Indonesian aircraft missing off Jakarta

[Volume]

the oh-so-pilot-friendly-and-simple-and-manual 737 doesn't pass pitch stability certification criteria

Maybe the 737-100 did pass the criteria of the 60s... At least for gliders I definitely know that the required stick forces were increased in the late 70s, so the earlier ones had significantly lower stick force gradients than current types. Same may be true for transport aircraft, so maybe boeing added this feature for the NG... Maybe even voluntarily, to meet the latest standards.

Why would they authorise aircraft clearance to fly when the problem never went away after fitting the new sensor .

Well, the just learned during flight that the problem was not solved... Normal for issues not reproducible on ground. You troubleshoot per the manual and see whether the problem is solved during the next flight.

[threemiles]

Originally Posted by DaveReidUK

You're not making sense. No, of course it isn't about that. By definition you can't "try to let something emerge" if you don't know it exists.

But it happens. If you're suggesting, as you seem to be, that certification doesn't involve flight testing, that's clearly nonsense.

Flight Test Guide for Certification of Transport Category Airplanes - FAA

We are not on the same page here. You are talking about flight tests, which verify a design . I am talking about certification of an aircraft system. These are two different baskets. This accident is related to an aircraft system, most likely ATA 22 in conjunction with ATA 27. It is the first and most important task of certification of a new design that you find out what COULD happen and what you possibly don't know and have never seen before. There are very structured approaches and tools to do this.

But in reality 90% of the preparation work for certification is done by the OEMs. Today's systems are much too complex that a FAA or EASA task force can review and understand entire new technology system designs without any help. Help in this business is also about liability and tends to be biased. Not mentioning the enormous time pressure to get the first delivery out and cash in.

Been there, done that for 25 years.

[threemiles]

Originally Posted by GarageYears

And



I'm a little bothered here. I truly believe most here are smart and understand systems analysis at least enough to comprehend what the Boeing AD is telling us here, but the statements above have me frowning. Is this really so confusing?

Boeing states that a failure of an AOA sensor can cause the AP to kick off or not be select-able in the first place if the AOA was already iffy. So let's assume that happened here. The crew took off things seemed fine, but once in the air they either engaged the AP which then dropped out, or were unable to engage the AP due to AOA disagreement. So no automatics. The AD is referring to stabilizer trim under control of the flight control computer, which with an iffy AOA input will cause nose down trim to be applied in increments lasting up to 10 seconds, while in manual flight.

They HAVE TO BE in manual because the very condition the AD refers to disables the autopilot.

So, no more "if only they turned on the AP", right?

- GY

You should not be bothered. Language in aviation in general, SBs and ADs in particular, is safety critical and should be clear, not contradictory and unambigious. This sentence MAY mean what you say, but it needs interpretation and twice thinking about it. This is bad and typical for lawyers. Boeing should know how to do better.

[bsieker]

Originally Posted by threemiles

You should not be bothered. Language in aviation in general, SBs and ADs in particular, is safety critical and should be clear, not contradictory and unambigious. This sentence MAY mean what you say, but it needs interpretation and twice thinking about it. This is bad and typical for lawyers. Boeing should know how to do better.

We should keep in mind that this is an Emergency Airworthiness Directive. The point here is to get what is perceived to be critical information out to the operators as fast as possible. In the course of doing so they make sure that the contents are correct and pertinent, but it may err on the side of caution. There may not have been time to verify that it is always true that the autopilot disconnects in all conditions leading to the autotrim continuing to trim nose-down, so it says that it may disengage or cannot be engaged, and "autopilot off" is part of the procedure. There is nothing very unusual about this E-AD.

And to those complaing that they are trying to fix the human to conform to the defective machine, again this is a temporary measure, it contains some element of CYA, but it is also probably the best that can be done on a few days' notice.

After a thorough investigation, a technical fix may follow, but this takes a long time in the aviation industry to make sure that the fix actually improves overall safety, and not just fixes this particular instance of a problem, while exacerbating other problems (such as weakening the stall-"prevention" function of the nose-down trim when air data is accurate or when the higher-reading AoA input is actually correct and stall is impending.)

What worries me a bit more is the sentence

[...] set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?


Bernd

[hans brinker]

Originally Posted by Union Jack

....and thank you, Hans Brinker, for the unintended consequence of highlighting Gums's outstanding record!

Jack appreciates.....

What I (quite unsuccessfully apparently) tried to say was that gums use of the words opines/salute/suggest took away (for ME) from his opinion, not that his opinion took anything from the thread. I think part of the Dutch way of talking is always be direct to the point of impolite, so that doesn't help....

[Organfreak]

Hans Brinker, I've been reading Gums' posts for years, and it's just a part of having a personality on the group, which is otherwise difficult. It's all part of the "fun" here.

[JulioLS]

These things are always multi-factorial... You can blame the mechanics for not fixing the problem.... You can blame the pilots for not following the right procedure.... But really there is only one party here to blame. And that is Boeing.....

They designed a crazy system, as if the AoA sensor is god and the pilot is stupid.... So no matter what the pilot does (apart from turning the damn thing off), the system will repeatedly drive you into the sea.....

Yes you can blame the mechanics. Yes you can blame the pilots. But at the end if the day, it is Boeing that thinks the AoA sensor has more authority than the pilot......... And that, in my book, is pretty bloody stupid......

[alph2z]

Originally Posted by bsieker

... What worries me a bit more is the sentence

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?

Bernd

On the cockpit panel probably these are not circuit breakers but rather switches. The switches on the CUTOUT control panel send a signal to the Trim computer in the electronics bay and then to HS horizontal stabilizer electronics and motors. Any hardware and software failures between the CUTOFF switch and the HS may cause the problem. They probably don't have all the facts yet and are very cautious. The HS TRIM circuit breaker is probably hard to find and pull during an emergency.

But, them having to hold the trim wheel is scary; especially during an emergency where the problem is not fully known !

[JulioLS]

Originally Posted by CurtainTwitcher

So a plausible scenario for the crew faced based on the Boeing Bulletin is:

• At or soon after rotate, so message like "IAS disagree", possibly other messages and warnings, possibly even stick shaker.
• Manually flying so no autopilot to drop out.
• As they are manually flying, and trimming, the runaway stabilizer fault is masked and dealing with the unreliable airspeed.
• Probably running the unreliable airspeed memory items
• After not trimming for 5 seconds, STS trims nose down, PF counteracts with nose up pitch and trimmed, runaway trim is masked for 5 seconds.
• As they are solving the UA checklist, speed is increasing, air loads on horizontal stabilzer increase.
• A series of sequences of manual trim, 5 sec delay, then runaway stab, manual pitch up and trim, ratcheting down the stabilizer, pilots compensate with
• Eventually the speed increases and air load becomes so large, that both pilots are unable to overcome the nose down stabilizer trim all the way forward becoming unrecoverable as there is a further rapid increase in speed.

Basically in this type of scenario, the crew are confronted with an intermittent runaway stabilizer in addition to a UA. This intermittency is a difficult problem to nut out in the cacophony of noise and confusion of an unreliable airspeed scenario. Ironically, it may be possible they may of actually had three valid IAS indications, in close agreement, further heightening the confusion.

This is pretty much the scenario that I imagine... pilots to busy with UA and UAS to notice the runaway h stab till its too late. Elevators are never going to win against the h stab at the stop.....

[JulioLS]

Originally Posted by alph2z

On the cockpit panel probably these are not circuit breakers but rather switches. The switches on the CUTOUT control panel send a signal to the Trim computer in the electronics bay and then to HS horizontal stabilizer electronics and motors. Any hardware and software failures between the CUTOFF switch and the HS may cause the problem. They probably don't have all the facts yet and are very cautious. The HS TRIM circuit breaker is probably hard to find and pull during an emergency.

But, them saying to hold the trim wheel is scary !

All Boeing pilots should bring a walking stick... to shove in the trim wheel when the h stab goes runaway!!!

[CaptainMongo]

Originally Posted by Bergerie1

Bleve,

And my belief is that when the crew started to fly manually they might well have found themselves having to cope with the 'yo-yo' manoeuvres described by Centaurus in a previous post (I quote him in italics below) while perhaps also being distracted by multiple warnings as described in the recent Boeing bulletin.

"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming."

To relieve airloads, the crew must momentarily release all backward pressure on the elevator then rapidly wind the stabilizer trim backwards manually or electrically. In turn, this allows more effective elevator control. In other words, a yo-yo manoeuvre. The crew needed to react instantly and correctly to relieve air loads in this manner. Unfortunately, the Lion Air crew did not have the altitude to successfully recover before impact.

If that was the case, I wonder how well many of us would have coped in that situation.

and with the trim rolling forward in 10 second increments, could not have the stab finally reached a point where it applied a force downward which the elevator could no longer counter act?

[WillFlyForCheese]

So - we have the same aircraft exhibit what appears to be the same problem on 4 separate flights - within a few days of each other. On each of the other flights - the folks in the pointy end were able to successfully control the aircraft. Why and how? What was different about this flight on this day that made whatever happened result in a different outcome? It will be interesting to hear what the pilots on the previous flights have to say about what was going on - unless they find the CVR (seems odd it's not been found yet) - those folks might be the best source of info on what they were experiencing.

Aside from all of that - I am still in amazement that the airline left this aircraft in service given the problems on the prior 3 legs.

Has anyone seen comments from the pilots of JT43?

[phil gollin]

.

Normally by this time in a crash thread someone chirps up and says - well I had some time in a simulator today and ..........

No one done that yet ?

(Also, I agree about the lack of CVR yet)

.

[QDM360]

Originally Posted by bsieker

I'm not that closely familiar with 737MAX systems, but how can the trim still run away if the switches have been set to "CUTOUT"? Aren't they mechanical circuit breakers?

There could be other defects. Like a short circuit/loose wire which accidentally powers the electric trim motor. Or an incorrectly installed wiring. One never knows what could happen. That's why, when everything else fails, you can still grab and hold the trim wheels as a last resort.

[GarageYears]

Anyone got access to a MAX FFS?

Originally Posted by phil gollin

.

Normally by this time in a crash thread someone chirps up and says - well I had some time in a simulator today and ..........

No one done that yet ?

(Also, I agree about the lack of CVR yet)

.

I've tried to point out that with the MAX, all Level D FFS simulators will be using a binary supplied by Boeing that encapsulates pretty much the entire simulation - this binary is essentially the rehosted avionics, flight control computers, AP, and models for all the systems and flight characteristics AND importantly provides all the supported malfunctions that the instructor/lesson plan system has available.

This malfunction list will include malfunctions that have traditionally been used for this aircraft type, and whatever new ones Boeing deemed useful//required.

However, it seems (based on the Boeing E-AD) that the insidious uses of AOA in the flight control computer and subsequent trim behavior when the AOA signal goes wonky was not something anyone really saw coming. My bet is any flight sim out there doesn't provide an AOA 'wonky' malfunction, and hence would be unable to replicate this crash. Maybe I'm wrong, but the way current generation flight simulators are put together relies almost wholly on the aircraft manufacturer for things like this now.

- GY

[Ian W]

Originally Posted by alf5071h

edmund #876, gums,
“ … reluctance in the industry to realistically quantify the expectation that a crew will be able to follow a recovery procedure.”
Not only the reluctance, the inability to quantify due to the inherent unpredictable human condition, because activity is heavily biased perception - the event at the time, etc, etc.

The industry increasingly appears to favour using a model of how technology works, or should work, (tech / certification), but when events show otherwise then instead of updating the model and changing the system the industry looks to ‘change the human’ - to match (mitigate) the errant tech model with more training.
We cannot expect pilots to manage technical failures in real time which are difficult to define in design or check in certification, or those which exceed the certification requirements (25.1302).

The interim procedure (AD) is full of assumptions. The background information frames the situation explaining the need for a new drill based on encountering an un-commanded nose down change of trim - education, training, simulation, (would a simulation show all of the other distracting features, or just a change in trim).

However, the inflight reality in manual flight (flaps up ?), the PF (failed side) could be more concerned by the stick shaker and speed indications, and distracting system alerts. Detecting a trim malfunction depends on a change in stick force (perhaps initially relating this to elevator opposed to trim). Potential for confusion, selecting an inappropriate drill / recovery action, etc, …

Conversely if the failure is on the PNF side, then further confusion - “what are you doing” CRM communication - totally different situations depending on displayed information, (no stick force), may choose unrelated checklist - UAS; incorrect mindset, difficult to change. (Similar to the Swedish CRJ)
Add surprise and continuing startle effect because of the apparent inability to control the aircraft or that the initial action did not work - where next …
The AD like the tech system is based on the same model; it assumes that the pilot will manage. (an assumption also seen in AF447, 20+ preceding events, AMS 737, ‘there is a drill for that’ - at higher altitudes)
………………

Oh, … and without AoA failure, inadvertently approaching a stall, - stick shake, low seed awareness, change in stick force (STS), misdiagnosed as a trim malfunction (salience of recent events), might a crew ‘inadvertently’ pull up, disconnect trim, etc, stalling the aircraft.
Little consideration of the human condition, their limitations in performance related to understanding of the situation; how we make sense of situations, in real time; AD - an assumption too far.

It is necessary to go back to the principle of FMC/FMS and avionics design. There are pilots on board and the FMC/FMS avionics is intended to make their life simpler. There is a significant cost in coding to deal with every potential error. So the design principle is that the automatics will be coded to field the basic well understood errors however as soon as it becomes complicated, - the 'otherwise case' - in the last resort the automatics hand the bag of bolts to the crew. The crew are expected to carry out the fault finding and correction using a set of checklists and if all else fails, their own innate capabilities as pilots to recover from the 'otherwise case'.

If the AD is considered in this light it is right along the line of the design principle. FMC cannot cope with differing angle of attack indications so passes bag of bolts to pilot. The pilots in this instance were not able to fly out of the problem. So the AD emphasizes the correct checks and operations to be used if this otherwise case occurs again. If the design principles are changed (and they are slowly changing) eventually the 'otherwise cases' the automatics cannot handle become extremely unlikely; and perhaps pilots will not be needed as the automatics will not drop out.

[Smott999]

Originally Posted by rideforever

Correct me if I am wrong, but the pilot should "know" the manual flight is not fully activated until you pull the cutouts for the stabilisers.
And so when reverting to manual that includes switching off the stabilisers (and whatever else).
As for holding the stabiliser wheel by hand, you should practice that, and during peacetime, so you are fully confident.

Auroperu 603 : pilots had restored control earlier on ... but then they tried to reengaged the AP ... why ?
Because they were trying to "fix" the problems in the air, rather than landing the plane.
Same thing with Lion Air, they wanted to fix their technical problems whilst in the air with passengers on board.

Thinking off the cuff :
If you hang a necklace around the sunvisors, that gives you a plumb line.
And if you throttle the engines independently can give you a sense of whether they are functioning properly and trust the throttle indicators.
Altitude : there seems to a radio altitude in some aircraft; ATC altitude might actually be originating from your own system's telemetry have to be sure if it is independent

Pilots May have thought STS was automatically disabled due to their increased speed. If what has been posted here is correct, prior versions had various activation triggers amongst which was low speed. Not higher speed, which they had invoked.
The MAX (it seems) is now adding AoA Disagree as a trigger. Did pilots know this ?

Is it Possible the pilots thought, given their increased speed, HAL would not mess w their stabilizer?

Yet another reason why what was actually happening was not something they imagined?

[sSquares]

Originally Posted by Ian W

It is necessary to go back to the principle of FMC/FMS and avionics design. There are pilots on board and the FMC/FMS avionics is intended to make their life simpler. There is a significant cost in coding to deal with every potential error. So the design principle is that the automatics will be coded to field the basic well understood errors however as soon as it becomes complicated, - the 'otherwise case' - in the last resort the automatics hand the bag of bolts to the crew. The crew are expected to carry out the fault finding and correction using a set of checklists and if all else fails, their own innate capabilities as pilots to recover from the 'otherwise case'.

Originally Posted by Ian W

If the AD is considered in this light it is right along the line of the design principle. FMC cannot cope with differing angle of attack indications so passes bag of bolts to pilot. The pilots in this instance were not able to fly out of the problem. So the AD emphasizes the correct checks and operations to be used if this otherwise case occurs again. If the design principles are changed (and they are slowly changing) eventually the 'otherwise cases' the automatics cannot handle become extremely unlikely; and perhaps pilots will not be needed as the automatics will not drop out.

​​​​​​It is becoming clear that the avionics should hand a plane to the pilot in a stable and best possible state to fly. For each FL, this should be possible. FL should be simple to determine from multiple sources.

The focus should be to stabilise the situation and to give the pointy end the maximum time to fly the thing in the state that it is in.

Giving the thing to the pilots in a dynamic state, with a known outcome of self-destruction is madness.

[Vessbot]

Originally Posted by sSquares

​​​​​​It is becoming clear that the avionics should hand a plane to the pilot in a stable and best possible state to fly. For each FL, this should be possible. FL should be simple to determine from multiple sources.

The focus should be to stabilise the situation and to give the pointy end the maximum time to fly the thing in the state that it is in.

Giving the thing to the pilots in a dynamic state, with a know outcome of self-destruction is madness.

That's a self-defeating argument. The reason the avionics are handing the plane to the pilot is because they're unable to maintain that control by themselves. If they had enough ability to fly the plane, they wouldn't be handing it to the crew in the first place.

[Smott999]

China 06

Originally Posted by Vessbot

That's a self-defeating argument. The reason the avionics are handing the plane to the pilot is because they're unable to maintain that control by themselves. If they had enough ability to fly the plane, they wouldn't be handing it to the crew in the first place.

China 6 is a good example of that. AP did it’s best w slowly increasing control surface (rudder IIRC) inputs until it gave up.
Handing over the plane to the pilots in a sharply descending right turn which they did not immediately recover from.