Ethiopian airliner down in Africa

[rodlittle]

a report in Pilot magazine by Bob Grimstead, cant comment on its accuracy but hes a reputable man

[Chronus]

It remains an inescapable fact, meaning as in the sense of a reality, that the introduction of a software based modification became a necessary in order to get this plane certified. That must have been considered as the most optimal solution to achieve the commercial aims of introducing a plane that could be competitive to others on the market, namely the Airbus offerings. The B737 had to be kept alive to do that. But how could it be possible to keep a plane designed half a century ago may still be fit for today`s world of aviation. The Douglas DC10 was also an all time winner, but can you imagine kitting it out with the latest high ratio by pass turbo fans of today, installing some fancy computers and software in it and saying here is the answer to short haul commuter, so long as you can get your pax to don their oxy masks if we hit some bad wx. Not really all that much different to saying the B737 MAX is more than safe as is, but just to make sure no airline has sat a pair of morons up front, we have with our clever MCAS thingy tell the computer how to handle them. Now if that does not make sense as to why they put in this MCAS thingy majig, then why did they do it in the first place. That of course takes us back to where we started, which then means we got nowhere and that is the whole purpose of the whole exercise.

[slacktide]

Originally Posted by Chronus

The Douglas DC10 was also an all time winner, but can you imagine kitting it out with the latest high ratio by pass turbo fans of today, installing some fancy computers and software in it and saying here is the answer to short haul commuter,

So, a MD-11?

[robocoder]

Originally Posted by SystemsNerd

Thus, when asking "why didn't they just fly the plane?", one possible answer is undoubtedly some variant on "they were incompetent". But another possible answer is "they were put into a scenario in which any human being would consistently fail to solve the problem, regardless of competence". Probably the truth is somewhere between those two points.

​​​​​​Thank you so much for this This is why I cannot accept the analysis of those that pile with unwavering assertiveness on the pilots' performance. We have only a partial view of what they experienced. We simply cannot know what the average crew would do in their shoes, vs what some hypothetical post-hoc average response should be, as evident as it may seem. Even so, are they at fault for the training they received? That's why when someone can't come back to tell their version, I prefer unanswered questions to "sure" answers.

[wonkazoo]

Originally Posted by rodlittle

From something Ive just read MCAS was to compensate for the fact that due to the new engine nacelles the pitch stablity was so poor that it would tighten up in a turn at low airspeed and that it actually required a push on the control column to defeat this which is quite unaceptable in an airliner, not so much in a Pitts.
Obviously this could not have been corrected by adjusting the elevator cct feel so it explains the why of why did they do it this way

This is a part of what I've been working on- where did you read that information??

Everyone has been focusing on the failure modes of MCAS and related components, but there has been little discussion about how stupidly huge the whacks that MCAS takes at a relatively minor (so we have been told) control feel issue. MCAS is, no two ways about it, a control system, one that exerts immense authority over the most important control surface on the airplane. Such a system, that sits unmonitored and unapologetically inserting itself when required, is unlikely to have been created in such a way without there being an equally significant issue that needed to be dealt with. Quickly and with huge control inputs.

THanks for sourcing that information-
dce

[wonkazoo]

Originally Posted by SystemsNerd

Thus, when asking "why didn't they just fly the plane?", one possible answer is undoubtedly some variant on "they were incompetent". But another possible answer is "they were put into a scenario in which any human being would consistently fail to solve the problem, regardless of competence". Probably the truth is somewhere between those two points.

*See Wikipedia article "Human factors and ergonomics"

Thank you for breaking this down into such understandable terms. When I posted a number of days ago my own experience (extremely experienced pilot with proper training, well-rested and otherwise not prone to panic or loss of functionality) I was sharing this exact point: Despite the firm assurances of many here there are circumstances you can be placed into wherein you will cease to function effectively. No machismo or mantra is going to change your basic incapacitation and the time it takes for you to return to a quasi-functional human being. From the outcome of the two MAX flights it is abundantly clear that the crews were partially incapacitated and overwhelmed. Given that 6 out of 6 pilots who were in this situation (The earliest incident went on for six minutes until the GIB piped up and suggested the cutout the trim. That flight was also on the brink of total loss...) a 100 percent incapacitation rate argues fairly forcefully (and empirically) against the hero-pilot who will just FTFA.

Warm Regards,
dce

[david340r]

grasp and hold

I have read the whole thread and I'm still a bit puzzled about the relative ability to trim electrically or manually. It's been asserted several times that the electric trim is more powerful than manual trimming, but we also have the checklist item "grasp and hold" if isolating electric trim doesn't control a runaway. This has been touched on earlier, but I can't envision a simple way that the manual trim wheels could win against the electric motor (stall it) whilst then not being able to actually trim over a wider range of conditions than the electric trim. Can anyone confirm there is some form of mechanism to achieve this and provide any information as to how it works?

I'm also wondering about the revisions to the stab trim motor unit over the years and what qualification tests are likely to have been required before revisions could enter into service. It appears the current motor is a brushless DC, but it seems extremely unlikely to me that it would have been this type of motor 50 years ago. It seems more likely to me that it would have originally been an a.c. motor running directly off the 3-phase supply. These can fairly easily be made multi-speed under relay control avoiding any control electronics and there are various design parameters that can be adjusted to control the speed/torque relationship, but perhaps it was some other type of motor. I wonder how accurately a modern brushless DC motor would reproduce the original characteristics, whatever type of motor it was, and whether this would have been flight tested over the full flight envelope before being signed off i.e. is it possible that not only the manual trim has changed in its authority due to reduced wheel size, but also the electrical trim capabilities may have changed in some subtle ways.

[yanrair]

[QUOTE=wheelsright;10461419]The direction of this thread is difficult to understand. There seems to be a surprising focus on the cut-out switches but no rational explanation for the changes in the MAX series. If there are no circumstances that only one cut-out should be operated there, is clearly no point in having two cut-out switches. If two contacts are needed to be operated it could be mechanically interlocked into one lever. The current information suggest the two switches are a product of muddled thinking... hardly a confidence builder.

Purely speculating, the reason that MCAS is not automatically disabled in the event of conflicting sensor inputs may be because MCAS needed to be permanently active to comply with 14CFR §25.203(a) "Stall characteristics". However, it is difficult to believe that the designers could have considered it a better option to leave it to the pilots to disable MCAS rather than by the automatic system that would be immediately aware of AoA sensor malfunction. It seems to be possible that focus was on conforming to wording of regulations rather than designing an adequate system.

A critical system that is intended to work in all circumstance must be designed in a way that reduces risks of malfunction to an acceptable level. Reliance on a single sensor or system does not appear to satisfy this obvious requirement. In the event that a critical sensor is no longer reliable, the system must automatically fall back to an alternate. That could be an alternate duplicate system or the manual control of the pilot or a combination or several nested fall-back options. The evidence so far is quite clear that Boeing failed to properly consider these options and required pilot intervention on scant information. In my view, it was negligent design and I suspect that I am not alone.

Many of the comments on this thread focus on the failure of the pilots to resolve the situation. There is good evidence that if the captain had handed control to the right hand seat or used the cut-outs earlier that they would have been successful. However, it does not excuse the fundamental design defects. In actual fact, Boeing could have easily prevented any uncertainty created by unreliable AoA through additional training automation and notification. There is no excuse for the design defects.

Further, much has been made of additional pilot training or improved memory items, QRH etc. Unfortunately, it is trying to close the stable door after the horse has bolted. The existing MCAS system will never be used again and any training or manuals will be based on a substantially different systems. Really all the focus at this stage must be on correcting the design defects... any manuals and training will fall from the new systems and will hopefully learn from the inadequacy of the previous systems and training.

I look forward to learning exactly how the MCAS electric trim system worked and how the situation will be resolved. One of the issues that I would like to further understand is why the pilots only appeared to make shortly electric trim corrections when it seemed likely that they would be trying to make large corrections. The FDR trace combines MCAS and electric trim... it is therefore uncertain what the thumb switch position was in.

Would permanently holding the thumb switch for nose-up, override AND from MCAS? Does MCAS cyclically override the thumb switch input in the 10s 5s cycle that requires further release and activation of the thumb switch. ie is the Boeing Ops Manual Bulletin TBC-19 entirely accurate... namely:

In the event of erroneous AOA data, the pitch trim system can trim the stabilizer
nose down in increments lasting up to 10 seconds. The nose down stabilizer trim
movement can be stopped and reversed with the use of the electric stabilizer trim
switches but may restart 5 seconds after the electric stabilizer trim switches are
released.

If this is true then it would be possible (not desirable) to use electric trim to override MCAS without using the cutout switches. MCAS could be interrupted and corrected every time it kicked in. I suspect it is not entirely accurate... I wonder if anyone has an authoritative answer? None of this excuses MCAS remaining active with unreliable AoA information.[/Q

Good explanation of MCAS story up to date
737 MAX - MCAS

[gums]

Salute!
@ david....

The diagrams of the trim motor and manual cable connection is over on the Lion crash thread.

Pretty clear that the cable will work no matter what unless it braks or tyhe motor/gear doofer freezes;

I'll let you do the research on thatother thread.

Gums suggests,,,,

[MurphyWasRight]

Originally Posted by david340r

I have read the whole thread and I'm still a bit puzzled about the relative ability to trim electrically or manually. It's been asserted several times that the electric trim is more powerful than manual trimming, but we also have the checklist item "grasp and hold" if isolating electric trim doesn't control a runaway. This has been touched on earlier, but I can't envision a simple way that the manual trim wheels could win against the electric motor (stall it) whilst then not being able to actually trim over a wider range of conditions than the electric trim. Can anyone confirm there is some form of mechanism to achieve this and provide any information as to how it works?

My understanding is that the 'grasp and hold' would be for the case of failed brakes on the stab mechanism, it is a recirculating ball drive so can be back driven by aero loads
Manual wheel inputs actuates a clutch that disconnects the motor so you would not be driving or trying to stall it. (motor may be unclutched when not active as well).
Not sure of mechanics of that but easy enough to conceive of a 'tension in cable' mechanism that would actuate the disengage.

Whether my details are exactly correct does not matter much since the point is that one is not directly fighting the motor, just trying to move the stab.

[Sublogic]

The cutout switch design change is important.

So, why do the two cutout switches in the MAX work differently than before? The NG had one for disabling AP trim plus (?) SpeedTrim and one to cut all electric trim, meaning the thumb switches’ input too.
Max has both switches cutting all.
Why:

(1) Was there a perceived danger that one needs to make double sure to cut MCAS out otherwise it would fly the ac in the ground? Which it did anyway but for other reasons. But that switch choice shows that someone saw the danger.

(2) Troubleshooting what goes wrong with the stabilizer trim takes too long. Better cut out everything right away but keep the appearance of two switches to ensure continuity. That choice must then have been based on somebodies analyses that nobody uses the sequential cutout approach. Meaning AP and SpeedTrim never failed. That must have been documented.

(3) Disabling MCAS input together with the AP could not have been allowed due to certification issues. Having a switch for AP & SpeedTrim and one for thumb switches & MCAS was considered as too complicated, so two switches cutting out all seemed the best choice while keeping the layout.

It seem to me that whoever made that design choice was aware that MCAS could be dangerous and he/she tried a last minute fix.

[L39 Guy]

Originally Posted by Chronus

It remains an inescapable fact, meaning as in the sense of a reality, that the introduction of a software based modification became a necessary in order to get this plane certified. That must have been considered as the most optimal solution to achieve the commercial aims of introducing a plane that could be competitive to others on the market, namely the Airbus offerings. The B737 had to be kept alive to do that. But how could it be possible to keep a plane designed half a century ago may still be fit for today`s world of aviation. The Douglas DC10 was also an all time winner, but can you imagine kitting it out with the latest high ratio by pass turbo fans of today, installing some fancy computers and software in it and saying here is the answer to short haul commuter, so long as you can get your pax to don their oxy masks if we hit some bad wx. Not really all that much different to saying the B737 MAX is more than safe as is, but just to make sure no airline has sat a pair of morons up front, we have with our clever MCAS thingy tell the computer how to handle them. Now if that does not make sense as to why they put in this MCAS thingy majig, then why did they do it in the first place. That of course takes us back to where we started, which then means we got nowhere and that is the whole purpose of the whole exercise.

With the exception of the hull, the MAX is an entirely different aircraft than the original B737-100 or even the NG’s. Different wing, engines, avionics, APU, landing gear, etc. If they called it a B797 would that makes things better?

The same can be said of the B747. Today's 800 series ain’t the B747-100 of 1969. Same thing, new engines, wing, avionics, APU, etc. Is anyone trashing Boeing for that? And, for all we know, the B747-800 might have the odd bandaid too for some obscure issue just like the MAX.

[L39 Guy]

Originally Posted by SystemsNerd

With respect, I think there may be a breakdown in communication here that may be in large part responsible for the ongoing disagreement. When people say "human factors", they don't mean "the human element", they mean Human Factors*, i.e., the study of how the human mind and body interacts with designed systems.

The human mind does not, ironically, work in the ways most people think it does - it has well-documented limitations and sources of error plumbed into its design. A human factors expert can I believe pretty trivially design a scenario where most (if not all) humans will consistently fail to correctly solve even relatively trivial problems, regardless of their competence under normal conditions.

Thus, when asking "why didn't they just fly the plane?", one possible answer is undoubtedly some variant on "they were incompetent". But another possible answer is "they were put into a scenario in which any human being would consistently fail to solve the problem, regardless of competence". Probably the truth is somewhere between those two points.

*See Wikipedia article "Human factors and ergonomics"

That’s a fair point. My response and likely that of my “cohorts” is this: what was presented to the three crews upon lift-off was a classic Unreliable Airspeed (UAS) scenario which is a an emergency that any B737 type rated pilot ought to have seen in a simulator complete with all the bells, whistles and other distractions. The fidelity of simulators is really quite amazing.

So how is it that 1/3 crews did the drill and saved the aircraft (by controlling and flying the aircraft including a managing its speed thanks to doing the UAS drill) while the other 2 crews did not do the drill which ultimately lead to an uncontrollable aircraft as speed was so high that no human could manually trim the aircraft?

Once we have addressed that issue then the next one is how is it that the successful Lion Air crew needed a jumpseat pilot to point out that they had a runaway stab trim and the fatal Lion Air crew was thumbing through the checklist looking for a memory item when they lost control of the aircraft.

To me, this points to a serious training issue at both of these airlines.

[ottorot8]

Originally Posted by L39 Guy

With the exception of the hull, the MAX is an entirely different aircraft than the original B737-100 or even the NG’s. Different wing, engines, avionics, APU, landing gear, etc. If they called it a B797 would that makes things better?

The same can be said of the B747. Today's 800 series ain’t the B747-100 of 1969. Same thing, new engines, wing, avionics, APU, etc. Is anyone trashing Boeing for that? And, for all we know, the B747-800 might have the odd bandaid too for some obscure issue just like the MAX.

Sorry, but your wrong. I’ve been flying 737’s for the last 28+ years. That covers the 200, 300, 500, 700, 800 and I have about a dozen flights in the Max8. You could take about 70-80% of just the -200 cockpit and use it for spare parts on a Max8. Same switches, gauges, lights, etc. The list goes on.

[568]

Originally Posted by L39 Guy

With the exception of the hull, the MAX is an entirely different aircraft than the original B737-100 or even the NG’s. Different wing, engines, avionics, APU, landing gear, etc. If they called it a B797 would that makes things better?

The same can be said of the B747. Today's 800 series ain’t the B747-100 of 1969. Same thing, new engines, wing, avionics, APU, etc. Is anyone trashing Boeing for that? And, for all we know, the B747-800 might have the odd bandaid too for some obscure issue just like the MAX.

Not the same as the 747-400 that's for sure. Boeing will have to address this, perhaps! (Flown both BTW).

[EDLB]

Originally Posted by L39 Guy

To me, this points to a serious training issue at both of these airlines.

If we talk about human factors we should start at the Boeing management decision making. They had years to think about that safety case, and figured, that the two chaps in row zero would always solve this problem in seconds.
May be we need for the MAX a third mandatory jumpseat pilot which only looks for weirded trim movement to get the MAX into the air again...

[Dave Therhino]

Originally Posted by yanrair

ie is the Boeing Ops Manual Bulletin TBC-19 entirely accurate... namely:

In the event of erroneous AOA data, the pitch trim system can trim the stabilizer
nose down in increments lasting up to 10 seconds. The nose down stabilizer trim
movement can be stopped and reversed with the use of the electric stabilizer trim
switches but may restart 5 seconds after the electric stabilizer trim switches are
released.

If this is true then it would be possible (not desirable) to use electric trim to override MCAS without using the cutout switches. MCAS could be interrupted and corrected every time it kicked in. I suspect it is not entirely accurate... I wonder if anyone has an authoritative answer?

MCAS can be interrupted with the electric trim switches on the yoke each time it activates, and trim can be returned to a low/zero column force state each time if the pilot puts in adequate opposite trim inputs. That is what the Lion Air crew did for approximately 2 dozen cycles of MCAS before the final few cycles, where the pilot flying at that point failed to put in an adequate amount of opposite trim in those final cycles, allowing the out of trim condition to increase to the point where they couldn't recover in the altitude available.

[L39 Guy]

Air

Originally Posted by EDLB

If we talk about human factors we should start at the Boeing management decision making. They had years to think about that safety case, and figured, that the two chaps in row zero would always solve this problem in seconds.
May be we need for the MAX a third mandatory jumpseat pilot which only looks for weirded trim movement to get the MAX into the air again...

This “problem” didn’t have to be solved in seconds. It’s not as if the aircraft is on fire. As pointed out earlier, the ET aircraft flew for almost two minutes with UAS before the flaps were selected up and MCAS kicked in. That was two minutes to do the UAS drill. Same thing for the fatal Lion Air aircraft. You could have given them all day and I don’t think it would have got ‘er done.

As I and others of my “cohort” have stated, Boeing’s mistake was to assume that B737 type rated pilots were trained to handle a basic emergencies like UAS and Stab Trim Runaway. If either of the fatal flights had done at least UAS the aircraft would have been controllable and bought them time to figure out the stab trim issue and, once they determined that, be able to manually trim the aircraft. This is what happened in the successful Lion Air case. In fact, they completed the flight (1 1/2 hours) with UAS and MCAS disabled.

Instead, neither of the accident aircraft crews did that drill, they failed to control the aircraft as it was going way too fast for manual trim. I don’t think it’s too much to ask of professional pilots to know and do memory drills and also to fly the damn aircraft at a speed where one can manually trim and not at the barber pole.

And, to be clear fault for this lies squarely on the airlines that employ and train them, the national CAA’s that regulate them and, to a lesser extent, the aircraft manufacturers that sell them aircraft with their brand on the side of the aircraft. And, yes, MCAS needs to be toned down too.

[derjodel]

Originally Posted by Dave Therhino

MCAS can be interrupted with the electric trim switches on the yoke each time it activates, and trim can be returned to a low/zero column force state each time if the pilot puts in adequate opposite trim inputs. That is what the Lion Air crew did for approximately 2 dozen cycles of MCAS before the final few cycles, where the pilot flying at that point failed to put in an adequate amount of opposite trim in those final cycles, allowing the out of trim condition to increase to the point where they couldn't recover in the altitude available.

An undocumented system of which the pilots have no clue it even exists can interrupt airplane trim. If the pilot doesn't want to end in a coffin corner, they need to figure out on the spot that:
- this is not STS
- because it's not STS it must be either a bug or an undocumented system
- to save their lives they need to return the trim manually to a low/zero column force each time the undocumented command is triggered.

Despite facing those conditions, the Lion Air crew managed to react appropriately about 2 dozen cycles. Fighting the unknown system raised pilot's adrenaline and fear and induced panic. Thus, incapacitated by stress put on them, they no longer managed to manually correct the erroneous system input that was trying to - and succeeded to - kill them.

[L39 Guy]

Originally Posted by derjodel

An undocumented system of which the pilots have no clue it even exists can interrupt airplane trim. If the pilot doesn't want to end in a coffin corner, they need to figure out on the spot that:
- this is not STS
- because it's not STS it must be either a bug or an undocumented system
- to save their lives they need to return the trim manually to a low/zero column force each time the undocumented command is triggered.

Despite facing those conditions, the Lion Air crew managed to react appropriately about 2 dozen cycles. Fighting the unknown system raised pilot's adrenaline and fear and induced panic. Thus, incapacitated by stress put on them, they no longer managed to manually correct the erroneous system input that was trying to - and succeeded to - kill them.

A stab trim runaway affecting the fly ability of the aircraft is no time to “figure out “ anything. The figuring out happens back on terra firma. Whether the source of the runaway is a short circuit in a switch or motor, MCAS or anything other source, when the aircraft experiences uncommanded flight control movements in pitch it’s a stab trim runaway for which there is a clear and simple memory drill. The instinctive thing would to pull or push to restore the desired path then trim for it with the electric trim switches, even if it means long burst of trim. Whatever it takes. If the trim continues to be uncontrollable, turn it off and manually trim with the wheel, however one has to be flying at something less than Vmo to do that which means controlling the thrust or, in other words, flying the airplane.