Ethiopian airliner down in Africa

[bill fly]

Well, if that’s true (by airman1900 above) it’s a combination of fixes, which many here have advocated.
Better would have been a system which doesn’t affect the elevator trim at all. But that’s the 737, even the auto land on the 300 required a massive stabiliser up input at 400 feet to enable the flare. If you then had an engine failure, the subsequent (manual) go around required mucho stick forward to avoid a huge pitch up.
having got away with that and had it certified, I guess Boeing thought they could fix just about everything via trim...
edited to remove italic...

[Discorde]

As I've posted before in threads relating to false stick-shaker and overspeed warnings: it's worth knowing in advance which CBs protect these warning systems so they can be isolated if required, which will remove the noise distractions while problem solving is underway. For B757/767:

Aural warning: B16 & H35
Stick-shaker: C11 & J21

This assumes of course that these CBs are not also protecting other vital circuits.

[WHBM]

Originally Posted by airman1900

From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:

Appears almost totally written by the Boeing PR department.

[VicMel]

Originally Posted by FCeng84

VicMel - I really appreciate your thoughtful response. I sense that overall you and I are on the same page. Please allow me to provide a few inputs on your points:

C) MCAS is implemented within the FCC within the same software that controls other automatic stabilizer control functions such as offload when A/P is engaged and STS. This code already required to be designed to high standards.
Conclusion a) We may need to rely less on critical crew action, but there must be some base level that can be counted upon. I suggest at least:
- RTO for engine out below V1
- Pull for takeoff somewhere near Vr
- Gear and flap management and coordination with associated speeds throughout flight
- Comply with ATC guidance
- Ability to navigate to destination
- Ability to capture and follow glideslope and localizer to runway and command landing flare
- Recognize unstable approach and execute go-around
- Sorry for the length of this list. My point is that there are many pilot actions we count on to maintain safe operation
Conclusion b) I fully agree and suggest adding that if the inputs are garbage the system should be robust enough to maintain safety.

Thanks for your detailed response with all of your valid comments. As you say, I believe we, and many other posters are “on the same page”.

I fully agree with your comment regarding crew action “there must be some base level that can be counted upon”. The upside of human unpredictability is the ‘magic’ of intuition, i.e. being able to think ‘outside the box’ (literally in aviation terms). This is why a pilot will always be needed on an aircraft with passengers. The point I was trying to get across is I believe aviation authorities must stipulate that if a supplier is using crew actions as part of his probabilistic safety case, then a Human Factors assessment has to be carried out. This would produce a figure for the probability of achieving whatever task the crew are supposed to do. This figure then has to go into the fault tree(s) to show the aircraft meets its acceptable safety criteria.

As software is my specialty, I would like to expand more on the software criticality issue, please pardon me if I am stating the obvious. This issue is in regard to MCAS in particular, but also other systems that are considered to be not safety critical, such as Air Data Systems. You are right to say about MCAS software, “This code already required to be designed to high standards”. However, there is a huge difference between the DO-178C software certification standard Level A (catastrophic failure, potentially loss of aircraft) and Level C (major failure, potentially minor injuries to passengers). I would expect all Level C software to be produced to a high standard, but Level A obviously has to be at a very significantly higher standard. There is a huge cost saving that can be made if the software can be justified as not needing to be at Level A; some estimates suggest Level A is at least 2 to 3 times more expensive to produce than Level C. The main 3 factors leading to this increased cost are:-
a) independence of verification; which needs additional team(s) of engineers
b) quality of process; e.g. using Ada rather than C, code analysis tools and (most importantly) specialist software engineers with lots of wide ranging experience on real time, safety critical systems.
c) complexity of software; there is a saying ‘system safety lies within the software’, meaning software has to be added to basic functionality to ensure the system meets its prescribed safety requirements. For example the hardware engineer may determine that triplex sensors are needed to ensure hardware integrity, but then the system engineer has to determine how the software is to handle the 3 inputs to produce a ‘safe to use’ output. This might be a ‘vote’ or an average or using historical readings to determine best integrity. And if the triplex sensors are vulnerable to ‘common mode failure’, the team might decide a different technology sensor has to be used, or to use other system’s data in order to provide a temporary reversion mode.

Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

[Alchad]

Originally Posted by VicMel

Thanks for your detailed response with all of your valid comments. As you say, I believe we, and many other posters are “on the same page”.

Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

If I were a betting man, I would put a few pounds on this suggestion. Failure of the AoA sensor seems to being clutched at like the proverbial man and a straw, but I've yet to see anything which confirms this. Let's hope Boeing are also pouring over the code with a very fine toothcomb.

Peter Lemme (Satcom Guru) has also commented on the AoA versus software issue.

(I've posted this previously but it adds context to repost here.)

Ethiopian ET302 similarities to Lion Air JT610

Reports from Ethiopian investigators have implicated the same Angle of Attack (AoA) sensor malfunction that was observed on Lion Air. Lion Air captain AoA sensor read about 22 degrees higher than the First Officer AoA sensor (a large bias error). Initial assessment of Lion Air AoA failure modes did not reveal any obvious electrical malfunction that could create the bias. The simplest explanation was that the AoA vane had been bent, causing a gross aerodynamic offset in the readings. If ET302 encountered the exact same offset, with the likelihood of it being bent exactly the same way not being conceivable, some other factor must be in play. For example, the ARINC 429 representation of AoA uses two's complement fraction binary notation (BNR). It is interesting to note that bit 26 represents 22.5 degrees which would be the bit "flipping" between the Captain and F/O AoA values (all other bits would match). Is it possible that the ARINC 429 word is getting corrupted (software defect)? If the ET302 offset was something like 20 or 24, this theory falls apart.

Full post

https://www.satcom.guru/2019/03/ethi...lion.html#more

[OldnGrounded]

Originally Posted by airman1900

From Aviation Week & Space Technology magazine March 25-April 7,2019, pages 16-18:

". . . Boeing says the changes are designed to increase overall system redundancy, limit stabilizer trim commands in response to an erroneous AOA reading and retain elevator authority by limiting the degree of stabilizer command."

This appears to quote material from Boeing. It also seems to support the understanding that MCAS, as originally implemented, had authority to command stab trim positions beyond points where elevator inputs could override.

[Smythe]

Aero-12:

The center of gravity (CG) also affects the lift that the wing must produce. As the CG moves forward, the nose-down moment increases because of the airplane weight and wing lift (fig. 5). Therefore, the downforce on the horizontal tail required to trim is increased. This means that the wing must provide enough lift to compensate for the download on the tail in addition to the weight of the airplane. Note that the AOA of stall is not changed, but the lift required of the wing is greater, and therefore the stall speed is increased.

[BlueMax56]

NY Times today: Boeing was "Go, Go, Go to beat Airbus with 737 Max
(can't post the URL yet but worth reading)

[FCeng84]

Originally Posted by Takwis

So in other words, you are saying that, "Elevator Control is sufficient to safely land the aircraft regardless of stabilizer position" doesn't mean "regardless of stabilizer position"; it means "any NORMALLY ENCOUNTERED position." I think I'm going to have to go back to English class, I guess.

Consider the situation of the airplane being loaded to its aft CG limit but the stabilizer trimmed full nose up or the opposite of forward CG with full nose down stabilizer. In either of these cases the elevator will be overwhelmed - particularly at high speed. Why do you suppose runaway stabilizer memory item to shut down stabilizer power is so critical and practiced so often?

[FCeng84]

Originally Posted by GordonR_Cape

airman1900



I'm not sure if the article is poorly written, but that sentence sounds exactly like the bad old MCAS to me (a computer programmer). If a faulty AOA sensor keeps returning +20 degrees, what stops MCAS from repeatedly triggering? What if two stalls follow in close sequence, is each a separate event? More questions than answers about those specific details, including the AOA sensor validation algorithm.

Hopefully Boeing will make the details of the MCAS modification clearer soon. MCAS in its original implementation would run again in the presence of AOA failed high following any amount of pilot pitch trim command. One can envision a modification to require that the pilot have run the trim back nose up at least a certain amount before allowing MCAS to go again. Or how about requiring that AOA drop low after having been high before allowing MCAS to go again. There are lots of things that could be done to provide additional interlocks. I am certain that we will learn that simply blipping trim with the revised logic will not trigger MCAS to reset to the point of running in another full increment of airplane nose down stabilizer motion.

[MemberBerry]

Originally Posted by 73qanda

FCeng84 or anyone more knowledgeable than me can you explain any relationship between the Feel diff press defect ( written up on the Lion Air aircraft) and the AOA vane?
My thoughts were that Feel Diff Press meant either a hyd system failure or the elevator pitot was in trouble.
Cheers

Incorrect AoA data can cause the aircraft to "believe" it's in a stall situation, when it is not.

As a result it can increase the feel pressure to 4 times the normal pressure, to make it harder to pull the control column and bring the aircraft deeper into the stall.

[GordonR_Cape]

Originally Posted by FCeng84

Hopefully Boeing will make the details of the MCAS modification clearer soon. MCAS in its original implementation would run again in the presence of AOA failed high following any amount of pilot pitch trim command. One can envision a modification to require that the pilot have run the trim back nose up at least a certain amount before allowing MCAS to go again. Or how about requiring that AOA drop low after having been high before allowing MCAS to go again. There are lots of things that could be done to provide additional interlocks. I am certain that we will learn that simply blipping trim with the revised logic will not trigger MCAS to reset to the point of running in another full increment of airplane nose down stabilizer motion.

From a programming point of view, having a system remember its previous state, and respond differently, creates all kinds of complexity. I would never want to go down that route, but can't see simple ways of avoiding the threat of multiple false MCAS activation, while still catering for repeated stalls.

Knowledge of the actual value of the trim stabiliser would be interesting, but I have not seen any mention of that as an input parameter.

[FlexibleResponse]

JRBarrett
The analysis by “Satcom Guru” is intriguing. He has found that the digital representation of AOA in the 737 is expressed as a 26 bit binary word, and if the 26th bit becomes incorrectly set (goes from binary zero to binary 1), it will correspond to an AOA of exactly 22 degrees, which is what the FDR on the Lion Air flight recorded for the left AOA sensor.

I strongly suspect that there was nothing wrong with the AOA sensor on LionAir - but rather some kind of intermittent hardware or software fault in the downstream conversion of the position data from analog to digital. If this also happened on Ethiopian, then the cause of this possible data corruption is going to have to be found and corrected on the Max in addition to any changes made to the MCAS system.

VicMel
Hence my concern:- Because MCAS software was not produced to Level A, it is not assured to be at a high enough standard to allow it to directly control the stabilizer. The risk is that there could be a fault in the software that could cause an erroneous trim condition. The proposed patch may not have any effect on such a software fault.

Alchad
If I were a betting man, I would put a few pounds on this suggestion. Failure of the AoA sensor seems to being clutched at like the proverbial man and a straw, but I've yet to see anything which confirms this. Let's hope Boeing are also pouring over the code with a very fine toothcomb.

Peter Lemme (Satcom Guru) has also commented on the AoA versus software issue.

The replacement of the identified "faulty AOA" sensor with another AOA sensor immediately before the Lion Air crash did not prevent the same "faulty AOA" sensor signal from reoccurring.

And why was the AOA faulty signal accompanied by similtaneous altitude, airspeed disagree indications along with PCU fault?

I agree that this all seems to be pointing at faulty sensor signal conditioning or processing in the air data computer software.

[Smythe]

Here you go Blue Max

Go,Go,Go...

[Smythe]

All these known issues with AoA sensors....from Boeing themselves Aero-12:

Stall warning devices have been mounted on the wing, but most modern commercial jet airplanes have movable leading edges that would interfere with such an installation. Most have the sensor located on the fuselage, far ahead of the wing, reducing the effect of changes in lift and configuration. Nearer to the nose of the airplane, the airflow is relatively clean and the boundary layer is thin, minimizing the required probe height.

Even at the nose, many factors can affect the relationship between the local AOA and true wing AOA (fig. 9). The angle of airflow around the nose is not the same as at the wing.

Also, the sensitivity to changes in AOA is greater, so a 1-deg change in true wing AOA causes a local flow change at the nose of 1.5 to 2 deg.

The trailing-edge flap position has an influence on a typical AOA sensor calibration, as has landing gear position (in particular, that of the nose landing gear doors).

Mach number affects the flow around the nose and therefore changes the sensor calibration.



Pitching the airplane can cause erroneous readings at the sensor. While the nose is pitching up (as in a turn), the local flow angle is reduced, causing the reading to be too low. Although the sensors are placed to minimize the effect of sideslip, it is not eliminated and can be quite significant at sideslip angles that may occur on short final approaches or with an engine out.

Even variations in the contour of the skin near the sensor can subtly affect the local flow angle. Many of these design challenges also affect pitot and static port installation and accuracy.

The sensor itself has potential for error. The combination of installation error, zero bias, and aerodynamic inaccuracy can total 0.5 deg or more. Contamination or damage can also affect the sensors accuracy.

For the most part, the effects discussed above can be compensated for and, depending on the airplane, many have been.

It should be noted, however, that each correction has its own inherent uncertainty and can also cause erroneous readings if the input data is incorrect.

[airman1900]

NYT article:Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 Max

NYT article:Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 Max

Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 Max
By David Gelles, Natalie Kitroeff, Jack Nicas and Rebecca R. Ruiz

Boeing faced an unthinkable defection in the spring of 2011. American Airlines, an exclusive Boeing customer for more than a decade, was ready to place an order for hundreds of new, fuel-efficient jets from the world’s other major aircraft manufacturer, Airbus.

The chief executive of American called Boeing’s leader, W. James McNerney Jr., to say a deal was close. If Boeing wanted the business, it would need to move aggressively, the airline executive, Gerard Arpey, told Mr. McNerney.

To win over American, Boeing ditched the idea of developing a new passenger plane, which would take a decade. Instead, it decided to update its workhorse 737, promising the plane would be done in six years.

The 737 Max was born roughly three months later.

The competitive pressure to build the jet — which permeated the entire design and development — now threatens the reputation and profits of Boeing, after two deadly crashes of the 737 Max in less than five months. Prosecutors and regulators are investigating whether the effort to design, produce and certify the Max was rushed, leading Boeing to miss crucial safety risks and to underplay the need for pilot training.

While investigators are still trying to determine the cause of the crash in Ethiopia this month and one in Indonesia in October, they are focused on a newly installed piece of software designed to avoid stalls. The software was meant to compensate for bigger, more fuel-efficient engines and ensure the plane flew the same way as an earlier version.

Months behind Airbus, Boeing had to play catch-up. The pace of the work on the 737 Max was frenetic, according to current and former employees who spoke with The New York Times. Some spoke on the condition of anonymity because of the sensitivity of the matter.

Engineers were pushed to submit technical drawings and designs at roughly double the normal pace, former employees said. Facing tight deadlines and strict budgets, managers quickly pulled workers from other departments when someone left the Max project. Although the project had been hectic, current and former employees said they had finished it feeling confident in the safety of the plane.

The specter of Boeing’s chief rival was constant. Airbus had been delivering more jets than Boeing for several years. And losing the American account would have been gutting, costing the manufacturer billions in lost sales and potentially thousands of jobs.

“They weren’t going to stand by and let Airbus steal market share,” said Mike Renzelmann, an engineer who retired in 2016 from Boeing’s flight control team on the 737 Max.

The successful end of a 2014 test flight of the Airbus A320neo. When Airbus announced plans for the plane in 2010, a Boeing executive told employees that it posed no threat.

Dismissing a Rival

Boeing didn’t seem bothered at first by the A320neo, the fuel-efficient plane that Airbus announced in 2010.

At a meeting in January of the next year, James F. Albaugh, the chief executive of Boeing’s commercial airplanes division, told employees that Airbus would probably go over budget creating a plane that carriers didn’t really want, according to a recording of the meeting reviewed by The Times.

Mr. Albaugh boasted that carriers were already paying more for Boeing’s single-aisle jet than the Airbus version. He didn’t see the need to strike now — Boeing could wait until the end of the decade to produce a new plane from scratch, the executive said.
“I don’t think we need to get too spun up over the fact that they’re making some sales,” he said.

For decades, Airbus was barely on Boeing’s radar. A consortium started in 1970 by several European countries, it was slow to compete globally. Boeing, founded in 1916, dominated the passenger-jet market with its 737 midsize jet and the 747 jumbo jet.

Then came John Leahy, an American who rose through the ranks to become the chief Airbus salesman in 1994. Mr. Leahy was relentless. Once, the chief executive of an airline got sick just as a deal was about to close. Mr. Leahy traveled to the man’s house, and the executive signed the papers while wearing his bathrobe.

“Boeing thought we were a flash in the pan,” Mr. Leahy said in an interview. “But I thought there was no reason we couldn’t have 50 percent of the market.”

Mr. Leahy scored a major coup in 1999 when JetBlue decided to launch with a fleet composed entirely of Airbus A320s. In the years that followed, more low-cost carriers around the world, like easyJet, placed big orders, too.

Airbus had pulled ahead of Boeing by 2005. “Boeing has struggled with the development work needed to take the company into the 21st century,” Tim Clark, president of Emirates, the Dubai airline, said that year. Airbus, he said, “has been braver, more brazen.”

In 2008, Airbus delivered 483 airplanes, while Boeing delivered just 375. Three years later at the Paris Air Show, Airbus took orders for 730 aircraft, worth some $72.2 billion, with its new fuel-efficient version dominating.

“Boeing was just completely arrogant in dismissing the viability of the A320,” said Scott Hamilton, managing director of the Leeham Company, an aviation consulting firm.

As American considered placing its largest-ever aircraft order exclusively with Airbus in the spring of 2011, executives at the carrier initially didn’t believe Boeing thought that the threat was real, according to a person involved with the discussions, who spoke on the condition of anonymity.

Airbus had a team camped out in a suite at the Ritz-Carlton in Dallas, near American’s headquarters. Mr. Leahy traveled to Dallas and dined with the American chief, Mr. Arpey, at the Mansion on Turtle Creek, a five-star hotel. Boeing visited less frequently, according to several people involved in the sales process.

With American pondering which planes to buy, Boeing made a business decision. A former senior Boeing official said the company opted to build the Max because it would be far quicker, easier and cheaper than starting from scratch, and would provide almost as much fuel savings for airlines.

Eventually, American decided to make deals with both Boeing and Airbus, buying hundreds of jets from each. Mr. Arpey called Mr. McNerney again, this time reading from a script to carefully calibrate his words. First, he congratulated the Boeing chief on the deal, according to the person with knowledge of the discussions. Then he broke the news that American would also place an order with Airbus.

'Intense Pressure Cooker'

Inside Boeing, the race was on. Roughly six months after the project’s launch, engineers were already documenting the differences between the Max and its predecessor, meaning they already had preliminary designs for the Max — a fast turnaround, according to an engineer who worked on the project.

“The timeline was extremely compressed,” the engineer said. “It was go, go, go.”

One former designer on the team working on flight controls for the Max said the group had at times produced 16 technical drawings a week, double the normal rate. “They basically said, ‘We need something now,’” the designer said.

A technician who assembles wiring on the Max said that in the first months of development, rushed designers were delivering sloppy blueprints to him. He was told that the instructions for the wiring would be cleaned up later in the process, he said.

His internal assembly designs for the Max, he said, still include omissions today, like not specifying which tools to use to install a certain wire, a situation that could lead to a faulty connection. Normally such blueprints include intricate instructions.

Despite the intense atmosphere, current and former employees said, they felt during the project that Boeing’s internal quality checks ensured the aircraft was safe.

In a statement, Boeing said: “The Max program launched in 2011. It was offered to customers in September 2012. Firm configuration of the airplane was achieved in July 2013. The first completed 737 Max 8 rolled out of the Renton factory in November 2015.”

The company added, “A multiyear process could hardly be considered rushed.”

At the heart of Boeing’s push was a focus on creating a plane that was essentially the same as earlier 737 models, important for getting the jet certified quickly. It would also help limit the training that pilots would need, cutting down costs for airlines.

Rick Ludtke, an engineer who helped design the 737 Max cockpit and spent 19 years at Boeing, said the company had set a ground rule for engineers: Limit changes to hopefully avert a requirement that pilots spend time training in a flight simulator before flying the Max.

“Any designs we created could not drive any new training that required a simulator,” Mr. Ludtke said. “That was a first.”

When upgrading the cockpit with a digital display, he said, his team wanted to redesign the layout of information to give pilots more data that were easier to read. But that might have required new pilot training.

So instead, they simply recreated the decades-old gauges on the screen. “We just went from an analog presentation to a digital presentation,” Mr. Ludtke said. “There was so much opportunity to make big jumps, but the training differences held us back.”

“This program was a much more intense pressure cooker than I’ve ever been in,” he added. “The company was trying to avoid costs and trying to contain the level of change. They wanted the minimum change to simplify the training differences, minimum change to reduce costs, and to get it done quickly.”

Boeing said in a statement that the 2011 decision to build the Max had beaten out other options, including developing a new airplane.

“The decision had to offer the best value to customers, including operating economics as well as timing, which was clearly a strong factor,” the company said. “Safety is our highest priority as we design, build and support our airplanes.”

A Cascade of Changes

Months before Boeing’s announcement of the Max, the commercial airplanes executive, Mr. Albaugh, critiqued the decision by Airbus to refit the A320 with bigger engines, which could alter the aerodynamics and require big changes to the plane.

“It’s going to be a design change that will ripple through the airplane,” Mr. Albaugh said in the meeting with employees.

“I think they’ll find it more challenging than they think it will be,” he told them. “When they get done, they’ll have an airplane that might be as good as the Next Generation 737,” a plane that Boeing had launched in 1997.

But a main selling point of the new A320 was its fuel-efficient engines. To match Airbus, Boeing needed to mount the Max with its own larger and powerful new engines.

Just as Mr. Albaugh had predicted for Airbus, the decision created a cascade of changes. The bigger engines altered the aerodynamics of the plane, making it more likely to pitch up in some circumstances.

To offset that possibility, Boeing added the new software in the Max, known as MCAS, which would automatically push the nose down if it sensed the plane pointing up at a dangerous angle. The goal was to avoid a stall. Because the system was supposed to work in the background, Boeing believed it didn’t need to brief pilots on it, and regulators agreed. Pilots weren’t required to train in simulators.

The push for automation was a philosophical shift for Boeing, which for decades wanted to keep pilots in control of the planes as much as possible. Airbus, by comparison, tended to embrace technology, putting computers in control. Pilots who preferred the American manufacturer even had a saying: “If it’s not Boeing, I’m not going.”

The new software system is now a focus of investigators who are trying to determine what went wrong in the Ethiopian Airlines crash and the Lion Air tragedy in Indonesia. A leading theory in the Lion Air crash is that the system was receiving bad data from a faulty sensor, triggering an unrecoverable nose dive. All 737 Max jets around the world are grounded, and Boeing has given no estimate of when they might return to flight.

In Renton, Wash., where the 737 Max is produced in a 1.1-million-square-foot plant, the mere possibility that Boeing engineering contributed to the crashes has cast a pall over the factory. After the Lion Air crash, Boeing offered trauma counseling to engineers who had worked on the plane.

“People in my group are devastated by this,” said Mr. Renzelmann, the former Boeing technical engineer. “It’s a heavy burden.”

In a statement, Boeing’s chief executive, Dennis A. Muilenburg, said he had spent time in Renton recently and “saw firsthand the pride our people feel in their work and the pain we’re all experiencing in light of these tragedies.”

Boeing is working on an update to MCAS software. The company was meeting with carriers over the weekend to discuss the update, which is expected to roll out by April. It also intends to make a previously optional safety indicator in its cockpit standard in new Max jets.

The business is increasingly under pressure as airlines reconsider their orders and ask for compensation. But work in Renton is continuing apace.

Boeing now makes a record 52 Maxes a month, and aims to reach 57 by April. As fuselages and plane skeletons continued to chug into the factory by train this past week, crews worked around the clock to make thousands more.

A version of this article appears in print on March 24, 2019, on Page A1 of the New York edition with the headline: A Jet Born of a Frantic Race to Outdo a Rival.

[MemberBerry]

@RUTUS, Since there are no other electrical connections in that diagram, the logical conclusion is that indeed on the NG any kind of automatic trim changes can be disabled by the AP cutout switch, and also by the column cutout switch connected in series with it.

I can't find a similar diagram for the MAX, but I remember reading that the cutout system has been redesigned. For example the two cutout switches have been renamed, from MAIN ELECT and AUTO PILOT, to PRI and B/U (primary and backup).

And, if I remember correctly, those two switches don't longer have independent functionality on the MAX, because they are connected together in series. If one of them gets stuck or fails shorted, the other can act a backup for it, so on the MAX both manual cutout switches would disable any kind of electric trim, manual or automatic.

I don't have further details about that, and I wouldn't want to speculate about exactly how it works on the MAX in combination with the column cutout switches, but this has been discussed previously in the Lion Air thread, you may try to look there for more details.

[BobM2]

Originally Posted by FlexibleResponse

The replacement of the identified "faulty AOA" sensor with another AOA sensor immediately before the Lion Air crash did not prevent the same "faulty AOA" sensor signal from reoccurring.

And why was the AOA faulty signal accompanied by similtaneous altitude, airspeed disagree indications along with PCU fault?

There has been no mention of an AOA failure prior to its replacement on the evening prior to the crash. It was apparently replaced as trouble-shooting in response to repeated write-ups of Capt unreliable airspeed & altitude. This did not correct the unreliable airspeed & altitude, but rather introduced an additional failure on the last two flights.

[Loose rivets]

RUTUS. I fear that so much is being ripped out of this thread that the loss of continuity makes some posts meaningless.

I posted mentioning a previous link that stated that the rear (hidden) switch in each column had been removed from the MAX. If true, and it seems to be, it is a major change, inasmuch as a quick tug against a nose-down trim would not have remotely the same effect.

The changes to the two emergency cut out switches, mentioned again above, are extraordinarily misleading - if not covered in MAX conversion training.

[deltafox44]

Originally Posted by Smythe

What is unclear to me is why it is necessary for the AoA sensor to be a vane outside of the ac. It is assumed that airflow is horizontal, and the fuselage/wing combination is at an angle to horizontal. Why is the AoA sensor not internal like the IRU gyro?

Airflow is horizontal only in level flight ! not in climb or descent