737only did you have the extreme trim?
 

So you found the pitch up managable if full throttle was applied at stick shaker. Did your autopilot run to extreme trim like that reached by Safta in his sim:

http://www.pprune.org/rumours-news/3...ml#post4770070

Do you think there should be a threshold of trim where the autopilot warns that g/a thrust would result in extreme pitchup? The autopilot would seem to have the independent informatiion necessary.

This plus the left alt dependency and second retard of the auto throttle would seem to be the lessons learned about the automation.

When the system designers were doing the SSA, FHA, FMEA, etc... I wonder if they considered a RA failure able to lead to a Haz or Cat event? And regardless of the hazard classification, I wonder if they were assuming some sort of annunciation or other crew action as a mitigating factor.

Maybe Boeing will have Honeywell add dual RA to the AT, and add some RA fault accommodation?

Propulsion guy
Not having seen the relevant FHA, FMECA etc, I can only guess that the main mitigating factor would be that the crew would be monitoring the critical flight parameters during the approach in the event of an inadvertent power reduction.

Bobcat4
The statement I made wasn't regarding whether Boeing made a mistake or not with the design but that idle-bystander thought the system designer should be ashamed of himself. However with your quoted reference data, you should also be aware that Boeing do not make engines or hold their TC :E

Trim was no problem, because we reacted at the first onset of the stick shaker.

What we did not do, was waiting for 8 seconds after stick shaker activation to fly the recovery. The turkish crew did not wait either. Their problem was the throttle retarding again. 6 seconds idle is not survivable when flying stall avoidance.

Lessons apart from basic flying is:

-Building in RA comperator which gives you a RA disagree, however this would not been spotted by a crew which does no instrument scan

-Programming a new reversion mode if the speed is too low, even on the G/S, no matter what mode the A/T is in.

Nigd3,

:) Right! See you point. Still I doubt Rolls-Royce isn't in the same perfect shape as some thinks Boeing is... "Don't you think Rolls-Royce know how to make engines?", I can hear someone say.

Talking about high pitch close to stall... Some are suggesting that pilots were looking out to see the runway. Cloud at 700' so when coming through the cloud base they would be able to see the horizon. Or... ??? At the increasing nose-up pitch, maybe they didn't see it? Anyway, it should be possible to see of feel the pitch when they came down to 700', right?

Q: What do you (normally) detect first when getting close to a stall, the presumably awkward look of the visual references outside, or the stick shaker?

Edit: Or to put it another way: What comes first: The look or the feel?

But newly graduated CPL pilots such as the multi-crew pilot licence first officers with less than 40 hours in a light aircraft are now second in command of some heavy iron. No "experience" necessary.

Are systems designers not permitted to assume a level of basic ability from pilots? Isn't that what we're paid for?

I'm afraid I'm in the exCargoClown camp at the moment - "There is something very wrong with all of this"

Is Turkey now ready for pilots to share some fault?
 

We still don't have cockpit voice recorder information. I wonder if it is taking so long because Turkey is playing defense by disputing the translations. Is the admission of "panic" a beginning of the preparation of the public to accept that the pilots may share most of the fault? Do you see any sign that Turkey has recognized that their initial denials have not reflected well on them? thanx for the translation.

You obviously do not know anything about the MPL.
Anyway the MPL is covered in many different threads.

bob cat4

Yes your facts are right. However the critique of the laymen in this thread is that they know what and where the mistake was made.

I have learned that everything that man has made will break. Thus as a system safety specialist one adds mitigating factors to the analysis of how often (it malfunctions) and how.

Yes in this accident something has gone wrong in these assumptions. Without more data I don't know what to fix yet.

I sense that the great majority of experience on this board is on the same page. So I tend to gloss over shoot from the hip comments about "bad design"

Comparator Warning Monitors, which included Rad Alt, have been around since the 707 and DC-8. Does the 737 NG really lack a RadAlt comparator warning, as stated repeatedly in this thread?

GB

Fly the aircraft is the bottom line: if you cannot, do not pretend to be a pilot.

@graqbeard,

indeed, there are altimeter and IAS comperators, but no RA disagree...
For sure there is an RA inop, but not for wrong readings...

new food for speculation?
 

Hello all,

Some more things to think about......?

Stall Identification
Stall identification and control is enhanced by the yaw damper, the Elevator Feel
Shift (EFS) module and the speed trim system. These three systems work together
to help the pilot identify and prevent further movement into a stall condition.
During high AOA operations, the SMYD reduces yaw damper commanded rudder
movement.
The EFS module increases hydraulic system A pressure to the elevator feel and
centering unit during a stall. This increases forward control column force to
approximately four times normal feel pressure. The EFS module is armed
whenever an inhibit condition is not present. Inhibit conditions are: on the ground,
radio altitude less than 100 feet and autopilot engaged. However, if EFS is active
when descending through 100 feet RA, it remains active until AOA is reduced
below approximately stickshaker threshold. There are no flight deck indications
that the system is properly armed or activated.
As airspeed decreases towards stall speed, the speed trim system trims the
stabilizer nose down and enables trim above stickshaker AOA. With this trim
schedule the pilot must pull more aft column to stall the airplane. With the column
aft, the amount of column force increase with the onset of EFS module is more
pronounced.


Did the failed RA trigger an inhibit condition? I am speculating here, but I would not be surprised.

Rgds
emjanssen

That Deadly Pitch-up Trim State Explanation was established at the beginning
 

Only confirms exactly what Belgique already said much earlier in post 645
and 648
and 699

and later repeated/expanded upon by UNCTUOUS at post 1385

lomapaseo

Yes, I agree. We should not rule out technical flaws, but to fix them is far easier said that done. I have to admit I tried (as a layman) and jumped to this conclusion: "If auto-retard is not needed during a single channel approach, get rid of it."

Well, it turned out to be needed. And I see the need for it. Pilots want under-speed protection during approach, right until flare. Then they want over-speed protection, hence the only "logical" thing to do is retard. The definition of "flare" is a given altitude over ground so RA is a perfect choice (if not the only choice). One could argue that a single RA in this situation is perilous, but a single channel approach is an aid, not a auto-land feature. Auto throttle in this configuration is not supposed to be fail safe. I guess pilots know that, and keep scanning their primary instruments.

The real danger about automation is that it is too damn perfect. If you fly 1000 single channel approaches and everything is normal, speed, attitude, altitude etc... Would you really be that careful the 1001st time scanning your instruments? As a PPL-rookie I've learned that the safest pilot is the rookie (with some but still very little experience) trying to do everything by the book. When you become a veteran errors come more easily.

It's like trying to quit smoking. The first months you are very aware of being a non-smoker. Then you have quit, and are done with that... Just one smoke doesn't hurt? Well it does! Been there, done that! (And I still smoke) :{

@ theshadow

I suggest you read my posting better.

It's not about standard trim behavior.

I don't think the "100 ft inhibit" of the EFS is discussed on this forum. Or did I miss something?


Rgds
emjanssen

Re: That Deadly Pitch-up Trim State Explanation was established at the beginning
 

The Shadow,

Thanx for the reminder links. It is too hard to find them all, but there were some posts that argued that the stick shaker at 500ft was recoverable. So it may not really be "eastablished". Here is one:

http://www.pprune.org/rumours-news/3...ml#post4768223

I think there were a couple verifying recoveries in sim.

How unrecoverable was the trim and pitch up on G/A thrust versus the second uncommanded AT retard which there seems to be general agreement sealed their fate.

bobcat4 Well, it's debatable whether the under-speed/over-speed protection available is worth the risk of a single malfunctioning RA surreptitiously placing A/T in the RETARD mode at 2000' and/or commanding idle thrust after manually selecting max thrust during a stall recovery attempt.

Note: you don't get Min. Speed Reversion with a coupled approach on the G/S. Unclear if MSR returns once the pilot de-selects the autopilot, I expect it does.

Calling for changes in design
 

In many posts here you would call for changes in design of A/P A/T systems. I appreciate any positive changes increasing safety, but strongly belive that we as humans hardly ever will be able to create a machine or software that is 100%. You change the design on the 737 and looking at the next accident we will be posting in another thread about aviate, navi..........

What I want to say is, if we let the chain of events carry on without stopping it, we will put our lives and the A/C at risk. IMHO we as pilots are paid to cover system abnormals, whatever they are. To execute that task we should have system knowledge, SOP, CRM and hopefully handflying skills on our side. Now, if you ignore all indications that the system provides is like driving down a mountain road with a 100 mph and just before o sharp bend turning around to fetch a map from the backseat with both hands.

Anyone out there who could explain how that particular crew would have detected a windshear or how they would have done a recovery from a faulty airspeed indication?

I don't recall all the indicator or system faults I have encountered in the last 40 years, as I am pretty sure the majority of pilots in this forum, and in some situations hit the panic buttons: the one on the yoke and the one at the side of the throttles.

MU3001A

As Rainboe said:

[automation]...that has worked fine for all the world for 25 years.........except for 1 flight.


Of course it is almost impossible to speak about "acceptable losses" so I guess you're right... And what would a redesign mean? Another accident caused by a side-effect we never thought of? Loosing the under-speed protected as auto-retard is could lead to pilots forgetting to throttle down after flare, and over-shoot the rynway. Just one example, the next example is something I've not thought if yet.... :confused:

Safta,
I also did a similar recovery in the sim recently. The lack of elevator authority is well documented and TOGA + full down elevator + nose down trim is the only way to go if you're that close to the ground. I still can't see why some recommend thrust limitation as a substitute for nose down trim. I'm sure that everyone gets to see this during initial type conversion.

bobcat4 Well learning from the experience of this accident I would suggest that in respect to the NG set-up the overriding design parameter of the RETARD function ought be ensuring that the A/T is only able to command RETARD at 27'RA and nowhere else, then build from there.

Note: the RETARD function is also invoked momentarily with LVL CHG but this doesn't involve the RA.

Yes, if the software actually looked for an approach to 27' and then busting that height having 'approached' it in a meaningful way, rather than looked for any (instantaneous) height reading below 27' - it might make a bit more sense...

dimitris lam Again yes, the RA didn't 'fail' which clearly, again is part of the problem, no?

In a correctly designed system the A/T would command RETARD reaching 27' RA and only 27' RA, not -8' RA not 1,500' or 0' or any of the other possible RA indications available. Once triggered the A/T should then stay in RETARD until the A/T disconnects 2 secs after receiving the WOW signal. If the RA doesn't see 27' then it shouldn't command RETARD, because landing without RETARD in the flare is a whole lot safer than having the A/T deciding without input from the crew to go into RETARD at 2000'.

HarryMann Yes, a one way check valve. IF (x=27', RETARD, otherwise don't)

It's not a design philosophy change it's a programming change. Right now the A/T is programmed to command RETARD when RA#1 sees any value below 27' and it probably needs to be re-programmed to command RETARD when it sees 27' and only 27' or 27' confirmed by two independent RA's or not at all.

Mu3001a
 

You say: "Landing without RETARD in the flare is a whole lot safer than having the autopilot deciding without input from the crew to go into RETARD at 2000'"

Being "non - bus" I'm probably talking out of line - apologies if I am - but wasn't a failure to retard possibly the prime reason behind the Airbus going off the end at Congonas last year?

edited to add: In any case, floating along at x feet above the runway because the throttles don't close certainly isn't safe either......

Here we go again... :) Pardon me for not taking any side. In one post I agree with you, in the next I go like this:

MU3001A wrote:

Well, first you have to be 100% sure that the output sample rate is quick enough so it's not jumping from 28' to 26'. And clear every runways outer edges for 2' high objects. No fences more than 2 feet high. Theoretically RA could bounce from a fence when at 27' and in the next reading measure 26'. The result would be no RETARD and the problems that would imply. Although I have to admit this would be a rather low-angle approach, if you're at flare height right above the airport fence.

Now, there is also a question about accuracy. Is the RA really accurate to one feet?

Another spooky thing about this design is that a RA could output a faulty 27' reading at 2000' just like the -8' in this accident. We are not sure what cased the -8' reading, are we? Could as well have been 27' with the same outcome.

As you cleverly put it: Debatable. Yes indeed! That what it is! And that's what we're doing. :)

That was a bus. On the NG the A/T should disengage 2 secs after WOW and if it were me going into a place like Congonhas, I wouldn't be relying on the automation to close the throttles.

Well, I actually said:

A lot more logic involved than: IF (x = 27') = TRUE Then RETARD

This implies the rate of change should be -ve over a reasonable sample size approaching the condition (x < 27) and that sample should be within certain aboslute values ( e.g. 202'; 147'; 98'; 39' ; -2' (<27' >RETARD)

So 2,000'; 1850'; 5' would NOT produce a LOGICAL TRUE

Requires a simple first in, first out buffer like a keyboard buffer

wiggy:

Yes, in a way it was. But it was a very strange accident. They closed (and reversed) the left engine, but left the other one with climb power.

It wasn't a A/T auto-retard failure as far as I know. It was pilot error when they failed to close power on one engine. Contributing factors: Very short runway which was wet. No, wet is not the correct word, more like flooded.

-Bob-

The answer is yes because it should be your trained response having had 1000's of hours in far less capable aircraft where you have to monitor and FLY THE AIRCRAFT !

Once the scan becomes an inbuilt and instinctive part of one's flying technique it should be there for good.

An individuals handwriting develops with time but rarely does it undergo radical changes

TR

bobcat4,,
 

For info, details regarding the TAM A320 accident may be found in the following link:

TAM Airlines Flight 3054 - Wikipedia, the free encyclopedia

brgds

How about this for a novel solution?
 

Require one of the pilots to have his hands on the controls during the approach, monitor the flight path / flight instruments and override / disconnect the automatic stuff if it does not perform as expected.

This just might work, and then we would not need to help Mr Boeing re-design all the systems. :ok:

Oops. Sorry. I see that it is already written in the operating manual.

erm, to those wishing to re-design everything.

Remember there are myriad items which can cause disaster. Take the altimeter pressure setting as an example. Get this wrong in IMC and the rest might be history........

The basic premise of a certain company, as I posted a while back is to assume a certain level of pilot competency, and generally this is proved to be valid when we consider the number of flights that go without a hitch every hour of every day.

This is not to pre-judge the findings in any way, but rather to suggest that you stop assuming that there is some magical way that every system that can cause an accident can simply be fitted with a warning. You'll need warnings on your warnings if you don't set some kind of baseline competency level in the operator.

And again I say this is not a comment on this accident, but simply a generalised observation on machine/human interface.

Wait for the report.

You can have all the warning systems the design engineer/pilot wants. Eventually you'll have warnings to tell you that the warning is not working.

Bottom line is that you have to AVIATE. Sommebody has to mind the shop. Every manufacturer's manual I've read has stressed that at all times one pilot is responsible for Flight Path Control. It is clear that this didn't happen in this accident. That is the responsibility of the pilot-in-command - to ensure that one pilot is looking after flying the aircraft while the other one deals with the peripherals whatever they may be - radio, QRH, checklists etc.

In this case it is clear that none of the three pilots did that with disastrous results. The only question now is WHY.

Where does all this end? Why not have both pilots with hands and feet on the controls in case one suffers a subtle incapacitation. And if there is a spare pilot in the jump seat he could be given the task of monitoring both pilots in order to be the first to detect the first signs of a heart attack, or epileptic fit. :ok:

In order to understand what in fact happened inside the cockpit, a word-by-word voice recording transcript preferably covering the entire approach and not only the last 2000 ft would be necessary. Any idea when the Dutch board might publish one? I found one report where the board have included a transcript, but it took the board almost three years to publish the final report... see this Onur Air incident, pdf page 75 for the transcript:

Runway overrun after rejected take-off, MD-88, Groningen Airport Eelde - De Onderzoeksraad voor veiligheid

I rather liked the Trident "Triplex" system where there were three of everything...Each radalt or AP monitored the other two...If it saw that it was significantly different from the other two then it dumped itself and a Red Flag would come up on the glare shield saying "MAN LND"...Autoland was not permitted with duplex but an Autoapproach was allowed but with a higher "Decision Height".

Seems to me that Duplex does not have the safety of Triplex...One of only Two is different, but which one is wrong? On a Duplex system with an error in any one the whole system should be dumped in favour of manually flying :hmm:

what pilots really want.
 

I read a post about what pilots want...something about speed protection.

What pilots want is to be well paid, lots of time off, and pretty flight attendants. We should fly enough to be very proficient in all aspects of non combat flight. We should have enough time off that we look forward to going flying again.

We also want fellow pilots who ''play for keeps''. Perhaps best explained by the "match" incident in "Fate is the Hunter".

We also want honest planes that are reliable and understandable.

We don't want to have to worry about any other aspects of our life when we come to work, whether it is paying the mortgage, family well being and health, or our pensions.

All the gadgets in the world developed since 1992 could be thrown out of a plane and we can still get the job done.


anyone who hasn't read "fate is the hunter'' and doesn't know the ''match'' incident ....while in a terrible storm, making a range approach, with the attitude gyro out of service, having tumbled in terrible turbulence, the captain started lighting matches in front of E.K.Gann, the copilot...he did a fine approach...just as the copilot was going to beat the crap out of the captain, while safely on the ground, the captain said something like: we play for keeps!!!!!!!!!!!

Fly the plane, play for keeps, and yell when the other guy is :mad: up....am I allowed to say :mad: up on this website?