Insufficient information?
 

On other threads it has been mentioned (many times) that the primary trigger for the B737 Max MCAS debacle was cost-driven avoidance of extra pilot training for this system.

It brought to mind another 'insufficient information' situation from a few years ago before I retired. On our non-FADEC RB211 B757s it was my habit to manually tweak the throttles (autothrottle engaged) to match the N1s as long as the resulting EPRs were closely matched. This reduced the 'beating' wah-wah-wah noise and thereby improved cabin ambience.

On our FADEC CF6-80C2 B767s I noticed early on that the N1s were always exactly synchronised, even if there was slight throttle displacement (no EPR gauges). A bit of experimenting showed that if one displaced one of the throttles the N1s would fluctuate for a few seconds and then re-sync. If the throttle discrepancy was increased the N1s would still re-sync until the displacement exceeded a certain limit, after which the N1s would de-sync to match the individual throttle settings. Aligning the throttles again would restore auto-sync.

There was no info about this behaviour in any of our manuals. A request to Boeing for info confirmed the behaviour and gave details of the sync range. IIRC the auto-sync was activated - with the signal determined by the leading throttle position - when the N1 demands of the two throttles were within 5% of each other.

My judgement was that this snippet of info was important enough to warrant informing pilots about but apparently others were not of the same opinion - it was perhaps considered 'not necessary to know' stuff rather than 'nice to know' or 'need to know' or 'must know'.

MCAS was surely a 'must know' item. I wonder in these cost-obsessive times whether other significant items are in the wrong categories.

I am probably being dim, but just wondering why the autosync refinement needed to be known by pilots?

Do you mean so as to ensure the autosync was engaged during flight to increase passenger, (and pilot) comfort? Or in case it ever went wrong?

I understand the "we're not learning how to build it" line of thought against extraneous detail. But if pilots are denied basic info like "what do my flight controls do," that's off the other end of the scale.

Challenge me to come up with why I find it important to know I have auto sync? I admit I really can't say - it does the thing without my involvement, whether I know about it or not, whether I care about it or not. But even besides that, somehow it feels -- more basic than that.

In engineering, we call that the 'limited authority trim' - but yes, the autothrottle system sends a trim signal to each engine to match up N1 or EPR across the wing. It has a very limited authority (I don't recall the limits for EPR, but for N1 it's +/- 2.5% at lower altitudes and +/- 5% at cruise). While it's there on the 777 and 787, it's not really needed as there is a separate servo for each thrust lever that can (and will) simply move the lever slightly to get the same effect. However on the 747 and 767, there is a single servo that controls all the thrust levers so it does not have the ability to move an individual lever to match N1/EPR across the wing - hence the need for the trimmer.
Not sure why Discorde thinks the pilot specifically needs to know the workings of the trimmer system - dual servo autothrottle systems (new 737NG and MAX, 777, and 787) can perform the very same thing by simply making subtle adjustments to the lever position.
There is already a procedure that basically says if you don't like what the autothrottle is doing, simply turn it off - which also disables the trimmer system.

Training avoidance was not the fundamental cause and neither was the lack of documentation. The first plane to encounter the problem landed safely after a 90 minute flight and they had neither special training nor any documentation regarding MCAS.

Since this particular failure mode was not identified as one that a typical pilot could not handle and had the same symptoms as any other electrical failure that would drive the trim system, no different training was identified. Apparently the simulators of the NG did not include the ability to falsify the AoA sensor data, so how could that training have been done?

The main problem seems to be the entire lack of ever having a trim-runaway on the NG - so no examples of crews being unable to handle it and no impetus to emphasize how it might manifest. As a result neither the design review process understood it to be a deadly threat and neither did those responsible for training. Maybe there was a case of runaway? If so, I have never seen it discussed in any of the thousands of replies or the accident reports or the Congressional report. To which I say - it was still identified as a potential problem without a defeatable cause as evidenced by the NG and the MAX having trim motor cutout switches.

It seems like more systems level information should be available, but all of MCAS was exposed 4 months before the second crash.

This is a big general problem with sophisticated automation - that the operator might have to not only know what the system is doing externally (as in the engine RPM) but also what the automation is doing and why it is doing it and what limits there are on the automation ability to cope with variances in the reported sensor values from the actual values, and then what the automation will do if an unobservable sensor provides information that is: accurate; might be a bit in error; might be largely in error; or might no longer function.

In most automation the first and last case are handled well; the second case falls under the first case with users remarking that the result isn't as good as expected, and the third case is what gets people killed. Deviations in either a few sensors or, because of damage, potentially a group of sensors, rapidly generates millions to trillions of possible outcomes.

MCAS is a stand-out. Many planes have had automation problems that lead to deadly crashes, but usually they weren't back-to-back from different initiators. In MCAS one was the miscalibrated AoA sensor on one plane and the suspected collision removal of the sensor vane on the other. In most automation failures the response has been to improve training and, when there is a software change, the operators are lucky and the software gets there before the next event.

MCAS wasn't to reduce cost. It was a small patch to a small trim problem just like STS is. It was based on STS, but because it had to operate under manual control to tweak the response to manual control it could not be shut off by manual control as STS can be. Sure, they could have designed an entire new plane for the hindsight cost, but then a person could buy a new car because the fuel tank is empty. In addition, a new plane would require all new training for all the pilots in the airlines buying 737s, which is exactly what the airlines did not want. If there is a blame for penny pinching - the airlines are it - but they also had not seen this problem so it wasn't identified as a requirement there either.

I've seen no indication that anyone had plans to change the simulators to falsify the AoA sensor output to produce the MCAS related crash sequences - without that no one could train for it. I expect they could simulate a trim runaway, but if no one ever heard of one or experienced one on a 737 why would that be emphasized?

I expect the same goes for the throttle response - if it has never caused a problem why tell pilots about it when more pressing issues might be dealt with in that amount of time or in generating pages for the manual? I do recall that, following the obliteration of an engine in midair that ruined a jet and killed a passenger, pilots were cautioned against conducting experiments. It also solved a mystery about a similar development failure on a test stand that the engine maker had tried but had been unable to diagnose or reproduce. See National Airlines, Inc., Flight 27, N60NA.

As an engineer, I have thanks for anyone looking at how the system is supposed to work. I could not always imagine all the potential interactions and found such questions to either be gratifying (I had accounted for it) or helpful (I had a new case to avoid.)

The necessary MCAS training input could have been very simple (and cheap): promulgation of an operational notice along the lines of:

The Max version of the B737 incorporates a modification to the stabilizer trim system to counteract the adverse effects of the engine nacelle geometry on the aircraft’s stalling characteristics. Boeing refer to this modification as the Manoeuvring Characteristics Augmentation System (MCAS). A technical description of the MCAS follows this Notice.

If pilots observe any activity in the stabilizer trim system when it should be inactive they should immediately accomplish the STAB TRIM RUNAWAY checklist.

Which is exactly what the Ethiopian crew did. MCAS was given far too much authority with a single point of failure.

I don’t think the MCAS system on its own was enough to require a new type rating or additional sim training. I’m not certain though and will happily be corrected. The main issue was Boeing were trying to hide that this airplane does not handle like it’s predecessors. MCAS was the band aid. If they’d been open about their solution to the handling characteristics, the FAA may* have reigned in the authority of MCAS and insisted on tying it to both AoA vanes. Only then would your suggested operational notice be sufficient.

*That is a very big may as the FAA may well have taken Boeing at their word that MCAS was safe as it was originally designed.

This was a factor in the Kegworth 737 accident. So yes, it would be good to know.

• The ‘N1 equalisation function’ was not well-known by crew.
• The ‘bad’ engine was causing the good engine to fluctuate similarly.
• Shutting down the good engine (splitting the thrust levers) turned off the ‘feature’, resulting in a confirmation bias that the correct engine had been identified.

There were multiple other factors, but this definitely did not help.

As is often the case, we are unaware of what we need to know before the wake-up event.

Is there a different Kegworth 737 accident? The one I see, from 1989, was that there was smoke in the cabin and they didn't understand a difference in air supply from earlier models and they shut down the engine they thought supplied bleed air. The remaining engine had been producing smoke as it had lost part of a outer panel of a fan blade. The autothrottle played a part as with the one engine shutdown apparently the throttle setting reverted and was lower than the autothrottle, leading to a reduction of vibration and a reduction of smoke and the pilots concluding they had got the correct one. I don't see that equalization is in the mix, but there may be another incident?

Unless, as Mech Eng notes, there was another Kegworth accident, that aircraft didn't even have the auto sync 'trim' system which is only on FADEC engines (it was a 737-300, hydromechanical engine controls). The autothrottle simply tries to keep both engines at the desired N1, which shouldn't exactly be a surprise to the pilots since that's the function of the autothrottle. Without the trim, any change in commanded N1 requires thrust lever movement.

How the autobrake system on the A320 is described in the FCOM is extremely sparse and IMHO insufficient. Crew calculate the landing distance for every landing and, in my experience, never notice how wildly inaccurate the computed data is. They are content that the landing was safe.

The AMM contains a lot more data and explains the systems better and as a result you can see why the QRH/ipad Airbus app is so inaccurate.

Section 2.2.2.2 of the report (p 116, last paragraph) refers. The ‘N1 Equalisation function’ is not mentioned explicitly by name, but was mentioned obliquely ((1.17.6.4) as a ‘feature’, and was covered in subsequent training at BD.

Whether this is significant, is a matter of interpretation: for me, the risk of confirmation bias, believing that a correct action has been taken is worth emphasising.