culture is the problem here, and it stinks. I've always assumed Boeing were good guys, with a track record second to none. But something has gone wrong. And the FAA? I just find the whole thing staggering.

Pity the poor flightcrew...left with an airplane that had systems they didn't know about, without the necessary redundancy, and which was doing things they couldn't hope to assimilate at a crtical juncture in the flight.

The safest form of transport is facing a lot of questions just now.

One easy explanation to your question #1 is that Boeing discovered this only in flight testing (at least how serious it was) and there simply was no time to make it much better, nevermind redesigning parts of the aircraft, like the size of the elevator surfaces which probably would have cost one or two years additional delay.

[NWSRG]

One easy explanation to your question #1 is that Boeing discovered this only in flight testing (at least how serious it was) and there simply was no time to make it much better, nevermind redesigning parts of the aircraft, like the size of the elevator surfaces which probably would have cost one or two years additional delay.

But that doesn't explain why the system wasn't (a) briefed to the end users, and (b) built with the necessary redundancy...

[M2dude]

But that doesn't explain why the system wasn't (a) briefed to the end users, and (b) built with the necessary redundancy...
Totally agree. There's no problem with the necessity of an MCAS type system with the MAX, but the seemingly absense of sufficient input monitoring, let alone training and information regarding the system seems diabolically wrong and completely alien to any system philosophy I've ever encountered.

[SteinarN]

But that doesn't explain why the system wasn't (a) briefed to the end users, and (b) built with the necessary redundancy...

Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?

[NWSRG]

Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?

Yep, that's probably all true. But do you then go ahead and release a system into service that isn't actually fit for purpose? It just seems to me here that something is fundamantally wrong in the philosophy of the system design...it should never have gone into service with these shortcomings.

[M2dude]

Well, discovered (late) in flight testing might be part of the reason why it wasnt built with redundacy. Better reliable and redundant programming obviousIy take more time than simple basic programming, and even more so when one includes the increased testing necessary on a more complicated piece of software. Dont know, but maybe it is requiring quite a bit of programming just to get the other AoA vane into the loop?
Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.

[DaveReidUK]

Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.

Particularly when you consider that "AOA DISAGREE" warning functionality is fitted to many 737 Max aircraft.

[edmundronald]

Seattle Times indicates that the AoAsystem is designed for a 1/100 000 failure rate, which I expect means 1 per 1 e10**5 hours.
There are 350 of the Max flying as of now maybe 10 hours a day, ie 35 000 hours a day.
So one MCAS incident due to a bad sensor can be expected every few days. Exactly what we've been seeing so far.
Seatlle Roulette?

Even if the AoA design study had been made for 1 in 10 Million hours, as it should have been for certification, with the full fleet of 5000 of these flying cows, you would have 50 000 hours a day, and several incidents a year, a hull loss could be expected every few years..

Edmund

[NWSRG]

Yes...those figures seemed concerning.

[MemberBerry]

I saw the video. I stopped counting the passes after a couple seconds as it was way to difficult. So I looked at the other things going on, saw the gorilla immediately. But then I knew it was a trick video.

But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.

The funny thing is I knew there was a gorilla in the video, because I saw that video in the past, but I followed the instruction to watch very carefully the ball exchanges, and I did that to the best of my ability, so I missed the gorilla I knew was there.

I didn't even believe I missed it after the video replayed the sequence. I thought that replay may have been faked, and I had to manually replay the video to convince me that there indeed was one, and I actually missed it.

So it's perhaps not surprising that the Ethiopian crew, even if they knew about the MCAS gorilla and how it can be disabled, still missed it, if they were focused on following other procedures and checklists to the letter.

Humans are not good at multitasking, especially when dealing with stuff that is not ingrained as muscle memory.

And if it takes only two MCAS cycles to bring the stabilizer to full nose down trim, it means this aircraft is capable to configure itself to kill you in less than a minute when the AoA sensor fails. I wouldn't want to fly such a plane, even if procedures that can prevent that from happening exist.

The FAA certification process needs to be overhauled so that this can't happen again in the future. In my opinion the FAA and Boeing bear together 90% of the responsibility for killing those people.

I found especially disgusting the way Boeing kept implying the pilots were at fault after the Lion Air accident and that the aircraft is perfectly safe, and how after the second accident the FAA kept saying the aircraft was safe and doesn't need to be grounded, when everyone else all over the world started grounding them.

I mean, everyone can make mistakes, Boeing, the FAA, the pilots, the airlines. Not admitting to those mistakes when they become obvious disgusts me.

[SteinarN]

Don't really agree that Boeing can use that as an excuse, a simple 'Alpha Disagree' discreet would be sufficient monitoring to inhibit MCAS and in my mind there is zero excuse for such a dangerous state of affairs to be allowed to exist on any commercial aeroplane.

I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.

[sky9]

A/P autoland needs three a/p channels, why isn't the same criteria used for the AOA indicators? What they really need is 4 AOA vanes so they can dispatch with one unserviceable.

But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.

[ManaAdaSystem]

I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.

Instead they rushed it with two accidents as the result, and the stocks tumbled, customers are raging and top management will lose their bonuses.

[DType]

Discovered late in flight testing????
As a total outsider (apart from some jet engine design many moons ago), I would have thought that the design process would have gone something like:-
What a pity we cant fit these larger engines to the 737.
But we could if you moved them forward and up.
That's a crazy suggestion, it would totally destabilise the aeroplane.
Yes, I know that, but you can fly an unstable aeroplane if you have computer assist, the military do it all the time, and we already have plenty of computing power in the system.
True, that would work, and we can't see any other quick solution. We'll have to go that way.
Just speculation!!

[Mr Optimistic]

@edmund 3500 perhaps? Doesn't alter argument though.

[TryingToLearn]

Since I'm working on car functional safety, I'm sometimes around here just to learn from accidents in aviation.

This story here is, if true, really a deviation from good practice and established safety standards on all levels.
The only persons I don't blame are the pilots. If a possible safety hazard is evaluated, there is always the parameter of controlability by the driver / pilot... But this is not 0% or 100%, it's statistics (high, medium, low...). Put one pilot/driver 10 times in the same unexpected situation and he will miss the solution once...
So the residual hazard is always the product of an already safe system and a good estimate of the controlability and training. One cannot design a crappy system and then rely on or blame the human problem solving skill for everything that may happen. Especially of something is repeatedly doing something complete unexpected and useless without warning and gives the pilot a free bodybuilding exercise.
Since many pilots here claim this situation is quite controlable, I just ask myself: How many undocumented or disclosed events of this kind were there?

So despite the failures made in many, if not all aspects of functional safety:
-> Crappy design to avoid recertification (and therefore a flying museum on steroids instead of a state-of-the-art design in all aspects)
-> Basic aerodynamic design flaws
-> Impact analysis of all the changes done within the MAX development
-> Risk accessment for MCAS based on wrong values (0.6°)
-> Single sensor/single point fault
-> Sensor comparison sold for $$$ (wtf, imagine this in automotive: Yes for only 500$ extra a blocking rear axle on the highway would be detected by the gearbox and stopped...). Lawyers will love that one
-> Dependent failure analysis incomplete (reset, 5 seconds and there it goes again)
-> Configuration management (application boundaries, 0,6° vs. 2.5°)
-> Integration testing (was this error introduces in a test flight/sim and was the reaction controllable)? If, in automotive (ISO26262) one relies on the controlability of a situation, one has to prove it on a test track with every model / release.
-> Safety case consistency (these 2.5° never found their way back in the risk accessment / accessment)
-> Training (MCAS what?)
-> Documentation
-> Accessor independence
-> Financial and time pressure

But still there is one open point to me:
500 Airplanes shipped, maybe 250 days flying on average, 16h a day -> 2,000,000 hours in the air
And already (at least) 2 defective sensors? -> 1,000 FIT???
That's the point where a car manufacturer would consider a recall for a non-safety related part like seat heating. But such a critical part should have:
-> high coverage measure such as 1oo2 / 2oo3 selection or at least comparison and safe state (ne action/warning)
-> low coverage measures like short/open/stuck detection
-> redundancy within the sensor (two potentiometers or other rotary sensors which are compared, again resulting in a high coverage detection method and error signaling)
-> sufficient testing to do statistics that show <10 FIT, FMEDA...
-> FMEA, environmental tests, shaker... the whole program

In this case only one AoA vane was used and this one went into a critical fault without self-diagnosis. And furthermore something like 'frozen to stuck-at' can almost be excluded, or does the airplane see such high angles at startup and the sensors typically freeze just after acceleration?

Someone wrote that the sensors were a carry-over part from the old model. Are ground crews always running around with a bunch of them in their pockets because they fail all over the place or freeze every second rainy day?
Maybe someone can give me a hint on what I'm missing here. Why are we talking about a highly critical part in aviation and it shows 1000 undetected critical failures per billion hour? Even the squeeze protection of a car's power window lifter is far better!

The lives lost in these probably avoidable accidents are a shame and I feel with the relatives.
Since I consult OEM and TIER1/2 automotive companies on critical safety functions, I do my best to get as much lessons learned out of this and transfer this into automotive.
I already sent out the great seattle times article to a lot of people, helps me a lot in justifying the high effort and development costs of safety related functions. I will keep this article on my computer and any time someone is claiming cost or development time or asks for some one-eye blindness, I just need this one link, It really covers everything one should NOT do.

Thanks a lot for all the research which get's collected here, this is really the best and most up-to-date place. The effort is not wasted but read by people who may be able to do it better next time in this or even different industries.

[WHBM]

Particularly when you consider that "AOA DISAGREE" warning functionality is fitted to many 737 Max aircraft.
Apparently this is an additionally chargeable option. All three major US customers (Southwest, American, United) have bought it. Lion and Ethiopian did not. I wonder about others.

And I wonder how the Boeing sales team went about selling this add-on. Why did the US carriers spend the money and others not. Presumably the sales team offered it to everyone. What were their justifications, and why did the US carriers, no fools at tough negotiations, go for it but not others. And how did the FAA certification let it be optional rather than required. How often, for those that fitted it, did it operate ?

[deltafox44]

Isn't this rather similar to a Lufthansa A321 incident that occurred Nov 5th 2014, near Bilbao, (Spain), where the aircraft experienced a rate of descent of 4,000 FPM before the pilots got the aircraft back under control?

Incident recorded here: https://avherald.com/h?article=47d74074

And here: https://aviation-safety.net/wikibase/wiki.php?id=171411
Except that A321 has 3 AoA probes, 2 of which were faulty, and the stall protection could be countered by aft stick (on mini-stick required force may not exceed pilot strength, contrary to a control column)

[edmundronald]

How often, for those that fitted it, did it operate ?

I think the answer to that is in the telemetry databases, and will determine the way the way the compensations trials go, and also how many people from Boeing resign.
Unless the fleet telemetry data turns out to have gone the way of Mrs Clinton's emails, and a State of Washington judge looks the other way.

Edmund

[deltafox44]

737 get smart...

https://en.wikipedia.org/wiki/Get_Smart

The french title for "Get Smart" TV series is "Max la menace"... here it gives :

737 MAX the mennace

[WingNut60]

At some point it may be necessary to review also whether the Lion Air accident was given sufficient attention / emphasis; and if not, why not.

It seems to me that a lot of people, including Ppruners, may have been lulled into thinking that the Lion Air incident was, to a certain extent, really their own fault.
And maybe, to a certain extent, it was. But was the response to the incident, in hindsight, even half-way adequate?

An airline with dubious safety, training and procedural standards, prior history, lax management of fault correction immediately prior to final crash, questionable actions on part of the fatal flight crew.
We'll send out a bulletin, throw in a software patch when we get around to it; we just need to make it idiot proof.

Maybe just not affording the incident the degree of attention that it deserved.

[A. Muse]

From BBC News website and also on News At TenFlight data from the Ethiopian Airlines disaster a week ago suggest "clear similarities" with a crash off Indonesia last October, Ethiopia's transport minister has said.Both planes were Boeing 737 Max 8 aircraft.

Last Sunday the Ethiopian Airlines jet crashed after take-off from Addis Ababa, killing all 157 people on board.

Transport Minister Dagmawit Moges told journalists that a preliminary report would be released within 30 days."Clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which would be the subject of further study during the investigation," Ms Dagmawit told journalists on Sunday.In both cases flight tracking data showed the aircraft's altitude had fluctuated sharply, as the planes seemed to experience erratic climbs and descents.

[deltafox44]

8 years ago, An Airbus crashed due to a blocked' AOA sensor- which fooled both the pilots AND HALBUS .
So a few years later during gestation-certification of MAX, Boeing played word games re critical definitions in how failures affect safety of flight- which allowed a single point ' failure' to take control from pilot ( for the first time ever ? ) and then decdided to not notify anyone via some oversight or creative pencil whipping

https://news.aviation-safety.net/2010/09/17/report-blocked-aoa-sensors-caused-loss-of-control-during-a320-check-flight/


Report: blocked AOA sensors caused loss of control during A320 check flight

note this was with experienced pilots !!

In this Airbus crash 2 out of 3 AoA sensors were frozen. The stall was NOT caused by faulty flight computers but was the result of the pilots voluntarily trying to stall the aircraft to "check" the AoA protection (which could not save them since sensors were frozen). At 2000 ft this is kind of a roulette russe :eek:

[4runner]

A/P autoland needs three a/p channels, why isn't the same criteria used for the AOA indicators? What they really need is 4 AOA vanes so they can dispatch with one unserviceable.

But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.
there are only 2 channels on a 73

[deltafox44]

Apparently this is an additionally chargeable option. All three major US customers (Southwest, American, United) have bought it. Lion and Ethiopian did not. I wonder about others.
Take-offs were included in the price, not landings :confused:

[b1lanc]

Apparently this is an additionally chargeable option. All three major US customers (Southwest, American, United) have bought it. Lion and Ethiopian did not. I wonder about others.

And I wonder how the Boeing sales team went about selling this add-on. Why did the US carriers spend the money and others not. Presumably the sales team offered it to everyone. What were their justifications, and why did the US carriers, no fools at tough negotiations, go for it but not others. And how did the FAA certification let it be optional rather than required. How often, for those that fitted it, did it operate ?

Southwest is retrofitting with AoA indicators as well. Believe American had them from the get-go. As I understand, the option is about $60K. Seems like noise level in terms of overall cost per airframe. Can't understand why that would even be an option and not included in the basic frame given the need for MCAS and total cost per airframe.

There was a report on Reuters awhile back after Lion indicating that WestJet, SilkAir, and flydubai also had AoA Diagree installed so at least some of the international carriers.

[FoxHunter]

https://www.zerohedge.com/news/2019-03-17/best-analysis-what-really-happened-boeing-737-max-pilot-software-engineer

[GroundedDinosaur]

If the MCAS isn't that important.... It can't be, because their was no mention of it in the extensive flight training that pilots received on it, according to
Boeing, it would just confuse them. So, why not just deactivate it, and have the planes fly merrily on their way? As all the 'other' 737's do. You don't think there might actually be a reason Boeing hasn't suggested this, do you?

[Retired DC9 driver]

Interesting point in the Seattle Times article, I assume this refers to the Lion Air crash, AOA sensors

The black box data provided in the preliminary investigation report shows that readings from the two sensors differed by some 20 degrees not only throughout the flight but also while the airplane taxied on the ground before takeoff.

[Chesty Morgan]

https://www.bloomberg.com/news/articles/2019-03-17/boeing-faa-oversight-of-737-max-was-flawed-seattle-times-says

[CONSO]

'That they found it was necessary with 2,5 degrees might indicate that the aircraft might be way off the required natural stability without the help of any system.https://www.pprune.org/images/statusicon/user_online.gif https://www.pprune.org/images/buttons/report.gif (https://www.pprune.org/report.php?p=10421853)

nope- it is sufficiently stable without MCAS - which is why they only needed it for the extreme unlikely case which allowed them to use the non flight critical certification. The biggedst screw up was NOT limiting its use and allowing a single sensor to control over the normal pilot disconnect. for 737 and similar

read the seattle times article today

[PaxBritannica]

Apparently this is an additionally chargeable option. All three major US customers (Southwest, American, United) have bought it. Lion and Ethiopian did not. I wonder about others.

And I wonder how the Boeing sales team went about selling this add-on. Why did the US carriers spend the money and others not. Presumably the sales team offered it to everyone. What were their justifications, and why did the US carriers, no fools at tough negotiations, go for it but not others. And how did the FAA certification let it be optional rather than required. How often, for those that fitted it, did it operate ?

I wonder too about the sales process. It does seem a little odd that carriers in the domestic market opted for an extra element there was no obvious reason to buy (if they didn't know there was a software feature for which it was a single point of failure), while third-world airlines did not. Was it just cost-saving, or did Boeing push a little harder / offer discounts where failures were less likely to be written off as down to poor maintenance / airmanship?

[FCeng84]

Thoughts on Seattle Times article published Sunday morning Seattle time

This article is generally well written and seems quite accurate. One point of clarification is that early on in the 737MAX development it was thought that MCAS would only be needed at particularly high Mach numbers. For those conditions the prediction was that the original 0.6 degrees of MCAS stabilizer authority would be sufficient. That proved to be pretty close to the case during flight testing and the final MCAS increment size for cruise and higher Mach numbers is very close to 0.6 deg. Later on it was determined that MCAS would also be needed at lower Mach numbers. With that extension of MCAS came the MCAS authority vs. Mach number schedule that is in the current design. The high Mach end of that schedule is approximately 0.6 degrees. Only with Mach Number less than 0.4 is the MCAS authority 2.5 degrees. The larger authority at lower Mach numbers is needed as the effectiveness of the horizontal stabilizer is less at lower speed. It is quite common that flight control functions are given higher authority at lower airspeed and less authority at airspeed increases.

A second point that did not come through particularly clearly in the Seattle Times article is that the pending MCAS software update has been in the works at Boeing since shortly after the Lion Air accident. As the data for the Ethiopian accident is not yet available (or maybe just came available) nothing that Boeing would be getting out the 737MAX fleet over the next couple of weeks could possibly be based on the most recent event. I'm sure that the team at Boeing will be evaluating the ET accident data as soon as they are able to see (1) if MCAS played any role in this accident, and (2) if MCAS did play a role, how would MCAS have behaved differently had the proposed updates been in place.

[FGD135]

But, I must say, if anyone trying his best to count the passes couldnt see the gorilla, then I think the expectatations on what a cockpit crew are able to do in a high stress situation with a lot of stuff going on in the cockpit has to be signifcantly decreased.
Scary indeed.
Rubbish analogy.

To make this video exercise more like the flight situation, change it to one where the viewer must count the number of passes, but then introduce an impediment that momentarily, but repeatedly, blocks his vision. Give the viewer a means to permanently remove the impediment.

Does the viewer realise that his view is being regularly blocked? Does he activate the removal option before time runs out?

[Sailvi767]

One interestingly thing from the Seattle article. The Lion air crew went through 21 MCAS cycles with the Captain retrimming each time. They did not disconnect the trim. The Captain handed the aircraft off to the FO who let the nose fall to far for recovery. The logbook entry from the prior flight should have mentioned the trim disconnect. I would presume Lion Air requires a log book review by each crew.

[M2dude]

I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?
The stock would tumble, customers would be raging, top management would lose its bonuses.

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.
Point well taken, but the complete lack of FAA oversight as well as such a rushed and incredibly flawed design are overwhelmingly bad here. Someone, one would expect, will take responsibility for the tragedies. (Having said that, these 'senior managers' are not renowmed for falling on their swords).
The fact is, the lack of alpha signal monitoring within MCAS is both alien to systems design and in my view is unforgivable

[futurama]

From The Washington Post:
March 17 ADDIS ABABA, Ethi*o*pia — *Ethiopia’s transport minister said Sunday that information from the flight data recorder on the Ethiopian Airlines jet that crashed last week shows “clear similarities” to the crash of the same type of plane in Indonesia in October.

Dagmawit Moges told journalists that the condition of the “black boxes” — the data and voice record — was good and that enough data had been recovered that her ministry’s Accident Investigation Bureau would release a preliminary report in 30 days on what happened to Flight 302.

“During the investigation of the FDR [flight data recorder], clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which will be the subject of further investigation,” Dagmawit said.

[FGD135]

The fact is, the lack of alpha signal monitoring within MCAS is both alien to systems design and in my view is unforgivableQuite commonplace, really, for critical airborne systems to use only one sensor, and only raw data at that. Examples:

Turkish Airlines flight 1951, 25 Feb, 2009. B737-800 where one radar altimeter was malfunctioning. The data from the sensor went to zero, the computers thought the plane was on the ground, so they reduced the engine power to idle. The result was a stall at low altitude where many occupants were killed. The idiotic thing was that not only were the computers using just one radar altimeter sensor, they were making no effort to inspect it for reasonableness or filter it against spikes. The data was showing valid heights but then instantly started showing zeros!

Qantas flight 72, 7 Oct, 2008. Airbus A330. Pilot's side air data computer had a momentary spike in the angle of attack data. Silly computers took this as indicating the aircraft was suddenly stalling, and at a speed of about 450 knots, pushed the nose down. Passengers were thrown into the ceiling and many were seriously injured. The idiotic thing was that the computers were using completely raw data and could therefore believe that the angle of attack could, in the space of one second, change from sensible values to a stalling angle. Also idiotic that the computers would happily perform a manouever of such violence.

[fdr]

In this Airbus crash 2 out of 3 AoA sensors were frozen. The stall was NOT caused by faulty flight computers but was the result of the pilots voluntarily trying to stall the aircraft to "check" the AoA protection (which could not save them since sensors were frozen). At 2000 ft this is kind of a roulette russe :eek:

not being pedantic, just that A320’s incorporate a conventional cane AOA sensor, not a static pressure comparator type system, the vane has no way to be blocked, it can jam...

[OldnGrounded]

Does the viewer realise that his view is being regularly blocked? Does he activate the removal option before time runs out?

Has anyone told him that there is a removal option?

[HarryMann]

I dont say it is an excuse, it certaintly is not an excuse.
But, imagine the pressure Boeing is under to get the Max certified and start delivering.
What would the reaction be if some low level engineers argued for work and modification 6 monts before planned first delivery that would delay certification and first delivery by 2 years, just to pick a number?

I can easily see such a reason for some (semi) top level managers trying to get away with a quick and dirty trick to avoid all the problems following a lengthy delay.

But an aircraft company of such standing even a small one, should have processes in place such that the situation you describe, doesn't arrive.

Just as aerodynamic problems are best 'engineered out' so such a situation should have been 'managed out' as it arose... we're building aircraft here not widgets and even management always had that aviation ethos back in the day...

I'm getting flavours of VW diesel fuel here,.. and a certain trans Atlantic cynicism.

[jimtx]

If the MCAS isn't that important.... It can't be, because their was no mention of it in the extensive flight training that pilots received on it, according to
Boeing, it would just confuse them. So, why not just deactivate it, and have the planes fly merrily on their way? As all the 'other' 737's do. You don't think there might actually be a reason Boeing hasn't suggested this, do you?

Why not turn it off? When it would be off during a real abnormal you continue on your merry way with manual trim and no auto pilot and are not told to avoid any flight regime that MCAS was put in to protect.

[CONSO]

I counted 14 and missed the gorilla.But thats not important.Whats important is that
Mullenberg doesnt miss the elephant in the room the next time round.
Boeing screwed the pooch on 3 counts:
-------->clandestine installation of MCAS
-------->MCAS activation based on single sensor
-------->failure to provide MAX simulators in good time for an aircraft whose differences cannot be trained on an ipad

Mullenberg is an MA in aeronautics and by all accounts a well-rounded guy.He has a good engineering background.
Hopefully hes the type who knows exactly whats going on on that assembly line and involved in the "nuts and bolts"
from the ground up.
The MAX can be safe,they just have to come clean and fix it.....and then win the flying public back again.I wish them
luck because in general they build great airplanes.

++++
Mullenberg is an MA in aeronautics and by all accounts a well-rounded guy.He has a good engineering background.
Hopefully hes the type who knows exactly whats going on on that assembly line and involved in the "nuts and bolts"
from the ground up.

I'm sure he will be first in line for
from WSJ

ByAndrew Tangel,Andy Pasztor andRobert WallMarch 17, 2019 8:20 p.m. ET The U.S. Department of Transportation is investigating the Federal Aviation Administration’s approval of Boeing (https://quotes.wsj.com/BA) Co.’s BA 1.52% (https://quotes.wsj.com/BA?mod=chiclets) 737 MAX jetliners, according to people familiar with the probe, an unusual inquiry into potential lapses in federal safety approvals for new aircraft.The inquiry focuses on a safety system that has been implicated in the Oct. 29 Lion Air crash that killed 189 people, according to a government official briefed on its status. Aviation authorities are looking into whether the anti-stall system (https://www.wsj.com/articles/boeing-to-make-key-change-in-max-cockpit-software-11552413489?mod=article_inline&mod=article_inline) may have played a role in last week’s Ethiopian Airlines crash, which killed all 157 people on board.On Sunday, Ethiopia’s transport minister, Dagmawit Moges, said there were “clear similarities” between the two crashes (https://www.wsj.com/articles/ethiopian-airlines-black-boxes-showed-clear-similarities-with-lion-air-crash-11552839318?mod=hp_lead_pos5&mod=article_inline). U.S. officials cautioned that it was too early to draw conclusions because data from the black boxes of the Ethiopian Airlines plane still need to be analyzed. . . .

[Loose rivets]

The Seattle Times article makes for very disturbing reading. Again, FCeng84's detailed clarifications have helped a lot.

In the article, one light-bulb moment for me was that the 'Resetting' of the MCAS was in fact a 're-datumizing', (my term) which allows one to understand the summed inputs reaching the end of the jackscrew.

EDIT, just noticed the quote by safelife back here.

https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-89.html#post10421506nd Ian W back here.


Talk about elephants in the room. I'd missed this entire page - see Ian W.



.
. (https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-89.html#post10421506)

[FGD135]

Has anyone told him that there is a removal option?He would have to know there is such an option. Every Boeing airliner since the 1960's has had that option, and it has been in every checklist.

Was he aware of the option, and was it regularly trained, would be the questions I would be asking.

[Airbubba]

Mullenberg is an MA in aeronautics and by all accounts a well-rounded guy.He has a good engineering background.

I think you are talking about Dennis Muilenburg (not Mullenberg) who is the CEO of Boeing.

[hans brinker]

Except that A321 has 3 AoA probes, 2 of which were faulty, and the stall protection could be countered by aft stick (on mini-stick required force may not exceed pilot strength, contrary to a control column)

Actually the stall protection could not be countered by the sidestick in normal law. The pilots switched off two of the three ADRs giving them alternate law without stall protection (just speed stability).
This was at that point not a published procedure and it is very likely that lesser pilots with no technical backup from the company would not have successfully completed the flight.
Having said that, a 3 out of 2 voting system is vastly superior to alternating between AOA 1 and 2 as Boeing has done with MCAS.

[b1lanc]

Thoughts on Seattle Times article published Sunday morning Seattle time

A second point that did not come through particularly clearly in the Seattle Times article is that the pending MCAS software update has been in the works at Boeing since shortly after the Lion Air accident. As the data for the Ethiopian accident is not yet available (or maybe just came available) nothing that Boeing would be getting out the 737MAX fleet over the next couple of weeks could possibly be based on the most recent event. I'm sure that the team at Boeing will be evaluating the ET accident data as soon as they are able to see (1) if MCAS played any role in this accident, and (2) if MCAS did play a role, how would MCAS have behaved differently had the proposed updates been in place.

The FAA has stated that " The grounding will remain in effect pending further investigation, including examination of information from the aircraft’s [ET] flight data recorders and cockpit voice recorders." There is no current timeframe or defined endpoint to that investigation. However, with Ethiopia now saying that there are strong similarities between both events, is that sufficient for Boeing to proceed?

The press coverage and viral responses are not comparable to any other sequence of accidents for any other type. References to the Electra, Comet, DC-10 do not apply - these events went viral reaching an amazingly broad audience world-wide and the politically charged actions will have an impact (has airspace ever been closed to any other type?).

[edmundronald]

I wonder too about the sales process. It does seem a little odd that carriers in the domestic market opted for an extra element there was no obvious reason to buy (if they didn't know there was a software feature for which it was a single point of failure), while third-world airlines did not. Was it just cost-saving, or did Boeing push a little harder / offer discounts where failures were less likely to be written off as down to poor maintenance / airmanship?

if all 737 Max have the second sensor, why should using it cost more, when the only purpose is _safety_ and avoiding a design fault ?
Come to think, why wasn’t MCAS documented properly in some foreign sales but documented in domestic ones?

i don’t get it.


Edmund

[flyingfalcon16]

Can I ask a question about MCAS?

It's my understanding applying nose down trim, will produce the effect of adding negative pitch attitude. So MCAS when activated is literally pushing the nose down. MCAS is sending nose down trim to bring the nose downward. Is this a completely correct statement from an engineering perspective? Is there any reason to think of MCAS another way? Does trim effect pitch attitude directly or is it providing column force so the pilot changes pitch? Would MCAS ever not be trying to bring the nose down? Is it inaccurate to say MCAS uses nose down trim commands to apply negative pitch attitude to the plane? In other words, does adding nose down trim add negative pitch attitude? Would MCAS ever be active adding trim in a scenario of high AoA and the plane has negative pitch attitude? Is MCAS literally part of the trim system?

[AerocatS2A]

Actually the stall protection could not be countered by the sidestick in normal law. The pilots switched off two of the three ADRs giving them alternate law without stall protection (just speed stability).
This was at that point not a published procedure and it is very likely that lesser pilots with no technical backup from the company would not have successfully completed the flight.
Having said that, a 3 out of 2 voting system is vastly superior to alternating between AOA 1 and 2 as Boeing has done with MCAS.


Not true. Read the report in the link. The captain was able to hold level flight using 50% aft stick. The ADIRS weren't turned off until over 20 minutes later after consulting with engineering via ACARS.

[Zeffy]

WSJ: FAA’s 737 MAX Approval Is Probed (https://www.wsj.com/articles/faas-737-max-approval-is-probed-11552868400) (full article at the link)

​​​​​​...The Department of Transportation inquiry, which hasn’t been previously reported, focuses on a Seattle-area FAA office that certifies the safety of brand new aircraft models and subsequent versions, as well as a separate office in the same region in charge of mandating training requirements and signing off on fleetwide training programs, people familiar with the matter said.

Files and documents covered by the directive also pertain to the FAA’s decision that extra flight-simulator training on the automated system wouldn’t be required for pilots transitioning from older models, according to people familiar with the matter.

Officials in those offices have been told not to delete any emails, reports or internal messages pertaining to those topics, people familiar with the matter said, adding that the probe also is scrutinizing communication between the FAA and Boeing.

The Department of Transportation inquiry is casting a wide net for documents about potential agency lapses just as House and Senate committees prepare for public hearings in the coming weeks that are expected to grill the FAA’s senior leadership on the same topics.

The DOT investigation is likely to raise more questions about how Boeing designed the airliner, how pilots are trained to fly it and the decisions the FAA took approving the model. The result could be changes to how the FAA certifies aircraft models, particularly giving more scrutiny to design changes from earlier models.

[Ian W]

Rubbish analogy.

To make this video exercise more like the flight situation, change it to one where the viewer must count the number of passes, but then introduce an impediment that momentarily, but repeatedly, blocks his vision. Give the viewer a means to permanently remove the impediment.

Does the viewer realise that his view is being regularly blocked? Does he activate the removal option before time runs out?

I understand what you are doing but the Gorilla experiment is specifically designed to overload the visual / spatial cognitive channel. The theory is that each of us only has cognitive channels that deal with various information inputs. These channels can get overloaded. This is why designers use haptics (feel/touch) like a stick shaker to break through otherwise full cognitive channels. A good example of a cognitive channel is the visual verbal - try to recite a nursery rhyme while you read a paragraph and understand what someone is saying to you. You cannot do all three as your verbal cognitive channel is overloaded. It does appear from what people are saying here that there are some failures that are a cognitive nightmare with visual verbal, aural verbal, graphical, alerts other pilot talking/shouting and the actual handling of the aircraft. This is a common failing the same was said about the AF447 likely explosion of warnings and alerts.

Perhaps the memory items shouldn't be a reasoned chain but a list of immediate safe quick fixes. So for example with Unreliable Airspeed, first action disable stab trim - then go through the subsequent checks replacing stab trim as a last step if the checks indicate that it is safe.

[Capt Kremin]

An objective analysis of the the FR24 supplied ADSB data raises many questions.

The first MCAS event (and perhaps the only one), seems to have occurred just after the aircraft left the ground.
The data shows a spike in the V/S at the approximate time the aircraft would have been leaving the ground coincident with a drop in altitude, at the 05:38:47z datapoint.
Remember the aircraft has an IVSI where accelerometers amplify V/S readings at the beginning of a climb or descent.

This spike make have been caused by an instinctive "yug" on the control column following a sensed drop in altitude.
Reports state that ATC knew the aircraft was in trouble even just after this point due to its undulating flight path at low altitude.
The pilot reports of a "flight control problem" occurred one minute after takeoff, around the time that the aircraft was first beginning to pitch down from about 300' AAL.

So what has happened here?

The MCAS will not operate with flaps extended. Yet it appears it was operating when it should not have been.
In conversation with 737 pilots it was stated to me that the A/C can do Flaps 1 takeoffs. At a high altitude airport a low flap/low drag takeoff setting is preferable for an engine out condition.
We know the FO was VERY inexperienced. Perhaps still being trained or on his first line sector.

The question is; Was the flap raised instead of the gear after rotate, thus activating the MCAS?

It would explain much, but not everything.

The MCAS stops operating when the high AOA condition is corrected, is opposed by the electric trim (but only while the trim switches are operating), or if the STAB switches are turned off.

However it does not automatically return to a lower stab incidence. It must be trimmed back to a proper value commensurate with the speed and configuration of the aircraft. If the Stab switches have been turned off as per the procedure, then the STAB must be manually trimmed back to a proper position.

ETH302 accelerated continuously till it crashed; indicating perhaps that the crew weren't minding the shop as they attempted to deal with the trim issue. It went way past VMO.

IF the STAB had not been sufficiently trimmed back from the nose down position, the increasing speed would have given the same impression of a runaway stab even if the switches had been cutout; an increasing nose down trim change, even though the stab trim was inactive.

The increasing force with the increasing speed would have made it eventually impossible for them to counter, perhaps indicated by the recovery at the 05:40:18 datapoint but no recovery at the final dive.

I stress I don't know what happened; however this makes some sense. Happy to be corrected. Kremin
https://cimg0.ibsrv.net/gimg/pprune.org-vbulletin/1200x954/d1vm9ahwoae_l1__624dbd40664835e70fd077e0d6d9b020e8ab3734.jpg
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/1200x992/d1sxk_kwoaaqeii_337aef52ba3117c841dce82bf4bfe39514209fa7.png

[Cropduster]

I think Boeing is probably facing a potentially bigger issue than the failure of the MCAS system. The bigger issue is that it is becoming increasingly apparent that the FAA failed to provide adequate oversight of delegated certification functions. What Boeing really needs to fear (apart from the punitive damages from the lawsuits) is that the airplane will have to undergo a complete re-certification. And even if senior FAA officials are satisfied, I am not sure that other world authorities, especially the European JAA are going to take the FAA's word on it this time.

[HalfMoonRising]

MCAS and autopilot together?
Is your question suggesting MCAS and autopilot might somehow be improperly connected via software logic, contrary to original assumption that MCAS CANNOT trigger unless autopilot is OFF? After reading the ASRS reports of MAX pilots switching autopilot ON during flaps up climb followed by almost immediate nose downs (fortunately stopped by going manual), I have been wondering if one possible explanation could be that through an untested bug in autopilot logic, MCAS code (which was supposedly an entirely independent subsystem) was inadvertently executed within the a/p system. Just a thought, but thus far I haven't seen a good hypothesis for the rather suspicious behavior.

[FGD135]

The first MCAS event (and perhaps the only one), seems to have occurred just after the aircraft left the ground.For the Lion Air accident flight, the captain's stick shaker activated whilst the aircraft was still on the runway and continued for almost the entirety of the flight. If this was the case here too, then the apparent pitching down and early reports of "flight control problem" may have been the pilot responding to the stick shaker.

The question is; Was the flap raised instead of the gear after rotate, thus activating the MCAS?If I was a betting man, I would bet my house that this wasn't the case - purely because the odds against having both these events at the same time would be astronomical.

[CONSO]

I think Boeing is probably facing a potentially bigger issue than the failure of the MCAS system. The bigger issue is that it is becoming increasingly apparent that the FAA failed to provide adequate oversight of delegated certification functions. What Boeing really needs to fear (apart from the punitive damages from the lawsuits) is that the airplane will have to undergo a complete re-certification. And even if senior FAA officials are satisfied, I am not sure that other world authorities, especially the European JAA are going to take the FAA's word on it this time.

from wsj tonight

A grand jury in Washington, D.C., issued a broad subpoena dated March 11 to at least one person involved in the 737 MAX’s development, seeking related documents, including correspondence, emails and other messages, one of these people said. The subpoena, with a prosecutor from the Justice Department’s criminal division listed as a contact, sought documents to be handed over later this month.

[Capt Kremin]

The Lion Air aircraft had a known AOA vane issue. There has been no indication ETH302 did. If it did and we haven't been made aware of it, then you are probably correct. If not....

[Airbubba]

Boeing statement on Sunday March 17, 2019:

Boeing CEO Muilenburg Issues Statement on Ethiopian Airlines Flight 302 Accident InvestigationCHICAGO, March 17, 2019 /PRNewswire (http://www.prnewswire.com/)/ --

Boeing Chairman, President and CEO Dennis Muilenburg issued the following statement regarding the report from Ethiopian Transport Minister Dagmawit Moges today.

First and foremost, our deepest sympathies are with the families and loved ones of those onboard Ethiopian Airlines Flight 302.

Boeing continues to support the investigation, and is working with the authorities to evaluate new information as it becomes available. Safety is our highest priority as we design, build and support our airplanes. As part of our standard practice following any accident, we examine our aircraft design and operation, and when appropriate, institute product updates to further improve safety. While investigators continue to work to establish definitive conclusions, Boeing is finalizing its development of a previously-announced software update and pilot training revision that will address the MCAS flight control law's behavior in response to erroneous sensor inputs. We also continue to provide technical assistance at the request of and under the direction of the National Transportation Safety Board, the U.S. Accredited Representative working with Ethiopian investigators.

In accordance with international protocol, all inquiries about the ongoing accident investigation must be directed to the investigating authorities.

SOURCE Boeing

[Rated De]

WSJ: FAA’s 737 MAX Approval Is Probed (https://www.wsj.com/articles/faas-737-max-approval-is-probed-11552868400) (full article at the link)

The Grand jury can start with Ali Bahrani and the B787 certification.

Regulatory capture complete with revolving doors between regulator and industry. Blurred lines of defined governance. Increasingly well established and proven techniques of separation watered down an increment at a time.

Cost reductions permeating every segment of the businesses.
MCAS certification, the requisite training and haste of system design all reek of cost and schedule control.

Cost reductions seen ex-post for what they are: Short term gain.
Long term is someone else's problem.

President and CEO Dennis Muilenburg weasel words won't cut it Boeing.
As the lights get turned on it will be interesting to watch which cockroach gets squished on the heel.

[hans brinker]

Not true. Read the report in the link. The captain was able to hold level flight using 50% aft stick. The ADIRS weren't turned off until over 20 minutes later after consulting with engineering via ACARS.

I did. I was not clear in my response. What I meant was:
You cannot override the stall protection in normal law. While they were able to hold altitude they weren't close to the stall. Before that at higher altitude and during the turns they made, the flight envelope protection pushed the nose down, and no amount of pull would have kept the nose up into a stall, so I had an issue with "the stall protection could be countered by aft stick".

[The Sultan]

O1 failure every 30 days pretty well matches up with the facts.

[Dark Knight]

Why if one has a significant problem such as may have been the case why allow the aircraft to accelerate to 382kts?

Wouldn't an experienced crew at least reduce thrust to maintain around 210-250kts and a safe altitude attempting to get things under control?

[Nomad2]

I don't think there will be a proper engineering fix for this.
What we are going to get is a patch, stuck on MCAS, which is itself a patch.

Boeing care about a few hundred deaths in countries other than America, only in as much as they affect its ability to make money.

The Max is a classic example of a design stretched far beyond the original concept, for reasons of expediency and profitability only.

A 'proper' fix would be to redesign the undercarriage and then relocate the engines, but of course that would require a complete re-design, and even though it's what they themselves would have preferred to have done from the start, it's too late now.

A software patch is what we are likely to get.

[N600JJ]

If MCAS ran the stab full down it occurred through a number of cycles and over a significant period of time. Where were the pilots?
Fighting with an aircraft just several hundreds / thousands feet above the ground at full speed and doing everything it can to return to the ground asap maybe?

[CYTN]

Wise old owl once said to me . " The cheapest way to do engineering is to do it right in the first place "

[WingNut60]

Why if one has a significant problem such as may have been the case why allow the aircraft to accelerate to 382kts?

Wouldn't an experienced crew at least reduce thrust to maintain around 210-250kts and a safe altitude attempting to get things under control?

Maybe, just maybe, they tried and encountered an adverse or bewildering reaction.
FDR should explain all that, I hope.

[inducedrag]

I don't think there will be a proper engineering fix for this.
What we are going to get is a patch, stuck on MCAS, which is itself a patch.

Boeing care about a few hundred deaths in countries other than America, only in as much as they affect its ability to make money.

The Max is a classic example of a design stretched far beyond the original concept, for reasons of expediency and profitability only.

A 'proper' fix would be to redesign the undercarriage and then relocate the engines, but of course that would require a complete re-design, and even though it's what they themselves would have preferred to have done from the start, it's too late now.

A software patch is what we are likely to get.
If any of the max had crashed in USA or Europe FAA would have been the first to ground the MAX then all new redesigned one have come :ugh:

[RickNRoll]

Wise old owl once said to me . " The cheapest way to do engineering is to do it right in the first place "

By saving millions it cost us billions.

[DaveReidUK]

An objective analysis of the the FR24 supplied ADSB data raises many questions.

Interesting graphic.

The altitude spike where the aircraft dips below the runway surface(!) accompanied by a single, instantaneous 2000+ fpm ROC value is clearly an artifact (unless Newton got it all wrong), probably coinciding with rotation.

There is a similar, spurious altitude spike towards the RH edge of the plot, which you have wisely ignored - that one is easier to account for because a distance-vs-time plot shows the aircraft flying backwards at that point (i.e. it's a timestamp anomaly rather than bad ADS-B data).

[El Bunto]

Wise old owl once said to me . " The cheapest way to do engineering is to do it right in the first place "

With the 737 Max orderbook clocking-in at well over $600 billion I don't think a few million spent for a patch-up fix will matter much.

[Rated De]

I don't think there will be a proper engineering fix for this.
What we are going to get is a patch, stuck on MCAS, which is itself a patch.

Boeing care about a few hundred deaths in countries other than America, only in as much as they affect its ability to make money.

The Max is a classic example of a design stretched far beyond the original concept, for reasons of expediency and profitability only.

A 'proper' fix would be to redesign the undercarriage and then relocate the engines, but of course that would require a complete re-design, and even though it's what they themselves would have preferred to have done from the start, it's too late now.

A software patch is what we are likely to get.

It was posited early in this thread that there was quite possibly a single point of failure.
That the MCAS relied on a single AOA is that single point. Now potentially a causal factor in two fatal accidents does not bode well for a soft solution.

The world has watched the silence of Boeing, the duplicitous silence of the FAA can readily be construed as regulatory capture.
Anything less than a full and frank commitment to resolve the root problem, not with legal inspired weasel words but action may not see all countries regulatory authorities so quick to play circus elephants and follow a clearly compromised FAA.

[grusome]

Croppy, in what was either an inspired piece of programming or else pure coincidence, a couple of days ago in Melbourne AUS the program Air Crash Investigation dealing with the crash of a Brazilian Fokker 100 was shown. To remind you, this happened when, shortly after take-off, the right reverser buckets began cycling, and finally deployed permanently. The crews lack of understanding of what was happening resulted in the aircraft diving into the ground. The initial cause was, as I recall, the failure of a ground-sensing micro. The back up safety system installed by Fokker automatically retarded the thrust lever, but the FO over-rode that using brute force, thus creating a situation of full forward thrust on the left, and full reverse on the right. The point of raising this incident is to highlight the fact that Fokker decided not to either inform, nor train crews in the system, apparently on the grounds that the probability of failure was extremely low. NTSB became involved and severely criticised the manufacturer's authority in this area, and also the FAA failure to mandate training. It wasn't clear to me whether the FAA even knew about this particular system. I don't think NTSB is currently involved with the MAX investigations, but nevertheless are aware of historic and similar failures of the regulatory authority. It should be clear to people that self-regulation will always lead to cost cutting and ultimately accidents. Spoiler - I am a retired regulator.

[KRUSTY 34]

I'm not a pilot (well, only ex-PPL), but I am an engineer, working in safety-critical infrastructure. These two accidents are going to shake this industry. I know they have not yet been linked, but the gun is smoking.

Three massive issues stand out for me.

1. What has gone wrong at Boeing, that could allow a system to intervene, unknown to the flightdeck, but which had no redundancy on a vital input? Any systems analysis of this solution should have picked up this critical flaw...if it didn't, then the analysis (or analysors) was patently in error.
2. What has gone wrong at Boeing, that allowed a system to be designed, which used trim as a primary flight control? Correct me here if I'm wrong, but is trim not there to alleviate control forces once a flightpath has been established? Any system where trim is used in a primary manner is completely counterintuitive to flight crew. (maybe my understanding is wrong here, so happy to be corrected)
3. What has gone wrong at the FAA, that no-one caught this system? It seems they tried to devolve responsibility back to Boeing, but the FAA cannot do that...they are on the hook for this regulatory failure.

Corporate and regulatory culture is the problem here, and it stinks. I've always assumed Boeing were good guys, with a track record second to none. But something has gone wrong. And the FAA? I just find the whole thing staggering.

Pity the poor flightcrew...left with an airplane that had systems they didn't know about, without the necessary redundancy, and which was doing things they couldn't hope to assimilate at a crtical juncture in the flight.

The safest form of transport is facing a lot of questions just now.

Pretty well sums it up as far as I’m concerned.

With regard to some of the apologists:

Excuses? Everybody’s got one!

[Stevedd32]

As a career engineer, AOA vanes scare the living daylights out of me! Small, delicate gadgets, easily damaged by ground staff, dependent on small bearings to work. They should NEVER be relied on in isolation and I reckon the risk of two being similarly dysfunctional at the same time cannot be discounted. If two are relied on for safety they should be constantly monitored and checked in software for correct orientation whenever possible.

[BRE]

The Seattle Times article says FAA has briefed lawmakers that the software fix will:
- use input from both AoA vanes
- limit travel
- limit retriggering

Sorry if this has been covered before: how do the MAX of SWA and AA differ? Do they just have an AoA display or do they actually have an extra vane, and their MCAS is already configured to use that extra input?

[ChicoG]

I see Boeing have quietly rolled out a new B777 as well.

Did they fast track/fiddle that certification as well?

https://edition.cnn.com/travel/article/boeing-777x-what-you-need-to-know/index.html

[ChicoG]

SEATTLE/WASHINGTON - Employees of the U.S. Federal Aviation Administration warned as early as seven years ago that Boeing Co. had too much sway over safety approvals of new aircraft, prompting an investigation by Department of Transportation auditors who confirmed the agency hadn’t done enough to “hold Boeing accountable.”

The 2012 investigation also found that discord over Boeing’s treatment had created a “negative work environment” among FAA employees who approve new and modified aircraft designs, with many of them saying they’d faced retaliation for speaking up. Their concerns predated the 737 Max development.

https://www.japantimes.co.jp/news/2019/03/18/world/faa-workers-sounded-alarm-boeing-performing-safety-checks-early-2012/#.XI9lbSgzaUk

[Capn Bloggs]

Why is the aircraft at "fullspeed" hundreds of feet off the ground?.
I think some posters do not realise how much power these types have at low level. Even if the pilots reduced to 75% N1 (737 Unreliable Airspeed thrust setting? Mine's 80% N1) once the gear is up, that thing is going to accelerate like a rocket. After 5 minutes at low level and in basically level flight, 380 is very likely, especially if the system is "helpfully" trimming forward as you progress!

[Saint-Ex]

The Boeing quote (from today`s Times) "The FAA concluded that the MCAS on the 737Max met all certification and regulatory requirements" and reliance on information from a single AOA vane are both extremely concerning.

[bsieker]

I see Boeing have quietly rolled out a new B777 as well.

Did they fast track/fiddle that certification as well?

https://edition.cnn.com/travel/article/boeing-777x-what-you-need-to-know/index.html

It isn't yet certified. It hasn't even flown. Just "rolled out".

Bernd

[Cows getting bigger]

One of the problems with a safety system is that when you find an omission/error/oversight/process concern you (should) start to wonder what else has gone wrong or been missed. if I were the FAA, I would be taking a big sample of other sign-offs and having a really good look at them. This MCAS affair has cast doubt on the integrity of a Organisation's Management System; that's going to take a lot to address and far more than a software tweak.

[HarryMann]

Why if one has a significant problem such as may have been the case why allow the aircraft to accelerate to 382kts?

Wouldn't an experienced crew at least reduce thrust to maintain around 210-250kts and a safe altitude attempting to get things under control?

DK ... Speed isn't all about thrust alone. It is climbing that controls speed in the early stages of flight once flaps and xart are cleaned up.
if somethings trying to pitch you into the ground it isnt your first course of action.

[FCeng84]

The Seattle Times article says FAA has briefed lawmakers that the software fix will:
- use input from both AoA vanes
- limit travel
- limit retriggering

Sorry if this has been covered before: how do the MAX of SWA and AA differ? Do they just have an AoA display or do they actually have an extra vane, and their MCAS is already configured to use that extra input?

Difference is display only. 2 vanes and exactly the same MCAS functionality as all other 737MAXs.

[wiedehopf]

Interesting graphic.

The altitude spike where the aircraft dips below the runway surface(!) accompanied by a single, instantaneous 2000+ fpm ROC value is clearly an artifact (unless Newton got it all wrong), probably coinciding with rotation.

This altitude dip below 0 is connected to erroneous high AoA readings.
It can be found in the altitude graph of the FDR readout of the Lion Air accident flight.
Check page 14 of this document:
https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

[infrequentflyer789]

Thoughts on Seattle Times article published Sunday morning Seattle time

This article is generally well written and seems quite accurate.


Interesting as I think Boeing described it as "mis-characterisation"... I thought (having less other info to corroborate it, I suspect) it was plausible and made sense, your clarification makes a lot of sense too.

Question: If MCAS has (sort of) a speed-dependent "gain", what value does it use when airspeed/mach is unknown (or known-bad)? Does it, perhaps, use the higher value (more trim) to be "safe"?

The accident flights and the made-it-back Lion previous flight all reported unreliable airspeed as first problem. I don't think airspeed is voted on 737, although there are three pitot/statics one set is used for standby only so at the FCCs airspeed must be either known (two inputs agree) or unknown (disagree). Have I got that right?

[CodyBlade]

This altitude dip below 0 is connected to erroneous high AoA readings.
It can be found in the altitude graph of the FDR readout of the Lion Air accident flight.
Check page 14 of this document:
https://www.flightradar24.com/blog/wp-content/uploads/2018/10/2018-035-PK-LQP-Preliminary-Report.pdf

Must interpret the graphs with some common sense eh.

[Aloha_KSA]

Now those with long memories may recall another overstretched aircraft, the MD-11. That, too, got a "clever" bit of software to overcome design aspects. LSAS. Longitudinal Stability Augmentation System. Even the name sounds similar to MCAS. Did one of the onetime McDD engineers who stayed on after the Boeing takeover have anything to do with the more recent concept.

And again, those with long memories will recall that the MD-11 had a hull loss rate substantially out of kilter with norms, and was well known for ending up on its back and burned out alongside the runway on landing, exactly at the point where LSAS had been designed to kick in.

There were even discussions about it on PPRuNe at the time. One who seemed to understand its technicalities wrote "I seriously wonder if the FAA would be as accommodating now". Hmmm ...

https://www.pprune.org/tech-log/406681-md-11-lsas.html

The parallels to the MCAS and the design philosophy of attempting to make an airframe with errant handling characteristics manageable by using software are stunning. What is also stunning is the (1) lack of training on the MD-11 to handle related issues, and (2) the FAA's complicity in the problems.

In a nutshell *Boeing and the FAA have been here before and did not learn from their mistakes.*

As I read some of these MD-11 accident reports, and the author's comments in light of the recent Max incidents and accidents, my jaw literally dropped: The McDonnell Douglas MD-11 Accident History (http://www.airlinesafety.com/faq/faq9.htm)

[averow]

I think Boeing is probably facing a potentially bigger issue than the failure of the MCAS system. The bigger issue is that it is becoming increasingly apparent that the FAA failed to provide adequate oversight of delegated certification functions. What Boeing really needs to fear (apart from the punitive damages from the lawsuits) is that the airplane will have to undergo a complete re-certification. And even if senior FAA officials are satisfied, I am not sure that other world authorities, especially the European JAA are going to take the FAA's word on it this time.

It would be a nightmare for Boeing if this were mandated. And yet without MCAS it seems that the 737 Max would not pass muster, in terms of stick and handling behavior. The kludge of using a software loop to make up for inadequate aerodynamic behavior has bitten Boeing very hard and may have lead to these two tragedies. There may need to be a complete rethink (and rebuilding) of the 737 Max.

[wiedehopf]

Must interpret the graphs with some common sense eh.
Is this ridicule?
I can't quite tell, please elaborate!

Anyway i've enlarged the Lion Air 610 FDR graph a bit so maybe you can see it as well.
The dip in this image is about 100 to 150 ft, comparable to the dip on rotation we see in the ADS-B data from the Ethiopian flight.

It is only present for the left altitude readout, which was corrected by the faulty left AoA.
FDR graph magnificiation take from preliminary Lion Air 610 report:


https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/565x195/screenshot_from_2019_03_18_12_26_08_6186bcc045b34d214113a7fd 8c8343ef60336cc2.png

[sky9]

A/P autoland needs three a/p channels, why isn't the same criteria used for the AOA indicators? What they really need is 4 AOA vanes so they can dispatch with one unserviceable.

But then using software to correct an inherently unstable design at the extreme of its envelope shows how far the industry has gone away from safety first.

there are only 2 channels on a 73 The 757 and 767 both have 3 channels.

If there are only 2 channels on a 737 A/P how does it do a CAT3 A and B autoland or is this another delegation of certification by the FAA?

[Sailvi767]

DK ... Speed isn't all about thrust alone. It is climbing that controls speed in the early stages of flight once flaps and xart are cleaned up.
if somethings trying to pitch you into the ground it isnt your first course of action.

Climbing controls speed? Only if you leave the thrust at a high power setting! Yes they should have adjusted power to maintain a reasonable speed. It’s called piloting!

[.Scott]

With the 737 Max orderbook clocking-in at well over $600 billion I don't think a few million spent for a patch-up fix will matter much.
We don't know how long the MAXs will be grounded. Perhaps 3 months. Aside from lots of missed new orders, what will that cost Boeing?
But I agree, the reengineering and deployment of the fix will not be financial killers. The most financial damage will likely come from the time it takes to work through the process.

The problem with the fix for this is not in figuring out what to do. From the time the flight data becomes available to the time they have a specific design and plan shouldn't be more than a week.
And the implementation should only take a week as well. But then they need to demonstrate that the what they have done works, addresses the problem, and doesn't introduce other problems.
Those involve generating more test procedures, test plans, test execution and documentation, and reviews at many levels.

It appears that there is a close connection between what happened at Lion, so they have some head start. But that also implies a flaw in their reasoning: if they fully understood what happened with Lion, why didn't they ground the MAXs until the fix was deployed? Bad luck? There is only one palatable answer, they did not understand the gravity of the problem - which puts that original fix into serious doubt and scrutiny. If the fix prepared for the Lion was not based on a full understanding of the problem, then it is not going to pass the scrutiny that it must go through before it can be deployed - and especially deployed and deemed sufficient to to restore the MAXs airworthiness.

If the reviewers do their job, this is what will realistically happen: Those at Boeing, FAA and others will be reviewing this change. But before they even look at the change, they will want to look at the design, development, and testing histories for the systems that are involved. They will need to do that simply to make themselves expert enough to understand how this process broke down. Then they will look at the process that was use to design, develop and test this change - and if they do not find reason for increased confidence - the will send the entire process back to Boeing.

[Sailvi767]

The parallels to the MCAS and the design philosophy of attempting to make an airframe with errant handling characteristics manageable by using software are stunning. What is also stunning is the (1) lack of training on the MD-11 to handle related issues, and (2) the FAA's complicity in the problems.

In a nutshell *Boeing and the FAA have been here before and did not learn from their mistakes.*

As I read some of these MD-11 accident reports, and the author's comments in light of the recent Max incidents and accidents, my jaw literally dropped: The McDonnell Douglas MD-11 Accident History (http://www.airlinesafety.com/faq/faq9.htm)

You could add training pilots to fly the A330 in the various laws with the CG near the aft limit at high altitude.

[Aloha_KSA]

We don't know how long the MAXs will be grounded. Perhaps 3 months. Aside from lots of missed new orders, what will that cost Boeing?
But I agree, the reengineering and deployment of the fix will not be financial killers. The most financial damage will likely come from the time it takes to work through the process.


At least two other major contributing factors must be addressed as well. And they require that both the FAA and Boeing admit fault.
(1) Why was MCAS not described in sufficient detail in the FCOM/ AFM?
(2) Why was there no training mandated for malfunctions of this System? And not just the failures that potentially caused these crashes, but what about failure of the MCAS system entirely? In that case the aircraft would handle differently, would it not? Given the lack of redundancy in the AOA sensors and possibly elsewhere in the MCAS system, MCAS failure/ inhibition should be a training event, or at least included in the ground school syllabus.
So far Max pilots have been given about 4 hours of CBT and a firm hand shake as their differences training. That will obviously have to change.
Even when the aircraft is deemed “fixed”, (1) the manuals will have to be updated and approved, and (2) the crews and engineers will still have to all be properly trained. That will take some time, as that training cannot commence until the problem is officially identified.

[Discorde]

Speculative QRH excerpt v 2.0:


https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/999x1008/mcas_qrh_v6_7f30d072a625231fa6a2461566a6b054d9a68b9e.jpg

[GarageYears]

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.

I have seen the above description of MCAS function in multiple places, but cannot find the original source, so apologies for the lack of attribution, though I think it came from Boeing.

Can ANYONE confirm there is an ALTITUDE 'limit' on MCAS operation? It has been stated that MCAS is only operational when the flaps are retracted (confirmed by Lion Air data) and AP is NOT engaged (i.e. manual flight).

The statement above includes a 'threshold' that must be exceeded in terms of both altitude and speed. Anyone got anything to confirm this?

- GY

[FGD135]

Speculative QRH excerpt v 2.0:

Ahem.

Discorde, nice try, but it looks fishy. It looks "Flight Simulator-ish". Please stop posting that.

Aloha KSA, how about you read some earlier pages of this thread? All of your questions are fully explored there.

GarageYears, have a read back a few pages. You will find that the word "altitude" is probably a typo. "Attitude" was the intended word.

[Busbuoy]

I think that that statement means that the threshold value of AOA above which MCAS becomes active varies and that that AOA value is dependent upon altitude and airspeed.

[Judd]

It seems both aircraft were porpoising before going in. Is it possible the crews were trying to overcome excessive aerodynamic loads on the stabiliser which had gone towards the forward limit, after cutting electrical power to the stab trim motor and were now trying to wind manual trim during the unloading maneuver called roller coasting? See extract from a Boeing 737-200 PTM date 1982 and migrated from Tech Log
Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity
Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim
"In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column. This, combined with flap extension and reduced speed should permit easier manual trimming.

If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim.

[Luc Lion]

I haven't seen it posted, apologies if it is a duplicate:

From BEA | Bureau d'Enquêtes & d'Analyses (https://twitter.com/BEA_Aero), via Twitter
Accident survenu le 10/03 du #Boeing737Max (https://twitter.com/hashtag/Boeing737Max?src=hash) @BoeingAirplanes (https://twitter.com/BoeingAirplanes) @flyethiopian (https://twitter.com/flyethiopian) / Les données contenues dans le FDR ont été téléchargées avec succès par @BEA_Aero (https://twitter.com/BEA_Aero) et remises à l’équipe d’enquête éthiopienne / communication en leur nom / 7:43 AM - 17 Mar 2019
It states that the FDR data have been downloaded and transferred to the Ethopian investigation team.
The CVR data have been downloaded and transferred the day before, on March 16th.

And the Ethiopian Transport Minister, Dagmawit Moges, held a press conference on Sunday, stating
"Clear similarities were noted between Ethiopian Airlines Flight 302 and Indonesian Lion Air Flight 610, which would be the subject of further study during the investigation,"
Details here:
https://www.bbc.com/news/world-africa-47605265

I understand that some data revealed by the CVR (or by both the CVR and FDR) confirmed the similarities between the 2 flights.

A video of the press conference can be found here
https://www.facebook.com/Ministeroftransportethiopia/videos/356264264979092/
The language appears to be Amharic.

[Nightingale14]

I am not a pilot or aviation expert. My interest is because my late father was a research engineer at the Royal Aircraft Research Establishment in Farnborough, and we used to discuss air crashes and their causes. I continue to be interested. Sifting through the information to date, and the excellent journalism by the Seattle Times, this is my layman's take on the likely cause of Ethopian plane crash. Am I close?

Why the Boeing 737 Max 8 crashed in Ethiopia in March 2019

The Boeing 737 Max 8 has larger engines mounted further forward than on previous versions. This causes the possibility of a stall on take-off, as it can make the Angle of Attack (AOA) too steep. To compensate, Boeing introduced a "small" software fix (the MCAS) to automatically adjust this, pointing the plane nose down. It was considered so small a fix that it was not included in initial documentation for the updated jet or in information for pilot retraining.

Meanwhile the US FAA (Federal Aviation Administration), citing staff and budget shortages, had earlier delegated some aspects of safety assurance for the plane, back to Boeing, making it self regulating in some areas, including the MCAS fix. The FAA also seems to have been keen to help Boeing get the new plane certified and available for sale as it was facing stiff competition from the Airbus.

During testing it emerged that the AOA adjustment made by the MCAS software was insufficient and so this was increased by a factor of 4, however this was not updated in the safety documents (according to unnamed informants). In addition the MCAS software resets itself from scratch every time it is activated. All this means that if there is a faulty reading from one of the external AOAs, the MCAS will continuously reset the nose of the plane downwards, as if it was doing it for the first time each time.

In the safety documentation, an AOA sensor failure is classified as a serious hazard but not as catastrophic which would have caused a delay in certification. Some experts say that a single point of failure like this is catastrophic while others say an experienced pilot should be able to handle it.

This AOA sensor failure is what seems to have happened with the Lion air fatal crash of a Boeing 737 max 8 in Indonesia last October. At that time the pilots did not know about the MCAS fix. The existence of the MCAS came to light after this and its existence was then included in pilots retraining. The official report on the Lion Air disaster is not due out until later this year. Boeing has been working on a fix since then but says it was delayed by the public sector shut down in the US earlier this year and it is now due in May.

Initial indications are that a similar accident occurred with last week's fatal Boeing crash in Ethopia.

[ChicoG]

Boeing tumbled early Monday on heightened scrutiny by regulators and prosecutors over whether the approval process for the company’s 737 Max jetliner was flawed.

A person familiar with the matter on Sunday said that the U.S. Transportation Department’s Inspector General was examining the plane’s design certification before the second of two deadly crashes of the almost brand-new aircraft.

Separately, the Wall Street Journal reported that a grand jury in Washington, D.C., on March 11 issued a subpoena to at least one person involved in the development process of the Max. And a Seattle Times investigation found that U.S. regulators delegated much of the plane’s safety assessment to Boeing and that the company in turn delivered an analysis with crucial flaws.

737 Max Is Turning Into a Major Problem for Boeing | Time (http://time.com/5553446/737-max-boeing-problems/)

[Vessbot]

Climbing controls speed? Only if you leave the thrust at a high power setting! Yes they should have adjusted power to maintain a reasonable speed. It’s called piloting!

You're mistaken, "climbing" (or, put more precisely) elevator/AOA control always controls speed. Of course, under the likely MCAS scenario discussed, they did not have AOA control and the airspeed was running away from them.

And thrust always controls vertical flight path, so if they reduced thrust they would have only hit the ground sooner. In a desperate fight for altitude, "piloting" would dictate maximum thrust.

[Ian W]

You're mistaken, "climbing" (or, put more precisely) elevator/AOA control always controls speed. Of course, under the likely MCAS scenario discussed, they did not have AOA control and the airspeed was running away from them.

And thrust always controls vertical flight path, so if they reduced thrust they would have only hit the ground sooner. In a desperate fight for altitude, "piloting" would dictate maximum thrust.

But more speed when your stab trim is too nose down is your enemy. Reduction in speed would reduce the force to counter the nose down trim so 'piloting' would dictate reducing speed.

[Sailvi767]

You're mistaken, "climbing" (or, put more precisely) elevator/AOA control always controls speed. Of course, under the likely MCAS scenario discussed, they did not have AOA control and the airspeed was running away from them.

And thrust always controls vertical flight path, so if they reduced thrust they would have only hit the ground sooner. In a desperate fight for altitude, "piloting" would dictate maximum thrust.

Having taught out of control flight in high performance aircraft I can tell you we never taught that. It’s also not taught in current airline simulator training. It is not what Boeing puts out. The last thing you want with trim stuck or running nose down is excessive speed. You control that with thrust. Again it’s called piloting. Had they reduce thrust and kept the speed back below 250 they would not have hit the ground at all. Control forces would have been much lighter. You have to establish the aircraft in a regime where it is controllable. Max thrust is the worst thing you could do in a nose down trim situation.
​​​​​​.

[Chesty Morgan]

The 757 and 767 both have 3 channels.

If there are only 2 channels on a 737 A/P how does it do a CAT3 A and B autoland or is this another delegation of certification by the FAA?
Fail operation versus fail passive.

[Chesty Morgan]

But more speed when your stab trim is too nose down is your enemy. Reduction in speed would reduce the force to counter the nose down trim so 'piloting' would dictate reducing speed.
Yes but reducing thrust on the 737 creates a large nose down moment (pitch/power couple) so as Vessbott stated they would have just hit the ground sooner.

My experience of this is unusual attitude recovery during manual reversing air tests. Reducing thrust, if you're already using everything you have to keep the nose up, WILL result in a further nose down moment and no reduction in speed. They'd have been better off sticking the speed brakes up.

And in fact Boeing DO publish this in the QRH.

[Vessbot]

Having taught out of control flight in high performance aircraft I can tell you we never taught that. It’s also not taught in current airline simulator training. It is not what Boeing puts out. The last thing you want with trim stuck or running nose down is excessive speed. You control that with thrust. Again it’s called piloting. Had they reduce thrust and kept the speed back below 250 they would not have hit the ground at all. Control forces would have been much lighter. You have to establish the aircraft in a regime where it is controllable. Max thrust is the worst thing you could do in a nose down trim situation.
​​

In your proposed solution, had they reduced thrust what would have prevented them from diving into the ground at the high speed commanded by their low AOA?

[gearlever]

Fail operation versus fail passive.

I think here is a missunderstanding.
It's about channels not number of AP.

To my limited knowledge the 737 has no AP YAW CHANNEL, only roll and pitch.

Stand to be corrected.

[Chesty Morgan]

I think here is a missunderstanding.
It's about channels not number of AP.

To my limited knowledge the 737 has no AP YAW CHANNEL, only roll and pitch.

Stand to be corrected.
Yes you're quite right. My bad.

[FlyingStone]

Fail-operational autopilot is a customer option on the NG and MAX since 2003. Not many airlines have taken the option though...

[Vessbot]

Yes but reducing thrust on the 737 creates a large nose down moment (pitch/power couple) so as Vessbott stated they would have just hit the ground sooner.

You're right about the thrust pitch couple, but I'm not even talking about that yet, I'm only taking talking about the basic effect of excess thrust on flight path angle.

And to that end, I'm afraid spoilers won't help either, but they'll certainly be a lot less harmful than a thrust reduction with underslung engines.

Unless the pitching moment they add is nose up, which is an answer I don't know. But a nose up pitching moment is what we want, both for the instantaneous normal acceleration upward, and the energy-state perspective on reducing airspeed.
[/QUOTE]

[Realbabilu]

It seems both aircraft were porpoising before going in. Is it possible the crews were trying to overcome excessive aerodynamic loads on the stabiliser which had gone towards the forward limit, after cutting electrical power to the stab trim motor and were now trying to wind manual trim during the unloading maneuver called roller coasting? See extract from a Boeing 737-200 PTM date 1982 and migrated from Tech Log
Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity
Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim
"In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column. This, combined with flap extension and reduced speed should permit easier manual trimming.

If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim.

Will it worked in such time critical at 1000 ft with 360 knot airspeed with extreme full down trim?
maybe neutralized with up with column electrical trim first than kill the 2 switches like jt043. It’s already proven

[flyingchanges]

This should be boxed as a memory item, like runaway stab trim.

It is runaway stab trim...
Maybe not all at once, but if it is not doing what you want, then it is out of control.

[Chesty Morgan]

And to that end, I'm afraid spoilers won't help either, but they'll certainly be a lot less harmful than a thrust reduction with underslung engines.

Unless the pitching moment they add is nose up, which is an answer I don't know.
[/QUOTE]
They do cause a pitch up.

[ReturningVector]

It is runaway stab trim...
Maybe not all at once, but if it is not doing what you want, then it is out of control.
That is not what Boeing states in its condition for the memory items:

"Condition: Uncommanded stabilizer trim movement occurs continuously."

[warbirdfinder]

VESBOT states:
You're mistaken, "climbing" (or, put more precisely) elevator/AOA control always controls speed. Of course, under the likely MCAS scenario discussed, they did not have AOA control and the airspeed was running away from them.

And thrust always controls vertical flight path, so if they reduced thrust they would have only hit the ground sooner. In a desperate fight for altitude, "piloting" would dictate maximum thrust.

If the above is true, when you are ready for take off, try this:

Pump the elevators up and down until you has reached VR, then when you reach VR, shove the throttles to maximum to rotate.

[Sailvi767]

In your proposed solution, had they reduced thrust what would have prevented them from diving into the ground at the high speed commanded by their low AOA?

They were at high speed, reducing thrust would have had almost no effect on pitch. It’s done every single day on every airline flight. The stabilizer at high speeds is extremely powerful in control of pitch. Engine thrust is negligible. Pulling the power from takeoff power to cruise power for 250 would not even be noticed. In normal ops maybe 1 click of trim moving the stab .01.
I think you are getting confused with recovering from flight near stall with a nose up attitude and high AOA. In that specific situation slamming the power to max will cause the nose to pitch up further because the stabilator has far less control authority.

[Vessbot]

VESBOT states:
You're mistaken, "climbing" (or, put more precisely) elevator/AOA control always controls speed. Of course, under the likely MCAS scenario discussed, they did not have AOA control and the airspeed was running away from them.

And thrust always controls vertical flight path, so if they reduced thrust they would have only hit the ground sooner. In a desperate fight for altitude, "piloting" would dictate maximum thrust.

If the above is true, when you are ready for take off, try this:

Pump the elevators up and down until you has reached VR, then when you reach VR, shove the throttles to maximum to rotate.

You ever try taking off at idle thrust?

[Joejosh999]

Does anyone know ETs procedure for Airspeed Disagree? Experiencing that error due to AoA vane failure, would they have simply gone for ex 80% N1, and then Flaps Up to keep bits from coming off?

At which point they’re soon rocketing along, MCAS kicks in, and they can’t climb?

[Ian W]

Yes but reducing thrust on the 737 creates a large nose down moment (pitch/power couple) so as Vessbott stated they would have just hit the ground sooner.

My experience of this is unusual attitude recovery during manual reversing air tests. Reducing thrust, if you're already using everything you have to keep the nose up, WILL result in a further nose down moment and no reduction in speed. They'd have been better off sticking the speed brakes up.

And in fact Boeing DO publish this in the QRH.

In fact the forward and higher placement of the engines that required MCAS because of their aerodynamic lift at high AoA, has also significantly reduced the pitch/power couple as the engines are closer to the vertical midline. In any case the idea is not to get to the full thrust position in the first place. As stated up thread the aircraft might have been controllable in pitch at a reduced speed.

[cappt]

You ever try taking off at idle thrust?

I always wondered if people who give that hardline analogy have never flown an airplane? When I get asked "what controls airspeed?" My answers is always -It depends.

[Vessbot]

They were at high speed, reducing thrust would have had almost no effect on pitch. It’s done every single day on every airline flight. The stabilizer at high speeds is extremely powerful in control of pitch. Engine thrust is negligible.

Are you aware of the relationship between excess thrust and climb angle? How much do you suppose they had if they hit the ground?
​​​
Pulling the power from takeoff power to cruise power for 250 would not even be noticed. In normal ops maybe 1 click of trim moving the stab .01.

Yet they were so hard up for trim that they hit the ground. So I'm not swayed by an argument that X amount is so little that they should have given it up toward an unimportant goal. Any amount of trim they could use should have obviously gone toward pulling up (which would also have had the effect of slowing down)


I think you are getting confused with recovering from flight near stall with a nose up attitude and high AOA. In that specific situation slamming the power to max will cause the nose to pitch up further because the stabilator has far less control authority.

Again, I'm not talking about the thrust pitch couple. But it we include it, it would only worsen the consequences of your proposed action.

[Vessbot]

Slowing from 320 to 250 at reduced thrust and reduced climb angle is beneficial over slowing from 320 to 250 at full thrust and a steep climb angle,... Why? What is the benefit? When did altitude stop being our friend? Especially when struggling to maintain control and maintain altitude when close to the ground?

[FCeng84]

But more speed when your stab trim is too nose down is your enemy. Reduction in speed would reduce the force to counter the nose down trim so 'piloting' would dictate reducing speed.

I concur. It is also important to realize that at cruise speeds and higher the elevator actuators are not able to supply enough force to push the elevators to their travel limits. Elevator travel at these speeds is hinge moment limited - the faster you go the less you get when applying full hydraulic pressure to the elevator actuators. No amount of crew pulling on the column can get around this. If you are running out of pitch control authority at moderate to high speed, additional speed is not you friend.

[Chesty Morgan]

In fact the forward and higher placement of the engines that required MCAS because of their aerodynamic lift at high AoA, has also significantly reduced the pitch/power couple as the engines are closer to the vertical midline. In any case the idea is not to get to the full thrust position in the first place. As stated up thread the aircraft might have been controllable in pitch at a reduced speed.
All fair points. I'm sure it would have been more controllable at lower speed but the fact is they got fast with a large nose down trim input they couldn't counter. Reducing thrust at that point would only make things worse.

[Airbubba]

BEA press release confirming the earlier announcement of the successful recovery of the FDR and CVR data:


https://cimg4.ibsrv.net/gimg/pprune.org-vbulletin/1089x1418/bea_press_release_bb4af0aea45a433f10de17a0ee0e58dec9db8b57.j pg

[Sailvi767]

Slowing from 320 to 250 at reduced thrust and reduced climb angle is beneficial over slowing from 320 to 250 at full thrust and a steep climb angle,... Why? What is the benefit? When did altitude stop being our friend? Especially when struggling to maintain control and maintain altitude when close to the ground?

I just realized you’re not a pilot. If they had the ability to get the nose up and trade airspeed for altitude they certainly would have done so. In fact if they had that ability they would have simply climbed out at 250 and never got fast. Your all hung up on thrust causing pitch changes because you read news articles by reporters with zero knowledge. Thrust changes are a non issue at normal speeds! If you have a trim runaway you need to slow down to reduce the effectiveness of the stab and reduce control column loads. L/D max or probably about 215 knots would have been my target airspeed with trim issues.

[FCeng84]

I just realized you’re not a pilot. If they had the ability to get the nose up and trade airspeed for altitude they certainly would have done so. In fact if they had that ability they would have simply climbed out at 250 and never got fast. Your all hung up on thrust causing pitch changes because you read news articles by reporters with zero knowledge. Thrust changes are a non issue at normal speeds! If you have a trim runaway you need to slow down to reduce the effectiveness of the stab and reduce control column loads. L/D max or probably about 215 knots would have been my target airspeed with trim issues.

Don't forget that slowing to about 250 knots also allows the control system to use full elevator travel. At speeds above that "blowdown" or "blowback" (choose your desired label) occurs and the system is not able to push the elevator to its full travel limits.

[Sailvi767]

Where did the steep climb angle come from? That was their problem

What steep climb angle, they were level about 1000 feet AGL and left the power up so the aircraft accelerated rapidly. They had no climb angle.

[Sailvi767]

Don't forget that slowing to about 250 knots also allows the control system to use full elevator travel. At speeds above that "blowdown" or "blowback" (choose your desired label) occurs and the system is not able to push the elevator to its full travel limits.

Bingo, you are reducing the effectiveness of the miss trimmed stab and increasing elevator effectiveness.

[Seat4A]

Apologies if already posted

Sensor cited as potential factor in Boeing crashes draws scrutiny

March 17 at 7:47 PM

https://www.washingtonpost.com/business/economy/sensor-cited-as-potential-factor-in-boeing-crashes-draws-scrutiny/2019/03/17/5ecf0b0e-4682-11e9-aaf8-4512a6fe3439_story.html?utm_term=.b9df74af9cb0

[Running Ridges]

Sounds like they were stuck between a rock and a hard place

Reduce thrust - immediate reaction is a slight reduction in pitch due to thrust coupling but maybe they would slow down and recover enough elevator authority to begin a stable climb eventually
vs.
Maintain / increase thrust - maybe a slight pitch increase to start with but they will gain speed with limited elevator travel and no chance of overcoming the nose down moment from the stab

Option 1 probably works nicely at when you have altitude on your side...

[justatechie]

Question for all the pros: if MCAS is supposed to AVOID stalls by putting the nose down, does anyone know how many times it actually DID this on all airlines since it was introduced? Is there some sort of log of when it was activated, and is there any analyses of valid/invalid activation? Or, is this asking too much? Seems to me this would be extremely relevant history.

[Peristatos]

"Prosecutors, Transportation Department Scrutinize Development of Boeing’s 737 MAX"

https://www.wsj.com/articles/faas-737-max-approval-is-probed-11552868400?mod=hp_lead_pos1

[Sailvi767]

Sounds like they were stuck between a rock and a hard place

Reduce thrust - immediate reaction is a slight reduction in pitch due to thrust coupling but maybe they would slow down and recover enough elevator authority to begin a stable climb eventually
vs.
Maintain / increase thrust - maybe a slight pitch increase to start with but they will gain speed with limited elevator travel and no chance of overcoming the nose down moment from the stab

Option 1 probably works nicely at when you have altitude on your side...

They had a much easier choice, comply with the QRH for runaway trim, disconnect the trim system, manually trim and fly to destination as airline crews have been doing since the invention of electric trim.

[ferry pilot]

Automation has been taking over cockpits for decades. Flight engineers have all but disappeared and the second officers filling their seats are gone too, along with the high time, well seasoned first officers who were often more experienced than their captains due to mergers and takeovers. These days, it must feel pretty lonely up there on a bad night with a copilot new to the airplane and the game. Automation, now so essential but not always cooperative or fully understood, only adds to the percentage of recent accidents due to confusion over who or what had control of the airplane.The writing is clearly on the wall. According to at least one source, Boeing believes eighty five percent of all accidents are due to pilot error, and there are those who think the sooner the day comes when the AI does the all work and the pilot does all the cross checking, the better.

The flying public are unlikely to accept security guards and night watchmen minding the machinery however, so real pilots will be with us for the foreseeable future.. Despite the shift in perception, away from the status and prestige of airline pilots in previous generations, they need to be a lot smarter in ways we old stick and rudder guys would never have dreamed of. Know your airplane is as important now as it ever was, but training is apparently too expensive and the task is not made any easier when the builders don’t think the pilots are up to it. Until they can design airplanes with pilots completely out of the loop, they need to be completely within it. Right up until the last one out of the cockpit turns out the lights.

[gearlever]

They had a much easier choice, comply with the QRH for runaway trim, disconnect the trim system, manually trim and fly to destination as airline crews have been doing since the invention of electric trim.

Yes, we know...
The billion $ question is: Why went two crews into that deadly trap?

[OldnGrounded]

They had a much easier choice, comply with the QRH for runaway trim . . .

Except that MCAS activation doesn't present as runaway trim (not continuous and can be briefly interrupted by operation of column trim switches), so it wasn't recognized by at least two crews. Then there's the problem of trimming manually, perhaps from full nose-down, at high speed and low altitude, while trying to fly the airplane -- with any number of other distractions bombarding the senses and causing distraction and confusion.

This has been discussed exhaustively and compellingly in these threads, but some still insist that the problem is pilot error. I suppose it's OK for individual pilots to think that way, but, when engineers, manufacturers, regulatory authorities, etc. do, the result is all too likely to be catastrophic loss.

[M2dude]

Quite commonplace, really, for critical airborne systems to use only one sensor, and only raw data at that. Examples:

Turkish Airlines flight 1951, 25 Feb, 2009. B737-800 where one radar altimeter was malfunctioning. The data from the sensor went to zero, the computers thought the plane was on the ground, so they reduced the engine power to idle. The result was a stall at low altitude where many occupants were killed. The idiotic thing was that not only were the computers using just one radar altimeter sensor, they were making no effort to inspect it for reasonableness or filter it against spikes. The data was showing valid heights but then instantly started showing zeros!

Qantas flight 72, 7 Oct, 2008. Airbus A330. Pilot's side air data computer had a momentary spike in the angle of attack data. Silly computers took this as indicating the aircraft was suddenly stalling, and at a speed of about 450 knots, pushed the nose down. Passengers were thrown into the ceiling and many were seriously injured. The idiotic thing was that the computers were using completely raw data and could therefore believe that the angle of attack could, in the space of one second, change from sensible values to a stalling angle. Also idiotic that the computers would happily perform a manouever of such violence.

Well I've only been an aviation professional for 52 years, so what do I know. :) Seriously though, the Turkish Airlines case illustrated poor failure monitoring within the RADALT (Not to MENTION complete crew unawareness and monitoring) of IAS. RAD ALT inputs to AFCS typically is used for gain gearing and throttle retard and usually have good self monitoring (But not in this case of course).
The QANTAS A330 case has yet to be completely and adequately explained ADIRU fault, the suspect was a data labelling issue. (GREAT airmanship by the QANTAS crew however). The ADIRU functions certainly are monitored and compared.
For ANY flight control system, ALPHA as well as Ps & Pt inputs are invariably monitored.. The absence of an Alpha disagree function of MCAS is at the very best negligent to the extreme, as has been the whole frantically rushed throwing together of this appalling system. Pilots and passengers deserve FAR better than this.

[flyingchanges]

How many times does it have to do the same thing before you consider it to be continuously doing something you do not want. My number would be 2.

[fgrieu]

The Seattle Times runs an article (https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/) with some bold claims, including that factual errors have crept in the certification process, and where raised to the attention of Boeing and FAA days before the ET302 crash. It is not paywalled where I stand.

[silverstrata]

It is runaway stab trim...
Maybe not all at once, but if it is not doing what you want, then it is out of control.

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

And the auro-trim systems are always mis-trimming the aircraft (the trim inputs by the speed-trim system are always wrong, and you always have to re-trim manually). So at what point does ‘operations normal’ become ‘operations abnormal’? At what point do you assume that the trimmer has gone awry..??

Silver

[abdunbar]

Interesting graphic.

The altitude spike where the aircraft dips below the runway surface(!) accompanied by a single, instantaneous 2000+ fpm ROC value is clearly an artifact (unless Newton got it all wrong), probably coinciding with rotation.

There is a similar, spurious altitude spike towards the RH edge of the plot, which you have wisely ignored - that one is easier to account for because a distance-vs-time plot shows the aircraft flying backwards at that point (i.e. it's a timestamp anomaly rather than bad ADS-B data).

In addition to often mentioned lack of fidelity in the ads-b info available on the internet. It is normal to see a VSI indication dip slightly at rotation. well, it used to be, not familiar with the most recent 15 years of aircraft development.

[dufc]

Any reason there is not a warning light on the 737 MAX to indicate MCAS has activated?

[Chesty Morgan]

How many times does it have to do the same thing before you consider it to be continuously doing something you do not want. My number would be 2.
Ever flown a 737?

[Organfreak]

Any reason there is not a warning light on the 737 MAX to indicate MCAS has activated?

I can think of one reason: It was meant to be a secret! :*

[gearlever]

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

And the auro-trim systems are always mis-trimming the aircraft (the trim inputs by the speed-trim system are always wrong, and you always have to re-trim manually). So at what point does ‘operations normal’ become ‘operations abnormal’? At what point do you assume that the trimmer has gone awry..??

Silver

Thx Silver for clearification:ok:

[Nomad2]

The single most powerful control surface on a transport jet is the THS.
Why Boeing would give control of it to a subsystem, like the MCAS is hard to understand.

No amount of hauling (or pushing) on the elevator is going to save you if the THS isn't where it should be.

[abdunbar]

Does anyone know? If you have a 737 Max , airborne, flaps up, really high speed, full nose down trim, electric stabilizer trimming motors shut off, how much back pressure does it take to raise the nose with the elevator? While applying this large force to the elevator, how much force is required to turn the stabilizer trim hand wheel? How many turns of the hand wheel per degree of stabilizer trim. In other words, is it possible to get into a position in which it is impossible to recover, not enough elevator authority due to force required and or inability to retrim the stabilizer manually due to it binding from a combination of speed and forces being applied through the elevator.

[Nomad2]

You have to put the THS back where it should be.
Until then, you remain in upset territory, or 'in the ****' as most pilots call it.

[Ian W]

Does anyone know? If you have a 737 Max , airborne, flaps up, really high speed, full nose down trim, electric stabilizer trimming motors shut off, how much back pressure does it take to raise the nose with the elevator? While applying this large force to the elevator, how much force is required to turn the stabilizer trim hand wheel? How many turns of the hand wheel per degree of stabilizer trim. In other words, is it possible to get into a position in which it is impossible to recover, not enough elevator authority due to force required and or inability to retrim the stabilizer manually due to it binding from a combination of speed and forces being applied through the elevator.

As FCEng says in post #1946 you cannot overcome the StabTrim with elevator at high speed.

[dozing4dollars]

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

And the auro-trim systems are always mis-trimming the aircraft (the trim inputs by the speed-trim system are always wrong, and you always have to re-trim manually). So at what point does ‘operations normal’ become ‘operations abnormal’? At what point do you assume that the trimmer has gone awry..??

Silver

I haven’t flown a 73 but on the 72 (if I recall correctly) during a runaway, the first instinctual response was to apose the runaway with opposite elevator. This ingaged the trim brake. The noise of the brake verses the runaway trim was a giveaway to use the cutout switches.

I don’t think this would happen as the MCAS does not activate the brake. All that sim training on runaway stab wouldn’t help because it’s not a runaway.

The stall horn and stick shaker would make pulling back and trimming nose up counter to all training that a pilot receives from initial stall recovery in a Cessna with a stall horn through to transport aircraft.

Two responses to two different stimulus. One Stall Recovery and one Unreliable Airspeed mask the third undocumented MCAS.

To learn anything from any accident you need to have empathy for those involved. Not just the pilots but the line mechanics, Boeing and FAA engineers. The true villains, senior management, board members and yes, even politicians will never be held accountable

The USA government shutdown that both political parties participated in was also a factor.

... and hence, the voters like you

[abdunbar]

I haven’t flown a 73 but on the 72 (if I recall correctly) during a runaway, the first instinctual response was to apose the runaway with opposite elevator. This ingaged the trim brake. The noise of the brake verses the runaway trim was a giveaway to use the cutout switches.

I don’t think this would happen as the MCAS does not activate the brake. All that sim training on runaway stab wouldn’t help because it’s not a runaway.

The stall horn and stick shaker would make pulling back and trimming nose up counter to all training that a pilot receives from initial stall recovery in a Cessna with a stall horn through to transport aircraft.

Two responses to two different stimulus. One Stall Recovery and one Unreliable Airspeed mask the third undocumented MCAS.

To learn anything from any accident you need to have empathy for those involved. Not just the pilots but the line mechanics, Boeing and FAA engineers. The true villains, senior management, board members and yes, even politicians will never be held accountable

The USA government shutdown that both political parties participated in was also a factor.

... and hence, the voters like you


I understand all that, and yes, I vaguely remember the trim brake. but the question is still this. Is there a conceiveable way to load the stabilizer to the point that it cannot manually be trimmed back to a point were elevators will work again?

[Azgalor]

I know it may look a bit stupid but I need to clarify that. I would like if someone who flies 737 could reply.
Why Boeing put MCAS to MAX? As I understood there was problem with pitch moment created by engines at some occasions. But is it possible to fly without it and it will be just difficult or it is impossible to handle the aircraft without MCAS? I though it is there just to be safer and easier for pilots but I have read many strange things about that. But I think that is just mess made up by media.

[megapete]

I understand all that, and yes, I vaguely remember the trim brake. but the question is still this. Is there a conceiveable way to load the stabilizer to the point that it cannot manually be trimmed back to a point were elevators will work again?
I also wonder if the forward position of the engines, which gives a pitch up moment at high angles of attack, and led to the addiction of MCAS, could possibly give a pitch down moment at low angles of attack?

[FCeng84]

Does anyone know? If you have a 737 Max , airborne, flaps up, really high speed, full nose down trim, electric stabilizer trimming motors shut off, how much back pressure does it take to raise the nose with the elevator? While applying this large force to the elevator, how much force is required to turn the stabilizer trim hand wheel? How many turns of the hand wheel per degree of stabilizer trim. In other words, is it possible to get into a position in which it is impossible to recover, not enough elevator authority due to force required and or inability to retrim the stabilizer manually due to it binding from a combination of speed and forces being applied through the elevator.

I cannot speak to the potential for binding of the horizontal stabilizer control (either via electric motor or via manual turn of mechanical trim wheel) but I can shed some light on the first question. Where the stabilizer needs to be for trim is a function of all of the contributors to pitching moments that must be balanced. CG is the biggest factor and will have the most influence on where the stabilizer sits for trim(i.e., no column push or pull required for steady flight). How "out of trim" the airplane is with the stabilizer moved all the way to its airplane nose down limit depends on where you start (i.e., what position represents "in trim"). If the CG is at its forward limit, trim will involve a fair amount of airplane nose up stabilizer so there will be a larger increment of stabilizer travel from there to the nose down limit. If the CG is at is aft limit, trim will place the stabilizer much closer to the airplane nose down limit so the increment from there to full nose down will be smaller.

Also with regard to your reference to "very high speed" specifics make a difference as Mach effects come into play along with dynamic pressure. At cruise speeds and faster elevator travel is limited by actuator force capability. The faster you go the less the elevator can be deflected and thus the more critical it is to have the horizontal stabilizer near its trim position.

[FullWings]

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

And the auro-trim systems are always mis-trimming the aircraft (the trim inputs by the speed-trim system are always wrong, and you always have to re-trim manually). So at what point does ‘operations normal’ become ‘operations abnormal’? At what point do you assume that the trimmer has gone awry..??

Silver
DING DING DING We have a winner!

That’s one of the biggest elephants (gorillas?) in the room. By the time you’ve thought “hmm, that’s not quite right” at low-level the situation has gone from nuisance to critical. The 737 trim is on the move all the time, be it from pilot inputs or STS/MCAS/Autopilot. Clickety-clack is the most heard noise on a 737 flight deck as the trim wheel spins it’s merry way backwards and forwards. Add an unreliable airspeed scenario to the above and no wonder things go from bad to worse. I really feel sorry for the crews who were dumped in this situation. :(

[derjodel]

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

Silver

Correctly functioning MCAS is not a runaway trim condition. If you really approach high AoA, MCAS kicks in, AoA drops and (assuming it was just some kind of upset and you have sufficient hight) you should be fine.

However, when an AoA is faulty, it will continously indicate high AoA to MCAS. MCAS kicks in, but still get high AoA input so it kicks again.. and again.. and again....

[canyonblue737]

I haven’t flown a 73 but on the 72 (if I recall correctly) during a runaway, the first instinctual response was to apose the runaway with opposite elevator. This ingaged the trim brake. The noise of the brake verses the runaway trim was a giveaway to use the cutout switches.

I don’t think this would happen as the MCAS does not activate the brake. All that sim training on runaway stab wouldn’t help because it’s not a runaway.

The stall horn and stick shaker would make pulling back and trimming nose up counter to all training that a pilot receives from initial stall recovery in a Cessna with a stall horn through to transport aircraft.

Two responses to two different stimulus. One Stall Recovery and one Unreliable Airspeed mask the third undocumented MCAS.

To learn anything from any accident you need to have empathy for those involved. Not just the pilots but the line mechanics, Boeing and FAA engineers. The true villains, senior management, board members and yes, even politicians will never be held accountable

The USA government shutdown that both political parties participated in was also a factor.

... and hence, the voters like you


Yes, clearly different than a runway and yes, the column cutout doesn't work with MCAS. Yes the trim wheel moving, even in manual flight, even when not trimming with the yoke switch is normal in a 737. That said you would think in 7-12 minutes of watching the nose get heavier and heavier and the trim moving downward on occasion on its own you would kill the trim with the stab cutout switches. I totally get the anger at Boeing but experienced 737 pilots should be able to figure this out, in particular with a bit of time, and after the Lion Air accident and the required reading of the MCAS system and its failure mode you would think any 737 MAX pilot would be able to figure this out very, very quickly let alone with time. Lots of blame to go around here in these accidents, starts with Boeing but as usual it ends in the point end of the jet.

[Azgalor]

I also wonder if the forward position of the engines, which gives a pitch up moment at high angles of attack, and led to the addiction of MCAS, could possibly give a pitch down moment at low angles of attack?
How the engines do that? What is supposed to be a problem? I expected that power and placement of engines creates this pitch up moment. Is it something aerodynamics related?

[megapete]

How the engines do that? What is supposed to be a problem? I expected that power and placement of engines creates this pitch up moment. Is it something aerodynamics related?
Yes its aerodynamic - my understanding ,from reading the whole thread, is that the engine nacelles being in front of the C of G exert aerodynamic forces - a positive angle of attack gives a pitch up moment - and subsequent reduction of stick back pressure approaching the stall - hence MCAS. I was just speculating if a low angle of attack would produce a nose down moment as the engines are presumably mounted to be zero A of A when the wing is at cruise A of A.

[dozing4dollars]

Question: does the 737Max have a Q limiter on the elevator deflection?

[FCeng84]

How the engines do that? What is supposed to be a problem? I expected that power and placement of engines creates this pitch up moment. Is it something aerodynamics related?

This is a very large thread, but if you want to know what is going on here you need to read from the beginning or at least skim through. Your question has been covered in numerous posts. You are welcome to search on my user name to see what I have contributed, but I suggest you read other's entries as well.

[FCeng84]

Question: does the 737Max have a Q limiter on the elevator deflection?

Need you to describe what you mean by "Q limiter".

[gearlever]

Dynamic pressure?

[FCeng84]

Dynamic pressure?

That's what I suspect, but I want to have dozing expand on the question a bit before answering.

[dozing4dollars]

Question: at what angle between stabilizer and elevator does the tail plane stall?

[Chronus]

I wondered why Boeing named their newest version of the successful 737 MAX. So I did a quick internet search and here is what came up:
https://www.airlinereporter.com/2011/09/boeing-introduces-the-737-max/

Here is an extract from the article:

"Yes, I understand the ideas behind Boeing choosing this name, but it doesn’t mean the name works. During the press conference announcing the re-engined 737, Nicole Piasecki explained why Boeing chose the MAX name. “We wanted the name to capture how exceptional the 737 is not only to in terms of its performance but we wanted it to be able to differentiate the 7, 8 and 9. We wanted to make sure the name was easily identifiable from 4-year olds up to 90-year olds and we wanted to make sure that it represented the best that it will truly be… We thought about how do you convey superiority, the best, the gold standard in single-aisle airplanes. And how do you come up with a name to describe already a great airplane. We wanted to make sure that it talked about what it was going bring to the industry in terms of maximum benefit, maximum competitive advantage for our customers, maximum value and absolute maximum in what an airplane could deliver to our customers. So we came up with something that fit that and we will be calling this airplane the 737 MAX.”

I do wonder whether after all the who ha is all over the air traveler will be asking whether it is a MAX they are about to board or even worse check before they buy the ticket.

[vlieger]

https://www.marxist.com/737-max-scandal-boeing-putting-profits-before-safety.htm

Short-sightedness and incompetenceA similar process of “soft corruption” and conflict of interest can be seen in the financial industry in various countries across the world, made worse by deregulation. The Airline Deregulation Act of 1978 started a process of removing government controls over the airlines and manufacturers in the USA. This was done to encourage competition and lower the ticket prices, but the end result has been the monopolisation of air travel to the point where four major carriers control 80 percent of US air traffic. Tickets did become cheaper but travelling by plane has generally become a miserable experience worldwide and the workforce – from pilots and cabin crew to dispatchers, baggage handlers and office workers – is more exploited, underpaid and demoralised than ever.
Combine this with the majority of establishment politicians sitting on the boards of private companies and you have a clear recipe for disaster. It is a cosy club where everybody looks after each other: regulators, manufacturers and politicians. Obviously, for any airline or manufacturer, any serious incident or accident is bad publicity and is to be avoided. The general level of safety in aviation since the 1980s has been relatively good, and numerically speaking, flying remains the safest method of transportation (https://www.businessinsider.com/flying-is-still-the-safest-way-to-travel-2013-7?r=US&IR=T). Under capitalism, however, with profit as the primary goal, there will be a never-ending battle of short-term expense versus long-term safety, where the latter finishes a long way behind.

This short-term thinking ties in with the increasing short-sightedness and sheer incompetence of the political elite worldwide. In the UK we have the Brexit circus, in the USA we have Trump. The Twitter president was quick last week to send yet another bizarre tweet saying that “airplanes are becoming far too complex to fly” and that he doesn’t want “Albert Einstein to be his pilot”. This comes from a man who doesn’t know how to close an umbrella upon entering the presidential 747 and who last year nominated his own pilot, John Dunkin — the man who flew Trump planes, not Air Force One — to head the FAA. As the Financial Times put it (https://www.ft.com/content/072ffe40-45dc-11e9-b168-96a37d002cd3?fbclid=IwAR2mgoHLixW2uOdduiiIAs1Vct8q1G-nU0gkpLjYXbPLQYXXpcucfPcFB70):

“When the Senate laughed him off as unqualified to lead an $18bn agency, Mr Trump failed to come up with a new name. The FAA has been flying without a pilot, so to speak, for more than a year. Little surprise America’s partners have lost trust in its direction.” (March 13, 2019)



Yet, like a broken clock that is right twice a day, Trump in this instance has a point, even if we can’t suspect him of having any real level of comprehension of the matter at hand.

[abdunbar]

Yes, clearly different than a runway and yes, the column cutout doesn't work with MCAS. Yes the trim wheel moving, even in manual flight, even when not trimming with the yoke switch is normal in a 737. That said you would think in 7-12 minutes of watching the nose get heavier and heavier and the trim moving downward on occasion on its own you would kill the trim with the stab cutout switches. I totally get the anger at Boeing but experienced 737 pilots should be able to figure this out, in particular with a bit of time, and after the Lion Air accident and the required reading of the MCAS system and its failure mode you would think any 737 MAX pilot would be able to figure this out very, very quickly let alone with time. Lots of blame to go around here in these accidents, starts with Boeing but as usual it ends in the point end of the jet.


Exactly!! There is a large range in pilot skill level and dedication. The most dedicated group I personally flew with was Japanese pilots at a small airline based out of Tokyo. They knew the aircraft systems backwards and forwards. They had their own study sessions and they also kept records of the expat Captains qwerks and briefed each other on those also. Was not unusual to pick up one of these young men who had a total flight time under 300 hours. And yes it showed but they matured rapidly and became very skilled pilots quickly.

but back to the question at hand.... Yes, there will be enough blame to go around and I really like Boeing and am sad that they let this happen to them. I have sympathy for people who work for unenlightened airline managements that let politics and favoritism trump safe operating decisions. There are people who are a danger to themselves and others and truly do not know it. I hope that on the positive side, this accident has drawn enough attention that ALL are watching and learning.

If the 737 MAX or any other aircraft can be flown out a corner of the envelope from which recovery is not possible we need to know about it and fix it.

BTW, my personal standard for releasing a pilot to line flying was simple. I imagined my family in the back and had him fly the entire let down and approach without the autopilot or auto throttle Very few had much problem with this. We trained for this, everyone was familiar with the power and attitude required for every common configuration.

[FCeng84]

Question: at what angle between stabilizer and elevator does the tail plane stall?

Depends on horizontal stabilizer position, AOA, and airspeed. With stabilizer in trimed position elevator retains effective control through its full range of roughly +/-30 degrees up to about 250 knots.

[abdunbar]

Question: at what angle between stabilizer and elevator does the tail plane stall?


well, as you stated before, that depends. the angle would be pretty small at Mach 1 . ;-)

[jagema]

How the engines do that? What is supposed to be a problem? I expected that power and placement of engines creates this pitch up moment. Is it something aerodynamics related?

Underwing-mounted engines, being under the center of gravity, create a pitch-up moment when adding thrust. Pitch-down when reducing thrust. Easy to picture: letter T. Push the lower end of the vertical line, pushing force being the thrust vector forward. The junction of the T (where vertical meets horizontal axis) being the CG - The whole thing swings clockwise (nose up).

[Chesty Morgan]

Underwing-mounted engines, being under the center of gravity, create a pitch-up moment when adding thrust. Pitch-down when reducing thrust. Easy to picture: letter T. Push the lower end of the vertical line, that'd be the thrust vector. The junction of the T (where vertical meets horizontal axis) being the CG, it'll swing the whole thing clockwise.
But that isn't what's happening with the MAX .

[FCeng84]

Underwing-mounted engines, being under the center of gravity, create a pitch-up moment when adding thrust. Pitch-down when reducing thrust. Easy to picture: letter T. Push the lower end of the vertical line, pushing force being the thrust vector forward. The junction of the T (where vertical meets horizontal axis) being the CG - The whole thing swings clockwise (nose up).

Need for MCAS is not related the thrust pitch coupling. Read previous thread entries to understand and catch up with the discussion.

[flyingchanges]

Ever flown a 737?

Yep, about 6,000 hours...

[dozing4dollars]

Need you to describe what you mean by "Q limiter".

In other aircraft the elevator has a dynamic limiter. The Q limiter. Q is the airodynamic force. This is a combination of airspeed and density altitude. The same as the force sensed by the pitot tube. The purpose of the Q limiter is to limit the maximum elevator angle. At lower Q the pilot has full authority over the elevator but as Q increases, the angle is limited.

In ithe scenario where an aircraft is low and fast the elevator deflection available is limited. It should be noted that elevator deflection is based on deflection from the trimmed position of the stabilizer.

[VFR Only Please]

TacomaSailor, I don't know the answers to your questions, and doubt anyone here Knows For Sure.

There is something in the US called the Aviation Safety Reporting System. It's run by NASA, precisely to keep it our of the FAA's hands. It's part confessional, part wailing wall for pilots. You can air your troubles, being as discreet about your personal identity as you wish.

Anyway, there have been a number of complaints about the MAX. (One pilot, after Jakarta: “I am left to wonder: what else don’t I know?”) And these include the autothrottles. Perhaps those far more knowledgeable than I will hoot at this, but it does add a dimension to the speculation mix.

[abdunbar]

https://www.marxist.com/737-max-scandal-boeing-putting-profits-before-safety.htm

Short-sightedness and incompetenceA similar process of “soft corruption” and conflict of interest can be seen in the financial industry in various countries across the world, made worse by deregulation. The Airline Deregulation Act of 1978 started a process of removing government controls over the airlines and manufacturers in the USA. This was done to encourage competition and lower the ticket prices, but the end result has been the monopolisation of air travel to the point where four major carriers control 80 percent of US air traffic. Tickets did become cheaper but travelling by plane has generally become a miserable experience worldwide and the workforce – from pilots and cabin crew to dispatchers, baggage handlers and office workers – is more exploited, underpaid and demoralised than ever.
Combine this with the majority of establishment politicians sitting on the boards of private companies and you have a clear recipe for disaster. It is a cosy club where everybody looks after each other: regulators, manufacturers and politicians. Obviously, for any airline or manufacturer, any serious incident or accident is bad publicity and is to be avoided. The general level of safety in aviation since the 1980s has been relatively good, and numerically speaking, flying remains the safest method of transportation (https://www.businessinsider.com/flying-is-still-the-safest-way-to-travel-2013-7?r=US&IR=T). Under capitalism, however, with profit as the primary goal, there will be a never-ending battle of short-term expense versus long-term safety, where the latter finishes a long way behind.

This short-term thinking ties in with the increasing short-sightedness and sheer incompetence of the political elite worldwide. In the UK we have the Brexit circus, in the USA we have Trump. The Twitter president was quick last week to send yet another bizarre tweet saying that “airplanes are becoming far too complex to fly” and that he doesn’t want “Albert Einstein to be his pilot”. This comes from a man who doesn’t know how to close an umbrella upon entering the presidential 747 and who last year nominated his own pilot, John Dunkin — the man who flew Trump planes, not Air Force One — to head the FAA. As the Financial Times put it (https://www.ft.com/content/072ffe40-45dc-11e9-b168-96a37d002cd3?fbclid=IwAR2mgoHLixW2uOdduiiIAs1Vct8q1G-nU0gkpLjYXbPLQYXXpcucfPcFB70):



Yet, like a broken clock that is right twice a day, Trump in this instance has a point, even if we can’t suspect him of having any real level of comprehension of the matter at hand.

I agree with a lot of your post but while is popular here and abroad to bring Trump into everything I do not think he has much to do with the current state of affairs at the FAA. The cozy regulator/industry relationship has been long in the making and the problem is often noted. The "dual mandate" to oversee aviation safety and promote air commerce was ended by Congress in 1996 but top civil service jobs are often political. Influence can be subtle. I remember a situation at a large domestic airline. The airlines fleet manager was disturbed at the number of pilots needing more simulator time in order to satisfactorily complete the steep turn demonstration. He decided that he would just take it out of the syllabus. He was over ruled by the FAA model manager for that aircraft at that airline. He took the matter over her head and her boss agreed with him that for what ever reasoning, steep turns were not important and could be deleted from the syllabus/check rides.

[Rated De]

Under capitalism, however, with profit as the primary goal, there will be a never-ending battle of short-term expense versus long-term safety, where the latter finishes a long way behind.

This is the business school graduate's mission: Profit. Either grow revenue or cut cost.

Until the Lion Air crash, no 737 MAX pilot had ever heard of this completely new MCAS system, which was not documented anywhere, never mind trained for in the simulator. In fact, this was one of the main selling points that helped Boeing secure the 5,000 orders for the 737 MAX: no expensive separate type rating – on average a 5-6 week training involving full-motion simulators, which are very expensive to run – needed for your existing 737 pilots, who can keep making your company money.

The roots of this crisis can be found in a major change the agency (https://www.nytimes.com/2013/04/26/opinion/a-back-seat-for-safety-at-the-faa.html) instituted in its regulatory responsibility in 2005. Rather than naming and supervising its own ‘designated airworthiness representatives,’ the agency decided to allow Boeing and other manufacturers who qualified under the revised procedures to select their own employees to certify the safety of their aircraft. In justifying this change, the agency said at the time that it would save the aviation industry about $25 billion from 2006 to 2015. Therefore, the manufacturer is providing safety oversight of itself. This is a worrying move toward industry self-certification.

A relationship that is confused. Self regulation and budgetary pressure.
Regulatory capture.

A similar process of “soft corruption” and conflict of interest can be seen in the financial industry in various countries across the world, made worse by deregulation. The Airline Deregulation Act of 1978 started a process of removing government controls over the airlines and manufacturers in the USA. This was done to encourage competition and lower the ticket prices, but the end result has been the monopolisation of air travel to the point where four major carriers control 80 percent of US air traffic. Tickets did become cheaper but travelling by plane has generally become a miserable experience worldwide and the workforce – from pilots and cabin crew to dispatchers, baggage handlers and office workers – is more exploited, underpaid and demoralised than ever.

In the centuries old battle of profit above all else, safety can only ever come a distant second.

The reputational damage to the FAA and indeed Boeing is substantial.

Whatever the correlated factors between the two accidents, MCAS is the symptom. The problem has its genesis in three elements:

The focus on infinite profit growth with infinite cost reduction (a product of business school) MBA teaching
Regulatory Capture
Soft corruption

There is no need for a case study. This is one of the oldest themes and the arrogance of humanity condemns it to repeat over and over.

[flyingchanges]

How many of you know what the stab trim range is in normal flight on your type. Might be a good time to pay attention to where your most powerful flight control spends most of its time. I know for our ops, the 800NG lives between 5 and 6 just about all of the time.

If the jet is doing something you don't want with a flight control, do something about it. I would call it a runaway, you can call it what you want. Yes, the trim moves a lot when hand flying, but it never moves enough to need substantial column input to counter it.

[FCeng84]

In other aircraft the elevator has a dynamic limiter. The Q limiter. Q is the airodynamic force. This is a combination of airspeed and density altitude. The same as the force sensed by the pitot tube. The purpose of the Q limiter is to limit the maximum elevator angle. At lower Q the pilot has full authority over the elevator but as Q increases, the angle is limited.

In ithe scenario where an aircraft is low and fast the elevator deflection available is limited. It should be noted that elevator deflection is based on deflection from the trimmed position of the stabilizer.


Got it, thanks for expanding. What I was wanting to know was if you were pointing to an explicit command limit within the control system that would keep from asking more of the elevator actuators than they can deliver vs. a system that asks for everything that is available and takes what it gets when elevator actuators are driven with full available hydraulic pressure. I am familiar with both types of systems. In the case of the 737 the limit is hydro-mechanical in that the elevator actuator control valves are wide open but the elevator hinge moment is more than the actuators can deliver so the surface ends up at a less than full travel position. I am familiar with this being referred to as either "blowdown" or "blowback". Note that if you are flying with high enough dynamic pressure for that to be the limiting factor and you command full elevator with full column and you hold that column and you speed up, the elevator deflection will decrease as dynamic pressure increases. With reference to Star Trek, that's when Scotty says "She's give'n you all there is, there just isn't any more to be had." Glad to provide this answer once I was certain of your question.

[jagema]

Need for MCAS is not related the thrust pitch coupling. Read previous thread entries to understand and catch up with the discussion.
I know the requirement for MCAS is to have linear alpha forces on the column as it approaches high AOA, as required by certification, due to the new lift generated by the engine nacelles not previously found in previous NG models.

I was trying to explain pitch-thrust coupling.

[yanrair]

Hi guys
A few points being missed here I think so far. Now some of these are of course just opinion but here goes.....
1 the 737 can fly with everything turned off. It’s a mechanical plane. That is it’s great virtue. So to crash one you have to forget that it’s actually a real ordinary plane and you are meant to be in total control! Always.
2 that being so, if STAB moves unexpectedly, turn off STAB SWITCHES as generations of pilots have done ,and fly straight and level. Why not take control of the plane? You can.
3 MACS only works with autopilot out at high AoA slow speed
4 the fact MACS malfunctions or maybe is not we’ll designed which we don’t know yet, is not the cause of the crash. although it would be desirable if it worked in a sensible manner. Eg two AoA inputs, doesn’t repeatedly incrementally trim nose down and a limit on the number of trim wheel turns etc etc as postulated here.
5 this nose down trim goes back to the 707 which had a stick pusher- it’s not really a new idea at all
6 the cause here? Looks to me like we’re forgetting the basics and the accumulated knowledge of 50 years of operating the 737.
as someone said, the MAX is like a cart (or perhaps a 707)with a couple of computers and glass screens, but underneath it’s a very simple uncomplicated plane. Fly it 6/60 and it will fly. 6 deg nose up. 60% power. Like any other plane.
7 the stabilizer trim switches on the yoke-the ones you use all the time, cannot apparently override (apply automatic brake) against MACS. Now- That’s something very different from the previous models and if true an important issue. But not the cause.
Thats my ten pence worth for today
i would fly a Max in a heartbeat. Provided the pilots

[FCeng84]

How many of you know what the stab trim range is in normal flight on your type. Might be a good time to pay attention to where your most powerful flight control spends most of its time. I know for our ops, the 800NG lives between 5 and 6 just about all of the time.

If the jet is doing something you don't want with a flight control, do something about it. I would call it a runaway, you can call it what you want. Yes, the trim moves a lot when hand flying, but it never moves enough to need substantial column input to counter it.

Music to my engineer ears! Let me add that the 737 automatic stabilizer control should never drive your airplane away from trim if you are flying at a steady speed and an AOA well below stick shaker. If it does, take note. Speaking of stick shaker, when that is going on a 737 MAX and the flaps are up and the autopilot is disengaged MCAS is most likely active. MCAS can activate with indicated AOA less than stick shaker, but it has to be close and must be above the AOA for any normal trim condition.

[FCeng84]

I know the requirement for MCAS is to have linear alpha forces on the column as it approaches high AOA, as required by certification, due to the new lift generated by the engine nacelles not previously found in previous NG models.

I was trying to explain pitch-thrust coupling.

Great and peace. We just need to be careful in an MCAS focused discussion not to give the impression that the 737 MAX engine issue that gives rise to the need for MCAS is thrust pitch coupling. Glad that we are of the same understanding here.

[abdunbar]

Got it, thanks for expanding. What I was wanting to know if you were pointing to an explicit command limit within the control system that would keep from asking more of the elevator actuators than they can deliver vs. a system that asks for everything that is available and takes what it gets when elevator actuators are driven with full available hydraulic pressure. I am familiar with both types of systems. In the case of the 737 the limit is hydro-mechanical in that the elevator actuator control valves are wide open but the elevator hinge moment is more than the actuators can deliver so the surface ends up at a less than full travel position. I am familiar with this being referred to as either "blowdown" or "blowback". Note that if you are flying with high enough dynamic pressure for that to be the limiting factor and you command full elevator with full column and you hold that column and you speed up, the elevator deflection will decrease as dynamic pressure increases. With reference to Star Trek, that's when Scotty says "She's give'n you all there is, there just isn't any more to be had." Glad to provide this answer once I was certain of your question.


This question is for FCeng84 who seems to be very specifically knowledgeable regarding the 737Max. Based upon what you are saying about how the elevator works, it does not seem that there would be a situation that would, either through control force, aerodynamic force or a combination thereof, preclude manual trimming of the stabilizer. True?

[jagema]

Glad that we are of the same understanding here.

A lot of it has to do with your clear and insightful contributions to this thread. As a 737NG driver I thank you bud. :)

[FCeng84]

Hi guys
A few points being missed here I think so far. Now some of these are of course just opinion but here goes.....
1 the 737 can fly with everything turned off. It’s a mechanical plane. That is it’s great virtue. So to crash one you have to forget that it’s actually a real ordinary plane and you are meant to be in total control! Always.
2 that being so, if STAB moves unexpectedly, turn off STAB SWITCHES as generations of pilots have done ,and fly straight and level. Why not take control of the plane? You can.
3 MACS only works with autopilot out at high AoA slow speed
4 the fact MACS malfunctions or maybe is not we’ll designed which we don’t know yet, is not the cause of the crash. although it would be desirable if it worked in a sensible manner. Eg two AoA inputs, doesn’t repeatedly incrementally trim nose down and a limit on the number of trim wheel turns etc etc as postulated here.
5 this nose down trim goes back to the 707 which had a stick pusher- it’s not really a new idea at all
6 the cause here? Looks to me like we’re forgetting the basics and the accumulated knowledge of 50 years of operating the 737.
as someone said, the MAX is like a cart (or perhaps a 707)with a couple of computers and glass screens, but underneath it’s a very simple uncomplicated plane. Fly it 6/60 and it will fly. 6 deg nose up. 60% power. Like any other plane.
7 the stabilizer trim switches on the yoke-the ones you use all the time, cannot apparently override (apply automatic brake) against MACS. Now- That’s something very different from the previous models and if true an important issue. But not the cause.
Thats my ten pence worth for today
i would fly a Max in a heartbeat. Provided the pilots




A couple of responses to your points:

1. True, but you don't truly get everything turned off until you use the stabilizer cutout switches. Handling qualities are not certifiable in that configuration.

2. Fully agree.

3. MCAS can operate at any Mach number less than 0.84.

4. Fully agree. Hopefully the MCAS update to be fielded soon addresses all that you raise in this point.

5. There is a fundamental difference between a stick pusher and a system that uses stabilizer. The pitch command increment provided by a pusher is gone as soon as you override and move the column where you want it. The increment of stabilizer motion inserted automatically is not removed via the column and takes either returning to low AOA or pilot commanding the trim in the other direction. Running the stabilizer back takes time.

6. Pitch and power per book recommendations - yes!

7. Pilot operated pitch trim switches on the yoke will temporarily override MCAS. If the conditions for MCAS activation persist, it will come back active 5 seconds after the pilot stops trimming. Lion Air pilot demonstrated this for several minutes. The column cutout switches (not available to the pilot, but tripped when the column is far enough out of neutral) do override the legacy STS function, but do not override MCAS when pulling with MCAS commanding airplane nose down stabilizer.

Cheers

[Zeffy]

Canada re-examining Boeing 737 MAX approval after FAA certification probe (https://www.reuters.com/article/us-ethiopia-airplane-canada/canada-re-examining-max-approval-after-faa-certification-probe-idUSKCN1QZ2DB)

OTTAWA (Reuters) - Transport Canada is re-examining the validation it gave Boeing Co’s 737 MAX jets, following reports of a U.S. probe into the aircraft’s certification by the Federal Aviation Administration (FAA), Canadian Transport Minister Marc Garneau said on Monday.

Garneau told reporters in Ottawa that Transport Canada might not take any action but he thinks it would be wise to re-examine the validation of the 737 MAX 8 jet, which has been grounded worldwide for safety concerns following the recent crash of an Ethiopian plane of that model, which killed 157 people.

The disaster followed a Lion Air crash in Indonesia in October involving the same model plane.

Canada accepted the FAA’s March 2017 certification of the MAX under a deal where such approvals by the United States are accepted by Canada and vice versa.

“We may not change anything but we’ve decided it’s a good idea for us to review the validation of the type certificate that was given for the MAX 8,” he said.

Citing people familiar with the inquiry, the Wall Street Journal reported on Sunday that U.S. Department of Transportation officials were scrutinizing the FAA approval of MAX jets and that a grand jury in Washington subpoenaed at least one person involved in developing the MAX.

In addition, the Seattle Times reported that Boeing’s safety analysis of a new flight control system on MAX jets, known as MCAS, had several crucial flaws, including understating the power of the system.

Garneau said Transport Canada would do its own certification of a software change being prepared by Boeing within the next few weeks “even if it’s certified by the FAA.”

Reporting By David Ljunggren in Ottawa. Writing by Allison Lampert in Montreal; editing by Jonathan Oatis

[dozing4dollars]

The most desirable outcome would be where manufacturers could design new aircraft with state of the art materials, engines and avionics instead of using airframes and certifications from the sixties. The cost of entry is so high this inhibites innovation and safety.

Recently a Canadian design that competed with Boeing was blocked by Boeing because it was a competitor. Airbus stepped in to scoop up the newly certified C series and rebrand it an Airbus A220. Not what Boeing wanted.

If the cost of certification is so high and established manufacturers block new entrants the safety and innovation that has been a hallmark of aviation will suffer.

Flying sixties designs with bandaid fixes will be our future and our grandchildrens

[FCeng84]

This question is for FCeng84 who seems to be very specifically knowledgeable regarding the 737Max. Based upon what you are saying about how the elevator works, it does not seem that there would be a situation that would, either through control force, aerodynamic force or a combination thereof, preclude manual trimming of the stabilizer. True?

You are stretching my 737 knowledge! I have never read or heard anything definitive about whether or not horizontal tail control (either electric or manual via the trim wheel) would be stalled out if the elevator were at blowdown and thus generating maximum force on the jack screw. I would hope that someone on this forum with that knowledge would share it with the rest of us. Not wanting anyone to find out the hard way my recommendation is to keep up with the pitch trim so that the column forces don't build up to the point where you become the one to find out in flight.

[DType]

Well, if questions are permitted from professional engineers, here are two dumb questions:-
1. Looking at the altitude plot in post 1869, the clearance from rising terrain at 02.40 is perilously small, but thereafter there is a brisk climb. Could that rate of climb and altitude gain have taken the aircraft into a stall?
2. Eyewitnesses claimed to have seen items falling from the plane whilst it was still airborne. Could these have been contrails/vortices generated by extreme AoAs?
Thank you in anticipation of patient and polite replies.

[hans brinker]

Clearly MCAS is not a runnaway trim condition, otherwise we would be reaching for the cut-out switches every time the speed-trim operated. I think some people here do not realise that the trimmer doing its own thing is operations normal.

And the auro-trim systems are always mis-trimming the aircraft (the trim inputs by the speed-trim system are always wrong, and you always have to re-trim manually). So at what point does ‘operations normal’ become ‘operations abnormal’? At what point do you assume that the trimmer has gone awry..??

Silver


I am going to disagree with you. You are technically correct, but the captain on the Lion aircraft that crashed manually corrected for MCAS input 21 or so times. 21 times there was a 10 second trim input by MCAS, followed by 21 times a 10 second ( I assume pilot electric trim and MCAS trim at the same rate but I can be wrong about that) electric trim input by the captain. I know there were 5 second breaks without trim, but I would have to think this is not even close to normal. Of course they had all sorts of other bells and whistles going off, but the captain was able to keep the aircraft in trim, so he must have known there was a trim issue too. I am on brand A, but I have a few hundred hours in the 737 cockpit as JS/non working crew. I have been paying attention, and have never seen STS doing anything close to a 10 second trim run, and it will generally trim ANU after take-off, as the pilot is trying to accelerate, and STS wants to keep the speed constant, whereas MCAS was continuously AND.

[dozing4dollars]

Got it, thanks for expanding. What I was wanting to know was if you were pointing to an explicit command limit within the control system that would keep from asking more of the elevator actuators than they can deliver vs. a system that asks for everything that is available and takes what it gets when elevator actuators are driven with full available hydraulic pressure. I am familiar with both types of systems. In the case of the 737 the limit is hydro-mechanical in that the elevator actuator control valves are wide open but the elevator hinge moment is more than the actuators can deliver so the surface ends up at a less than full travel position. I am familiar with this being referred to as either "blowdown" or "blowback". Note that if you are flying with high enough dynamic pressure for that to be the limiting factor and you command full elevator with full column and you hold that column and you speed up, the elevator deflection will decrease as dynamic pressure increases. With reference to Star Trek, that's when Scotty says "She's give'n you all there is, there just isn't any more to be had." Glad to provide this answer once I was certain of your question.

The Q limiter was pure mechanical and it limited rudder (DC-9). Same vintage as original B737. I don’t know what the MAX or NG has but I believe all modern jet transport aircraft limit fight controls as Q increases as well as Mach.

My point.... and I do have one.... is that the elevator may have increasingly limited authority as the aircraft AS increased.

[WingNut60]

The USA government shutdown that both political parties participated in was also a factor.

... and hence, the voters like you

I don't remember Indonesians or Ethiopians getting a vote!

[FCeng84]

The Q limiter was pure mechanical and it limited rudder (DC-9). Same vintage as original B737. I don’t know what the MAX or NG has but I believe all modern jet transport aircraft limit fight controls as Q increases as well as Mach.

My point.... and I do have one.... is that the elevator may have increasingly limited authority as the aircraft AS increased.

Let me give two examples:

On 737 the maximum elevator displacement with full column input is either full travel if the elevator actuators are physically capable of pushing the elevators hard enough to get there or where ever the aerodynamic hinge moment balances out against full elevator actuator force capability. In both cases, the control system is trying to move the elevator as far as is physically possible but in high dynamic pressure case it has reached an actuator force limit.

On 787 the maximum elevator displacement with full column input is limited by a control system command limit schedule that is a function of flight condition. (I am simplifying here by ignoring for this discussion any envelope protection functions.) The elevator actuators may be capable of generating more force than required to get the surfaces to the command limits, but they are not allowed to. At low speeds the command limits are such that full elevator travel is achievable. At higher speeds control law limits are chosen to balance between (on the low end) elevator displacement needed to achieve pitch control power to meet maneuver requirements and (on the high end) deflections that would generate higher structural loads than necessary. This scheme allows the elevator limits to be tailored to provide the pitch control power needed, but no more so that the structure can be optimized for minimum weight. This is one of the ways in which FBW control is able to deliver improved performance.

The story is always a little more complicated than one might at first think.

[deltafox44]

Bingo, you are reducing the effectiveness of the miss trimmed stab and increasing elevator effectiveness.

Reducing the speed (or not letting it grow) is an obvious remedy but easier to say afterwards. If they have the stick shaker since the take-off, with a normal airspeed, they may think the fault is on airspeed and apply the procedure to keep N1 at a relatively high value that will accelerate the aircraft beyond controlability limits...

[deltafox44]

Let me give two examples:

On 737 the maximum elevator displacement with full column input is either full travel if the elevator actuators are physically capable of pushing the elevators hard enough to get there or where ever the aerodynamic hinge moment balances out against full elevator actuator force capability. In both cases, the control system is trying to move the elevator as far as is physically possible but in high dynamic pressure case it has reached an actuator force limit.

On 787 the maximum elevator displacement with full column input is limited by a control system command limit schedule that is a function of flight condition. (I am simplifying here by ignoring for this discussion any envelope protection functions.) The elevator actuators may be capable of generating more force than required to get the surfaces to the command limits, but they are not allowed to. At low speeds the command limits are such that full elevator travel is achievable. At higher speeds control law limits are chosen to balance between (on the low end) elevator displacement needed to achieve pitch control power to meet maneuver requirements and (on the high end) deflections that would generate higher structural loads than necessary. This scheme allows the elevator limits to be tailored to provide the pitch control power needed, but no more so that the structure can be optimized for minimum weight. This is one of the ways in which FBW control is able to deliver improved performance.

The story is always a little more complicated than one might at first think.
Also, 787 do not need any MCAS :{

Instead of a 737 MAX Boeing should have built a 787 MIN :)

[FCeng84]

Reducing the speed (or not letting it grow) is an obvious remedy but easier to say afterwards. If they have the stick shaker since the take-off, with a normal airspeed, they may think the fault is on airspeed and apply the procedure to keep N1 at a relatively high value that will accelerate the aircraft beyond controlability limits...

Keep trimming and if the system continuously trims you nose down as you are accelerating know that is the opposite direction of STS and thus incorrect => shut the stabilizer down. First and foremost keep trimming to keep the column forces from building up. The problem of getting progressively more out of time takes 10s of seconds to build up and will stop if you keep trimming. If MCAS decides it is time to put in 10 seconds of nose down trim and you determine after a couple of seconds that it is doing the wrong thing and add your own nose up trim, MCAS will stop until you have been off of the trim for 5 continuous seconds. If all you do is blip the trim once every 5 seconds MCAS won't do anything even if the AOA it is getting is out of whack high! Eventually it is hoped that the crew will decide that the automatic stabilizer is doing far more harm than good and turn if off via the cutout switches.

Oh - did I mention enough times that you should keep trimming?!

I'm not trying to argue that MCAS as currently design is satisfactory, but with the system knowledge that we had before the end of 2018 I was confident that we had an acceptable workaround until improvements could be brought to the fleet.

If it turns out the the Ethiopian accident was the result of the same issues that led to the Lion Air accident our industry has some major soul searching to do.

MCAS appears to have been designed based on three assumptions that I have suggested before:
1. If a pilot trims column force will be trimmed to or near zero.
2. Having the automatic stabilizer control continuously take the airplane away from trim when otherwise flying a relatively steady condition, pilots will recognize that it is not healthy and would shut it down via the stabilizer cutout switches.
3. An errant AOA signal feeding MCAS would be acceptable because of (1) and (2) above.
Lion Air showed us that for the crew the day before the accident assumptions (1) and (2) above were reasonable so when (3) happened they were able to fly home.
- In fact they elected to go on to their destination with the stick shaker rattling the whole way!
Lion Air further showed us that for the pilot on the accident flight assumption (1) above held. He made more than 20 corrections and was able to maintain his apparent target altitude of 5000 feet reasonably well. He did not get to (2) above, but might have had his partner been able to keep up with (1) after transferring control.
The Lion Air accident clearly showed that neither assumption (1) nor (2) held true for the second pilot and thus control was lost as a result of not meeting assumption (3).

737MAX was permitted to continue flying after the data from the Lion Air accident revealed the facts outlined above, through so many PPRUNE pages, and across so many other information outlets including FAA and Boeing communications because an assumption was made that with increased awareness pilots would be able to live up to assumptions (1), (2), and (3) above. I would like to think that most of the pilots flying 737MAX airplanes in February were prepared to live up to these assumptions. If the recently decoded FDR from the Ethiopian accident shows that to be a repeat of the Lion Air event this latest assumption will clearly not have been valid for at least one 737MAX crew.

While the MCAS software update developed after the Lion Air accident that is almost ready to go to the fleet will likely remove reliance on the three MCAS design assumptions listed above and thus would have greatly improved the likelihood of a safe outcome for the Ethiopian event we are left with a huge elephant in the room. After making the planned update we still must address the following:
A. How many other key points in the 737MAX safety story are based on pilot response assumptions that may not be valid?
B. How about other airplane models? Are they deemed safe based on faulty assumptions regarding pilot action?
- For instance, how may current 737 crews (all models) would not respond quickly enough to a classic stabilizer runaway that was not arrested by column cutout (i.e., pulling the column far enough)? I know this is covered in simulator sessions for 737 pilots, but is that enough?
C. Moving forward with the current status and future of commercial aviation have we gotten to the point where basic flying skills and system awareness are so low that we are at risk throughout the whole industry?
D. Can current and future pilot reaction short falls be addressed through training? If so, what kind, how much, and how often?
E. How will we know that we have achieved a sufficient industry wide level of safety?

Hoping to see FDR data from the Ethiopian accident soon. I sure hope someone from the PPRUNE community will find a way to get ahold of it and share it here.