Isn't that statement a logical fallacy for two reasons:
- An aircraft can stall at any speed, if the altitude is sufficiently high, and the the wings are in a banked turn (accelerated stall).
- MCAS is not an anti-stall system, so that statement has no bearing on its activation.

An astute observation. I am not conducting a first-order analysis for a very specific reason. A first-order analysis would step through the initial threats, the barriers, and the errors (trapped and untrapped) and the outcome of each untrapped error. I think that has already been done in spades, though not necessarily through the lens of TEM. We know there were errors, and we know many of those errors went untrapped despite the theoretical presence of numerous barriers. I am doing something more of a second-order (and in some cases third-order) analysis that suggests that the "barriers" did not function as expected because they actually contained unrecognized threats. Those threats, being unrecognized, had no mitigation strategy or barrier to contain them and thus led to a series of actions resulting in the loss of this aircraft.

As far as the "inadequacy" of the crew, I think the picture I've been painting here is the inadequacy of the system that put them in that cockpit. These pilots were a product of their training, experience, and environment. In theory, that system gave them the tools (i.e. the barriers) that would have made this accident avoidable. Rather, my conjecture is that instead of creating resilient barriers, their training and operating protocols were actually producing unperceived, and hence unmitigated, threats.

Please excuse me if I am repeating something that has been discussed earlier in this thread, but from the schematic for the “Horizontal Stabilizer Trim Control System – Functional Description – Electric Trim” (see PPRUNE thread entitled 737MAX Stab Trim architecture, post #194), one can see that when MCAS is active, then STS in inactive.
And when MCAS is inactive, then STS is active.
Is it possible that after a pilot electrically trims the aircraft nose-up after an MCAS nose-down trim event, then the STS system will activate to trim the aircraft nose-down again before the next MCAS nose-down trim event? Recall that the STS system trims the aircraft in the direction opposite to the speed change. So if the pilot has just trimmed with a nose-up command, then wouldn’t the STS system counter with a nose-down trim command? This same operation would still apply if the autopilot thought the aircraft had a higher angle of attack as a result of a defective AoA sensor (the autopilot controls the STS trim even when the autopilot is off). Could this help to explain the failure of the ET302 pilot to trim back to a fully neutral trim after an MCAS trim event?

One thing that confuses me here is that I’ve read that STS activates 5 seconds after release of the manual trim switches. MCAS has a similar 5 second delay. This may mean that any STS trim would be canceled by an MCAS trim event. But could there be a delay in MCAS activation relative to STS activation? By the way, STS trim and manual electric trim have the same trim rates, but differ in direction. Also, any STS trim should be canceled by the simultaneous activation of manual electric trim by the pilot. But if the pilot released the manual trim button when he believed the aircraft trim to be at neutral, then STS might give a short nose-down trim command before MCAS activates to give a larger nose-down command.

Also, the same schematic shows that the two pedestal cutout switches on the 737MAX operate as a logical “AND” function (“&” function) as follows:This means that there is no way to turn off all automatic trim functions while keeping the manual electric trim operative. However, it would be a trivial change to have the switches operate as follows:
In this case the pilots would be able to turn off the autopilot trim and MCAS trim by turning off only the B/U cutout switch while keeping the manual electric trim and STS trim active by leaving the PRI cutout switch on. This would make the 737 MAX operate more like the 737NG aircraft, allowing full use of manual electric trim at all times. Why has this not been done? Is it because it would have required re-certification of the aircraft by giving the pilots control over the MCAS function? Was certification of the 737NG with new lift-causing engines dependent upon the MCAS correction function operating only in the background without control from the pilots?

Other than it's existence and a few things posted here I have no knowledge of sts, however does not look to be a significant factor in ET case.
There is one brief NU automatic trim on the trace at 05:40:00 after the AP disconnect followed (or even interrupted by) MCAS for 9 seconds, this could be an STS input.

The only possible impact of this is that the pilot may have heard trim starting and glanced down to see normal looking (NU) trim, which was quickly reversed by MCAS.
Had not thought of that before but likely not significant, in any case it was short and "the right way".

BTW: The penultimate Lion Air crew wrote up the defect as "STS trimming in wrong direction".

Correct on cut out switch change from NG to MAX.

No one has offered an 'official' sounding reason for the change.
The most likely case is that training had shifted to always using both and it simplified some aspect (cert?) of MCAS to not have a seperate auto only cutout, but both switches were retained for commonality.

Yet another review panel
 

https://www.seattletimes.com/busines...pgrade-review/

STS respects the control column cutout switches, so any time that virtually any amount of forward or backward pressure was being applied to the yoke, STS would not be able to make any input. Additionally, STS has its own Stall ID mode which, in the presence of a stall signal, would command the trim nose down and override any other STS input. This nose down trim input is also inhibited by the control column cutout switches.

Both have a 5 second delay because MCAS is actually a sub-function of STS (though MCAS is not inhibited by the control column cutout switches). STS can trim in both directions. If near neutral trim, STS might make an input (nose up or nose down) but any further inputs would be inhibited if the control column was displaced from neutral.

Under current procedures, we never use the cutout switches individually on the 737NG or the MAX. We always use them together. There have been extensive discussions regarding the why's and wherefore's of the change in switch functionality, but procedurally it makes no difference at all.

Pilots have never had direct control over the STS function, so I'll speculate that giving them direct control over MCAS never crossed anyone's mind. MCAS was required for certification, but I don't think those certification rules cared whether the system operated in the foreground or background.

Salute!

Losing credibility faith in you, Murph...... to wit:
Even Driver has referenced STS and that MCAS was considered a sub-mode by some folks. And due to STS rolling that trim wheel a lot, the Lion crew commented that STS was working backwards. I would also like to hear the CVR on that flight, as all we hear via the rumor mill is the jump seat guy saved the day. Until we have the trial testimony and depositions, we may not know. Maybe the CVR had some of the conversation, as the FDR had a lotta hours. My not so humble opinion is that crew lucked out and "went manual" when the trim system was not acting as they expected. I give them a lotta credit for doing all that with then shaker goingon, but their CVR shoul give us a clue if it ever becomes public.

Comes down to same thing - longitudinal pitch moments and such, not simply back stick forces per AoA unless you are flying a pure cable and pulley plaine. The 737 variants added STS after a coupla generations because it had to satisfy FAR speed stability reuqirements. And BTW, I do not like that "speed" term. It's AoA and basic aero to force the nose down/up when decreasing/increasing speed/AoA from a reference speed/AoA. It's called "trim".And most here learned all about it back when learning in the Tiger Moth or Aeronica or Cessna or.........

Big B has a lotta public relations work in store, and I am not sure they will recover for long time. Irritates this old fart, as I always liked their control authority philosophy.

Gums sends...

Threat and Error Management
 

Part 5

Continuing the Threat and Error Management discussion......

Okay, the question has been asked, "Why bother with the TEM model? What good is it?"

The TEM model is widely used in aviation, and it is a fundamental part of the language of aviation safety. It often is the language that is directed toward flight crews by their airlines in order to build a case for better safety practices. I am suggesting that it is also a useful tool not only for an individual pilot's safety assessment, but also as a way to engage in a dialogue back up the management chain. I am admittedly putting an unorthodox spin on TEM by raising the issue of "barriers as threats." However, sometimes when our airlines think they are creating barriers, they may actually be creating threats. By looking closely at some of the assumptions underlying many barriers, it is possible to identify these new potential threats. Once these threats are identified, steps can then be taken to mitigating those threats, perhaps by building additional barriers. Yes, there is a potential matryoshka doll type quality to this recursive analysis, but I don't it needs to be taken through too many layers.

In Part 4 of this series, I listed some questions to asked regarding the traditional barriers available to the flight crew. Perhaps you have some of your own. Those questions may lead to the identification of a threat in the guise of a barrier.

Examples of responses that raise some flags:
.

• Our company SOP's emphasis on automation as a "safety" tool is causing my hand-flying skills to degrade.
• Our company's established reporting system for for operational concerns is so onerous that most pilots don't bother using it.
• Our training program's focus on standardization relies too much on rote actions, predetermined training events, and a "tick box" mentality that does not allow for the introduction of novel events that require higher order thinking. There are no attempts to induce a "startle" effect or create ambiguity.
• Our company's hierarchical structure and emphasis on the Captain's authority makes First Officers reluctant to speak up and correct the Captain when necessary.
• The First Officers I fly with know their systems, are whizzes at programming the box and have no problem with the automation, but they seem to have little "feel" for flying or having the "big picture."
• When I point out that one of our checklists has a potential trap, the response is something like, "Smarter people than you made that checklist. Just stick to it."
• We hire people from around the world, and frankly communicating with some of them outside the expected checklist responses is challenging.

.
In each of these cases, one of the traditional barriers of the TEM model was hiding a potential threat. Now what?

The TEM model shows the way. Once threats are identified, the flight crew (or individual pilot) should use whatever tools available to mitigate those threats or even develop a new barrier. How the pilot mitigates the threat will depend heavily to his company's openness to dialogue as well as that pilot's personal initiative to mitigate threats as they arrive in daily operations.

On a group or organizational level this may include lobbying the airline managers and/or regulators for appropriate changes to training standards, automation policy, and operational reporting system. Use the TEM model as a tool this dialogue. Push for enhanced training for First Officers that emphasizes their role as a proactive barrier on the flight deck, and recommend creating a forum where operational safety concerns can be freely discussed without fear of retribution. Where managements are resistant, engage with outside safety organizations or other entities that have influence. Remind managers that not all costs can be entered into a spreadsheet before the fact, but they can certainly be tallied later. Some of those costs are paid in bent metal and broken bodies. Carry a picture of the crater left by ET302 as a constant reminder of the consequences of ignoring these issues.

On an individual level, spend some time looking at your company's safety culture and identify existing threats. If the airline will not take appropriate steps to mitigate the threat (e.g. pressure to meet schedule or contain costs overrides your specific issue), use whatever tools you have to contain the threat even if it means walking off the airplane. Brief every flight as if it were your last. If you are a Captain, make your expectations clear to your First Officers and insist that they speak up as necessary. If you are a First Officer and you have a "difficult" Captain, remember its your butt up in the cockpit, too. Use diplomacy, social skills, and/or direct language as appropriate. If your airline won't provide the training you think you need, train yourself. Memorize the "mantra" and share it with the pilots you fly with. "Chair" flying is always available and desktop simulators are cheaper than ever. Click off the automation every chance you get. Review your procedures, memory items, and limitations regularly. Look for potential traps in those procedures and have a plan for them. If you have a concern in the cockpit, speak up! It may be nothing, it may be something. Don't assume the other person is aware of everything that you are aware of. Don't assume that you are aware of everything you need to be aware of. Get plenty of rest, and take care of your health.

Yes, it is a lot to ask, however, never forget that the pilots are usually the first ones to the scene of the accident. Our standards and expectations ought to be higher.
.

​​​​​​"Our problem is not that we aim too high and miss, but that we aim too low and hit." - Aristotle
.

No, it really isn't, there is no way you can stall a 737 at 350kts indicated, because the wings will come off before you hit the critical angle of attack.

MCAS is not anti-stall. it just prevents the pilots from stalling (you see how that sounds?)

What I mean is that in ET case it was clear from the traces that although there was one probable STS trim it had no impact on the accident sequence.
I was attempting to answer a question about STS possible active involvement in the ET accident.
.
Not at all saying that STS was not of overall significance, possibly by adding confusing expectation of intermittent auto trim, although the magnitude and other behavior is much more benign than MCAS.

While MCAS is a subsystem of STS it would be confusing (to say the least) to blame "STS" for the difficulties faced by the crews.

BTW: 737 driver STS explanation is much better than mine since it also includes response to column cutout switches etc further supporting the case that it had no direct role in ET.

Trimming. Now there's an interesting concept. Let's see. AP on at 500ft after takeoff. No pilot trim required. AP out at 500ft on final approach. No pilot trim required. In some companies, this is the recommended/preferred SOP.

How is a pilot expected to instinctively trim in such a diabolical scenario when he doesn't do it at any other time?

ET was at ~250 when MCAS dumped in 9 seconds of ND trim which led to sharp speed increase. Even so they were still well under VMO when they disabled all electric trim and were apparently unable to manually trim due to aero loads possibly compounded by lack of training in the unloading technique.

This period is unfortunately not well covered in the prelim report but to say they were 'racing around' does seems a bit harsh.

Other pilots have stated that chopping power would need to be done very carefully given the conditions and altitude.
I am not saying they did not simply miss the 'autothrottle off' step but that only added to problems later on.

Do you mean Texas or Florida?

To me it also sounds like a plan B if the international sister *AAs are not as servile as expected in providing a waiver for the design.

Having read most of the 256 pages - did we have somewhere a comparison of the implementation of MD11s LSAS and MCAS?
IIRC LSAS hat two computers (left and right) selectable by flight crew? Can't remember if each of those two computers had a left and right channel as well.
Is MCAS and LSAS a good comparison, given that the one is active most of the time and the other only in a very specific corner of the envelope? What does that mean in terms of safety requirements?

Here is a good recent article on Boeing certification problems:

https://www.seattletimes.com/busines...uding-737-max/

Fly SAFE!

God bless, and Namaste...

Just another thing - seems the simulator does not simulate MCAS, another over site to rectify.

https://edition.cnn.com/2019/03/28/a...ntl/index.html

Chief Pilot and Vice President of Flight Operations Yohannes HaileMariam is at the helm of our simulated flight. Everything during the re-creation is designed to be as real as possible, including videos of runways and airports around the world that play on the screens, simulating the cockpit's wind screen. Guided by HaileMariam, our simulated flight rises and is airborne for 15 minutes before gliding to a stop.
During our simulated flight, there is no sign of a downward tug on the plane's nose, a concern at the center of investigations into the two crashes. The 737 Max 8's MCAS lowers the plane's nose when a sensor detects that the aircraft is at risk of stalling.