Go Back  PPRuNe Forums > Flight Deck Forums > Rumours & News
Reload this Page >

Ethiopian airliner down in Africa

Rumours & News Reporting Points that may affect our jobs or lives as professional pilots. Also, items that may be of interest to professional pilots.

Ethiopian airliner down in Africa

Old 7th May 2019, 16:24
  #5081 (permalink)  
 
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,831
The problem with TEM is that it tends to encourage linear thought - actions will create the desired resolution. I spent some time in the UK RAF where we often quoted the Boyd`Cycle (OODA Loop) which was more of a circular decision making process - think DODAR. The advantage of the Boyd Cycle is that you review the efficacy of your actions and then, potentially, choose additional or even different actions.

Of course, such flexibility and decision making (including potential divergence from checklists) requires experience and deep theoretical. knowledge. In that area I think we all agree that aviation is struggling, not just due to the training system but also due to the manufacturers not telling the full story.

People quote Sully as an example in that he ‘got the job done’ regardless of checklist.
Cows getting bigger is offline  
Old 7th May 2019, 16:27
  #5082 (permalink)  
 
Join Date: Dec 2002
Location: UK
Posts: 1,974
To be continued..... Oh please no.

Is it really necessary to explain the complete TEM concept, to use this model to fit the few facts that are available, or is it that the facts are fitted the model in order to understand an individual’s (preconceived) viewpoint.

All models are wrong, but some are useful’ (George Box). The value of a model, like a tool is to select the appropriate one and know how it should be used; particularly its limits.

If you start with the human as a threat then you will conclude human error; alternatively starting with the human as an asset, pilot, designer, regulator, then with open thought, guided by a model, it may be possible to identify influencing factors, which in combination enabled the outcome.

Limitations of TEM Model
Assumes technical competency appropriate for role.
The threat-error-undesired states relationship is not necessarily straightforward and it may not always be possible to establish a linear relationship, or one-to-one linkage between threats, errors and undesired states. e.g. threats can on occasion lead directly to undesired states without the inclusion of errors;
and operational personnel may on occasion make errors when no threats are observable.
Essentially a ‘deficit’ model.
Benchmarks against a standard ‘safe’ or ‘safe enough’ i.e., other operators.
Descriptive: It describes an outcome or end state not how to get there.
Little focus on minimisation of error
Links the management of threats and errors to potential deficiencies in HF & NTS skills but not the processes supporting good TEM behaviour.
Same challenge as ‘Airmanship’

(https://www.casa.gov.au/sites/g/file.../banks-tem.pdf)




Last edited by safetypee; 7th May 2019 at 17:50. Reason: typo
safetypee is offline  
Old 7th May 2019, 17:06
  #5083 (permalink)  
 
Join Date: Feb 2019
Location: shiny side up
Posts: 431
Given that, my concern with the MAX was not with adapting to any differences when things were going right, but rather how different it might be when things were going wrong. Sadly, those concerns were not misplaced.
Sadly, those concerns WERE misplaced.

There are the legacy commands that line up, not necessarily under non-normal ops. Look what happened when, what was it V10 of the HW FMS software came out? That one didnt last long.

The if/then sequence of commands can get one to a line in the code that has been long forgotten. A few that come to mind are the balked TOGA with a bounce, or after crossing a FO waypoint, the ac porpoises down to the AA level of the next waypoint, and of course, the lookup finding a simple radius of the Earth instead of the Geoid.

Unintended consequences of legacy programming. I would love to see a V1.0 of the FMS.

Last edited by Smythe; 7th May 2019 at 18:57.
Smythe is offline  
Old 7th May 2019, 17:28
  #5084 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by safetypee View Post

All models are wrong, but some are useful’ (George Box). The value of a model, like a tool is to select the appropriate one and know how it should be used; particularly its limits.
I agree. The TEM model has its limitations, but it also has its uses. One of its primary benefits is that is a key part of the language of aviation safety. Pilots are usually on the receiving end of this dialogue. I submit that it can be pointed in the other direction.
737 Driver is offline  
Old 7th May 2019, 17:34
  #5085 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by Cows getting bigger View Post
The problem with TEM is that it tends to encourage linear thought - actions will create the desired resolution. I spent some time in the UK RAF where we often quoted the Boyd`Cycle (OODA Loop) which was more of a circular decision making process - think DODAR. The advantage of the Boyd Cycle is that you review the efficacy of your actions and then, potentially, choose additional or even different actions.
If you go back and look at the original graphic, you will see that it does incorporate a cycle of input/output/review. I'm familiar with the Boyd Cycle, and it is appropriate in some circumstances, but it is less useful in setting up a resilient system in the first place. The OODA loop is more applicable once you are responding in the environment that has already been established.
737 Driver is offline  
Old 7th May 2019, 17:44
  #5086 (permalink)  
 
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,831
Yep, like an aircraft trying to kill you when you've lost your way through process.
Cows getting bigger is offline  
Old 7th May 2019, 19:04
  #5087 (permalink)  
 
Join Date: Nov 2018
Location: Vancouver
Posts: 67
Just another reiteration of some issues with MCAS' flawed logic, as discussed here and elsewhere... (with my emphasis)

Boeing says no flaws in 737 Max. Former engineer points to several

...Boeing CEO Dennis Muilenburg said the planes went down because of a chain of events.

"One of the links in that chain was the activation of the MCAS system because of erroneous angle attack data," he said at a recent news conference.

Peter Lemme, a former Boeing engineer and former FAA designated engineering representative, said MCAS is the main link. The flaws in that system, he said, need to be addressed...

***First, MCAS activated because of a single sensor with a false reading. On the Ethiopian jet, one indicator swung from showing a normal ascent to showing a steep ascent. Lemme said in that case it was a clear sign of failure.

"Having the vane change from 15 to 75 degrees in two seconds — it is immediately an indication of a fault. There's just no physical way to do that," he said. "And then 75 degrees is kind of a ridiculous number."

But MCAS acted on it, even though a sensor on the other side of the plane reported everything was fine.

"That was a big disappointment. If the systems had declared the signal failed then MCAS would not have fired and nothing would have happened," he said.

***Both planes were flying at a great speed when they crashed — another flaw, according to Lemme because MCAS should have stopped at that speed.

"There is no way to stall the airplane at that airspeed and MCAS should have had logic in place that would prohibit it from operating," Lemme said.

***The Lion Air flight pitched forward more than 20 times before that plane crashed into the sea. That is the greatest flaw in MCAS, Lemme said: the repeated descents.

"It persistently attempted to move the stabilizer down without giving up. I think if MCAS hadn't had the repeated feature where it could re-trigger, we probably would have been OK," he said.

Lemme said testing should have caught the problems with MCAS.

"That should have been found. You would expect the test program would look at the likely failure modes," he said. "That is a breakdown in the test program."...
- https://www.kuow.org/stories/engineer-gap-flaw-mcas
patplan is offline  
Old 7th May 2019, 19:14
  #5088 (permalink)  
 
Join Date: Oct 2011
Location: Lower Skunk Cabbageland, WA
Age: 70
Posts: 354
And the source of the above article is very well-respected as one of Seattle's NPR radio stations, KUOW, so should be taken seriously.
Organfreak is offline  
Old 7th May 2019, 19:25
  #5089 (permalink)  
 
Join Date: Jan 2008
Location: Wintermute
Posts: 54
Originally Posted by Lost in Saigon View Post
There are many systems on an aircraft where one failure can cause entry to a "dangerous state".

MCAS was designed to be easily disabled by simply trimming the aircraft. There is no prompt action required. All that is need is for the pilot to FLY THE AIRCRAFT just as they were taught in their very first lesson. ATTITUDES and MOVEMENTS

Pilots are taught to always control the aircraft and to TRIM the aircraft to maintain that control. If the aircraft is not doing what you want it to, it is up to the pilot to MAKE it happen.

The MCAS "problem" is just a form of un-commanded or un-wanted trim. In addition to being a memory item, it is also just common sense to disable a system that is not performing correctly. In this case MCAS was causing nose down trim. If repeated nose up trim did not stop the unwanted nose down trim, turn off the electric trim.

Problem solved.

You can't really blame Boeing any more than you can blame Airbus for not predicting that the AF447 crew would forget that you need to lower the nose to unstall an aircraft, or that Airbus had designed the side sticks so that they cancel each other out.
It may be interesting to note that what appears to be the vast majority of people who are responsible for designing, developing and delivering safety critical systems for a living (I am another example - high software content military life critical systems amongst other things) who have commented find the Boeing approach at best questionable, and for my part very concerning (as a very regular pax). I had expected better from the aviation regulation process.

Equally concerning are the folk that fly these machines who also appear to feel that this type of potentially inadequate (and demonstrably dangerous) systems design is acceptable, it may be the norm, and it may be what you are used to . . . but I'm surprised . . .

Edit : A wise man in the military safety community once told me that if I wasn't personally prepared to trust my life to the system I designed I shouldn't be in the industry . . . I wonder whether that ethos has been diluted in aviation . . . I hope not . . .

Fd

Last edited by fergusd; 7th May 2019 at 19:43.
fergusd is offline  
Old 7th May 2019, 20:06
  #5090 (permalink)  
 
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 58
Posts: 424
Originally Posted by patplan View Post
Just another reiteration of some issues with MCAS' flawed logic, as discussed here and elsewhere... (with my emphasis)Peter Lemme, a former Boeing engineer and former FAA designated engineering representative, said MCAS is the main link. The flaws in that system, he said, need to be addressed...

[snip]

***Both planes were flying at a great speed when they crashed — another flaw, according to Lemme because MCAS should have stopped at that speed.

"There is no way to stall the airplane at that airspeed and MCAS should have had logic in place that would prohibit it from operating," Lemme said.

[snip]

Lemme said testing should have caught the problems with MCAS.

"That should have been found. You would expect the test program would look at the likely failure modes," he said. "That is a breakdown in the test program."...

- https://www.kuow.org/stories/engineer-gap-flaw-mcas
Isn't that statement a logical fallacy for two reasons:
- An aircraft can stall at any speed, if the altitude is sufficiently high, and the the wings are in a banked turn (accelerated stall).
- MCAS is not an anti-stall system, so that statement has no bearing on its activation.
GordonR_Cape is offline  
Old 7th May 2019, 20:42
  #5091 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by Europa01 View Post
Here's a polite challenge. Given your previously expressed views on what you consider to have been the inadequacy of this crew, are you sure you aren't levering your preconceptions into the TEMS model rather than applying it from first principles?
An astute observation. I am not conducting a first-order analysis for a very specific reason. A first-order analysis would step through the initial threats, the barriers, and the errors (trapped and untrapped) and the outcome of each untrapped error. I think that has already been done in spades, though not necessarily through the lens of TEM. We know there were errors, and we know many of those errors went untrapped despite the theoretical presence of numerous barriers. I am doing something more of a second-order (and in some cases third-order) analysis that suggests that the "barriers" did not function as expected because they actually contained unrecognized threats. Those threats, being unrecognized, had no mitigation strategy or barrier to contain them and thus led to a series of actions resulting in the loss of this aircraft.

As far as the "inadequacy" of the crew, I think the picture I've been painting here is the inadequacy of the system that put them in that cockpit. These pilots were a product of their training, experience, and environment. In theory, that system gave them the tools (i.e. the barriers) that would have made this accident avoidable. Rather, my conjecture is that instead of creating resilient barriers, their training and operating protocols were actually producing unperceived, and hence unmitigated, threats.
737 Driver is offline  
Old 7th May 2019, 20:45
  #5092 (permalink)  
 
Join Date: Apr 2014
Location: Minneapolis, MN
Posts: 14
Originally Posted by MurphyWasRight View Post
It has pretty well been established on this thread that pilot electric trim will work in all conditions (does not stall under load) and interrupts MCAS if active as shown by ET trace at ~05:40:27. This pilot trim input was possibly then interrupted by cutout switches.
Other than 'deer in headlights' losing it I see a few possible factors:
1: Pilot accustomed to short blips not comprehending amount truly needed, this fits Lion Air when the FO was ineffective at the end when PIC handed over control while the Captain was mostly successful.
2: Trimming by column feel not position: May seem that AC is closer to trimmed than it is. In other words if you have been pulling really hard then just slightly hard may feel like close to trimmed, I am sure the pilot did not want to over trim given all the alarms.
This might explain ET first retrim at 05:4-:15. Unfortunately we don't have the column force graph, just position.
3: Some as yet to be revealed flaw that interferes with pilot trim inputs; one possibility is biomechanical factors related to actuation switches after prolonged pulling.
This is unlikely but could explain the final seconds of both accidents.
Hopefully the final reports will fully address this question.
Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRuNe thread entitled 737MAX Stab Trim architecture, post #194), one can see that when MCAS is active, then STS in inactive.
And when MCAS is inactive, then STS is active.
Is it possible that after a pilot electrically trims the aircraft nose-up after an MCAS nose-down trim event, then the STS system will activate to trim the aircraft nose-down again before the next MCAS nose-down trim event? Recall that the STS system trims the aircraft in the direction opposite to the speed change. So if the pilot has just trimmed with a nose-up command, then wouldn’t the STS system counter with a nose-down trim command? This same operation would still apply if the autopilot thought the aircraft had a higher angle of attack as a result of a defective AoA sensor (the autopilot controls the STS trim even when the autopilot is off). Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?

One thing that confuses me here is that I’ve read that STS activates 5 seconds after release of the manual trim switches. MCAS has a similar 5 second delay. This may mean that any STS trim would be canceled by an MCAS trim event. But could there be a delay in MCAS activation relative to STS activation? By the way, STS trim and manual electric trim have the same trim rates, but differ in direction. Also, any STS trim should be canceled by the simultaneous activation of manual electric trim by the pilot. But if the pilot released the manual trim button when he believed the aircraft trim to be at neutral, then STS might give a short nose-down trim command before MCAS activates to give a larger nose-down command.

Also, the same schematic shows that the two pedestal cutout switches on the 737MAX operate as a logical “AND” function (“&” function) as follows:
Manual electric trim = [PRI] & [B/U]
Autopilot trim = [PRI]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative. However, it would be a trivial change to have the switches operate as follows:
Manual electric trim = [PRI]
Autopilot trim = [PRI] & [B/U]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

In this case the pilots would be able to turn off the autopilot trim and MCAS trim by turning off only the B/U cutout switch while keeping the manual electric trim and STS trim active by leaving the PRI cutout switch on. This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done? Is it because it would have required re-certification of the aircraft by giving the pilots control over the MCAS function? Was certification of the 737NG with new lift-causing engines dependent upon the MCAS correction function operating only in the background without control from the pilots?
Double07 is offline  
Old 7th May 2019, 21:22
  #5093 (permalink)  
 
Join Date: May 2010
Location: Boston
Age: 69
Posts: 440
Originally Posted by Double07 View Post
Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRuNe thread entitled “737MAX Stab Trim architecture”, post #194), one can see that when MCAS is active, then STS in inactive. And when MCAS is inactive, then STS is active.).
...
... Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?
...
This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative..
......
This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done?
...
Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
There is one brief NU automatic trim on the trace at 05:40:00 after the AP disconnect followed (or even interrupted by) MCAS for 9 seconds, this could be an STS input.

The only possible impact of this is that the pilot may have heard trim starting and glanced down to see normal looking (NU) trim, which was quickly reversed by MCAS.
Had not thought of that before but likely not significant, in any case it was short and "the right way".

BTW: The penultimate Lion Air crew wrote up the defect as "STS trimming in wrong direction".

Correct on cut out switch change from NG to MAX.

No one has offered an 'official' sounding reason for the change.
The most likely case is that training had shifted to always using both and it simplified some aspect (cert?) of MCAS to not have a seperate auto only cutout, but both switches were retained for commonality.

Last edited by MurphyWasRight; 7th May 2019 at 21:27. Reason: spell check 'typos'
MurphyWasRight is offline  
Old 7th May 2019, 21:29
  #5094 (permalink)  
 
Join Date: Feb 2006
Location: USA
Posts: 446
Yet another review panel

https://www.seattletimes.com/busines...pgrade-review/

FAA asks for NASA’s help in Boeing 737 MAX safety-upgrade review
May 7, 2019 at 12:40 pm Updated May 7, 2019 at 1:58 pm
By Alan Levin and Ryan Beene
Bloomberg

The Federal Aviation Administration is convening a panel of outside experts from the Air Force, NASA and a Transportation Department center to review Boeing’s software fixes for the grounded 737 MAX.

The agency announced the new Technical Advisory Board in a statement on Tuesday. The panel’s recommendations will “directly inform the FAA’s decision concerning the 737 MAX fleet’s safe return to service,” the agency said.

The plane was grounded on March 10 after the second fatal accident in less than five months claimed a total of 346 lives. Boeing designed the plane with a system that automatically forced down the nose in some circumstances and malfunctions on both flights caused it to repeatedly dive until pilots lost control.

The manufacturer is changing the software to make it less likely to fail and to limit how far it can drive down the nose. Boeing and the FAA have been working closely on the software fix, but the Chicago-based planemaker hasn’t completed its work.

The new panel is separate from two other existing reviews created by FAA. The DOT’s Volpe National Transportation Systems Center in Massachusetts is participating.

To contact the reporters on this story: Alan Levin in Washington at [email protected];Ryan Beene in Washington at [email protected]
Zeffy is offline  
Old 7th May 2019, 21:49
  #5095 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Originally Posted by Double07 View Post
Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRuNe thread entitled 737MAX Stab Trim architecture, post #194), one can see that when MCAS is active, then STS in inactive.
And when MCAS is inactive, then STS is active.
Is it possible that after a pilot electrically trims the aircraft nose-up after an MCAS nose-down trim event, then the STS system will activate to trim the aircraft nose-down again before the next MCAS nose-down trim event? Recall that the STS system trims the aircraft in the direction opposite to the speed change. So if the pilot has just trimmed with a nose-up command, then wouldn’t the STS system counter with a nose-down trim command? This same operation would still apply if the autopilot thought the aircraft had a higher angle of attack as a result of a defective AoA sensor (the autopilot controls the STS trim even when the autopilot is off). Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?
STS respects the control column cutout switches, so any time that virtually any amount of forward or backward pressure was being applied to the yoke, STS would not be able to make any input. Additionally, STS has its own Stall ID mode which, in the presence of a stall signal, would command the trim nose down and override any other STS input. This nose down trim input is also inhibited by the control column cutout switches.

One thing that confuses me here is that I’ve read that STS activates 5 seconds after release of the manual trim switches. MCAS has a similar 5 second delay. This may mean that any STS trim would be canceled by an MCAS trim event. But could there be a delay in MCAS activation relative to STS activation? By the way, STS trim and manual electric trim have the same trim rates, but differ in direction. Also, any STS trim should be canceled by the simultaneous activation of manual electric trim by the pilot. But if the pilot released the manual trim button when he believed the aircraft trim to be at neutral, then STS might give a short nose-down trim command before MCAS activates to give a larger nose-down command.
Both have a 5 second delay because MCAS is actually a sub-function of STS (though MCAS is not inhibited by the control column cutout switches). STS can trim in both directions. If near neutral trim, STS might make an input (nose up or nose down) but any further inputs would be inhibited if the control column was displaced from neutral.

Also, the same schematic shows that the two pedestal cutout switches on the 737MAX operate as a logical “AND” function (“&” function) as follows:
Manual electric trim = [PRI] & [B/U]
Autopilot trim = [PRI]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative. However, it would be a trivial change to have the switches operate as follows:Manual electric trim = [PRI]
Autopilot trim = [PRI] & [B/U]
STS speed trim = [PRI]
MCAS trim = [PRI] & [B/U]

In this case the pilots would be able to turn off the autopilot trim and MCAS trim by turning off only the B/U cutout switch while keeping the manual electric trim and STS trim active by leaving the PRI cutout switch on. This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done?
Under current procedures, we never use the cutout switches individually on the 737NG or the MAX. We always use them together. There have been extensive discussions regarding the why's and wherefore's of the change in switch functionality, but procedurally it makes no difference at all.

Is it because it would have required re-certification of the aircraft by giving the pilots control over the MCAS function? Was certification of the 737NG with new lift-causing engines dependent upon the MCAS correction function operating only in the background without control from the pilots?
Pilots have never had direct control over the STS function, so I'll speculate that giving them direct control over MCAS never crossed anyone's mind. MCAS was required for certification, but I don't think those certification rules cared whether the system operated in the foreground or background.
737 Driver is offline  
Old 7th May 2019, 22:16
  #5096 (permalink)  
 
Join Date: Jul 2011
Location: Canada
Posts: 55
Originally Posted by fergusd View Post
It may be interesting to note that what appears to be the vast majority of people who are responsible for designing, developing and delivering safety critical systems for a living (I am another example - high software content military life critical systems amongst other things) who have commented find the Boeing approach at best questionable, and for my part very concerning (as a very regular pax). I had expected better from the aviation regulation process.

Equally concerning are the folk that fly these machines who also appear to feel that this type of potentially inadequate (and demonstrably dangerous) systems design is acceptable, it may be the norm, and it may be what you are used to . . . but I'm surprised . . .

Edit : A wise man in the military safety community once told me that if I wasn't personally prepared to trust my life to the system I designed I shouldn't be in the industry . . . I wonder whether that ethos has been diluted in aviation . . . I hope not . .
Fd
I think everyone is in agreement that MCAS needs to be fixed.

None of the aviators that have defended Boeing or MCAS find this situation “acceptable” at all. What we have a hard time accepting is that “professional pilots” could not manage this situation in 2/3 of the events. If they had even done the UAS drill they likely would have survived as both crews lost control of the aircraft as they were racing around at an unacceptably high speed. If either of the crews had trimmed the pitch, a perfectly natural and instinctive reaction, they would have disabled MCAS each and every time. If the crews had done the Stab Trim Runaway memory checklist, which is for events just like this, they would have disabled MCAS just like the crew of the Lion Air incident did and indeed flew the aircraft for an hour and a half with unreliable airspeed and MCAS just waiting to rear its ugly head.

These drills (UAS and Stab Trim Runaway) are not complex; pulling the throttle back to control the airspeed is basic flying just as trimming the aircraft. What has aviators like myself, 737 Driver, Lost in Saigon and others deeply concerned about is that the basic flying skills to deal with these situations are no longer present in today’s professional pilot. When everything works it’s all good...just put ‘er on the autopilot and off you go. But when a curveball is thrown at you, you’re not there when you’re needed the most. That should be of serious concern to the airlines, the regulators, the manufacturers and the professional pilot community.

The measure I used as an instructor and a commercial airline pilot was “would I put my family on an aircraft flown by less than competent pilots”? If the answer is no then we have a problem and I would submit that there is a problem in parts of the world that seem to be crashing aircraft these days.
L39 Guy is offline  
Old 7th May 2019, 22:48
  #5097 (permalink)  
 
Join Date: Jun 2009
Location: florida
Age: 77
Posts: 1,195
Salute!

Losing credibility faith in you, Murph...... to wit:
Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
Even Driver has referenced STS and that MCAS was considered a sub-mode by some folks. And due to STS rolling that trim wheel a lot, the Lion crew commented that STS was working backwards. I would also like to hear the CVR on that flight, as all we hear via the rumor mill is the jump seat guy saved the day. Until we have the trial testimony and depositions, we may not know. Maybe the CVR had some of the conversation, as the FDR had a lotta hours. My not so humble opinion is that crew lucked out and "went manual" when the trim system was not acting as they expected. I give them a lotta credit for doing all that with then shaker goingon, but their CVR shoul give us a clue if it ever becomes public.

Comes down to same thing - longitudinal pitch moments and such, not simply back stick forces per AoA unless you are flying a pure cable and pulley plaine. The 737 variants added STS after a coupla generations because it had to satisfy FAR speed stability reuqirements. And BTW, I do not like that "speed" term. It's AoA and basic aero to force the nose down/up when decreasing/increasing speed/AoA from a reference speed/AoA. It's called "trim".And most here learned all about it back when learning in the Tiger Moth or Aeronica or Cessna or.........

Big B has a lotta public relations work in store, and I am not sure they will recover for long time. Irritates this old fart, as I always liked their control authority philosophy.

Gums sends...
gums is offline  
Old 7th May 2019, 23:08
  #5098 (permalink)  
 
Join Date: Apr 2019
Location: USA
Posts: 217
Threat and Error Management

Part 5

Continuing the Threat and Error Management discussion......


Okay, the question has been asked, "Why bother with the TEM model? What good is it?"

The TEM model is widely used in aviation, and it is a fundamental part of the language of aviation safety. It often is the language that is directed toward flight crews by their airlines in order to build a case for better safety practices. I am suggesting that it is also a useful tool not only for an individual pilot's safety assessment, but also as a way to engage in a dialogue back up the management chain. I am admittedly putting an unorthodox spin on TEM by raising the issue of "barriers as threats." However, sometimes when our airlines think they are creating barriers, they may actually be creating threats. By looking closely at some of the assumptions underlying many barriers, it is possible to identify these new potential threats. Once these threats are identified, steps can then be taken to mitigating those threats, perhaps by building additional barriers. Yes, there is a potential matryoshka doll type quality to this recursive analysis, but I don't it needs to be taken through too many layers.

In Part 4 of this series, I listed some questions to asked regarding the traditional barriers available to the flight crew. Perhaps you have some of your own. Those questions may lead to the identification of a threat in the guise of a barrier.

Examples of responses that raise some flags:
.
  • Our company SOP's emphasis on automation as a "safety" tool is causing my hand-flying skills to degrade.
  • Our company's established reporting system for for operational concerns is so onerous that most pilots don't bother using it.
  • Our training program's focus on standardization relies too much on rote actions, predetermined training events, and a "tick box" mentality that does not allow for the introduction of novel events that require higher order thinking. There are no attempts to induce a "startle" effect or create ambiguity.
  • Our company's hierarchical structure and emphasis on the Captain's authority makes First Officers reluctant to speak up and correct the Captain when necessary.
  • The First Officers I fly with know their systems, are whizzes at programming the box and have no problem with the automation, but they seem to have little "feel" for flying or having the "big picture."
  • When I point out that one of our checklists has a potential trap, the response is something like, "Smarter people than you made that checklist. Just stick to it."
  • We hire people from around the world, and frankly communicating with some of them outside the expected checklist responses is challenging.
.
In each of these cases, one of the traditional barriers of the TEM model was hiding a potential threat. Now what?

The TEM model shows the way. Once threats are identified, the flight crew (or individual pilot) should use whatever tools available to mitigate those threats or even develop a new barrier. How the pilot mitigates the threat will depend heavily to his company's openness to dialogue as well as that pilot's personal initiative to mitigate threats as they arrive in daily operations.

On a group or organizational level this may include lobbying the airline managers and/or regulators for appropriate changes to training standards, automation policy, and operational reporting system. Use the TEM model as a tool this dialogue. Push for enhanced training for First Officers that emphasizes their role as a proactive barrier on the flight deck, and recommend creating a forum where operational safety concerns can be freely discussed without fear of retribution. Where managements are resistant, engage with outside safety organizations or other entities that have influence. Remind managers that not all costs can be entered into a spreadsheet before the fact, but they can certainly be tallied later. Some of those costs are paid in bent metal and broken bodies. Carry a picture of the crater left by ET302 as a constant reminder of the consequences of ignoring these issues.

On an individual level, spend some time looking at your company's safety culture and identify existing threats. If the airline will not take appropriate steps to mitigate the threat (e.g. pressure to meet schedule or contain costs overrides your specific issue), use whatever tools you have to contain the threat even if it means walking off the airplane. Brief every flight as if it were your last. If you are a Captain, make your expectations clear to your First Officers and insist that they speak up as necessary. If you are a First Officer and you have a "difficult" Captain, remember its your butt up in the cockpit, too. Use diplomacy, social skills, and/or direct language as appropriate. If your airline won't provide the training you think you need, train yourself. Memorize the "mantra" and share it with the pilots you fly with. "Chair" flying is always available and desktop simulators are cheaper than ever. Click off the automation every chance you get. Review your procedures, memory items, and limitations regularly. Look for potential traps in those procedures and have a plan for them. If you have a concern in the cockpit, speak up! It may be nothing, it may be something. Don't assume the other person is aware of everything that you are aware of. Don't assume that you are aware of everything you need to be aware of. Get plenty of rest, and take care of your health.

Yes, it is a lot to ask, however, never forget that the pilots are usually the first ones to the scene of the accident. Our standards and expectations ought to be higher.
.

​​​​​​"Our problem is not that we aim too high and miss, but that we aim too low and hit." - Aristotle
.
737 Driver is offline  
Old 7th May 2019, 23:42
  #5099 (permalink)  
 
Join Date: Nov 2010
Location: Denver
Age: 52
Posts: 49
Originally Posted by GordonR_Cape View Post
Isn't that statement a logical fallacy for two reasons:
- An aircraft can stall at any speed, if the altitude is sufficiently high, and the the wings are in a banked turn (accelerated stall).
- MCAS is not an anti-stall system, so that statement has no bearing on its activation.

No, it really isn't, there is no way you can stall a 737 at 350kts indicated, because the wings will come off before you hit the critical angle of attack.

MCAS is not anti-stall. it just prevents the pilots from stalling (you see how that sounds?)
hans brinker is offline  
Old 7th May 2019, 23:55
  #5100 (permalink)  
 
Join Date: May 2010
Location: Boston
Age: 69
Posts: 440
Originally Posted by gums View Post
Salute!

Losing credibility faith in you, Murph...... to wit:
Quote:
Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
Even Driver has referenced STS and that MCAS was considered a sub-mode by some folks. And due to STS rolling that trim wheel a lot, the Lion crew commented that STS was working backwards. I would also like to hear the CVR on that flight, as all we hear via the rumor mill is the jump seat guy saved the day. Until we have the trial testimony and depositions, we may not know. Maybe the CVR had some of the conversation, as the FDR had a lotta hours. My not so humble opinion is that crew lucked out and "went manual" when the trim system was not acting as they expected. I give them a lotta credit for doing all that with then shaker goingon, but their CVR shoul give us a clue if it ever becomes public.

Comes down to same thing - longitudinal pitch moments and such, not simply back stick forces per AoA unless you are flying a pure cable and pulley plaine. The 737 variants added STS after a coupla generations because it had to satisfy FAR speed stability reuqirements. And BTW, I do not like that "speed" term. It's AoA and basic aero to force the nose down/up when decreasing/increasing speed/AoA from a reference speed/AoA. It's called "trim".And most here learned all about it back when learning in the Tiger Moth or Aeronica or Cessna or.........

Big B has a lotta public relations work in store, and I am not sure they will recover for long time. Irritates this old fart, as I always liked their control authority philosophy.

Gums sends...
What I mean is that in ET case it was clear from the traces that although there was one probable STS trim it had no impact on the accident sequence.
I was attempting to answer a question about STS possible active involvement in the ET accident.
.
Not at all saying that STS was not of overall significance, possibly by adding confusing expectation of intermittent auto trim, although the magnitude and other behavior is much more benign than MCAS.

While MCAS is a subsystem of STS it would be confusing (to say the least) to blame "STS" for the difficulties faced by the crews.

BTW: 737 driver STS explanation is much better than mine since it also includes response to column cutout switches etc further supporting the case that it had no direct role in ET.
MurphyWasRight is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.