Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed
If the stab trim was off then the likliehood of an accident related to it falls massively. So if an accident occurs as a result of another issue it would be wrong to blame switching off the stab trim.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
Play the video below as you read the post.
The biggest issue faced by this and the other crews is trying to figure out what was going on. They had IAS disagree, stickshaker, and intermittent trim runaway only after flap retraction. This was NOT a classic runaway, the runaway did not follow the continuous expectation, it only began after a 5 second period from a manual trim input, then stopped as soon as the trim switch was moved for another 5 seconds. Try workshopping that combination with the published system knowledge that fails to mention that the MCAS even exists, in your second language reading the checklist(s) to figure out your pitch/thrust combination to isolate the failed system, all with this racket in the background.
If you gave this scenario's to 100 crews in the sim, I have no doubt less than 100 would end up turning off the stab trim cutout switches off. Some crews may never have even retracted to flaps to expose the MCAS activation. Unfortunately we won't ever be able to perform the experiment as most 737 MAX pilots are now likely acutely aware of the MCAS and the appropriate deactivation via the stab trim cutout.
The biggest issue faced by this and the other crews is trying to figure out what was going on. They had IAS disagree, stickshaker, and intermittent trim runaway only after flap retraction. This was NOT a classic runaway, the runaway did not follow the continuous expectation, it only began after a 5 second period from a manual trim input, then stopped as soon as the trim switch was moved for another 5 seconds. Try workshopping that combination with the published system knowledge that fails to mention that the MCAS even exists, in your second language reading the checklist(s) to figure out your pitch/thrust combination to isolate the failed system, all with this racket in the background.
If you gave this scenario's to 100 crews in the sim, I have no doubt less than 100 would end up turning off the stab trim cutout switches off. Some crews may never have even retracted to flaps to expose the MCAS activation. Unfortunately we won't ever be able to perform the experiment as most 737 MAX pilots are now likely acutely aware of the MCAS and the appropriate deactivation via the stab trim cutout.
This was NOT a classic runaway, the runaway did not follow the continuous expectation, it only began after a 5 second period from a manual trim input, then stopped as soon as the trim switch was moved for another 5 seconds.
The basic point though is surely, the trim is running....I want it to stop.....I will turn it off Bloggs unless you have a better idea....... No it is not a classic sim failure, single problem, linear solution now move on to the next exercise. They had the aircraft more or less levelled off then lost control. Got tired or swapped PF?
If the stab trim was off then the likliehood of an accident related to it falls massively. So if an accident occurs as a result of another issue it would be wrong to blame switching off the stab trim.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
The other point is that they can be turned on again, to assist crew to “fault find” and work out a safe configuration.
The engineer, according to the airline, was simply a flying spanner whose presence was not connected with the problems that had been encountered with the aircraft.
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
With regard to the somewhat semantic debate as to whether "stab runaway" applied or not, it might be good to not just look at the title of the procedure, but also at any additional information or training which helps define the condition.
For example, on a DIFFERENT aircraft the corresponding AFM procedure starts:
Thus, while the name of the procedure appears to be narrowly defined, the indications - the conditions under which you are expected to action, or at least consider actioning, the procedure - cover a range of scenarios - and I'll note include the "not by system design" case, so for the B737 STS case, if you know the motion is normal per design, you wouldn't do this procedure. If you don't know that, then it's a contender for "stab runaway"
I don't know if the corresponding B737 materials contain sufficiently similar wording for the comparison to be fully valid ...
For example, on a DIFFERENT aircraft the corresponding AFM procedure starts:
Stabilizer Trim Runaway
Indication:
Indication:
- Abnormal / uncommanded change in pitch attitude.
- Stabilizer trim changes without pilot input.
- Stabilizer trim changes not by system design (Mach trim, flap compensation, etc).
- Higher or lower than normal and increasing or decreasing pitch control forces.
I don't know if the corresponding B737 materials contain sufficiently similar wording for the comparison to be fully valid ...
Join Date: Jul 2013
Location: In a Pineapple Under the Sea
Age: 61
Posts: 152
Likes: 0
Received 0 Likes
on
0 Posts
Right now - it’s pure speculation either way. The airline cannot say whether the engineer was or was not on the flight deck when things went bad. The CVR will reveal whether he was there - right now it’s all speculation.
I don't have the 737 Max QRH but this is from the 737NG QRH. I'm guessing, since B kept quiet about the MCAS it would be the same!
"RUNAWAY STABILIZER
Condition: Continuing rotation of the stabilizer trim wheel in a manner not appropriate for the flight conditions."
Is 'continuing' the same as continuous which is how it was always presented in the sim? Are there differences in how these words are understood on each side of the Atlantic? I think both crews had previous NG experience, (reversion to past experience under stress?), but also remember English was not their first language.
I suppose the last part, "not appropriate etc", covers the intermittent trim wheel rotation but as suggested probably not all crews would have remembered that part of the conditions for applying the "Runaway Stabilizer" Non-Normal Checklist at the time.
1066
"RUNAWAY STABILIZER
Condition: Continuing rotation of the stabilizer trim wheel in a manner not appropriate for the flight conditions."
Is 'continuing' the same as continuous which is how it was always presented in the sim? Are there differences in how these words are understood on each side of the Atlantic? I think both crews had previous NG experience, (reversion to past experience under stress?), but also remember English was not their first language.
I suppose the last part, "not appropriate etc", covers the intermittent trim wheel rotation but as suggested probably not all crews would have remembered that part of the conditions for applying the "Runaway Stabilizer" Non-Normal Checklist at the time.
1066
The reason why the engineer was on board isn't really speculation either, unless we're suggesting the airline might be lying about that.
Whether the engineer was on the jump seat and, if so, what part if any they played in the events, are the only unknowns. My money would be on none.
Join Date: Mar 2006
Location: Vance, Belgium
Age: 62
Posts: 270
Likes: 0
Received 5 Likes
on
3 Posts
Salute!
Thank you Curtain..
OTOH some here sound like a defense lawyer being picky about the malfunction definition during the upcoming liability suits.
Sheesh.
Then Mad expresses the thots of many
So in a galaxy far away I had this malfunction that had no procedure, and only thing we had in our checklist was called "LEF Malfunction" ; So when I called in after getting heart rate below 150 or so, and altitude of 1,000 feet or so, still climbing ( speed may be life, but altitude is life insurance!), my squad "helper" said to "LOCK" flaps after gear down, as that was the only procedure at the time. I explained that I had a diferent problem. Was second guy with this, and first one over in an EPG country died trying to land but we didn't know the details, so for all practical purposes I was the first and I recorded the approach for a potential accident board ( it's in my interview on the public profile heref - crappy video conversion thru three formats )..
So here's what I saw just after raising the gear:
Surprise!
And here's the quote from our checklist and Dash One:
The assymetric flap procedure was added after my episode
Let the picture speak to that.
So the cardinal rule applied, and I followed it. Fly the damned plane, then call for help when you can. Don't change anything if you are not wildly out of control. Do not troubleshoot unless the procedure calls for it AND the original problem is mitigated, otherwise do what the previous 610 crew did and accept the horn/shaker/whatever and fly with manual trim wheel.
I still maintain:
Boeing needed to 1) tell all the users about the MCAS system, 2) change the emergency procedures for ALL perceived trim malfunctions as Mad has shown for brand-x to have the crew simply tiurn off the electric trim and then proceed, maybe with more steps if required, and 3) conduct a better fault tree analysis before fielding this lates kludge
Gums sends...
Thank you Curtain..
OTOH some here sound like a defense lawyer being picky about the malfunction definition during the upcoming liability suits.
Sheesh.
Then Mad expresses the thots of many
Thus, while the name of the procedure appears to be narrowly defined, the indications - the conditions under which you are expected to action, or at least consider actioning, the procedure - cover a range of scenarios
So here's what I saw just after raising the gear:
Surprise!
And here's the quote from our checklist and Dash One:
A [symmetric] LEF malfunction may be indicated by the LE FLAPS caution light. This indicates that one or both of the LEF branches have malfunctioned. LEF may stop and remain fixed in position when the malfunction occurs. An LE FLAPS caution light may also indicate that an asymmetry was detected and the asymmetry brakes have locked the LEF's. LEF's
should remain symmetrical (within 10 degrees).
should remain symmetrical (within 10 degrees).
The most likely cause of an asymmetric LEF malfunction is a mechanical disconnect in one of the LEF drive trains accompanied by a failure of the asymmetry brake(which is what happened). This failure may not illuminate the LE FLAPS caution light . The first indication of an asymmetry is an uncommanded roll. The failed LEF may be as much as 90 degrees up or down.
So the cardinal rule applied, and I followed it. Fly the damned plane, then call for help when you can. Don't change anything if you are not wildly out of control. Do not troubleshoot unless the procedure calls for it AND the original problem is mitigated, otherwise do what the previous 610 crew did and accept the horn/shaker/whatever and fly with manual trim wheel.
I still maintain:
Boeing needed to 1) tell all the users about the MCAS system, 2) change the emergency procedures for ALL perceived trim malfunctions as Mad has shown for brand-x to have the crew simply tiurn off the electric trim and then proceed, maybe with more steps if required, and 3) conduct a better fault tree analysis before fielding this lates kludge
Gums sends...
Last edited by gums; 23rd Feb 2019 at 00:55. Reason: font correction
Salute Lion!
First clue was roll, but I thot jet wash from preceding Viper. Control pressure on that gal is light, but it was later determined Ihad about 14 or 15 pounds( max control pressure available was about 16 or 17 pounds, so I was close to losing it). Then the vibration/buffet became very obvious and I glanced left, then right.
I kept speed where it was when I realized the flap had folded up, as I was doing O.K. and kept on keeping on.
Now back to undocumented malfunctions, but mine was a first for USAF and second overall. Least we figured out how to land the thing.
Gums sends...
BTW Lion, I think the loss was a fellow countryman of yours, and I got details much later from F-16.net moderators. So the fact that I did not try to "flare" save me and the jet.
.
First clue was roll, but I thot jet wash from preceding Viper. Control pressure on that gal is light, but it was later determined Ihad about 14 or 15 pounds( max control pressure available was about 16 or 17 pounds, so I was close to losing it). Then the vibration/buffet became very obvious and I glanced left, then right.
I kept speed where it was when I realized the flap had folded up, as I was doing O.K. and kept on keeping on.
Now back to undocumented malfunctions, but mine was a first for USAF and second overall. Least we figured out how to land the thing.
Gums sends...
BTW Lion, I think the loss was a fellow countryman of yours, and I got details much later from F-16.net moderators. So the fact that I did not try to "flare" save me and the jet.
.
Intermittent v Continuous
MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
Join Date: Dec 2018
Location: Dundee
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Intermittent v Continuous
MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
MCAS has a limited authority, and a continuous sensor fault would result in a single trim error to the limit of the MCAS system authority. That defect would likely be counteracted by any flight crew, as the speed was changing through the flight profile, and so pilot trim would be undertaken as a normal matter of course. Without having any information on the presentation of the fault, it would appear that there was intermittent failure and an ongoing change in the trim condition. It is also possible that didn't happen, and that would be a further human factors investigation issue.
I had not appreciated the extent of the changes in the MAX Magazine - ALPA
I wonder what other ‘unknown’ system quirks there might be. A ‘fly-by-wire’ spoiler, electrically signalled or computed logic? Landing and emergency descent.
Improved safety appears to be optional; the modifications relate to accidents in each category, but in order to aid the crew you have to pay for the addition. I cannot see that an unstable approach warrants an ‘overrun’ warning; speed / height alert possibly.
Somewhat embarrassing for ALPA in that their pilots apparently did not ‘discover’ MCAS during their lengthy - Boeing paid for, evaluation. This further questions the viability of a computerised differences course and minimum FCOM change.
I wonder what other ‘unknown’ system quirks there might be. A ‘fly-by-wire’ spoiler, electrically signalled or computed logic? Landing and emergency descent.
Improved safety appears to be optional; the modifications relate to accidents in each category, but in order to aid the crew you have to pay for the addition. I cannot see that an unstable approach warrants an ‘overrun’ warning; speed / height alert possibly.
Somewhat embarrassing for ALPA in that their pilots apparently did not ‘discover’ MCAS during their lengthy - Boeing paid for, evaluation. This further questions the viability of a computerised differences course and minimum FCOM change.
Join Date: May 2006
Location: Genf
Age: 58
Posts: 13
Likes: 0
Received 0 Likes
on
0 Posts
Voting and triple systems
Voting is not always the best solution. Try to block 2 pitots tubes on 2 ADMs at FL290 (at night) on the Triple and perform a descend for landing and land.
Triplexed systems have been around for 50+ years. How many times in that period has a good input been outvoted by two bad ones ?
Join Date: Mar 2019
Location: West Wales
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
INS versus AoA and software updates
Basically the MCAS trim override system is a partial “FbW” system. We all know why it was implemented, so I don’t need to discuss its merits/functionality here or the unsettling fact that its bad behaviour was actually notified last year after the Lion Air incident. No one outside of Boeing or whoever is in accident investigations has seen the recorder data sets and heard the recently recovered CVR of that accident. That will remain confidential for ever.
I personally doubt (working in military electronics) whether the latest incident’s recorders would have survived a “direct in” at that terminal velocity. However, this seems to me to be a truly software-related problem. Yes, I know that setting various switches, is supposed to reset or kill a “loop” in the “code” however, in the good old days switches used to get connected to servo actuators by things called “wires” using stuff called “current”. Now each switch (however WW2 clunky) is read into a data set packet and sent along the Manchester bus data-highway of the revised and “simplified” cockpit systems into the various CPUs. Frantically pulling fuses out won’t help. So, ignoring the input side of the AoA sensors on the wings, there is a possibility that the software version now being hastily rolled out, (I’m not sure how the FCS/CPUS is updated, could even be over a USB stick) may indeed have the “corporate cover-up code” required to eliminate the “problem”. (i.e, if the loop executes say, more than 5 times, - it’s probably a sensor failure not a “pilot error”).
If any system which is designed to take a manual input before it re-enters its loops, does NOT read or ignores fresh inputs from switches - then there is also a risk that the “naughty” algorithm will continue to re-execute, despite the operators putting their big feet on the glass displays and yanking back with such enormous force as to bend the panel. In any event, there won’t be any real feedback or pitch reaction by the kite, if the control column is only “connected” to the air-surfaces by dumb electronics and computers. I doubt whether anyone has actually tried to see if the system does indeed go into an unrecoverable loop at FL 35 over the pond while delivering a new freshly painted bus to a punter. After these two incidents, I wouldn’t want to try, unless the hatch was open and I had a parachute - as I’m too fat to squeeze thru the DV window.
This brings me onto point 2).- “Sanity” Displays.
Each aircraft has 1-3 INS systems. They look at 6 DOF (six degrees of freedom, P,Y,R, and Surge Heave and Sway as Noah would say) and they are fully capable of measurements to high orders of angular and rate accuracy. They know exactly what the “vectorial” behaviour of the airframe is at any instant. The strapped down INS actually contains low-drift North-seeking Ring Laser gyroscopes, and 6 very sensitive accelerometers, probably all Honeywell types same as used in TLAAMs. The basic function of it can act as a really high-accuracy vertical reference unit. (remember those?). It can output the true measured “3D” motions of the a/c its - accelerations, pitch angles, rates and an earth-centred attitude reference. Remember - half the battle of flying is defying gravity. So as an engineer, my question is - why rely wholly on attitude sensors that Noah used to trim his boat in a gale? They are subject to bugs (insects), cleaners, de-icers, icing, birdstrikes, electronic failures, corrosion, static from lightning, poor calibration etc etc. The real method of display of an aircraft’s true attitude should, in my opinion, be derived from the “VRU” aspects of the INS and combined/checked against any external physical sensors. A failure warning “disagree” page should be available on the glass display, warning the pilot (by red/green overlaid lines etc) that what’s being “dealt with” is NOT the true attitude of the a/c in motion or its approach to/from instability. Just a thought. I’ve banned my whole family and staff from ever flying on the MAXes for the foreseeable future and I extend my heartfelt sympathies to those affected by this, IMHO, totally avoidable “modern” tragedy.