The design seems to fail "on" by which I mean to say a bad sensor is able to trigger the software to continue to say "Nosedown" to MCAS. This seems to be opposite to conventional wisdom where a device is designed to fail "safe" or in other words say to MCAS "do nothing". That's my understanding at this point.

Pretty simple to program if AoA = disagree then MCAS = off. That may be simplistic but may well be something like what Boeing is considering? Whether this or something else they come up with meets certification requirements is yet to be seen.

Exclusive: Boeing eyes Lion Air crash software upgrade in 6-8 weeks
https://www.reuters.com/article/us-i...-idUSKCN1NZ00S

Fair enough. But if they actually did failure analysis and quantified failure rates properly, like they are supposed to, it would have been glaring obvious the "unintended activation" has a high occurrence rate, and a single point failure at that.

What would be interesting to know is how a Brazilian Max operator, GOL, implemented the type B training and checking for the MCAS system and what their pilots were told about the system.

Even assuming you did that - and I am sure they did do the corresponding analysis, we can argue about "properly" - you'd still be left with determining the hazard classification.

I rather believe that faced with a similar failure scenario - low speed limited authority "uncommanded motion" of the stab (it's commanded, but not in the circumstances truly intended) - with the pre-existing ability to disable the system and a pre-existing procedure which would address the runaway case (if somehow it repeated) then that would probably be classified as no more than a MAJOR hazard. In other words, I strongly suspect (and this may be an unpopular view) that the system as has been presented in public information is perfectly certifiable, and I suspect analogies could be found on other aircraft.

Agreed, except "pre-existing procedure" implies there are defined criteria for DETECTING failure condition, which does not exist before the FAA AD came out. Even with the FAA AD, the flight crew identifiable symptom is a large laundry list, which is not ideal.

Similiar system on 737, STS has its own warning lamp to properly indicate failure to flight crew, per FAR25.672a clause

I have a copy of the QRH Runaway Stabilizer NNC (my bold):
From the FDR traces, the failure mode does not appear at face value to meet the NNC condition statement. The adverse trim will stop for 5 seconds after pilot manual electric trim. This is an intermittent uncommanded trim mode, not continuous (as per NNC condition statement). Was this taken into account with the failure mode analysis?

In the failure mode analysis, would this condition statement be true for the single point failure (AoA signal) to be classified only as a major hazard, given that it could also generate an intermittent trim movement under some conditions (flaps up), continuous stick shaker AND UAS simultaneously.

In other words, with the design of this MCAS system, a single point failure has created a very complex scenario. Did Boeing actually consider the combined interactions of each of these outcomes in totality or individually when classifying the hazard? I would view the resultant accident as an indication of failure of the failure mode analysis. Why was the analysis flawed, that is the big question.

While you are contemplating this, try putting up with what this crew had to endure while they were trying to figure out what was going on.

And I'm still wondering why only Brazil? That information had to come from Boeing. Why not world-wide disto?

Thanks for that summary. FCeng84 seems to have the inside dope on MCAS so I'll happily defer to his explanations. I would make a couple of points though:

And he probably has a new crop of pilots in training. :*

https://cimg5.ibsrv.net/gimg/pprune....918e24503f.jpg

What was wrong with the old system? :cool:

Mr Cheese.

It's just that one letter that makes the difference. It suggests ". . . limited to 2.5 degrees each and are . . ." might be an improved wording.

The old system required you to roll into a 45 degree bank in the simulator and raise the nose the degree or two to maintain level flight, increasing the load factor, and either holding pressure or trimming it off while getting your instrument crosscheck warmed up. The new aerodynamics of the Max, if replicated in whatever simulator might have them, might allow you to roll into 45 degree bank and as you pulled , you might not have to pull anymore or pull less because the engines aero effect started pulling for you. What's wrong with that I don't know. If you have a good crosscheck you fly the attitude and performance instruments and do what ever it requires with the stick. If there is any other flight envelope where the old system would be deficient for the MAX and you needed the MCAS we don't know and Boeing isn't telling us but previous threads have hinted that a normal flight would never see it. This is all supposition by me wondering why steep (or step) turns were mentioned in the one of the Boeing blurbs.

Because the elevator alone seems to be not powerful enough, no matter whether the pilot or an actuator pushes it. Obviously nose down trim is required to create enough nose down pitching moment. Which does not speak for the design, but is typical for the late 50s, when most elevators were so small that no hydraulic power was required to operate it.
If the 737 MAX would be a clean sheet design, the horizontal stabilizer and elevator would for sure look differently.

Trim has always been a killer item requiring close attention and it will always be, even if now a box of chips and a bunch of sensors pays the attention. Having new aircraft designs without a trim wheel is unbelieveable for me, but it becomes the standard. Trim becomes a computer assist item.

During each pre-flight, admittedly in a different airframe, each pilot would test the stick shaker and I would expect from that, they would be quite used to the feel on their column and sound, is it the same on the B737 MAX ?

MickG - careful now. This is not at all a matter of HAL saying "I'm afraid I can't allow that, Dave." What is happening here is that MCAS has inserted a nose down stabilizer motion increment in response to its understanding that the airplane is at high AOA. The pilot has then manually re-positioned the stabilizer. MCAS is in no way preventing the pilot from moving the stabilizer in either direction as much as the pilot wants. MCAS is further waiting five seconds to allow the pilot to make sure that the pitch trim situation is to the liking of the pilot. If the pilot is not satisfied with the pitch trim and makes another manual trim input, MCAS sits it out for another five seconds. Only after that does MCAS make a new assessment as to whether or not the conditions exist (flaps up, proper speed range, and high indicated AOA) to trigger MCAS to insert a limited increment of nose down stabilizer motion. The design assumption here is that when a pilot makes pitch trim inputs, those inputs will be in the direction to trim the airplane such that each time MCAS makes its assessment as to whether or not to add more nose down, it is starting from a relatively trimmed condition. The pilot maintains highest priority for stabilizer control throughout and MCAS only moves the stabilizer a limited increment each time that the pilot finishes trimming manually.

While it does not present itself as continuously running run-away automatic stabilizer motion, with the airplane flying at a relatively steady flight condition repeated instances of the system moving the airplane away from the trim condition that the pilot has established manually should be recognized as improper automatic stabilizer operation and disabled via the cutout switches.

Any of you who are interested in flight test and the required handling qualitiies of aircraft, particularly at the stall, will probably enjoy these podcasts and find them most informative. At 1hr 14mins into the second podcast he describes the 707 and in the third he talks about the 747 and later the T-tail aircraft. Much of what he has to say is relevant to this 737 accident.

https://www.pprune.org/tech-log/6029...ml#post9985073

Mr Cheese
First, there is that AND word, which an earlier poster suggested, ' . . . AND, and etc., etc.'

Again, wording is so critical. But your main point: while the extent of the trim via the mini-corrections IS variable, (i.e. Mach), for the most part the repeated blips are very similar on the graphs available to us. Although the Mach modification is very small, it does get me wondering what it was doing during the fatal dive.

Rounded estimate of the status of the identification process based on public information - and excluding empty seats:
About 50% of those in front rows have been identified.
About 25% of those in the back rows have been identified.
The cabin apparently had seatrows numbered 1-34 but probably excluded rows 13 and 14 (in spite of 1 passenger mentioned to be in 13).
Standout is seat column F which has the largest percentage missing.

From the data it is not possible to estimate where the 3+3 cabin crew were seated. A guess is that at least 1 in a front folding seat, and 2 at the back galley, with the 3 trainees in row 1 seats DEF.

It suggests a nose down impact and right hand roll (more than 90 degrees would not surprise me).

.
FCeng84, could this statement be also interpreted as fixing a non-linearity in control response at high AOA? Is that the type of improvement in handling characteristics being created?

The ratchet effect exists - and is very apparent from the post of the FDR permalink here to post

https://cimg1.ibsrv.net/gimg/pprune....6b67acda9b.jpg



Regardless of wordings in spec, the pitch trim position can be seen to 'ratchet' down in 3 full steps without correction back by the PF who just blips the trim. From the scale on the left of the image the stab trim reached max nose down.

Something I'd not noticed before on that FDR data - not sure it's been remarked on. At the VERY end of the trace, the stab is seen to apparently move a long way back towards to trim state. Given the compressed scale, it's not possible to see if that is a "final instant" artifact and not "real" or if there's an actual slope to the stab trace. If it's "real" it indicates that the stab remained under the potential for crew control throughout the flight to the very end, and that the ratcheting prior to that was not "uncorrectable".

The graph in the report shows a number of the parameters end in vertical lines like that.

To address your question I think it is important to be very clear with regard to your phrase "non-linearity in control response". The FAR in question speaks to the progression of column pull force required to command increased AOA. Well behaved stability characteristics would involve the need for the pilot to apply ever increasing column pull to command ever increasing AOA. Not having that desired characteristic could be a result of either the pitching moment vs. AOA (Cm-alpha) characteristic of the overall airplane or the pitching moment vs. column (Cm-column or similarly Cm-elevator) generated via deflection of the column. The net effect that the FARs speak to is how these two sources of pitching moment (AOA vs column) balance one against the other.

The issue that MCAS addresses is non-linearity of Cm-alpha stability derivative. The pitching moment generated by the elevator (and thus the column) is much more linear. As I have mentioned in previous posts, it is not a matter of the pilot having insufficient ability to generate pitching moment via the column. The issue is that as AOA increases into a range higher than normal operation (near and beyond the AOA for stick shaker activation), the amount of nose down pitching moment generated by additional increase in AOA is not sufficient to require the FAR mandated increase in column pull to balance.

CT with all due respect... I don't see anyone disputing that Boeing's MCAS system ran the nose down and crashed the jet killing 189 people, but it is noteworthy that two switches may have prevented this tragedy.

What remains to be seen is how ambiguity in the QRH, distraction, lack of training, a flying spanner, CRM, or perhaps even crew competency factor in as possible contributing causes.

"We study and discuss accidents so we don't become the subject of a thread on PPRuNe."

Or, come to that (with 20/20 hindsight), simply grabbing and holding the trim wheel.

N.B. No criticism of the crew intended.

I am with gums on this one, in terms of "if something moves the flight control surfaces, the pilots need to be aware that it exists and how it helps them, and thus some training/education is required." Also needed for safe operations is "what turns it on or off" if it moves the flight control surfaces.
That quoted "executive" needs a talking to from the pilot's union.
Anything that is built can break, anything with computer code or electricity involved can malfunction.

Question on the MEL: is one AoA sensor INOP a downing discrepancy? I'd assume so, but I've been surprised before.

Regardless of the fault or cause, one does wonder after all those trim corrections, or whatever fault that caused the trim to run counter to where they wanted it , at what stage would the crew have used those switches.

B-737-8/9 MMEL on FAA website (rev 1, Jan 2018) only mentions AOA heater as related MMEL option; AOA sensor itself does not appear on MMEL. (Based on a few search terms)

from this SLF- when ONE faulty sensor input allows " hal " to override manual control AFTER correction by the pilots without warning or deliberate reset, without notice, or mention, the " chain of command" which allowed/approved/designed such a process to be incorporated needs to be held responsible.

Well yes, but the majority of the thread is leaning towards the stabilizer not being disabled. Something is nagging away in the back of my mind. Stabilizer runaway memory actions are so fundamental that the thread's detective logic changed quickly to looking at the ~5 second delay adding to the confusion of an already chaotic flight-deck - causing a radical diversion from old established SOPs.

The relatively calm ATC and the prolonged period of approximate hight holding, coupled with the huge handful of power in the last moments, is leaving me with a mind that's wide open.

There seems to be a significant amount of hindsight bias regarding the specific term "runaway". A lot of the discussion is now anchored to what has been revealed about MCAS and the behavior of this aircraft. If you survey every single poster in this thread before this incident and asked them to describe what "runaway stabilizer" looks like, I imagine the answers would be quite different than what you would get in a poll with hindsight of this incident. For an example of a 2016 reference guide description of runaway stabilizer, google: The Ultimate B737 NG Technical Handbook STABILISER TRIM SYSTEM AND RUNAWAY STABILISER

It's not even clear that the previous crew diagnosed a "runaway" and followed the NNC. They may have gone directly to the cutout switches as a way to isolate an unknown electrical trim problem- they later reported that they believed it was STS operating in reverse due to IAS issues. This may even have been a conclusion/guess they reached later in the flight rather than a contemporaneous diagnosis.

EDIT: climber314 pointed out that the preliminary report says they followed the Runaway Stabilizer NNC. Hopefully we get more specifics on this later.

The JT43 crew ran the R/S NNC and cut out Stab Trim. I posted this shortly after the report was released.
https://cimg5.ibsrv.net/gimg/pprune....20e61039fb.png

I think it's a fair distinction to raise but feel this presentation is disengenous.

As far as we can tell, MCAS is intended to provide a more consistent and predictable handling response in incipient stall conditions.

How does an intermittent and unadvertised control input, of complex algorithmic intensity, every 5 seconds, provide that?

Sure enough. Is that statement based on interview with the crew?

My assumption is they were debriefed. The whole flight is described in detail in a little over one page - 18.1 PK-LQP Previous Flight.