Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 6th May 2019, 20:26
  #5041 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by Cows getting bigger View Post
737 Driver, TEM incorporates the whole system, not just pilots being faced with issues. So, in this case one could view MCAS trim runaway as the threat with AOA failures, inadequate training, crew responses etc as errors.
You are correct. The TEM model can be applied to the entire chain including what went wrong during the design process. This model is so flexible that it is often used outside of aviation as well. However, as I have previously mentioned, my main interest is what can done at the flight crew level, so that is where my focus is.
737 Driver is offline  
Old 6th May 2019, 20:28
  #5042 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
driver,

the flow of if/then logic in the system is lost with legacy and lack of a comprehensive logic flow chart.

As an example, the accident in DXB, when the pilots pressed TOGA, but then the ac bounced on the runway. The pilots had no idea of the logic switch in the system, and what was disabled with weight on wheels. The mantra, press TOGA, pull back...within 10 seconds the ac impacted the rwy.

The legacy commands, the if/thens, are lost in the FMS programming. Only on incidents, does the legacy and the myriad of if/then scenarios emerge.

MCAS was a poorly applied band-aid to a much larger problem. At least 3 different crews found the holes in the model, 2 of which, cant speak to the issues.

Last edited by Smythe; 6th May 2019 at 20:41.
Smythe is offline  
Old 6th May 2019, 20:34
  #5043 (permalink)  
 
Join Date: Mar 2018
Location: Central UK
Posts: 334
What, exactly, is the use of an "A of A DISAGREE" with no A of A indication to back it up? I can't see it tells you anything useful at all, in fact it merely adds an unquantifiable and unanswerable question into the mix. Had it been fitted it would have required a QRH action to go with it. What could tgat possibly tell you to do about it?
Add another A of A sensor and a triage system and it becomes another matter of course, but it seems unnecessarily harsh to criticise Boeing for not incorporating procedures that can only confuse and not help.

meleagertoo is offline  
Old 6th May 2019, 21:32
  #5044 (permalink)  
PJ2
 
Join Date: Mar 2003
Location: BC
Age: 72
Posts: 2,417
Originally Posted by wonkazoo View Post
The Boeing whistleblower who is working with the FBI confirmed that making the MCAS flight control system reliant on only one sensor was a deliberate decision to avoid the need for expensive Level D or flight simulator training.

“MCAS was designed using data from only one of the sensors because we knew the FAA would not have certified a two-sensor system without Level D Training…”

https://www.youtube.com/watch?v=Qytf...ature=youtu.be at 35:30

Boeing is dead, at least the Boeing we all knew and loved. It’s sadly time to accept that reality.
Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.

PJ2 is offline  
Old 6th May 2019, 21:36
  #5045 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by PJ2 View Post
Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.
It is an NG simulator. You could fake it by throwing in a bad AOA/stick shaker/unreliable airspeed and then introduce a runaway stab after flap retraction. Not what I would call "valid" but "illustrative."
737 Driver is offline  
Old 6th May 2019, 22:02
  #5046 (permalink)  
 
Join Date: Nov 2015
Location: Bay Area, CA
Posts: 65
Originally Posted by PJ2 View Post
Was this video done in a B737MAX simulator? If so, who's simulator, and if not, we need to know how an NG simulator re-produces MCAS behaviour such that the demonstration is a valid one.
The simulation is meaningless and it is on an NG sim. The quote is purportedly from a Boeing whistleblower who is working with the FBI. IF from an accurate source it is not meaningless, it is instead a stunning indictment that Boeing put profit ahead of safety and knew it when they did.

Forget the demonstration- that was so much theater. Look at what the Boeing employee said- that is the important bit, which is why I posted it.

Regards,
dce
wonkazoo is offline  
Old 6th May 2019, 22:05
  #5047 (permalink)  
 
Join Date: May 2019
Location: Järna
Posts: 1
Originally Posted by wonkazoo View Post
Reading the back and forth on the conundrum of “Pilots completely at fault for being stupid” as set against “Pilots completely not at fault because Boeing designed a $hit system,” and I’ve decided to take a stand. Apologies in advance as this is long, but trust me- it is worth it.

Of all of you out there who have posted here- whether with a desire to blame the pilots entirely or the opposite, how many of you have actually experienced an imminent, binary and life-threatening emergency in your airplane?? One that is so explicit you will either get it right or you will die?? And you have maybe 30 seconds to make that choice.

My guess is the list of aviators who can answer honestly that they have been at that threshold of death is very very small.

I am on that list. And I survived, despite making bad choices along the way.

I share this story because I want people to understand once and for all that while it is fine to offer that the pilots could have done better (they totally could have) the root cause of the MAX crashes was one of design, and human failures only built on that edifice to achieve the final outcome.

I also share this story because I want to try to explain to everyone here, in terms we can all understand, what it is really like when your known world explodes and you have to improvise in order to survive.

In June of 1996 I was in a very high performance unlimited category biplane named the Goshawk. (N345RM) I had departed Livermore CA several minutes earlier and was headed to a legal practice box adjacent to the Tracy airport. While over the Altamont hills at an indicated altitude of 4000MSL I began warming up by pulling to a 45 degree upline and doing snap rolls to the right. I did this once or twice. On the third attempt, once again at approximately 4000+MSL I initiated the snap roll to the right and hit hard left rudder as the wings returned to level to stop the autorotation. When I did this the left rudder pedal/bar shot away from my foot instead of providing actual resistance. The left rudder cable had snapped.

The airplane (which was by design dynamically unstable) paused its rotation for a moment and then began again violently to the right, probably at about 360 degrees per second. And here’s where the chair-jockeys don’t get it. I probably went two or three full revolutions before my mind could accept what I already knew had happened. I immediately pulled power, but the aircraft was already entering a nose-down spin- at a rotational rate of at least 360 degrees per second.

The ROD of a spinning aerobatic biplane is pretty steep, probably on the 1500-2000FPM range. I checked my altimeter, saw I was descending through 4,000 feet and decided to try to recover the airplane before bailing out. AND HERE IS THE IMPORTANT POINT: BECAUSE I REFUSED TO ACCEPT THAT THE AIRPLANE WAS COMPLETELY EFFED I would nearly die. My mind knew before then, as it knows now, that if you put a Pitts-like airplane into an autorotational state the only thing that is going to get it out is opposite yaw. With no rudder THERE CANNOT BE ANY OPPOSITE YAW!! I had thousands of hours in similar aircraft, I was an unlimited category competition aerobatic pilot and instructor, and yet when faced with the obvious I could not process it quickly enough, despite having the evidence staring me squarely in the eye, to react quickly enough to prevent me from nearly dying.

So I frittered away precious moments trying to use opposite yaw via ailerons, shots of engine thrust, hell I might have even prayed, I don’t know. What I know now is I could have done better. What I also know now, and somehow managed to forget then, was that I was over the Altamont. When I saw 4000’MSL and thought “OK, I’ve got time to play with this” the reality was I was over a hill- that was 2134’ high. Tracy- just 20 miles away and where I was headed sits at 193’ MSL.

In my mind, because I was stupid overwhelmed, or just unable to process everything being thrown at me I had maybe 3500-4000’ to play with. So I could spend 30 seconds fighting the airplane to try to recover it before I had to bail.

In reality I had less than 2000’ before I would be dead.

I spent probably ½ to ¾ of the real time I had to get out of the airplane in it- fighting to try to save it, and I did this by deliberately ignoring what I already knew (I had lost rudder control completely) what I should have known (I was over the Altamont) and what I should have accepted (I had to go- the Goshawk was not going to survive this, the only real question was would I??)

I obviously did reach the (already foregone but stubbornly ignored by me) conclusion that the airplane was unrecoverable and decided to bail out- which is an interesting concept in a stable spinning airplane. I undid my harnesses as I had practiced, and I fought my way out of the airplane- pinned against the left side of the cockpit coaming by the rotational g-forces before eventually getting enough of my upper body into the slipstream that I was basically yanked out of the airplane. I was falling in a fetal position, thought about waiting to pull the ripcord, said eff-it and pulled, and after the shocking introduction to my first and (so far) only canopy opening was struck by the sound of the airplane smacking into the ground just a second or two later. Future calculation efforts would show that my chute opened between 134 and 200 feet above the ground, which at that rate of descent equaled a couple of seconds at best.

Surviving that incident has given me some small window of insight into what happens when your comfy world devolves in seconds into one where you know you are about to die.

The biggest lesson, and the greatest ego-killer was simple: I didn’t respond nearly as I would have hoped I would. It took me countless seconds to register the fact of the failure. I knew as soon as the pedal fired away from my foot what had happened. But my mind simply refused to accept that reality for some short period of time. The second error was equally simple: I thought I was the hero pilot (Neil Williams etc…) who would bring my crippled plane back to the airport, thereby saving the day. That thought nearly cost me my life, as I wasted precious seconds performing an absolutely useless dance of fancy “airmanship” that did nothing but allow my airplane to bring me closer and closer to the ground with every moment.

And now to the main point of this entirely too-long post: For those of you who suppose you will see everything clearly and “FTFA” when your own fatal opportunity presents itself please hear me when I say this: YOU WILL NOT!! The question that will determine your survival is how quickly will you move past that initial shock and be able to function properly again. In my case it was a single (albeit fatal) failure. I was extremely well trained, averse to panic-driven responses, and well-able to handle the emergency I had been presented with. Yet I wasted probably a full minute in an airplane I had no business being in any longer.

In the 737 crashes it was a cascade of failures. My own- very rare life experience tells me that those pilots had little chance given the stressors they were working under, as would the rest of you. These are not the words of someone who doesn’t know what it’s like. I’ve been there. I lived. So please trust me when I tell you that your vaunted talents will wither to nothing if someday you are in this unfortunate position. At best you will be semi-functional, at worst you will be functionally useless.

What you will not be, in any context, is a hero who defies these realities.

Final note: This isn’t about placing blame on anyone. Boeing designed an airplane with a crap system that had random and unmonitored control over the single most important control surface of the aircraft. The FAA paved the way for certification of the airplane, and once in the hands of pilots that airplane not once, but twice flew itself into the ground. (The pilots didn’t- it was MCAS that did, and that’s an important fact to take note of…) You can blame the pilots all you want, but it was the airplane itself that had a failure mode that required the pilots to be perfect or die. Boeing had years to create a functioning system that would not put the pilots in this position and they failed to create one. So the two (six really) pilots were left to defend themselves against an airplane that was trying to kill them. Four failed in that endeavor, and they have my utmost respect and gratitude.

Only those who have walked the path and survived can understand the fine line between winning and dying- which is why I have posted this ridiculously long post tonight.

Sorry for the sermon, just tired of reading the constant back and forth about who we should blame.

Link to the Final on my incident: Well despite being a member for years I haven't reached the vaunted 10-post threshold for posting URLs. Search "NTSB June 17, 1996 N345RM" for the final report.

Regards,
dce
Dear DCE, the only thing I disagree with is that Your "story" was too long. Not at all, it could not be shorter, though You are a talented writer.
//M
Marian Blacharski is offline  
Old 6th May 2019, 22:08
  #5048 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Threat and Error Management

Part 2

Continuing the Threat and Error Management (TEM) discussion....


Necessary preamble.... Yes, there were many other factors leading to this accident, many of which were outside the control of the crew. The TEM model can be applied to those pieces of the puzzle, but my interest is in what can be learned and applied at the professional flight crew level. What are the takeaways so that pilots can avoid a similar situation in the future?

Using the TEM model to analyze the Ethiopian accident, we can look at the factors that were directly bearing on the crew. We can start by asking "What were the threats?"

Threats can be external or internal (inside or outside the crew's direct control). External threats are things such as weather, terrain, language barriers, external pressure to meet schedule, etc). Internal threats could include such things as fatigue, distraction, and crew experience. Threats can also be known and unknown (but not necessarily unknowable). A known threat might be an inoperative aircraft system that has been placarded. Unknown threats which could still be anticipated would include such things as possible aircraft malfunctions during the flight, a pop-up TCAS alert, or a sudden call by tower to execute a go-around from low altitude. Once identified, the next step is to attempt to mitigate the threat using the tools available to the flight crew.

For ET302, environmental threats might include field conditions (high altitude) and high terrain in the general area. Specific detail on the crew pairing and schedule has not been released, but we can probably categorized a low-time First Officer as a potential threat. If the crew had not flown together much, lack of familiarity with each other could have been a threat. Insufficient rest could have created a fatigue issue. It has been suggested that there may have been a steep authority gradient gradient at Ethiopian which would have discouraged a First Officer from correcting a Captain. If so, this would be a threat, but perhaps an unappreciated one if this authority gradient was deeply embedded in the airline culture. The primary unknown threat was the pending AOA malfunction. Another possible unknown threat was a lack of specific systems knowledge as it related to MCAS and the subsequent trim problem.

For each of the identified (known) threats, what could have the crew done to mitigate them? Primarily, by actually identifying the threats and briefing any appropriate procedures - forewarned is forearmed. For example, one thing I do whenever I fly with a new First Officer is that I explicitly state that anyone on the flight deck can make an error and it was the job of the other pilot to correct those errors. I want my FO's to feel free to speak up. Slowing down and methodically using checklists and flows is another good mitigation strategy. In the more extreme cases, simply refusing to depart until the situation has been satisfactorily changed for the better may be the most appropriate mitigation strategy.

The next question in this analysis is, "What were the errors?"

Errors are caused by human actions or inaction that increase the likelihood of an adverse event. The difference between an error and a threat is that an error can, with careful attention, be quickly identified and crew members can find prompt solutions to the error. This is sometimes known as "trapping" the error. The impact of an error can, therefore, be quickly reduced if properly managed. If not managed correctly, an untrapped error can lead to an undesired aircraft state or create a new threat (known or unknown). Examples of errors include procedural errors, perception errors, miscommunications, and violations of SOP's (intentional or unintentional).

The crew errors seem to fall in the following categories: perception errors (not picking up on obvious cues), procedural errors, CRM errors, and basic airmanship errors. Most of these have been extensively discussed, so I won't repeat them here.

The next question is what were the barriers that should have enabled the crew to trap any error before they led to an undesired aircraft state?

Traditional aviation barriers include policies and procedures, checklists, CRM, knowledge and aircraft handling skills, as well as external resources (ATC, maintenance, etc).

As we look at this accident through the TEM lens, I think there are two very important questions:

Why did the existing barriers fail?

What happens when a barrier actually becomes a threat?

Last edited by 737 Driver; 7th May 2019 at 14:22.
737 Driver is offline  
Old 6th May 2019, 22:08
  #5049 (permalink)  
 
Join Date: Jul 2011
Location: Canada
Posts: 55
Originally Posted by MurphyWasRight View Post
It has pretty well been established on this thread that pilot electric trim will work in all conditions (does not stall under load) and interrupts MCAS if active as shown by ET trace at ~05:40:27. This pilot trim input was possibly then interrupted by cutout switches.

Other than 'deer in headlights' loosing it I see a few possible factors:

1: Pilot accustomed to short blips not comprehending amount truly needed, this fits Lion Air when the FO was ineffective at the end when PIC handed over control while the Captain was mostly successful.

2: Trimming by column feel not position: May seem that AC is closer to trimmed than it is. In other words if you have been pulling really hard then just slightly hard may feel like close to trimmed, I am sure the pilot did not want to over trim given all the alarms.
This might explain ET first retrim at 05:4-:15. Unfortunately we don't have the column force graph, just position.

3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.

Hopefully the final reports will fully address this question.
Another factor is that given the dependence on automation these pilots may have never trimmed this aircraft or any others in their airline career.

Consider that if the airline policy was to use the autopilot to the max (sorry about the pun), their entire career of flying a Boeing product would be to takeoff, climb to 400 ft then engage the autopilot. For this short bit of flying there is no requirement to trim if the stabilizer trim was set properly. During any changes in speed or configuration the autopilot would automatically trim the aircraft. The aircraft would stay on autopilot until short final (1000 AGL or less), the autopilot would be disconnected and, assuming that no configuration or speed changes occur, the aircraft would not have to be manually trimmed.

In speaking with friends flying outside of “the western world” this is exactly what happens. In fact, if the flight data analysis (which, in some cases is analyzed after every flight at some carriers) shows manual flying, the Captain gets queried about why. If it happens too often they get docked pay.

To those of us that insist on doing some hand flying of our jets, this might seem preposterous however that is what is going on in many parts of the world.

I would be interested in hearing if others are under this practice or have colleagues that are.
L39 Guy is offline  
Old 6th May 2019, 22:32
  #5050 (permalink)  
 
Join Date: Jul 2004
Location: Found in Toronto
Posts: 609
Originally Posted by L39 Guy View Post


Another factor is that given the dependence on automation these pilots may have never trimmed this aircraft or any others in their airline career.

Consider that if the airline policy was to use the autopilot to the max (sorry about the pun), their entire career of flying a Boeing product would be to takeoff, climb to 400 ft then engage the autopilot. For this short bit of flying there is no requirement to trim if the stabilizer trim was set properly. During any changes in speed or configuration the autopilot would automatically trim the aircraft. The aircraft would stay on autopilot until short final (1000 AGL or less), the autopilot would be disconnected and, assuming that no configuration or speed changes occur, the aircraft would not have to be manually trimmed.

In speaking with friends flying outside of “the western world” this is exactly what happens. In fact, if the flight data analysis (which, in some cases is analyzed after every flight at some carriers) shows manual flying, the Captain gets queried about why. If it happens too often they get docked pay.

To those of us that insist on doing some hand flying of our jets, this might seem preposterous however that is what is going on in many parts of the world.

I would be interested in hearing if others are under this practice or have colleagues that are.
As airline pilots our recurrent training often emphasizes or incorporates items that were the causes of recent airline accidents or incidents:

I can just see it now.... My next session is going have some spot training involving hand flying while operating the electric trim switches up and down .
Lost in Saigon is offline  
Old 6th May 2019, 22:33
  #5051 (permalink)  
 
Join Date: Apr 2019
Location: Michigan
Posts: 4
Not a pilot - software engineer that started my career at a small company that produced hardware-in-the-loop testing and certification solutions for major aerospace and defense organizations. I experienced first-hand the sort of pressures and poor communications/management between entities that leads to audits/test results/certifications be pushed through too fast and in incomplete forms and to be honest it made me wonder if we wouldn't start to see failures like this tragedy unfold in the near future.

From the information available my gut feeling tells me that the systems design on the MAX was intentional, not an instance of well-meaning engineers making a mistake. There's the change of the rate of trim applied made late in the testing stages (from 0.6 units to 2.5 units per time period?) and the seeming lack of any sort of sanity checks in the MCAS system that just seems impossible to miss. There are very basic things that can be done in software even beyond bringing in more sensors to fall back on such as checking the values that come before (is it ever possible for AOA to jump over from 14 to 75 degrees in under a second?). This is something that should have been glaringly obvious to all involved in the process and if there was genuinely no bad intentions on Boeing's part then what this suggests is serious organizational rot. In either case I would hesitate to put confidence in other aspects of the design if this system is such a mess.

I've yet to see a satisfactory explanation behind the changes to the trim cutout switches. Sure, I've read that they are always used at the same time but how does that justify neutering the behavior but leaving the two switches except for different labels? In what world does it make sense to get rid of the ability to cutout the plane's automation (STS, MCAS, probably others that I'm not familiar with) while still allowing the pilot to enter trim commands using the stab motor? What does this improve upon the original design of the switches? A change like this involves multiple engineering departments in order to implement and everything is documented and cross checked along the way. I'm very curious as to what the justification is here.

And the mysterious short blips of trim shortly before MCAS dealt it's final blow... From following along in this thread and others I've come to the knowledge that trimming away pressure in the control column is one of the most basic aspects of flying that there is. The failures to get completely back into trim and then the final blips suggest to me that something else is wrong. From what I see other pilots saying it sounds like the equivalent of someone in the path of an oncoming semi-truck applying very slight turns of the steering wheel to get out of the way (sorry for the clumsy metaphor). If airline training has taken such a deep dive in quality over the years as to lead to pilots that don't have supposed basic airmanship skills, doesn't this imply that we should expect to see a steep increase in the amount of pilot errors leading to accidents?

So far they have been confined to two hulls of the same make and model within the first years of it entering into flight...

If you read all of that then thanks for taking the time to consider the viewpoint of someone from outside the profession. I've become somewhat obsessed with this MAX fiasco because just like it highlights the importance of airmanship to some pilots here, to me it highlights the importance of systems design and good engineering practices in the software and technology world. It is cheap and easy to alter products by manipulating lines of code but we must keep in mind that the impact that it has on the word is just as real as that of the other more "material" engineering professions.
shmerik is offline  
Old 6th May 2019, 22:35
  #5052 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by Lost in Saigon View Post
As airline pilots our recurrent training often emphasizes or incorporates items that were the causes of recent airline accidents or incidents:

I can just see it now.... My next session is going have some spot training involving hand flying while operating the electric trim switches up and down .
Yep, always training for the last accident, kind of like generals fighting the last war.....
737 Driver is offline  
Old 6th May 2019, 22:40
  #5053 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 1,907
wheelsright,

But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches?’

Overall, and biased by the accident outcome, I doubt that nose up trim would have been effective, particularly when considering time of recognition, realisation, and action.

Continued debate considers if trim would / was enabled to override MCAS.
Then, the erroneous rate / power of MCAS design would out perform trim by 9 sec down to 3 sec up.
Also, there is debate and interpretation if trim is restricted due to design (EASA questions) and further if the aerodynamic forces restrict nose up motion - tail / elevator interaction.
Then the above must consider the pilots perception of the situation, the need for trim and the extent of trim required in very stressful, surprising, and demanding conditions.

All that must be confined to history. Whatever is changed in the MCAS operation it must not be able to mis trim the aircraft to extreme.

As for judgement of crew performance, consider https://www.pacdeff.com/pdfs/Errors%...n%20Making.pdf
Crews either fail to understand the situation, HF - thus choose the incorrect procedure
Or with correct understanding, the incorrect procedure is chosen - HF (or procedure is not available - documentation, training, novel failures)
safetypee is offline  
Old 6th May 2019, 22:46
  #5054 (permalink)  
 
Join Date: Jul 2011
Location: Canada
Posts: 55
Originally Posted by Zeffy View Post
https://youtu.be/QytfYyHmxtc

Compelling interviews with Chris Brady ( The Boeing 737 Technical Site ), Dennis Tajer, Peter Lemme, David Learmount and Dominic Gates.
43 minutes...
That simulator sequence at the beginning was interesting to see. If that wasn't a stab trim runaway I don’t know what is. Uncommanded pitching of the nose (down in this case) and spinning of the trim wheel. someone hand flying that aircraft couldn’t miss that or mistake that as not being a textbook stab trim runaway.

Interesting too that arm strength with continuous trim recovers that aircraft. That would be an opportune time to hit the stab trim cutout switches.
L39 Guy is offline  
Old 6th May 2019, 23:10
  #5055 (permalink)  
 
Join Date: May 2010
Location: Boston
Age: 68
Posts: 439
Originally Posted by safetypee View Post
wheelsright,

But do you think that it is possible to use electric trim to counteract MCAS before using the cut-out switches?’

Overall, and biased by the accident outcome, I doubt that nose up trim would have been effective, particularly when considering time of recognition, realisation, and action.

Continued debate considers if trim would / was enabled to override MCAS.
Then, the erroneous rate / power of MCAS design would out perform trim by 9 sec down to 3 sec up.
One last time: Please look at the ET traces from 05:40:00 (first MCAS) to 05:40:45.
This shows MCAS trimming down, an inadequate pilot retrim followed by another MCAS trim 5 seconds later, this second MCAS trim was interrupted after 6 seconds by pilot trim.
This pilot trim continues until trim cutout. Had they waited 10 more seconds while continuing to apply trim the AC would likely be in trim.
Each of these trim inputs clearly show on the pitch trim trace.

All of the above is exactly as described by original MCAS 'disclosure'.

Not sure where the '3 sec up' in your post comes from, the second pilot trim in above is 8 or 9 seconds (hard to read exactly from graph).

They did re-enable electric trim at end, likely a desperate measure, unfortunately they did not provide sustained trim inputs but did re-trigger MCAS one last time.
The trim position trace at 05:43:15 show a slight upward bump after the 2 'blip' showing the electric trim working against the aero loads.
The trim inputs would not show on the trace if still cutout due to cutout switch wiring.
MurphyWasRight is offline  
Old 7th May 2019, 00:25
  #5056 (permalink)  
 
Join Date: Feb 2011
Location: Grand Turk
Age: 57
Posts: 66
Originally Posted by MurphyWasRight View Post
One last time: Please look at the ET traces from 05:40:00 (first MCAS) to 05:40:45.
This shows MCAS trimming down, an inadequate pilot retrim followed by another MCAS trim 5 seconds later, this second MCAS trim was interrupted after 6 seconds by pilot trim.
This pilot trim continues until trim cutout. Had they waited 10 more seconds while continuing to apply trim the AC would likely be in trim.
Each of these trim inputs clearly show on the pitch trim trace.

All of the above is exactly as described by original MCAS 'disclosure'.

Not sure where the '3 sec up' in your post comes from, the second pilot trim in above is 8 or 9 seconds (hard to read exactly from graph).

They did re-enable electric trim at end, likely a desperate measure, unfortunately they did not provide sustained trim inputs but did re-trigger MCAS one last time.
The trim position trace at 05:43:15 show a slight upward bump after the 2 'blip' showing the electric trim working against the aero loads.
The trim inputs would not show on the trace if still cutout due to cutout switch wiring.
"One last time" the FDR trace does not track thumb switch trim inputs. Therefore, it cannot be said with certainty what the pilots were doing. The assumption is that Boeing advice is correct but it is not absolutely certain. Unless you can authoritatively show that MCAS has no authority during thumb switch input in all circumstances then you are speculating.
wheelsright is offline  
Old 7th May 2019, 01:01
  #5057 (permalink)  
 
Join Date: May 2010
Location: Boston
Age: 68
Posts: 439
Originally Posted by wheelsright View Post
"One last time" the FDR trace does not track thumb switch trim inputs. Therefore, it cannot be said with certainty what the pilots were doing. The assumption is that Boeing advice is correct but it is not absolutely certain. Unless you can authoritatively show that MCAS has no authority during thumb switch input in all circumstances then you are speculating.
Ok I will bite:
Unless you can authoritatively show the FDR trace does not track thumb switch trim inputs a reasonable interpretation of the traces is that it does. I have not seen anything that shows otherwise.

As to whether the switches tracked the pilots thumb and or intentions is possibly an open question, especially the blips at the end.

Don't know about "all circumstances" but the trace at 05:40:27 shows the manual trim stopping MCAS before the full 9 or seconds it would have run.

The schematic that was posted also shows manual electric trim overriding automatic,the 'trim motor' is shown as a block so can't 'prove' this.

In any case not clear where this is going, in ET case MCAS is clearly disabled by pilot trim (for 5 seconds) and cutout, had they succeeded with manual trim we would not be having this discussion.

No need for elaborate undisclosed actions, the stated behavior explains what is seen.
Occam's razor might be constructively considered here.

Last edited by MurphyWasRight; 7th May 2019 at 01:10. Reason: added for 5 seconds
MurphyWasRight is offline  
Old 7th May 2019, 02:04
  #5058 (permalink)  
Psychophysiological entity
 
Join Date: Jun 2001
Location: Tweet Rob_Benham Famous author. Well, slightly famous.
Age: 80
Posts: 4,761
Still concentrating on the Human Factor - the miserable consuming confusion while under stress.

Recently I said.
" there's a chance some pre-knowledge of the Lion Air accident had a negative effect on the ET skipper's actions. Firstly a greater shock factor - due to realising a very specific and serious danger was confronting him . . ."
However, Lord Farringdon put it far better, and in commoner's language.

If the ET Captain had never heard of MCAS, he probably would have carried out the UAS and landed safely. Basically, his mere knowledge of MCAS but lack of full understanding of it may have scared the c##p out of him.
Hopefully by now the ET captain may well have linked the duff AoA with an airspeed error and stick-shake, but not the failure of the AP to stay locked on for more than thirty seconds. He was probably processing that while the wheel spun for 9 seconds.

I recall leaving the classrooms after Type conversions with a reasonable knowledge of system interactions . . . at best. Usually, the light-bulb would come on after 300 to 500 hours and a lot of work. How one system affected another was the most difficult part of any type conversion for me, and in the modern world, I'd imagine the MAX is an order of magnitude more involved. I have to concede 737 Driver's 'Fly and then press on with the drills', rather than analyse too deeply is vital. It's simply too complex these days.

.

.

Last edited by Loose rivets; 7th May 2019 at 12:08. Reason: Murpy's spotted AP time on incorrect. Corrected.
Loose rivets is offline  
Old 7th May 2019, 02:21
  #5059 (permalink)  
 
Join Date: May 2010
Location: Boston
Age: 68
Posts: 439
Originally Posted by Loose rivets View Post
Still concentrating on the Human Factor - the miserable consuming confusion while under stress.

Recently I said.


However, Lord Farringdon put it far better, and in commoner's language.



Hopefully by now the ET captain may well have linked the duff AoA with an airspeed error and stick-shake, but not the failure of the AP to stay locked on for more than three seconds. He was probably processing that while the wheel spun for 9 seconds.

I recall leaving the classrooms after Type conversions with a reasonable knowledge of system interactions . . . at best. Usually, the light-bulb would come on after 300 to 500 hours and a lot of work. How one system affected another was the most difficult part of any type conversion for me, and in the modern world, I'd imagine the MAX is an order of magnitude more involved. I have to concede 737 Driver's 'Fly and then press on with the drills', rather than analyse too deeply is vital. It's simply too complex these days.
Minor correction, after a couple of false starts the autopilot was engaged for more than 30 seconds, just long enough to provide a false sense of "not that bad"?
Then it all hit the fan on short order with AP disconnect followed by MCAS.
MurphyWasRight is offline  
Old 7th May 2019, 02:37
  #5060 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Threat and Error Management

Part 3

Continuing the Threat and Error Management discussion.....
If you are joining midway through, I highly recommend that you go back to the beginning (Part 1) starting with the post with the TEM graphic.

The TEM model posits that there will always be threats, that there will always be errors, but that by intelligently designing and employing sufficient barriers, threats can be identified and mitigated, and errors can be trapped before they lead to an undesired aircraft state, incident, or accident.

Threats and errors were covered in the previous post, and a list of potential barriers were identified. I left off with what I thought were two germane questions:

Why did the existing barriers fail?

What happens when a barrier actually becomes a threat?

​​​​​Once again, traditional aviation barriers that apply to flight deck operations include policies and procedures (SOP's), checklists, crew resource management (CRM), knowledge and aircraft handling skills, as well as external resources (ATC, maintenance, etc). CRM procedures would include briefings, communication, active monitoring, deviation callouts, assignment and execution of pilot flying/non-flying pilot (PF/NFP) duties. Knowledge and aircraft handling skills would determined by the particular training and experience of each pilot.

Which of these barriers failed? (easier question) Why did they fail? (harder question)

Unfortunately, not enough is known of the specific Ethiopian SOP's, crew discussions prior to takeoff, or specific training and experience to definitively address some of these questions. However, we can still make some (hopefully) useful observations. The data that has been released to date suggests that the ET302 Captain did not fully process the nature of the malfunction (perception error). Having not perceived the true nature of the malfunction, he proceeded to apply inappropriate procedures (attempting to engage A/P, retracting the flaps before the AOA/UAS malfunction was resolved). The repeated attempts to inappropriately engage the autopilot and subsequent aircraft handling (particularly the lack of aggressive trimming against the MCAS input) suggest a lack of comfort with hand-flying. At this point, it is impossible to say how much of the Captains actions were driven by a particular lack of knowledge or skill, or rather, the inability to draw upon that knowledge or skill under pressure. However, I think it is a reasonable observation that, to the degree that any barriers resided within the mind of the Captain (perception, SOP's, knowledge, aircraft skills), these barriers were ineffective. In short, the Captain could not trap his own errors. When errors are not properly trapped, they can convert to new threats. Or to put it another way, what should have been barriers actually became threats.

How did these barriers become threats? There are signs that the Captain was experiencing cognitive overload. Contributing issues could include fatigue, distraction, pressure to meet schedule, inadequate training, and/or perception that he was effectively single pilot (more on that in a moment). Whatever the reason, the TEM model does suggest an appropriate response when barriers become threats.

Before that discussion, I need to touch on one other aspect of this accident. Based upon some of the previous feedback, I suspect some of you are not going to like this part, but I feel this is a necessary exercise. There was another potentially useful barrier on the flight deck that day - the First Officer. This is an interesting case in that I have already identified a low-time FO and the possible existence of a steep authority gradient on the flight deck as potential threats. So was the FO a threat or a barrier? Or a little of both?

One piece of information we do not have is whether any steps were taken to mitigate the FO as threat. How well did the Captain know the FO and how did he perceive the FO's competency? Did he enquire as to his recent experience or if he had any particular questions? How thoroughly did the Captain brief his FO? Did the Captain perceive that there was a potentially hazardous authority gradient, and if so, did he attempt to mitigate it with clear guidance to the FO that he was expected to speak up as necessary?

Now let's discuss the FO as a potential barrier. In a two-pilot crew operation, each pilot is expected to back up the other and help identify and mitigate threats as well as trap errors. They are also expected to work together to resolve any non-normal procedure.

One of the remarkable aspects of the CVR discussions that have been released so far are not so much what was said, but what was not. There is very little discussion of the ongoing malfunction or the state of the aircraft. There is no discussion of airspeeds or altitudes. No one calls for any checklists, normal or otherwise. When the Captain tries to engage the autopilot with an active stick shaker (three times!) the First Officer does not question this action. By the time the aircraft reaches 1000' (and before MCAS ever showed up on the scene), the signs of unreliable airspeed were present. The Captain was absorbed in flying the aircraft and apparently greatly distracted. What was the First Officer doing? A fully qualified and proficient FO should have been monitoring both the aircraft and the Captain. He should have identified the UAS situation, but did not do so. If he had identified the UAS, he should have called for the appropriate NNC himself if the Captain did not do so. When the Captain called for the flaps to be retracted while they had an active stick shaker and before any non-normal procedure had been called for, the First Officer simply did as requested and did not question whether it was an appropriate action. As the airspeed increased toward VMO, the First Officer said nothing. When the Captain was obviously applying an excessive of back pressure on the control column without sufficient trimming, the First Officer did not prompt the Captain to trim or ask if the Captain needed help inputing trim. By not trapping any of the Captain's errors, those errors now converted to new threats. The First Officer failed to be an effective barrier.

Some have pointed out, seemingly to the First Officer's credit, that it was he who finally identified the runaway stab trim problem (we should note for the record that the First Officer only made this observation the second time MCAS began it's 9-second, 37 spin journey to oblivion). But rather than this being a positive result, it was actually the final link in a long chain of errors that doomed this aircraft. Yes, that's right, the First Officer introduced his own deadly error into the chain.

From the transcript:
.
At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First- Officer confirmed stab trim cut-out.




When a non-normal checklist is needed, the procedure is for the first pilot seeing the problem to call out the problem (In this case "We have runaway stab trim") and then for the other pilot to confirm ("Yes, I agree. We have a runaway stab."). This is a quote from my airline's FCOM: "Prior to performing procedures, both pilots should communicate and verify the problem."

"Stab trim cutout" is not a problem. It is a command (maybe suggestion?). "Runaway Stab Trim" is a problem. When the First Officer said "stab trim cut-out", the (likely overloaded) Captain pounced on the suggestion, one of the pilots cutout the trim, and they were finally and fatally screwed with a stabilizer in an untenable position and no effective way to move it.

The next step in a non-normal situation is for one of the pilots (at some airlines it is the Captain, at some airlines it is the Pilot Flying) to call for the appropriate NNC procedure. Again from the FCOM: "Identifying the correct procedure is critical to properly managing the non-normal situation."

There is a bit of divergence here depending on whether the airline uses a Quick Reference Card (QRC) or the "Memory Item" method. My airline uses a QRC, but basically the goal is to work through the steps in a methodical fashion. Grabbing controls and switches without careful thought can lead to all sorts of misery. Think here of those accidents that resulted from crews shutting down the wrong engine during an engine fire/failure in flight response. From the FCOM: "Non-normal checklists use starts when the aircraft flight path and configuration are correctly established......Usually, time is available to assess the situation before corrective action is started. All actions must then be coordinated under the Captain's supervision and done in a deliberate, systematic manner. Flight path control must never be compromised." In other words, fly the aircraft first, and don't rush through the procedure.

Okay, I know some might find the preceding paragraphs tedious, but they are important to understand this final fatal error.

The Runaway Stabilizer checklist has been previously posted, so I won't duplicate it here except to enumerate two particular steps. Step 2 of this NNC states: "Autopilot (if engaged) .... Disengaged. Do not re-engage the autopilot. Control aircraft pitch attitude manually with control column and main electric trim as needed." It is not until Step 5 of this checklist that we get this: "If the runaway continues after the autopilot is disengaged: STAB TRIM CUTOUT switches (both)..... CUTOUT." It should be added that it is really not necessary that all the words be said correctly as long as all the actions are performed correctly.

By methodically following the published procedure (rather than responding reflexively to the First Officer calling out "Stab Trim Cutout!"), the Captain would have been prompted to trim the aircraft with the Main Electric trim - the very thing he most needed to do after MCAS kicked in. Only after the aircraft was returned to neutral trim was it appropriate to use the stab trim cutout switches, not before.

The First Officer should have been a barrier. Instead he was a threat.

The Captain should also have been a barrier to his own errors and the errors of his First Officer. Being unable to trap either set of errors, those errors became threats.

Too many threats, too many errors, not enough effective barriers.

So we are now left with (a variation of) my final question:

What should one do when a barrier actually becomes a threat?

Last edited by 737 Driver; 7th May 2019 at 14:23.
737 Driver is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.