Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 8th Apr 2019, 03:10
  #3581 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 599
Originally Posted by TryingToLearn View Post
To me (as a functional safety engineer) it looks like the designers made a very common beginners mistake at the very beginning while designing MCAS.
This mistake can sometimes even be found within training documents.

MCAS should only be active in rare situations and only change the feel (low impact).
It's like an airbag which is only needed in case of an accident where it may help you.
Therefore it got a low A rating.
But this is an availability rating, not safety!

Functional Safety covers a different question: What can go wrong if this functions fires off in the worst possible situation (by considering all possible situations). In this case at maximum speed and low height. And is there any kind of controlability?
Like an airbag explosion hitting and killing you (critical) while stepping out of the car (common situation) without any chance to avoid it (too fast).
-> It should have been rated higher, probably critical (C) as already mentioned
All further analysis, quality methods, redundancies (2 or 3 sensors), documentation, process requirements... rely on this rating which was probably wrong.
In addition they changed the maximum impact of the system later (0.6 to 2.5) and did not question the assumptions within the first analysis. This should happen automatically as part of the safety process.

MCAS had apparently a latent systematic (design) fault which ended up in a critical fault as soon as the AoA reading was wrong (2nd fault).
This is no beginners mistake. They apparently knew EXACTLY what they were doing. The only reason it was not classified as Critical is because in doing so would require a crew warning and thus more crew training. This allegedly would trigger penalties embedded in purchase contracts (the figure quoted was $1 million per aircraft for just one operator who had ordered 280 units).


System failed on a single sensor
The bottom line of Boeing’s System Safety Analysis with regard to MCAS was that, in normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death.

In the case of an extreme maneuver, specifically when the plane is in a banked descending spiral, an activation of MCAS was classified as a “hazardous failure,” meaning that it could cause serious or fatal injuries to a small number of passengers. That’s still one level below a “catastrophic failure,” which represents the loss of the plane with multiple fatalities.
Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system




This is much much darker than a rookie error, a Rubicon has been crossed...
CurtainTwitcher is online now  
Old 8th Apr 2019, 03:33
  #3582 (permalink)  
 
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,313
Originally Posted by CurtainTwitcher View Post
This is no beginners mistake. They apparently knew EXACTLY what they were doing. The only reason it was not classified as Critical is because in doing so would require a crew warning and thus more crew training. This allegedly would trigger penalties embedded in purchase contracts (the figure quoted was $1 million per aircraft for just one operator who had ordered 280 units).



Seattle Times: Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system




This is much much darker than a rookie error, a Rubicon that has been crossed...

The reasoning was not 'a dark plot'. As with all automation in modern aircraft if things go awry as they will, it was thought that the flight crew would be able to counteract the problem. Just using the pickle trim stops MCAS, trimming up reverses MCAS. Repeated uncommanded down trim that becomes intrusive would be dealt with by the runaway trim NNC, but just trimming back to trim using normal trim would be sufficient as it was in the Lion Air cases except in the last the FO didn't trim back to normal trimmed flight and let MCAS take over. That in itself is a clue - Boeing thought that pilots would trim to trimmed flight as second nature as part of normal flying. In the same way that car manufacturers with lane keeping software assume that drivers want to stay in lane - only more so. As for professional pilots trimming so the controls can be lightly held is a natural part of flying. Boeing were wrong in this expectation.

It may be as discussed in several posts that the sheer human factors overload and automation surprise has been totally underestimated - in several posts the intrusive nature of the stick 'shaker' has been mentioned as completely over the top of what is required, a single minor fault has an FMEA that results in multiple systems all deciding to add to the cacophony instead of one calm report saying AOA disagree. This is a major human factors issue/failure in all modern aircraft.

Nevertheless, had autopilot, autothrottle and stab trim all been switched off; and control taken over manually all these aircraft would have been controllable and landed.
Aviate , Navigate, Communicate. is nice as a chant - but Boeing relied too much on pilots managing to aviate.

Be aware that this is logically pushing aircraft development toward full automation.
Ian W is offline  
Old 8th Apr 2019, 03:50
  #3583 (permalink)  
 
Join Date: Jun 2006
Location: Brisbane
Posts: 914
Originally Posted by deltafox44 View Post
i would speculate that it will activate upon resetting the stab supply switches
...
The FDR plots indicate that it didn’t. There was no further activation of MCAS until 5 seconds after the final two yoke switch inputs.

Furthermore, it is apparent that MCAS is unaware of the position of the stab cutout switches, because it still tried to trim while the switches were in cutout.

So I would speculate that MCAS wouldn’t have a clue that the cutout switches had just been reactivated, and would only attempt to trim again when the already published criteria are met:

1. AOA still exceeding threshold, and
2. Reset by subsequent pilot activation of yoke trim switch.

So, in theory, a pilot with superior understanding of MCAS could:

1. Hit the cutout switches in response to undesirable MCAS input,
2. Hold back pressure to keep the aircraft safe while collecting thoughts,
3. Reactivate cutout switches,
4. In his own good time, then electrically trim ANU either continuously or in “blips” spaces less than 5 seconds apart,
5. Hit the cutout switches again less than 5 seconds after the last “blip”.

Now, with an aircraft “in trim”, continue with manual trim.

Speaking purely academically of course.


Last edited by Derfred; 8th Apr 2019 at 04:02.
Derfred is online now  
Old 8th Apr 2019, 04:32
  #3584 (permalink)  
 
Join Date: Aug 2008
Location: Trinidad
Age: 58
Posts: 23
Because I now have an understanding of MCAS from this thread. It is conceivable, for whatever reason ( demonstration) that MCAS could be handled like a snake charmer that pats a cobra repeatedly on its head. Dangerous yes, but if every time MCAS “attacks”, the pilot immediately uses a blip of manual electric trim to shut it down for 5 seconds , he could fly a tedious ILS in such a condition. The knowledge which I have now, but isn’t in the FCOM, takes the mystery out of the MCAS monster, which can be easily tamed in so many ways: Flaps, autopilot, cutout switches, trim switches
1. I am convinced that the captain incorrectly kept control instinctively because of how extremely green the FO was and the very low altitude. 100 feet.
2. With that thought implanted in his mind he focused only on AP A. instead of B
3. Nevertheless I don’t buy the explanations in this thread thus far, that the captain used manually electric trim on three seperate occasions but stopped at 2.4, 2.3, and 2.3 units exactly, while still leaving him holding back pressure, instead of prolonged trimming until the column was neutral. I consider this a vital clue and one still to be explained.
4. How unfortunate manual electric trim was never used during the 9 seconds of MCAS activation to expose the control of manual electric trim over MCAS.
5. As for 3 out of 3 crews retracting the flaps. It was always expressed, if possible, clean up the aircraft and speed is your friend. Get clean and fast quickly. The flap connection with MCAS was not clear in their minds.
6. The crew had to think through warnings and confusion immediately as the aircraft got airborne : stick shaker from start to finish, master caution, anti ice, left alpha vane, autopilot wailers, GPWS DONT SINK, over speed clacker, while having to hold increasing back pressure on a vibrating column.
dingy737 is offline  
Old 8th Apr 2019, 04:39
  #3585 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 599
Ian W, I respectfully disagree. A lot of money was at stake, riding on the MCAS being single source, hidden from virtually everyone. I am not the only one making the allegations, it's people who worked on the MAX project.

Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet

March 26, 2019 at 5:00 pm Updated March 27, 2019 at 3:01 pm
...The design

Boeing had been exploring the construction of an all-new airplane earlier this decade. But after American Airlines began discussing orders for a new plane from Airbus in 2011, Boeing abruptly changed course, settling on the faster alternative of modifying its popular 737 into a new MAX model.

Rick Ludtke, a former Boeing engineer who worked on designing the interfaces on the MAX’s flight deck, said managers mandated that any differences from the previous 737 had to be small enough that they wouldn’t trigger the need for pilots to undergo new simulator training.

That left the team working on an old architecture and layers of different design philosophies that had piled on over the years, all to serve an international pilot community that was increasingly expecting automation.

“It’s become such a kludge, that we started to speculate and wonder whether it was safe to do the MAX,” Ludtke said.

Ludtke didn’t work directly on the MCAS, but he worked with those who did. He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off.

And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table.

“The decision path they made with MCAS is probably the wrong one,” Ludtke said. “It shows how the airplane is a bridge too far.”

Boeing said Tuesday that the company’s internal analysis determined that relying on a single source of data was acceptable and in line with industry standards because pilots would have the ability to counteract an erroneous input.

In addition to the imminent software fix for the MCAS, people familiar with Boeing’s plans said the company now intends to make standard two features that previously were optional add-ons at extra cost.
Seattle Times: Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet



The bottom line is that airlines have for the most part "Aviation, Navigating, Communicating" with the 737 Classic and NG safely around the world for a long time. The AoA vane is the same part number on the NG and the MAX, yet suddenly there are two Loss Of Control accidents in a very short space of time on a new airframe due to a fault in this sensor. It is hard to conclude that a lack of aviating, navigating & communicating is suddenly the root cause of the problem.

A fully conscious rational business decision was made to withhold knowledge of the new MCAS software and down rate the risk assessment. The two accidents are proof that that an AoA failure on the MAX and the MCAS should have a failure rating of Catastrophic, and a warning feature & additional training should have been mandated as a consequence.

If that had occurred, a lot of people would still be alive, and ironically, Boeing managers and shareholders would be significantly wealthier.

Last edited by CurtainTwitcher; 8th Apr 2019 at 05:06. Reason: grammar
CurtainTwitcher is online now  
Old 8th Apr 2019, 04:57
  #3586 (permalink)  
 
Join Date: Jul 2007
Location: the City by the Bay
Posts: 507

Mentourpilot explains (back tracks)
armchairpilot94116 is offline  
Old 8th Apr 2019, 05:05
  #3587 (permalink)  
 
Join Date: Nov 2018
Location: Jakarta
Posts: 19
pax here,
In et-Avj fdr traces,
1. The ap Cmd a activated in 1 interval, it is means autopilot can be activated when ias disagree. Even though it willl be off later. Why not directly off by system

At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted, and the pitch trim position decreased to 4.6 units.
2. There is 3 trim nose down commanded by autopilot trim I suppose and flaps retracted when ap cmd a activated,
flaps retract by autopilot / pilot ?

EDIT: it was captain pilot who retract
At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.
At 05:39:55, Autopilot disengaged,

Seems the weird activated autopilot made the pilot brave enough to retract the flaps.
unfortunately the autopilot turned off again due IAS disagree. How it can be activated for 33 seconds when stick shaker was shaking?

Last edited by Realbabilu; 9th Apr 2019 at 13:25.
Realbabilu is offline  
Old 8th Apr 2019, 07:11
  #3588 (permalink)  
 
Join Date: May 2005
Location: Mars
Posts: 521
Not trying to criticise the crew but rather clarify my reading of the data presented:

1. Pilot manually flying, gets an AoA disagreement on climb out, pilots clean up.
2. Pulls back on stick and gets a stick shaker.
3. Pilot trims logically, MCAS trims ND worried about AoA.
4. At some point AP goes in then out, not clear why.
5. MCAS trims ND.
6. Pilots cut-out trim. (It seem MCAS tries to trim down to no effect which was good)
7. No further trim inputs from pilots (Looks like trim wheel not used)
8. Issues with stick forces, re-engage automatic trim and lose control.
9. Manual trim wheel doesn't seem to have been used
9.Throughout speed is increasing because thrust has not changed so stick forces are increasing.

A confusing situation no doubt, but after cutting out the electric trim would setting a sensible pitch and reducing power while using the trim wheel have lead to a different result?
Schnowzer is offline  
Old 8th Apr 2019, 07:42
  #3589 (permalink)  
 
Join Date: Jul 2003
Location: An Island Province
Posts: 1,079
Schnowzer,
AoA Disagree not fitted to the accident aircraft.
Stick-shake after wt-off-wheels, normal operation of stall warning system with (erroneous) high AoA.
MCAS only active with flap up; nose down trim MCAS operation as designed - until it isn’t. **
Pilots continuing concern about stick-shake and corresponding, but erroneous indications of low speed / stall awareness on EFIS (no immediate indication / association with AoA).
Some texts indicate that MCAS is inoperative with AP engaged.
MCAS intermittently trims down, but at a rate / time ratio which overcomes pilots opposing trim.
Pilot electric trim increasingly ineffective (nose up), MCAS more effective nose down due to tail forces / hinge moments.
Stab off, manual wheel trim similarly unable to move trim nose up due to high forces.
A point is reached where what ever option, SOP, etc, is applied, then if the aircraft is not within reasonable control (trim) - manageable by one pilot, there is little more that can be done.

** Underlying question applying to many posts - ‘how do pilots know when the MCAS is not working as required ?’
alf5071h is offline  
Old 8th Apr 2019, 07:48
  #3590 (permalink)  
 
Join Date: Nov 2007
Location: Hong Kong
Posts: 342
When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.
CodyBlade is offline  
Old 8th Apr 2019, 08:39
  #3591 (permalink)  
 
Join Date: Apr 2005
Location: the balmy beautiful south
Posts: 38
A couple quick questions for the airline pilots out there. I’m trying to get a general feeling for the experience/airmanship level of my colleagues around the world. For any transport category jet, how many of you would:
  1. Engage an autopilot with a stick shaker active or any other signs of unreliable airspeed on departure?
  2. Retract flaps with a stick shaker active or any other signs of unreliable airspeed on departure?
  3. Be uncomfortable manually controlling thrust at any point during the flight.
  4. Be uncomfortable manually flying the aircraft during an emergency?
  5. Distrust the average pilot in your company to accurately fly manually during an emergency.
  6. Not use the electric trim system to relieve control column pressure (if it is having a positive effect, such as was almost assuredly the case in the Lion-air and Ethiopian accidents)?
DHC6tropics is offline  
Old 8th Apr 2019, 08:54
  #3592 (permalink)  
 
Join Date: Oct 2008
Location: UK
Age: 39
Posts: 136
Originally Posted by CodyBlade View Post
When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.
Of course that’ll be the job of Boeing lawyers to mitigate and try to reduce liability but ultimately the main culprit will come down to MCAS, it’s design, certification, discreet implementation, lack of redundancy and ultimately its power to overcome pilot actions without crews being made fully aware of its capabilities.

KyleRB is offline  
Old 8th Apr 2019, 08:54
  #3593 (permalink)  
 
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 599
Originally Posted by CodyBlade View Post
When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.
Well, if we want to get really picky, did they complete the "Approach to Stall or Stall Recovery" Non-Normal Manoeuvre (NNM) first, because that the second line says"
"Immediately do the following at the first indication of stall (buffet or stick shaker).
The third item is (step 2 disconnect autothrottle):
"smoothly apply node down elevator to reduce the angle of attack until until buffet or stick shaker stops".

Glad they skipped that NNM and went onto something else. I wonder what the lawyers will make of that decision?

In the cold hard light of day, 3 crews were placed in situations beyond the engineering assumptions of all the SOP's, NNC and NNM's. They faced a continuous cacophony of noise (stick shaker), that has been shown by anecdotal reports in this thread to induce tunnel vision and difficulty doing ANY task, including just flying the aircraft. Two crew were unable to cope, the third had assistance from an additional pilot.

Perhaps as the lawyers are debating and dissecting second by second details, they should do it with the continuous Stick Shaker loop in the background. It really is an asymmetric situation for the crews, if they don't do something (following the NNM for the stick shake and shove the nose down) and save the day at that point they get no credit, yet they don't do something else everyone wants to point to them and say see, pilot error. For the manufacturer it is a business decision to hang the crew if possible as it reduces their liability. They get to cherry pick the inevitable forced pilot errors in such difficult circumstances and gloss over the manufacturers errors and omissions. Nothing personal, just business to make the most bucks it can.

I've pretty much argued consistently in the Lion Air thread and this one, that the crews were put into incredibly difficult circumstances by the rational design choices of the manufacturer. Those design choices were made under circumstances of far less pressure than the crews faced. The only possible justification Boeing could make is was more profitable for them to design the system this way.
CurtainTwitcher is online now  
Old 8th Apr 2019, 08:59
  #3594 (permalink)  
 
Join Date: Jul 2003
Location: An Island Province
Posts: 1,079
DHC6tropics, #3633
Without context none of these ‘predetermined’ measures can rate airmanship.
Experience might be judged according to what has been done (past), but this cannot be reliable projected for the use, the application of that experience in some future event. Who judges, you or an external observer.
Airmanship is not a quantity, at best it’s a rating, a term, something which can be used in conversation because it impossible to deal with these qualities in any other way.

Context, hindsight, and the human condition.
alf5071h is offline  
Old 8th Apr 2019, 09:12
  #3595 (permalink)  
 
Join Date: Nov 2007
Location: Hong Kong
Posts: 342
Originally Posted by KyleRB View Post


Of course that’ll be the job of Boeing lawyers to mitigate and try to reduce liability but ultimately the main culprit will come down to MCAS, it’s design, certification, discreet implementation, lack of redundancy and ultimately its power to overcome pilot actions without crews being made fully aware of its capabilities.

going to be judged not by your peers or professionals who can intepret the data objectively.But by mom and pop.
CodyBlade is offline  
Old 8th Apr 2019, 09:18
  #3596 (permalink)  
 
Join Date: Apr 2005
Location: the balmy beautiful south
Posts: 38
Originally Posted by alf5071h View Post
DHC6tropics, #3633
Without context none of these ‘predetermined’ measures can rate airmanship.
Experience might be judged according to what has been done (past), but this cannot be reliable projected for the use, the application of that experience in some future event. Who judges, you or an external observer.
Airmanship is not a quantity, at best it’s a rating, a term, something which can be used in conversation because it impossible to deal with these qualities in any other way.

Context, hindsight, and the human condition.
Are you serious!?! The ability to make fundamental decisions with regards to configuration and automation in abnormal situations and the ability to confidently and accurately manually fly the aircraft are pillars of airmanship. Unfortunately, airmanship can not be taught purely in a classroom. Much of airmanship comes from professional experience. I’m not American, but I applaud them for their 1500 hour rule. Learning the fundamentals of flying and airmanship should happen long before a pilot is allowed to set foot in a transport category jet.
DHC6tropics is offline  
Old 8th Apr 2019, 09:19
  #3597 (permalink)  
 
Join Date: Aug 2007
Location: airborne
Posts: 6
ET standard pax weight

Hi, anyone knows the standard pax weight used by Ethiopia Airline? Male/Female. The ECAA gives a standard weight 90 M/ 70F including 20lbs handbag. Is it the same?
flyingmate is offline  
Old 8th Apr 2019, 09:25
  #3598 (permalink)  
 
Join Date: Apr 2008
Location: back of beyond
Posts: 98
Originally Posted by CodyBlade View Post
When they went thru checklist Auto throttle 'deselect' not done.

Power left at 94% until end.

In cold light of day Lawyers will have a field day with this.
Getting a bit fed up with this canard. Not saying it shouldn't have been done, but what exactly would this have done to the throttle position in the accident scenario?
fizz57 is offline  
Old 8th Apr 2019, 09:31
  #3599 (permalink)  
 
Join Date: Apr 2005
Location: the balmy beautiful south
Posts: 38
Originally Posted by fizz57 View Post
Getting a bit fed up with this canard. Not saying it shouldn't have been done, but what exactly would this have done to the throttle position in the accident scenario?
Ummm...it would have allowed them to manually control the thrust levers...which is exactly what basic airmanship would dictate.
DHC6tropics is offline  
Old 8th Apr 2019, 09:38
  #3600 (permalink)  
 
Join Date: Nov 2018
Location: madrid
Posts: 47
Fight the normalization of the abnormal

I see more and more posts selecting solutions which are strictly inside the coordinates of what we "know" it is possible. (EG: more training, software patch...) and not seriously mentioning much better / obvious ones.

I say: listen to people from other industries. What we sometimes believe impossible in terms of complexity / cost / time may not be so.

It's time to roll up our sleeves and produce good computer systems for planes. Systems in which sensor signals jumping straight up to off - the - scale - high are automatically rejected and have zero impact. For a start. Updating whichever rules as we go to keep a cheap but much safer solution.

We totally know how to do it right, it's just we forbid ourselves to do it by all sorts of rules and bureaucracy. Let's not accept another band aid.

Somebody wrote many pages ago he spent 30 years in the industry and failed to change substandard quality. Sorry I forgot who. But to him and everyone else, we have to keep fighting, as futile as it may be. It's simply what we have to do.
ecto1 is offline  

Thread Tools
Search this Thread

Contact Us Archive Advertising Cookie Policy Privacy Statement Terms of Service

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.