Indonesian aircraft missing off Jakarta

[climber314]

Originally Posted by DaveReidUK

Provided that, at 0.27 degrees per second, it is allowed to run uninterrupted for a tad over 9 seconds.

The design seems to fail "on" by which I mean to say a bad sensor is able to trigger the software to continue to say "Nosedown" to MCAS. This seems to be opposite to conventional wisdom where a device is designed to fail "safe" or in other words say to MCAS "do nothing". That's my understanding at this point.

Pretty simple to program if AoA = disagree then MCAS = off. That may be simplistic but may well be something like what Boeing is considering? Whether this or something else they come up with meets certification requirements is yet to be seen.

Exclusive: Boeing eyes Lion Air crash software upgrade in 6-8 weeks
https://www.reuters.com/article/us-i...-idUSKCN1NZ00S

[LDRA]

Originally Posted by Mad (Flt) Scientist

It's two subtly but significantly different statements.

that attributed to Boeing - "pilots weren’t ever likely to encounter" sounds like the kind of wording used in failures assessment guidance. (I suspect if I dug deep enough i could find it verbatim in guidance somewhere) On the other hand, "it'll never happen" is not the kind of statement any certification engineer would ever be capable of or comfortable making, and I'm guessing it's a paraphrasing (with a dollop of simplification) of the former statement.

Fair enough. But if they actually did failure analysis and quantified failure rates properly, like they are supposed to, it would have been glaring obvious the "unintended activation" has a high occurrence rate, and a single point failure at that.

[jimtx]

Originally Posted by LDRA

Disturbing statement, shows lack of safety culture and lack of understanding of how safety works.

If the safety system will never be used, why develop and install in production aircraft in first place?

What would be interesting to know is how a Brazilian Max operator, GOL, implemented the type B training and checking for the MCAS system and what their pilots were told about the system.

[Mad (Flt) Scientist]

Originally Posted by LDRA

Fair enough. But if they actually did failure analysis and quantified failure rates properly, like they are supposed to, it would have been glaring obvious the "unintended activation" has a high occurrence rate, and a single point failure at that.

Even assuming you did that - and I am sure they did do the corresponding analysis, we can argue about "properly" - you'd still be left with determining the hazard classification.

I rather believe that faced with a similar failure scenario - low speed limited authority "uncommanded motion" of the stab (it's commanded, but not in the circumstances truly intended) - with the pre-existing ability to disable the system and a pre-existing procedure which would address the runaway case (if somehow it repeated) then that would probably be classified as no more than a MAJOR hazard. In other words, I strongly suspect (and this may be an unpopular view) that the system as has been presented in public information is perfectly certifiable, and I suspect analogies could be found on other aircraft.

[LDRA]

Originally Posted by Mad (Flt) Scientist

Even assuming you did that - and I am sure they did do the corresponding analysis, we can argue about "properly" - you'd still be left with determining the hazard classification.

I rather believe that faced with a similar failure scenario - low speed limited authority "uncommanded motion" of the stab (it's commanded, but not in the circumstances truly intended) - with the pre-existing ability to disable the system and a pre-existing procedure which would address the runaway case (if somehow it repeated) then that would probably be classified as no more than a MAJOR hazard. In other words, I strongly suspect (and this may be an unpopular view) that the system as has been presented in public information is perfectly certifiable, and I suspect analogies could be found on other aircraft.

Agreed, except "pre-existing procedure" implies there are defined criteria for DETECTING failure condition, which does not exist before the FAA AD came out. Even with the FAA AD, the flight crew identifiable symptom is a large laundry list, which is not ideal.

Similiar system on 737, STS has its own warning lamp to properly indicate failure to flight crew, per FAR25.672a clause

[CurtainTwitcher]

I have a copy of the QRH Runaway Stabilizer NNC (my bold):

Condition: Uncommanded stabilizer trim movement occurs continuously

From the FDR traces, the failure mode does not appear at face value to meet the NNC condition statement. The adverse trim will stop for 5 seconds after pilot manual electric trim. This is an intermittent uncommanded trim mode, not continuous (as per NNC condition statement). Was this taken into account with the failure mode analysis?

In the failure mode analysis, would this condition statement be true for the single point failure (AoA signal) to be classified only as a major hazard, given that it could also generate an intermittent trim movement under some conditions (flaps up), continuous stick shaker AND UAS simultaneously.

In other words, with the design of this MCAS system, a single point failure has created a very complex scenario. Did Boeing actually consider the combined interactions of each of these outcomes in totality or individually when classifying the hazard? I would view the resultant accident as an indication of failure of the failure mode analysis. Why was the analysis flawed, that is the big question.

While you are contemplating this, try putting up with what this crew had to endure while they were trying to figure out what was going on.

[alf5071h]

CT, Good points about certification process. How might EASA have evaluated this; rubber stamp, or take an active interest in the specific changes ?

See the discussion re drills and training here :-
Indonesian aircraft missing off Jakarta

[b1lanc]

Originally Posted by jimtx

What would be interesting to know is how a Brazilian Max operator, GOL, implemented the type B training and checking for the MCAS system and what their pilots were told about the system.

And I'm still wondering why only Brazil? That information had to come from Boeing. Why not world-wide disto?

[MickG0105]

Originally Posted by Jetthrust

Hi Mick. I would suggest the difference in view is due to a difference in how you interpret the second last sentance, in the description of MCAS's operation. ...

Thanks for that summary. FCeng84 seems to have the inside dope on MCAS so I'll happily defer to his explanations. I would make a couple of points though:

1. Neither the FAA nor Boeing were particularly forthcoming in their initial correspondence to operators on this matter. Neither the FAA Emergency AD or the Boeing FCOM Bulletin mentioned MCAS. Boeing's bulletin simply stated that

'In the event of erroneous AOA data, the pitch trim system can trim the stabiliser nose down in increments lasting up to 10 seconds.'

That statement neatly sidesteps the fact that on the B737, AOA data had never previously been used to directly inform 'the pitch trim system'.

2. Having had at least another three days to come up with a clear description of MCAS the best that Boeing could manage was still somewhat ambiguous. What the subsequent Boeing correspondence fails to make clear is that:

a. In the absence of crew trim inputs, MCAS will only make one nose down trim adjustment of up to 2.5 units.

b. MCAS is apparently not interested in overcoming the attitude condition that triggered it - having made its initial nose down trim adjustment the trigger condition AOA can persist and (so long as there is no crew trim input) MCAS will do nothing further.

c. MCAS also apparently makes a subsequent nose up trim adjustment to return the stabiliser to the previously trimmed position.

3. Boeing fails to make it clear that a trigger for MCAS to continue trimming in more nose down trim is a countermand from the crew. Frankly, I think that is astounding. The system will ignore the persistence of the trigger condition after it makes its initial nose down trim adjustment but it will make a further nose down trim adjustment if the crew countermands it! Moreover, it will do that each and every time the crew countermands it. That is a very clear cut case of an automated system that is designed to override a specific crew command. To borrow an image from Gums, when the crew looks to wind off some of the automatically commanded nose down trim, HAL says, 'I'm afraid I can't allow that, Dave.'

[megan]

A top executive at a 737 MAX customer agreed pilots didn’t need to know the system’s details. “They’re not engineers and their job is to fly the aircraft,” this executive said."

And he probably has a new crop of pilots in training.

[rubik101]

What was wrong with the old system?

[Loose rivets]

Mr Cheese.

I see lots of folks assuming MCAS trims 2.5ND each time - but that's not what I get from the description of MCAS, which provides: Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers.

So - depending on speed and AoA, MCAS will trim up to 2.5ND - correct? Or - is there something else that confirms MCAS trimmed JT610 2.5ND repeatedly, and then continuously?

It's just that one letter that makes the difference. It suggests ". . . limited to 2.5 degrees each and are . . ." might be an improved wording.

[jimtx]

Originally Posted by rubik101

What was wrong with the old system?

The old system required you to roll into a 45 degree bank in the simulator and raise the nose the degree or two to maintain level flight, increasing the load factor, and either holding pressure or trimming it off while getting your instrument crosscheck warmed up. The new aerodynamics of the Max, if replicated in whatever simulator might have them, might allow you to roll into 45 degree bank and as you pulled , you might not have to pull anymore or pull less because the engines aero effect started pulling for you. What's wrong with that I don't know. If you have a good crosscheck you fly the attitude and performance instruments and do what ever it requires with the stick. If there is any other flight envelope where the old system would be deficient for the MAX and you needed the MCAS we don't know and Boeing isn't telling us but previous threads have hinted that a normal flight would never see it. This is all supposition by me wondering why steep (or step) turns were mentioned in the one of the Boeing blurbs.

[Volume]

Why did Boeing not fit a stick nudger as was done for the 747 on the British register?

Because the elevator alone seems to be not powerful enough, no matter whether the pilot or an actuator pushes it. Obviously nose down trim is required to create enough nose down pitching moment. Which does not speak for the design, but is typical for the late 50s, when most elevators were so small that no hydraulic power was required to operate it.
If the 737 MAX would be a clean sheet design, the horizontal stabilizer and elevator would for sure look differently.

Trim has always been a killer item requiring close attention and it will always be, even if now a box of chips and a bunch of sensors pays the attention. Having new aircraft designs without a trim wheel is unbelieveable for me, but it becomes the standard. Trim becomes a computer assist item.

[aeromech3]

During each pre-flight, admittedly in a different airframe, each pilot would test the stick shaker and I would expect from that, they would be quite used to the feel on their column and sound, is it the same on the B737 MAX ?

[WillFlyForCheese]

Originally Posted by Loose rivets

Mr Cheese.
It's just that one letter that makes the difference. It suggests ". . . limited to 2.5 degrees each and are . . ." might be an improved wording.

yes, but limited to 2.5 AND each time - depending on speed and AoA. It appears as though everyone is assuming it trimmed at the max limit each time - and I’m curious where that information is found. How do we know, for example, MCAS didn’t trim 1.3 AND each time, if that’s what speed and AoA called for? Or 0.7 . . .or 2.1?

[FCeng84]

Originally Posted by MickG0105

To borrow an image from Gums, when the crew looks to wind off some of the automatically commanded nose down trim, HAL says, 'I'm afraid I can't allow that, Dave.'

MickG - careful now. This is not at all a matter of HAL saying "I'm afraid I can't allow that, Dave." What is happening here is that MCAS has inserted a nose down stabilizer motion increment in response to its understanding that the airplane is at high AOA. The pilot has then manually re-positioned the stabilizer. MCAS is in no way preventing the pilot from moving the stabilizer in either direction as much as the pilot wants. MCAS is further waiting five seconds to allow the pilot to make sure that the pitch trim situation is to the liking of the pilot. If the pilot is not satisfied with the pitch trim and makes another manual trim input, MCAS sits it out for another five seconds. Only after that does MCAS make a new assessment as to whether or not the conditions exist (flaps up, proper speed range, and high indicated AOA) to trigger MCAS to insert a limited increment of nose down stabilizer motion. The design assumption here is that when a pilot makes pitch trim inputs, those inputs will be in the direction to trim the airplane such that each time MCAS makes its assessment as to whether or not to add more nose down, it is starting from a relatively trimmed condition. The pilot maintains highest priority for stabilizer control throughout and MCAS only moves the stabilizer a limited increment each time that the pilot finishes trimming manually.

While it does not present itself as continuously running run-away automatic stabilizer motion, with the airplane flying at a relatively steady flight condition repeated instances of the system moving the airplane away from the trim condition that the pilot has established manually should be recognized as improper automatic stabilizer operation and disabled via the cutout switches.

[FCeng84]

Volume - MCAS was not introduced to make up for deficient elevator nose down control authority. MCAS is there to improve handling characteristics as proscribed by the FARs at elevated AOA. The pilot has plenty of control power to lower the nose via the column. That is not the issue.

[Bergerie1]

Any of you who are interested in flight test and the required handling qualitiies of aircraft, particularly at the stall, will probably enjoy these podcasts and find them most informative. At 1hr 14mins into the second podcast he describes the 707 and in the third he talks about the 747 and later the T-tail aircraft. Much of what he has to say is relevant to this 737 accident.

D P Davies interviews on certificating aircraft

[Jetthrust]

Originally Posted by MickG0105

Boeing fails to make it clear that a trigger for MCAS to continue trimming in more nose down trim is a countermand from the crew. Frankly, I think that is astounding. The system will ignore the persistence of the trigger condition after it makes its initial nose down trim adjustment but it will make a further nose down trim adjustment if the crew countermands it! Moreover, it will do that each and every time the crew countermands it. That is a very clear cut case of an automated system that is designed to override a specific crew command. To borrow an image from Gums, when the crew looks to wind off some of the automatically commanded nose down trim, HAL says, 'I'm afraid I can't allow that, Dave.

That was my view also. But, after reading FCeng84’s comments to this statement, I would explain it this way. Let’s assume the system logic was the opposite. That is, if after MACS commands a pitch change, the pilot uses the electric trim switch or manual trim wheel, MACS says “ok, the pilot has deliberately changed the pitch, I will disable myself”. For how long should MACS remain disabled? What happens if 20 min later, the AoA gets into dangerous territory? Clearly, a time period needs to exist at which MCAS becomes re-enabled. So, this reverse logic scenario is actually exactly how it does work. It’s just that the time period, according to FCeng84 who seems to know this system well, is 5 seconds. (Which given how quickly an aircraft could get out of control, is probably quite a long time?)