PDA

View Full Version : Ethiopian Prelim Report


galdian
5th Apr 2019, 04:37
Hi all
Have had a look at the report, if I've missed anything/misunderstood very happy to be corrected.

It appears thigs were "contained" until the last 30 seconds when it all fell apart, attitude of -40 degrees was reached and recovery impossible.

Thing I can't work out is that previously the STAB TRIM switches were moved to cutoff and verified no electric trim was available, also manual trimming was attempted but unsuccessful (high aerodynamic forces?)

In the last 30 seconds there was electric manual trim followed by severe automatic nose down trim - with the STAB TRIM switches in cutoff?

Can only think of 3 options:
- STAB TRIM override switch engaged..but that only allows manual trim in direction opposite to control column forces?
Equally did not see any mention of the override being engaged;
- STAB TRIM switches were returned to normal position/operation;
- an electrical fault that allowed the system to be energised regardless of the STAB TRIM switches position.

Thoughts appreciated.

gums
5th Apr 2019, 05:07
Salute!

I am getting old and need a magnifying glass to look at the data traces.

So can anyone else note more differences than I do on the data traces than for the Lion flights we have? Times, magnitude, etc.

Gums asks...

galdian
5th Apr 2019, 05:09
Agree most likely scenario is they returned the STAB TRIM switches to normal but would have expected some sort of verbal discussion/confirmation which appears lacking - even if just a couple of words to indicate intent.

jimjim1
5th Apr 2019, 06:35
Salute!
need a magnifying glass to look at the data traces.
Gums asks...

I have found best quality is obtained by downloading PDF and then using say Acrobat Reader. You can zoom in to your hearts content.

http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+B737-800MAX+,%28ET-AVJ%29.pdf

Looks like this-

https://cimg2.ibsrv.net/gimg/pprune.org-vbulletin/713x768/b737_zoom_example_309b5ccc2cc7baa2e6e4fb4a1f442cc2715c931d.p ng
Maximise window to ensure full size. This is just a small corner of the chart for illustrative purposes.

DaveReidUK
5th Apr 2019, 09:45
I am getting old and need a magnifying glass to look at the data traces.

Click on this graphic for the trace chart at its native resolution (i.e. you won't get any more detail by zooming in):

https://cimg8.ibsrv.net/gimg/pprune.org-vbulletin/2000x1250/general_overview_of_flight_7a4fd0f8cfa5fceabcd8af790f8c9cc0a a1d7ce9.jpg

DaveReidUK
5th Apr 2019, 09:49
Second chart, likewise:
https://cimg3.ibsrv.net/gimg/pprune.org-vbulletin/1337x594/preliminary_fdr_data_ead2e6e167a88137a0328eb89ac79b9b9fa79ec 5.jpg

GordonR_Cape
5th Apr 2019, 11:49
galdian

It appears things were "contained" until the last 30 seconds when it all fell apart, attitude of -40 degrees was reached and recovery impossible.

My thoughts are that things were 'contained' only in the sense that if you fall out of a 100 story building, nothing bad happens until you reach the ground.

Once the speed passed 250kts, that was a road from which it was very difficult to return. Reducing thrust would have produced a nose down pitch, at an altitude when that was least desirable.

It is not clear the exact stage at which that point-of-no-return was reached, but IMO no pilot on earth could have landed that plane safely, from the conditions it was at 30 seconds prior to them re-engaging the trim cutoff switches.

Edit: Perhaps some weird combination of elevator roll, speed brakes, or something else may have helped. Someone with a lot of free time on a simulator, might be able answer that question.

oggers
5th Apr 2019, 11:56
The report mentions in passing that autothrottle was left engaged throughout but fails to acknowledge it should have been disengaged. It avoids the question of whether the pilots switched the stab cut-out back on even though the data shows that must have been the case. The Press Conference "was almost entirely focused on vindicating the actions of the pilots" according to the admittedly partisan Seattle Times - it is subjective but FWIW I agree.

Nonetheless it is abundantly clear the MCAS failed (as if we didn't know that by now). But it is a matter of fact that contrary to the Ethiopian Transport Minister's statement, the crew did NOT follow correctly the Boeing procedures and the Non Normal Checklist. The autothrottle was never disengaged (a significant oversight). Although the stab cut-out was belatedly used the trim was later re-engaged contrary to the Boeing advice to "ensure the CUTOUT switches remain at CUTOUT for the remainder of the flight".

GordonR_Cape
5th Apr 2019, 12:25
The report mentions in passing that autothrottle was left engaged throughout but fails to acknowledge it should have been disengaged. It avoids the question of whether the pilots switched the stab cut-out back on even though the data shows that must have been the case. The Press Conference "was almost entirely focused on vindicating the actions of the pilots" according to the admittedly non-paretisan Seattle Times - it is subjective but FWIW I agree.

Nonetheless it is abundantly clear the MCAS failed (as if we didn't know that by now). But it is a matter of fact that contrary to the Ethiopian Transport Minister's statement, the crew did NOT follow correctly the Boeing procedures and the Non Normal Checklist. The autothrottle was never disengaged (a significant oversight). Although the stab cut-out was belatedly used the trim was later re-engaged contrary to the Boeing advice to "ensure the CUTOUT switches remain at CUTOUT for the remainder of the flight".

The preliminary report is a statement of facts, not an attribution of blame. The press conference is an entirely different matter, and your points are probably valid.

Capn Bloggs
5th Apr 2019, 12:40
Plenty of Monday-morning quarterbacking there, Oggers. "Didn't follow the NNC". They were airborne for only a few minutes before diving into the ground at over 400KIAS! Cut them a bit of slack!

scifi
5th Apr 2019, 12:49
Looks like the L AoA error was +75 degrees in this case. That is three times more than in the Lion-Air accident, so not a binary multiple. However 75 degrees could be the Full Scale Deflection, so could still be a data line problem. Also it contained no signal component, just an FSD steady reading.
.

Mansfield
5th Apr 2019, 13:54
The elephant in the living room is the source of the erroneous angle of attack inputs. How did two brand new airplanes experience nearly the same angle of attack input faults within six months of each other, particularly when one of them had the AoA vane changed halfway through the four day maintenance history? Is this a hardware problem? Or are we dealing with some form of bad code within the systems somewhere?

As Dave Davies once wrote regarding a runaway stabilizer, “if this should occur at high speed the airplane is bound to be in severe trouble; the only hope is to get the speed off.” Certainly reducing power would have added a nose down pitching moment, but getting rid of the speed would have taken the bite out of the stabilizer, reduced the elevator required and allowed the trim to be moved manually (if that was a problem).

We don’t really know whether the trim could be moved manually or not. It took the FO 8 seconds to conclude that “it’s not working”. I don’t know how hard he tried, or if he even understood how much force might be required. There may be more information within the CVR transcript that we don’t have.

However, EASA Equivalent Safety Finding B-05 discusses the limits of the yoke trim switches, stating that “Simulation has demonstrated that the thumb switch trim does not have enough authority to completely trim the aircraft longitudinally in certain corners of the flight envelope, e.g. gear up/flaps up, aft center of gravity, near Vmo/Mmo corner, and gear down/flaps up, at speeds above 230 kts. (italics added). It then states that “The trim wheel can be used to trim the airplane throughout the entire flight envelope. “

Boeing has always stated in their FCTMs that “excessive” airloads may require the efforts of both pilots, and that in “extreme” cases those airloads may have to be relieved aerodynamically. I don’t know what ‘excessive” airloads are or what kind of case is an “extreme” case, but based on the EASA document as well as the absence in the QRH of any such discussion, I am assuming that I can operate the trim wheel manually in all corners of the envelope. This will be an interesting discussion next month in recurrent training.

It appears to me that they were climbing with the master trim selected off. I don’t know why the captain said “The pitch is not enough”…of course, I don’t really know what he said at all, only how it was presented in the public release. But it seems to me that they were stable and climbing, so one option would have been to just hang on and get some altitude before trying to sort things out.

The other option would have been to turn the thing back on and mash the trim switches until you got a pretty good nose up trim established, then shut it off again. You’d have to understand how the system works, but we’ve had those discussions for years in regard to using some parts of the trim system to reset a runaway stabilizer if it was necessary.

The Lion Air captain trimmed nose up against the MCAS 21 times; the Lion Air FO only tried this twice. The preceding Lion Air crew never came close to the ground, so presumably they trimmed nose up against the MCAS quite a lot, until they shut it off and finally left it off. The Ethiopian captain appears to have trimmed nose up against the MCAS at least 5 times, but when the system was turned back on, he only tried a couple of short nose up inputs. I wonder if he even knew it was back on. For the life of me, I cannot understand why either the Lion Air FO or the Ethiopian captain did not simply mash those yoke switches and hold them there until they relieved the column force, and then mash them again when the MCAS started running the trim nose down. They are hand flying the thing…they certainly would feel the trim start to change.

But like I said, the real elephant in the living room is the source of the erroneous angle of attack data. The airplane isn’t going back to flight status until that gets sorted.

oggers
5th Apr 2019, 14:36
Bloggs

Plenty of Monday-morning quarterbacking there, Oggers. "Didn't follow the NNC". They were airborne for only a few minutes before diving into the ground at over 400KIAS! Cut them a bit of slack!

Call it what you will, you will never understand this accident if you do not examine all the facts. But my point is really just the Ethiopian Transport Minister claims the crew carried out the Boeing procedure, whilst the interim report shows unequivocally that they did not.

safetypee
5th Apr 2019, 15:14
Mansfield, turning your ‘elephant’ around, consider the actual threat to safe flight. The aircraft was not flyable because of the trimmed condition; the abnormal trimmed state.

AoA failure in previous variant 737 other aircraft types can be managed. In the Max, MCAS with AoA contributed to the trimmed condition, but so too could other trim failures - continuous runaway (not this accident).

The Boeing argument is that the abnormal drill for trim runaway would mitigate the MCAS induced trimmed condition. The mounting evidence is that this is not so, particularly considering crew’s inability to understand the abnormal trim motion - the initial MCAS trim movement was exactly as designed; and thereafter the physical impossibility to move the trim wheel manually.
The obverse is if the trim runaway drill will mitigate a ‘trim runaway’, (no MCAS or AoA involvement), particular with larger trim offsets and / or higher air speeds; does the MAX differ from the NG in this respect.

There are differences between the two trim failure initiators, but each depend on human perception, understanding the situation, choice of action, and acting - which may or may not work.

Managing the abnormal trim state depends on an assumed human ability; that the crew will be able to identify and mitigate the threat.
Thus the fundamental question is if reliance on human ability in this instance has been stretched too far; highly questionable for mental workload and situation assessment (+ no training, no published system description), even more so for the impracticality of crew procedures( + none / hastily issued inadequate drill).

‘It is very difficult to change the human behaviour, but you can change the conditions in which the human works’ - James Reason.
In changing the conditions of work, Boeing must consider all possible contributions to the real threat - all trim malfunctions, all abnormal trimmed states.

Intruder
5th Apr 2019, 17:02
Call it what you will, you will never understand this accident if you do not examine all the facts. But my point is really just the Ethiopian Transport Minister claims the crew carried out the Boeing procedure, whilst the interim report shows unequivocally that they did not.In fact, their adherence to 'normal' procedures immediately after takeoff may well have set themselves up for the fatal endgame:
They got the stick shaker almost immediately after takeoff, but he tried to engage the autopilot 4 times while it was still shaking!

They retracted the flaps while the stick was still shaking!

They never brought the engines back from TO thrust.

If they had left the flaps in the TO position while troubleshooting, they could have trimmed the airplane normally throughout the flight. Depending on autothrottle mode, it may have brought the thrust back to maintain the flaps limit speed (228 kt?).

CW247
5th Apr 2019, 17:20
Translate what she said to "they did all they could as per the manufacturers' suggestion, given the fear of losing their dear-lives and the myriad of physiological and psychological issues they were experiencing during the roller coaster ride". Is that better?

BluSdUp
5th Apr 2019, 17:28
Intruder.
Speed limit for Flap 5 is 250kts.
My go-to speed is 230 as that gives me safe flight in most conditions in the 737-800.
So
Level change , speed 230, leave F5 AT off and climb to say 15 000 feet, ca 7000 feet above field?

slacktide
5th Apr 2019, 18:50
I think they turned the switches back on, as a last resort, after the inability to turn the trim wheels against the high aerodynamic loads. Like many, here, I wish they would have pulled back the throttles, somewhere along the line, but totally understand that they had a lot of other confusing and distracting things to deal with, and not a lot of time.

Until recently, I did not realize that the trim wheel was smaller, the damper larger, and therefore the mechanical advantage reduced from what I was used to. It is truly no longer a 737. MAX kludge.

The trim wheel on the 737 MAX is identical to the trim wheel on the 737 NG. It has the same part number and they are interchangeable.

safetypee
5th Apr 2019, 18:51
Mansfield,
Further to your views on EASA #13, see https://www.pprune.org/showpost.php?p=10439906&postcount=3374

The safety case considered normal trim, at or near trim to maintain trim. The accident involved restoring trim from an extreme position where the combined air loads of tail / elevator prevented operation of the trim wheel.
If so, then the basis of the certification is flawed.

Davidppp
5th Apr 2019, 19:16
Hello all.

I'm not in the industry but have rudiments of aero.
So here is my silly question.

If the engines generate lift far forward pitched up this tends to assist further pitch up since the centre of lift moves far in front of the centre of gravity.

If the pitch becomes nose down, at some negative AOA the engines will similarly move the centre of negative lift forwards the air strikes the top of the nacelle. And tend to push nose down.

Is this a reasonable analysis?

David

Goldenrivett
5th Apr 2019, 20:13
safetypee
If so, then the basis of the certification is flawed.


I don't see why. The preliminary report says
"At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units."

The crew could still wind the stab trim ANU using the manual electric trim 32 seconds before impact. The question has to be why didn't they use the manual electric trim to remove the elevator load completely then isolate the system using the two pedestal switches.

GordonR_Cape
5th Apr 2019, 20:39
safetypee

I don't see why. The preliminary report says
"At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units."

The crew could still wind the stab trim ANU using the manual electric trim 32 seconds before impact. The question has to be why didn't they use the manual electric trim to remove the elevator load completely then isolate the system using the two pedestal switches.

I think your assertion contains several logical inconsistencies:
1. The momentary trim inputs may be an artifact of the FDR data sampling algorithm, or the crew stopped trying when the trim wheels didn't turn after a few seconds. We don't really know for sure, and IMO you can't build an argument on such evidence.
2. The recorded increase in the stabiliser ANU position may also be a data artifact, or backlash in the cables and pulleys, or the trim motor locking mechanism. There are a number of suggestions from other sources (including EASA), that what you describe is physically impossible at high airspeeds and aerodynamic loads.
3. Re-enabling the trim switches after runaway trim, is not documented in any procedure, so cannot count towards the certification process. They could re-write the procedures, but currently it seems to fail certification under those extreme conditions.

Edit: Reuters has an excellent article, citing some very knowledgeable sources: https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP
The undated EASA certification document, available online, was issued in February 2016, an agency spokesman said.

It specifically noted that at speeds greater than 230 knots (265mph, 425kph) with flaps retracted, pilots might have to use the wheel in the cockpit’s center console rather than an electric thumb switch on the control yoke.

Mansfield
5th Apr 2019, 20:51
Safety Pee, your point regarding the EASA document is well taken. I think we have to be careful of what we read into the data thus far; we really don't know what kind of effort was expended by the FO to move the manual trim wheel. But the possibility of excessive loads is clearly present, and that will be an immediately crucial question. Right now, there is no reason to believe that a similar effect would not occur on the NG, should an old-school runaway stabilizer occur, so the issue is going to need some prompt discussion.

pax britanica
5th Apr 2019, 21:06
To my mind as potential passenger it comes down to certification . It seems Boeing and the FAA are too cosy- its not unreasonable to delegate some things to the manufacturer because they have resources and expertise but perhaps thatc ulture became too ingrained and everyone got tripped up.

Is the MAX really still a 737 after 50 odd years; 3 engine types, new wings, new tail, vertical and horizontal , undercarriage changes due to engines, fly by wire, all digital flight deck no doubt a lot of structural changes internally to lighten weight - the only things that seem to still be 737 are the flight deck windows. Should the FAA really have accepted the grandfather premise or just told Boeing , especially after the 739 -sorry you are just going to have to call it 797. Its a great engineering feat , up to a point, but as MD found out when they went one step beyond with the MD90 you can go a stretch too far and not just in dimensions,

safetypee
5th Apr 2019, 22:54
Goldenrivet, Gordon, Mansfield,
The critical parameter is the pitch trim position (units) on the FDR; above that are indications of electrical input. The top line being the pilots yoke switches command, when enabled, the lower the FCC output - MCAS. It is quite clear during the final stages of flight, that there is little or no trim change with pilot nose up input, if indeed that was an input vice noise, but for MCAS the nose down change is quite clear - dramatic.
Additional rationale is in https://www.pprune.org/showpost.php?p=10439750&postcount=3337 (https://www.pprune.org/showpost.php?p=10439750&postcount=3337)

The argument is that excessive asymmetric control forces enable the tail trim to be repositioned nose down, but oppose all nose up movement.
Add to this that the electrical signal for trim acts directly on the trim motor at the rear of the aircraft, which can become ‘electrically stalled’ (or inhibited - under discussion). Whereas manual trim wheel from the flight deck involves cables which can stretch under high loads, this together with the unusual wheel to tail trim ratio, could appear to the pilots as having some wheel movement, but it being totally ineffective due to stretching the cables and not moving the tail trim mechanism, again due to high aerodynamic load restricting the nose - up sense.

With caveats, caution, and all reservations as above; also to be applied to https://www.pprune.org/showpost.php?p=10439906&postcount=3374 (https://www.pprune.org/showpost.php?p=10439906&postcount=3374)

Derfred
5th Apr 2019, 23:20
I'm sorry, I can't accept an FDR "noise" explanation.

There are two electrical trim inputs coinciding with a change in trim position from 2.1 to 2.3 units.

Two separate FDR channels show trim input and trim position change.

A change of one parameter or the other could be noise, a change of both together cannot.

A trim change was commanded electrically, and the stab trim responded accordingly.

568
6th Apr 2019, 05:37
The report mentions in passing that autothrottle was left engaged throughout but fails to acknowledge it should have been disengaged. It avoids the question of whether the pilots switched the stab cut-out back on even though the data shows that must have been the case. The Press Conference "was almost entirely focused on vindicating the actions of the pilots" according to the admittedly partisan Seattle Times - it is subjective but FWIW I agree.

Nonetheless it is abundantly clear the MCAS failed (as if we didn't know that by now). But it is a matter of fact that contrary to the Ethiopian Transport Minister's statement, the crew did NOT follow correctly the Boeing procedures and the Non Normal Checklist. The autothrottle was never disengaged (a significant oversight). Although the stab cut-out was belatedly used the trim was later re-engaged contrary to the Boeing advice to "ensure the CUTOUT switches remain at CUTOUT for the remainder of the flight".Agreed that the NNC directs the crew to leave the switches in "CUTOUT" but we don't know what other alerts were audible to the crew at that time. No amount of training in sims is going to help these "startle events" in real life/time events.

568
6th Apr 2019, 05:48
Hello all.

I'm not in the industry but have rudiments of aero.
So here is my silly question.

If the engines generate lift far forward pitched up this tends to assist further pitch up since the centre of lift moves far in front of the centre of gravity.

If the pitch becomes nose down, at some negative AOA the engines will similarly move the centre of negative lift forwards the air strikes the top of the nacelle. And tend to push nose down.

Is this a reasonable analysis?

DavidIf you can obtain a copy of "handling the big jets" by DP Davies, this will provide you with an insight into aerodynamics. There are many forces at play when new engines are used on re-designed wings and subsequent certification for aircraft types.

568
6th Apr 2019, 06:04
I think your assertion contains several logical inconsistencies:
1. The momentary trim inputs may be an artifact of the FDR data sampling algorithm, or the crew stopped trying when the trim wheels didn't turn after a few seconds. We don't really know for sure, and IMO you can't build an argument on such evidence.
2. The recorded increase in the stabiliser ANU position may also be a data artifact, or backlash in the cables and pulleys, or the trim motor locking mechanism. There are a number of suggestions from other sources (including EASA), that what you describe is physically impossible at high airspeeds and aerodynamic loads.
3. Re-enabling the trim switches after runaway trim, is not documented in any procedure, so cannot count towards the certification process. They could re-write the procedures, but currently it seems to fail certification under those extreme conditions.

Edit: Reuters has an excellent article, citing some very knowledgeable sources: www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP (https://[/QUOTE)https://
[/QUOTE] (http://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP[/url)
www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP (https://www.pprune.org/www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP)[/QUOTE]I would say that the majority of pilots who have been trained on the 737 (I have flown the Jurassic, old EFIS and NG series) see the "stab manual trim wheels" (located on either side of both pilots center pedestal),rotating, indicating that the use of the control column switches "are trimming the stab" (no autopilot engaged). Due to air loads and the fact that MCAS had activated, this lead the crew to believe that the STAB trim wasn't working properly (manually or electrically). Again, we are not privy to the CVR and all of the distractions the crew were facing at this crucial time, low to the ground.

VinRouge
6th Apr 2019, 09:48
Until a point is reached where multiple AoA vane failures can be dealt with safety, accounting for MCAS, it’s not an airworthy design IMHO.

Large multiple bird strikes to the radome can cause issues to airflow which make AoA readings erroneous. It was a known issue on a previous fleet. You simply need to be able to turn off MCAS or have an override switch that takes tabular data of airspeed and flap settting and resets the stab appropriately. Either this, or a stab that hasn’t been designed to be uncontrollable manually at high speed.

Derfred
6th Apr 2019, 09:53
No amount of training in sims is going to help these "startle events" in real life/time events.

I would beg to differ.

Additional training in sims to cover “startle events” above and beyond the “minimum required by regulators” should certainly help with the last slice of Swiss cheese in a scenario not conceived as a mandatory training item.

Basic thrust + attitude + trim training to cover startle effects together with basic flight path monitoring could possibly have saved many recent Boeing fatalities.

I’ve added “trim” to basic attitude flying because for a well-trained pilot, that should go without saying, but maybe in light of the two recent B737 fatalities it needs to be said.

The question is whether the regulators and/or airlines can be persuaded of this, which might increase their costs compared to their minimalist competitors.

Of course, the airlines would prefer to buy fool-proof aircraft so they can employ fools for peanuts, but we’re obviously not there yet. I think the message is we still need good pilots, and the industry needs to suck that up and pay and train accordingly.

For example (Boeing only): Lion Air, Ethiopian, Atlas, Asiana, Emirates, Air Niugini, FlyDubai, Tatarstan, Adam Air, Garuda etc (off the top of my head) were all events that could have been survivable with a different crew at the controls. To say it’s impossible to train crews to deal with difficult events is simply not true. It just might involve higher standards, more training, and inevitably more money. The industry will need to decide where the economic trade-off should lie.

Is Boeing complicit in the 737MAX events? Undoubtedly. But could better trained pilots have saved the day and become heroes? I suggest yes. One crew did (with a bit of help from a jumpseater).

I’m not necessarily suggesting I would personally have done any better - I could also be a victim of insufficient training. But I do spend a bit of my spare time trying to learn from others mistakes, including reading this website, which contains an enormous wealth of knowledge amidst the noise. I’m certainly not prepared to just throw my hands in the air and say “this was unsurvivable”. In fact, I put to any professional 737MAX pilot: if you studied the Lion Air preliminary report, you should have been well prepared for this event - it should not have been startle factor at all. If, in fact, you didn’t study the report and arm-chair fly it so as to be so-prepared, then maybe this isn’t the job for you.

As a professional pilot, of course I want my aircraft to be designed as safely as possible, but I need to be always ready to perform when it decides not to. That’s my job.

BluSdUp
6th Apr 2019, 12:47
NRK ,the Norwegian news , is now quoting Bjørn Ferm and Mentour Pilot that it was impossible to recover for the poor crew.
I feel somewhat sorry for Boeing.
What ever these two chaps have said, the news picks the part that makes most headlines!
Gone Fishing

Capn Bloggs
6th Apr 2019, 13:32
Derfred, one of the best posts I've read on Prune for a while. :ok:

NRK ,the Norwegian news , is now quoting Bjørn Ferm and Mentour Pilot that it was impossible to recover for the poor crew.
If only... they'd kept trimming back after they switched the stab trim back on... if only. RIP you poor fellows.

werbil
6th Apr 2019, 15:11
I’m certainly not prepared to just throw my hands in the air and say “this was unsurvivable”. In fact, I put to any professional 737MAX pilot: if you studied the Lion Air preliminary report, you should have been well prepared for this event - it should not have been startle factor at all. If, in fact, you didn’t study the report and arm-chair fly it so as to be so-prepared, then maybe this isn’t the job for you.

I'd delete the maybe. In this industry it's what you don't know you don't know that'll come out and bite you. Seeking knowledge beyond the training provided can provide that last line of defense to prevent catastrophe.

alf5071h
6th Apr 2019, 16:35
Derfred, Bloggs,

See post https://www.pprune.org/10440231-post27.html and previous via links; particularly https://www.pprune.org/10439906-post.html

Unsurvivable - at some point in time; probability after selecting stab trim off !

And that using yoke elect trim before that would loose the battle with MCAS 10 to 5 against; or that using manual wheel trim after that point, the single crew member might be unable to restore trim to an acceptable stick force to enable the other pilot to control altitude and speed whilst stick forces increase and trim is even less effective.

Startle - nothing worse than following procedures and finding that they don’t work !

The line which the industry has crossed, as in this accident, is the assumption that pilots will always be able to manage … ,
………………………………………………………but only with hindsight

GordonR_Cape
6th Apr 2019, 19:02
NRK ,the Norwegian news , is now quoting Bjørn Ferm and Mentour Pilot that it was impossible to recover for the poor crew.

Every situation is recoverable up to a certain point. The question of what stage of the flight it was, which may be grounds for legal arguments.

These results should not have any bearing on the future safety of the MAX, since MCAS should never cause that fault again. Whether it is relevant to runaway stabiliser trim, and apply to the existing NG models, is a deeper issue.

alf5071h
The line which the industry has crossed, as in this accident, is the assumption that pilots will always be able to manage … ,
………………………………………………………but only with hindsight


IMO, the line that was crossed, was testing a new system (software and pilot backup), by continuing to put lives at risk after the first crash.

Water pilot
7th Apr 2019, 03:23
This is possibly another naiive question, but is it even possible for a MAX at the high AOA for which MCAS was designed to detect to approach maximum airspeed? What is the scenario where you can actually pull yourself into a stall at this speed, and would any non-suicidal pilot try it? There should have been some sort of "sanity" cut out in the design -- keep in mind that the Captain's airspeed was reporting as even higher than the actual speed. Was there any speed limit, or would MCAS have activated at a speed that would have torn off the stabilizer?

I have a very strong feeling that the designers of the MCAS programming had no idea of the effect of speed upon the forces required to move the stabilizer trim, indicated by the fact that they slightly changed the algorithm to account for speed sometime during the certification process.

Water pilot
7th Apr 2019, 04:12
The question of what stage of the flight it was, which may be grounds for legal arguments.
I doubt there is going to be much in the way of legal arguments on this one, Boeing does not want to be anywhere near a jury. You can talk about the pilot's actions all that you want to, but ultimately you have two aircraft that were pointed to the ground at low altitude by a flight control system that was not disclosed to the pilots and that was (according to media reports) significantly different than the certification documentation described. Add in the cosy relationship with the FAA along with the whistleblower report and this is not something that goes to trial if Boeing has any competent lawyers left.

I am not a lawyer, but I don't think you ever want to be in a civil trial where the jury is wondering why the executives are not in jail yet.

GordonR_Cape
7th Apr 2019, 07:17
I doubt there is going to be much in the way of legal arguments on this one, Boeing does not want to be anywhere near a jury. You can talk about the pilot's actions all that you want to, but ultimately you have two aircraft that were pointed to the ground at low altitude by a flight control system that was not disclosed to the pilots and that was (according to media reports) significantly different than the certification documentation described. Add in the cosy relationship with the FAA along with the whistleblower report and this is not something that goes to trial if Boeing has any competent lawyers left.

I am not a lawyer, but I don't think you ever want to be in a civil trial where the jury is wondering why the executives are not in jail yet.

Wow, best comment I have read this week! A good antidote to the trolls questioning the actions of the '3rd world' pilots. I'm glad my 'dumb' question elicited such a response.

Mansfield
7th Apr 2019, 14:41
SafetyPee, with respect to the erroneous angle of attack issue that I assigned elephant in the room status too…my thinking is that we have two airplanes, and three AoA vanes, all on the left side, that have generated faulty data in a very short fleet history. My concern is that there is a problem in either the hardware or software that is processing the AoA inputs. As the NG does not, to my knowledge, have an extensive history of this, I have to wonder what else is different in the air data systems of the Max, and how changes in design at that location may also have been poorly vetted...which of course leads to lots of other questions about the design process.

There is no doubt that Boeing’s MCAS stability augmentation idea has failed miserably. It is another case of a safety system introducing more risk than it was installed to prevent. The unscheduled operation of this system , particularly as it was modified following flight test (from 0.6 degrees per actuation to 2.5 degrees), introduces a very serious threat that clearly was not contemplated by the system safety analysis. Further, Boeing’s contention that the runaway stabilizer procedure is an adequate mitigation of this threat is not valid. Since the 707, Boeing aircraft have incorporated cutout switches in the control column designed to interrupt the pitch trim system if it is trimming in the opposite direction to which the pilot is pushing or pulling. These switches are intended to stop the system from moving the horizontal stabilizer too far until the pilot has the time to manually disable the system entirely. The MCAS bypassed these switches, which is a logical design when looked at solely from the purpose of the MCAS itself. Since MCAS is intended to increase the control force as the angle of attack approaches the stall, it doesn’t make much sense to allow MCAS to be cut out as the pilot inadvertently pulls the nose up toward that stalling angle.

But when looked at from the standpoint of the threats posed by a powerful stabilizer running away at high airspeed, this design is absurd. And since the first step in the runaway stabilizer procedure is to hold the control column firmly, thus utilizing those column cutout switches to inhibit further trimming, the risk mitigation assured by that procedure is severely diminished.

That all said, Muillenberg was appropriately diplomatic when he said that Boeing owns one link in the chain, but not the whole chain.

When crew of ET-302 lifted the airplane off the runway at Addis Ababa, the first thing that happened was the captain’s stick shaker activated. This is pretty much the same thing that happened to LNI610, the Lion Air flight that crashed on Oct 29, and LNI043, the flight to Jakarta on Oct 28 . It may well have occurred to that airplane on Oct 26 and 27 as well. The crew operating LNI043 did not record the stick shaker operation in the aircraft maintenance log; perhaps others did not as well.

The captain of LNI043 was able to ascertain pretty quickly that the left side instruments were unreliable by comparing with the standby flight instruments. The crew of LNI610, on the other hand, did not believe they had any reliable altitude information, and asked ATC for groundspeed information. To date, I have not seen any information regarding discussion on the ET-302 flight deck about standby instruments, or comparisons between left and right instruments.

The captain of LNI043 retracted the flaps after he had determined which instruments were malfunctioning, and he had verified the airspeed. In the ET-302 case, that does not appear to have happened; instead, it looks to me like they retracted the flaps because they were task saturated and clinging to normal procedure.

The ET-302 crew did not comply with the Boeing procedure for a runaway stabilizer. As far as I can tell, no one actioned any item on the procedure except the most important step, disabling the master trim cutout switches. The procedure calls for the autopilot and autothrottles to be turned off. This crew made several attempts early on to get the autopilot engaged; it finally engaged and then disengaged itself 33 seconds later. They selected level change and set the speed to 238 knots. No one ever made any attempt to actually control the airspeed. My hunch is that they assumed the autothrottle would control the airspeed, which is a pretty standard response for automation-dependent flight crew. However, level change controls the airspeed with pitch; without being able to get the nose up, the airspeed is headed for the barber pole.

If they still had 238 knots in the MCP window and were actually doing well over 300, the FD command bar was probably pasted to the top of the PFD; that may be what the captain meant when he said the “pitch is not enough”. I can’t see any other reason. They were climbing. In the final 3 minutes, with the pitch trim selected off, they had climbed about 4000 feet.

It appears that the first officer attempted to crank the manual trim wheel after they had shut off the electric trim system. Only eight seconds after the captain told him to try the manual trim, the first officer reported that it wasn’t working. It is impossible to know exactly how he reached that conclusion; at the speed they were moving at, I’m pretty sure the trim would have been difficult to move. I’m skeptical toward the claim that it was impossible to move; I would be more inclined to believe that if the first officer had said more or taken more time attempting to crank the wheel. The two ANU trim inputs shortly before the end indicate that a) the master trim switches were back on, and b) the trim motor was capable of moving the stabilizer. I really don’t know whether the manual trim can be frozen while the trim motor still works, but I suspect it would be the other way around. Bear in mind that it takes a couple of dozen revolutions of the manual wheel to make a dent in the nose down trim forces. I’d certainly love to see some flight test data on this…my visit to recurrent training next month will be interesting and possibly colorful.

I really don’t know whether the captain knew that the master trim switches had been selected back on. Prior to this, the captain had successfully countered MCAS inputs with nose up electric trim, just as the Lion Air captain did. When the MCAS operates the final time, the captain does not appear to attempt to counter it with the electric trim switches. I cannot help wondering if he still believed the electric trim was off; if so, he may have thought there was nothing he could do except try to pull up with the elevator control.

We have what appear to be three flights with very, very similar attributes. The crew of LNI043 managed to resolve the entire problem, even without knowing of the existence of MCAS (possibly with help from the jumpseater). They resolved it so successfully that they flew all the way to Jakarta with the autopilot off and manually trimming. They then failed to accurately record all of the faults (like the stick shaker) in the AML, a fact they will have to live with for the rest of their lives. The crew of ET-302 knew about MCAS, disabled it, and were still unable to get the situation under control…despite gaining what appears to be adequate altitude.

I suspect that there are huge issues of automation dependency, systems knowledge (standby instruments), and workplace cultural issues (repetitive writeups that are not resolved and turn out to be incomplete) in play here.

GordonR_Cape
7th Apr 2019, 15:17
Mansfield
The two ANU trim inputs shortly before the end indicate that a) the master trim switches were back on, and b) the trim motor was capable of moving the stabilizer. I really don’t know whether the manual trim can be frozen while the trim motor still works, but I suspect it would be the other way around.

Just a minor technical point. If a heavily loaded jackscrew cannot move in the nose up direction, that does not mean it cannot move in the nose down direction. Consider the case of a scissors jack under a heavy vehicle, and you get the picture.

lomapaseo
7th Apr 2019, 16:12
Mansfield


Just a minor technical point. If a heavily loaded jackscrew cannot move in the nose up direction, that does not mean it cannot move in the nose down direction. Consider the case of a scissors jack under a heavy vehicle, and you get the picture.

Depends on how it is loaded. Are we talking a single sided piston or an electric motor that reacts the load?

DaveReidUK
7th Apr 2019, 16:44
Depends on how it is loaded. Are we talking a single sided piston or an electric motor that reacts the load?

737 stab trim motor:

https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/605x459/stab_trim_motor_b1b99128b9f17f65ff7608188fbb1e2c71828f95.jpg

No hydraulics involved.

Mansfield
7th Apr 2019, 16:50
Mansfield


Just a minor technical point. If a heavily loaded jackscrew cannot move in the nose up direction, that does not mean it cannot move in the nose down direction. Consider the case of a scissors jack under a heavy vehicle, and you get the picture.

Agree. The two data points I am referring to are, I believe, ANU inputs from the yoke switches. So the motor could...apparently...move the stabilizer nose up against the load being applied by the elevator/stabilizer combination. That's certainly not conclusive, but it is suggestive.

safetypee
7th Apr 2019, 17:55
Mansfield, #42,
Your points about the AoA vane are well made. However for the complete picture it would be necessary to compare vane failure ‘rates’ between NG and MAX. Short of that, 3 failures so early in a new aircraft’s life is suspicious, but not beyond probability.
Whilst the weight of evidence points towards the vane, we should not forget wiring.

As for crew procedures, the use of the trim runaway drill was a hasty response to an accident. With hindsight it appears very inadequate, e.g. use of autopilot, which is very important for trim runaway, but less so for MCAS.

We should not blame crews for not following any checklist, for as much as the industry overly depends on crews being able to manage ‘all’ abnormal situations, so too that they will follow procedures - a grossly misused assumption.
For the human factors (cognitive) aspects, because we cannot know what the crew perceived and deduced, all that should be concluded is that a crew acted as they saw the situation at that time, with all of the confusing inputs, alerts and distractions, which now ‘we’ cannot comprehend - thats our limitation not the crew’s.

There is growing weight of argument that with trim already offset, then neither electric or wheel will be effective - speed dependant, note the ‘equivalent safety case’.

A simplified overview of the situation / dilemma (with hindsight) - from alf above.
With incorrect MACAS operation using yoke trim before selecting trim cutout would loose the battle with MCAS 10 to 5 against (misleading procedure - ‘can be used’).
Using manual trim wheel after trim cutout, then the (one) pilot might be unable to restore trim to give an acceptable stick force for the other pilot, as speed and trim ineffectiveness increase.
Thus there is a finely balanced point where cutout is used and aircraft trim can be recovered, or after cutout it is unlikely that the aircraft can be controlled. The first Lion flight was the ‘right’ side of the line - three crew, the second Lion flight understandably not so.

Others have argued a range of scenarios for switching and trim operation re fdr; we don’t know, we might only deduce. The important aspect for aircraft control is what the tail did, not that a switch was operated.

Re crews’ recording technical issues; this could be influenced by the widely used electronic log and self test - are there manufacturer’s recommendations re this (or sales pitch); compare with other operators.

I would not oppose your final suspicions, but suggest that they might better be phrased as a worldwide industry issue, and less interpretable as applying to particular operators.

oggers
7th Apr 2019, 18:03
The stabiliser responded normally to the captains manual (electric) trim ANU just a gnats cock below VMO (just before the stab trim was selected to cutout). So the motor would seem to be equal to the task.

Intruder
7th Apr 2019, 20:34
I think your assertion contains several logical inconsistencies:
1. The momentary trim inputs may be an artifact of the FDR data sampling algorithm, or the crew stopped trying when the trim wheels didn't turn after a few seconds. We don't really know for sure, and IMO you can't build an argument on such evidence.
2. The recorded increase in the stabiliser ANU position may also be a data artifact, or backlash in the cables and pulleys, or the trim motor locking mechanism. There are a number of suggestions from other sources (including EASA), that what you describe is physically impossible at high airspeeds and aerodynamic loads.
3. Re-enabling the trim switches after runaway trim, is not documented in any procedure, so cannot count towards the certification process. They could re-write the procedures, but currently it seems to fail certification under those extreme conditions.1. Not so. Every time they used the yoke trim switches from 5:38 (takeoff) through 5:41, the trim responded as it should have. IMO, the Pilot Flying did not use enough trim to restore an in-trim condition, even though he had the ability if he had tried.

2. The move between 2.1 and 2.3 when the trim was disabled certainly may be any of those. I doubt it would have had a significant effect at normal airspeeds, but was exacerbated near VMO.

3. Again, I disagree with you. They re-enabled the trim, but did NOT attempt to use the yoke trim switches after doing so! In similar dire straits I may have re-enabled the trim, but NOT until after I had the yoke trim switches held in the ANU position. If the trim did not IMMEDIATELY begin to go toward ANU, I would have cut out the trim again.

Mansfield
7th Apr 2019, 20:45
As I mentioned earlier, I have to wonder whether the Ethiopian captain knew the trim had been reinstated. No way to really know unless the CVR transcript has more evidence. Regarding reinstating the trim cutoff switches, the captain of LNI043 did just what you said; he turned them back on, noted a trim moving toward AND, and shut them off again...permanently.

infrequentflyer789
7th Apr 2019, 20:56
I have a very strong feeling that the designers of the MCAS programming had no idea of the effect of speed upon the forces required to move the stabilizer trim, indicated by the fact that they slightly changed the algorithm to account for speed sometime during the certification process.

Not sure on that, might not even have been the same people. If what we have heard on this site is true, MCAS was originally designed and implemented only for high mach numbers (and possibly documented - some sites show Boeing documentation stating: "The MCAS only operates at extreme high speed pitch up conditions that are outside the normal operating envelope.").

The original designers may have done calculations for high speed and less trim authority and found it was ok.

The "extreme high speed" regime is probably also the reason why MCAS apparently has no altitude dependency, since as-designed it would only engage at high altitude. Erroneous activation at low alt is clearly more hazardous, but possibility of AOA and IAS failing high, to give erroneous activation at low alt, might be suitably remote (despite the slight dependency in the ADIRU).

Later on in flight testing, a problem was found at low mach as well, so someone decided it should activate there (and therefore possibly at low alt), and with much more authority. That change quite possibly didn't require code changes, just configuration data. The sort of change you can get an "intern" to do... in fact the more junior the team member you can find the better - junior staff tend to bend awfully (and understandably) easily when leaned on from on high.

Did they redo the entire safety case for the new activation regime and authority levels and then just "forget" to update the certification documents, or did they "forget" to update a lot more than the cert docs? Did they just decide that the late discovery that the dynamite packing cases had a few screws missing wasn't a problem because they had a fully certified hammer, they'd just have to hit them a bit harder?