Ethiopian airliner down in Africa
Joined: Mar 2014
Posts: 66
Likes: 8
From: Birmingham, UK
What is described is actually classic 'Automation Surprise' (What's it doing now?) that is followed by attentional (cognitive) tunneling as the human's mind grasps at straws to try to understand what is going on.
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
The suggestion that the machine tells the pilot what is happening is good- except that if there is not sufficient thought a small subsystem like AoA used by a LOT of systems can result in alert messages scrolling on displays all sorts of sounds and alerts and haptics like stick shakers and pushers -- all for just an AoA disagree. I think that there is a major human factors failure in modern aircraft where not sufficient thought has been given to the multiplicity of warnings that can come from a small event - and the warnings themselves create problems rather than assistance. There needs to be something like an Failure Modes Effects Analysis that flags up that at this point there are multiple separate warnings being displayed in various ways that will consume the entire cognitive resource of the pilot and not allow his primary AVIATE task any resource. This effect is often seen where something VERY obvious is disregarded as the pilot's cognitive resources are completely saturated.
Another aspect of the automation surprise is that the workload can literally explode from routine to overload in a second. This takes a lot of training to cope with and an MPL with less than 100 hours live flying is not going to be of any use in one of these incidents and indeed may panic and make extra work for the experienced pilot - effectively the aircraft is being flown by one pilot,
There will be a raft of lessons to be learned from these incidents. Let's hope that the beancounters learn them too. .
https://risk-engineering.org/concept/AF447-Rio-Paris
Joined: Dec 2006
Posts: 1,350
Likes: 0
From: Florida and wherever my laptop is
That would be even worse then! You could train for x failure after take off and then when you ACTUALLY encounter x something quite different happens and the procedure you used successfully in the SIM winds up killing you.
Whose responsibility would the sim software be?
Whose responsibility would the sim software be?
It is obvious that the designers believed that any pilot with stab trim repeatedly trimming in a way that was hazardous would switch it off. It is apparent that some (even some on here) will not switch the stab trim off as the NNC says runaway and that's not runa.... etc etc. All the way to the ground. Perhaps if the NNC had said (for the pedants) "repeated or continuous uncommanded trimming in one direction" then the Max8 may still have been flying.
Joined: Jun 2009
Posts: 594
Likes: 72
From: VA, USA
- GY
Joined: Jan 2008
Posts: 857
Likes: 0
From: uk
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
Joined: Jun 2009
Posts: 594
Likes: 72
From: VA, USA
One wonders if this means that:
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
a) the sim doesn't include an erroneous MCAS failure scenario
b) the sim doesn't include any failure scenario that would trigger MCAS
c) the sim does not correctly model MCAS activation given e.g. an ADIRU failure or AOA failure
or
d) the sim does not implement MCAS at all, and therefore does not correctly model handling at high AOA
Is there actually any sim anywhere that you could train on for MCAS failures/ erroneous activation (outside of Boeing engineering sims) ?
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
P.S. And to be clear, Ethiopian DOES NOT own a 737MAX FFS simulator. See: https://www.ethiopianairlines.com/EA...aining-Schools
Joined: Dec 2006
Posts: 1,350
Likes: 0
From: Florida and wherever my laptop is
In some ways it reminds me of the way that the crew of Air France flight 447 ignored 75 stall warnings.
https://risk-engineering.org/concept/AF447-Rio-Paris
https://risk-engineering.org/concept/AF447-Rio-Paris
I know that there are considerable efforts to check the warning systems that the crew have to deal with. However, if you start doing a parallel cognitive walkthrough of each set of task requirements for example following an NNC while aviating and reading the various instruments and hearing the alarms voice and sounds and dealing with the haptics like stick shakers and loads on control columns, while being shouted at by the other crew member, then it will immediately be apparent that some cognitive channels are overloaded. For example a simple non-stress test for you - read this post and at the same time recite a well known set of memory items and have someone tell you something. You will not be able to do all three because they all use the same 'verbal' reasoning 'cognitive channel' - it's why you have a sanitized flight deck on approach.
As with AF447, these two Max crashes should inform the future cockpit human factors and alarm development
Joined: Jul 2013
Posts: 17
Likes: 0
From: Southern Maryland
Some simulator manufacturers design "hardware in the loop" simulators running the actual flight-qualified aircraft FMC hardware (and hence the actual software binaries, loaded using aircraft-representative methdos). Some start with the binary software load, and run it through a software conversion to make it compatible with the simulator host computer. Some create simulations from scratch based upon the known operation of the aircraft, although that's uncommon on commercial full-flight simulators; it's much more common in the military simulation world.
Using flight-qualified software and hardware in a simulator can present some challenges, by the way. Aircraft FMC and navigation software generally doesn't like simulator freezes, resets, and repositions, which are common in training. If the FMC software doesn't provide "hooks" for telling it to play nice in a simulator, it can be necessary to simulate the software instead of implementing it directly. I've seen some pretty odd simulator behavior because the FMC didn't understand why it was suddenly 28,000 feet higher and 400 miles away from its last known position.
Joined: Dec 2017
Posts: 28
Likes: 0
From: last known by reference to poorly programmed GPS
I cannot say definitively, but the latest simulators generally use the SAME software load, delivered as a binary, as the aircraft.
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
Since MCAS is 'contained' within the FMC, I have no reason to doubt that MCAS would be implemented within the binary and therefore available to be trained.
However, whether there is a specific malfunction for "AOA sensor failed high" is another question. Somewhere I may have a malfunction list from a recent simulator, but that would take some time and effort to dig up.
However, be aware, there are only five (5) 737MAX FFS simulators in the world operating currently (4 with Boeing Flight Services and 1 with Air Canada).
- GY
The (few) MAX simulators in existence have the capability to train for events that are defined in the QRH. If it ain't in the QRH, it ain't in the sim's list of malfunctions / trainable events. Period. This was by deliberate choice.
Does MCAS fault appear in the QRH? Fair bet that stab runaway does, but that's a different thing from successive 2.5 degree increments isn't it?
The software in the simulators comes from the same source as the QRH.
The simulator industry has also changed A LOT in the past several years.
Joined: Jun 2009
Posts: 594
Likes: 72
From: VA, USA
Using flight-qualified software and hardware in a simulator can present some challenges, by the way. Aircraft FMC and navigation software generally doesn't like simulator freezes, resets, and repositions, which are common in training. If the FMC software doesn't provide "hooks" for telling it to play nice in a simulator, it can be necessary to simulate the software instead of implementing it directly. I've seen some pretty odd simulator behavior because the FMC didn't understand why it was suddenly 28,000 feet higher and 400 miles away from its last known position.
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
Joined: Feb 2019
Posts: 431
Likes: 0
From: shiny side up
The original MCAS was designed for 0.5 degree changes. Test pilots found out this did not work, and it was changed to the 2 cycles of 2.5 degrees.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
Last edited by Smythe; 21st March 2019 at 15:57.
Joined: Dec 2017
Posts: 28
Likes: 0
From: last known by reference to poorly programmed GPS
Generally you are spot on here, except some considerable work has been done to support the use of aircraft code directly within flight simulators - particularly with the adoption of ARINC standard 610 (currently at RevC) "GUIDANCE FOR DESIGN OF AIRCRAFT EQUIPMENT AND SOFTWARE FOR USE IN TRAINING DEVICES"
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
The latest commercial simulators for 'new' aircraft all use the aircraft binaries - this is for multiple reasons including accuracy (but I also suspect protection of IP rights is high on the list, as is being able to charge $8 million for a data package from Boeing or Airbus, but that's a different discussion).
- GY
These days, and for simulators representing Brand-B aircraft, starting with the MAX, it's not just the "aircraft binaries", it's the ENTIRE vehicle simulation INCLUDING malfunctions that is delivered to the sim manufacturers (essentially just integrators now) as a binary. To be fair, both Big Brands are now operating this way, Brand-A has been for several years already.
The "different story" as you put it is the main reason for this. You wanna train for Brand-X airplanes, you'll do it on a Brand-X sim, using Brand-X software, Brand-X training program in a Brand-X training centre. IP protection was the excuse used to launch the approach, but it's always been about the training $$$. Smaller manufactures are being Hoovered up rapidly to gain control of those markets too... Bombardier / Embraer. Wanna place bets about bizjets and helicopters for the future?
Joined: Jul 2007
Posts: 556
Likes: 1
From: Germany
The original MCAS was designed for 0.5 degree changes. Test pilots found out this did not work, and it was changed to the 2 cycles of 2.5 degrees.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
5 degrees nose down, repeatedly, at lower altitudes is far more significant than stab runaway, and look at those effects. Wonder what the trim wheel revolution speeds are under MCAS...that has to be inspiring!
So, the flight testing showed the ac was inherently unstable in the test conditions. It would be very helpful to see what the conditions are that trigger the MCAS.
The solution floated here, which may be close to the truth, seems to be to use both AoA values as inputs to MCAS (they are physically available anyway), and only to act if both values consistently read high, and close to each other. If they disagree sufficiently, MCAS will disable itself. When the probability of getting into a real high-AoA situation (where MCAS would actually be required) and getting an AoA disagree event at the same time (the result of which would be that MCAS were unavailable when needed) is shown to be sufficiently low, such a solution can be certified.
Since the failure mode has now been demonstrated to be of "catastrophic" severity, "sufficiently low" would be less than 1 in 10^9 flight hours),
Bernd
Gender Faculty Specialist
Joined: Mar 2002
Aviation Qualifications: ATPL
Posts: 2,321
Likes: 428
From: In your head.
MCAS - 0.27/s
Normal trim flaps up - 0.2/s
Normal trim flaps extended - 0.4/s
I'd rather have an MCAS do what it did than a runaway with flaps extended at low level.
Last edited by Chesty Morgan; 21st March 2019 at 17:04.
Joined: Feb 2019
Posts: 431
Likes: 0
From: shiny side up
Again, no. The aircraft is not, by any stretch of the imagination, "unstable", let alone "inherently unstable" (in what way is that different from "unstable"). It just does not provide enough adverse stick force to satisfy a very specific certification requirement.
Poor design of the engine/wing configuration 'fixed' (so far not successfully) with software... the other fix, to turn off the AP, really? That to me is unstable design.
4 units per second would be a feat to behold.
Joined: Jun 2009
Aviation Qualifications: Military
Posts: 1,851
Likes: 645
From: florida
Salute!
After the Lion crash, and many affirmations of the MCAS rationale, I see this comment today
Ahem....... Guess the test pilot here flew the MAX at high AoA to help evaluate the FAR requirements for control force approaching the stall. Maybe not read all the posts bout the new engines and their mounting adding nose up pitch moments. If not, then maybe the test hops in the previous models did not include evaluating the STS with the trim motor turned off. You know, the thing that helps meet FAR requirements for speed stability when flying "trimmed". The tricky test point is that one up high to ensure that HAL tweaks the elevator without you doing anything when approaching a certain mach threshold. That's a good one, cause you might get aileron reversal and some flutter that really strains your control surfaes and wing.
But no problem, As another pilot here has stated over and over - " any competent crew/pilot could handle that".
And then I continue the quote;
Well, sir, IT HAS CHANGED!!!!! And that has been the crux of most discussion on our various threads since early November. So DOUBT IT !!! Sheesh, .............................beam me up.
-----------------------------------------
I am trying to follow the ROE for our forum, but it's getting hard. I do not mean to diminish the length and breadth of experience that many pilots here have contributed to the discussion. But somethimes I get a little testy.
My fear is that some lurking here will think that we lost two planes and 300 passengers because incompetent crews did not simply turn off two switches within seconds of raising flaps at normal altitude and speed with the stall warning system telling them they were stalling and their airspeed was FUBAR.
The primary contributing factor to loss of control in the Lion crash and likely the Ethiopian one ,is gonna be the MCAS and its implementatio without fairly documenting it for the crews and not considering its activation at a corner of the envelope it was not intended for.
Gums...
After the Lion crash, and many affirmations of the MCAS rationale, I see this comment today
I don't get your comment "not certified". A 737 can fly with no computers or indeed no pretty much anything working, and this is demanded on the FAA test flights which I have conducted to make sure it works.
But no problem, As another pilot here has stated over and over - " any competent crew/pilot could handle that".
And then I continue the quote;
If this has changed on the MAX then that is something to ponder most seriously. But I doubt it.
-----------------------------------------
I am trying to follow the ROE for our forum, but it's getting hard. I do not mean to diminish the length and breadth of experience that many pilots here have contributed to the discussion. But somethimes I get a little testy.
My fear is that some lurking here will think that we lost two planes and 300 passengers because incompetent crews did not simply turn off two switches within seconds of raising flaps at normal altitude and speed with the stall warning system telling them they were stalling and their airspeed was FUBAR.
The primary contributing factor to loss of control in the Lion crash and likely the Ethiopian one ,is gonna be the MCAS and its implementatio without fairly documenting it for the crews and not considering its activation at a corner of the envelope it was not intended for.
Gums...
Joined: Jan 2008
Posts: 211
Likes: 3
From: farmm intersection, our ranch
When it gets to a certain angle of attack, the engines, given the size and the forward/upward mounting, provide an unexpected amount of lift. This is the reason MCAS was developed, to push the nose down.
Poor design of the engine/wing configuration 'fixed' (so far not successfully) with software... the other fix, to turn off the AP, really? That to me is unstable design.
Exactly, and likely at full speed!
Poor design of the engine/wing configuration 'fixed' (so far not successfully) with software... the other fix, to turn off the AP, really? That to me is unstable design.
Exactly, and likely at full speed!
Joined: Nov 2000
Posts: 630
Likes: 6
From: Canada
March 21, 2019 / 8:34 AM / Updated an hour ago
Boeing to add extra safety alarm in 737 MAX jets: FT
(Reuters) - Boeing Co will install an extra safety alarm in the cockpits of all its 737 MAX aircraft after intense criticism in the wake of two fatal crashes, the Financial Times reported on Thursday.
Boeing did not immediately respond to a request for comment.
Shares of the company were down about 1 percent at $372.49 in morning trade