Ethiopian airliner down in Africa

[VicMel]

Originally Posted by MurphyWasRight

One excellent use of the 'smart sensors' would be in combination with existing vane style.
This would greatly reduce chances of a common design/environmental fault affecting AoA values.

And it is not just AoA vanes that are a Common Mode Failure by design, the 3 (or 4) pitot tubes for measuring TAS are all same technology, all located near to one another. The purpose of AOA sensors is to detect an imminent stall; a more direct measure (possibly a second source for a plausibility check) would be a pressure sensor built in to the upper and lower wing surface. It need not use holes, if something as mundane as a mobile phone can distinguish between a tap and a swipe, there must be other new technologies out there that could be used.

[MemberBerry]

Originally Posted by Lost in Saigon

Is that the video that "Mentour Pilot" deleted?

I am not worried about the video because:

1) They purposely trimmed THE WRONG WAY just to see what happens.

They trimmed the wrong way not "to see what happens", but to replicate MCAS trimming the wrong way, because electric trim can't trim nose down so much with the flaps up, as MCAS can.

At the end they tried to trim THE CORRECT WAY, but even with the trim at just 2.4 units from full nose down it was almost impossible for one person.

2) It is a simulator and may not accurately reflect actual aircraft operation in the same situation.

I don't understand why you are not worried. Is it because you believe it will be much easier on a real aircraft in the same situation? If that's the reason, what is the basis for your belief?

[bsieker]

Originally Posted by Just This Once...

Did you just make that all up?

Maybe your idea of widespread is different to mine as just one manufacturer of this style of probe has quite a broad customer base - including Boeing, LM, Airbus, Northrop Grumman, BAES, Bombardier, Embraer, Sikorsky, Dassault, Gulfstream et al.


Your claim on sensitivity to environmental conditions looks odd for a probe type used on everything from battlefield helicopters and tactical airlifters all the way through to supersonic fighter aircraft and supersonic bombers. Airbus have been using them for nearly 20 years across a number of types!

Have you ever looked at the nose of an A350? It clearly has a lot of mechanical vanes, three alone for sideslip angle, and some combined probes (pitot plus mechanical vane). Same for the A380. So no, Airbus is not relying on fancy smart probes, although they may use them alongside traditional vanes.

And you are aware that the picture is from a sales brochure by the manufacturer. Maybe Airbus evaluated such probes, which would be enough for them to claim the type on their list. You may also notice that the picture uses the weasel word "... programs", which could mean anything. A "program" can also just be a theoretical evaluation, with a final decision against it.

There are also mechanical vanes on the A400M, the 787, the CSeries, etc. Business jets, yes, but other than the E2 I haven't seen one airliner without them. Not exactly widespread. And that's all just because ... manufacturers cannot be bothered to use modern technology?

Bernd

[Lost in Saigon]

Originally Posted by MemberBerry

They trimmed the wrong way not "to see what happens", but to replicate MCAS trimming the wrong way, because electric trim can't trim nose down so much with the flaps up, as MCAS can.

At the end they tried to trim THE CORRECT WAY, but even with the trim at just 2.4 units from full nose down it was almost impossible for one person.



I don't understand why you are not worried. Is it because you believe it will be much easier on a real aircraft in the same situation? If that's the reason, what is the basis for your belief?

In the video they spent far too long fighting the control forces before attempting to operate the trim cutout switches. Maybe they were trying to represent the lowest common denominator in pilot skill? MCAS does not operate if the pilot toggles the trim switch so they should have been able to operate the trim cutout switches before the aerodynamic load became excessive. "Should Have" is important but we'll have to wait for the full report to find out why they didn't.

I have no idea whether or not it would be easier in a real aircraft. I just don't trust that a simulator can accurately reproduce what actually happens. It would be interesting to hear from someone who has actually experienced excessive airloading of the stabilizer trim in a B737.

[Jetthrust]

Originally Posted by VicMel

I absolutely agree. The aviation authorities have the hardest of evidence possible that “average” pilots are unlikely to cope. Boeing’s dilemma is this then means the MCAS system (at least) has to be considered as a “catastrophic” safety critical system. The MCAS software then has to be “Level A” according to DO-178C.

IMO no amount of software patching can turn a Level C software package into a Level A.

Has it been stated anywhere what design assurance level (DAL) the new MCAS software will be?

I have read there are several changes:

• Compare L & R AOA (and inhibit if they disagree, and display raw AOA values)
• Only allow 1 trim application
• Limit MCAS input to less than control column authority

But nowhere have I seen what the DAL is going to be. Since the hazard assessment seems to be where the errors started, allowing one sensor, what's the new hazard assessment?

[slacktide]

Originally Posted by VicMel

And it is not just AoA vanes that are a Common Mode Failure by design, the 3 (or 4) pitot tubes for measuring TAS are all same technology, all located near to one another. The purpose of AOA sensors is to detect an imminent stall; a more direct measure (possibly a second source for a plausibility check) would be a pressure sensor built in to the upper and lower wing surface. It need not use holes, if something as mundane as a mobile phone can distinguish between a tap and a swipe, there must be other new technologies out there that could be used.

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

[spornrad]

hope it was the old version:

[Lost in Saigon]

Originally Posted by slacktide

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

Crafty FOs could carry one of these to test the kazoo......

[capngrog]

Originally Posted by slacktide

How about this - you could drill a hole in the leading edge of the wing, slightly below the stagnation point. Using some flexible tubing, you could connect this hole to a kazoo or harmonica mounted in the cockpit. At a high angle of attack, the stagnation point will move below the hole, and a vacuum will exist at the hole, drawing air through the tube and sounding the kazoo.

You could even test it during pre-flight by applying oral suction. One would presume that this would be an FO task.

What you have described is the old Safe Flight stall warning system which used a moveable vane at the stagnation point instead of an orifice. This stall warning system has been around light aircraft since about 1946 or so.

Cheers,
Grog

[Lost in Saigon]

Originally Posted by capngrog

What you have described is the old Safe Flight stall warning system which used a moveable vane at the stagnation point instead of an orifice. This stall warning system has been around light aircraft since about 1946 or so.

Cheers,
Grog

No, the system he is describing does not use a vane.

[Water pilot]

Coding these days rarely has errors as there are many tools that can be used to verify the code it will also validate correctly as the code does just want the designer erroneously asked it to do.

You just made me spit out my coffee! I think we must work in vastly different parts of the industry.

As a side and possibly interesting technical note, it is not possible to prove even that a given program will terminate given a specific input, that is one of the early theorems in computer theory, dating back to before computers actually existed. Sometime in college I had a course on proving programs correct; the text was a medium sized book that as I recall spent many chapters proving that a simple algorithm for floating point division was correct. Having already worked for a scientific company (and having found a bug in their floating point libraries) and being a better programmer than theoretician I did the obvious thing and implemented the pseudo code -- and promptly found that pseudo code which had been proven correct in several different ways actually produced the incorrect answer in many common cases! The frustrating part was that although I could easily see why the code was wrong, I was never really able to figure out why the proof that it was correct was wrong. My much smarter friend who was just as crazy as I independently did the same thing and she got the same conclusion. She actually worked for Boeing back in the day.

[Realbabilu]

Originally Posted by patplan

An edited GIF version of Mentour Pilot Video...
..

Or, you can watch most of it here...
- https://vimeo.com/329558134
https://fpdl.vimeocdn.com/vimeo-prod...e382f0eef47c84

Maybe the sim not as realistic as the real one.
I cant hear the sim stick shaker for far more dramatize the upset condition

[Loose rivets]

As someone who's flown a simulator with little wooden houses going by on a huge conveyor belt, I suppose I'm predisposed to doubt the purity of even the latest simulation, despite electronics being one of the strings to my bow.

The box they're in obviously doesn't have a long cable run, and if there is any use made of steel cable, it must be loaded by a simulation device. Okay, doable, but here's the rub. If Boeing produce an aircraft that can allow a vital control surface to be impossible to move, how the Dickens can a simulator manufacturer program a valid reality from such incomplete information?

[L39 Guy]

Checklists

Originally Posted by GordonR_Cape

Alchad



Many people (still) blame the pilots for getting into that situation, by not taking action sooner. All sorts of clever answers are possible, for those sitting at home, and having had time to read the accident report.

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

[Hi_Tech]

Originally Posted by CP Bern von Hoesslin

Ref.: 737-7/8/9 Training Manual 22-11-00, Dated 19.Sep.2016 Pages 165, 166 and 167

Ref.: THE MOST IMPORTANT QUESTION ON THE LION AIR AND ETHIOPIAN 38M AIRCRAFT CRASH INVESTIGATION maybe!

A simple version here.

Will the PRI Toggle when moved to CUT OUT, IS IT 100% GUARANTEE to remove -all- electrical signals to the Stab Trim Motor?

Why do I ask? "The FCC supplies MCAS signal to enter high speed mode on the stab trim motor and bypass the aft column cutout switches for trim down commands.". As we know also in error.

THUS if the B/U is in CUT OUT, then MCAS still has authority but what about PRI in CUT OUT?"

The trim commands from the FCC is processed in the "autopilot section of the motor". That means besides the FCC A in these cases, there is another controlling Software either part of the MCAS programing (thus active when a Fault like is being considered part a chain of errors in these two accidents) or a separate sub routine / program influencing the Stabilizer Motor into moving the Stabilizer that has never been mentioned before.

I'm thinking like a chicken with its head cut off, the nerves can still allow it to run around.

So the PRI in CUT OUT, does it still allow impulses from the "auto pilot section of the motor" however created, to move the stabilizer via 28VDC thru the motor un-commanded when the operating crew thinks they've isolated that electric trimming (CUT OUT), thus do not expect further electric trimming (non-pilot induced)?

To keep it simple - PRI and B/U toggles in CUT OUT there is no possible way the stabilizer movement (NU or ND) can be activated unless done manually by the crew using the Trim WHEELS OR a failure of the stabilizer mechanics i.e. excessive speeds beyond VMO, thus possibly breaking or stressing / stretching the components moving the stabilizer itself i.e. for example into the full AND position which is then fatal as non-recoverable?

Any Source I can contact, kindly PM? I do not have access to Boeing Customer Service any more.

Thanks in advance for all PPRUNER's efforts here.

CP Bernd von Hoesslin

===============================

You can’t use the Private Messaging system, add url links or images until you have an established posting history

I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

[Escape Velocity]

Originally Posted by L39 Guy

I will preface my response by saying that there is lots of blame to go around and when I criticize the pilots understand that this is also a criticism of their airline employer as well as their national CAA.

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation (stick shaker, disparity between the various airspeed indicators). This is a recall (memory) checklist - set an attitude/power setting (10 degrees/85% with flaps, 4 degrees/70% clean - don't quote me on those numbers as I am not MAX qualified), autopilot and auto throttles off, etc. This is a simple emergency procedure.

Neither the Ethiopian nor Lion Air accident aircraft pilots did this checklist. In fact, the Ethiopian Captain asked for the autopilot on, contrary to the checklist. Getting the power back from take-off to 85% or less would have most helpful in controlling the speed and hence the trim forces when manual trim was required later. I think it is fair to ask why four B737 MAX rated pilots did not do a simple, memory checklist and remember, this is along before the flaps went to zero and MCAS kicked in.

When the flaps were selected up and the aircraft was in manual flight the MCAS did its thing, namely provided an uncommanded nose down trim. Anybody hand flying the jet surely could not miss this as the trim was uncommanded, downward and produced a lot of nose down trim; manual electric trim was available including continuous nose up trim to both stop MCAS and return the aircraft to a neutral trim - this is basic flying skills. Nevertheless, neither crew did not do the Stab Trim Runaway procedure which, again, is a simple, memory checklist...manhandle the aircraft and shut off the stab trim cut-off switches. Once again, how is it that the four pilots in these two aircraft did not do a simple recall checklist? Worse, on the Lion Air flight on the same aircraft previously, the operating crew did not know to turn off the stab trim and it took a jump seat pilot from another airline to point this out.

Pilot error is too often the go to explanation for an accident and I don't like it one bit however why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

[EDLB]

Originally Posted by Hi_Tech

I have this sent by someone. Not sure 100% if it is authentic. Looks authentic to me as MCAS is mentioned. The two switches (Left lower corner) (STAB and B/U not mentioned here) are in series for cutting out the Stab Trim Control power. So either switch will cut the control power to the Motor. One switch (A) cuts out the Autopilot enable signal and other (B) cuts the signal from FCC disabling the manual electric, STS and MCAS. That is my inference. You can come to your own conclusion if you can read the circuit d iagram.
Hope this helps.

Thanks for the diagram. The two cutout switches are in series so they are the STAB and B/U.
The cut out funktion works over the R64 main relay. At the same time the FCC knows that it is cut out. What worries me more is, that the MCAS signal seem to be able to switch the Stab motor into fast mode as when the flaps where down via K5. My assumption is, that since the increase to 2.5 degrees MCAS stab was necessary, MCAS can move the stab faster than the pilots can in a flap up condition.

[HundredPercentPlease]

Originally Posted by L39 Guy

In all three MCAS incidents, immediately upon lift-off the aircraft was into an Unreliable Airspeed situation

I disagree. Immediately (at the end of the rotation) the aircraft was indicating a stall, and so the crew performed a stall recovery (lowered AoA by reducing pitch and increasing speed).

Originally Posted by L39 Guy

why did these pilots, all MAX endorsed, not do two simple, memory checklists particularly the Ethiopian crew that should have been acutely aware of this issue following the Lion Air accident.

It was three memory checklists:

1. Stall recovery.
2. UAS recovery.
3. Runaway stab (during the UAS recovery and aurally masked by the stick shaker).

The evidence is that 3 is too many - unless possibly you have a third pilot to monitor and assist.

I have a feeling that the Ethiopian captain may have engaged the autopilot as a pre-considered homebrew anti-MCAS strategy. Autopilot in = no MCAS risk.

[alf5071h]

‘Blame’ is used as a self-satisfying closure for complex, often indeterminate situations (‘wicked problems’).
Assuming that something was understood as an opening analysis risks hindsight bias, or that everyone will have similar understandings, similar thought processes.
UAS could equally be stick-shaker implying stall, or a range of alternative perceptions according to context. Bounding problems with assumption might aid our after-the-fact understanding, but whatever we conclude is only probability, because we can never know what these crews perceived, what was thought, or understood, or any reasoning for action.

Start with a view that the crew acted as they saw the situation (not our view), that humans are an asset to be used and not a hazard to be constrained; this and the above might provide an alternative analysis. Not fact only probable, but an understanding which might better be used to learn from.

As background see:-

https://www.nifc.gov/PUBLICATIONS/ac...an%20Error.pdf

https://www.ida.liu.se/~729A71/Liter...berti_2001.pdf

https://www.eurocontrol.int/sites/de...ndsight-25.pdf Page 10 -

https://www.demos.co.uk/files/systemfailure2.pdf

“Problems worthy of attack prove their worth by hitting back.
Man's a kind of Missing Link, fondly thinking he can think.”

“Modern man has the skill; he can do what he will.
But alas - being man he will do what he can.”

“You'll conquer the present suspiciously fast if you smell of the future -- and stink of the past.”

Grooks of Piet Hein

[Lost in Saigon]

Originally Posted by Escape Velocity

This.

But not exactly. The 737NG (I'll bet the Max is the same) QRH Unreliable Airspeed checklist, after the memory items, goes on for 4 pages of fault isolation. To accomplish one thing - configure the aircraft to continue and for a safe landing. The UA checklist is a one-size fits all, meant for any phase of flight, but a read between the lines is that the checklist mostly is meant for cruise flight. One thing the UA checklist does not say is - ignore all the warnings and flashing lights, retract the flaps and press on. Both accident crews did precisely that after not accomplishing even the memory items of the UA checklist, and after flap retraction caused the trim problems associated with the MCAS/AOA fault. Both airplanes had normal trim during the initial climbout so neither crew was facing a trim runaway. Had they promptly recognized the initial problem as unreliable airspeed, done the memory items and checklist then chances are they may have never retracted the flaps, stayed at pattern altitude and returned to base.

Here is the B737 MAX Unreliable Airspeed Checklist. Compared to the NG, the memory items are identical, and the rest has only a few differences.