Ethiopian airliner down in Africa

[Water pilot]

Coding these days rarely has errors as there are many tools that can be used to verify the code it will also validate correctly as the code does just want the designer erroneously asked it to do.

You just made me spit out my coffee! I think we must work in vastly different parts of the industry.

As a side and possibly interesting technical note, it is not possible to prove even that a given program will terminate given a specific input, that is one of the early theorems in computer theory, dating back to before computers actually existed. Sometime in college I had a course on proving programs correct; the text was a medium sized book that as I recall spent many chapters proving that a simple algorithm for floating point division was correct. Having already worked for a scientific company (and having found a bug in their floating point libraries) and being a better programmer than theoretician I did the obvious thing and implemented the pseudo code -- and promptly found that pseudo code which had been proven correct in several different ways actually produced the incorrect answer in many common cases! The frustrating part was that although I could easily see why the code was wrong, I was never really able to figure out why the proof that it was correct was wrong. My much smarter friend who was just as crazy as I independently did the same thing and she got the same conclusion. She actually worked for Boeing back in the day.

[Realbabilu]

Originally Posted by patplan

An edited GIF version of Mentour Pilot Video...
..

Or, you can watch most of it here...
- https://vimeo.com/329558134
https://fpdl.vimeocdn.com/vimeo-prod...e382f0eef47c84

Maybe the sim not as realistic as the real one.
I cant hear the sim stick shaker for far more dramatize the upset condition

[Loose rivets]

As someone who's flown a simulator with little wooden houses going by on a huge conveyor belt, I suppose I'm predisposed to doubt the purity of even the latest simulation, despite electronics being one of the strings to my bow.

The box they're in obviously doesn't have a long cable run, and if there is any use made of steel cable, it must be loaded by a simulation device. Okay, doable, but here's the rub. If Boeing produce an aircraft that can allow a vital control surface to be impossible to move, how the Dickens can a simulator manufacturer program a valid reality from such incomplete information?

[L39 Guy]

Checklists

Originally Posted by GordonR_Cape

Alchad



Many people (still) blame the pilots for getting into that situation, by not taking action sooner. All sorts of clever answers are possible, for those sitting at home, and having had time to read the accident report.

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

[Hi_Tech]

Originally Posted by CP Bern von Hoesslin

Ref.: 737-7/8/9 Training Manual 22-11-00, Dated 19.Sep.2016 Pages 165, 166 and 167

Ref.: THE MOST IMPORTANT QUESTION ON THE LION AIR AND ETHIOPIAN 38M AIRCRAFT CRASH INVESTIGATION maybe!

A simple version here.

Will the PRI Toggle when moved to CUT OUT, IS IT 100% GUARANTEE to remove -all- electrical signals to the Stab Trim Motor?

Why do I ask? "The FCC supplies MCAS signal to enter high speed mode on the stab trim motor and bypass the aft column cutout switches for trim down commands.". As we know also in error.

THUS if the B/U is in CUT OUT, then MCAS still has authority but what about PRI in CUT OUT?"

The trim commands from the FCC is processed in the "autopilot section of the motor". That means besides the FCC A in these cases, there is another controlling Software either part of the MCAS programing (thus active when a Fault like is being considered part a chain of errors in these two accidents) or a separate sub routine / program influencing the Stabilizer Motor into moving the Stabilizer that has never been mentioned before.

I'm thinking like a chicken with its head cut off, the nerves can still allow it to run around.

So the PRI in CUT OUT, does it still allow impulses from the "auto pilot section of the motor" however created, to move the stabilizer via 28VDC thru the motor un-commanded when the operating crew thinks they've isolated that electric trimming (CUT OUT), thus do not expect further electric trimming (non-pilot induced)?

To keep it simple - PRI and B/U toggles in CUT OUT there is no possible way the stabilizer movement (NU or ND) can be activated unless done manually by the crew using the Trim WHEELS OR a failure of the stabilizer mechanics i.e. excessive speeds beyond VMO, thus possibly breaking or stressing / stretching the components moving the stabilizer itself i.e. for example into the full AND position which is then fatal as non-recoverable?

Any Source I can contact, kindly PM? I do not have access to Boeing Customer Service any more.

Thanks in advance for all PPRUNER's efforts here.

CP Bernd von Hoesslin

===============================

You can’t use the Private Messaging system, add url links or images until you have an established posting history

I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

[Escape Velocity]

Originally Posted by L39 Guy

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

[EDLB]

Originally Posted by Hi_Tech

I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

Thanks for the diagram. The two cutout switches are in series so they are the STAB and B/U.
The cut out funktion works over the R64 main relay. At the same time the FCC knows that it is cut out. What worries me more is, that the MCAS signal seem to be able to switch the Stab motor into fast mode as when the flaps where down via K5. My assumption is, that since the increase to 2.5 degrees MCAS stab was necessary, MCAS can move the stab faster than the pilots can in a flap up condition.

[HundredPercentPlease]

Originally Posted by L39 Guy

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).

Originally Posted by L39 Guy

why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

It was three memory checklists:

1. Stall recovery.
2. UAS recovery.
3. Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

[alf5071h]

‘Blame’ is used as a self-satisfying closure for complex, often indeterminate situations (‘wicked problems’).
Assuming that something was understood as an opening analysis risks hindsight bias, or that everyone will have similar understandings, similar thought processes.
UAS could equally be stick-shaker implying stall, or a range of alternative perceptions according to context. Bounding problems with assumption might aid our after-the-fact understanding, but whatever we conclude is only probability, because we can never know what these crews perceived, what was thought, or understood, or any reasoning for action.

Start with a view that the crew acted as they saw the situation (not our view), that humans are an asset to be used and not a hazard to be constrained; this and the above might provide an alternative analysis. Not fact only probable, but an understanding which might better be used to learn from.

As background see:-

https://www.nifc.gov/PUBLICATIONS/ac...an%20Error.pdf

https://www.ida.liu.se/~729A71/Liter...berti_2001.pdf

https://www.eurocontrol.int/sites/de...ndsight-25.pdf Page 10 -

https://www.demos.co.uk/files/systemfailure2.pdf

“Problems worthy of attack prove their worth by hitting back.
Man's a kind of Missing Link, fondly thinking he can think.”

“Modern man has the skill; he can do what he will.
But alas - being man he will do what he can.”

“You'll conquer the present suspiciously fast if you smell of the future -- and stink of the past.”

Grooks of Piet Hein

[Lost in Saigon]

Originally Posted by Escape Velocity

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

Here is the B737 MAX Unreliable Airspeed Checklist. Compared to the NG, the memory items are identical, and the rest has only a few differences.

[bsieker]

Originally Posted by alf5071h

‘Blame’ is used as a self-satisfying closure for complex, often indeterminate situations (‘wicked problems’).
Assuming that something was understood as an opening analysis risks hindsight bias, or that everyone will have similar understandings, similar thought processes.
UAS could equally be stick-shaker implying stall, or a range of alternative perceptions according to context. Bounding problems with assumption might aid our after-the-fact understanding, but whatever we conclude is only probability, because we can never know what these crews perceived, what was thought, or understood, or any reasoning for action.

Start with a view that the crew acted as they saw the situation (not our view), that humans are an asset to be used and not a hazard to be constrained; this and the above might provide an alternative analysis. Not fact only probable, but an understanding which might better be used to learn from.

As background see:-

https://www.nifc.gov/PUBLICATIONS/ac...an%20Error.pdf

https://www.ida.liu.se/~729A71/Liter...berti_2001.pdf

https://www.eurocontrol.int/sites/de...ndsight-25.pdf Page 10 -

https://www.demos.co.uk/files/systemfailure2.pdf

[...]

Thank you. I agree completely.

I would add to the list of references any of Sidney Dekker's works, in particular The Field Guide to Understanding 'Human Error'.

Bernd

[flyingchanges]

Originally Posted by HundredPercentPlease

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).



It was three memory checklists:

1. Stall recovery.
2. UAS recovery.
3. Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

MCAS would not be a factor until the flaps were up.

[ams6110]

Originally Posted by HundredPercentPlease

It was three memory checklists:

1. Stall recovery.
2. UAS recovery.
3. Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

Interesting idea, but I wonder why he would have decided that his strategy was to engage the autopilot rather than simply leave flaps extended. If he knew enough about MCAS to know that it doesn't operate when autopilot is on, he would presumably also know it doesn't operate with flaps extended. Also if that it what he was thinking, then that implies he knew that the stall warning was false?

[Maninthebar]

Originally Posted by ams6110

Interesting idea, but I wonder why he would have decided that his strategy was to engage the autopilot rather than simply leave flaps extended. If he knew enough about MCAS to know that it doesn't operate when autopilot is on, he would presumably also know it doesn't operate with flaps extended. Also if that it what he was thinking, then that implies he knew that the stall warning was false?

Or.... insufficient confidence in knowing which of the three plus inadequate height agl
So
Power maintained to mitigate stall risk
Autopilot engaged to mitigate against MCAS
UAS less of a risk than either of the above

??

[armchairpilot94116]

Ethiopian Crash Data Analysis Points To Vane Detachment |

Firewall but but the first paragraph says a lot
now why did the vane come off ? Still doesn’t excuse Boeing of MCAS reliance on one vane.

[GarageYears]

Originally Posted by shackson

Is it known if the vane has been recovered or was destroyed?

A bit of a needle in a haystack, but they should sure be looking for it. It should be possible to determine a specific location where it detached and hence a search area.

Understanding why it fell off is important, especially since it is not the same problem as affected Lion Air, despite the resultant similar crashes.

- GY

[Loose rivets]

Can't get the above link.


Is the vane detachment - the very bizarre coincidence of two different failures - solely based on the different angle split readouts?

[L39 Guy]

Recall Emergencies

Originally Posted by HundredPercentPlease

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).



It was three memory checklists:

1. Stall recovery.
2. UAS recovery.
3. Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

If one rolls down the runway with both engines providing the advertised thrust (94%), the airspeed cross check at 80 indicates no disparity, and the aircraft is rotated normally at Vr with both airspeed indicators working normally then rotated to a climb attitude and the engines continue to turn and burn, then any erroneous stall warning has to be ignored and treated as such. That is why manufacturers provide nominal pitch/power settings to insure a stall free climb or cruise while it gets sorted out. In fact, I had the same stick shaker after take-off many years ago on the 737-200 after lift-off; yes, it gets your attention but if the attitude of the aircraft is ok and the engines are running fine then it cannot be a bona fide stall but an erroneous indication.
If the crew thought it was a stall, then the stall recovery should have been implemented - it was not and in fact they (Ethiopian) tried to engage the autopilot, a definite no-no in a stall.
So even setting aside the MCAS issue later, sadly this all points to training and experience to handle a pretty basic emergency. And that points back to the airline and the CAA who are responsible for that.

[alf5071h]

L39 Guy,

“… sadly this all points to …”
… the persistence, the difficulty in avoiding hindsight, prejudging, assuming; -

How would a crew know that stick-shake just after lift off is erroneous. How is the accuracy of AoA established, of attitude, or at that instant, speed, until the accuracy of these is confirmed all that remains is assumption.
Whatever is argued, the correct AoA cannot be determined even with an EFIS display - which one is correct.
The on-side airspeed will be inaccurate because AoA is used in pressure error correction. Similarly the EFIS low speed awareness - based on AoA, perhaps adding to a belief that stick shake is valid.
Add distractions of Speed and Altitude Disagree alerts, and Feel Diff Press, together with the surprise of an unexpected event, or even higher stick force due to Feel Diff, then all available thinking ability is required to manage what exists.
In time, crosschecking speed, attitude, ‘feel’ (experience) might judge otherwise.

Assumptions such as “… it cannot be a bona fide stall but an erroneous indication” can be just as hazardous as an abnormal technical situation.
And thus any conclusion based on such assumption fails because of false reasoning.

Back to the links in Ethiopian airliner down in Africa - background reading.

[GordonR_Cape]

Originally Posted by Loose rivets

Can't get the above link.


Is the vane detachment - the very bizarre coincidence of two different failures - solely based on the different angle split readouts?

Article summarises the fact that evidence is all in the FDR readout:
- Initial wild gyration of AOA sensor immediately after takeoff.
- Thereafter stable at implausibly high AOA.
- Moments before the final crash, the aircraft entered a negative-g bunt, AOA sensor flipped 180 degrees, stick shaker stopped.
Already hinted before in this thread, but the only physical explanation consistent will all of these data points is vane detachment. The event is clearly different from Lion Air, which had a constant 20 degree offset, but the end result was the same.

Re-posting annotated FDR readout: