Ethiopian airliner down in Africa
Join Date: Jul 2002
Location: Europe
Posts: 65
Likes: 0
Received 0 Likes
on
0 Posts
Suppose MCAS becomes unavailable during flight e.g. due to Stab trim deactivation. The MAX’s flight characteristics in approach to stall scenarios proved not certifiable without MCAS as a fix. I’d like to ask the ones in the know (FcEng and others) how critical the loss of MCAS in flight would be in real life. For example, encountering a flight upset with approach to stall, how easily can this be recovered without MCAS? How was the risk of such an event assessed? Was it demonstrated in test flights? Why was it determined there would be no need to train flight crews on the simulator for the changed handling outside the certification parameters?
In a previous post I assumed such a scenario to be critcal, but perhaps it isn’t? Thanking you in advance for shedding light on this issue.
In a previous post I assumed such a scenario to be critcal, but perhaps it isn’t? Thanking you in advance for shedding light on this issue.
Join Date: Nov 2007
Location: dublin
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Lot of discussion on MCAS and associated issues, I'm not condoning Boeing's apparent quick fix but airlines and consumers have a degree of involvement too.
737 is by today's standards an old design, the NG was a comprehensive update but its still based on a 60's design.
If you look at the 757 which most of us thought would take over from the 737 it takes a greater payload further, higher and faster for a comparable or better fuel burn; Not seen much outside the States now but still heavily used by some major players for N. American routes.
Why choose an older design over newer, more efficient types? Conservatism and customer familiarity/confidence are my first thoughts, leading us to this moment.
737 is by today's standards an old design, the NG was a comprehensive update but its still based on a 60's design.
If you look at the 757 which most of us thought would take over from the 737 it takes a greater payload further, higher and faster for a comparable or better fuel burn; Not seen much outside the States now but still heavily used by some major players for N. American routes.
Why choose an older design over newer, more efficient types? Conservatism and customer familiarity/confidence are my first thoughts, leading us to this moment.
Y
Nomad,
In a companion thread here there is discussion about having to rely upon the same faulty sensors even in "Manual" reversion and comments that one might actually be in "pseudo-manual mode" as a result.
I think back to the long discussion about AF 447 crash and the circumstances surrounding that tragedy.
How does a crew really get back to an old fashioned "Hands On" configuration of controls, instruments, and sensors (where all of the automation and fancy gadgets are completely isolated from involvement) these days?
In a companion thread here there is discussion about having to rely upon the same faulty sensors even in "Manual" reversion and comments that one might actually be in "pseudo-manual mode" as a result.
I think back to the long discussion about AF 447 crash and the circumstances surrounding that tragedy.
How does a crew really get back to an old fashioned "Hands On" configuration of controls, instruments, and sensors (where all of the automation and fancy gadgets are completely isolated from involvement) these days?
Join Date: Mar 2007
Location: Europe
Posts: 256
Likes: 0
Received 0 Likes
on
0 Posts
Why so? What was driving the cost? The fuselage cross section was the same as 707, 727 and 737. Wings were better, and the undercarriage was high enough to support support high bypass turbofans without workarounds. The 757-200 was originally intended as a replacement for the 727-200 and is only 2 ft. longer, even if it seats more due to more efficient use of cabin space. It is hard to see why a shrink of the 757 would not have been a competent replacement for the 737 - 700 to 900 and a serious competitor for the A32x-Neo.
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Reuters report on CVR
Unless I've missed it, this Reuters story hasn't been addressed here.
Exclusive: Lion Air pilots scoured handbook in minutes before crash
. . . Big Snip . . .
“They didn’t seem to know the trim was moving down,” the third source said. “They thought only about airspeed and altitude. That was the only thing they talked about.”
. . . Big Snip . . .
“They didn’t seem to know the trim was moving down,” the third source said. “They thought only about airspeed and altitude. That was the only thing they talked about.”
Join Date: Jan 2008
Location: Herts, UK
Posts: 748
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Sep 2018
Location: Laredo, TX
Posts: 133
Likes: 0
Received 0 Likes
on
0 Posts
No, you cannot simply waive certification requirements on stability by saying you will provide some more training. And how have you arrived at the conclusion that training would do a better job than a small system that provides the required control forces at high angles of attack? This is a system that helps return the aircraft to its normal flight envelope when it already is at a high angle of attack. Typically this is a situation where something else has already gone wrong, and that almost always implies a high workload, where it is vastly preferable to have the airplane return to fully controlled flight by itself rather than relying on a task-saturated pilot to remember some bit of training highly specific to this type of aircraft.
Obviously, these kinds of assistive devices require a proper hazard assessment to be performed, including adequate assumptions about human behaviour, especially in a high-workload environment, which is exactly where this system is most likely to be active, and an analysis of worst-case consequences of single failures. Arguably that could have been done better in the case of MCAS.
On the whole, I'm sure you will find that fly-by-wire airliners generally have a far better safety record than conventionally controlled ones. That is not to say that it is only due to the computer-controlled flight controls, but also because FBW types are newer and incorporate other advances in safe design and systems reliability. But it is also clear that computer-assisted flight controls do not generally make flying less safe, QF72 notwithstanding. Case in point: The A320neo has had no accidents and perhaps one incident (tailstrike), despite being on the market somewhat longer and having almost twice as many airframes in service as the 737MAX.
Bernd
Obviously, these kinds of assistive devices require a proper hazard assessment to be performed, including adequate assumptions about human behaviour, especially in a high-workload environment, which is exactly where this system is most likely to be active, and an analysis of worst-case consequences of single failures. Arguably that could have been done better in the case of MCAS.
On the whole, I'm sure you will find that fly-by-wire airliners generally have a far better safety record than conventionally controlled ones. That is not to say that it is only due to the computer-controlled flight controls, but also because FBW types are newer and incorporate other advances in safe design and systems reliability. But it is also clear that computer-assisted flight controls do not generally make flying less safe, QF72 notwithstanding. Case in point: The A320neo has had no accidents and perhaps one incident (tailstrike), despite being on the market somewhat longer and having almost twice as many airframes in service as the 737MAX.
Bernd
From the NYTimes: 2015 OIG Audit Report
FAA LACKS AN EFFECTIVE STAFFING MODEL AND RISK-BASED
OVERSIGHT PROCESS FOR ORGANIZATION DESIGNATION AUTHORIZATION
Federal Aviation Administration
https://www.oig.dot.gov/sites/defaul...5E10-15-15.pdf
Last edited by PJ2; 20th Mar 2019 at 16:44.
Join Date: Jul 2007
Location: Germany
Posts: 556
Likes: 0
Received 0 Likes
on
0 Posts
Is that certification requirement an airframe stabilty criteria. Because MCAS does not operate with the autopilot on and that nacelle effect would still be there. I don't know if the MCAS envelope would be normally encountered with the autopilot on but one case I envision is a long final where you stay clean and get a windshear event. If MCAS wasn't there when you performed the escape would you not still fly attitude no matter what the stick force was? I think you also can do the escape on autopilot and it wouldn't be affected but maybe you can't activate an automatic escape when clean.
Bernd
Join Date: Apr 2015
Location: Under the radar, over the rainbow
Posts: 788
Likes: 0
Received 0 Likes
on
0 Posts
Thanks. Armchairpilot's link was to a version of the story published in Straits Times and the headline cited ddn't get my attention. I posted the link to the other version largely because "a source" who supposedly heard the CVR recording or read a transcript noted that the crew didn't appear to have noticed the H-stab trimming.
Join Date: Mar 2007
Location: Europe
Posts: 256
Likes: 0
Received 0 Likes
on
0 Posts
Using the trim to counter a pitch up moment seems counterintuitive.
1. It is fairly slow in comparison to e.g. windshear.
2. The change remains there even after the disturbance is gone.
A brief push on the stabilizer seems more adequate to deal with a quick and transient upset. I suppose the actuator is not there because the 737 stab is not FBW?
1. It is fairly slow in comparison to e.g. windshear.
2. The change remains there even after the disturbance is gone.
A brief push on the stabilizer seems more adequate to deal with a quick and transient upset. I suppose the actuator is not there because the 737 stab is not FBW?
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
Automation Surprise - or 'What's it doing now?'
Thanks. Armchairpilot's link was to a version of the story published in Straits Times and the headline cited ddn't get my attention. I posted the link to the other version largely because "a source" who supposedly heard the CVR recording or read a transcript noted that the crew didn't appear to have noticed the H-stab trimming.
See "Automation Surprise" in Aviation: Real-Time Solutions Here is the abstract:
Conflicts between the pilot and the automation, when pilots detect but do not understand them, cause "automation surprise" situations and jeopardize flight safety. We conducted an experiment in a 3-axis motion flight simulator with 16 pilots equipped with an eye-tracker to analyze their behavior and eye movements during the occurrence of such a situation. The results revealed that this conflict engages participant's attentional abilities resulting in excessive and inefficient visual search patterns. This experiment confirmed the crucial need to design solutions for detecting the occurrence of conflictual situations and to assist the pilots. We therefore proposed an approach to formally identify the occurrence of "automation surprise" conflicts based on the analysis of "silent mode changes" of the autopilot. A demonstrator was implemented and allowed for the automatic trigger of messages in the cockpit that explains the autopilot behavior. We implemented a real-time demonstrator that was tested as a proof-of-concept with 7 subjects facing 3 different conflicts with automation. The results shown the efficacy of this approach which could be implemented in existing cockpits.
So had there been a warning "AoA Disagree expect unreliable airspeed, Stick Shaker and MCAS" followed by "MCAS TRIMMING DOWN"
There would have been no automation surprise as the crew wouldn't have been left trying to find out 'what's it doing now?' and two aircraft could have landed safely.
Indeed just these warnings may be all the software change needed.
Join Date: Mar 2014
Location: Clinton WA
Age: 75
Posts: 74
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Jun 2009
Location: Dorset
Posts: 31
Likes: 0
Received 0 Likes
on
0 Posts
If it turns out the the Ethiopian accident was the result of the same issues that led to the Lion Air accident our industry has some major soul searching to do.
While the MCAS software update developed after the Lion Air accident that is almost ready to go to the fleet will likely remove reliance on the three MCAS design assumptions listed above and thus would have greatly improved the likelihood of a safe outcome for the Ethiopian event we are left with a huge elephant in the room. After making the planned update we still must address the following:
A. How many other key points in the 737MAX safety story are based on pilot response assumptions that may not be valid?
B. How about other airplane models? Are they deemed safe based on faulty assumptions regarding pilot action?
- For instance, how may current 737 crews (all models) would not respond quickly enough to a classic stabilizer runaway that was not arrested by column cutout (i.e., pulling the column far enough)? I know this is covered in simulator sessions for 737 pilots, but is that enough?
C. Moving forward with the current status and future of commercial aviation have we gotten to the point where basic flying skills and system awareness are so low that we are at risk throughout the whole industry?
D. Can current and future pilot reaction short falls be addressed through training? If so, what kind, how much, and how often?
E. How will we know that we have achieved a sufficient industry wide level of safety?
Hoping to see FDR data from the Ethiopian accident soon. I sure hope someone from the PPRUNE community will find a way to get ahold of it and share it here.
While the MCAS software update developed after the Lion Air accident that is almost ready to go to the fleet will likely remove reliance on the three MCAS design assumptions listed above and thus would have greatly improved the likelihood of a safe outcome for the Ethiopian event we are left with a huge elephant in the room. After making the planned update we still must address the following:
A. How many other key points in the 737MAX safety story are based on pilot response assumptions that may not be valid?
B. How about other airplane models? Are they deemed safe based on faulty assumptions regarding pilot action?
- For instance, how may current 737 crews (all models) would not respond quickly enough to a classic stabilizer runaway that was not arrested by column cutout (i.e., pulling the column far enough)? I know this is covered in simulator sessions for 737 pilots, but is that enough?
C. Moving forward with the current status and future of commercial aviation have we gotten to the point where basic flying skills and system awareness are so low that we are at risk throughout the whole industry?
D. Can current and future pilot reaction short falls be addressed through training? If so, what kind, how much, and how often?
E. How will we know that we have achieved a sufficient industry wide level of safety?
Hoping to see FDR data from the Ethiopian accident soon. I sure hope someone from the PPRUNE community will find a way to get ahold of it and share it here.
The same flawed argument now seems to being applied to AoA with MCAS. I am only aware of three cases of the MCAS not working correctly, in only one case did the crew manage to safely deal with the situation. The real hard evidence suggests that a significant proportion of pilots (somewhere between 10% and 90%) would not be able to cope. From what I understand about MCAS from the Pprune posts, I would expect this probability of pilots failing to cope would need to be of the order of 0.1% (or lower) in order for the MCAS to be considered as not safety critical. IHO, only a basic understanding of Human Factors is needed to show that the MCAS safety assessment is fundamentally flawed. This is the elephant in the room, Boeing might perhaps try to hide it with a software patch, but it will still be there.
The software patch looks inadequate to me for the following reasons:-
A) Quote from https://www.seattletimes.com/busines...ion-air-crash/
“According to a detailed FAA briefing to legislators, Boeing will change the MCAS software to give the system input from both angle-of-attack sensors. It will also limit how much MCAS can move the horizontal tail in response to an erroneous signal. And when activated, the system will kick in only for one cycle, rather than multiple times.”
I find this quite disturbing:-
i) They seem to have ‘defined’ the software patch before they even know the cause.
ii) How does having both inputs help if one of them is ‘erroneous, but believable’?
iii) Presumably the software would have be set to be cautious and use the higher (potentially wrong) value?
iv) MCAS was originally designed at its current limits in order to counteract a known problem. Presumably lowering the limits mean that more ‘real’ problems will not now be safely dealt with.
B) There may well be failure modes other than the AoA vane that need to be considered. From https://leehamnews.com/2018/11/07/bo...-air-accident/ the Alpha Vanes input to the ADIRUs, presumably there they are at least A to D converted. Are the (non-safety critical) ADIRUs a potential source of failures?
C) From The Seattle Times report, the MCAS was not considered to be a Level 1 safety critical system, so presumably the software was not designed, developed and tested to Level 1 standards. In which case, a software failure within the MCAS has to be considered as a feasible cause of the MCAS’s undesirable behaviour.
Considering your points A to E on the future of aviation safety: I fear the aviation industry is approaching a ‘perfect storm’ dilemma:
a) aircraft are becoming more complex, even Boeing consider that “average” pilots cannot cope with the workload of extra information about MCAS
b) air traffic is increasing and new aircraft designs are ‘down-sizing’ as smaller aircraft are more cost effective; this means many more new, inexperienced, pilots will be needed
c) it is not possible to train pilots such that they all become ‘super Sulleys’.
My conclusions are:-
a) systems must no longer use human intervention as part of their safety case; we are too unpredictable.
b) safety critical systems must get smarter; garbage in, garbage out is not an option, neither is giving up and disconnecting.
Join Date: Mar 2015
Location: Stratosphere
Posts: 42
Likes: 0
Received 0 Likes
on
0 Posts
Gordon Bethune, former Continental CEO, on FAA and Boeing
Salute!
Thanks, infrequent, good post about previous flight; And I would not trust all what is being bandied about concerning the extra set of eyes on that previous flight. Did that dude know about MCAS? I doubt it. Was he holding up to 40 or 50 pounds of a vibrating wheel? Ws he looking about to see if he could help? Probably. Was he more likely to notice the trim wheel moving more than the normal STS movement? Maybe. Maybe he was one of the Yeager, Doolittle or Lindbergh clones we have here or like Luke? "Something ain't right, R2, let's go manual!"
So I will like to see his actual interview and description of what happened.
As far as the other previous crewmembers go, I really feel they did a fatal disservice to the accident crew with their log entry. No mention of the stick shaker or turning off the stab trim motor and so forth. We won't know exactly what they did until they testify in one of the lawsuits. I am sure they won't say a word before then, and maybe the dead head troop won't either.
As with Mick, I am cutting the accident crew some slack.
Gums sends...
Thanks, infrequent, good post about previous flight; And I would not trust all what is being bandied about concerning the extra set of eyes on that previous flight. Did that dude know about MCAS? I doubt it. Was he holding up to 40 or 50 pounds of a vibrating wheel? Ws he looking about to see if he could help? Probably. Was he more likely to notice the trim wheel moving more than the normal STS movement? Maybe. Maybe he was one of the Yeager, Doolittle or Lindbergh clones we have here or like Luke? "Something ain't right, R2, let's go manual!"
So I will like to see his actual interview and description of what happened.
As far as the other previous crewmembers go, I really feel they did a fatal disservice to the accident crew with their log entry. No mention of the stick shaker or turning off the stab trim motor and so forth. We won't know exactly what they did until they testify in one of the lawsuits. I am sure they won't say a word before then, and maybe the dead head troop won't either.
As with Mick, I am cutting the accident crew some slack.
Gums sends...
Join Date: Feb 2005
Location: UK
Age: 85
Posts: 697
Likes: 0
Received 0 Likes
on
0 Posts
Using the trim to counter a pitch up moment seems counterintuitive.
Join Date: Mar 2019
Location: PA
Posts: 5
Likes: 0
Received 0 Likes
on
0 Posts
That's a key point. If you have two watches you never really know what time it is. With two inputs, how do you know which is correct?
Join Date: Jan 2019
Location: Belfast
Posts: 36
Likes: 0
Received 0 Likes
on
0 Posts
Salute!
Thanks, infrequent, good post about previous flight; And I would not trust all what is being bandied about concerning the extra set of eyes on that previous flight. Did that dude know about MCAS? I doubt it. Was he holding up to 40 or 50 pounds of a vibrating wheel? Ws he looking about to see if he could help? Probably. Was he more likely to notice the trim wheel moving more than the normal STS movement? Maybe. Maybe he was one of the Yeager, Doolittle or Lindbergh clones we have here or like Luke? "Something ain't right, R2, let's go manual!"
So I will like to see his actual interview and description of what happened.
As far as the other previous crewmembers go, I really feel they did a fatal disservice to the accident crew with their log entry. No mention of the stick shaker or turning off the stab trim motor and so forth. We won't know exactly what they did until they testify in one of the lawsuits. I am sure they won't say a word before then, and maybe the dead head troop won't either.
As with Mick, I am cutting the accident crew some slack.
Gums sends...
Thanks, infrequent, good post about previous flight; And I would not trust all what is being bandied about concerning the extra set of eyes on that previous flight. Did that dude know about MCAS? I doubt it. Was he holding up to 40 or 50 pounds of a vibrating wheel? Ws he looking about to see if he could help? Probably. Was he more likely to notice the trim wheel moving more than the normal STS movement? Maybe. Maybe he was one of the Yeager, Doolittle or Lindbergh clones we have here or like Luke? "Something ain't right, R2, let's go manual!"
So I will like to see his actual interview and description of what happened.
As far as the other previous crewmembers go, I really feel they did a fatal disservice to the accident crew with their log entry. No mention of the stick shaker or turning off the stab trim motor and so forth. We won't know exactly what they did until they testify in one of the lawsuits. I am sure they won't say a word before then, and maybe the dead head troop won't either.
As with Mick, I am cutting the accident crew some slack.
Gums sends...
Everything points to 'automation surprise' which occurs when automation does something you do not expect.
See "Automation Surprise" in Aviation: Real-Time Solutions Here is the abstract:
MCAS is a 'silent mode change' of the aircraft and so too was the AoA disagree in some ways.
So had there been a warning "AoA Disagree expect unreliable airspeed, Stick Shaker and MCAS" followed by "MCAS TRIMMING DOWN"
There would have been no automation surprise as the crew wouldn't have been left trying to find out 'what's it doing now?' and two aircraft could have landed safely.
Indeed just these warnings may be all the software change needed.
See "Automation Surprise" in Aviation: Real-Time Solutions Here is the abstract:
MCAS is a 'silent mode change' of the aircraft and so too was the AoA disagree in some ways.
So had there been a warning "AoA Disagree expect unreliable airspeed, Stick Shaker and MCAS" followed by "MCAS TRIMMING DOWN"
There would have been no automation surprise as the crew wouldn't have been left trying to find out 'what's it doing now?' and two aircraft could have landed safely.
Indeed just these warnings may be all the software change needed.
At that time a multitude of 'experts' derided the idea that MCAS, since Lion Air, could be a factor- 'sure everyone knows what to do'. It's really not that simple! Some on this forum even insinuated that the first thing they'd do in any abnormal circumstance is flick the Stab Cut-Outs- sorry, what??? You've got a spectrum of warnings, stick shaker etc. and some forum experts believe they'd have performed perfectly every time? It's easy to make those statements in hindsight and fixating on one single issue- in this case MCAS. I was fed up with constant comments that just jumped to some conclusion that 'it's the crew's fault'.
Even those that use the Lion Air's previous flight crew as an example of what should be done- if this scenario was scientifically tested- I'd like to know the % of success/failure in the exact same scenario. At the minute- 50% for Lion Air- is that a success rate acceptable to the industry? Or do we need to revert to a 3 man flight deck? MCAS activation in the situation described is by and large silent automation- which is why it is dangerous.
I welcome all posts and find this forum to be an excellent place to discuss. In the spirit of following CRM best practice, let's be constructive, rather than posting spurious condescending comments- by users who expect every pilot to act like Sully, and deride any suggestion that the situation may be somewhat difficult for the crew in the given circumstances.
Last edited by positiverate20; 20th Mar 2019 at 19:49.
Join Date: Jan 2015
Location: Banksville
Posts: 70
Likes: 0
Received 0 Likes
on
0 Posts
“...when activated, the system will kick in only for one cycle, rather than multiple times.”
So....what the heck does that mean exactly? MCAS is off for the rest of the flight?
There must be some re-set feature?
So....what the heck does that mean exactly? MCAS is off for the rest of the flight?
There must be some re-set feature?
