Ethiopian airliner down in Africa
Join Date: Dec 2001
Location: what U.S. calls Žold EuropeŽ
Posts: 941
Likes: 0
Received 0 Likes
on
0 Posts
"Once we were recruited and trained for our judgement, now we are selected for our compliance"
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
The above quoted post got no reaction, as it unfortunately appeared in between a series of tit for tat posts. Succinctly written, it describes the background to this problem in what appears to be a completely valid manner.
Therein lies the problem, as Boeing have hung MCAS on the tail of the STS, which has for many years operated quietly in the background to effectively neutralize long period elevator demand, and thereby providing the full range of elevator control when required on demand. Its the extra lift generated by the engine nacelles, now further forward and higher than those on the NG, that needed to be neutralized to maintain the correct feedback forces on the control column in high AoA situations.
As described by StuntPilot, MCAS is a reconfiguration sub-system relying on non validated air data, and steps across the safety critical barrier in an insidious way.
Therein lies the problem, as Boeing have hung MCAS on the tail of the STS, which has for many years operated quietly in the background to effectively neutralize long period elevator demand, and thereby providing the full range of elevator control when required on demand. Its the extra lift generated by the engine nacelles, now further forward and higher than those on the NG, that needed to be neutralized to maintain the correct feedback forces on the control column in high AoA situations.
As described by StuntPilot, MCAS is a reconfiguration sub-system relying on non validated air data, and steps across the safety critical barrier in an insidious way.
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
Harry, Brandon,
You may wish to consider the question posed at the end of this post. Why fail high.
Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed
You may wish to consider the question posed at the end of this post. Why fail high.
Boeing 737 Max Software Fixes Due to Lion Air Crash Delayed
Join Date: Mar 2019
Location: Sweden
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Runaway Stabilizer training
Have you seen this 737 runaway stabilizer training on YouTube? OMG when that stab wheel is running there is not much time to react. Very scary. Look at the first officer trainee's reaction when the warning signals turn on and the plane dips. After seeing this I am so sad to see that these easy to access STAB TRIM switches could have saved both planes.
www.youtube.com/watch?v=3pPRuFHR1co
www.youtube.com/watch?v=3pPRuFHR1co
Join Date: Jan 2008
Location: Herts, UK
Posts: 748
Likes: 0
Received 0 Likes
on
0 Posts
What is described is actually classic 'Automation Surprise' (What's it doing now?) that is followed by attentional (cognitive) tunneling as the human's mind grasps at straws to try to understand what is going on.
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
It horrifies me that this area has not been addressed more intelligently (cognitive overload) although QRMs and their glass screen equivalents do prioritise and stack incoming errors in (pre-ordained) importance
The serious incident of the Qantas A380 engine explosion damaging many systems, requiring up to 3 extra buddying crew (?) to work successively (and tirelessly) through many pages to get that back on the ground safely is a case in point, and perhaps it's incidents like these that should not only be studied more widely but become industry exemplars of CRM.
However, we must not forget Company Communication and Systems Training which will almost certainly here to be found wanting?
Last edited by HarryMann; 21st Mar 2019 at 16:10.
Join Date: May 2016
Location: Nantes
Posts: 63
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Apr 2018
Location: Sudbury, Suffolk
Posts: 226
Likes: 0
Received 0 Likes
on
0 Posts
Whose responsibility would the sim software be?
Join Date: Mar 2014
Location: Birmingham, UK
Posts: 57
Likes: 0
Received 0 Likes
on
0 Posts
What is described is actually classic 'Automation Surprise' (What's it doing now?) that is followed by attentional (cognitive) tunneling as the human's mind grasps at straws to try to understand what is going on.
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
https://risk-engineering.org/concept/AF447-Rio-Paris
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
That would be even worse then! You could train for x failure after take off and then when you ACTUALLY encounter x something quite different happens and the procedure you used successfully in the SIM winds up killing you.
Whose responsibility would the sim software be?
Whose responsibility would the sim software be?
It is obvious that the designers believed that any pilot with stab trim repeatedly trimming in a way that was hazardous would switch it off. It is apparent that some (even some on here) will not switch the stab trim off as the NNC says runaway and that's not runa.... etc etc. All the way to the ground. Perhaps if the NNC had said (for the pedants) "repeated or continuous uncommanded trimming in one direction" then the Max8 may still have been flying.
- GY
Join Date: Jan 2008
Location: uk
Posts: 861
Likes: 0
Received 0 Likes
on
0 Posts
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
One wonders if this means that:
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
P.S. And to be clear, Ethiopian DOES NOT own a 737MAX FFS simulator. See: https://www.ethiopianairlines.com/EA...aining-Schools
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
In some ways it reminds me of the way that the crew of Air France flight 447 ignored 75 stall warnings.
https://risk-engineering.org/concept/AF447-Rio-Paris
https://risk-engineering.org/concept/AF447-Rio-Paris
I know that there are considerable efforts to check the warning systems that the crew have to deal with. However, if you start doing a parallel cognitive walkthrough of each set of task requirements for example following an NNC while aviating and reading the various instruments and hearing the alarms voice and sounds and dealing with the haptics like stick shakers and loads on control columns, while being shouted at by the other crew member, then it will immediately be apparent that some cognitive channels are overloaded. For example a simple non-stress test for you - read this post and at the same time recite a well known set of memory items and have someone tell you something. You will not be able to do all three because they all use the same 'verbal' reasoning 'cognitive channel' - it's why you have a sanitized flight deck on approach.
As with AF447, these two Max crashes should inform the future cockpit human factors and alarm development
Join Date: Jul 2013
Location: Southern Maryland
Age: 56
Posts: 17
Likes: 0
Received 0 Likes
on
0 Posts
Some simulator manufacturers design "hardware in the loop" simulators running the actual flight-qualified aircraft FMC hardware (and hence the actual software binaries, loaded using aircraft-representative methdos). Some start with the binary software load, and run it through a software conversion to make it compatible with the simulator host computer. Some create simulations from scratch based upon the known operation of the aircraft, although that's uncommon on commercial full-flight simulators; it's much more common in the military simulation world.
Using flight-qualified software and hardware in a simulator can present some challenges, by the way. Aircraft FMC and navigation software generally doesn't like simulator freezes, resets, and repositions, which are common in training. If the FMC software doesn't provide "hooks" for telling it to play nice in a simulator, it can be necessary to simulate the software instead of implementing it directly. I've seen some pretty odd simulator behavior because the FMC didn't understand why it was suddenly 28,000 feet higher and 400 miles away from its last known position.
Join Date: Dec 2017
Location: last known by reference to poorly programmed GPS
Posts: 28
Likes: 0
Received 0 Likes
on
0 Posts
I cannot say definitively, but the latest simulators generally use the SAME software load, delivered as a binary, as the aircraft.
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
The (few) MAX simulators in existence have the capability to train for events that are defined in the QRH. If it ain't in the QRH, it ain't in the sim's list of malfunctions / trainable events. Period. This was by deliberate choice.
Does MCAS fault appear in the QRH? Fair bet that stab runaway does, but that's a different thing from successive 2.5 degree increments isn't it?
The software in the simulators comes from the same source as the QRH.
The simulator industry has also changed A LOT in the past several years.
Using flight-qualified software and hardware in a simulator can present some challenges, by the way. Aircraft FMC and navigation software generally doesn't like simulator freezes, resets, and repositions, which are common in training. If the FMC software doesn't provide "hooks" for telling it to play nice in a simulator, it can be necessary to simulate the software instead of implementing it directly. I've seen some pretty odd simulator behavior because the FMC didn't understand why it was suddenly 28,000 feet higher and 400 miles away from its last known position.
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
The original MCAS was designed for 0.5 degree changes. Test pilots found out this did not work, and it was changed to the 2 cycles of 2.5 degrees.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
Last edited by Smythe; 21st Mar 2019 at 16:57.
Join Date: Dec 2017
Location: last known by reference to poorly programmed GPS
Posts: 28
Likes: 0
Received 0 Likes
on
0 Posts
Generally you are spot on here, except some considerable work has been done to support the use of aircraft code directly within flight simulators - particularly with the adoption of ARINC standard 610 (currently at RevC) "GUIDANCE FOR DESIGN OF AIRCRAFT EQUIPMENT AND SOFTWARE FOR USE IN TRAINING DEVICES"
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
These days, and for simulators representing Brand-B aircraft, starting with the MAX, it's not just the "aircraft binaries", it's the ENTIRE vehicle simulation INCLUDING malfunctions that is delivered to the sim manufacturers (essentially just integrators now) as a binary. To be fair, both Big Brands are now operating this way, Brand-A has been for several years already.
The "different story" as you put it is the main reason for this. You wanna train for Brand-X airplanes, you'll do it on a Brand-X sim, using Brand-X software, Brand-X training program in a Brand-X training centre. IP protection was the excuse used to launch the approach, but it's always been about the training $$$. Smaller manufactures are being Hoovered up rapidly to gain control of those markets too... Bombardier / Embraer. Wanna place bets about bizjets and helicopters for the future?
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
The original MCAS was designed for 0.5 degree changes. Test pilots found out this did not work, and it was changed to the 2 cycles of 2.5 degrees.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
The solution floated here, which may be close to the truth, seems to be to use both AoA values as inputs to MCAS (they are physically available anyway), and only to act if both values consistently read high, and close to each other. If they disagree sufficiently, MCAS will disable itself. When the probability of getting into a real high-AoA situation (where MCAS would actually be required) and getting an AoA disagree event at the same time (the result of which would be that MCAS were unavailable when needed) is shown to be sufficiently low, such a solution can be certified.
Since the failure mode has now been demonstrated to be of "catastrophic" severity, "sufficiently low" would be less than 1 in 10^9 flight hours),
Bernd
