Ethiopian airliner down in Africa
(1) If the flight crew uses their pilot commanded electric trim (thumb switches) they will not stop trimming for more that 5 seconds until the column force has been trimmed to (or close to) zero.
(2) Repeated events of the automatic stabilizer control running the stabilizer away from trim when starting from an otherwise trimmed, relatively steady flight condition will be recognized by the flight crew as errant behavior of the automatic stabilizer control system and that the flight crew response will be to activate the stabilizer cutout switches to disable further automatic stabilizer control commands.
(3) The impact of an errant AOA signal feeding into MCAS would be acceptable at the expected failure rate based on assumptions (1) and (2) above
(2) Repeated events of the automatic stabilizer control running the stabilizer away from trim when starting from an otherwise trimmed, relatively steady flight condition will be recognized by the flight crew as errant behavior of the automatic stabilizer control system and that the flight crew response will be to activate the stabilizer cutout switches to disable further automatic stabilizer control commands.
(3) The impact of an errant AOA signal feeding into MCAS would be acceptable at the expected failure rate based on assumptions (1) and (2) above
DPS-JKT: AOA error prior to takeoff, constant difference between AOA's. Crew recognise a problem exists to pitch force, Capt sees trim being applied automatically against FO's elevator input, and Capt selects cutout on Stab. Capt then reverses cutout, problem re-occurs, and cutout reselected, nose down trim stops. Crew use trim wheel for rest of flight, and operate non RVSM, manual flight. Stall warning is on from nose wheel lift off until landing in JKT. partial writeup in logbook, not whole story.
JKT accident flight: wash-rinse-repeat, except the stab is not selected to cutout. crew fight the trim with pickle switches nose up, and outside of 5 sec window, auto trim giving nose down. Crew lose plot by the looks of it, and stab trim finally runs away in the end. (if the pickle switch [split ARM-CMD series switching] being used was intermittent at the end, then a runaway of the trim would result, until such time as the cutout switches were employed, or the other pickle switches were used). Throughout this situation, the stall warning system, and multiple EICAS messages are adding to competing cognitive tasks.
Sensor validation by voting with the other AOA output and inhibiting function with a detected difference, or comparison of AOA to pitot/static-attitude-inertial/GPS data to determine validity would be needed to avoid reliance on crew detection and correct response. In the end, a failure of the system will still be a possibility, however remote, and crew timely intervention to isolate the system is needed to be reinforced. There is an inherent reticence to alter system states on the aircraft ( a good thing in normal RPT ops) but the training matrix is filled with warm fuzzy time expenditure on LOFT etc vs dealing with vignettes of HQ problems, time critical detection and response events. We continuously squander training resources to appease training programs that fail to meaningfully train. HF stuff can be done in a classroom or in front of a cardboard bomber, HQ stuff needs to be done in a sim, procedural stuff needs at least PTTs to be undertaken effectively. The travelling public are being sold lemons by the nonsensical Part 61/JAR/EU FCL requirements.
On the missing information to the crew, the same problem in a Cessna, Learjet, Citation, or B747 would exhibit in the same manner, that there is an undesirable state, which is readily apparent to the crew, and which needs to be responded to promptly, and to which mechanism to provide intervention exists, being a off switch, cutout, or CB depending on the flavor of the ride. The crew detected the fault in the DPS-JKT leg, and actioned correctly. The actual reason why is not needed at that time, only the detection of an undesirable state, and the intervention necessary to achieve a satisfactory outcome. In both accident flights, it appears that the crew did not achieve a state of affairs where they had detected the condition and from that, from training or knowledge, continued to effective intervention.
§ 25.672 Stability augmentation and automatic and power-operated systems
If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with § 25.671 and the following:
(a) A warning which is clearly distinguishable to the pilot under expected flight conditions without requiring his attention must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system which could result in an unsafe condition if the pilot were not aware of the failure. Warning systems must not activate the control systems.
(b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures of the type specified in § 25.671(c) without requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.
(c) It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system -
(1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;
(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplaneconfigurations) which is described in the Airplane Flight Manual; and
(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.
[Amdt. 25-23, 35 FR 5675 Apr. 8, 1970]
If the functioning of stability augmentation or other automatic or power-operated systems is necessary to show compliance with the flight characteristics requirements of this part, such systems must comply with § 25.671 and the following:
(a) A warning which is clearly distinguishable to the pilot under expected flight conditions without requiring his attention must be provided for any failure in the stability augmentation system or in any other automatic or power-operated system which could result in an unsafe condition if the pilot were not aware of the failure. Warning systems must not activate the control systems.
(b) The design of the stability augmentation system or of any other automatic or power-operated system must permit initial counteraction of failures of the type specified in § 25.671(c) without requiring exceptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof, or by overriding the failure by movement of the flight controls in the normal sense.
(c) It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system -
(1) The airplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered;
(2) The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplaneconfigurations) which is described in the Airplane Flight Manual; and
(3) The trim, stability, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing.
[Amdt. 25-23, 35 FR 5675 Apr. 8, 1970]
Join Date: Sep 2016
Location: USA
Posts: 803
Likes: 0
Received 0 Likes
on
0 Posts
MCAS appears to be doing its job.
Adding a system like the MCAS to an aircraft it no different than adding a stick pusher to an aircraft has has suspect stall recovery?
I think everyone is missing the elephant in the room.
The MCAS is getting all the attention in the media and on this forum when it appears that the input to the MCAS is the suspect.
The MCAS is acting on what information it is fed. Why are we not looking at the source of that information?
Adding a system like the MCAS to an aircraft it no different than adding a stick pusher to an aircraft has has suspect stall recovery?
I think everyone is missing the elephant in the room.
The MCAS is getting all the attention in the media and on this forum when it appears that the input to the MCAS is the suspect.
The MCAS is acting on what information it is fed. Why are we not looking at the source of that information?
Therefore, it is very appropriate to put attention on the manner in which that information is used by the system using it, and designing that system to be tolerant to a fault like the one experienced. I.e., redundancy. Such as the 2/3 voting that's been put forth multiple times in these threads, or a 1 vs. 1 disagree inhibiting the system and posting a caution to the crew, etc.
Put another way, MCAS handling this bad information in a graceful way should be considered to be part of "its job."
On my airplane that is 100% hydraulic dependent, I'm glad that there are 6 hydraulic pumps instead of 1 hydraulic pump that's supposed to be really really really reliable.
Join Date: Nov 2018
Location: Vancouver
Posts: 68
Likes: 0
Received 0 Likes
on
0 Posts
Guys, think people need to ease of the aircraft a little as if its got some huge design defect especially until we have some more facts, bear in mind many operators have been using this type for a fair while southwest nearly 3 years, with no such issues, also bear in mind that both operators here that have managed to "fly it into the ground" have very questionalble safety records as an operator.
In other words, Boeing 737 Max 8 has only been flown commercially since May 6, 2017, less than 20 Months ago to be exact.
Join Date: Jan 2008
Location: Herts, UK
Posts: 748
Likes: 0
Received 0 Likes
on
0 Posts
MCAS appears to be doing its job.
Adding a system like the MCAS to an aircraft it no different than adding a stick pusher to an aircraft has has suspect stall recovery?
I think everyone is missing the elephant in the room.
The MCAS is getting all the attention in the media and on this forum when it appears that the input to the MCAS is the suspect.
The MCAS is acting on what information it is fed. Why are we not looking at the source of that information?
Adding a system like the MCAS to an aircraft it no different than adding a stick pusher to an aircraft has has suspect stall recovery?
I think everyone is missing the elephant in the room.
The MCAS is getting all the attention in the media and on this forum when it appears that the input to the MCAS is the suspect.
The MCAS is acting on what information it is fed. Why are we not looking at the source of that information?
Whilst fighter aircraft with inherent instability and full FBW may be acceptable, indeed the norm...
a civil airliner without full FBW requiring a crude interruptiive add-on to a pre-existing flight control system is, to experienced aeronautical engineers, just plain asking for trouble via interpretation, secondary feedback errors or unstable malfunction (as likely in this case)..
'Add Lightness and Simplify' as an underlying philosophy has been binned it seems.
Join Date: Sep 2016
Location: USA
Posts: 803
Likes: 0
Received 0 Likes
on
0 Posts
However has anyone thought of the possibility that the inexperienced co-pilot selected the flap up after takeoff instead of retracting the gear?
Doing so would result in an increase in the stall speed, unwanted drag from the gear, a high nose attitude annd AoA and accordingly massively reduced climb ability. Now with the flaps up and the autopilot off, the MCAS would be active and would trim the nose down, the stick shaker stall, “don’t sink” warnings would be sounding to add more confusion.
Doing so would result in an increase in the stall speed, unwanted drag from the gear, a high nose attitude annd AoA and accordingly massively reduced climb ability. Now with the flaps up and the autopilot off, the MCAS would be active and would trim the nose down, the stick shaker stall, “don’t sink” warnings would be sounding to add more confusion.
That would be consistent with an initial high AOA CF, but not with having gained 2500 feet and 350 knots before the crash.
Join Date: Jul 2014
Location: Harbour Master Place
Posts: 662
Likes: 0
Received 0 Likes
on
0 Posts
Incorrectly set stab trim and zero flap are two items which will cause the takeoff warning horn to sound when takeoff thrust is applied. Even an inexperienced crew would surely react to that.
However has anyone thought of the possibility that the inexperienced co-pilot selected the flap up after takeoff instead of retracting the gear?
Doing so would result in an increase in the stall speed, unwanted drag from the gear, a high nose attitude annd AoA and accordingly massively reduced climb ability. Now with the flaps up and the autopilot off, the MCAS would be active and would trim the nose down, the stick shaker stall, “don’t sink” warnings would be sounding to add more confusion.
Personally, I knew someone who had inadvertently retracted the flaps one step instead of gear retraction. Luckily they were doing a F5 takeoff and got away with it. A F1 takeoff is a different story without the LED's.
The counterpoint is the F1 "gate", making it more difficult retract the flaps one step with a simple motion, it would be a little more awkward and is there to ensure that 1 Eng inop go-around is F15 ---> F1, rather than straight through to Flap 5.
Even an inexperienced crew would surely react to that.
It needs a "little" correction. The first delivery of Boeing 737 MAX 8 [B38M] was on May 6, 2017 to Malindo Air [9M-LRC]- a Lion Air subsidiary. They placed the aircraft into commercial service on May 22, 2017. Coincidently, that plane is now being operated in Indonesia by Lion Air, now coded as PK-LQK. Originally, SWA was intended to be the launch customer for B38M.
In other words, Boeing 737 Max 8 has only been flown commercially since May 6, 2017, less than 20 Months ago to be exact.
In other words, Boeing 737 Max 8 has only been flown commercially since May 6, 2017, less than 20 Months ago to be exact.
I don't think anyone missed the faulty AOA information in the Lion Air crash. That's very straightforward. Trying to eliminate the possibility of a AOA sensor (or any other sensor or single piece of gear in aerospace) going bad would be a fool's errand. (I guess, other than the middle part of a helicopter's rotor hub!)
VB; the point on JT610 is still being missed. I reiterate...
For JT610, the data shows the following: AOA IS NOT FAULTY. IT IS INSTALLED INCORRECTLY. There is a constant offset between L & R, that is not a fault of the sensor, that is an install error. The outcome is the same, an erroneous triggering occurs, but the root cause of the system architecture is a maintenance error, not a sensor error. Now, the system still sucks, and the pilot knowledge was missing info for the first case, but not for the ET302 case, training is definitely needed as it stood.
Hope that clears up that issue a little. It is not a trivial matter, hardening the system from errors needs to recognise what has actually happened, otherwise the effort is flawed. From a litigation viewpoint, it alters where some of the questions get directed.
Join Date: Sep 2016
Location: USA
Posts: 803
Likes: 0
Received 0 Likes
on
0 Posts
VB; the point on JT610 is still being missed. I reiterate...
For JT610, the data shows the following: AOA IS NOT FAULTY. IT IS INSTALLED INCORRECTLY. There is a constant offset between L & R, that is not a fault of the sensor, that is an install error. The outcome is the same, an erroneous triggering occurs, but the root cause of the system architecture is a maintenance error, not a sensor error. Now, the system still sucks, and the pilot knowledge was missing info for the first case, but not for the ET302 case, training is definitely needed as it stood.
Hope that clears up that issue a little. It is not a trivial matter, hardening the system from errors needs to recognise what has actually happened, otherwise the effort is flawed. From a litigation viewpoint, it alters where some of the questions get directed.
For JT610, the data shows the following: AOA IS NOT FAULTY. IT IS INSTALLED INCORRECTLY. There is a constant offset between L & R, that is not a fault of the sensor, that is an install error. The outcome is the same, an erroneous triggering occurs, but the root cause of the system architecture is a maintenance error, not a sensor error. Now, the system still sucks, and the pilot knowledge was missing info for the first case, but not for the ET302 case, training is definitely needed as it stood.
Hope that clears up that issue a little. It is not a trivial matter, hardening the system from errors needs to recognise what has actually happened, otherwise the effort is flawed. From a litigation viewpoint, it alters where some of the questions get directed.
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
For JT610, the data shows the following: AOA IS NOT FAULTY. IT IS INSTALLED INCORRECTLY. There is a constant offset between L & R, that is not a fault of the sensor, that is an install error.
Cases described historically had to do with wrong template used from day one at factory - ( which in this case seems unlikely )
with both physical and electrical ( bad or wrong connector plug ) being possible again does not rule out an incorrect install
and then the fubar airspeed and other warnings may lead to a code flaw of some sort
all of which could lead to more than one gotcha in the system -
Hopefully a closer look at FDR and CVR data plus inspect records/calibration will be made available ... or perhaps the acrtual part (AOA sensor)
Max Crash After Start (MCAS)
I think a few people now are making a case for an input into the basic elevator control run.
The reason is:
1 This was where the increased force was Intended to be felt.
2 The stab remains in trim - the input is direct and can be trimmed.
3 Depending on the design the input only occurs once, bringing the feel into line with the NG, whereas with MCAS if the high AoA condition remains the input repeats.
4 In failure mode of the sensor(s) a one time feel correction won’t be catastrophic and a mechanical system won’t repeatedly react to such a failure.
5. In use, a simple position switch could switch on a cockpit notification.
Two ways have been mooted - an input into the elevator feel box or a dedicated high AoA box in the control run.
The latter would be easier to achieve, quicker and would mean that the elevator feel box remains common.
Unfortunately the “back to the drawing board” mentality has long since been replaced by the effort to make an original idea work, no matter what. Don’t admit anything is a mistake.
For a line pilot this work ethic goes mightily against the grain.
So we will probably finally see another bodge to the bodge applied to the trim system.
The reason is:
1 This was where the increased force was Intended to be felt.
2 The stab remains in trim - the input is direct and can be trimmed.
3 Depending on the design the input only occurs once, bringing the feel into line with the NG, whereas with MCAS if the high AoA condition remains the input repeats.
4 In failure mode of the sensor(s) a one time feel correction won’t be catastrophic and a mechanical system won’t repeatedly react to such a failure.
5. In use, a simple position switch could switch on a cockpit notification.
Two ways have been mooted - an input into the elevator feel box or a dedicated high AoA box in the control run.
The latter would be easier to achieve, quicker and would mean that the elevator feel box remains common.
Unfortunately the “back to the drawing board” mentality has long since been replaced by the effort to make an original idea work, no matter what. Don’t admit anything is a mistake.
For a line pilot this work ethic goes mightily against the grain.
So we will probably finally see another bodge to the bodge applied to the trim system.
Join Date: Sep 1999
Posts: 541
Likes: 0
Received 0 Likes
on
0 Posts
Boeing have grounded the MAX reluctantly,acting under "extreme caution".FCENG84 has outlined very succintly why MCAS is there and why stick input cant inhibit it.I dont think they're going to install a third AoA and they wont be fitting a stick shaker
inhibit switch on the column.What if 2 faulty AoA indicators rule out the 3rd good one?
I think they will stick with two and have them activate MCAS only when they both agree.If they disagree MCAS wont activate which will make unwanted MCAS activation
far more unlikely.
In these accidents,the crew were facing unreliable airspeed and a flight control problem(perceived though it may be) simultaneously compounded of course by the cacophony of the stick shaker.Thats cognitive overload for some crews,especially if unfamiliar with MCAS in the first place(Lionair).
But we know that some crews can handle this,even without MCAS knowledge.Call it airmanship.
If the AoA fix is done then IMO they have to supplement it with some additional precautions;
-------->No Captain can go direct to MAX without significant classic/NG time as Captain
-------->this 100 hour limitation in some companies where a Captain is deemed "experienced" and can fly with a new co-pilot out of flight school....this has to be looked at again.
-------->MAX simulators have to represent the MAX faithfully.....100%.....an MCAS event(unwanted and genuine) must be programmable
-------->new MAX pilots have to have these scenarios demonstrated and they have to perform them....every 6 months
Of course it might help if the Captains were not 28 years old but thats another topic...for another day.
inhibit switch on the column.What if 2 faulty AoA indicators rule out the 3rd good one?
I think they will stick with two and have them activate MCAS only when they both agree.If they disagree MCAS wont activate which will make unwanted MCAS activation
far more unlikely.
In these accidents,the crew were facing unreliable airspeed and a flight control problem(perceived though it may be) simultaneously compounded of course by the cacophony of the stick shaker.Thats cognitive overload for some crews,especially if unfamiliar with MCAS in the first place(Lionair).
But we know that some crews can handle this,even without MCAS knowledge.Call it airmanship.
If the AoA fix is done then IMO they have to supplement it with some additional precautions;
-------->No Captain can go direct to MAX without significant classic/NG time as Captain
-------->this 100 hour limitation in some companies where a Captain is deemed "experienced" and can fly with a new co-pilot out of flight school....this has to be looked at again.
-------->MAX simulators have to represent the MAX faithfully.....100%.....an MCAS event(unwanted and genuine) must be programmable
-------->new MAX pilots have to have these scenarios demonstrated and they have to perform them....every 6 months
Of course it might help if the Captains were not 28 years old but thats another topic...for another day.
Join Date: Mar 2019
Location: Null Island
Posts: 77
Likes: 0
Received 0 Likes
on
0 Posts
MCAS does not operate when in autopilot - it is intended solely for manual flying to ensure that the reduction in backpressure on the control column when in high AOA does not lead a pilot to inadvertently pull back into a stall. So the article you quote is not looking at the MCAS issue at all as the problem only occurred on engaging autopilot. It is probably looking at ASRS reports from crews that in some way mis-set the autopilot causing it to attempt to fly to where the crew had set it to fly. It is most definitely not MCAS.
Trawling ASRS requires a certain amount of knowledge of what you are looking at.
Trawling ASRS requires a certain amount of knowledge of what you are looking at.
AOA probes stick, or go open or closed circuit, and give fixed, high or low limit output on failures. A constant difference between the two is not a fault in the sensor it is an indexing error, IMHO.
JT043 28 Oct 18 DPS-CGK first flight post installation of replacement AOA probe
JT610 28 Oct 18. Accident flight, post further maintenance action
Join Date: Nov 2007
Location: Hong Kong
Posts: 448
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Apr 2014
Location: Newport
Posts: 3
Likes: 0
Received 0 Likes
on
0 Posts
More data needed
Agreed. This failure mode, whatever it turns out to be, has demonstrated catastrophic consequences, possibly in two cases The system safety of the type design requires improvement. Training is not an acceptable alternative to safe design. I would be curious to know how a software "enhancement" answers the mail, and I wonder what the design assurance level of the software is. If faulty AoA sensing is part of the issue, then the AoA sensing system input to MCAS will need system safety (hardware) enhancement in keeping with potential catastrophic consequences of the failure mode. Of course, the actual resolution must be based on more data than we have on this forum.
Re post #1450,
It seems that 'the problem' occurred during the turn back or very quickly thereafter, in both cases.
Is there any indication of the angle of bank applied, (post crash) and therefore increased AoA incurred during the turn - which may or may not require a degree of increased elevator control?
Therefore, Increased MCAS input?
Just asking...
It seems that 'the problem' occurred during the turn back or very quickly thereafter, in both cases.
Is there any indication of the angle of bank applied, (post crash) and therefore increased AoA incurred during the turn - which may or may not require a degree of increased elevator control?
Therefore, Increased MCAS input?
Just asking...
Last edited by Ex FSO GRIFFO; 16th Mar 2019 at 05:42. Reason: Clarity
Join Date: Mar 2014
Location: WA STATE
Age: 78
Posts: 0
Likes: 0
Received 0 Likes
on
0 Posts
So Boeng now claims a software fix ready to load in 10 days ? Run a test flight after loading software and put back in service ??
IMHO- this is the equivalent of 1 male plus 1 female = 1 baby in 9 months, therefore 9 men plus 1 woman = 1 baby in 1 month software coding logic
And of course the rest of the world will agree, cuz Boeing said so ??
IMHO- this is the equivalent of 1 male plus 1 female = 1 baby in 9 months, therefore 9 men plus 1 woman = 1 baby in 1 month software coding logic
And of course the rest of the world will agree, cuz Boeing said so ??
Join Date: Apr 2008
Location: Australia
Posts: 669
Likes: 0
Received 0 Likes
on
0 Posts
calypso,
I think yours is a very good summation. I was just looking closely at the JT610 FDR data last night. The big difference between the Lionair accident flight and the previous flight was that the previous crew immediately disabled the electric stab trim.
I think yours is a very good summation. I was just looking closely at the JT610 FDR data last night. The big difference between the Lionair accident flight and the previous flight was that the previous crew immediately disabled the electric stab trim.