BBC: Ethiopian Airlines No survivors

Surely after tge Lion Air crash, 737 max pilots must be aware of the issue and how to solve it?

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

That altitude variation at the end looks awfully suspicious. It's hard to believe the pilots wouldn't know what to do, though.

Well they put through a software "fix" to the system I believe.... but not sure if it was mandatory or not.

There is still only 1 simulator in the world that actually simulates this MCAS system.

The official Boeing differences training is a 3 hour CBT between the NG and MAX no simulator time is mandated. Just do the CBT and go and fly.


This phase of flight is statistically one of the safer phases and two aircraft of a new type in the space of 6 months crashing in that phase is highly unusual and to be honest extremely worrying.

I thought the pilots could easily disengage the new attitude system and surely after the 1st crash they would have been thinking about it all the time, no? Maybe the AoA sensor failed and they couldn't fly the plane without it. How hard is it to maintain the proper AoA on that kind of plane without functioning instruments? I don't usually worry at all about flying, but right now I would have to think hard about flying on the Max.

Its pretty easy on any plane you just set an attitude either by looking out the window, looking at the artificial horizon or maintaining the book airspeeds.

This MCAS system takes the AoA reading and then applies forward trim if it thinks the plane is going to stall while manual flying with the flaps up. Full forward trim is 45kg stick force for level flight.

There is an easy trained way of getting rid of the trim system.


But its spotting there is a problem and then realising what the problem is. They were in the air 180 seconds before they crashed.

Memory items for our quickest procedure which is the fire evacuation on the ground take 50 seconds which is quick, the 737 has to put flaps down first so takes 2 mins.



An aircraft type should not be in the air if the pilots have to presume there is going to be a trim runaway as soon as the flaps come up.

Wonder if there is going to be a recall? Or will there have to be a crash on a western carrier before Boeing takes action?

Give it about a week. If Boeing does't escalate its response to this flaw by then, I believe it will require condition "b" to provoke it.

I would like more insight into how the Southwest Airlines' pilots union is reacting to this. They have the most at stake, having the biggest order of these aircraft so far. What can be read of the SWAPA union press releases contains normal griping concern about not being consulted on issues related to the evolution of the 737 to the new Max variant, but little about the MCAS system. I have found nothing written by persons who display an adept understanding of aircraft control systems in the press releases (why should I expect it?).

So if the pilots are not concerned should we be not concerned?

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Seems like the plane was pushing its climb a bit in the second attempt:

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

the government of china has ordered all 737max8's grounded within their airspace

https://edition.cnn.com/2019/03/10/africa/china-bo...

the first section the flap will have been down for takeoff so the MCAS system won't be turned on yet.

1000ft agl is acceleration when the flap would come up.

As the AoA also controls the stick shaker then I would expect one side to be running in phase 2 climb. You can see the level off phase 3. Then decent in phase 4 when the MCAS kicked in when flaps retracted.

4000ft per min is nothing special to be honest at 9000ft MSL clean and 350+ knots. Which is way over the Vmo of the aircraft.

You mean altitude not acceleration?

Does the MCAS shut off with any flaps or only with full flaps?

Keith Cress
kcress - http://www.flaminsystems.com

We call it acceleration altitude which is when we come out of takeoff configuration and speeds which is normally V2 +10 and 1 or 2 stages of flap and into climb mode.

You level accerate to V climb retract the flaps and climb away at that.

With any stage of flap the MCAS system is not required to ensure stability. Flaps move the center of pressure inboard and to rear increasing stability in pitch and decreasing it in roll.

It's required because the center of thrust is lower with leap engines giving an increased nose pitch up with power. So the MCAS is meant to automatically pitch the nose down.

I think this is the best place to get news for all things aviation, and their thread for this accident;

https://www.airliners.net/forum/viewtopic.php?f=3&...

It's all just rumor and speculation at this point.

Brad Waybright

It's all okay as long as it's okay.

I enjoy that site but it is not very well moderated. That thread is mostly quarreling to this point.

There have been what, 350 of them delivered, and two have crashed in relatively similar ways?

That's a pretty high percentage.

Quote (TenPenny)

There have been what, 350 of them delivered, and two have crashed in relatively similar ways?

That's a pretty high percentage.

...and I wonder how many white knuckle moments that didn't make the news?

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

CBC "Boeing to update software in model of plane involved in Ethiopian crash"

"Boeing confirmed late on Monday it will deploy a software upgrade to the 737 Max 8... ...a few hours after the Federal Aviation Administration said it would mandate 'design changes' in the aircraft by April."

The missing three minutes are shown on this map. Look like the pilot had made a right turn to try to get back to the airport but from the crater seems to have gone in near vertical at high speed. Hope the FDR and CVR give us some data about what was going on.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

News:

BBC: UK joins wave of countries grounding the 737 Max

It's uk airspace so it's basically blocked them being used transatlantic.

News: "Germany, Ireland and France ban Boeing 737 Max 8 planes from airspace"

Over 4 months without a fix.
They could have at least pulled a fuse or disconnected a wire.
A simple alarm rather than computer directed flight into terrain.
Instead they delayed until another 157 people died.
Are there any calls yet for criminal charges against Boeing executives.
Unbelievable and shameful.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Well, I see now that 'Einstein' shouldn't be flying the planes, so let's all go back to wooden biplanes and sticks!

Such an embarrassment...

Indeed.

Keith Cress
kcress - http://www.flaminsystems.com

That map from the guardian is inaccurate, below is the co-ordinates for the crash site.

https://earth.google.com/web/@8.87673473,39.250979...

lots of speculation on this accident on the airliners forum. 35 pages of mostly speculation and rehashing mis-information on the MCAS system and it's operation, and a lot of back and fourth about if the Type should be grounded. There is a couple of nuggets of info but sorting through it all is a mess.

There are so few facts to choose from. I can't tell if the European no-fly orders are politically motivated or have technical merit.
I'm still trying to learn the function and purpose of the MCAS system.
This helps:
http://www.b737.org.uk/mcas.htm

It repeats the conditions when MCAS is active (autopilot off, flaps up). The description on that site makes it seem more like a thrust compensation device. Engines are mounted down low, so when the throttles are pushed forward, Boeing chose to "tweak" the elevator trim to compensate for the nose-up pitch. It just doesn't seem like this system can back off, or reverse the compensation when the throttles are eased back. In fact, if you consider that the pilots have manual control over the pitch anyway, giving them full authority over the airspeed, too, this system should be backing off the compensation almost immediately after it activates. If I understand its function right, it works in chunks of 2.5 degrees at a time - pretty big chunks of elevator pitch change to give out all at once.

In 100 years, there have been many aircraft with thrust-lines far off-center from the center of drag. In fact, it's common. It doesn't take much to be noticeable. I was exposed to it in basic training on a Cessna 172 doing go-arounds. When aborting a landing you have to get the flaps up and slam on the throttle, so you have to be ready for both the torque and wicked nose-up motion by doing both of those things at the same time. Pilots who can't deal with pitch changes associated with thrust changes get weeded out of the talent pool long before they are charged with passengers.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Quote (SparWeb)

There are so few facts to choose from. I can't tell if the European no-fly orders are politically motivated or have technical merit.

I heard this morning that the Ethiopian authorities are holding the black boxes and can't access the data. I don't know if that's true but if so this seems totally irresponsible and negligent. Otherwise, from what I have been able to find out, anything related to the cause of this crash is simply speculation. The Lion Air crash was apparently caused by a faulty AoA sensor and the MCAS incorrectly trying to compensate for the bad data from it. A contributing primary factor was the pilots inability or lack of knowledge about how to respond to that situation. Also, this condition had existed for several previous flights for this airplane and it should not have been left to fly until the problem was corrected. To attribute the latest crash to airplane design without some empirical evidence to support the claim is just irresponsible. That's the world we live in today, though.

Brad Waybright

It's all okay as long as it's okay.

It changes at 0.27 degrees per second. The limit is 2.5 degrees of change which would occur over 9.26 seconds.

Quote (thebard3)

I heard this morning that the Ethiopian authorities are holding the black boxes and can't access the data. I don't know if that's true but if so this seems totally irresponsible and negligent. Otherwise, from what I have been able to find out, anything related to the cause of this crash is simply speculation. The Lion Air crash was apparently caused by a faulty AoA sensor and the MCAS incorrectly trying to compensate for the bad data from it. A contributing primary factor was the pilots inability or lack of knowledge about how to respond to that situation. Also, this condition had existed for several previous flights for this airplane and it should not have been left to fly until the problem was corrected. To attribute the latest crash to airplane design without some empirical evidence to support the claim is just irresponsible. That's the world we live in today, though.

https://www.washingtonpost.com/world/africa/ethiop...

Ethio­pian Airlines announced Wednesday that it would send the voice and data recorders from its ill-fated Flight 302 to be analyzed abroad, as more countries said they were banning planes of the same type from operating in their airspace.
...
Ethio­pian Airlines Chief Executive Tewolde Gebremariam told CNN on Tuesday that the pilot reported “flight control problems” and asked to return to the airport.
...
Tewolde told CNN that the boxes would be sent abroad “because we don’t have the equipment here” to analyze their data. He said the boxes could possibly go to the United States or to a European country closer to Ethi­o­pia “in the interest of proximity and speed.” The decision will be made by the team investigating the crash.
...
In both the Lion Air and Ethio­pian Airlines crashes, the airplane immediately showed signs of trouble, with an erratic flight path that ascended and then descended before the airliner crashed minutes later.

Quote (thebard3)

I heard this morning that the Ethiopian authorities are holding the black boxes and can't access the data. I don't know if that's true but if so this seems totally irresponsible and negligent.

Perhaps you're misinterpreting.

"Ethiopian authorities are holding the black boxes..." ...perhaps while they're making arrangements to have them sent to a suitable facility for reading out the data. They'd be holding them in a secure location, as evidence. It's the sort of secure transportation arrangements that could quite reasonably require a couple of days.

"...and can't access the data." There are probably a hand-full of suitable facilities in the world that can read the data from the boxes (which may be heavily damaged). So it's perfectly reasonable that the Ethiopian authorities can't access the data themselves. Even if they could try, it would be safer to let the experts (such as the OEM) do it.

So I don't see anything that's remotely irresponsible and negligent.

Hopefully I'm not misinterpreting what you've posted.

Did you want to clarify?

Quote (VE1BLL)

Perhaps you're misinterpreting.

I sometimes exhibit poor choice of words. This crashed happened Sunday and the data recorders were found quickly. It just seems to me an unreasonable delay to have not made a decision on where to have them analyzed still on Wednesday.

BTW- A pilot reporting 'flight control problems' means just about anything could be wrong. Immediately assuming this has any similarities to the Lion Air crash is just pure speculation, IMHO. The recorder data will quickly clear things up and identify a need (or unnecessary step) to ground the fleet.

Brad Waybright

It's all okay as long as it's okay.

Canada has now grounded the 737 Max 8 and 9.

CBC: "This safety notice restricts commercial passenger flights from any air operator, both domestic and foreign, of the Boeing 737 MAX 8 and 9 aircraft from arriving, departing, or overflying Canadian airspace," Transport Minister Marc Garneau said Wednesday. Garneau said the decision was made after his department received new information.

Quote (VE1BLL)

Garneau said the decision was made after his department received new information.

Can't wait until someone shares that with us.

Brad Waybright

It's all okay as long as it's okay.

"...happened Sunday and the data recorders were found quickly."

Reportedly, the data recorders were found on Monday.

And now the USA...

CBC News: "U.S. President Donald Trump issued an 'emergency order' grounding all Boeing 737 Max 8 and Max 9 a few hours after Canada's decision."

Because tRump is such a recognized aviation safety authority ...

----------------------------------------

The Help for this program was created in Windows Help format, which depends on a feature that isn't included in this version of Windows.

Quote (thebard3)

the Ethiopian authorities are holding the black boxes and can't access the data. I don't know if that's true but if so this seems totally irresponsible and negligent. Otherwise, from what I have been able to find out, anything related to the cause of this crash is simply speculation. The Lion Air crash was apparently caused by a faulty AoA sensor and the MCAS incorrectly trying to compensate for the bad data from it. A contributing primary factor was the pilots inability or lack of knowledge about how to respond to that situation. Also, this condition had existed for several previous flights for this airplane and it should not have been left to fly until the problem was corrected. To attribute the latest crash to airplane design without some empirical evidence to support the claim is just irresponsible.

Just a friendly comment. They've been spatting about just these questions for 30+ pages on airliners.net and I hope to be civil here with you guys as always.

Anyway, doesn't this kind of beg the question to say it is irresponsible on both fronts? I can see how urgency on both would be warranted. Some of the groundings may be motivated by political or corporate interests, and these are not necessarily irresponsible, they are just different than technical grounds. It forces Boeing to resolve this with more urgency than they seem to have shown. It looks bad for them to be talking about a software patch the day after these two incidents.

At any rate, I think a simple risk matrix can be used to support a grounding, even with as little as we know. Two brand new Max 8 apparently fly themselves into the terrain on a clear day with experienced pilots reporting control issues, killing all souls on board. That weighs heavy on the consequence side of the equation even if the probability is low or non-existent for most of the 300+ planes in the fleet.

Agreed, commercial aviation should be one of the most risk-adverse fields out there. There have been two crashes, of the same make/model, relatively soon after the model was released. I would think that's enough justification to put them on the ground and see what's going on and determine what (if anything) needs to be addressed.

Looks like the French are going to look at the flight recorders:

http://uk.reuters.com/article/uk-ethiopia-airplane...

www.tynevalleyplastics.co.uk

Politicians like to panic, they need activity. It is their substitute for achievement.

...and that Boeing is now putting a worldwide grounding in place (though with an FAA ban in place and no access to any of the major worldwide hubs, this could be a case of bowing to the inevitable).

A.

Quote (charliealphabravo)

At any rate, I think a simple risk matrix can be used to support a grounding, even with as little as we know. Two brand new Max 8 apparently fly themselves into the terrain on a clear day with experienced pilots reporting control issues, killing all souls on board. That weighs heavy on the consequence side of the equation even if the probability is low or non-existent for most of the 300+ planes in the fleet.

I sort of agree, but regarding the previous crash, I have a hard time blaming the aircraft design although it seems the MCAS was perhaps a contributor. It flew several previous flights with a known hardware issue that was never properly repaired. Also, there is an assumption that this crash is somehow related to the first, although as far as we know here there is no evidence yet to support that. Assuming they are related to the MCAS, new aircraft always require some type of in service modification/improvement just like anything else. I guess you just hope that an issue like this would be identified and corrected without people losing their lives.

Brad Waybright

It's all okay as long as it's okay.

Quote (RVAmeche)

Agreed, commercial aviation should be one of the most risk-adverse fields out there. There have been two crashes, of the same make/model, relatively soon after the model was released. I would think that's enough justification to put them on the ground and see what's going on and determine what (if anything) needs to be addressed.

I wish I had just said that instead.

Brad Waybright

It's all okay as long as it's okay.

Caught a glimpse of the Ethiopian crash site on the local news... it showed a bulldozer pushing large masses of scrap metal into even larger masses. Someone please tell me they're not making the site more "tidy" by using a bulldozer. I thought immediate course of action was to collect all pieces of the aircraft and reconstruct in a local hangar, making careful note of where each piece was found.

Dan - Owner
http://www.Hi-TecDesigns.com

I agree it doesn't look like a very "secure" site, but the level of destruction is unreal, it all basically buried itself several metres down in what is apparently quite soft ground out there having gone in near vertical by the look of things.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Apparently there is a way to turn off the MCAS with a switch in the console between the pilots. Can anybody verify this with a picture? I'd like to update our article (below) with that information.

From my research for the article, I found that not all pilots were informed of the MCAS or the cut off switch. The head of one pilots union said words to the effect of "Why should they know? I don't know how my TV works."

https://www.engineering.com/ElectronicsDesign/Elec...

Roopinder Tara
Director of Content
ENGINEERING.com

From the discussion of the Lion Air crash it appears that every time the pilots turned the system off, it turned itself back on.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Roopinder,

See this which is the best diagram and photo I've ever seen on the lion Air crash. https://www.nytimes.com/interactive/2018/11/16/wor...

I still think they are talking about the STAB TRIM CUTOUT switches in the centre console below the throttle levers.

The manual trim switches on the yoke can override the trim position but only for a few seconds.

Now how you manage to flick the safety covers out the way and flick those switches down while the plane is going haywire and bouncing around is another thing. Also you need to do both at the same time by the look of it (can a pilot confirm this?)

If you only manage one and then the system kicks in I can only imagine one trim going one way while the other stays put won't be good.





Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote (RoopinderTara)

Apparently there is a way to turn off the MCAS with a switch in the console between the pilots. Can anybody verify this with a picture? I'd like to update our article (below) with that information.

It was already posted by SparWeb. This link has a picture. http://www.b737.org.uk/mcas.htm

However, the switches don't disable the MCAS, they disable the motor operating the stabilizer. Then, the pilots have to manually control it.

Quote (MacGyverS2000)

Caught a glimpse of the Ethiopian crash site on the local news... it showed a bulldozer pushing large masses of scrap metal into even larger masses. Someone please tell me they're not making the site more "tidy" by using a bulldozer. I thought immediate course of action was to collect all pieces of the aircraft and reconstruct in a local hangar, making careful note of where each piece was found.

As he spoke, a bulldozer dumped more debris from the plane into a huge pile in front of the assembled mourners, while men wearing white masks and carrying plastic bags picked through the dirt.

The plane plowed nose down into the earth, and much of the wreckage was buried at least 60 feet deep, said Zhang Jun, a construction engineer working at the site.

He brought his back hoe and bulldozer from Addis Ababa, where he was working on an airport construction project.

“It is in the soil very deep,” he said of the aircraft debris. “The pieces are very small, no more than two meters [about 6 ½ feet] long, he said. The human remains he found, he added, “were even smaller.”

https://www.washingtonpost.com/world/africa/at-eth...

This 'buried in the dirt' has me wondering how they found the Boxes so quickly.. Oh wait, they're now in the tail aren't they?

Keith Cress
kcress - http://www.flaminsystems.com

And, they beep.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Grounded until May at least:

http://www.bbc.co.uk/news/business-47567039

Cheers

www.tynevalleyplastics.co.uk

Politicians like to panic, they need activity. It is their substitute for achievement.

The Stab trim cutout switches are inline one is a backup in case the first one fails closed. flipping one should still cut power to the motor but for safety sake it's a redundant pair that gets flipped at the same time. In the closed position it has protection from being moved to cutout accidentally. Once moved to Cutout all electric trim is lost, pilots can only manually trim the plane. The pilots electric trim on the stick stops MCAS for 5 seconds after release before it re-initiates trimming (runaway trim is apparently different in that the pilots electric trim switch does nothing to stop it and can be up or down). MCAS can not turn itself back on after stab trim cutout switches are moved to cutout, only after being stopped momentarily by the pilots trim switch(5s before reactivation).

I think from pictures of the crash site it is clear it was a high speed nose down crash, and that rules out any mid air explosion or engine failure. There is a very concentrated debris field around the crater, not a large extended debris field cover kilometers before the crash. Any sort of mid air explosion the was significant enough to cause a high speed nose down crash would have left a secondary debris field.

The FDR and CVR data can not come out soon enough but I will wait patiently.

I am still struggling with the purpose of the MCAS.

Quote (As stated on the b737.org.uk page)

This new location and size of the nacelle causes it to produce lift at high AoA; as the nacelle is ahead of the CofG this causes a pitch-up effect which could in turn further increase the AoA and send the aircraft closer towards the stall. MCAS was therefore introduced to give an automatic nose down stabilizer input during steep turns with elevated load factors (high AoA) and during flaps up flight at airspeeds approaching stall.

What I get from that is the MCAS is most active during take-off and climb-out (the times of both crashes). It should be inert and/or remove all compensation during cruise and descent for landing. Right so far?

Also, there seems to be a variable lift-curve on the nacelle body, possibly energized by the intake's airflow. What doesn't pass into the nacelle is accelerated before passing over the nacelle body, generating lift on that surface. Takeoff and climb are the high-power phases of flight, too, so the acceleration would be greatest.
One more thing: none of the descriptions of the MCAS system refer to an engine power as an input value, just AoA airspeed and altitude.

Quote (b737.org.uk)

The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude.

Lion Air crashed into the ocean (alitude=0) and Addis Ababa is at 7,700 feet so we have a wide spread of altitude inputs with the same result.
What is common in both crash events is that the airspeed and angle of attack were all over the place.

Would it help if we thought in terms of a PID controller that is not properly tuned, leading to an overshoot? The literature (in the media; I haven't been able to read Boeing's data) says that the rate is 2.7 (correction: 0.27) degrees per second. So there's no way to tune the rate to keep up with more rapid pilot inputs or gusts? Making it not even a "P" controller (Proportional)?
Or is this a wrong-headed way of thinking about this system's function?

<edited to fix an incorrect number, thank you LH>
No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

LittleInch and MDEAus; Thanks for the clarification.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Rumours are going around that they found the elevator screw Jack and it was in the fully nose pitch down position.

Oh,

The thing I haven't figured out is what happened apparently at the end of the Lion air flight, i.e. it bounces around seemingly between the application of the MCAS and recovery in a cycle of several seconds and then after some time it just dives near vertical.

Does the MCAS gradually increase the max trim angle?
Does it allow a certain number of cycles and then go beserk and just goes max nose down?
If you don't pull the elevator trim back to level does it go a second time after a few seconds for another attempt at nose down until it runs out of elevator trim?

Sparweb, from what I've heard the trim control goes at a certain increase angle per second to a max of 2.7 degrees after I think 9 seconds.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

There really isn't much official out there about the system or how it works. There is absolutely zero about it in the pilots training for it.

Apparently the difference training is 2 hours of CBT then go fly the plane according to Boeing.

I'm just wondering if they ever really software tested it for multiple operations of operating followed by reset followed by... Strange things happen sometimes if the program decides enough is enough and just goes full pitch down.

Rereading the info in the posts above, it looks like the system continues to go nose down if it thinks the previous adjustment hasn't worked and one issue which is impacting the roll out of the mods is whether and how much to limit the max elevator trim.

for Boeing to not release the software update for months after it has become clear it had a large part in the Lion air crash tells you that there is something not right in how this MCAS works under real life situations and bad data.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Apparently the government shutdown screwed the FAA up somewhat.

Quote (IRstuff)

And, they ['Black Boxes'] beep.

Traditionally, the smaller (~ 4-inch) Underwater Acoustic Beacons (UABs) attached to the Black Boxes beeped at ultrasonic frequencies. E.g. The very common now-obsolete DK100, or its newer replacement DK120/90, both ping at 37.5 kHz. One may still hear a faint click, if it's still working.

There are now also 8.8 kHz LF UABs, but they're longer (~ 6-inch) and are generally designed to be attached to the fuselage itself. They're more recent, perhaps starting circa 2012 as far as I can tell.

Those black boxes are going to be mangled and burnt to a crisp that's why they have to be sent to France.

All the outside of it will be junk and the connectors unusable.

They have to take the solid state memory out of it and remount it to a reading board then download.

They don't look too bad. a picture just rekeassd by the bea.

https://www.forbes.com/sites/kristykiernan/2019/03...

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Sparweb - I already posted it, but I'll do it again for everyone's benefit since what seems to be the wrong info keeps being repeated. It changes at 0.27 degrees per second. The limit is 2.5 degrees of change which would occur over 9.26 seconds.

From the descriptions, the MCAS will apply a trim correction up to 2.5 degrees. It then does it again 5 seconds later if it still believes the plane is close to a stall condition.

The electric trim switch on the stick will control the trim, which means it can over-rides MCAS if the pilot uses it to command trim up. However, the pilot can't hold it or else the plane will stall. So, they have to release it and then the MCAS will start to command trim down again.

From the manual page at the previously linked site, it says for trim, flaps up the stabilizer can change at 0.2 units per second and with flaps not up the stabilizer can change at 0.4 units per second. MCAS is only active with the flaps up. So, what is a unit? Is it possible the MCAS can move the trim faster than the pilots can via the trim switch?

The round bit is where the solid state memory lives. The mangled bit is the connectors, pinger, transmitter.

Quote (thebard3)

I have a hard time blaming the aircraft design although it seems the MCAS was perhaps a contributor.

I agree. It may well turn out that manufacturing or maintenance problems contributed. And it will be a chilling find if it is determined that there was something simple the pilots could have done.

I wonder what is the maximum speed that you can deploy flaps. Maybe someone knows if this would disabled the automatic trim system.

It would disable it.

Flap speeds is 230 knts I think for the 737 for the first stage.


The MCAS system is to add stability to the control pressure. I belive that the control responce is not linear ie we usually have increasing control forces as you get nearer the stall to pitch the nose higher.

Due to the nacelles on the leap engines thay start developing liftat high angles of attack and that means the control forces to increase pitch become less the closer you get to the critical angle of attack which is against crtification rules. So they added in theis automatic trim nose down fuction to increase the stabity in pitch while manual flying. I think its only really meant for the go around situation.


The action of it isn;t just one cycle and then stop at 2.5 degrees it pauses and the system rests then does it again and repeats until the AoA reduces or the autopilot gets engaged.

Here is the mechanical side of the system for those interested

The 737 was designed in the 1960's. What have you still got running that was designed in the 60s? My toothbrush? Not even. The 757 and 767 were developed decades later than the 737 and both of them have been retired. 737 Max? More like a 737MF (MaxFrankenstein). I suspect that design modifications to the 50+ year old airframe have finally caused inherently unstable flight within certain areas of the performance envelope required to conduct normal operational manuevers. Now some obviously low IQ, AI software was patched in as a vain attempt to keep the aircraft from entering attitudes that have been found to provoke the resultant situational aerodynamic instabilities and it may think it is smarter than the PIC. And that may be right, given the lack of speed and clarity of the "work arounds" issued to pilots by Boeing itself, which may or may not work. Whao! When Boeing (or anybody) starts thinking that hastily written AI software (did it even make ver 1 yet?) is the best possible method to correct bad aerodynamics, I'm bailing out literally! What the heck are they thinking... all this is some FlightSim game? Take your eyes off the turn and bank indicator and look out the window once in awhile.

My humble advice is don't fly a Max until the airframe is substantially corrected. I doubt that will ever happen, given the certification costs and time schedules involved in that. Leave unstable flight envelopes to bees and helicopters.

BTW, waiting for more data before grounding the MaxF was not my idea of a risk adverse industry and ... who trusts any branch of USA.gov to make a responsible decision these days? 50 other countries being first shows how much evidence there is for that.

https://www.seattletimes.com/business/boeing-aeros...

So only one of the two available AoA sensors was used in the MCAS?

The control strategy is not AI; it's the opposite ... overly simplistic.

The Seattle Times report posted by BrianPetersen is chilling.

Am I the only one to interpret

(1) The certification authority FAA has partially or substantially delegated the safety assessment authority to the manufacturer Boeing.
(2) A design change of 400% on the limit of the tail rotation angle, from 0.25 to 2.5 degree, was implemented "after" the 737 Max8 was certified its airworthiness.
(3) The design of the MCAS can allows unlimited self-activation, possibly at the maximum permitted tail rotation, over the pilot's intervention.
(4) Both FAA and Boeing were aware of the first three issues and did nothing even before the second plane crash occurred in Ethiopia.

I can understand in (1) this is possibly a common practice in view of Boeing's expertise and FAA's lack of resources and (2) The subsequent flight tests could demand a large increase of the tail rotation to make the 737 Max8 work. However if the rumour that the recovered jackscrew, which pushes the horizontal stabilizer up and down to rotate the tail in Alistait_Heaton's supplied diagram, were true in the Ethiopian plane then the MCAS could have played a major role in bringing down both planes?

Yes both screw jacks have been found and both were at maximum travel to pitch the nose down.

A few years ago, I was working at a large heavy oil plant. This was a rebuild following a fire and the plant was down to 50% production.
Gross revenue was down over $10,000,000 a day.
In the wake of several serious safety violations by one contractor, the contractor was removed from site and another contractor brought in.
Note that there were no deaths, injuries or equipment damage. It was a case of workers being directed to do unsafe work.
The crew was allowed to remain and was directed by the incoming contractor.
Basically, all management personal were removed.
Crew foremen, who relay instructions but do not effectively have decision making authority were allowed to stay.
All management with decision making authority were removed from site.
I wonder if there will be a similar top down purge at the FAA.
That would send a strong message for a generation or so.
Does my post sound a little harsh?
187 deaths due to pressure to meet deadlines.
That's harsh.
Four months later another 157 deaths.
That's a little more than harsh.
Bill
--------------------
"Why not the best?"
Jimmy Carter

I saw an air crash investigation of the TAM Fokker 100 that crashed in Brasil in 1996, something struck me as similar. A safety system that pilots were not trained on functioning in an unexpected way during take off. On the Fokker 100 it was a safety to reduce power to an engine if the thrust reversers deployed during flight, pilots at TAM weren't aware of that function so they fought the reduction in power as there was no warning of thrust reversers being deployed. On the 737max the MCAS system is meant to keep the aircraft in the flight envelop yet the pilots were not aware of a system and the way it functioned (granted every max pilot should have after the lion air accident).

Is there a readout somewhere of what angle trim settings are at during flight available to the pilot and FO? The manual trim would be spinning which should be a key to the pilots decision but if they think they've countered it with the electric trim switch but haven't fully countered it (1.5 degrees up every time MCAS commands degrees nose down), what in the cabin (apart from looking out the window) would shout that the trim has reached maximum nose down trim (even before the aircraft is pointing nose down)?

Would an augmentation system meant to make it feel like flying the NG really need to access the full stroke of trim? Is there even position monitoring of the trim ram that is fed into the FCCs?

Saikee,

I tend to agree with you.

The key issues coming out seem to be the significant change in max angle from 0.6 to 2.5 degrees and the clear lack of understanding that this system refuses to die after effectively being cancelled and also keeps increasing the trim until it can't increase it anymore. For it to work "in the background" and not advertise itself in any form as a light, warning buzzer or similar is clearly key also in terms of pilots not understanding what is going on with probably a host of other alarms and errors popping up all over the panel.

The desire to both get a certification and also make the system appear identical to earlier versions is the thought process which goes wrong as well as only using a single sensor and not recycling the decision when the parameters change implies a lack of frozen design or poor Management of change procedures.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

There is usually a trim indicator which needs set for a CoG position prior to departure. If it s not set within a certain range a config warning sounds when the aircraft thinks your about to go flying. If you get it wrong it may mean that you can't lift the nose off the deck if its trimmed to far forward or if its to far rearward the plane will start to pitch nose up before you get to rotation speed which may cause a tail scrape.

If the aircraft thinks its stalling there are multiple alarms both tactile,visual and audio, The stick has a vibrator on it which shakes it which creates quite a loud noise, there will be main caution light flashing and also a indicator which side of the aircraft is about to stall. There are three modes normal flight with nothing going. incipient stall with caution lights and stick shaker. Then full stall which is the master caution and a stick push which shoves the nose down in types which can develop into deep stall. There are links to the rad alt with cut offs of the stick push to prevent the nose getting shoved down in the last x amount of feet before landing which varies with type.

The stall system going off is extremely attention getting. The flight deck will be extremely alive with multiple warnings going off, it would be pretty easy in my opinion to miss the trim wheel moving un-commanded.

Alistair_Heaton is on target, from my perspective. On the ground with the pilot reading a manual or using CBT for familiarization, it is easy to understand, "If the trim appears to be arguing with the intent of the pilot, use the STAB TRIM CUTOUT switches." But takeoff is already well known among pilots as a high workload phase of flight with plenty of factors capable of killing you. As such, taking the wrong action during takeoff can be as bad or worse than doing nothing. So as Alistair indicated, recognition is vital, and recognition during a very busy flight phase is difficult. Also as Alistair noted, the trim wheel and indicators are well down out of the line of sight unless the pilot takes their eyes off of the outside horizon or the control instruments, whichever is being used to establish their situational awareness.

Using the Lion Air preliminary report from the authorities, the Lion Air accident aircraft had the same activation of the MCAS during the flight just the day before. While maintenance cleared the issue by following the manual, apparently the true fault was not corrected. The accident flight crew would have had the aircraft log available for review, but there is no way to tell if the wording of the log communicated to the accident crew the true circumstances, and most importantly, the actions taken by the previous crew which resolved the trim runaway and allowed for continued safe flight. It is unlikely that the two flight crews had the opportunity to speak directly to each other.

So for a recap (admittedly abridged) and an application to the Ethiopian accident:

1. STAB TRIM CUTOUT switches to stop any type of runaway trim have been available on the flight deck of commercial aircraft for decades. Trim runaway would be defined approximately as, "The trim is moving when it should not be moving, or is moving in a direction it should not be moving." It does not matter if the MCAS is moving it, or some other system failure is the root cause. At that point a typical pilot would not care about the root cause, they just want to stop the runaway. Thus, STAB TRIM CUTOUT switches exist. Pilots likely have an "official" definition that is better than mine of trim runaway - but I think I am reasonably close.

2. IF (and this is the big IF) the Lion Air accident crew and the Ethiopian accident aircrew recognized trim runaway then they should have already been trained, as aircrews have for decades, to use the STAB TRIM CUTOUT switches.

With all of the above being said, unless they were unaware of the Lion Air crash with trim runaway as the preliminary target of the investigation, it is difficult to understand why the Ethiopian flight crew did not actuate the STAB TRIM CUTOUT switches.

The airframe problems with newer aircraft or should I say the flight controls, were essentially a non issue in the older days of aircraft. The main problem is electronics and computers, the lack of manual systems like the days of control cables, and using a motorized or servoized jack screw to pitch the tail plane or horizontal stabilizer. DC-3's and DC-7's and other such aircraft used a controllable trim tab, not the whole tail plane, just like a small aircraft and if for some reason it got stuck the pilot could still over ride the effect. I am thinking even if with this max 8 situation, if the pilot knew what to do to prevent the dive into the ground the flight control system would very likely not allow him to do the required maneuver.
The fix for the dive would have been to invert the plane, scary yes, but still better than diving into the ground.

The main question is: How come even with full nose down tail plane the controls ie the elevator could not over come and counter that effect?
My guess is, the flight control system won't allow it. There is always a simple solution to problems like this. Back to the good old system, control cables and fixed tail planes.

If that's the case, its a crappy control scheme in a life or death application. To me that's not a good instance of "back in the good ole days things were simpler", it's just an overall poor design.

I may be inaccurate in detail, but qualitatively speaking, the last two large aircraft, (AFAIK, maybe there were other contemporaries, e.g. from Tupolev), that had unpowered main controls or full manual reversion in the event of power assist failure, were the Bristol Britannia and the original Boeing 707. These concepts did not persist into succeeding generations of large aircraft, as they had their own drawbacks, I suppose, high control effort possibly being one, and lack of direct linkage (i.e. servo controls) being another. Hence the introduction and eventual ubiquity of fully powered main controls on large aircraft.
In general, the large aircraft manufacturers seem to have gotten it right from the late fifties until recently.
I remember the 737 (or was it DC-9?) had some kind of mechanical issue with the elevator jack, several decades ago, but that was a design or material issue, not a conceptual issue, IIRC.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Not sure this adds a ton to the discussion. But, for the folks who don't know much about jet planes and such, Juan Brown's channel on YouTube (blancolirio) has some good discussion about these 737 crashes. Juan is a commercial airline pilot (777) here in the US and came to my attention with some good reporting on the Oroville Dam spillway issue and construction.

https://www.youtube.com/user/blancolirio/videos

I am wondering how those AoA sensors ever got approved.
Not a very good MTBF (Mean Time Before Failure)
And not a very good MTBF (Mean Time Between Fatalities).
The first delivery was a MAX 8 on May 6, 2017,
Second crash was on Mar 10, 2019
That's 344 fatalities in 673 days.
Even factoring in the 350 Max 8s flying it is not good numbers.
Then add in the several failures of the AoA sensor that did not result in a crash.
Are these sensors new to this aircraft? If they are used without problems on other planes, why are they failing on the Max *.

Anecdote. A friend of my wife's was visiting today.
I overheard her mention to my wife that she had phoned WestJet concerning her upcoming Mexican holiday.
She wanted to be reassured that she would not be flying on a Boeing plane.
In the end the market place may deliver the harshest punishment to Boeing.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Thank you Alistar,

Is it possible that MCAS is triggering before any stall warnings are active? I know we are limited on the knowledge of MCAS system but if it is activating only from AoA input (lion air had faulty input for some reason), What does the FCC use to determine stall? Lion air had the stick shaker active the whole flight from memory so they must have been dealing with false stall warnings.

The MCAS system could have been employed effectively to simulate the handling of the NG aircraft. From my perspective MCAS should have greatly limited authority, and a limited range (50% of nose down trim or whatever is counter-able with stick pressure to keep the aircraft level).

This whole situation to me boils down to

• An underestimation of the risk associated with the MCAS system (which may have been fine if it was limited to 0.6 degrees per activation or been prevented from driving the stabilizer to full nose down)
• Uninhibited authority off the MCAS system leading it to command trim inputs (requiring pilots to counter it and ensure they've arrived back at the correct trim setting)
• Reliance on a procedure for runaway stabilizer (can present much different symptoms?)
• Reliance on only (one) AoA input for MCAS activation
• Pilot confusion over strange symptoms (poor documentation and training)

There may have been things that the pilots could have done to save the flights (see previous flight of lion air) but a system like this should never have been approved. Another thing that annoys me with the MCAS is that it's to simulate the NG 'feel' during high AoA maneuvers yet it's supposed to only trim nose down, so after any high AoA maneuver ( yeah take off is probably it in a normal flight) Trim needs to be reset by the pilot to what they would consider normal. I'm guessing this is something that MAX pilots must have experienced and noted that it is different to the NG? If not is it safe to say that MCAS isn't actually required or could be significantly limited to low levels of trim adjustment? As normal operations wouldn't normally see it activate and higher AoA conditions should still be within the flight envelop otherwise this would instead be a stall protection system which I'd assume would have a greater risk profile.

debodine - You bring up a point that has made me wonder if there is a bigger issue that has remained hidden. I would have expected the pilots to know to throw the trim cutout switches when experiencing runaway trim. So, I'm finding it difficult to explain why they struggled for minutes counteracting runaway trim without throwing the switches.

enginesrus - In this case, Turning the trim cutout switches to the off position and then using the manual trim wheel instead solves the problem. So, the solution is to revert to manual controls, just like you want.

I only have access to the same info as you how the MCAS system works... Which is the same as the pilots who were flying them.

Just some points through about flight controls.

I have flown unpowered controlled aircraft the Jetstream 31/32 and 41 the 41 is a 10 ton aircraft. They are firm and relatively slow response and you get a good work out on a high wind approach. When you move to bigger aircraft the control response is approximately the same weight but the forces involved normally are the same. this is done via what's called a feel unit which applies a force to the controls which varies with the airspeed. If you say have a hydraulic failure its a whole different ball game your talking two feet braced against the panel and pulling with both hands to move the elevator backwards to flare to land.

FBW is a different ball game which i have zero experence with outside flying a Airbus sim a couple of times. I don't want to comment about it. Mates that have flown them say the first 3-4 sessions in the sim are a bit wierd but you get used to it and after that it no problme but its a different way of thinking.

Now the reason why they had to have the MCAS system. The leap engines are extremely effecient. We had 737 classics fleet and also CS300 fleet the CS fleet uses 1600kg of fuel an hour the 737's its 2400 kg an hour. The fuel savings are collosal. The leap engines are a geared fan and the fans are huge. This means the engine pod is huge. So when they fitted them to the NG wing they didn;t have enough ground clearance. SO they raised the gear height and to get more room the moved them forward and up.

737 800



737 max 8

now if you look at the shots above its pretty obvious the geometry changes that have needed to be done.

The leading lip of the nacelles if significantly forward of the leading edge of the wing on the max.

Now what's apparently happening is when the aircraft gets into high angles of attack the huge pods which have a flat base are generating lift and because they are so far forward of the centre of lift of the main wing they are forming a moment couple in addition to the elevator. This has the effect that as the angle of attack increases the control force decreases as does the stability. This is completely against certification rules. As you get closer to the stall the control forces should increase and the stability increase with the aircraft having a natural inclination to lower the nose to decrease the angle of attack. In all cases in the event of a stall in straight and level flight if the pilot lets go of the controls the planes stability should mean that it self recovers ie the nose drops and the angle of attack is reduced.


This wasn't the case with the max with those engines. So they stuck a computer fix in that altered the trimming of the aircraft to produce forward trim as the angle of attack increased. That in itself I don't have a problem with really. What they didn't do is then complete the risk matrix to look at how the Angle of Attack is measured and the failure modes. We tend to have three of everything for critical systems.


Take Hydraulics for example: we have a separate system powered by each engine with either a backup electrical pump or a PTU from the other system or both they are powered from the main electrical buses with pumps fitted to the ancillary gear box . We also have an emergency system which is completely separate which is powered by a DC pump off the emergency battery bus and on these big jets that will be linked to the ram air turbine which is a little windmill that pops out the side of the plane in the event of power failure of both engines electrical supplies (again 3 systems) it has an accumulator and the pump charges it so you have enough pitch authority to flare to land.

The MCAS took its input from 1 AoA sensor of which there are only two fitted so no way of determining the odd one out in the event of a failure. No comparison indicator warning on the flight deck as standard between the two sensors. All other critical flight instruments again follow the rule of three. And all the rest will trigger comparator warnings if there is conflict in the readings, then the pilots can look at the separate system and two out of three win and the faulty reading can be deselected.

Realistically I can't see a fix for the engine lift issue without a complete redesign of the wing and aircraft geometry.

The instrumentation the minimum I can see is them having to fit a third AoA vane. With that it requires a huge rethink of the avionics software. The retrofitting a 3rd vane will not be easy either.

After that pilot training needs to be revisited and there needs to be more than just a 2 hour CBT. And simulators need to programmed for the MAX currently there is only one in Seattle everyone else does their 6 monthly training on NG 737-800 sims which I believe have MAX performance programmed into them getting rolled out but don't have the MCAS system simulated.


Realistically the safest option is to kill the grandfather approvals based on old type approvals. But that would significantly increase the costs of new types in the same product lines.

To note flying an transport cat of aircraft inverted is an extreme solution. As pilots we are not trained to do it. The systems are not designed to operate under prolonged negative G. They are not tested to do it.


For them to be able to do it then the complete interior of the aircraft would need to be redesigned for negative loads the additional metal required for the seats alone would put so much mass onto the airframe it would be uneconomical.


The aircrat should not be designed in such a way that its required.

Why can the trim greatly exceed the elevator control on a computer controlled flight system?

Answer: So the government can take over the plane and plant-it from the ground if needed. [/conspiracy theory]

Keith Cress
kcress - http://www.flaminsystems.com

Oh lord is that the nonsense that they are coming out with now?

Its bad enough when you get a flat earth or chemtrail nutter on board.

The flat earth sit with a spirt level in flight filming it with their cameras.

And the chemtrail lot try and take samples of everything including the crap that comes out the drain valves at the bottom of the fuselage onto the ground. which is the accumulation of sweat and breath moisture which condenses on the inside of the hull in cruise and then melts and runs down to the bottom and drains out the spring valves when the plane is not pressurised.

I was flying an aircraft with a water meth boost kit for hot high operations. The tank was visible in the rear hold when pax were boarding. I thought one guy was having a sexual experience in his pants walking up the steps trying to get pictures of it.

This apparently what it does to the stability

Yeah, that was insisted at me by an engineer.

BTW: Juan Brown put up a pretty informative vid on the trim equipment showing it running.
YouTube 737 MCAS

Keith Cress
kcress - http://www.flaminsystems.com

first words that entered my head when I read your post was "software...applemac"

Alistair,

A great explanation as usual.

It seems to me that Boeing are not in a good place with this design and explains why there was no quick fix following the lion air crash.

In order to follow the certification rules and prevent a runaway stall they need to modify the flight controls and their only means seemingly is to actually alter the flight control surfaces and not the flight controls.

To do this though using only one of two AoA sensors and then having to increase the action from 0.6 degrees to 2.5 degrees has been disastrous. Sure - there are ways to prevent this leading to destruction but it is clear that with all hell breaking loose in the cockpit, stick shaking, alarms, the plane seemingly having a mind of its own and one or two quite hard to get to switches a procedure built approach to a sensor or computer fault isn't working. This (the MCAS system kicking in) was not the only thing going on and both planes apparently had to deal with faulty or discrepancy in sensors which could easily lead to confusion as to what was happening.

I don't see any easy way out which will allow a quick return to operation and keep within the rules of certification. Fix one problem and create two more.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Also I am being told that this idea you can use the trim cut offs is a bit simplistic.

Yes you can shut them off.... but and its a big one.

The manual trim unpowered requires a handle to be folded out from the trim wheel. Then the thing wound for minutes to get it back from the full pitch forward position to something nearing what you actually need and its relatively easy to still control the aircraft.


I am reliably told by the classic pilots at work even if pre prepared for it, the FO built like a grinder on a volvo ocean race crew your going to loose an min of 6000ft until its sorted. Normal people who aren't pissing about in the sim its more likely 10 000ft.

Man itsmoked, I was really hoping you were just kidding. That's depressing.

Alistair - Man that is not good.

I thought it might take longer clearly if there is no electric power, but 6, to 10,000 ft....
So unless you manage to hit the off switch just after you've manually thumbed the trim switch back to near level then you're done for at low altitude??

I saw somewhere that the final nose down on Lion air was because the FO only flicked the trim switch up instead of holding it up to regain trim back to near level and then the MCAS kicked in again.

It seems as though the manual trim up switch on the yoke doesn't work while the MCAS is busy winding it down. Can anyone confirm this?

Maybe the same happened on ET with a low hours FO taking over while the captain tried to work out what was going on.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Your pretty much done with most control issues at low altitude.

Which is why we tend to head upwards like a fart in the bath to give us room and potential energy to deal with things.

The electric trim switch should kill the MCAS system for a period of time. Then it resets and does its thing again. Sorting out what's actually going on with all the bells and whistles going off is shall we say intense.


Another thing is that if the stick shaker is triggered that usually kicks the auto pilot out. And as soon as the auto pilot is out the MCAS system kicks in if the flaps are up.

A friend clued me into reporting by Dominic Gates, long-time-all-things-Boeing reporter for the Seattle Times...

Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system
https://www.seattletimes.com/business/boeing-aeros...

Reporter told Boeing, FAA of possible safety issues with 737 Max four days before fatal plane crash
https://www.philly.com/news/nation-world/boeing-ma...

Also, 'Sully' Sullenberger had s some words of concern regarding Boeing and the flight crew... specifically the 200-Hr total time copilot...
Captain Sully Weighs In On Boeing 737 MAX Crash
https://liveandletsfly.boardingarea.com/2019/03/16...

There have been several incidents of runaway/uncontrolled stabilizer-trim systems causing mishaps... some caused by jack-screw-stripping failures due to maintenance... some due to inadvertent trim actuation by non-pilots in the pilot's seat [yes-gag-for-real] and these... 737-Max that [at time] appear related to flight control software 'bugs'. Hmmmm... maybe this is why Southwest Airlines maintenance was being fined by FAA for poor practices regarding weight and balance calculations?!

The term 'sneak circuit' applies whenever circuit-designs create unintended electrical/electronic pathways. There appears to be an equivalent concept for computer code... 'sneak-computer-code' or 'sneak-software-code' is very real... leading to unintended consequences if not fully/completely vetted by simulations and flight testing. This 'sneak-software-code' is relevant to aviation as it has been to space exploration.

NOTE. At-least-two-possibly-three Mars orbiters/landers have encountered catastrophic software bugs... and of course there was [quietly covered-over] software bug for the Huygens-probe that landed on Saturn's moon Titan.

NOTE. RE the Huygens probe... the highly calibrated/sensitive transmitter [for precision Doppler tracking on atmospheric entry and parachute descent]... and which was connected to certain sensors and a second landing camera system... was turned-on in 'stand-by mode' to warm-up... but the computer code sequence failed to include a 'turn-on the transmitter and send-data' command-line... so all of that channel-data was 'lost'. Good-thing that the non-precision transmitter worked 'well-enough' to send good quality images/sensor-data and good-enough signal data for Doppler tracking/images.

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

I will admit I fly with 200 hour fresh meat in the cockpit. And I also fly with 1500 hour fresh meat in the cockpit.... To be honest they are both clueless until they get a couple of 100 sectors under their belts sector length doesn't change things. This whole hours as a gauge is utter bollocks. I have 8.5k hours with an average sector length of 1 hour. A mate that went heavy early but qualified at the same time has 9000 hours with an average sector length of 5.5 hours. Giving him 950 landings when he has been at the controls. I have way over 4000 landings in commercial aircraft who is the most experienced? Mind you he is still a first officer and I have been a Captain for some 12 years now. I fly regional turbo prop short haul.

If you stick a pilot with 2000 hours single pilot single engine into a multi crew transport aircraft they are in the same state as a 200 hour out of school pilot. They both need 150-200 sectors before they know what they are doing. And there is only way they are going to get that experience.. Fly with bald grumpy moaning bastards like me. Don't worry I do try and fill there heads with the reason why we do things the way we do and it not because I said so.

Lets face it... its exactly the same with baby engineers...

Alistair_Heaton ... don't recall hearing Your name... but interesting/valuable comments...

"Lets face it... its exactly the same with baby engineers..." .... SOOOOOO TRUE!

My dad was a fighter pilot and long-time GA pilot... He always expressed doubt at how much time-experience a bomber or transport pilot and copilot should actually record... especially when they had the luxury to eat or drink and leave their seats to go to the head... etc.

A couple of favorite quotes comes to mind...

"Flying is long hours of boredom, punctuated by moments of stark terror." [paraphrased, W Churchill]

"Experience is a cruel teacher. First she gives you the test; then she teaches you the lesson.” [often cited version of Vern Law’s quote]

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

Fast jet ex mil have other issues in commercial transport. Some of them get over them and are a pleasure to work with/for. And others are a danger to themselves and others.

But that's not really significant to this thread or the problems with the MAX.

But it does highlight the liveware aspect to most issues in aviation. Its how the operator interacts with the hardware especially when it goes wrong that is crucial.

Haven't seen any mention of this: https://abcnews.go.com/US/wireStory/pilots-reporte...

A couple of incidents where the 737 Max nosed down after engagement of autopilot.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I wouldn't put to much into them because they didn't go through the full investigation process and were only pilot reports.

The problem with pilots reports is in the heat of the moment our memory's are not very good because our bodies are putting all the resources into reacting. We all experience this in sim debriefs the TRE starts going on about something that happened 4 hours ago and you really can't remember what you did after the session. Which is why the more progressive company's video them and we can watch them in the de brief and they are then deleted in front of us.


Here is a similar nose down incident on my type...... was it a problem with the aircraft... Was it hell.

https://assets.publishing.service.gov.uk/media/5bc...

Unless the FDR is pulled and they run it through the variable machine nobody has a clue what was going on. BTW in my area of the world all our flight data is pulled for every flight for set of variables. And it has to go through a quality process to ensure we are not flying like cowboys. But that data doesn't have the same number of variables as the FDR.

I am wondering about the initial trigger.
Why are those AoA sensors failing so frequently?
Are they a new type used only on the Max8?
Is it a problem with the mounting location?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Aside from the Lion Air flight which had documented maintenance issues, I don't think it's confirmed the sensors are failing (or is it?)

Don't forget it could be purely a SW problem too. With complex systems people often scream hardware when it's actually software.

Keith Cress
kcress - http://www.flaminsystems.com

Quote (AH)

It's how the operator interacts with the hardware especially when it goes wrong that is crucial.

KC beat me to it.

I was going to mention that you spelled "software" incorrectly.

The design decisions made in this example will become 'poster children', or case studies. Both hardware and software. And certification.

Sorry the way I was using the term is in relation to the shell human factors model.

https://en.m.wikipedia.org/wiki/SHELL_model

When you live and breathe this stuff its easy to forget that people might not know.

In current developments, there seems to be some troubling logic.

First
The rudder increment of 2.5 deg shall be reduced back to something alike the original .6 deg, but: it has has been altered for a reason! As is it said that it became necessary during testing, for stall protection, this runs in a circle. Meaning: You'll not have the needed feature in that other flight situation, as .6 deg increment has been proven to be too low then.

Second
If MCAS is, say, mimicking a well known flight behavior of a previous model range, you can't just switch off auto during an emergency, because then you'll meet someone new: The airplane flying AS IT IS, with its flight characteristics of an elder airframe coupled with superfar forward big size modern powerplants.
Mr. Sullenberger is correct to require two qualified pilots in the cockpit, but these pilots should be able to fly two planes at the same time, them being just the flip of a switch away from each other. This seems to be high end professionalism i can't fathom to be standard all over the world.
Correct me if I'm wrong.

Third:
The second AoA sensor shall be wired in. But then: As it has not been done until now, again there might be a reason. Boeing will not have been building in two sensors and then leave one out off for decoration. If, for whatever reason, they could not make those AoA-sensors synchronize, or the coupled sensors output is so prone to failure or mismatch or whatever, the improvement might again lead to systemic failure.

This reminds the Space Shuttle story all over again. So they, they had to learn the hard way to ask: What, if there's still more to it?

The Max planes, if made airworthy again by FAA in April, shall be on a continuous trial run.
But who will trust FAA now? They don't have the know-how, they don't have the manpower, they are not independent, they don't know the plane and they don't speak up when it matters.

Finally, there's people on board. My daughter, your wife, a beloved one.. anyone!
Talk shareholder value now.
And that so many dead people do not make open any mouth with a face to it from within Boeing engineering, let alone the company as a whole, this troubles deeply.
Flying with a plane, that's about trust, in engineering, and certification.

Roland Heilmann

It's all about trust and the trust is gone;
I first posted this in the other 737 thread by mistake.
Boeing 737 MAX to face first congressional hearing Link
Europe and Canada Just Signaled They Don't Trust the FAA's Investigation of the Boeing 737 MAX Link

Bill
--------------------
"Why not the best?"
Jimmy Carter

The poo is getting more intense for Boeing.

I am European but can only imagine the law suites that will be getting prepared.

https://www.seattletimes.com/business/boeing-aeros...

Quote (Alistair Heaton)

The poo is getting more intense for Boeing

From the article:
The FBI’s support role was described by people on condition of anonymity because of the confidential nature of the investigation.
The papers always have an anonymous source to quote.
Congress has to get involved, because well, that's what they do.
My money says no criminal charges will ever be filed. Boeing will pay some meager fine and one of the world's most popular and safest aircraft's reputation will be besmirched forever.

Brad Waybright

It's all okay as long as it's okay.

ROIMEC,

I think you've got it correct.

That's why Boeing didn't rush out a simple "software fix" because when they looked at it closely and, maybe, reran the safety review and analysis with the data they now have and are using, they realized that it didn't work.

To maintain the classification rating they need MCAS.
A faulty MCAS is now, most definitely in the catastrophic rating for safety
Therefore the input sensors now need to be at least one order if not two order of magnitude more "reliable" and able to self diagnose and take the correct reading before activating as it needs to and ONLY when it needs to, not spuriously.

How the pilot can override it to again not prevent it operating when it should becomes very tricky. Make it too easy and you could get planes stalling when they shouldn't - equally bad news.

I don't envy them.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

"My money says no criminal charges will ever be filed. Boeing will pay some meager fine and one of the world's most popular and safest aircraft's reputation will be besmirched forever."

Add that to the points RolMec made, and it adds up to another 737 Max 8 crashing.

Well safest apart from the hard over rudder issue. Which they only really sorted in 2005 world wide.

But your right it is a sad note to end an aircraft line. Can't see anyone touching them now. The punters just won't want to fly in them

This is growing beyond just Boeing.
With the FAA reportedly losing credibility worldwide, this issue now may have a devastating effect on the entire US aviation industry.
If the foreign regulators require the Max 8 to be certified as a new plane, it may be the end of the Max 8.
Even if foreign regulators accept the Max 8 as a modification, it still may not pass with those oversized engines and their negative effect on flight characteristics.
The reported lack of trust, worldwide for the FAA may double or more than double the approvals costs for all American aircraft manufactures for both new models and for modifications.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Has the FAA been losing credibility for a long time? Or just in response to their delayed response to ground the Max 8?

The NY times is reporting sensors and warning lights that would detect faulty AoA vanes are sold as extras. Neither of the crashed airplanes had them installed:

Link

Quote (RVAmeche)

Has the FAA been losing credibility for a long time? Or just in response to their delayed response to ground the Max 8?

The whole approvals process and the delegation to Boeing of critical safety analysis.
The FAA apparently allowed Boeing to self approve an apparently flawed system.
I am wondering also if and when we will hear allegations of improper political influence on the FAA, and the FAA yielding to outside influence.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I have a few dumb questions. With the plane in the air at 200+mph, is the angle of attack really that different from the angle of the airplane relative to a level line? Couldn't the AoA sensors be roughly checked against the direction of gravity? Or would it be too rough to be useful?

Quote (HotRod10)

I have a few dumb questions. With the plane in the air at 200+mph, is the angle of attack really that different from the angle of the airplane relative to a level line? Couldn't the AoA sensors be roughly checked against the direction of gravity? Or would it be too rough to be useful?

I was thinking along the same lines. There must be some other condition that could be used to check or limit the MCAS if the AoA don't agree. I know we had the discussion about the usefulness of GPS earlier but suppose you could check the vertical velocity component of the plane. I mean why should MCAS continue to push the nose down if the aircraft is already traveling downward at over 10,000 fpm (ie crashing).

Quote (waross)

The whole approvals process and the delegation to Boeing of critical safety analysis.
The FAA apparently allowed Boeing to self approve an apparently flawed system.
I am wondering also if and when we will hear allegations of improper political influence on the FAA, and the FAA yielding to outside influence.

For sure, I was just wondering if there were other recent instances/incidents that have been building up against them.

For an extremely limited set of parameters you could construct a table of predicted AoA for airspeeds and weights. Basically a 2 D model.


As soon as you go 3d turning it falls over. As soon as you add in power changes it falls over.

And the biggest witch of all is.... Mother nature up drafts down drafts windshear.

Still air, flying straight and level you could do it.

You want to hit certain angles of attack for efficiency. The airspeeds these occur at vary with weight.

And when you get up high you start getting limited by transonic flow over bits of the airframe which is related to air temperature.
As you get higher the air density drops so for a given AoA the speed is higher.

Eventually you hit what's called coffin corner where if you go faster you get sonic shock waves forming taking out the rear control surfaces and if you go slower you go higher than the critical angle of attack.

And the pilots do check ruffly by setting an attitude. We teach it as pitch plus power equals performance. So for each phase of flight we know what the picture should be either looking out the window or looking at the attitude indicator. You don't actually need any instruments at all in a light single engine piston aircraft to fly it once you know what your doing. You set power by ear and you know what speed your doing by the picture.

Actually your structural..... its none linear geometry

The direction the aircraft is pointing bears no relationship at all to what angle of attack of the wings to the airflow.


IN aerobatics we are quiet often pointing 60 degs up but the aircraft is not stalled. During a spin we are pointing straight down to the ground and everything is stall apart from the rudder.

Just look at a video of a loop or a barrel roll. At no point in those exercises is the plane stalled.

This is the famous one.

https://youtu.be/Ra_khhzuFlE

A MAX8 costs $127M why wouldn't they have three AoA sensors voting? How is the price of an AoA sensor even relevant?

Keith Cress
kcress - http://www.flaminsystems.com

Because if they added a 3rd sensor in it would come away from the 1960,s type approval. PLus it would have meant that the pilots would have had to do a bit more than a 2 hour CBT which was a huge selling point of the MAX for NG operators.

I don't know of any aircraft with 3 vanes to be honest. They are about 500$ each on my type. They will be cheaper on the max because they will be the same as on the NG so economies of scale.

I guess I don't really understand the "type ratings". I don't see how an additional sensor would alter a 'plane type' or 'controls system type'. I could see how a joy stick would change things from a yoke, but a redundant sensor?

Keith Cress
kcress - http://www.flaminsystems.com

The whole Avionics would have to get reworked and it would be a first. Normally they buy in the avionics system from somewhere else eg Honeywell. Which has its own approval they just need to get it approved for the type. With that the avionics would have to go through a full approval as well.

The whole type thing is a bit of mystery to me as well and what requires a new rating, what just requires differences training and what just needs a 2 hour CBT.

For my type the Q400 was meant to have hot wings and most of the engine control stuff done through buttons in the cockpit and it could have also had auto throttle.

But it was decided that if they changed that then it would be a new full type rating which is 3 weeks ground school and 10 4 hours sessions in the sim followed by 4 hours skills test and either another 4 hours in the sim or 4 circuits in the live aircraft.

So they ditched them and it was 2 sessions in the sim and a company differences exam for anyone with a DH8-100,200 or 300 rating. the 100 is nothing like the 400.

The whole point of this stretching and using old type approvals is to do as little additional approvals and certification as possible. So they try and use as much from the previous as possible and only then test and certify the changes. If a new requirement comes along as long as they don't change the system that had prior approval then they don't have to include it. eg control disconnects on the 737, for the last 30 odd years your meant to be able to split both roll and pitch in case of control jams and have duplicate control runs. No requirement in the 60's so the Max doesn't have them now some 57 years later from the first 737 approval. The 787 has them because its a fresh type approval. I don't think the 747-800 has them either.

Quote:

Because if they added a 3rd sensor in it would come away from the 1960's type approval. PLus it would have meant that the pilots would have had to do a bit more than a 2 hour CBT which was a huge selling point of the MAX for NG operators.
I don't know of any aircraft with 3 vanes to be honest. They are about 500$ each on my type. They will be cheaper on the max because they will be the same as on the NG so economies of scale.

By now, this kind of re-certification could be on the table. Boeing is contending with not NEVER delivering hundreds of aircraft. The stakes are high in this game, in the billions.

The cost of the sensor is hardly an issue. Any number of shops could do a hardware installation kit for one of those, for the cost of a few tanks of fuel. Feeding the data in a meaningful way into the MCAS system, then rewriting the software from SCRATCH because it needs a new criticality class would cost millions. That task is beyond the ability of many players in the aerospace industry except those that routinely develop software-driven hardware. I haven't heard yet exactly who developed the MCAS system (I would expect it to be a 3rd party, but it could be Boeing engineers, not making assumptions) then that team working flat out would need more than a year to finish unless they got a LOT of help and had the eye of Sauron on them.

What Alistair is talking about is commonly called "grandfathering" or the continuation of certification rules from a set date in the past. There are good reasons for this practice to continue because 99% of the time changes are minor or don't affect the level of safety in operations. It's that 1% of the time that the change tips over. When doing certification, we regularly do an evaluation of the scope of any change, to determine if it requires a re-evaluation of the certification basis (Transport Canada in my case, but FAA and EASA have equivalents). If the scope is big enough, we could end up using the latest rules, rather than the rules in place when the plane was certified in the past. Even modifiers of aircraft like me do this evaluation, not just the big OEM's. For example, a substantial change would be the adoption of "fly-by-wire" in a previously mechanically controlled aircraft. Other kinds of changes can skirt the edge (but don't usually cross it) like conversion of the interior from passengers to all-cargo, fuselage stretch, or changing from steam-gauges to an all-glass cockpit. If that cargo conversion includes extending the doors, it tips over. If the all-glass cockpit were to reduce the crew workload that you could eliminate one of the pilots, that would definitely tip over an old plane into a re-evaluation under the current rules. That's how the Q400 was grandfathered despite its stretched fuselage.

I've long been convinced that the 737 of today is drastically different from the 737 of 1970. There are some barriers that would be very difficult to cross if the FAA forced Boeing to apply for a new type certificate, using current certification rules to the 737 airframe. Most obvious to a structures guy like me is that after 1970 the required crash loads were changed, but the 737's are all designed to the original levels. In some conditions the floor structure would need to withstand 50% more load to meet today's requirements. There may be a margin of strength already built into the floor structure, so maybe it wouldn't need to be made 50% stronger, but still SHOWING it and fixing the shortcomings are not trivial jobs. This kind of check-and-fix procedure would be required for all points of the design. It would probably not be worth saving, and cheaper to just start with a clean sheet of paper.

For those still reading, here's a mind-bender: The current practice of evaluating the scope of a design change to see if it invalidates the principles in the original design is a rule that came in during the late 1990's. Since the 737 stretches were also done in the mid-1990's they were completed before this new rule came in. If Boeing had tried the NG's after the changed-product rule was introduced, I don't think they would have had such an easy time.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Follow up:
Has anyone read the Wikipedia page about the Boeing 737?
Has the marketing department of Boeing re-written it recently due to all the attention, or has it always been that way?

Some of the language:

Quote:

The 737 was originally envisioned in 1964...
The primary flight controls are intrinsically safe...
In the event of total hydraulic system failure or double engine failure, they will automatically and seamlessly revert to control via servo tab...

Only a MBA could write this drivel.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Thanks SparWeb Would you by any chance have anything to do with the Q400? I am due to move to the CS300 some point this year.

For someone not involved in aircraft in any way except as an occasional passenger, and as someone who has always considered Boeing planes to be better than the others, I just wonder if there is an explanation as to why these two, or three, events occurred, while there were many uneventful flights. What was different? Are some airline pilots that much better trained so that they avoided or dealt with this issue? Or something else?

Human factors is a huge part of most fatalities. It is extremely rare with hindsight that if a human involved had taken another course of action then it couldn't have been avoided. Be that human a loader, technician, ground handler or mostly pilot. Everyone concentrates on the stick monkey. But us stick monkeys know fine that its a huge team effort to get an aircraft from A to B safely. Every human is different and training does play a major role and culture of the nationality and company. Some of us can trouble shoot faster than others but there is a limit to what you can expect the human body and brain to process. We are not super human and not all pilots can have the talents of Neil Armstrong. The aircraft design has to be for the lowest acceptable level of operator.


Now we usually look at the fatalities per million flight hours for an aircraft type.


In its day Concorde was considered the safest aircraft type out there because it had zero fatalities. Then one day one crashed and killed everyone. Because it used to fly relatively few hours compared to other types it went from top of the list to technically the worst in the space of 8 mins.


The MAX has been flying less than 2 years and 376 have been delivered. lion air 189 SOB and Ethiopian 157 SOB. Being extremely generous calling it 18 hours per day for 2 years for each airframe gives 5 million flight hours (this is extremely high its more than likely barely half that).


But that gives fatality rate of 69 fatalities per million flight hours. That is ridiculously and unacceptably high even with my completely inaccurate but very forgiving estimated number of flight hours flown already.

Bombardiers CS300 have produced less aircraft in that period the type flys less hours and has a fatality rate of 0.

The average value for airline transport or part 121 as the FAA calls it is 4.03 fatalities per million flight hours 1998 to 2007.


http://www.planecrashinfo.com/cause.htm

As for if Boeing is better... its historical and company mergers and changes in managment mean that in some ways they are living off the reputation of a completely different company in history. These days there are no bad aircraft that are allowed to fly. They all have there plus points and thier bad. Economics is a major factor in the type a company wants to use. Its the same with the engines as well which are counted seperately to the Hull. In some ways Rolls Royce is living off historical reputation these days as well.

I have never flown an Airbus or a Boeing but wouldn't have a problem if i was told it would be my next type. If i was told it was going to be a MAX I think I would go and get another job thanks very much. 757 with RR engines I think I would have a little sex wee and be prancing around like a 5 year old for days. A380 i would be looking for another job as well but for other reasons.

Alastair and spar Web. Your contributions are what makes this site worth reading above many others and thankyou for your insights.

Hokie, It seems to be a result of faults in sensors. Their failure rate is known and the more hours that are flown the more likely one will fail. Apparently in the previous lion air flight it took a jump seat pilot who was able to detach probably a bit from the overload on the pilots to see what was going on and recommend a course of action that averted disaster. He wasn't there on the next flight.

Now why that sensor wasn't just replaced and not just "tested" is all down to time cost and possibly low amounts of data going from pilot to maintenence technician as to the fault.

I think the key issue here is that previously a faulty AoA sensor might have kicked off anti stall warnings but not taken control of the aircraft without warning or apparently knowledge of the pilots.

Why was that MCAS required? To keep the flying characteristics of the airplane close to its predecessors after doing some fairly major engine mods which have significantly impacted those characteristics.

It's getting pretty clear that there is no quick fix for this issue but I just can't see Boeing going back to the drawing board. It could break the company.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

In the old days they used to have flight engineers to sort things like this out. All the stick monkeys had to do was keep the thing flying.

The FE ran all the checklists and had a far great depth of knowledge about the systems than pilots do.


But as the designs got better, the quality of the parts got more predictable they got rid of the position. Some may say bring them back but before that we used to have navigators and radio operators. Do we really need them... No.

The accident stats have been decreasing since they have all been removed.

But now the focus is on the Design of the aircraft. If its not fit to be operated by two normal human beings it shouldn't be in the sky.

And I to like this site because it doesn't have the nationalistic willy waving that normally occurs in aviation. Plus although I am a stick monkey I still think like an engineer and its nice to talk about these things with people that think the same way.

That's the cancellations for orders started.


I suspect they may end up scrapping the model.

From my rough understanding (Feel free to correct me, my exposure to FAA is from 10,000km) the rot at the FAA started in the 80's with giving increasing power to the manufactures, and accelerated over the last 10 or more years with chronic under-funding, unstable funding and regulation lag. There also appears to be issues with their ability to take action on unsafe aircraft, at least one AD's on Robinson helicopters blade delamination only came about after a pacific island nation spent a large amount of cash fishing all the blade bits out of a lagoon, the accident investigator was left with the impression that the FAA knew all about the critical issue but couldn't take action without evidence from an outside source, mention was also made about underfunding of NTSB resulting insufficient number of accident investigations being undertaken.

Quote (Alistair_Heaton)

Human factors is a huge part of most fatalities. It is extremely rare with hindsight that if a human involved had taken another course of action then it couldn't have been avoided. Be that human a loader, technician, ground handler or mostly pilot.

Depressingly much of what tends to be credited to pilot errors is actually bad design, the Airbus side sticks is a classic come to mind.

For those that actually would like to see the certification quagmire that the 737 max has become the applicable section starts at page 68, the certification table starts page 71, on other aircraft it can consist of little more that all regulations applicable at amendment XX.
https://rgl.faa.gov/Regulatory_and_Guidance_Librar...

The certification grandfathering drives some odd features, on a cargo converted 737 classic the cargo barrier is at a higher certification amendment than the aft side of the cockpit wall, so after a few attempts the conversion design orginisation put aft facing seats for the supernumerarys on the cockpit wall because ones forward facing ones on the cargo barrier would have been to a higher spec and hence more expense.

"Depressingly much of what tends to be credited to pilot errors is actually bad design"

And a bad design in the first iteration is known about but progresses through 50 years with soft fixes through training instead of changing it through grandfather rights because it is cheaper than fixing it because the end user pays for training.

Quote (Alistair Heation)

That's the cancellations for orders started.

That's interesting. I work at a sub tier supplier and our parts end up at Boeing (among others) on the 737s. We happened to have our quarterly all hands meetings yesterday and there was a long discussion about the 737 Max issues. We were told that our customers have contacted us and assured that there would be no drop in purchasing and to continue manufacturing at full steam.

Could be because we're a long lead time product... or just because they want to make everything sound rainbows and sunshine. It's worrying to see cancellations for aircraft though.

I thank you too Alistair and Spar as you've provided me with a lot more understanding of "ratings".


Changing subject a bit. If the MAX has 2 AoA sensors why didn't the calm one win? Software should've detected one changing radically and flagged it while ignoring it. Or is there only one?

Keith Cress
kcress - http://www.flaminsystems.com

Garuda is wanting to cancel 49 airframes.

5 Billion $ order.

Vietjet is also talking about it 25 billion 200 airframes

And Kenya Airways 30 aircraft at 3.56 billion.

If your parts are generic for NG and MAX product lines I can't see a drop in demand. People are not going to stop flying the NG's because of an issue with the MAX. If your product is only used in the MAX which i doubt because you state among others then things might change quiet quickly. I really can;t see it getting released for service any time soon.


"Changing subject a bit. If the MAX has 2 AoA sensors why didn't the calm one win? Software should've detected one changing radically and flagged it while ignoring it. Or is there only one? "

There is two but apparently the MCAS only uses the input for one of them per flight and flips between them.

Normally in my experience with avionics miss matches its left to the pilot to decide which one is given the correct reading. What the machine does is flag up that there is a comparison error between them. Problem with AoA is that is quiet common that they do disagree depending on the manoveur being under taken.

Airsped a difference of 5 knts, Altitude is 60 ft, heading is 6 degrees all trigger comparison errors. When it happens we look at the standby system and say that one is shite twiddle a knob and the display turns yellow to indicate we are in a reduced tolerance mode and manually have to check the standby system and we continue the flight. BUt again we are back to this 3 system redundancy. I can take one AoA vane out of the system but it requires a circuit break pull. We know its happened because we get a caution about icing gear and the low and high speed protection goes nuts. So we get a spurious stick shaker or over speed warning. After we pull it, it then takes the stall protection system out of action and I can't fly in icing conditions any more. And the plane is gorunded as soon as I land.

To note i don't know of any commercial aircraft being flown today apart from test bed aircraft and those ones that fly into hurrancanes that are fitted with more than 2 AoA sensors.

It smoked - It appears as if the MCAS only takes readings from one sensor (I think the one on the captains side). As I understand it the two halves of the cockpit - Captain and FO have a set of readings from units on their own side of the aircraft. with only two sensors, if there is a difference between them then there are alarms - the issue here is that the alarm for AoA disagree was an extra which the planes didn't have fitted (!!) Apparently these are now going to be part of the basic pack, but the actual AoA readings are still going to be an extra. Someone in Boeing is making a bad call there.

IIRC the Lion air crash reported that the captains unit was the one failing and he had the "stick shaker" active for most of the flight whereas the FO didn't.

The issue with one failing and one not is that the computer doesn't know which one to look at and hence you get all these disagree alarms going off. There is also some evidence that the airspeed signals may have been affected also from the reports from the pilot of Ethiopian airlines, but that isn't clear.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

It flips between which sensor apparently so the first flight of the day is the No 1 sensor which is the captains side then the next flight the Number 2 on the fo's side. Repeat until there is a full shut down power cycle. Which I suspect was half the problem trying to work out what was going on with the lion air aircraft. One sector the crew was saying everything was fine the next they were saying they were getting trim runaway. Get back to the ground turn the aircraft off, tech come to fix it and turn everything on to test it and everything works fine. Next flight departs and everything good pilots think great they have fixed it..... Second flight the shit hits the fan again because it was the other one that was faulty.

There needs to be a way of killing the MCAS without loosing the electrical trim system as well. That will take the Autopilot away as well.

Thanks - kind of makes sense that it would alternate inputs.

I thought that an MCAS disable button would be the way to go, but that clearly has issues in that it is a critical part of the flight control system and would disable what was designed as an important safety element in preventing an accidental stall condition. Hence solve one problem and potentially create another one.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

To be perfectly honest...

Overspeed is usually the problem with pilots.... not stalling....

I would have thought that a logic system turning it off for take off until 10 000 feet would be feasible.

With the AoA sensors being such a cheap but critical part of a system that has the potential to cause the plane to dive into the ground, I would think that mounting maybe 3 of them on each side would be a prudent move. That way, if one fails, there should still be 2 in agreement that it can use. It there aren't at least 2 matching, then the system warns the pilots and bypasses the stall avoidance subroutine.

It's not quite that simple.

The AOA sensor is an aerodynamic device. Similar to a pitot tube, It needs 'clean' air, to function; it also (unlike a pitot tube) needs to be positioned in a specific way relative to the aircraft pitch axis to function correctly.

In other words, you can't just add more next to the existing ones.

Even if you could, the software and processing hardware that interacts with these devices is, by definition, extremely complicated. The amount of traffic between systems and the level of internal code error checking is extreme. This is why third parties provide the systems- design is complicated and expensive.

Adding $2,000 of additional AoA sensors might mean literally tens of millions of dollars in additional engineering time to make them function safely. That's no comfort to the families of those lost on these flights, but it's an economic calculus that is being made either way.

Not that the AoA sensors are the only thing that could go wrong with the MCAS, but is there a way to manually switch the sensor that's being used or does it only switch automatically at each take-off?

A lot of people will not fly on a 737 Max8.
Additionally a lot of not sophisticated but worried people will not want to fly on any 737 or Boeing.
The reasoning being;
"I really don't know the difference so to be safe I won't fly on any Boeing."

Does anyone remember Konica? Not Konica Minolta.
Konica had a fully automatic, dependable and easy to use automatic exposure system in the 60s.
Konica's Hexanon lenses were among the finest lenses in the world. Hexanon lenses were selected by the Japanese government as the standard against which all other lenses were compared.
Then they released the TC-X 1985 – 1987
Built by Cosina for Konica, fully mechanical SLR
First SLR in the world with body and frame completely cast of plastic
First camera in the world that uses DX coding on film cartridge for film speed setting
It was reported that the plastic turned out to be not dimensionally stable.
This may have been public perception rather than the actual reality, but was told to me by a dealer when I questioned why Konica cameras and lenses were no longer stocked.
Konica lost the trust of their dealers and lost their dealer network.
While cameras were not Konica's only business, the model TC-X marked the end of their single lens reflex camera business.
20 years of fine cameras and one bad model ended their camera business.

If the Max8 leads to a re-evaluation of the FAA's grandfathering provisions this could mark the beginning of the end of the 737.


Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (waross (Electrical))

If the Max8 leads to a re-evaluation of the FAA's grandfathering provisions this could mark the beginning of the end of the 737.

Since FAA does not have the resources it can sublet the new evaluation back to Boeing. Have we not seen it before?

Alistair;
With respect. I am not challenging you. I am wondering whether my reasoning is valid.
I read with interest your link to planecrashinfo.
I note that mechanical failures account for only 17% of fatal aircraft accidents.
That would make the statistics on the MAX 8 about 6 times worse than your initial estimate.
But the general heading of Mechanical includes;
Engine failure,
Equipment failure,
Structural failure,
Design flaw,
and
Maintenance error.
So design flaw is only a part of the 17%.
In the table:
Notable Accident Causes by Category,
Design flaws account for only 17 out of 212 accidents.
That's down to 8% of total accidents.

Quote (Alistair)

The average value for airline transport or part 121 as the FAA calls it is 4.03 fatalities per million flight hours 1998 to 2007.

May we apply the 8% to this figure and call the average number of accidents due to design flaws 4.03 x 8% = 0.322 fatalities per million flight hours?
Now we are over 12 times worse than your initial estimate.

Bill
--------------------
"Why not the best?"
Jimmy Carter

waross, from a philosophical perspective, I would say design factors play a role in EVERY crash. Think of a simple hand launched balsawood toy glider, built with adequate structural safety margin, ample dihedral, positive longitudinal stability, and balanced aerodynamic surface areas. Almost nothing could make it crash. By contrast, the MCAS, for example, based on one faulty input, if left to its own devices is guaranteed to crash the aircraft, and appears to have done so on two occasions against determined human opposition.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Crashes are very rarely down to one factor.

Usually it's something then the human gets involved and due to their actions it becomes worse than it needs to be.

In fact I just had the qrh out this evening with a problem in flight with pressurisation. We spotted it while climbing so leveled off at FL 100 and had enough fuel to get to destination so continued. Got a new fuel plan for going back at fl100 and the technicians replace the rear outflow valve when we got back. A complete none event. If we hadn't spotted it on the way up before the warnings went on then we would have had to descend quickly with the cabin crew doing service hot drinks going every where and trolley s rolling about with the nose pitched down by 20 Deg.

You can't fiddle with the fatalities per million flight hours. It's a straight number unrelated to the other accident figures. Most accidents these days are aircraft going off the runway and nobody killed.

Quote (Alistair_Heaton)

Crashes are very rarely down to one factor

From what I’ve read about air and rail crashes and what I’ve personally determined about electrical system events I’d change “very rarely” to “never”. Even two factors is astronomically improbable.

Thank you Alistair.

I agree David. Three contributing factors is more common.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Hemi;
I was comparing numbers under headings in a table. All crashes versus crashes due to design flaws.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote:

Thanks SparWeb Would you by any chance have anything to do with the Q400? I am due to move to the CS300 some point this year.

Not directly, but plenty of 100's to 300's cycling through the facility where I work. My resumé has a lot of spicy stuff on it.
Oh I envy you - I'm sure you're very eager to switch to the C-Series jets!
What about the other Bombardier stable-mates, like the RJ's and Globals?
Or are you having so much fun (not) doing emergency descents in the Q400 that you never get the chance?

A quick summary on my thoughts about a few of the recent comments:

I doubt that the grandfathering clauses would be changed by this accident. Restricting that would make many aircraft operations completely uneconomical. By an order of magnitude. Not exaggerating! It would prohibit any aircraft more than 10 years old from flying.

The causes of this accident appear (for now) to be from a bad system safety assessment, and that (for what it's worth) is a very modern process of analysis. It didn't exist in the 70's but definitely a hallmark of modern avionics design now. The failure, we believe, is in the assumptions and conditions used for the analysis. If the audience is willing, I can show you some of these assumptions and how they affect certification of equipment. Takes a bit of time to prepare that kind of stuff, but I'm game if you are.

I take the comments by Chesley Sullenberger seriously. If he's concerned about the FAA, then so am I. My work has some projects that have been stalled by the US government shut-down and a few still are delayed, and I'm not even working at a US company! It must be awful for the aviation companies that are in the USA.

Canada (and EASA) may be taking upon themselves a detailed review of the 737 certification. I hear rumours and rumblings from Transport Canada that a resources are being moved to respond to this need. Last fall I attended a seminar on system safety analysis (only 1 week after the Lion Air crash; how I regret not asking a question at the time). The expert at Transport Canada had a tremendous grasp on the issues and methods to assure reliability of modern aircraft systems. He was even reporting some cutting edge stuff like avionics faults that could be traced to cosmic radiation (facts to back it up!). I have a lot of faith that if people at TC, like this person, are evaluating the Boeing certification, independently of the FAA, that we WILL get to the bottom of these tragedies.

It just can't happen quickly enough.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Hi SparWeb. I didn't mean to imply that there would be no more grandfathering, just that it may become more restrictive.
If TC and EASA move towards more restrictive grandfathering there will be a lot of pressure on the US industry and the FAA to follow.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (waross)

20 years of fine cameras and one bad model ended their camera business.

Yet somehow, GM survive the Vega.

Brad Waybright

It's all okay as long as it's okay.

waross, I wasn't taking issue with your post. But I think you missed my point. Any aircraft design can be crashed. Some will do it on their own, while others put up more of a fight. Ergo, the design plays a role in all crashes. In other words, a really good design needs a lot of serious contributing factors before it will crash.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

One can foresee Boeing’s future could hinge on how the technical argument develops. After the two fatal incidents the MCAS system in the 737 Max8 is now implicated as it can “create” or “generate” an accident. MCAS can automatically initiate an Aircraft Nose Down (AND) after the flap has been retracted and the Angle of Attack (AoA) sensor gives out an erroneous reading. If the pilot counteracts the AND with an Aircraft Nose Up (ANU) by manually trimming the stability the aircraft’s tail the MCAS could repeat itself to fight the pilot’s intervention. This in-fighting between human and an automatic system was recorded in detail in the Indonesian plane's blackbox for over two dozen times. The end result was MCAS could in each automatic trim swivel the horizontally tail further to increase its aerodynamic resistance until it become too difficult for the pilot to trim it back. MCAS won in both occasions and downed the planes.

Boeing could be criticized for not coming clean with what the MCAS could do to the plane and only issued the relevant information after the first accident . The doomed Indonesian plane in the previous fight had a similar tug of war between the pilot and the MCAS system but was stopped by a jump-seat pilot’s advice to switch off the MCAS by the cut off switch of the Stability Trim. The maintenance competency and the safety culture of the Indonesian carrier were criticized but the downed 737 Max8 plane was only 2.5 months old and has not had its minor and major check maintenance yet.

Unless other shortcomings come to light Boeing can claim 737 Max8 is safe as long as the pilot flips the cut out switch terminating the unwanted intervention of MCAS triggered by a defective AoA sensor. This argument will probably difficult to rebuff if Boeing does not patch the MCAS system. If Boeing finds it necessary to change the MCAS materially then it would be an admission of gilt for a bad if not unsafe design, would it not?

In any case would it be fair to a pilot to be ready in full combat mode to fight the MCAS system a few minutes after the plane leaves the ground when the flap is retracting to its home position, say in six minutes like the Ethiopian accident? No doubt the two Ethiopian pilots would be criticize not remembering by heart to flip the cut off switch mentioned in the FAA directives released after the Indonesian accident but would the flight carriers still buy the 737 Max8 after knowing its nasty MCAS system that claims to be a safe feature but in fact dangerous if not switched off in an event of a frequently occurred sensor error. No doubt if the senor is defective it got nothing to do with Boeing’s design or installation and most probably just a supply chain issue.

Nicely summed up saikee.

Repetitively played tug-of-war between the pilots and the MCAS with the MCAS cheating by having more authority available than the pilots.

Like a game of Monopoly with the banker having sticky fingers.

Keith Cress
kcress - http://www.flaminsystems.com

If the solution is do nothing to the MCAS....

I know what the pilots solution will be....

Turn the electrical trim off for takeoff. And only turn back on with 10k worth of fresh air under your arse.

Yeah.

Sadly, I suspect this MCAS issue would never ever take another plane down. The problem is essentially solved now. (Though sketchy AoA sensors need to be eliminated.)

I'm sure right now the thinking of every last MAX pilot - everyone of them - is 'any hint of vertical irregularities' TURN OFF MCAS.

Keith Cress
kcress - http://www.flaminsystems.com

I recently came across the story of QF72 (2008).

"The....Australian Transport Safety Bureau....finds incorrect data on measures such as airspeed and angle of attack (a critical parameter used to control an aircraft's pitch) was sent by one of the A330's three air-data computers – each of which has its own sensors on the fuselage – to other systems on the plane. One of the three flight control primary computers then reacted to the angle-of-attack data by commanding the plane to nosedive."

It's curious that the lessons are just not being learned. Some subtly-flawed logic remains in place as accepted design dogma, leading to unnecessary incidents.

Note also that this mentions triple redundancy. So the ultimate solution isn't that.

When I get home tonight I will find the accident report for that one. Then we can see what the engineering is and miss out the jorno crap.

Never done a type rating on a proper bus but I know they have 2-3 different flight laws. There are also a load of protection systems such as alpha floor.

The a330 does have 3 air data computers but only 2 AoA vanes according to my geeky plane spotting first officer.

I just perused the report (it's long and I didn't read the whole thing yet). Section 2.6.1 'Role of software in safety-critical systems' gives a good summary of the accident and the associated risks that maybe contributed to the 737 MAX crashes too.

Brad Waybright

It's all okay as long as it's okay.

You got a link to so I don't have to go looking for it?

I think this is it

QF72 Accident Report

How about stepping back and looking at the overall picture.
I understand that the MCAS system was implemented to compensate for flight characteristics caused by the new engines.
Maybe the solution is to use higher landing gear and put the engines in a position that does not need MCAS.
MCAS may not be the only problem with the MAX8.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (AH)

The A330 does have 3 air data computers but only 2 AoA vanes according to my geeky plane spotting first officer.

QF72 report (footnote 28, page 15): "There were three AOA sensors, three pitot probes and six static ports on the aircraft. There were only two TAT probes; one provided data direct to ADIRUs 1 and 3, the other provided data direct to ADIRU 2."

Quote (AH)

...the jorno crap...

That's a bit harsh. The linked article appears to quite reasonable.

Keep in mind that even an official investigation can sometimes be short-sighted (at first), requiring an interested party to push - in this example combined with luck in actually finding further physical evidence. e.g. UA 811

Quote (waross)

MCAS may not be the only problem with the MAX8

May be but it is bad enough for some if

(1) The existence of MCAS was not communicated to the purchasers who bought the plane nor the pilots who flew the aircraft.
(2) MCAS was not part of the pilot’s operating manual for the plane.
(3) No MCAS training was ever planned for the pilots until the system started to kill everybody in the 737 Max plane.
(4) MCAS can take over the plane based on just one faulty senor’s erroneous signals to make the plane dose-dive. It can repeat itself if the pilot intervenes. It does not stop until the plane is destroyed. This is known to cause the first fatal accident. The second accident has remarkable similarities. The jackscrew found in the second crash site has been reported in the full nose-dive position. Ethiopian authority has indicated “to the best of their knowledge” the MCAS was in play for the brief duration of flight 302 from Addis Ababa
(5) The sudden take over by MCAS has been reported by American pilots too and aired in specially arranged channels.
(6) The logged/established MCAS malfunctions are (1) Indonesian plane flight immediately prior to the accident (stopped by a kill switch by a off duty pilot), (2) Indonesian doomed flight in Oct 2018 and (3) Ethiopian doomed flight in Mar 2019. Even the anonymous reports by the American pilots are totally ignored the fault frequency of MCAS is one should never be associated with commercial passenger flights.
(7) Unless the pilots remember and know how to activate the kill switch the MCAS system is so lethal that it could kick in so quickly during the take off to leave insufficient time for the pilot to return back to the airport. The first Indonesian and the second Ethiopian planes were crashed in 12 and 6 minutes respectively.

If the public were force the manufactuer's CEO to fly the 737 Max to show the safety of his plane I will bet my money that he would put his hand on the kill switch (Stab Trim cut off) before giving the pilot the green light to take off.

I am sure the intention of MCAS is good and the installation is essential to the operation of 737 Max but its implementation is now a laughing stock for the manufacturer. It would be revealing to see how much engineering has been compromised by the commercial interest in the coming investigations.

For all you prejudiced idiots who think 'simple' pilot incompetence killed 346 innocent people in the Lion Air and Ethiopian crashes, here is another captain who agrees with me:

Boeing (and many posters) say "Hey, it's just a trim runaway. Do the drill and all is good." But this is not the simple trim runaway that the QRH contemplates. It starts with a stall warning stick shaker shortly after lift off. Close to the ground this will, and should consume both pilots' undivided attention. After a number of seconds they realise that the airplane hasn't stalled and they start figuring out that they may have an airspeed and/or AOA problem.

This is a second problem to deal with on top of the first. And they can't shut the &%$#@ stick shaker off once they realise that it may be spurious. The PM will be frantically scanning the panel to try and find some clue what is going on. And this whole time, among the din of the stick shaker, the crew's concern for the airplane's flight path, and the confusing instrument indications, MCAS has been intermittently dialing in nose down trim. Not steadily, in a calm cockpit at altitude like the QRH contemplates.

But intermittently in the background of chaos, noise, and confusion. At some point, well past when it would have been timely, the task saturated PF realizes that the trim is working against him/her and the stab cutout switches get turned off. (hopefully). But the shitshow isn't over. Because of everything else going on, this took too long and the airplane is way out of trim. The Lion Air crew reportedly had 60 KG of back pressure on the yoke. Close to the ground, and relying on the lifting component of the underslung engines to help keep the nose up, the crew do not dare reduce power. Now the crew needs to manually trim the airplane, but the airplane is way, way off its trim speed. The B737 QRH makes reference to the large forces that may be required to break free a servo clutch:

"3 If needed: Use force to cause the disconnect clutch to disengage. Approximately 1/2 turn of the stabilizer trim wheel may be needed. Note: A maximum two-pilot effort on the trim wheels will not cause a cable or system failure."
Worse, the "Manual Stabilizer Trim" section of the Boeing FCTM talks about the air loads on a grossly out of trim stab requiring a speed change to reduce the force required to manually trim:
"Excessive air loads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the air loads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually."
Sweet Jesus how did this thing get certified?

A guy (or petite gal) has a 60 KG+ force on the yoke trying to stop the airplane from impaling itself into the hard ground just a few thousand feet below, and now he/she has to brute force trim the airplane as well, requiring involved coordination with the PM. Still with all the stick shakers, aural warnings, goofy instrument readings, and whatever else is happening to distract the crew and making communication almost impossible. It is not hard to see how quickly it becomes overwhelming. In addition to a fix for the airplane, if they keep the MCAS system (instead of designing a whole new wing or tail for the airplane), they will have to train the pilots who fly it to deal with its failure.

Right now, there is not a single Max pilot in the world who has been trained for this failure because - there isn't a single simulator in the world that can replicate it. But when they do, all those pilots that claimed "it's just a trim runaway" are going to have a very eye opening simulator session."

the above is from a 10k hour skipper on NG 737 and he is a yank

Is there also a piece that says it's reasonable to anticipate a trim runaway if you've been fiddling with the trim, but otherwise, not? Or is that not true any more (or has it never really been true?)

A.

The more I read about 737 Max and MCAS the more I am convinced of FAA culpable of the two disasters.

Alistair Heaton's suggestion, of the manufacturer's training of the pilots should be directed to coping with the failure of the MCAS, sounds like hitting the nail on its head. Who give the rat ass about the MCAS. The public needs the pilots trained to survive the events when the damn thing fails to work.

Have I got this right?
The placement and the power of the new engines could cause unacceptable flight characteristics under some flight conditions.
It is during high power operation during climbs such as is common during take-offs that the unwanted flight characteristics are liable to occur.
MCAS was implemented to counteract this unwanted effect of the new engines.
Most pilots will be turning the MCAS system off during take-offs in the interests of safety and self preservation.
So, during the time when MCAS is most needed, it will in the future be turned off?
Maybe it's time to rethink the engine application.

We hear a lot about the expense of pilot retraining.
With a claimed 8% saving in fuel consumption, how many flights would it take to save the cost of retraining?

Bill
--------------------
"Why not the best?"
Jimmy Carter

If the plane is acceptably flyable without MCAS then why does MCAS exist?
If the plane is not acceptably flyable without MCAS then what bad things will happen with it turned off?

A challenge to Boeing and the FAA:
When the first simulator is programed to simulate a failed MCAS on a 737 MAX8, send a few dozen pilots who have had the present MAX8 upgrade training and see how many of them can handle a failed MCAS during take-off.
I suggest that one failure is one too many.
I suspect that there will be more than one failure.
Then, Boeing and the FAA execs, do not pass Go......

Bill
--------------------
"Why not the best?"
Jimmy Carter

you can't turn it off. the only way you can kill it is by turning off the electric trim system.

The aircraft would not pass certification without MCAS

And there is one sim in the world with MCAS simulated. that's Boeings one.

There are a few posts here that keep talking about turning the MCAS off.

You can't turn it off and don't even know whether it is the issue or not. There's no alarm or light or anything that I've heard to say MCAS active.

The only thing the poor pilot can do is turn off the electric power to the motor on the elevator trim. However if the system has already commanded a nose down and then you turn the power off you need to manually wind the trim back which could take several thousand feet of air you don't have.

Also MCAS is a required safety feature which is designed to stop a stall occurring dye to the lift being generated by these new engine nacalles. Turn off the elevator trim motors on take off and you can't trim the aircraft for climb and you risk a stall.

I don't know if the MCAS takes in other data like air speed or just the AoA sensor so even the (optional) AoA disagree light might not alert a pilot to the operation of this "hidden" piece of software if it uses other data. The ET pilot apparently reported air speed indicator issues but we will need to see the FDR info to be sure.

So basically Boeing are in a complete pickle on this. Their relative silence is deafening.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

you can manually trim which is not that onerous because you set the trim before departure.

the recovering trim from full forward manually is the issue. Once its back to something sensible you can fly it no problems manually.

Nobody outside boeing seems to have a clue what data sources it uses.

Reported on AVweb;

'According to reports, Boeing is set to confirm changes previously reported as considered, which include: changing the MCAS configuration to accept data from both angle-of-attack sensors rather than just one; limit the number of times MCAS can drive the stabilizer to affect nose-down pitch; and limit the duration of the events to 10 seconds. Preliminary reports from both the Lion Air and Ethiopian Airlines accidents suggest that MCAS continually tried to offset the pilots’ efforts to level the aircraft. In addition, new coding will make MCAS disengage if it sees a differential in AOA sensor readings of more than 5 degrees.'

Brad Waybright

It's all okay as long as it's okay.

I read an interesting article today that the only place MCAS is mentioned by name in the 737MAX manuals is in the Glossary. Other than that, the system is not referred to at all.

Was it deliberately left out so that training could be simplified? That seems to be the implication.

Although turning off MCAS and manually trimming is obviously the best course in a malfunction, even if it's ideally trimmed it's going to leave the plane with the original tendency to stall at high AoA as depicted in the graph AH posted March 19. I wonder how easy it is to stall this plane without MCAS.

Is everybody looking for just a temporary or a permanent fix to the MCAS?

In the submission for the airworthiness certification Boeing had the stability trim of 0.6 degree per activation but the subsequent AD released after the first crash in Indonesia the stability trim has been quoted 2.5 degree or more than 400%. It was understood that the increase was needed and after proven by the flight tests. The New York Times has reported today in the 737 Max simulator tests the pilot has only a 40 second window to avert the disaster using the existing MCAS settings.

Boeing now says in the new patch the trim will be reduced and becomes a once-only event for 10 second.

Also in the new fix the signals from two instead of one AoA sensors will be used. There is a suggestion that MCAS will not be activated if a fault is found in the AoA sensor system. If this is true and judging by the previous events then it would not be uncommon for a 737 Max to fly without the MCAS for the whole journey.

Don’t these reduction or withdrawal of the MCAS make the 737 Max less safe in the event of nose up created by it higher engine position during operation?

Is Boeing doing a trial and error procedure with the human lives? If this doesn’t work we can always do another fix.

Seem to me Boeing has to come clean to tell the public why the original setting was necessary as over 300 lives have been sacrificed because of it and why the new fix would be able to make the plane safe enough to return to commercial services.

Interesting:

Seattle Times

Quote (Linked article)

The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight.

One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.”

“So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said.

Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.”

In this report based on New York Times investigation with simulator tests it was reported the pilot has a 40 second window to rescue the plane from the nosedive generated by the old MCAS settings. The new proposed setting to be implemented apparently has proved satisfactory in the simulator tests.

Peter Lemme web page today also quotes from a Seattle Times report an ex-Boeing engineer working with the Max plane hinted if MCAS were made known to the pilots then training would have to be provided for them to know the system and how to cope with it. Also if two AoA sensors were used in the MCAS the display and the procedure to deal with the malfunction would necessitate the training to be done in a simulator.

Apparently even Boeing's own pilots who flew Max did not know MCAS.

It now makes sense why MCAS was not made known to the pilot or the purchaser or in the Max's flight Manual.

I wonder if Boeing is watching Peter Lemme's web pages as they are implementing his key recommendations in the coming new fix.

So Boeing now has a software fix: https://www.reuters.com/article/us-ethiopia-airpla... They just need to get it through hundreds of eyes around the world.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I wonder if they are standing by the original sales pitch for the patch as a "software enhancement...designed to make an already safe aircraft even safer”.

Edit: Marketing lies about teeth whiteners and bottled tap water is one thing. There's little chance that Boeing knows anything now that they didn't already know 6 months ago, and yet they spun this as an "enhancement". This decision should be part of the dialog.

Hmmm. I wonder what various regulatory agencies think they mean when they declare that they will 'review' the software changes prior to allowing the planes to fly again. Verification that the new patch has the intended effect is one thing. Combing through the computer code is another, as one program routine presumably has numerous effects throughout others. Windows patches download and install routinely, often even without our knowledge. We never question the effectiveness of them, rather we just assume that Microsoft knows what they are doing. Of course, a computer crash is a much different thing.

Brad Waybright

It's all okay as long as it's okay.

Very disturbing facts coming to light...
While the early Comet breakups can be attributed to ignorance (of metal fatigue design techniques), the word that comes to mind here is negligence, wilful at that.

Quote (waross)

Maybe the solution is to use higher landing gear and put the engines in a position that does not need MCAS.

In other words, bring back the 757?

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Quote (saikee119)

...the pilot has a 40 second window to rescue the plane...

40 seconds is not really much different than the 35 seconds pilots' allowed "reaction time" made famous in the movie 'Sully' (*).

So with that assumption, that'd leave perhaps 5 seconds to perform all the required post-reaction tasks.


* Wiki extract for convenience: "The NTSB used flight simulators to test the possibility that the flight could have returned safely to LaGuardia or diverted to Teterboro; only seven of the thirteen simulated returns to La Guardia succeeded, and only one of the two to Teterboro. Furthermore, the NTSB report called these simulations unrealistic: "The immediate turn made by the pilots during the simulations did not reflect or account for real-world considerations, such as the time delay required to recognize the bird strike and decide on a course of action." A further simulation, in which a 35-second delay was inserted to allow for those, crashed.[report:50] In testimony before the NTSB, Sullenberger maintained that there had been no time to bring the plane to any airport, and that attempting to do so would likely have killed those onboard and more on the ground."

Quote (charliealphabravo (Structural))

I wonder if they are standing by the original sales pitch for the patch as a "software enhancement...designed to make an already safe aircraft even safer”.

I am disturbed by it too. Can't he say it makes a dangerous plane less risky? The damn thing kill over 360 people already. The suggestion that "the patch makes an already safe plane even safer" is a total detachment from reality.

It is obvious to many that Boeing knew the problem and how to fix it when the first plane dropped in Indonesia. They could have saved their lives by telling the pilots the existence of the MCAS.

Quote (thebard3)

I wonder what various regulatory agencies think they mean when they declare that they will 'review' the software changes...?

Presumably they mean IAW DO-178, perhaps Rev B.

'Software Considerations in Airborne Systems and Equipment Certification'

So, the engines were changed and unacceptable flight characteristics was an unintended consequence.
The aircraft could stall. To be fair, neither of the crashed planes stalled.
So now with new software and twin AoA sensors, the MCAS may be disconnected or disabled automatically.
Now the aircraft may unexpectedly stall if there is a problem with the MCAS.

Bill
--------------------
"Why not the best?"
Jimmy Carter

hemi; The point of the MAX was to avoid the huge expense of an airline requiring a second aircraft training track.

saikee119; You're getting a bit shrill.

Keith Cress
kcress - http://www.flaminsystems.com

"...when the first plane [crashed] in Indonesia."

That's a very important point. The whole Air Incident Investigation process is not supposed to require two examples to react.

Perhaps it's 'merely' a timing issue. But that's still a problem if the durations embedded in the processes allows further incidents before corrective actions can be rolled out.

It seems that the investigative and corrective actions process itself should be subjected to a higher level of review.

This point will become self-evident when the two individual reports inevitably cross reference each other's incident.

There's a corollary thread on this subject on this site here: thread2-451013: B737 Max "fix"

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

If those jets shall be made to fly again, patched / fixed:
How will the work environment look like for the pilots now?
- always hyper-alert, both of them, to what the plane is doing, or not, or might be cooking up in some software or other
- never sure what card the "system" will play in 5 seconds, fully aware that there's 30 or 40 sec at most, maybe...
- flying a plane which shall behave quite differently once the feature simulating a NG-plane has been cut off.
What a wearsome environment.. and shall they all manage if an emergency comes up.. all those pilots, all of them, not just only some cracks?

And also: how will the travel environment for the passengers look like, feel like, now?

This will be a test to human ability for enduring the unacceptable. But it must not be like that.
Honest and responsable engineering could be done, even now. Full scale test flights could be required, under external supervision.
And a fully open design discussion, including the pilots. Who have a right to get a full scale training to that NEW plane.
No more "Grandfathering".

Roland Heilmann

Quote (RolMec)

If those jets shall be made to fly again, patched / fixed:
How will the work environment look like for the pilots now?
- always hyper-alert, both of them, to what the plane is doing, or not, or might be cooking up in some software or other
- never sure what card the "system" will play in 5 seconds, fully aware that there's 30 or 40 sec at most, maybe...
- flying a plane which shall behave quite differently once the feature simulating a NG-plane has been cut off.

The nature of a "fix" is that the problem is fixed. That's the point.

I would think that a properly engineered, vetted, and implemented fix to this problem would be a stress-reducing situation for 737 Max pilots, not a stress-inducing one. Although I can't speak for them, let's not forget that since the Lion Air crash pilots have been whirring around in these aircraft for quite some time, without knowing if a fix for the perceived problem was coming.

jgKRI is correct.

The 40 sec window to rescue the plane is the original MCAS setting. All grounded planes should have it as standard.

Boeing's new patch is supposed to address this risk. Boeing is persuading the aviation companies and the regulators if the patch were implemented it would be safe for Max to return to service.

The MCAS has been designed to trim the plane to nosedive 2.5 degree each time for about 10 sec and then rest for 5 sec. In the original setting MCAS is allowed to activate unlimited number of times( see graph below for the 20+ times in the doomed Indonesian plane recordings). So it takes about 3 activations and the horizontal stabilizer could be at its limit. In the presentation released by Indonesian Aviation Authority KNKT the blackbox data shows pitch trim position was advanced by 5 degrees before the plane impact. According to the explanation by the experts the 1st graph represents the manual trim by the pilot while the 3rd graphs by the MCAS response and the 2nd graph is the pitch trim position.



The new setting permits MCAS to activate only as a once-only event at a time and to take reading from two instead of just one AoA sensor.

MCAS was triggered by a defective AoA sensor in the Indonesian plane. No information is available from the Ethiopian accident yet (due this week). Thus many Max flew without incidents in the USA because the planes did not have fault with the AoA sensors. In any case the MCAS can be disabled by a kill switch if any 737 pilot equates its effect as a standard runaway trim. That was FAA's defense used in the Senate hearings yesterday.

The problem with MCAS is it was not described in the flight manual. It has been pointed out that the name MCAS appears only once in the glossary of terms. Many believe the motive of not mentioning MCAS is if Boeing were to describe it then the aviation company would have to train the pilot to use or cope with it and that costs money. The Max was sold on its claim of minimum training requirement, reported around 1 to 2 hours, needed for a pilot to switch from the older 737 to fly it.

It's definitely shady to me that Boeing appears to have tried to "hide" MCAS to minimize training and not re-classify the plane.

But that aside, I'd like to know if their simulator with MCAS ever showed anything like the Lion Air accident happening. If not, why? And if not, how do we know their software patch or whatever will fix the cause, aside from allowing/informing pilots how to disable it.

As an aerospace materials supplier, I cannot tell you how many times I have heard the statement:
"Fix the problem, but do not change anything."

In the end the problem get's fixed in the manner that can best best be described as "did not change anything significant". But this is usually done by consensus of a group of interested parties.

Quote (Compositepro)

As an aerospace materials supplier, I cannot tell you how many times I have heard the statement:
"Fix the problem, but do not change anything."

On a similar wavelength- I've been curious throughout the discussion how involved major airline personnel have been/are currently with Boeing's decisions through the development process.

Certainly Boeing is ultimately responsible for the quality and safety of engineering on their products, and programs such as the development of the 737 Max are aimed at growing market share- but the airlines are the ones who stand to gain the most from higher efficiency aircraft, and the most to lose should they be required to adopt expensive training programs to modernize their fleets... When you're Southwest or United or whomever and you're placing product orders in the tens of billions of dollars, I have to think there's a relatively high level of involvement. These aren't housewives buying toasters at Wal-mart.

I'm not attempting to place any blame on the airlines themselves- just curious if it is a realistic thought that a situation like this may not have been a surprise to people at Southwest or Lion Air et. al.

jgKRI; I can easily see the airlines as being in on this.

"We really like everything about the new MAX series and would probably sign up for 35 of them except the training cost of more than 3 hours is a real problem. Is there nothing you can do in this regard to help me secure this order for Boeing?"

Keith Cress
kcress - http://www.flaminsystems.com

Given the pricetag of planes themselves, and the savings in fuel costs that they're anticipating, it seems odd that a purchaser would balk at cost of a few more hours of training for the pilots, but hey I don't buy the planes for an airline, maybe it's big deal to those who do.

Possibly the required updates to everyone's simulators too. I'm sure there was a lot of pressure everywhere to shoe-horn this function in. (I'm not saying it was smart not to!)

Keith Cress
kcress - http://www.flaminsystems.com

Lesson learned from the Pinto disaster;
Even if you know better, don't write a memo to upper management suggesting that this is a really bad idea.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I've written such Pearl Harbor memos and came within a hair's breadth away from getting fired over it; it depends on where you are in the hierarchy.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Fact check: the Pinto memo wasn't about the Pinto. It was an analysis of a hypothetical case in response to a proposed new law.

Cheers

Greg Locock


New here? Try reading these, they might help FAQ731-376: Eng-Tips.com Forum Policies http://eng-tips.com/market.cfm?

Quote (HotRod10)

...it seems odd that a purchaser would balk at cost of a few more hours of training for the pilots...

Are we comparing Boeing's 737NG-to-737MAX transition training (known as "iPad training") against the detailed flight control re-training, which would require hours of simulator time?
Yeah, that's a big bucks issue for airlines. It goes from 100's of dollars per hour to 1000's of dollars per hour training, and take much longer too.

It would also require a whole new subject in the "Abnormal Procedures" of the aircraft flight manual. That becomes a subject for both introductory and re-current training, so the increased costs don't end when the crews are all trained up; the extra procedure is re-tested periodically, again in the simulator.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

How much would an 8% saving in fuel consumption save in a flight from Calgary to Toronto (1750 miles) or, alternatively, one day in service for 12 hours compared to the cost of retraining the flight crew?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote:

It would also require a whole new subject in the "Abnormal Procedures" of the aircraft flight manual. That becomes a subject for both introductory and re-current training, so the increased costs don't end when the crews are all trained up; the extra procedure is re-tested periodically, again in the simulator.

Which may have saved 300+ lives. No biggie...

If I read correctly, each plane is $27 Million. Compared to that, yes, even several thousand $ multiplied by half a dozen pilots per aircraft would have been a paltry investment. Of course, as RVAmeche noted, the 300+ lives needlessly lost is not insignificant either. Add to that, the loss of trust by both pilots and passengers, and indeed a Million $ or more for training would have been easily the cheaper option.

Quote (waross)

8% saving in fuel consumption save in a flight from Calgary to Toronto (1750 miles)

Wayyy bigger than the training cost. But the training cost is on a different line of the balance sheet. Fuel is paid for by operating revenue. Training is overhead. Doing your training in a simulator is awesome, but it costs 100X more than reading operations manuals. When the margin on your bottom line is as thin as the airlines have it, a few hours of time in the simulator is yet another cost hump to overcome.

Guys,
I'm not defending evil. I'm just analyzing where it comes from. Since you asked.

Step back, and don't look at the cost of simulator training any more: consider what it "mean" instead. If your pilot can read an operations manual to transition to another aircraft type, then that's one more piece of evidence that it's not a big change in the aircraft type design. If instead that pilot must spend hours in a simulator to adapt to new procedures in that aircraft, that speaks to a much larger scope of the change. Boeing's goal is to minimize the perceived scope of the change to the aircraft model with the new engines. If they let the scope creep, they will have to step up the certification basis to newer rules. Boeing's goal was clearly to avoid this at all cost - the certification basis of the 737 is from the 1960's!

The cost of training is therefore just a symptom of Boeing's desire to maintain the 737's in the same certification standards.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Thanks SparWeb.
"Wayyy bigger than the training cost."
I suspected that. It's nice to have it confirmed.

Quote (SparWeb)

The cost of training is therefore just a symptom of Boeing's desire to maintain the 737's in the same certification standards.

Now that both Boeing and the FAA may have lost credibility internationally, FAA type certification may be the least of their worries.

Bill
--------------------
"Why not the best?"
Jimmy Carter

HotRod10-
These planes are north of $100 million each.

Brad Waybright

It's all okay as long as it's okay.

$120 Million each

Keith Cress
kcress - http://www.flaminsystems.com

No, I totally get that while the cost of training is small, it is a cost and the accountants and sales people would prefer to say "this plane is so great, there's even minimal additional training".

The issue of course is that the FAA appears to have been negligent or incompetent and essentially let Boeing do whatever they wanted. They appear to have "hid" a new control system and didn't provide training on how to fight it should anything happen. Possible more concerning is they didn't appear to have even identified the risk/possibility that MCAS could nose dive the plane. How?

Hindsight is still 20-20...

To me, it appears the analysis was done based on the MCAS having a smaller movement and only operating once per stall approaching event. The breakdown was likely between that analysis and what was really done in production. Somehow, the changes made didn't get the proper re-analysis.

If Boeing was going to try to skirt the certification requirements, they should have thoroughly tested (or at least simulated) the failure of every one the components of the MCAS system. Now they have $42 Billion in merchandise grounded, and damage to everyone's trust in their planes that will likely prove more costly than that.

Add a few points to this discussion...

Relaxed stability aircraft of all types, not just high performance fighters, are coming... are here.

Fly-by-wire-and-computers aircraft are here [many AirBus]

'Single pilot' and 'pilotless aircraft'... with remote back-up crews... not just high performance fighters and military drones, are coming soon. This makes my flight attendant friends VERY anxious.

The reason for the 'MAX' reconfiguration was multifold... primarily performance/payload, grossly improved fuel efficiency and to maintain [extension of] existing type certificate due to 'similarity'. I am sure confidence and enthusiasm were in high gear...

Boeing being Boeing, I am dead certain will work with hard/grim resolve to ensure the 737 MAX’s are as safe, or safer, relative to any similar aircraft on the market into the future. After-all they [Boeing people] and their families and their friends... and many unknown strangers for years to come... will fly on this aircraft... and that is a VERY PERSONAL responsibility

My best guess is that, even though Boeing [the company] will take full responsibility for these errors and their catastrophic results... the design and test folks actually responsible for various aspects of the MAX flight certifications will likely carry intimate/personal/heavy burden of shared responsibility for these fatalities... and will second-guess everything they do... from now to the day they die. SOME may actually quit engineering for good or move/escape to other jobs. I also believe that over the next few years some may even take their own lives... by suicide or by overwhelming guilt thru stress or pills or booze. PTSD from these events has a long-reach into the psyche.

NOTE.
EVERY military acft I have worked on that experienced any serious mishap... was very shocking and personal and caused sleepless nights... even when I realized my work likely had had no [zero] contribution to the mishap. HOWEVER... I have had engineering acquaintances that did in-fact contribute directly to loss of aircraft and life... civil and military... and that fact was a very heavy burden on their soul's... which a few will discuss... others will clam-up.

NOTE. Many years ago...
Certain models of the Beechcraft V-tail Bonanza experienced a high rate of inflight break-up due to loss of one-or-both stabilizer(s) due to overload. When wind tunnel testing was [very reluctantly] done on all models to ‘prove-them-safe’ it was finally understood that the opposite was actually true... certain evolutionary versions of the aircraft... slightly stretched, higher weight, higher-power, faster, etc... which had evolved from reliable/safe/tested configurations... actually had overly-simplified/faulty assumptions made for the stabs and their control surfaces/tabs loads/loading. This faulty simplified design logic regarding effects of 'small' configuration mods, failed to account for effects of increased stab/control-surface loads [and other aero factors] during higher-speed maneuvering and rough air. Many of these ‘in-between-model’ aircraft have had-to-have significant [tailored] 'mandatory inspections and beef-up mods' just to continue flying safely. Perhaps this is one of the reasons that many V-Tails are no-longer flying today...

NOTE. The back-story as I heard it... when the wind tunnel results were validated and the truth was laid bare and incontrovertible on the engineers involved... everyone that had participated in the design and certification of these ‘incremented in-between V-Tail Bonanza models’ were horrified that these aircraft were in-deed death-traps. There were LOTS of tears shed spontaneously for months/years afterwards... and many [now retired] engineers and managers carry a heavy burden of guilt and sadness.. probably to the ends of their lives.

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

Hopefully nothing Boeing/management did was intentionally shady or disingenuous and it was just a matter of the potential failures/impacts not being fully understood. That's certainly a major issue given their apparent design/self-certification freedom, but it would be an honest mistake. I really hope there's not a poor engineer somewhere who feels responsible because he tried to raise the flag and management or whoever didn't listen (like NASA with the space shuttle).

Quote (RVAmeche)

I really hope there's not a poor engineer somewhere who feels responsible because he tried to raise the flag and management or whoever didn't listen (like NASA with the space shuttle).

In an earlier thread it has been pointed out Seattle Times has already reported FAA own engineer had highlighted the danger of relying on a single sensor in the risk analysis. The management did not want to rock the boat of minimizing pilot train time and gave the certification to Boeing. I hope the FBI and the Justice Department do their job to catch whoever responsible. The certification and party to original MCAS arrangement is deadly as the two crashes were so sudden and quick upon the take off. The 189 on board of the first doomed 737 Max never had a chance because MCAS was not communicated to the pilots.

Thank you for sharing your experiences and feelings in regards to personals experiences as a result of failed aircraft.
I am sure that a lot of people in both Boeing and the FAA felt those feelings, even if not everyone did so.
Then the second plane crashed.

Bill
--------------------
"Why not the best?"
Jimmy Carter

It's a question of culture, of the companys real work environment. That's an "iceberg dilemma".

5 min googling
https://www.bloomberg.com/news/articles/2018-04-16...
https://www.seattletimes.com/business/boeing-aeros...
http://www.live5news.com/2019/03/22/wake-max-issue...

one "technical" fix is not enough, will not be enough.

Roland Heilmann

Now ABC News is reporting that Singapore has grounded it's '787 MAX' planes, like the ones discussed here. Gotta love that superb reporting.

https://abcnews.go.com/Lifestyle/wireStory/singapo...

Brad Waybright

It's all okay as long as it's okay.

I'm not seeing the connection. The 787 is a different plane and the reported blade problem is attributed to its Rolls Royce engines.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

"Like many other places, Singapore has grounded Boeing 787 Max aircraft following two fatal crashes of Max 8 planes, in Indonesia in October and in Ethiopia last month."

That's funny. I suppose you could argue that an 8 looks kinda like a 3, if you squint a bit and drink a lot.

Bad engineering + bad management + lobbying/bribing politicians to get contracts = profit... Any good bean counter knows that profit comes first.

Big deal, the writer just mistakenly typed 8 instead of 3.

From that ABC story...

Quote:

This story has been corrected to show that the Boeing aircraft grounded by Singapore and other countries is the 737 Max, not the 787 Max.

Singapore has also grounded their 787-10s for reasons unrelated to the 737 Max issues.

An interesting development, on the technical side. Ominously published on 1 April. Take that for what it's worth.

Transport Canada Master MEL, Boeing 737 Max, Revision 6

This is a revision to the Minimum Equipment List. This, literally, is the list of equipment that has to be functioning for the aircraft to fly safely. Every aircraft has a list like this, unless it's a relic from the 1940's.
This MEL is applicable only to the 737 Max 8, not any other 737 model (they have separate MEL's).
It also lists when you can fly with something not working, with the conditions to keep the flight safe.
For instance, if you can't pressurize, you can fly, but only below 10,000 feet altitude. And if the cargo bays don't have working fire extinguishers, then you can't carry cargo. It's meant to help deal with abnormal equipment problems that don't endanger the aircraft while you fly it to a repair base, etc.

You will probably not be surprised that the only change in this document (highlighted and underlined on page 18) is the SPEED TRIM functions, which must all be operative at all times.

The previous MEL statement, which you can still see on the FAA's MEL goes like this:

Quote (FAA MEL for Boeing 737 Max8, Revision 1)

Speed Trim Function (2 systems installed, 1 required for dispatch)
One speed trim function may be inoperative provided:
a) Associated speed trim function is deactivated,
b) Remaining speed trim function is verified to operate normally, and
c) SPEED TRIM FAIL light operates normally.

SPEED TRIM FAIL Light (1 light installed, 0 required for dispatch)
The speed trim fail light may be inoperative, provided speed trim system is verified to operate normally.

So operators had quite a bit of latitude to deal with glitches in the trim system, here referred to as "speed trim".

I should also point out that Transport Canada publishes only the changes, while the FAA publishes the entire MEL, which consists of 160 pages. For their part the FAA has not yet updated their MEL. This allows us to compare the original MEL from the FAA with the direction that Transport Canada is going. Maybe in a few days the FAA will do the same.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Thanks for sharing that, SparWeb.
Very timely, only two days after its release by Transport Canada.
Does speed trim include MCAS?

Bill
--------------------
"Why not the best?"
Jimmy Carter

The Justice Department has subpoenaed Peter Lemme

Also, WSJ is saying that apparently the pilots had cut off the electric trim system but couldn't recover.

As I understand it, the hypothesis is that with the stab trimmed for nose down, and the elevator deflected upward to counter the trim, the stab jackscrew could have a high enough load on it to make it difficult to manipulate the manual trim function.

Scary.

Quote (Excerpts from Pete K's second link)

Last week, Boeing outlined a software fix that addresses all the details criticized in the story. But the company denied that the original design was inadequate and characterized the changes as merely making the MCAS “more robust.”
.....
The pilots of the Ethiopian Airlines 737 MAX that crashed last month appear to have followed the emergency procedure laid out by both Boeing and the Federal Aviation Authority — cutting off the suspect flight-control system — but could not regain control and avert the plunge that killed all 157 on board.
.....
But Lemme said the Ethiopian pilots most likely were unable to carry out that last instruction in the Boeing emergency procedure — because they simply couldn’t physically move that wheel against the heavy forces acting on the tail.
“The forces on the tail could have been too great,” Lemme said. “They couldn’t turn the manual trim wheel.”
.....
More detailed instructions that conceivably could have saved the plane in this situation are provided in the 1982 pilot manual for the old 737. As described in the extract posted by the Australian pilot, they require the pilot to do something counterintuitive: to let go of the control column for a brief moment.

The entire article in the link is well worth reading.

Bill
--------------------
"Why not the best?"
Jimmy Carter

pre-engineer... hmmm...

Quote ((a) Bad engineering + (b) bad management + (c) lobbying/bribing politicians to get contracts = (d) profit... Any good bean counter knows that profit comes first. )

YOU need to explain each element... (a), (b), (c) and (d)... of this 'simplified' equation in relation to what is KNOWN and VERIFIABLE, relative to the certification, manufacture and operation of a new very complex aircraft system.

Over the years I've heard theme/variation of these 'remarks' for various aircraft types/models... IE: just to name a few...

Lockheed Electra
CH-47
CH-53E
C-17
F-22
F-35
V-22
787
A400M
Cessna Conquest
Piper Tomahawk
Piper Aerostar
Beechcraft Bonanza [V-tail]
Etc...

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

Quote (waross)

Does speed trim include MCAS?

Yes, that's my understanding at this time. To a pilot, "Speed trim" is a good meaningful name for the system in this context. Pilots all have to master continuously managing the aircraft speed, and at times re-trimming this speed, no matter what aircraft they fly. It is one of the most universal aviation skills. A name such as "MCAS" would not be easily recognizable. Remember that Boeing promised minimum re-training of pilots, so they'd cut down on the alphabet soup, especially on stuff like this.

Another thing, as I'm seeing it now, is that I think the pilots and the MCAS system are making adjustments to the exact same trim mechanism, even though they us different controls to do it. The pilot has a big wheel on the center console, while the MCAS has an electric actuator. Adjusting the trim of the elevator means that pilot has to exert more or less force on the control column to maintain the attitude of the aircraft. Usually the pilot adjusts trim until the control column force needed to maintain a steady airspeed is zero or very light.

A lot of folks who aren't pilots know that the pitch of the nose should be "level" when flying normally, but there's more to that. The pitch you set for the nose actually determines the speed you fly. The engines play a role, too, of course, but every time you change the power and re-set the pitch of the nose, you settle out at a new airspeed, and you also have to reset the trim. Again back to this elementary piloting duty to keep the aircraft set properly.

Here we have the 737 Max8 trying to do some of that on behalf of the pilot. It's not supposed to be active during cruise, but during climb the angle of attack is high and the MCAS kicks on at times to compensate for oddball pitching moments which, we are learning, do counter-intuitive things on this aircraft. But the pilots don't know much about the automatic MCAS system, and they're trying to do this job the way they've been drilled to do it for their entire careers. Something the MCAS does is contrary to their expectation, or it wages war with the crew under some conditions.

This is becoming more clear, as to how the trim mechanism can find itself run down to the end of its travel, leaving the pilots with control column forces they cannot overpower.

Quote (waross, quoting Pete K)

Releasing the stick for a second

Yeah, not just a second. More like minutes. If the MCAS has the trim bottomed out, then it will take a long time for it to slowly drive the lead-screw back up to the neutral. Oh, and the MCAS needs time to recognize that the airspeed is stable and decide that it CAN begin to reduce the trim adjustment. With all the talk about how the MCAS activates the trim to compensate for high angle of attack, there's been less discussion given to when and how it relinquishes its control, after the aircraft is leveled off.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

BBC: Ethiopian Airlines Boeing 737 pilots 'could not stop nosedive'

Quote (BBC)

... Pilots "repeatedly" followed procedures recommended by Boeing before the crash, according to the first official report into the disaster. ... "The crew performed all the procedures repeatedly [that were] provided by the manufacturer but were not able to control the aircraft," Ms Dagmawit said in a news conference in Addis Ababa. ... [Boeing] has said the system can be disabled - allowing pilots to regain control if there appears to be a problem. But the latest comments from Ethiopian officials suggest that pilots could not regain control, despite following procedures recommended by Boeing. ...

SparWeb - From what I have read, MCAS will never return the trim to the original position. It also doesn't take trim control away the control from the pilot. It's operation can be stopped at any time if the pilot activates their yoke mounted trim switch which puts the pilot in control of the trim.

The first problem is that the misbehaving MCAS will re-activate something like 10 seconds after the pilot has released their trim switch and then it begin to move towards nose down trim again. The second problem is that the MCAS can move the trim at least as fast as the pilot can (and possibly slightly faster) which means that if MCAS does operate for 10 seconds and 2.5 degrees of adjustment before the pilot catches it, the pilot then has to spend at least 10 seconds holding the switch to move it back. With the system being "hidden" the pilot might not fully understand why the trim moved and why they have to spend so long moving it back.

What the above means is that the pilot could hold their trim switch until the trim was correct or at least close to correct and then thrown the cut-out switches to stop any further electric trim movement. The true issue and how to resolve it eluded the pilot and co-pilot of both planes as they tried to understand what the plane was doing and sadly the Ethiopian pilot threw the switches with high nose down trim and then couldn't recover the plane from that point.

The operating procedure change as per this FAA document on page 7 supports that they should have tried to moved the trim back to being correct before throwing the cutout switches.

FAA Emergency AD 2018-23-51

So, sadly, it's clear the failure issue was well understood shortly after the first crash and the way to save the airplane was published well before the second crash. I hope the investigations also look into how much effort is put into ensuring pilots quickly learn about changes to operating procedures such as this.

The article cited above implies that MCAS continued to re-activate itself, even though the pilots turned it off, ostensibly because MCAS continued to get erroneous readings from the AoA sensor.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

It barely implies that, if at all. It certainly doesn't say the MCAS kept functioning. Once the switches are thrown, the stabilizer won't be moved by the electrical system.

From what the article says, it can easily be construed that they threw the cutout switches with the stabilizer nose down and couldn't recover from that point.

Sounds like an automatic steering system for a car that the only way to override it is to shut down the entire power steering system, but if you do it with the wheels already turned, you probably won't be able straighten it out. That seems pretty dang stupid. They should get somebody from Tesla to reprogram it for them - at least if the car tries to drive you into a barrier, if you're paying attention, you can override the automatic steering just by turning the wheel, without losing the power steering.

The manufacturer spokesman, who said the fix is to make "a safe plane" even safer, can always take a short flight in a 737 Max with the original MCAS and a faulty AoA sensor to demonstrate how safe is the plane.

Can anyone describe the relative speeds of the two trim systems?

We appear to know that the MCAS drives the trim at about 0.3 degrees per second for about 9 seconds to get its max 2.5 degree angle.

How fast can the manual trim toggle switch drive the elevator back up?

Does the MCAS cut in even if the manual trim up is being pressed?

It seems from the Lion air data that this results in fairly violent pitching and climbing of the aircraft with no doubt the pilots heaving back on the stick at the same time. It does appear that at max nose down of the trim the control elevators can't provide enough variance to maintain a level flight at 5 degrees pitch down of the main elevator. That doesn't sound great to me, but maybe that's normal?

Would you ever see 5 degrees up or down on a trim? Is the real issue here that max trim is excessive?

So how easy it actually is for the pilots to hit the cut out switch at the right point seems to me to be very difficult.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote (LionelHutz)

which means that if MCAS does operate for 10 seconds and 2.5 degrees of adjustment before the pilot catches it, the pilot then has to spend at least 10 seconds holding the switch to move it back.

Is it clear that this is how the system functions?

My understanding (which someone will hopefully correct if I'm wrong here) was that when the switch on the column which disables MCAS is depressed, it only stops MCAS from making further trim adjustments, but it DOES NOT return to whatever the previous trim setting may have been.

I.e. if MCAS decides it needs to add 2 degrees of nose-down rear stab trim, and halfway through that process the pilot depresses the column switch (not the panel-mounted cutoff switch) then the rear stab is held at 1 degree, and does not return back to zero.

This makes the situation even worse. If MCAS returned to zero every time the momentary switch was depressed, all the pilot(s) would have to do is hold that switch down, wait for trim to stabilize at the original value while maintaining safe pitch attitude (or as close as possible), then flip the cutoff switches on the panel. This would be much easier than the alternative, which is what I thought was actually required- flip the cutoff switches to disable automatic trim, and then run the rear stab back to the required trim setting manually using the trim wheel.

The preliminary report is here: http://www.ecaa.gov.et/documents/20435/0/Prelimina...

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

LittleInch - I read 0.2* per second with flaps up for pilot initiated movement. The MCAS was 0.27* per second I believe. Probably anything within 0.5* would be OK maybe even more, so hitting the switches within a couple of seconds of reaching the correct trim would work.

jgKRI - Information available says the pilot still have over-riding control via the yoke switch. As I described and the AD I linked directs, it should be possible to run the stabilizer back, by holding the switch on the yoke control, to the correct trim before turning off the switches. Nothing I've read so far says the MCAS will ever reverse any nose down trim adjustments it has made, but that really is irrelevant when talking about the pilots ability to change the trim via their control switch.

IRstuff,

Thanks for the Preliminary report link.

So in the report the pilots at 05:40:35, presumably from the voice recorder, did apply the Stab Trim Cut Out switches as advised by Boeing via an Emergency Airworthiness Directive issued by FAA only after the Indonesian 737 Max Crash.

Thus the first 737 Max crashed in the Java sea because the Indonesian pilots were kept in the dark about MCAS.

The second 737 Max Crashed because the Boeing/FAA Emergency Airworthiness Directive didn't work for the Ethiopian pilots.

Is this the reason Boeing went back to do more work on the MCAS countermeasures which claimed to be ready last week and were previewed at Renton recently?

Is this another example of the accountants/lawyers taking over the engineering?

To the point about it being difficult to manually trim the plane (with the wheel) if the stabilizer is at full nose down, the excerpt from the flight manual has a statement about reducing control column force by running the electric trim (with the yoke switches) to a neutral condition before hitting the trim cutout switches.

It seems to me that unless the recovery procedure is well trained to the point of being rote, the pace of the events and the "fog of war" during this problem make it difficult to ascertain what is going on and correctly identify the proper way to fix it.

Quote (LionelHutz)

but that really is irrelevant when talking about the pilots ability to change the trim via their control switch.

So the column switches actually provide trim adjustment?

Maybe that's the point of confusion for me- what I know about this system comes pretty much from reading this thread, so this is all new to me. I was thinking (apparently incorrectly) that the column switch only disabled automatic trim, but was not actually a control switch (i.e. the pilots can adjust trim electronically).

I was under the impression that pilots adjusted trim using the wheel only.

There are still some mysteries in the ET302 FDR from the report



(1) A huge 75 degree disagreement between two AoA sensors (In Indonesian plane it was 20 degree). What could cause such huge disagreement and sustained 60 dgree to the end and then with a sudden swing, from +60 to -60 degree?, just before the plane hit the ground ? In both crashes it was the Left AoA faulty but in the Indonesian case the fault stated immediately.
(2) The MCAS kicked in initially with 3 small Automatic Trim Down Commands changing the Pitch Trim from 6 to 5 degree over 12 seconds. It then followed by two 3 and 2 sec aggressive Automatic Trim Down Commands to reduce the pitch Trim from 5 to 0 units. The pilots immediately counteracted with Manual Trim up to pull the Pitch Trim back to about 2 units. At the same time both pilots were heard to apply and confirm the Stab Trim Cut Out switches. Thus the aggressive third long 4-sec trigger by MCAS at 05:40:45 did nothing to the Pitch Trim. However the last Automatic Trim Down Command, at about 05:43:20, pushed the pitch Trim down beyond the point of recovery. Was this a design flaw in the system or the pilots had reversed the Stab Trim Cut Out? If it was an action by the pilots the voice recorder would have a record similar to the one occurred previously and stated in the report "At 05:40:35, the First-Officer called out“ stab trim cut-out” two times. Captain agreed and First-Officer confirmed stab trim cut-out."

Boeing now changes the approach and take responsibility.

That is a good approach. If one admits one's fault one is likely to go out all one's way to fix it. No one doubts Boeing's ability to fix it. The financial burden isn't one that can break Boeing. An early real fix will enable Boeing rebuild its reputation, return 737 Max back to service, win back customers and emerge as a leader in aviation again.

jgKRI - yes, the yoke switch allows the pilots to electrically change the trim.

saikee119 - You missed that the pilots did 2 short trim up commands which did move the stabilizer starting at 5:43:11 - about 2.5 minutes after the stab switch call-out in the CVR and the MCAS trim down command not moving the stabilizer. Both the pilot trim switch and MCAS became function again about 2.5 minutes after the stabilizer switches were cutout. This tends to disproves any conspiracy that the MCAS was left functional even in stab cutout.

Why the stabilizer started moving electrically again might be one of the toughest questions to answer.

Why the pilots could recover from the second automatic stabilizer movement to 0.4 units and not the 4th and last automatic stabilizer movement to 1 unit will be another tough question to answer.

One speculation is the Ethiopian pilots had applied the Cutout switch to the MCAS but might have switched it back again. It is this point I like to see the views from the members here.

The observations are:

(a) The report states “At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First-Officer confirmed stab trim cut-out.” Since both the CVR and DFDR have been recovered and available to other agencies so the information is no longer private. If a voice recording can be heard for applying the Cutout switches once one would expect the same should be available from the pilots for reversing the Cutout switches.

(b) It is somewhat unimaginable that the pilots, knowing well by heart that MCAS can cause the plane to node dive, having killed off MCAS with the Cutout switches to fly the plane if not steady but slowly upward and gaining altitude progressively over a period for nearly 3 minutes would suddenly had a dead wish to activate the MCAS again themselves without recording their action orally.

A possible explanation behind the pilot might have inadvertently switched on the MCAS can possibly explained by Peter Lemme description of the differences of the Stab Trim Cutout switches between a normal 737 and the Max model.

In a normal 737 that most pilots fly one of the Stab Trim Cutout switch is to disable the autopilot and the other is to disable the electrical power to the Electric Trim. Just flip the autopilot Cutout a pilot can disable the MCAS (if fitted) and still be able to use the electric trim to control the plane a lot easier than just use the manual trim.

In the 737 Max the two switches are marked a PRI and B/U. Peter Lemme was asked about what these refer to and he guessed Primary and Back up but was unsure what their functions are.

If the Ethiopian pilots, familiar with the non-Max version of 737, had flipped just one of the Cutout switchs thinking it was Main Electric to restore the electric trim then that would have let the MCAS slip through the net. (FAA Emergency Airworthiness Directive mandates MCAS must be disabled by applying both Stab Trim Cutout switches)

It is evident from the black box data after the pilots applied both Cutout switches the plane was steady up to 05:43:10 without any electrically-assist manual trim while the aft columns were worked on continuously. If the pilots needed a relief to their workload and mistakenly thought to reverse the Cutout switch normally for restoring electrical power in a non-Max 737 then we could see some electrically-assist manual trim events in the black boc data. This is indeed the case. The report at 05:43:20 shows two such electrically-assist manual trims did occur, as pointed out by LionelHutz.

About 5 seconds after the last electrically-assist manual trim the restoration of electrical power also allowed MCAS to activate itself from the faulty AoA left sensor. It is that last 5 to 6 second MCAS activation that pushed the nose down beyond the point of recovery and destroyed the plane.

Like everyone I am just speculating but the black box data does support this theory.

Quote (saikee119)

Boeing now changes the approach and take responsibility.

That is a good approach. If one admits one's fault one is likely to go out all one's way to fix it. No one doubts Boeing's ability to fix it. The financial burden isn't one that can break Boeing. An early real fix will enable Boeing rebuild its reputation, return 737 Max back to service, win back customers and emerge as a leader in aviation again.

That goes a long way to repair my respect for Boeing's integrity.
I fear that having admitted responsibility, they have exposed themselves to debilitating lawsuits. Not that it wasn't the right thing to do.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

It seems odd they would disable both and then turn one back on since flipping both points to them understanding that both had to be off.

Is that earlier switch combination from a NG or an even earlier version of the 737?

Regarding the root cause of the major AOA discrepancy, I found this curious:

Quote:

At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°. At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.

At 05:38:43 and about 50 ft radio altitude, the flight director roll mode changed to LNAV.

At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.

What is the "heat parameter" that changed state?

Quote (Hotrod10)

They should get somebody from Tesla to reprogram it for them...

Perhaps not... You could make Tesla's Autopilot swerve into traffic with a few stickers on the road

When reading accident reports, I admit that I get very wrapped up with the sections that tell the sequence of events. I try to understand what it was like to be in the cockpit as the trouble unfolded. Concealed in the technical jargon, the culmination of events in the cockpit of this aircraft is dramatic.

Seconds after takeoff, the crew were immediately confronted with the Master Caution and stick shakers. Realizing they had an aircraft in trouble, they remained calm, stuck to procedures, and worked the problem. They did what the AFM told them to do, and came very close to bringing the problem under control. With both men pulling back on the yoke to keep the nose just barely level, they got it turned around back to AA airport, enough to start thinking about the descent to land. They even got their hands free enough to work the manual trim a little, but it must have been a battle to do it, when trying to pull back on the yoke at the same time. They were so close to bringing everyone home.

Then, for no apparent reason, this happened:

Quote (Aircraft Accident Investigation Preliminary Report)

At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down.

Something commanded the electric trim to nose-down drastically, even while the electric trim switches were set to cut-out. With yoke forces too great for two adult men to overcome, the aircraft thundered into the earth seconds later.

I read it, but I still can't believe it.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

The root problem:
Am I completely misunderstanding this?
The regs require that the force on the control column be linear.
That is, as the pilot increases the angle of attack, the pressure on the control column must increase proportionally.
Problem; The placement of the oversized engines resulted in the pressure on the control column to no longer be linear as required by the regulations.
It may have been a lot simpler, cheaper and safer to just add a force to the control column so that the force felt by the pilot would continue to increase as the angle of attack increased.
This could be done electrically (a torque motor type arrangement) or pneumatically (an electrically controlled pressure regulator).
Either way, the system could be overcome by the pilot by either exerting more or less force on the control column depending on the failure mode.
The maximum force added would be the maximum force needed to maintain the "feel" of the controls when the aircraft was flying in the problem angle of attack attitude.
Turn it off, the added force goes away.
It turns itself on, the same force is again applied, but no windup until disaster.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I'm noting a few things here, my main concern is that this isn't entirely a repeat of the Lion air accident. I have a few questions before I get into any speculation. at 05:35:45 we see that the aircraft leaves the ground based on altitude readings (pressure and radar), yet approximately the same time the pitch is 18 degrees nose up. Is 18 degrees considered high for a 737 max8, could this have caused a tail scrape? At 05:40:27 we see the TRIM AND is almost immediately countered with TRIM ANU (Control column inputs less then during final moments), This trimmed deeper than the final TRIM AND event which was unrecoverable, immediately after the final TRIM AND event there's a drop in control column position (significant?) followed by large input which fails to arrest the nose down pitch of the aircraft. Almost immediately after the final TRIM AND event there is a sudden change in the left AOA value (05:43:26) at the same time the pilots appear to be attempting to roll the aircraft from 30 degrees one direction to 18 degrees the opposite direction at time off impact.

the left AOA Trace also looks out of place, after the jump to 75 degrees it maintains a near flat trace while the right AOA trace has noise which seems fairly consistent with other noise profiles or fluctuations with the aircraft (Lion air was out by +20 degrees in regards to the right AOA, this one "jammed" at 75 degrees). would that seem to indicate a bird strike? however that doesn't explain the change in the LEFT AOA value at 05:43:26.

Really wild AoA numbers and "flat lines with little noise" points at an electrical issue rather than a mechanical one. Perhaps bad connectors?

Keith Cress
kcress - http://www.flaminsystems.com

Quote (Spartan5)

Something commanded the electric trim to nose-down drastically, even while the electric trim switches were set to cut-out. With yoke forces too great for two adult men to overcome, the aircraft thundered into the earth seconds later.

Instead of sounding like a broken record I'll just post what I previously did again....

"You missed that the pilots did 2 short trim up commands which did move the stabilizer starting at 5:43:11 - about 2.5 minutes after the stab switch call-out in the CVR and the MCAS trim down command not moving the stabilizer. Both the pilot trim switch and MCAS became function again about 2.5 minutes after the stabilizer switches were cutout. This tends to disproves any conspiracy that the MCAS was left functional even in stab cutout."

The above pilot ANU commands occured 5 seconds before the last MCAS AND command.

4 automatic AND commands occurred which were presumably MCAS. The 2nd one drove the stabilizer to 0.4 units and the last/4th one drove it to 1 unit. So, I will also add this again - "Why the pilots could recover from the second automatic stabilizer movement to 0.4 units and not the 4th and last automatic stabilizer movement to 1 unit will be another tough question to answer."

Quote (Saikee119)

If the Ethiopian pilots, familiar with the non-Max version of 737, had flipped just one of the Cutout switchs thinking it was Main Electric to restore the electric trim then that would have let the MCAS slip through the net.

The two switches are in series- there's a B/U switch so that if the PRI switch fails NC/has a short or other closed contact failure, elec trim can still be disabled.

Unless Switch A has a closed contact failure, flipping switch B only does not re-enable electric trim or vise versa.

A closed contact failure on one of these switches is certainly possible, but highly unlikely. It's a very rare fault.

Quote (Waross)

It may have been a lot simpler, cheaper and safer to just add a force to the control column so that the force felt by the pilot would continue to increase as the angle of attack increased.

This would still require AoA sensors as part of the feedback loop which would be subject to the same system architecture which failed in this case. Also, I'm suspicious that the control gradient requirement is really there so that submitted designs have a self-righting moment AWAY from stalled pitch attitudes. Augmenting control column forces alone doesn't produce that behavior. Aerodynamic changes (which MCAS provides if operating correctly) do provide self-righting pitch moment. I don't know that for sure, it's a suspicion of mine though.

There's so much data here that looks confusing and difficult to call from afar.

Some points I have include:

1) When the electric trim was active, i.e. before they apparently threw the cutout switch why did the trim only increase from the low point of 0.4 to 2.3 instead of the initial 4.6? Why did they take the finger off the trim up switch?
2) With the trim seemingly stable at 2.3 for a long period, the aircraft was climbing slowly but control position and apparent difficulty in controlling the aircraft would appear to have nothing to do with movement of the trim position - what is going on here?
3) There is a continuous and in the end quite significant roll to the right - what was going on here?
4) The small stab trim inputs just before the final dive and again seemingly after flicking the electric power back on don't seem to have materially affected the trim position so why bother??
5) Why connect the system again?
6) The faults mentioned in Dec 2018 were not exactly fixed as no faults could be found. This doesn't sound like a good fix and if there were "several" (see section 1.6.4) write ups surely this should have resulted in some replacement of components in that event even if no fault can be found there is clearly something wrong.
7) The AOA sensor reacts very strangely right at the end so was not totally broken, but clearly in error.
8) As Lionel says above, they managed to recover from the first nose down and had more height this time, so what happened t 0543 20 ( the aircraft was in a 30 degree roll at that point mind)

I hope someone can figure this out as it doesn't look solely like the mcas issue here, thought that is clearly the primary cause of all the trouble along with the faulty AOA reading.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

LittleInch - i commented on the possibly being another issue before and I would tend to agree with you now. I'm currently not convinced that changing MCAS is the full solution. As to your point 2, I'm sure it's a fight to hold the stick back when the plane is in a nose down trim configuration.

I had it somewhat wrong in my previous post. There were 7 automatic ANU commands, 4 of which were a significant length. The first 3 were short and attributed to the autopilot. The 5th one (2nd significant one) forced the stabilizer to the furthest down position yet the plane remained controlled. The last one didn't go quite as far but the plane wasn't controlled.

What amount of down trim would be required to counteract the worst condition of extra lift from the engine housings?
One would think that that would be the reasonable limit of MCAS override.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bill, it seems capable of exceeding that amount of trim - greatly.
It's possible that when nearly at stall AOA, the MCAS does need that much authority to counteract the lift from the engines.
When it's active at any other time, however, it applies a control force that two crew members cannot overcome.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Quote (SparWeb)

It's possible that when nearly at stall AOA, the MCAS does need that much authority to counteract the lift from the engines.

If you are correct, and it takes that much trim to counteract the engine lift, the corollary may be that if MCAS fails to engage when it is needed, it may require more control force than two crew members can apply to avoid a stall.
Suppose that a new system is deployed that will detect AoA sensor failures and automatically disconnect the MCAS. The next crash may be as a result of a high angle of attack leading to a stall and both crew members not being able to apply enough force to bring the nose down without MCAS.
Another thought; with the trim full down, will the elevators be able to counteract the trim with any amount of control column force?

Maybe it's time to set aside the MCAS and look at the engine placement.
I sincerely hope that the FAA takes a hard look at whether this configuration should be accepted under the old type approval.

Bill
--------------------
"Why not the best?"
Jimmy Carter

It appears on record Boeing did not want the pilots to know MCAS so they don't have to be trained to deal with it. FAA was party to this arrangement.

It took a plane with 189 lives to show the world MCAS exists and a malfunction of it during take off could be fatal.

Boeing's solution was: treat it as a standard runaway stabilizer scenario, stop it by throwing two cutout switches and use the crank wheel to trim the plane manually. Boeing did indicated "higher control force may be needed to overcome any stabilizer nose down trim already applied". FAA dispatched this solution as an Emergency Airworthiness Directive.

It took another plane with 157 lives, having a malfunction of MCAS during a take off, to reveal that Boeing first solution may not work because by a loss of electrical power, consequential to throwing the two Cutout switches, the pilots were unable to cope with the manual trim using the slow mechanical crank wheels in an emergency situation to overcome quickly enough the heightened aerodynamic resistance in the nose dive.

That looks something fundamentally flaw in the plane design. I can't see how revising software can get Boeing out of this hole. Seem to me at least the wiring has to changed to give the pilots back the necessary electrical power to trim plane out of the nose dive situation.

It would be interesting to see what Boeing has to offer in the next round.

waross's corollary suggests even the MCAS is fixed this time we could still in future see 737 Max dropping off from the Sky (when MCAS has to be disabled on account of a faulty AoA vane and the plane has an excessive nose up that can only be cured quickly by MCAS).

Quote (saikee119)

It took another plane with 157 lives, having a malfunction of MCAS during a take off, to reveal that Boeing first solution may not work because by a loss of electrical power, consequential to throwing the two Cutout switches, the pilots were unable to cope with the manual trim using the slow mechanical crank wheels in an emergency situation to overcome quickly enough the heightened aerodynamic resistance in the nose dive.

The preliminary report doesn't support this claim, at all.

#1. There is no evidence they attempted to operate the manual wheel after throwing the cutout switches.
#2. The cutout switches appear to have been on right before the plane crashed.

Quote (waross)

The next crash may be as a result of a high angle of attack leading to a stall and both crew members not being able to apply enough force to bring the nose down without MCAS.

There is no evidence I've seen that this is true. Please share it if you have it, otherwise it serves no purpose to speculate about it.

Quote (waross)

Another thought; with the trim full down, will the elevators be able to counteract the trim with any amount of control column force?

The initial accident report shows that the pilots held the plane fairly level with the stabilizer almost full down, at 0.4 units (degeees?) long enough to operate it back to 2.3 units. One could conclude from this that there is an amount of force that can counteract it.

"It may have been a lot simpler, cheaper and safer to just add a force to the control column so that the force felt by the pilot would continue to increase as the angle of attack increased."

There is already a thing called a feel unit on powered controls. Which increases the control forces with airspeed.

Now trimming. Basically you are zeroing the control forces at a particular airspeed. Think of it as a U and you trimming the control forces to be at the bottom of the U. If you speed up the elevator produces more down thrust due to L=1/2 x rho Vsqt x coefficient of lift. So to get it back to producing the same amount of down force you have to change the coefficient of lift by changing the elevator position. We call this trimming. Trimming is fundamental in flying in all three axis. When you get it right you can fly a 747 with your finger tips. Take you hands off the controls and the plane is in equilibrium and will continue straight and level. Get it wrong and any lapse in concentration and the aircraft will depart the required flight path. Its taught in the 3 lesson of pilot training after effects of controls. Pitch trimming is the basic one, trimming yaw is also important in commercial aircraft especially in an engine failure situation. All 4 controls effect each other so the order you trim is quiet important. Power, then yaw, then roll and lastly pitch. Once you have been flying multi engine for a bit you don't think about it you just do it like changing gear in a car. Jet aircraft there isn't much yaw change with power change unless you are flying on one engine.

Alistair, happy to see you back. What's your take on the initial report which has a few of us quoite confused as to what the pilot actions and thinking was.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote (LionelHutz)

One could conclude from this that there is an amount of force that can counteract it.

This conclusions premature in the face of the preliminary report. This thread, indeed this entire forum, is an exercise in forensic problem solving based on the available information, fully acknowledging that more information will become available and that more informed experts exist. Personally, I can only justify my participation in this forum if ALL my statements are taken as speculation and NONE of them are taken as public expressions of my professional opinion.

Peace.

Hi Lionel.
Who is Peter Lemme?
From the links posted by Pete K

Quote (https://www.seattletimes.com/business/boeing-aeros...)

After two fatal crashes of Boeing’s 737 MAX, a federal agent served a grand jury subpoena Monday seeking information from an aviation flight-controls expert and consultant as part of a sweeping and aggressive criminal investigation into the jet’s certification.

The expert, Peter Lemme, a Kirkland-based former Boeing flight-controls engineer who is now an avionics and satellite-communications consultant, has no direct personal knowledge of the airplane’s development or certification but he did a detailed analysis of the October crash of a Lion Air 737 MAX. He was extensively cited as an expert in The Seattle Times, subsequently in multiple press accounts, including in The New York Times.

What did Peter Lemme say?

Quote (https://www.seattletimes.com/business/boeing-aeros...)

Exerpts: But Lemme said the Ethiopian pilots most likely were unable to carry out that last instruction in the Boeing emergency procedure — because they simply couldn’t physically move that wheel against the heavy forces acting on the tail.
“The forces on the tail could have been too great,” Lemme said. “They couldn’t turn the manual trim wheel.”

The stabilizer in the Ethiopian jet could have been in an extreme position with two separate forces acting on it:

MCAS had swiveled the stabilizer upward by turning a large mechanical screw inside the tail called the jackscrew. This is pushing the jet’s nose down.
But the pilot had pulled his control column far back in an attempt to counter, which would flip up a separate movable surface called the elevator on the trailing edge of the tail.

The elevator and stabilizer normally work together to minimize the loads on the jackscrew. But in certain conditions, the elevator and stabilizer loads combine to present high forces on the jackscrew and make it very difficult to turn manually.If after much physical exertion failed, the pilots gave up their manual strategy and switched the electric trim system back on — as indicated in the preliminary reports on the Ethiopian flight — MCAS would have begun pushing the nose down again.
Boeing on Wednesday issued a statement following the first account, published Tuesday night by The Wall Street Journal, that the Ethiopian pilots had followed the recommended procedures.

And in support, there is this information:

Quote (https://www.seattletimes.com/business/boeing-aeros...)

A local expert, former Boeing flight-control engineer Peter Lemme, recently explained how the emergency procedure could fail disastrously. His scenario is backed up by extracts from a 1982 Boeing 737-200 Pilot Training Manual posted to an online pilot forum a month ago by an Australian pilot.

That old 737 pilot manual lays out a scenario where a much more elaborate pilot response is required than the one that Boeing outlined in November and has reiterated ever since. The explanation in that manual from nearly 40 years ago is no longer detailed in the current flight manual.
...
More detailed instructions that conceivably could have saved the Ethiopian plane are provided in the 1982 pilot manual for the old 737. As described in the extract posted by the Australian pilot, they require the pilot to do something counterintuitive: to let go of the control column for a brief moment.

As Lemme explains, this “will make the nose drop a bit,” but it will relax the force on the elevator and on the jackscrew, allowing the pilot to crank the stabilizer trim wheel. The instructions in the old manual say that the pilot should repeatedly do this: Release the control column and crank the stabilizer wheel, release and crank, release and crank, until the stabilizer is swiveled back to where it should be.

And this:

Quote (https://www.seattletimes.com/business/boeing-aeros...)

However, a separate analysis done by Bjorn Fehrm, a former jet-fighter pilot and an aeronautical engineer who is now an analyst with Leeham.net, replicates Lemme’s conclusion that excessive forces on the stabilizer trim wheel led the pilots to lose control.

Fehrm collaborated with a Swedish pilot for a major European airline to do a simulator test that recreated the possible conditions in the Ethiopian cockpit.

A chilling video of how that simulator test played out was posted to YouTube and showed exactly the scenario envisaged in the analysis, elevating it from plausible theory to demonstrated possibility.The Swedish pilot is a 737 flight instructor and training captain who hosts a popular YouTube channel called Mentour Pilot, where he communicates the intricate details of flying an airliner. To protect his employment, his name and the name of his airline are not revealed, but he is very clearly an expert 737 pilot.

In the test, the two European pilots in the 737 simulator set up a situation reflecting what happens when the pre-software fix MCAS is activated: They moved the stabilizer to push the nose down. They set the indicators to show disagreement over the air speed and followed normal procedures to address that, which increases airspeed.

They then followed the instructions Boeing recommended and, as airspeed increases, the forces on the control column and on the stabilizer wheel become increasingly strong.After just a few minutes, with the plane still nose down, the Swedish 737 training pilot is exerting all his might to hold the control column, locking his upper arms around it. Meanwhile, on his right, the first officer tries vainly to turn the stabilizer wheel, barely able to budge it by the end.

If this had been a real flight, these two very competent 737 pilots would have been all but lost.

The Swedish pilot says at the start of the video that he’s posting it both as a cautionary safety alert but also to undercut the narrative among some pilots, especially Americans, that the Indonesian and Ethiopian flight crews must have been incompetent and couldn’t “just fly the airplane.”Early Wednesday, the Swedish pilot removed the video after a colleague advised that he do so, given that all the facts are not yet in from the ongoing investigation of the crash of Flight 302.

More detailed instructions that conceivably could have saved the Ethiopian plane are provided in the 1982 pilot manual for the old 737. As described in the extract posted by the Australian pilot, they require the pilot to do something counterintuitive: to let go of the control column for a brief moment.

As Lemme explains, this “will make the nose drop a bit,” but it will relax the force on the elevator and on the jackscrew, allowing the pilot to crank the stabilizer trim wheel. The instructions in the old manual say that the pilot should repeatedly do this: Release the control column and crank the stabilizer wheel, release and crank, release and crank, until the stabilizer is swiveled back to where it should be.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (waross)

Who is Peter Lemme?

here

He is a Satcom guru and his in depth knowledge of operating 737 models including Max is generally regarded one of the top experts.

Quote (LionelHutz)

#1. There is no evidence they attempted to operate the manual wheel after throwing the cutout switches.

Page 11 of Preliminary Report last paragraph

"At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied
that the trim was not working and asked if he could try it manually. The Captain told him to try. At
05:41:54, the First-Officer replied that it is not working."

This is from BBC news
"The pilots' five-minute struggle

08:38 A sensor on the pilot's side falsely indicates that the plane is close to stalling, triggering MCAS and pushing down the nose of the plane
08:39-40 The pilots try to counter this by adjusting the angle of stabilisers on the tail of the plane using electrical switches on their control wheels to bring the nose back up
08:40 They then disable the electrical system that was powering the software that pushed the nose down
08:41 The crew then attempt to control the stabilisers manually with wheels - something difficult to do while travelling at high speed
08:43 When this doesn't work, the pilots turn the electricity back on and again try to move the stabilisers. However, the automated system engages again and the plane goes into a dive from which it never recovered

Source: Ethiopia's Aircraft Accident Investigation Bureau"

Quote (LionelHutz)

#2. The cutout switches appear to have been on right before the plane crashed.

At about 05:43:10 the pilots applied two the Manual (electric) Trim command. Thereafter about 5 to 6 seconds the last MCAS activated and destroyed the plane. This has been interpreted the electrical power had been restored by the pilot in an attempt to replace the manual crank with the Manual (electric) trim.

Quote (LionelHutz)

The initial accident report shows that the pilots held the plane fairly level with the stabilizer almost full down, at 0.4 units (degeees?) long enough to operate it back to 2.3 units. One could conclude from this that there is an amount of force that can counteract it.

If the pilots were able to control the stabilizer they would not have to restore the power to access the Manual (electric) trim.

You can read Peter Lemme's explanation and the Q&A with the pilots on this matter.

I misread that line to mean they tried the electric trim again.

Bill - the trim was at 2.1-2.3, not full down so that simulation and any comments about the trim being impossible to move manually when at the full down position simply doesn't match what was being attempted. They certainly didn't attempt to move the wheel during the last dive to recover the plane. So, if you want to keep claiming it was impossible then find something which says the amount the trim needs to be away from the "ideal" before the manual wheel gets too hard to turn. In this case it seems the trim was around 2-2.5* off when they attempted to move the manual wheel.


This is something I found really odd.

Quote:

At 05:40:12, approximately three seconds after AND stabilizer motion ends, electric trim (from
pilot activated switches on the yoke) in the Aircraft nose up (ANU) direction is recorded on the
DFDR and the stabilizer moved in the ANU direction to 2.4 units. The Aircraft pitch attitude
remained about the same as the back pressure on the column increased.

At 05:40:28 Manual electric trim in the ANU direction was recorded and the stabilizer reversed
moving in the ANU direction and then the trim reached 2.3 units

At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two
momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in
the ANU direction from 2.1 units to 2.3 units.

Readin the above and looking at the FDR graphs, why did they keep moving the trim adjustment back to around 2.4/2.3 units but never attempt to go further? At one point, they held the trim switch about 9 seconds to get back to 2.3*, but never pressed the switch to go further towards 4.5*.


saikee119 - you totally and completely missed the point of that last comment of mine you quoted. The stabilizer moved to 0.4 degrees and the pilots were able to control the plane and get through it with the plane remaining reasonable level. This makes claims saying it is impossible to keep the plane level with the stabilizer at 1 degree questionable.

There is no reason (yet) to believe the crew turned the STAB TRIM back on.

I have been seeing some misinterpretations and misunderstandings. I don't want the speculation and assumptions to get out of control. Without saying I'm the best person to explain this, I think I'm in a good position to discuss some of the details about the control system. I hope to forestall any jumping to conclusions about what the crew may or may not have done. While I acknowledge that my own understanding of the 737 is limited, I have been taking the time to read carefully the most authoritative sources of information, so that I may understand it better.

Assumptions that "electric trim" implies MCAS is turned on are incorrect.
Assumptions that "manual" control of a device implies no electric operation are also incorrect.
Even though the 737 is a fairly old aircraft type, it's not only controlled by rods and strings.
The sequence of events told in the preliminary report indicates that the "manual (electric) trim" was used at

The "old" 737's were equipped with autopilot, yaw dampers, mach trim, and approach coupling as standard equipment. These automatic systems are similar to the systems used today, and driven by semiconductor logic that a modern engineer can read and follow. They've probably evolved over the decades, but I don't think they've been replaced outright.

When operated in manual mode, the automatic systems are overridden, as you would expect, but manual doesn't mean "mechanical".

Here's a photo of the relevant controls:

This picture was taken just a few years ago from a 737-400. As you can see from all the glass, it's had an avionics upgrade, but the basic flight controls remain the same.

The 737's all have stabilizer trim wheels on either side of the center console to allow the flight crew to make manual adjustments to the stabilizer. These adjustments are unnecessary when the autopilot is on, and moving the wheels can actually disable the AP if it is.

In the lower center of the photo, you can see the pair of STAB TRIM switches. If they are set to CUTOUT then the autopilot and hence approach coupling cannot engage. Also disconnected by STAB TRIM CUTOUT is the MCAS. What remains available, however, are the manual trim, MACH trim and the Yaw dampers.

Mach trim does what you might assume it does: adjusts the trim slightly for the effects of high speed (the 737's fly up to Mach 0.85 or so). The Yaw dampers compensate for oscillations in the aircraft's lateral direction which happen when slight adjustments are made to its direction. There is no need to override these if the stabilizer trim has trouble (and reasons why you don't want to either).

The aircraft stabilizer and elevator work in a dependent-independent relationship. The stabilizer is the "entire" horizontal tail, which can pitch up or down several degrees. You can see the marks on the fuselage this travel leaves on every 737. When the stabilizer moves, the elevators moves, too. Their relative movements are complex:


(The above photo is from a 737-200. Sorry I have no 737 Max schematics. It is my belief that much of this system is similar on later aircraft, including the Max, but I admit it's an assumption on my part.)

The main driver of the horizontal stabilizer is the trim actuator, which is a screw-jack. It receives commands from trim adjustment wheels on the center console. My understanding is that on the Max, an additional input to this actuator is sent from the MCAS system. When active, the MCAS will move the actuator, adjusting the stabilizer pitch up (which pitches the nose down) and the crew should expect to see the stabilizer wheels spin at the same time.

The elevator is the movable trailing edge of the stabilizer. The main control Yoke operates the elevator, and it is quite true that this is done by steel cables. So when the flight crew "pulls back on the stick" they are indeed pulling on cables and directly moving the elevator. You can also see from the schematic above, there are other systems acting on it, including the mach trim and the autopilot actuators. These make adjustments relative to the position of the cables from the yoke, and the elevator can move under autopilot control without the yoke showing any corresponding movement.

So going back to what happens when the STAB TRIM is set to CUTOUT, the autopilot actuators on the elevator stop working, and so should the MCAS control over the stabilizer trim. But all the other controls do still function.

I believe the ET-AVJ crew had properly set these switches to CUTOUT, and never moved them back. They then wrestled the yoke bring the nose back up, but it took all their personal strength to do so. When one or the other tried a couple of times to reach for the trim wheel on the console, he could only manage a small amount of turn before he had to put his hands back on the yoke to maintain the nose attitude. This was tried twice but the effect was too small. They would have had to accomplish many turns of those wheels to return the stabilizer to a neutral position.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Lionel
I'm just going by what Peter Lemme, an acknowledged expert has said, and by the experience of two pilots who "crashed" in a simulator because the forces were too great to overcome.
I also noticed a little note that says that when the plane dives the speed increases and when the speed increases, the control forces increase also.
The speed must be considered as well as the stabilizer position.
And there is the old 1982 flight manual procedure that addresses the extreme control forces that can develop and has a procedure to manually trim the stabilizer when that happens.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"What's your take on the initial report which has a few of us quote confused as to what the pilot actions and thinking was. "

MY main thought is utter "by the grace of god go I"

Some of us call this test pilot territory which basically means that they are in a situation which they have no training for and zero knowledge how to deal with and they can only rely on systems knowledge and experence to try and sort it out. But to be honest no test pilot would be in this situation because there would be multiple cut outs and additional data analysis going on in the back for real time data managment and a load of technicians on the ground monitoring things real time.

I was at a kids party yesturday with another dad who has flown the Max. He is qualified on what we call the 737 classics which is the 300,400,and 500 which is the cockpit detailed above. Also on the new generation NG 737 which is 600,700,800 and 900. The training between the classic and NG is 4 days of ground school followed by 4 sessions in the sim and a new type rating issued to your license.

Before he flew the MAX for the first time he had a call from ops 18 hours before departure telling him to do the Ipad training which took 45mins. The turned up to find his fellow pilot was exactly the same.

He said that he found the MAX to have more handling differences than the transition between Classic and NG.

Now I am an ex engineer and he is a ex session musician. We could only think that the system is mainly for in the event of a go-around where you get high power settings, manual flight control and high alphas and the trim setting is quite far away from your normal departure setting. GO- arounds are trained every 6 months but normally in single engine operation. Dual engine go-arounds we do as part of our low vis training for Cat2 and Cat 3 approaches. So personally I do 3 single engine go-arounds and 2 dual engine go-arounds every 6 months in the sim and the last part of the low viz training is usually an engine fire at 900ft which I always ignore and land then deal with it on the ground in 350m viz and 000 cloud base (you get to see 2 lights of the approach lights at 110 feet and your on the ground 5 seconds later). Real life I have done 2 go-arounds in the last 12 months in a real aircraft. Once due to outside wind limits on a slippery runway at 200 feet and the second was due to another aircraft not clearing the active runway in time for us to land. They are not a big deal although if the aircraft is very light it can be a bit sporty mainly due to the climb performance.

Another point he brought up...

Now because the tail plane is an all moving affair without balance horns they can get an effect where the aerodynamic loads are more than a normal human can pull against and the manual trim does not have enough leaverage to power through even with the handle pulled out the side to help. Boeing have a procedure for dealing with this which is both pilots pull there hardest on the controls and then relax the pressure on them and during the period while the forces are sorting themselves out the trim wheel can be moved and you do that multiple times until your back into the situation that you can again move the trim wheel normally. This is a common procedure on Classics and NG. It takes loads of altitude to sort out. He has done it a couple of times in the sim and he is not a small lad and said they had two 90 kg blokes pulling at the controls with thier feet braced on the instrument panel and the examiner cheering in the back saying go for it and they managed an outstanding comment on there post session form. He said they were lucky to get half a turn out of the trim wheel every pull and it took maybe 5-6 pulls to get it to the point they could move the trim wheel manually.

The Q400 has a fixed plane elevator with balance horns in front of the point of rotation and you can hand fly it manually with full forward trim position and full rear. Which is why I presume it doesn't have a manual trim wheel.

Now none of the above has any technical comment on the crash. I give it to give a picture of what its like in the cockpit and the human factors side of dealing with issues and a general coment on how these things work.

There was an issue with my registration apparently. I would like to state I am not pro any manufactures product, most of my time has been spent in a Handely Page designed aircraft aka the designer of Lancaster Bomber. Built like a brick poo house, lovely to fly but ultimately an under performing heap of an aircraft which realistically shouldn't be flying with paying pax on board these days. The aircraft I really really want to fly is the Boeing 757 with Rolls engines sometimes called the 75 GTI in piloting circles. So I am not anti Boeing in the slightest. But I do think a pilot should be given a safe aircraft with which to operate. My disgust is firmly towards the regualators allowing this situation to develop. And its not just targeted at one countries regulator, world wide they are all as bad as each other these days. They have all de skilled and turned into paper work chasers over the last 20 years. But I am sure sparweb has more experence and knowledge on this subject than I do as a stick monkey. BTW the stick monkey comes from an old bit of banter between Pilots and Technicians. The techs say you can train a monkey to ride a bike but you can't train one to fix it.

This is a 737-800 NG cockpit.



And this is the MAX.


"It is my belief that much of this system is similar on later aircraft, including the Max, but I admit it's an assumption on my part."

Its the same, a physical change to the control system would be a step to far for a straight through grandfather certification. It would also trip the balance between new type rating and differences training. I will try and find out if it changed between Classics and NG.

After a brief search since my last post here is some of the things I have found which may be of interest.

http://www.737ng.co.uk/B_NG-Flight_Controls.pdf

http://www.b737.org.uk/flightcontrols.htm#Pitch

https://www.satcom.guru/2018/11/stabilizer-trim.ht...

Welcome back Alistair,

Quote:

"It is my belief that much of this system is similar on later aircraft, including the Max, but I admit it's an assumption on my part."

Its the same, a physical change to the control system would be a step to far for a straight through grandfather certification. It would also trip the balance between new type rating and differences training. I will try and find out if it changed between Classics and NG.

That's exactly what was on my mind as I wrote it.
Any drastic change to the flight controls, such as giving the pilots more authority over that big stabilizer, would trigger re-certification.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Has anyone else noticed that even after the loss of over 100 lives, neither Boeing nor the FAA seemed to feel a need to verify the failed procedure in a simulator before releasing it?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bill; after reading about "forces increasing", "hard to turn trim wheels", etc., I suspect it could take months to build a simulator true-enough to be suitable for 'testing' as compared to one that might be "suitable for training".

Keith Cress
kcress - http://www.flaminsystems.com

Buried somewhere in the links is an account of two European pilots who tried the first procedure in a simulator. The simulator that they were using was true enough to demonstrate that the procedure was not possible.

Quote (Seattle Times)

However, a separate analysis done by Bjorn Fehrm, a former jet-fighter pilot and an aeronautical engineer who is now an analyst with Leeham.net, replicates Lemme’s conclusion that excessive forces on the stabilizer trim wheel led the pilots to lose control.

Fehrm collaborated with a Swedish pilot for a major European airline to do a simulator test that recreated the possible conditions in the Ethiopian cockpit.

A chilling video of how that simulator test played out was posted to YouTube and showed exactly the scenario envisaged in the analysis, elevating it from plausible theory to demonstrated possibility.The Swedish pilot is a 737 flight instructor and training captain who hosts a popular YouTube channel called Mentour Pilot, where he communicates the intricate details of flying an airliner. To protect his employment, his name and the name of his airline are not revealed, but he is very clearly an expert 737 pilot.

In the test, the two European pilots in the 737 simulator set up a situation reflecting what happens when the pre-software fix MCAS is activated: They moved the stabilizer to push the nose down. They set the indicators to show disagreement over the air speed and followed normal procedures to address that, which increases airspeed.

They then followed the instructions Boeing recommended and, as airspeed increases, the forces on the control column and on the stabilizer wheel become increasingly strong.After just a few minutes, with the plane still nose down, the Swedish 737 training pilot is exerting all his might to hold the control column, locking his upper arms around it. Meanwhile, on his right, the first officer tries vainly to turn the stabilizer wheel, barely able to budge it by the end.

If this had been a real flight, these two very competent 737 pilots would have been all but lost.

Someone has a simulator good enough.

Bill
--------------------
"Why not the best?"
Jimmy Carter

To use an analogy of working the hand wheel to trim the aircraft under high loads. Big game fisherman do a similar thing, it is far easier to use both hands to pull on the rod and then as they drop the tip quickly wind any slack up then use both hands to pull on the rod again.

Alistair what do you think of the 18 odd degrees pitch during rotation? Isn't that high for a 737? The sudden drop in pitch after lift off doesn't seem right to me either(drops to roughly 8.8 in less than 3 seconds approx 3 degrees/second change of pitch).

SparWeb - Any data I have seen says the cutout switches disable electrical operation of the stabilizer trim actuator/jack screw. Yet the report shows that the trim actuator/jack screw moved electrically right before the crash. 2 small nose up movements from pilot input and a big automatic nose down movement (presumably MCAS). It's rather hard to reconcile these movements unless the pilots had moved the switches again.

I read somewhere about a week or 10 days ago that there is only one 737 Max 8 simulator available with MCAS.

It appears that the manually trimming the plane by the crank wheels, when the plane is out of trim in a nose dive situation, doesn't appear to be a viable solution. The Senate should ask FAA/Boeing to demonstrate how it is done.

"I read somewhere about a week or 10 days ago that there is only one 737 Max 8 simulator available with MCAS."

Yes, that was discussed in the thread on the lion air crash.

Quote (Seattle Times)

In the test, the two European pilots in the 737 simulator set up a situation reflecting what happens when the pre-software fix MCAS is activated

They did not need a Max8 simulator to set up the same conditions that the MCAS caused.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"Alistair what do you think of the 18 odd degrees pitch during rotation? Isn't that high for a 737? The sudden drop in pitch after lift off doesn't seem right to me either(drops to roughly 8.8 in less than 3 seconds approx 3 degrees/second change of pitch)."

18 deg is completely normal in fact less than what I used yesterday with a 22 ton Q400 which was 20 deg. Noise abetment usually means we are required to rotate and then smoothly pitch at 3 deg rate of change until we maintain V2 + 10 knots while the gear comes up. Then at an altitude which we call acceleration we accelerate to V climb and clean the flaps up. We have a company limitation on pitch of 20 degs on the Q400 so at 22 tons I was pitch 20 deg nose up and way beyond V2 +10 more like V2 +50. At 1000ft acceleration I would pitch down to get V climb to approximately 10 deg then accelerate to V climb then pitch up again. Then at 3000ft accelerate to 210 knots which we then hold to 10 000ft and then go into a pitch hold mode at 5 deg pitch attitude all the way up to FL250 ( this is a slightly strange procedure normally you would not climb an aircraft in anything other than airspeed hold mode but the q is a bit different and if we did that at book speeds the hosties wouldn't be able to get the carts up the cabin as it would be at 10 deg most of the way up, you never see the low speed warning tape on the speed tape so there is no chance of stalling).

I have tried it in the sim and to keep V2+10 in a 22 ton Q, needs just under 30 deg nose pitch attitude which would scare the hell out of the punters plus also it gives us a rather sporty level off at 4000 ft when you going up at 4500ft per min.

At 29.5tons the Q needs 15 deg nose pitch to maintain V2+10.
Speeds for the Q 22tons and (29.5 tons)

V1/Vr 113knts (133)

V2 117nts (135)

Vflup 126 knts (145)

V climb 137 knts. (157)

Everytime I look at the current report things don't line up as we all suspect they should.

For instance, it is pretty clear from the recording and the data that after manually inputting trim ANU (but for some reason only back to 2.3 units and not the original 5) they managed to throw one or both Stab trim cut out switches. There is then a single automatic trim down, presumably from the MCAS which now does nothing. Then nothing from the auto system calling for AND despite the AOA sensor still wildly out of control and the stick shaker going off indicating the system thinks there is an incipient stall about to happen.

Then when they apparently re-activate the electric trim it comes back into play again. How did it (MCAS) know?

I would assume in the 737NG if the AOA indicator goes beserk then this would instigate all sorts of alarms and stick shaking etc as it would use this as a key input into the stall warning? Or is the stall warning cleverer than that and needs other inputs?

How does the NG cope with incorrect AOA signals?

I feel a lot for the captain having very dodgy data and a continuous stick shaker. I'm no pilot but from what I've seen and read this (stick shaker) not only makes a fairly loud noise but is like hanging onto a pneumatic jack hammer which you can't turn off and you can't let go of.

I'm struggling to see how Boeing are going to get around not having to have an MCAS cut out switch to allow all the other aspects of the aircraft stay the same as before. Trying to modify the software wouldn't cut it for me. when software gets very odd readings it tends to do strange things never envisaged so the only way to eliminate it as a risk is to provide a switch or button of some sort, to add of course to the multitude of buttons already there...

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

The Mentour Pilot video has been taken down because there is still a degree of speculation on the subject.

Regards
Ashtree
"Any water can be made potable if you filter it through enough money"

Pretty good deep dive into the prelim report.

I agree.

Answered one of my questions I.e why no more mcas commands? Apparently so long as the pilot doesn't trim back up it kind of goes to sleep. Those two little trim up commands at high speed may have felt too harsh but kick stayed mcas back into life.

Also that AND command at the end was more violent due to the higher speed and couldn't be brought back by column pressure alone like it was earlier in the flight. .

Would continuous manual trim up at that point have saved the plane? Probably doomed by then but maybe needs to be added to the armoury of actions?

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Would throttling back and putting the flap down have made the plane more controllable for the pilots?

Even if it had, how were the pilots in question to have known to do that - or been able to figure this out in a couple of minutes?

At the time of this, the second crash hadn't happened yet (they were it), and Boeing was still trying to bury MCAS as a footnote in the flight control systems. The logic behind its operation was opaque (still is rather opaque). The instructions for pilots just addressed trim runaway, not specifically MCAS going crazy.

Pete K's link above (and included again here) should be required reading for people who are trying to understand this. It's very rich with detail.

For some reason this whole MCAS debacle seems reminiscent or the several fatal crashes that have occurred with autonomous vehicles in control (albeit with human oversight, that proved to be inadequate in the event).
Not from a control logic aspect exactly, but rather from the model that systems of arbitrary complexity can be comprehended sufficiently by semi-independent modules of software and hardware, developed by semi-independent teams, and then launched into the real world of infinite possibilities, without making infrequent but egregious errors that that an appropriately trained, competent human given the same task and responsibility, could be expected to avoid.
There are many layers to this skepticism. For instance, by the authority it is granted, the MCAS can pitch the aircraft down based on its own narrow logic and limited sensor/data array. A human pilot would only take such action based on comprehensive evaluation of all available information, which surely is greater than that provided to the MCAS logic.
Putting the above another way, what happened to system engineering? I'm becoming increasingly disappointed learning about latter day failures that should not occur in a system that is properly engineered at the system level.
I hope the answer is not that systems have become too complex for comprehensive analysis. My rebuttal in that case is, "does that mean they should be let loose in the world before they are validated to be safe, relative to the systems they are supplanting and replacing?"

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Quote (hemi)

Putting the above another way, what happened to system engineering? I'm becoming increasingly disappointed learning about latter day failures that should not occur in a system that is properly engineered at the system level. I hope the answer is not that systems have become too complex for comprehensive analysis.

Yes this is a failure of systems engineering, but only in terms of failing to apply the known and well-proven principles to the changes in the flight control system, which doesn't seem to have happened on the Max.
Refer to last month's Seattle times reports that the original system design of the MCAS included a very small one-time adjustment to trim, but was later expanded in scope after flight test results. The failure, under those conditions, is not returning to the original analysis and following through the consequences of those changes. I believe that process was not done, hence Boeing did not discover that it had made a safe system unsafe, even though they had started the analysis which would have revealed the fact, had they simply updated it after the flight test changes.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Hemi is referring to a much wider scope than just this latest example. I've noticed the same thing, and so I agree fully.

It's worth noting that another major aircraft manufacturer has provided many of the 'case-study worthy' examples of this flavour of aircraft incidents over the decades. Where subtle design or coding errors, or trivially blocked or failed sensors, escalate.

There seems to be something missing in the synthesis, or integration at the highest level, within the System Design process.

And no, I can't put my finger on it.

But, based on some exposure to DO-178, I suspect that the solution for system software is contradictory to that process; at least at the highest level.

There's a semi-valid argument that such designs help to avoid too-frequent human error, and are thus competitive in terms of overall safety. This argument fails to address the 'concentration of liability' that will surely result.

At then end of the Peter Lemme post there is this link which gives a very interesting insight into possible human factors for the pilots of the jet. Well worth a read IMHO. You need to skip down a bit past the data section.

The key for him is the very fast speed at that altitude and the sensitivity of the aircraft to trim action.

ON the final AND the plane went into negative G territory so not surprised they couldn't recover from that.

Pilot action

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

The human factor has been mentioned several times.
What about the human factor as it applies to the management-engineering interface?
Did a sales driven management philosophy put undue pressure on engineering to meet unrealistic goals?
Management demands:
Install larger, more efficient engines.
Maintain type approval.
No simulator training.
If these demands are unreasonable from an engineering viewpoint and if this is the direction that Boeing management has been going, is it possible that the best engineers have voted with their feet and are now working elsewhere?
I'd like to be a fly on the wall in the Boeing board of directors meeting when the overall picture is discussed.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"Putting the above another way, what happened to system engineering?"

It's way more than just that; Boeing has demonstrated on a number of programs that CMMI 3 and higher is not sufficient to fully solve a problem. That's because there needs to solid engineers with EXPERIENCE and understanding of the basic problems. The Uber collision is an excellent example of lack of tribal knowledge and understanding of a basic problem; the software collected and monitored an object moving in an intercept trajectory and yet, did nothing until the object (pedestrian) was in the physical path of the car.

On a broader scale, there used to a Zenger-Miller management class that insisted that a manager needed to know nothing about the technical aspects of the jobs of the people they managed; likewise, there's a tendency to think that you can get a bunch of image processing programmers to design a collision avoidance system.

In this 737 Max case, the lack of rejection of bad sensor data is a major fail. A system engineer would have to actually know something about flying to know to allocate or derive a requirement to gracefully degrade through a sensor malfunction.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

IRStuff has a good point. Perhaps the MCAS software should have been trained to ignore any AOA rate of change that was above a reasonable limit. After all, the aircraft can only change angle of attack up to some specific maximum rate while still under control, any rate faster than that would be defined as an upset or out of control. Any rate of change that is defined as out of control requires that the flight crew have full freedom to decide for themselves which flight controls should be exercised to fly out of the upset.

Any rate of change beyond that should be ignored or at least smoothed, for two reasons.

1) If the rate of change signal is valid, it is a hazardous departure (upset) from stable flight and the pilots are in a better position than the software to evaluate all factors before choosing a course of action. Trained human beings excel at a reasonableness check. Software does not typically simulate human capability so well in this area because the software will never have ALL the sensory input or ALL of the experience a trained human has. Example: a human pilot observing a moving indicator showing that the AOA was varying wildly while seeing absolutely no corresponding variations in any other performance instruments would instantly ignore the erratic AOA indicator.

2) If the rate of change signal is not valid, then it should not be allowed to affect the flight controls in any case.

Aside from the assumed software issues, I still don't understand how Boeing's simulator never encountered something resembling the accidents. Did they simulate a strike on the AoA resulting in mis-matching sensor data? Or was the simulator incapable of accurately simulating MCAS (and this was only discovered after the accidents)?

For a system that actively controls flight characteristics and fights pilot inputs, that seems like a major issue.

Is there any legitimate reason (aside from wanting to minimize changes to keep type certifications) to bury/limit pilot knowledge of such an important system? I would've thought (perhaps naively?) that pilots would be extensively trained on how to handle particular control system failures. With a plane featuring a brand new control system...I don't understand the lack of transparency.

The Lion Air plane also had malfunctioning AoA sensors, so Boeing certainly had forewarning that this could easily happen again.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

"don't understand how Boeing's simulator never encountered something resembling the accidents. "

Testing a complex system, short of brute-force binary failure enumerations, is an art and time-consuming exercise. The Intel Pentium FDIV bug could only be found with very specific tests, and without the accidental finding by someone specifically using the full resolution of the math unit, it would have taken months, if not years of testing to find.

Likewise, in both accidents, while the AoA sensors clearly had some impact, there may have still be other contributing factors that caused the MCAS to act out that did not occur in over 8000 other takeoffs, since AoA failures appear to be a pretty common occurrence.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

waross,

I think you have hit the nail here very well.

It is pretty clear that the desires of the management for these outcomes and all in as short a time as possible have led us to where we are. It will be very interesting to see if other aviation bodies other than the FAA will accept the latest modification and not go back to the beginning and start to more critically investigate the changes from NG to MAX and maybe determine that it is not the same aircraft and that more additional training is required. It would be interesting to see this 45 minute Ipad "training" to see what it mentions about the handling characteristics and the stab cut out switches.

If the lack of feedback loop between original MCAS design intent ( small degree (0.6) AND trim command and only once) and what changed after flight testing ( 2.5 degree and multiple times) occurred on other systems.

I think it was sparweb who said earlier on in this post that there was a constant fine line / fuzzy boundary between what is "new" but still the "same as before". It looks to most people I think that Boeing have stepped over that line, the issue now for other regulators will be where else did they do this and how critically have those changes been reviewed for unintended but fatal consequences.

Certainly in instrumentation I deal with there are out of range errors which disable executive action based on them. Also rate of change which is physically impossible should flag an instrument error instead of direct feeding garbage into the control system.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

IRStuff,

That's fair. Is AoA failure really that common? I thought there was an earlier post, maybe on the Lion Air thread, saying they were pretty sturdy typically.

Quote (RVAmeche)

Aside from the assumed software issues, I still don't understand how Boeing's simulator never encountered something resembling the accidents.

Google "fuzzing" as it relates to software testing/hacking... perhaps fuzzing should be a slightly more prevalent test scenario in the simulators than current...

Dan - Owner
http://www.Hi-TecDesigns.com

Apart from simulating the actual MCAS system, there is at least one simulator in Europe that is capable of simulating recovery from a runaway trim condition caused by a failed MCAS.
I understand that part of the procedure put out by Boeing was a method to recover from the runaway trim caused by MCAS malfunctions.
That procedure has been tested on a simulator, just apparently not by Boeing.

Quote:

On a broader scale, there used to a Zenger-Miller management class that insisted that a manager needed to know nothing about the technical aspects of the jobs of the people they managed

Most of us older folk can share at least one and probably more anecdotes of departments or whole companies in severe distress as a result of years of following this philosophy.
I suspect that the underlying issues are much broader than just the technical aspects of MCAS.
Let's look at the possible overall contributing factors:
FAA culture. (Possibly partly driven by underfunding.)
Boeing's management culture;
...Resisting additional training.
...Loss of corporate memory. (1982 flight manual.)
...Possible inappropriate engine selection and mounting.
...Issuance of an unworkable procedure without any verification that it would work.
...Has Boeing become a victim of creeping Peter Principle?

Is a software kludge a valid solution to an engine size and placement that changes the flight characteristics as much as the new engines changed the 737 characteristics?
A question for the experts:
Given the altered flight characteristics, would the Max8 have passed certification even under the original rules?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Waross;
I'm not arguing with your list. I just want to point out that every company I ever worked for suffered from "loss of corporate memory" from one day to the next.
I find it most curious, if my understanding of the MCAS function is correct, is that it just seems to have been poorly envisioned and implemented. Placing so much reliance on a single sensor when another is available, and to give the system full authority over the pilots attempts to countermand it seems to be poorly thought out, and I would assume that the functions of the software went through many layers of peer review, including by experienced pilots who would probably tend to not like that.

Brad Waybright

It's all okay as long as it's okay.

Quote (thebard3)

I find it most curious, if my understanding of the MCAS function is correct, is that it just seems to have been poorly envisioned and implemented. Placing so much reliance on a single sensor when another is available, and to give the system full authority over the pilots attempts to countermand it seems to be poorly thought out, and I would assume that the functions of the software went through many layers of peer review, including by experienced pilots who would probably tend to not like that.

I believe SparWeb hit the nail on the head:

Quote (SparWeb)

Refer to last month's Seattle times reports that the original system design of the MCAS included a very small one-time adjustment to trim, but was later expanded in scope after flight test results.

I am not in the aviation industry, but I can empathize on the point that last minute changes on a project on its way out the door often do not receive the same level of scrutiny as they would inside of the "normal" design process. It typically takes a seasoned individual to "catch" the mistakes or shortcomings imposed by late changes and correct them. I would surmise that some degree of pressure from management served to fast track the MCAS changes after the flight tests - as others in this thread have posited as well.

Quote (KoachCSR)

a project on its way out the door often do not receive the same level of scrutiny as they would inside of the "normal" design process.

Hence the need for 'Change Management'. I'm not in the aviation industry either, but in the chemical world all of our processes are subject to review before any changes are made. And usually, if something bad goes wrong the worst thing that happens is that everything stops. Since it's all on the ground, that's usually not a terrible thing.

Brad Waybright

It's all okay as long as it's okay.

I doubt that Boeing doesn't have change management; it's part of the system engineering process certified by their CMMI rating. However, no such process guarantees quality paperwork, just that paperwork exists and is processed per written procedures, and no such process guarantees that everyone on the sign-off applies their full diligence.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I find the design philosophy of the MCAS system deeply disturbing.

(1) It accepts input from just one AoA sensor, trusts it to continuously to trim the aircraft to destruction.
(2) It does not monitor/check the result of its own action.
(3) It does not take other information from the plane control to test the need of MCAS.
(4) It has no ability to verify the soundness of the AoA signal like a sudden jump movement that clearly cannot possibly happen to a 70 ton plane flying in mid air. (JT610 jumped 20 degree and ET302 jumped 75 degree are detectable by a simple check on the signal’s rate of change/gradient/first derivative).
(5) It persists activation even the AoA signal indicates the plane is outside the normal operating envelope (unreasonable AoA angles).
(6) MCAS has no other intelligence to tell a nose up from a nose dive and applies the trim indiscriminately.

"(4) It has no ability to verify the soundness of the AoA signal like a sudden jump movement that clearly cannot possibly happen to a 70 ton plane flying in mid air. (JT610 jumped 20 degree and ET302 jumped 75 degree are detectable by a simple check on the signal’s rate of change/gradient/first derivative)."

This is precisely the same behavior that resulted in death of the pedestrian by the Uber self-driving car. A pedestrian suddenly appeared in front of the car with zero time for even reacting, but the sensors on the car detected the pedestrian well before then, but the software was not written to follow the logical course of induction.

I've seen the exact same lack of design philosophy and derived requirements in a project in my own history.

Sadly, this comes from so many programmers and too few actual and experienced system engineers. Everyone thinks that they can take an image processing class, or read a book, or whatever, and start to program complex systems. Programming is nearly the absolute last thing in the design process.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I must admit I have extremely little experience with control systems in fact after 3rd year systems and controls at Uni. I have only recently had to relearn control while renovating a house I am building which I am sticking in a ground heat pump system and underfloor heating and fan coils. And its changed days from my youth with vented hot water cylinders and a 240V triggered gas boiler. So getting my head into TMV3 valves, 2 way diverter valves, 3 way mix valves and smart controls... Anyway back to aircraft in flight....


The problem with stalling is that the books all talk about the stall speed and its very easy to fall into the trap and think that its the only speed the aircraft stalls at. The quoted speed is for a very precise set of conditions ie 1g straight and level flight clean aircraft.


The actual speed which an aircraft stalls is dependent on power setting, angle of bank, weight, CoG, configuration, altitude and what your doing with it. When they quote speeds its actually a speed where the angle of attack hits the critical angle of attack for the defined conditions.

At the beginnning of flight stalling wasn't understood at all. In fact in the First world war the standard procedure for dealing with a stall was to pull back on the stick until you crashed. Then some british combat pilot survived a stall because he lost grip on the controls and the aircraft recovered itself by dropping its nose. He spotted this and then tried it on purpose and pushed the nose down and recovered. He reported this to the powers that be and was instantly court martalled for disobeying the pilot order book. But the stall recovery procedure which we still use today was born. (I don't have a reference for this tale, I had the utter joy of flying with a BAe test pilot in his final job before retirement who told me this. Ex empire test pilot school, Lightning pilot, and was the lead test pilot on the Jetstream 41. So don't have clue if its true or not.. but it does have a ring of how it might have happened.)


The first stall systems where sucktion hooters on slightly the underside of the wing, which when the pressure changed from positive pressure of the underside producing lift changed to negative pressure they gave a sound like a duck getting murdered to the pilot. This system is still used today on the likes of cessna 150's to C172's


It then progressed to a electrical system which used a tab in the airflow which when lifted by the same effect would trigger an alarm and recovery systems. The likes of Jetstream 31/32's shorts 360 straight wing had this sort of system.

With the developement of straight wing jets the above methods didn't work for high altituide and any transonic airflow and they had to look at something else.

Because airspeed can't give you the state of the aircraft apart from in very set conditions the only thing that was left was the measurement of the actual angle of attack. So they started using AoA vanes. But it didn't progress through the whole system. They decided that the pilots didn;t need to know the actual angle of attack and could stick with just nailing the airspeed and getting the values from a book. Which for transport type aircraft works fine. Military came away from this with performance aircraft and started using angle of attack on approaches and the like and the pilots nail the angle and the airspeed looks after itself and they put enough power in to maitain the flight profile they want.


I really don't know why, its still to this day a huge reluctance to allow pilots to see the actual AoA of the aircraft. Most of the flight management systems use it to set cruise speeds for fuel effeciency etc also it does the stall system. On the flight deck with EFIS avionics we can see the AoA varying with the low speed red tape on the airspeed indicator. Most of the time on turbo props we can't see it but on approach to land we come in at approximately 30 knts above the tape. On windy gusty days it bounces up and down and when it gets too close to the Vref we add a bit on so the stick shaker doesn't go off. But if you add to much on, when it comes to the flare to land the aircraft has way to much energy and will float and all your landing performance numbers will be way out. Add in a contaminated runway and you have all the holes in the swiss cheese model lined up for departing the runway at the end or off the side.

It started off as a single job system which only triggered an alerting system. Then the data was used to feed into other systems which wasn't a problem when those system had no direct control over the aircraft apart from say setting a cruise power. Now its being used to directly control the aircraft and its systems. But fundamentally the sensor and data handling and error trapping is the same as it was in the 1950's when it was developed when the limit of its authority was sounding an annoying alarm in the cockpit and triggering a vibrator on the stick.


In my experence AoA vanes are very solid infact its usually the heater which they have to stop ice forming on them that goes which then means you can't fly in icing conditions that causes thier replacement not the actual unit providing dodgy data.

Hi Alistair. Thank you very much for the information that you have shared with us.
I heard a slightly different version of the WW1 story.
As the story went, there was a tendency to spin out when turning.
One pilot had a theory that you may be able to recover from a spin by diving.
He argued this with fellow pilots.
Then one day he tried to test his theory.
The pilots on the ground observed that he did bring the plane out of the spin.
Unfortunately he did not have enough altitude to recover from the dive and died in the crash.
This may be a different version of your story.
We may never know the true story. grin.

Bill
--------------------
"Why not the best?"
Jimmy Carter

To an extent these 2-mishaps continue to remind me of the Aeroperú Flight 603 B757-23 that crashed in the ocean very soon after take-off on a dark night with very poor visual references.

https://en.wikipedia.org/wiki/Aeroper%C3%BA_Flight...

The aircraft took off 42 minutes after midnight (05:42 UTC) on 2 October,[6](p10) and straight away, the Boeing 757 airliner crew discovered that their basic flight instruments were behaving erratically and reported receiving contradictory serial emergency messages from the flight management computer, including rudder ratio, mach speed trim, overspeed, underspeed and flying too low. The crew declared an emergency and requested an immediate return to the airport.[2]

In this case the pitot tubes had been taped-over for maintenance [wash?] and the tape was inadvertently left in-place. Photos of the wreckage in the ocean clearly showed the Pitots covered with tape. This prevented the ADC from interpreting the flight condition and poor visibility made visual flying almost impossible.

In the case of the 737MAX it appears the compounding factor of the MCAS... working in the background with unreliable pitot/AOA 'bug' [left, right side] may have made the situation even worse than the AeroPeru 757 experienced with blocked pitot's.

I wonder if 'bugs' or other FOD [mud, etc] sources could have contaminated one or more Pitots? I doubt if the wreckage will ever reveal the in-flight condition of these probes.

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

Don't go with that one I am afraid.

When you are in a spin everything is stalled apart from the rudder. You can wiggle and waggle the stick as much as you like it won't come out.

Only thing that will work is opposite direction rudder and when that then bites you get airflow again over the other controls. The aircraft is actually under very little loading while its spinning. You just have to watch you don't pull the wings off when you pull the nose up after the rudder input stops the spin.

Thanks for debunking that Alistair.
It was a long time ago and memory fades. It was probably something out of a novel, possibly by Nevil Shute, possibly not.
Given Shute's background as an aeronautical engineer he would have known better.
Bill
--------------------
"Why not the best?"
Jimmy Carter

Alistair_Heaton, I think the suggestion was not to have the system ignore the AoA sensors at any particular angle reading (maybe some limit where the angle would not be possible?), but above a certain rate of change in the reading that would not be possible, indicating a fault in the sensor. Would that be a workable improvement to the system?

Also, from some of the previous posts I get that variations between AoA sensors on opposite sides is a normal occurrence, but is there a limit on how much the angle of attack can vary between one side and the other during normal flight for these planes?

My point was more there is no other way to obtain if you about to stall or not.

I really don't know how much angle change is required to give a certain amount of speed red tape to change. Or for that matter how much difference you get between sides.

That sort of detail is not required to operate the aircraft. The B2 technicin s avionics will have limits in thier mans but pilots do not get access to them normally.

It doesn't help if I speculate with you lot so I will stick to only the stuff I am sure about.

Apropos to Alistair's story about recovery...
https://www.historynet.com/spin-control.htm

Dan - Owner
http://www.Hi-TecDesigns.com

Alistair, the account related by your instructor is pretty spot on. From the wikipedia article on Spin (aerodynamics), the history section says this:

Quote (Wikipedia: spin (aerodynamics))

In August 1912, Lieutenant Wilfred Parke RN became the first aviator to recover from an accidental spin when his Avro Type G biplane entered a spin at 700 feet AGL in the traffic pattern at Larkhill. Parke attempted to recover from the spin by increasing engine speed, pulling back on the stick, and turning into the spin, with no effect. The aircraft descended 450 feet, and horrified observers expected a fatal crash. Though disabled by centrifugal forces, Parke still sought an escape. In an effort to neutralize the forces pinning him against the right side of the cockpit, he applied full right rudder, and the aircraft leveled out fifty feet[17] above the ground. With the aircraft now under control, Parke climbed, made another approach, and landed safely.

In spite of the discovery of "Parke's technique" spin-recovery procedures were not a routine part of pilot training until well into World War I. The first documented case of an intentional spin and recovery is that of Harry Hawker.[18] In the summer of 1914, Hawker recovered from an intentional spin over Brooklands, England, by centralizing the controls. Russian aviator Konstantin Artseulov, having independently discovered a recovery technique, somewhat different from Parke's and Hawker's, on the frontlines, demonstrated it in a dramatic display over the Kacha flight school's airfield on September 24, 1916, intentionally driving his Nieuport 21 into a spin and recovering from it twice.[19] Later, Artseulov, at the time an instructor at the school, went on to teach this technique to all of his students, quickly disseminating it among the Russian aviators and beyond.[20]

In 1917, the English physicist Frederick Lindemann conducted a series of experiments in a B.E.2E [21] that led to the first understanding of the aerodynamics of the spin. In Britain, starting in 1917, spin recovery procedures were routinely taught by flight instructors at the Gosport School of Special Flying, while in France, at the School of Acrobacy and Combat, Americans who had volunteered to serve in the famous Lafayette Escadrille were by July 1917 learning how to do what the French called a vrille.[22]

The article also relates the story that @waross may be remembering.

Quote:

The first chapter of the spin story closes with a tragic irony. Less than four months after his landmark spin recovery above Salisbury Plain, Wilfred Parke set off from Hendon on a cross-country trip, piloting a sleek Handley Page E monoplane. About five miles out over Wembley golf course, the engine was running so rough that he decided to turn back toward Hendon, trusting in the luck and skills that had served him so well. But as he turned downwind over the treetops with a failing engine, his Handley Page stalled—the beginning of Parke’s Dive. He knew what to do, of course, but this time Parke fatally ran out of height and luck.

I am not surprised that Tim's account of what happened was more true than not. I think he was RN as well originally and a carrier pilot.

I had a very enjoyable week of flying charters with him between Aberdeen in Scotland and Bergen, Stravanger and OStesund in Norway and Shetland in Scotland. I had been a Captain for 6 months but it was very easy to fall into being a FO again with an old master aviator in the Captains seat.

We spent our time in the cruise and waiting for pax discussing aircraft performance and aerodynamics. The pilot theory taught is basically wrong and simplified to the point of having a clue but no clue. I had the basic stuff from my engineering degree but never really understood terms such as control harmony, dutch roll and the big one which is min control airborne. The last one is for when we are one engine down and the rudder is your life saving control input, not enough air over it and it won't produce enough lift to counter the moment from the live engine and you won't have enough roll authority to stop the aircraft rolling on its back and going into a none recoverable spiral dive at low level. We had plenty of empty sectors as well so he got to demonstrate alot of what we were discussing. So it was the back side of the weather brief covered in maths and theory with pax onboard and flying on one engine empty. I realise now how lucky I was to experence this. Most pilots never get to see these effects and survive never mind get them explained by someone that knows what they are talking about and can waggle a stick.

That generation of aviators who were slightly before Sully's time are completely different to modern day pilots. Tim was friends with Douglas Bader, Eric Bristow and the like and had the personal email address of Niel Armstrong. Niel it was nothing to do with the moon :D it was to do with glue for fixing a wooden and canvas aircraft. Can't remember what type it was but think Tiger Moth vintage. It involved horses and human piss I seem to remember. But the resultant glue had some extremely good properties for canvas and wood.


Its some 14 years ago now but that week still has day to day effects on my flying and also in the sim checks as well. Even if you wanted to pay for it I susepct it would be very hard for a pilot to get the training I did that week with Tim. It was two blokes with a love of aviation that could both speak maths, one a grandad (Tim) and one a grandchild (me) who was hanging on every word he said, and he loved being listen to and being asked questions and was more than happy to answer them. And we had an aircraft to play with and fuel to burn.


I suppose in Engineering terms it was like getting your first lead engineer job as a naval Architect and the Engineering director used to work on Square riggers and knew how the sail plan and rigging worked and you got stuck in in some ship yard together with a bar for a week waiting for transport and he found out you were building your own boat. Then things developed....


I was feeling guilty then of thread drift but then realised the above yarn is actually the issue with this issue. There are no people like Tim involved with the big picture or just lots of people dealing with thier own little picture and not communicating to the big picture. So we get "we have a problem big picture, the stabilistion performance at high alphas is outside certification limits with current values".... "ok small picture fix it and let me know" "ok big picture we have fixed it with a software change of the limits"........ Now this next bit is where the error wasn't trapped. Was the question asked how and what effect this software fix was going to have on the big picture or was it just accepted as fixed.

Boeing CEO says it’s completed 96 test flights with 737 Max software fix

CNBC Link

Check out Eng-Tips Forum's Policies here:
FAQ731-376: Eng-Tips.com Forum Policies

Big picture, little picture.-
Little picture.
Does the fix work?
Big Picture.
With the radical change in characteristics caused by the new engines, is the extension of type certification valid, or wise?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Alistair; That is an experience to treasure.
Thank you for sharing with us.
It brought to mind an experience of mine.
Very early in my career I had a job driving the truck for the guy who changed the street lights in a big city.
I was young and he was old.
One day he spotted an old work mate on the street and hailed him.
We went for a very long coffee break.
These men had worked together stringing the first rural distribution lines across the Canadian prairies.
I was a fly on the wall as these old timers remembered the old days.
In the hot, dry Canadian summer on dry cedar poles they worked 2300 Volts bare handed.
"It was okay as long as you didn't get in series."
"Ya, you never wanted to get in series."
"Do you ever hear from Joe?"
"No. Didn't you hear? He got in series down by Moose Jaw."
"Ya, you didn't want to get in series."
"What about Harry?""
"Oh, he got in series over by... What about Sam?"
"Sam got in series by..."
I guess that these were the only two left. Every mutual friend that they could remember had 'Got in series' somewhere.
After about an hour, I envy the week that you spent, Alistair.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"Was the question asked how and what effect this software fix was going to have on the big picture or was it just accepted as fixed. "

Obviously, we won't know for sure for some time, but it's also been pretty obvious that faulty data was a more of a symptomatic problem. From a pure systems engineering perspective, we can only hope that someone realizes that the any arbitrary introduction of thresholds or limits on data inputs isn't necessarily going to do the job and that a more comprehensive solution approach involving looking at the inputs and aircraft immediate history holistically is required.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I'm struck by some similarities between these crashes, and the Airbus crash of Air France 447 back in 2009. Both crashes were in part caused by failure of sensors, and the poor management (trapping) of those errors and clear reporting of the discrepancies by the automated systems to the crew.

AF 447 was pure poor discipline and not carrying out published procedures for invalid airspeed indication. There was a design fault with the pitot tube heaters which allowed them to get iced up but it was only one hole in the chain.

But after that it was pure pilot error I am afraid to say. To be honest it was pilot error they were flying into an ITCZ huge cell in the first place. The accident could have been trapped before the pitots iced to the point of being useless. It could have been trapped when the crew planned the rest cycle in the cockpit before departure by ensuring that the Commander was in his seat for a higher risk period of the flight crossing the ITCZ instead of in his bunk.

But anyway if they had set a pitch attitude and a power setting and flown the aircraft manually using partial panel procedure as published. They would have come out the other side and on the decent into azors or the canaries the aircraft would have defrosted at 15 000 ft and they could have climbed back up and continued to destination if they had enough fuel left. But the commander was in his bunk, the first officer was calling the shots, a cruise FO in the RHS who isn't allowed to fly the aircraft under 10 000ft, they went into a ITCZ CB and came out the bottom instead of out the other side because of a simple airspeed indication mismatch.


At no point did the aircraft take over. It did revert to a down graded control law when it worked out that the airspeeds were showing mismatches and kicked the AP out to make the pilots deal with it. After that everything that happened after that was pilot input.

I remember watching a dramatized documentary about that incident and seem to recall that there was conflict between the pilot/co-pilot and that one was secretly pulling the stick back without the knowledge or direction of the other.

Also want the an issue that the stall warning stopped and started due to conflicting data so when they came back in the"zone"the stall warning went off confusing them but yes pilot error was a key issue.

https://www.flightglobal.com/news/articles/stall-w...

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote (Charliealphabravo)

I remember watching a dramatized documentary about that incident and seem to recall that there was conflict between the pilot/co-pilot and that one was secretly pulling the stick back without the knowledge or direction of the other.

AF 447 was a strange one.

The pilots had an airspeed mismatch. Autopilot kicks off, aircraft switches to an alternate control law. Pilot flying responds with nose-up inputs until the aircraft reaches MPA and eventually enters a stall. Aircraft begins descending, eventually at a rate over 10,000 fpm. PF apparently confuses stall buffet with overspeed buffet and continues nose-up inputs.

Angle of attack becomes so high, the flight controller thinks the AOA inputs are invalid. This means they are ignored, and that stall protection is turned off, so no stick shaker or stall warning. Any time PF brings the nose down, AOA returns to the range which the flight controller believes is correct, which re-activates stall protection.

This creates a situation where nose-down inputs activate the stick shaker/stall warning. That's pretty damn counterintuitive.

From the CVR transcript the Captain apparently understood what was happening and attempted to provide nose-down input to bring the aircraft out of the stall. The guy in the other seat, who was much less experienced, held his stick back which canceled out the captain's nose-down inputs for many minutes until the plane hit the water. This was possible because the two sidestick controls aren't physically linked the way a dual-yoke aircraft is, and there's no feedback mechanism.

There's certainly a large pilot error component- the pilots didn't follow the airspeed mismatch procedure, PF didn't yield control of the aircraft to the captain on the audible call etc. But also a design philosophy component as well. Seems likely that the exact same scenario with the exact same flight crew in a dual-yoke aircraft would not have resulted in a crash- the captain would have been able to easily tell that the FO was applying incorrect inputs.

I think the bigger picture issue now is whether the FAA or other regulators are going to demand more pilot training or more in depth analysis as Boeing have now also discovered some other mysterious fault requiring software changes.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Did you see the part where the system failed to report a high AoA when it deemed a valid signal to be invalid?
Manslaughter charges were brought against Air France and Airbus in March, 2011 in France
According to the Air France-KLM Group Consolidated Financial Statement for 2017, (page 70)
As off the end of 2017, the manslaughter charges against Air France were still ongoing.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Here is the final report on AF 447.

https://www.bea.aero/docspa/2009/f-cp090601.en/pdf...

Its got quiet alot on CRM training as well which would have been a factor in the MAX accidents.

Re AF 447

In general, if any incident investigation finds that human error is a significant contributing factor, then perhaps that aspect deserves at least one more "Why?".

Convenient Wiki ref. 5 Whys

These lines of inquiry bear fruit when they lead to changes in the system design, software, user interface, human factors, training, etc.

Would it be unreasonable to suggest the new training for 737 Max proposed by the plane manufacturer should include the two scenarios of the Indonesian and Ethiopian accidents to see if the pilot could come out alive?

We got all the black box data so it shouldn't be too hard to put them into the simulators.

I will feel more comfortable with this inclusion if in future I have to board a 737 Max.

Five Whys should also be applied to the Boeing process that led these two MCAS incidents

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

IMHO, installing two AoA sensors but using them one per flight leg in alternation was a colossally bad decision.

Perhaps some paper pushers thought that it provided redundancy, but it didn't; it provided a single point of failure, and additionally provided confusion that masked the failure half the time.

Mike Halloran
Stratford, CT, USA

"Perhaps some paper pushers thought that it provided redundancy, but it didn't; it provided a single point of failure, and additionally provided confusion that masked the failure half the time."

Two sensors can provide redundancy/cross-checking, in a correctly designed system. In both of the crashes in question, one of the two AoA sensors was working correctly, but the hardware/software ignored the contradictory data. A simple history track and cross-checking of both sensors could have potentially avoided the accidents.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Whatever passed for a system (not MCAS - I mean top aircraft level system) DFMEA for the final design would be very interesting to see.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Unfortunately we are not talking about a correctly designed system.

We are talking about a horridly hacked kludge so stupendously bad that no part of the design team, from bottom to top, and especially toward the top, should be allowed to participate in design of anything remotely like an aircraft, again, ever.

Mike Halloran
Stratford, CT, USA

Been looking at what other makes do with AoA sensing. I have limited it to flyby wire types.

Ejets use whats called a smart probe system and have done away with AoA vanes

Airbus all have 3 vanes 2 main ones at the front and one down the back.

The A220 from Bombardier has 3 all on the nose.

VE1BLL: Thanks for the 5 whys. I learned something.

AH! That's what I was suggesting way up this thread. Why not three on a $120M plane and why not a voting controller that dumps the bad one. Sigh.

Keith Cress
kcress - http://www.flaminsystems.com

Circa 2008, flight QF72 went "psycho" in spite of having three AoA sensors. Triple redundancy by itself can't overcome bad (or incomplete) system design.

--

It seems like there might be an arguably new (perhaps it just needs to be made more explicit) sub-field of engineering; in-between System Design, Safety Design, Human Factors, Software, and A.I.

Specifically: How can we optimise the opportunity for synergy given both automation and humans? The sum should always be greater than the parts. But right now it seems more like the weakest link wins.

Point being, either can fail, either subtly or spectacularly. That makes it a very difficult requirement.

That's where the new science is needed: a theory and a formal process to ensure optimum synergy of automation and humans. Especially in abnormal or emergency situations.

Pilot and aircraft fighting is exactly the opposite. How do we ensure that we design-out these fights? How do we ensure that the automation and humans combine in a synergistic way?

The higher supervisory level of automation will require more inputs, and much more software.

More software brings its own issues, so a new process is required. Perhaps more AI and/or Fuzzy Logic at this new supervisory level.

By way of example about the more inputs. In these sorts of incidents the aircraft decides that pitching down is required. The system is seemingly oblivious to the sudden negative-g, and is oblivious to the passengers bouncing off the ceiling. The system is also seemingly unaware of the pilots' inputs.

If this were more of an A.I. topic, then we could usefully compare these systems to Helen Keller (the famous deaf and blind person). The systems lack sensory inputs to provide an opportunity for a higher level of overall situational awareness. e.g. Will a self-driving car posses enough sensory inputs that it can detect that it is, itself, on fire?

Can an aircraft be aware that its last action caused an unwanted result?

And how does it smoothly cooperate with the pilots, while accepting that it itself may be faulty?

It seems like this is the gap that is at the root of these and many similar incidents.

It'll probably take a decade to fill this gap.

Maybe there should be a well guarded button labeled "Let humans fly the plane".

Quote (wayne440)

Maybe there should be a well guarded button labeled "Let humans fly the plane".

... with an electric cattle prod connected to the guard, so that if the pilot touches it while somato-gyrally/gravically deluded, the switch stays open.

... and an infallible system to decide when the cattle prod ought to be energised.

A

I'm going to seize on this quote from Alistair:

Quote (Alistair Heaton)

It started off as a single job system which only triggered an alerting system. Then the data was used to feed into other systems which wasn't a problem when those system had no direct control over the aircraft apart from say setting a cruise power. Now its being used to directly control the aircraft and its systems. But fundamentally the sensor and data handling and error trapping is the same as it was in the 1950's when it was developed when the limit of its authority was sounding an annoying alarm in the cockpit and triggering a vibrator on the stick.

It's an example of extension of the use of a device beyond its original intent or ability.
Just like the 737 has been extended beyond its original scope of performance.
So whether you focus on a narrow or a wide field, this happens. Sometimes the growth is carefully done, sometimes it's a kludge.

Here's an example:
About 15 years ago, operational regulations changed in the USA & Europe related to the heating of the pitot tubes (aerodynamic airspeed sensors). Heating them prevents ice from forming, so this example seems to be appropriate here. The rule change made it mandatory to alert the flight crew to a potential failure of the heater, letting them know that one of the airspeeds could be faulty. The rule was retroactive on aircraft based on the kind of operation used by the owner. Private owners didn't have to do this, but commercial operators flying scheduled routes did. This led to a zillion failure detection systems being figured out by technicians as "one-off" designs in dozens of aircraft types by hundreds of companies, rather than the aircraft manufacturers providing one common kit to upgrade each aircraft type that every operator could use. I got involved in a few of these, and made sure to have a number of functional and operational tests done to demonstrate that the system works every time it was installed, and include a supplement in the crew's flight manual to be clear on what the warnings mean.

Even so, for each type of aircraft and helicopter I repeated the system on, I had to come up with a new way to integrate it into the existing functions and warnings. One one aircraft, I was able to integrate the warning into the group of existing caution/warning lights, by picking my way through the fault logic board to find the spot. On another, no such caution/warning panel existed so it was just a pair of crude lights on the instrument panel, itself a crude layout from the decades before anyone heard of system design.

This is what it's like coming up with a new system, or modifying an existing system with new features on an aircraft that's already been designed and built. You have to take the machine as it is, and splice in the new stuff as smoothly as you can. If you do it well, you provide the crew with the intended improvement in their safety and a way to diagnose problems. Do it badly, and you confuse the crew or introduce a new mode of failure.

None of the aircraft or helicopters that needed this system had to undergo a FMEA, so it wasn't done. It is not part of the basic type design of most light aircraft or helicopters, certainly not old ones, and if you think about it, that's WHY they didn't have a warning system in the first place. The new rule didn't specify that FMEA was needed, either.

The introduction of that rule would have been completely different if the responsibility had been placed on the OEM's to provide the system.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

I personally wouldn't want self learning AI in a plane I'm flying on. I want the system to have very well developed and vetted rules for how it responds to certain inputs, not an output it's learned that won't be known until it's required to respond to an certain set of inputs.

"Why not three on a $120M plane and why not a voting controller that dumps the bad one. Sigh."

Because that would have explosively destroyed the grandfather certification usage of the 737 type and meant that crew would not have been able to have done less than 1 hours training on an Ipad and gone and flown it. Plus also the avionics system would have had to have a complete re certification because I suspect it would then have been deemed FBW and all the critical software quality checks would need to have been done. We can be pretty certain they haven't. Which in the time frame they had would have been impossible. They could have junked the 737 system and then brought in the 787 FBW control system but again that would have failed the grandfather certification for the 737.

It all circulates round the bean counters/commercial stipulating a set of requirements which the lead engineer didn't have the balls or if they did to have the ability to say sex and travel.

Coming away from aviation but using a case study which I personally use while training CRM to pilots, it has aspects of the big picture of why Chernobyl went bang.

You might wonder why a pilot would use a nuclear power plant failure to facilitate crew resource management?

Its something different to what pilots are used to. They all get hammered to death with Kegworth/Tenerife and other big name aircraft crashes which AF477 is now on the list.
Give them something which is equally complex to operate, its operated by a bunch of people who don't and can't understand the big picture of the design. We can then focus discussions on the interactions between humans and the machine and the error cheese, than get involved with the excuse of are but "good airmanship" would save the day and minute detail of the technicalities of operating an aircraft.

Note that I use operating not flying an aircraft. Yes there are times we fly it. 99% of the time we are operating it and cross checking that our instructions have achieved our intent of what it was meant to do. This aircraft design has failed because the aircraft isn't predictable by the pilots and when they do choose to then fly it..... it won't let them or its already in a condition which is not recoverable.

BTW I really can't see any number of test flights proving that the system is fixed. And they might think things are bad now..... if another 737 max crashes and there is any hint that its a control software issue then the current situation will seem like it was childs play to sort out.

Quote (LH)

...self learning AI...

The "more AI and/or Fuzzy Logic" was intended merely as a placeholder to help convey the larger point about the need for a supervisory system to help ensure optimum man-machine synergy.

Any AI obviously wouldn't be self learning in the field.

And you're correct that the field of AI is very weak in fully understanding the systems they've created. That's why I mentioned fuzzy logic.

Ensuring optimum synergy is the point.

"This
margin
is too
small..."

...to include a design spec.

"Why not three on a $120M plane and why not a voting controller that dumps the bad one. Sigh."

Because that would have explosively destroyed the grandfather certification usage of the 737 type and meant that crew would not have been able to have done less than 1 hours training on an Ipad and gone and flown it"

Was management telling engineering when they should be asking engineering?

Adding AoA sensors will "have explosively destroyed the grandfather certification" but the installations of physically larger engines in such a way as to drastically alter the flight characteristics is allowed to be grandfathered?
Incredible... unbelievable.
I don't doubt you but;
A 5-Why check may not get to the root cause, but with enough Whys, there may be a hard look at the grandfathering provisions and the general oversight of the FAA.

Bill
--------------------
"Why not the best?"
Jimmy Carter

We will have to wait for sparweb to confirm....


But engines are not actually part of the type certification. Power plant is treated as a separate entity which is then attached. The Aircraft gets certified and the engines get certified. Then there is a process for matching the two up but its not a full certification process.

That makes some sense. Engines are always being improved and changing slightly. It's probably more related to the number of engines and general location (underwing, etc) if I had to guess.

I'm not seeing why a sensor system supplied by a contractor to the craft maker would affect anything about the plane certs or require one second of additional training time.

Right now the AoA system is completely hidden from the pilots in that they don't have any say in which of the 2 AoA systems is running the show, or even have the ability to select which one.

The pilots are probably not privy to obscure engine control algorithms or the electronics that convert pitot tube airflow into usable electronic signals either.

So, a voting AoA controller dishes up only good AoA info for the system to use and turns on a fault light somewhere that shows AoA "2 disabled". There is still nothing for the flight crew to do, no added switches, no selectability, and same operational situation if all the AoAs choked for some reason, you're back to, "you have bad AoA deal with it." At least you'd have the chance of the voting controller actually looking at the AoA data and indicating it's all unreliable.

A voted 3-AoA controller would've prevented both these disasters, by virtue of 'something' making a viable decision about AoA information correctness.

Keith Cress
kcress - http://www.flaminsystems.com

Quote (itsmoked)

I'm not seeing why a sensor system supplied by a contractor to the craft maker would affect anything about the plane certs or require one second of additional training time.

Certification of an aircraft design involves a lot more than what is and is not visible to the pilots.

A significant change in control design or structure means the control design or structure needs to be re-evaluated and re-certified. The gray area is what is defined as significant and what isn't.

And... right now the AoA system IS NOT hidden from the pilots. Good AoA feedback affects the function of the autopilot and the handling law of the airplane directly- meaning even if AoA is not displayed on the HUD, feedback about its functionality is of vital importance.

This is showing potential to be one of the great engineering/management blunders in history, in terms of notoriety, and consequences. Cases that immediately come to mind are automotive, e.g. Corvair, EPA consent decree, VW "Dieselgate"...
I rule out Comet 1 as they did what they did in good faith. I rule in Corvair as the swing axle is a low cost, inferior concept for independent suspension, and GM defended it until the model year 1965 Corvair was introduced with a fully articulated rear suspension that was not susceptible to axle jacking. Aerospace cases that come to mind are few; the Challenger shuttle,... the Concorde (not because of the accident, but rather because of the frightfully low return on investment). It could be argued that the Concorde program was a catalyst for profitable technology, like Apollo, but I'm skeptical, so show me the argument.
Others? I suggest blunders committed in wartime should be treated separately, due to urgency ("the fog of war") and political interference. For instance, Hitler's repurposing of the ME-262 as a bomber, hence delaying its availability as an interceptor.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Nobody seemed to care that the old Beetle was a swing axle as well. Or old Triumphs. Or....or... The rap on the Corvair was total BS and a hit job. But a certain do-gooder and his non-profit came out OK on it.

The problem with sloppy work is that the supply FAR EXCEEDS the demand

The Corvair incident was not quite that simple.
I always ran nearly equal tire pressures in my 64 Corvair, and it handled well.
But GM recommended absurdly low front tire pressures, in order to make it understeer.
... which it did, but then the steering became terribly imprecise.

Axle jacking was just a fantasy based on a 2D drawing that was incorrect.
In truth, the springs took a set as soon as the car was loaded, so none of the early Corvairs ever had positive camber with a driver in them.

The only real danger was that it was very easy to drive very, very fast, because even with low front tire pressure, it didn't give much warning that the tires were nearing their limits, and it didn't have a loud sound signature in the cockpit, even at speed. The engine, and the noise, was all in the back.

My 64 Corvair was no better nor worse than its competitors.
My 65 Corvair was immensely improved; I miss it still.

Mike Halloran
Stratford, CT, USA

Fans of the Corvair should watch season 2 of the TV series Fargo (based on the movie).

Now I'll skate out on some thin ice for a moment... hopefully I won't skid like a Corvair.
Engines are not certified as a part of the airframe, they have their own type certificates. But that doesn't mean that the integration of the powerplant isn't a major part of the aircraft's own certification process. In fact the engine's integration drives a lot of the requirements and the design. Loads, speeds, torque, inertia... all are affected. The system demands to feed a particular engine are one thing, and the energy it supplies as electricity, hot compressed air, and hydraulic pressure, drives more system design downstream.

That said, there isn't a rule that forces you to re-certify everything, specifically, when upgrading an engine. As some of you can tell, engine changes start with slight component upgrades, run through the spectrum of performance possibilities from extra power to broader RPM ranges to higher altitudes to lower fuel consumption. Keep improving performance, or completely switch to a new powerplant, and many systems will start from scratch. Because this is a grey area, not a fine line, I find that there's room built into the process for negotiation - rightly so - of the kind that assumes equal parties acting in good faith. I won't take a position on anyone not acting in good faith because there's no evidence to say so at this point.

I will repeat something I said earlier though. The scope of the changes to the 737-700/800 models in the 90's (they were stretched, given a glass cockpit and the NG engines) appeared to me to be significant enough to trigger the re-certification process. Alas, the FAA/JAA hadn't come up with rules to control that decision, yet. It is possible that the 737NG's were the impetus that convinced the FAA/JAA that they had to get this policy in writing.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Hi SparWeb. Feel free to decline comment on this.
Under Canadian regs, could an engine selection and placement that is so different than the original that the flight characteristics were altered be grandfathered under type approval?

Bill
--------------------
"Why not the best?"
Jimmy Carter

The certification basis of the Max's is public information on the FAA.gov website.

Here is a link to the type certificate data sheet (TCDS) for the 737 series aircraft. One can see that each model is designed using specific amendment levels of the FAR's. Each platform shows the engines that are allowed for each model. The newer 737's are certified to higher amendment levels (generally) than the original.
Link

Each amendment level can be found here: Link
Interestingly the longitudinal control and longitudinal stability and control is designed to current amendment levels (25.143 amendment 108 and 25.231 amendment 108).
The longitudinal trim has an ELOS (equivalent level of safety findings) "PS12-0038-F-2" (Ref FAR 25.161 amendment 115 which is current). I would like to read this memo but I'm not sure it's public. See pdf page 96 of the TCDS.

I'm a structural guy so this stuff is quite out of my expertise and hesitate to comment. However, I have kept up with this thread and am thankful to the knowledge of the contributors!! Thanks Alistair for your pilot's point of view. I hope the above information helps.

Thanks for that, downloaded onto the IPad for reading in the cruise.

I will say discussing the subject here is much better than the pilot forums. Where hormones and emotional state seem to carry the day instead of informed discussion.

The certification stuff is way beyond what pilots need to know about. We get the aircraft with a thing called a service release signed by a licenced technician. There is what we call a post holder in charge of Engineering and a person called the CAMO which stands for Continuing Airworthiness Management Organisation. Between the two of them they ensure that the release for service is only given when the other paper work is correct and the plane is serviceable. So we only have to check the release for service is valid (its usually valid for between 24 and 48 hours depending on the type and the company approval). Then we can go flying. If the paper work isn't correct we don't go flying.

Quote (Alistair Heaton)

Where hormones and emotional state seem to carry the day instead of informed discussion.

I'm quite familiar with this concept after 2 failed marriages. I don't think that's what you were referring, though?

Brad Waybright

It's all okay as long as it's okay.

Well to be honest we are all adrenalin junkies. And most of us classed as stable extroverts. With a large percentage of Alpha males.

The heated arguments and oxygen wasted about SOP's would quiet surprise you.

Should it be free on the left, clear on the left, left side free. left side clear.....

Then you get into cultural differences between nationality's, avid supporters of a particular aircraft type or make....

Must admit I do take the piss out of mates that fly ATR's..... so I am not entirely innocent about not fitting into the stereotype.

Quote (waross)

Under Canadian regs, could an engine selection and placement that is so different than the original that the flight characteristics were altered be grandfathered under type approval?

That's a really tough question to answer, especially for the 737's and the Leap engines.
Compare the engine thrust between a -700 model and a Max 8, and it's not really that different. Compare the placement, it's about a meter forward. Compare the diameter, it's not much larger. It's a drastic difference compared to the original 737, I agree, but model by model it just sneaks up.

I could spend hours/days trying to satisfy myself that this should go one way or another based on the information I have, but I know it would all be "armchair quarterbacking".
I did look at the policy and there's no fine line to be drawn. Advisory Circular 21.101A
That document is NOT fun to read. It's full of if/then/else/except stacks of logical deliberation. There is a table of examples in the back, which suggests all kinds of ridiculous proposed aircraft design changes, with a smattering of practical examples mixed in that I actually use in my job. Mostly I do my best to avoid ever invoking these conditions, but my excuse is the scope of the design work I do usually involves using the aircraft within its existing envelope, not expanding it.

If you want to drive yourself nuts, try it for yourself. I have to read the flow-charts slowly, and talking to myself helps. You may be most keenly interested in page A-5 from the appendix, but jumping to that part before reading the first parts will just make this discussion worse, not better. If you get that far, and still want to cite the example as a reason it should have invoked a certification change, then I'll play devil's advocate and pick apart the wording and show that it doesn't. We will go crazy trying to prove our points, but the REAL problem is that the policy is badly worded and convoluted. The examples are not very helpful, either. It's better than NO POLICY, but leaves room for misunderstanding still.

I think the FAA simply didn't want to tie its own hands on this issue, but they knew they had to do something, given the state of the industry prolonging the life of existing designs with upgrades, rather than creating new designs at the latest safety standards.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Thank you SparWeb.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"but my excuse is the scope of the design work I do usually involves using the aircraft within its existing envelope, not expanding it."

That's the thing with the Leap engines they don't per say provide more power. There is an expansion of envelope but that parameter is range.....


The reason why the range goes up is because the LEAP engines sip fuel.

737 500 uses 2700kg of fuel an hour in the cruise.

The leap engines use 1600kg on the A220

The Airbus Neo my mates tell me is easily beating its advertised 20% fuel saving per seat mile that was advertised in the marketing.

Quote (Sparweb)

It's a drastic difference compared to the original 737, I agree, but model by model it just sneaks up.

Therein is the key. incremental change from one upgrade to the next upgrade is the underlying issue compared to continually comparing it to the original. A similar thing happened to the BOP on the Deepwater Horizon where the depth of the system gradually crept up m by m until it got beyond it's operating envelope.

I suspect this would be such a big change that it would cause chaos, but really is what should be done.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote:

incremental change from one upgrade to the next upgrade

I suspect some of that is, 'look it creeped and showed no nefarious results'.

'Let's creep it some more...'

Keith Cress
kcress - http://www.flaminsystems.com

Quote (SparWeb noted)

...there's no fine line to be drawn.

Policy makers should try to avoid bifurcating a spectrum.

A spectrum of possibilities that has been arbitrarily divided into just two choices inevitably leads to endless arguments at the sharp boundary. And worse, being forced to accept a process that is either clearly too little, or clearly too much.

At the very least, policy makers should include a minimum of three options.

E.g. for airworthiness change categories, Major, Medium, or Minor.

There are some workarounds, but issues remain stemming from this 'cognitive bias' instinct to divide spectrums into only two parts.

VE1BLL

I agree but it still doesn't stop the boundaries issue and the medium category sounds like "a little bit pregnant".

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Of course, the FAA has had a continual issue with its organizational mission conflict of interest, i.e., regulate, AND promote. That's an inherent bifurcation in the fundamental psyche of the FAA.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

BTW you think the FAA has issues.... you should see what the Australians have to put up with.

And in the JAR days in Europe they stipulated that hot air balloons needed an airspeed indicator. And EASA has continued in the same vane.

So its a world wide issue. Nobody seems to want to pay for proper regulation and oversight.

Seems that there isn't any protection against stupidity ... like enforcing meaningless dumb technical requirements while not checking stuff that actually matters.

An airspeed indicator on a hot air balloon is easy. Just print out a big "0" on a mailing label and stick it somewhere, and call that the airspeed indicator.

The fact is that these regulation agency's these days employ more lawyers, phycologists and other blunty types than engineers and operators.

The JAR lawyers didn't have a clue until a lady from Humberside in the UK who told them not to be so bloody stupid and explained the reason why.

They wanted a fully certified ASI and it checked and calibrated as per normal avionic regs, so every 3 years for private operators and every year as commercial.

Quote (VE1BLL)

E.g. for airworthiness change categories, Major, Medium, or Minor.

Actually, if you read the advisory (And I don't blame you for not reading it. REALLY, you probably shouldn't) they use these terms:
Significant / not significant
Substantial / not substantial
There's no middle ground. Nobody is "a little pregnant" as LittleInch put it.

When you're plugging in new boxes and drilling holes for the wires to run through, you definitely do NOT want to do anything that provokes either "substantial" or "significant" or your project budget triples. It seems a little odd to extrapolate this kind of attitude from my perspective all the way up to Boeing's business decisions, given their complexity and what is at stake. I still think that's what's going on, otherwise why doesn't the 737 type certificate show the latest models certified to the latest requirements?
Actually, all of the OEM aircraft companies do this, and from their perspective they are making as much use of the design work they did in the past as they can.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

I am sure that the argument will be made that an engine placement that requires MCAS intervention at high angles of attack crosses the line into "Substantial" and "Significant".
As I understand the reason, it was not for stall prevention or avoidance, that was a pre-existing function and routine.
The treason for this application of MCAS was that at high angles of attack the extra lift from the further forward mounted engines could reduce the pressure on the stick as the AoA increased rather than increasing it as per the regulations.
That sure seems to be "Substantial" and "Significant".
Time will tell.
Sadly, over 300 souls will not be available to testify as to their first hand experience when the flaws became apparent.

A question that has been bugging me;
Why didn't they just extend the landing gear so that the engines could be placed in the same position as in previous versions of the aircraft?
Is it something to do with operational limits of the standard passenger boarding bridge?
I understand that the front gear was extended, so that tends to shoot down the type approvals argument.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (Waross)

Why didn't they just extend the landing gear so that the engines could be placed in the same position as in previous versions of the aircraft?

Because the landing gear needs to retract.
Longer gear need a bigger hole in the plane which isn't there.
Longer gear has more drag so impacts landing and take offs.
Longer gear will create larger moment forces from the braked wheels needing stiffer mounts.

And I'm not am aircraft designer but this is what I can think of off the cuff.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

A bit of research also shows that the latest 737NG is actually higher off the ground than the original 737. This was relatively low to the ground to allow stairs to be loaded on the plane and baggage loaded before the advent of baggage ramps by people on the ground. Smaller engines in 1968...

https://www.latimes.com/local/california/la-fi-boe...

Interestingly I didn't realize that the wheels sit under the plane in a pocket but without covers.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Back to MCAS, there was this comment on the reason, why Boeing had increased the MCAS rudder step input from .6 to 2.5 deg.
The cutout of Seattle Times' report of March 18th is attached (can't load up an image from here).
A result of test flights.. so, what do the respective test flights to same setups tell now?
There's not just one direction to look, this automatism saving the plane in one situation might well (again) put it in danger in another one.. or rather, might be insufficient to the real needs in that situation.

I feel that the public should have the right to full disclosure of technical changes in order to take part in the discussion.
I feel as well that aircraft and regulatory specialists from all ends should be involved rather than having one more dangerous situation. Due to "soft factors" like tradition, technical inbreed, usual ways.. you name it.

Thanks so much to everybody here, for all this substantial input and research.
kind regards
R

Roland Heilmann

• https://files.engineering.com/getfile.aspx?folder=086bbb99-f1e7-4b82-ab48-0

I certainly wish I had access to the Functional Hazard Assessment for the addition of the MCAS. I think it would make interesting reading to see the assumptions.

This is interesting.

IEEE Spectrum, by Gregory Travis, 18 Apr 2019

'How the Boeing 737 Max Disaster Looks to a Software Developer'

VE1BLL, thanks for the link.

I have been a software developer for a part of my career.

I think I reached the unofficial rank of 'Cowboy Coder' (usually used as a pejorative), which for a time was useful to a now former employer, because I could rip up and replace major pieces of code, by myself, with no committees or specifications, and sometimes no source code, in a very short time frame, like in the week before a major show.

My stuff was never shipped to customers.

A government agency other than the FAA required that the code that shipped to customers was written with approved procedures, with voluminous specifications, rigorous reviews, exhaustive testing, regression testing going back to the company's early days, and all the stuff that inherently causes delay in software development. ... so much delay that some problems were fixed with hardware changes, because it was faster than generating formally approved software.

The FAA must be at least as fussy as that other agency about software development, so I'm concerned about time estimates on the order of a small number of weeks to modify the MCAS software.

Maybe Boeing has a few Cowboy Coders working ahead of the official teams, pointing the way, or maybe not, but I'd feel more comfortable if they had teams of hardware and software and aero hackers working on a higher level, with no a priori restrictions on what could be tried. ... Like, for example, designing engine nacelles that didn't produce much lift at high AOA, even if they looked odd. ... and ditching the MCAS entirely, or at least reducing its authority.










Mike Halloran
Stratford, CT, USA

Indeed. Kind of like the secret service model, i.e. "get results", "we don't want to know about your methods", "we will disown you if you are caught". Not quite as sinister as that, but the corner cutting applies.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

The process is, of course, DO-178 of whatever version and various Design Assurance Levels.

The word "Assurance" seems to be a case of over-selling; based on these occasional incidents. The investigation will hopefully examine that larger question.

Do we need even more detailed development process? Or is the entire proof of compliance approach doomed to peak at about 99% Assurance coverage because of some subtle Gödel-like proof limit that nobody has yet noticed?

There are companies / products that explicitly avoid getting tangled up in DO-178. They highlight, "No software, firmware or programmable logic." Example

Thanks for the link, VE1BLL.
He says pretty much what I have been thinking from a problem solving point of view.

Hi Mike. When you say cowboy, I think rodeo.
The very top rodeo cowboys make a fortune, that, wisely invested, can leave them set for life.
I personally know an ex Canadian champion roper who still enjoys the fruits of his invested earnings, over 25 years later. My son played hockey and branded calves with his sons over the last couple of years.
Some rodeo cowboys make a living.
Some struggle to make a living and a lot often don't recover their entry fees.
This comment, Mike, " which for a time was useful to a now former employer," would put you in the well above average category of 'Cowboy Coder'.
To follow the rodeo comparison, I've got to wonder if some of the 'Cowboy Coder's are making their entry fees.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bill, I will take "well above average" as a compliment; thank you for that.

That former employer had ~5000 employees scattered around the globe. I was one of maybe 50 "Champions", selected by the Chairman and primary owner to work on special projects for the Chairman, in addition to their normal duties for a huge bureaucracy. Products generated by the bureaucracy were mostly expensive failures. Successful products just sort of appeared one day, high up in the bureaucracy's product development queue, with no apparent history, all development work having been completed outside, or inside with stolen resources. It was a grand adventure, and worked well until the Chairman got sick and died.

Mike Halloran
Stratford, CT, USA

Warning: May be off topic.
Yes Mike, a "well above average" compliment.
There are cowboys and there are cowboys.
Coding is not the only field where "Cowboy" is used as a pejorative.
But I know the families of two cowboy brothers.
One is working as a successful professional cowboy.
His brother is almost as good.
Along the way, both have college educations and both have earned teachers certificates.
The othr brother is teaching school locally.
They are not the only "cowboys" with college degrees.
There are a number of schools offering 'rodeo' scholarships.
A successful rodeo cowboy must have above average physical abilities.
People with above average physical ability very often have above average mental ability.
I am pleased that my son has met and been befriended by a number of cowboys who are also successful businessmen and often have an advanced education.
I see a champion cowboy with a college degree on the side, as a positive role model.

Bill
--------------------
"Why not the best?"
Jimmy Carter

From Reuters

"
By David Shepardson

WASHINGTON (Reuters) - The U.S. Federal Aviation Administration said Friday that a joint governmental review of the now grounded Boeing 737 MAX will begin on April 29 and will include 9 other aviation regulators from around the world.

The FAA said earlier this month it was forming an international team to review the safety of the aircraft, grounded worldwide following two deadly crashes - in Indonesia in October and in Ethiopia last month - that killed nearly 350 people.

Boeing has announced a planned software update on the 737 MAX to prevent erroneous data from triggering an anti-stall system known as MCAS that is under scrutiny following the two disastrous nose-down crashes. It has not yet submitted the software to the FAA for formal approval.

China, the European Aviation Safety Agency, Canada, Brazil, Australia, Japan, Indonesia, Singapore and the United Arab Emirates will all take part, the FAA said, in the Joint Authorities Technical Review (JATR) that is set to last 90 days, the FAA said. Most of the countries previously confirmed they would take part.

The JATR is chaired by former National Transportation Safety Board Chairman Chris Hart and is comprised of a team of experts from the FAA, NASA and international aviation authorities. The group will conduct a comprehensive review of the certification of the aircraft’s automated flight control system.

The team will evaluate aspects of the 737 MAX automated flight control system, including design and pilots’ interaction with the system, "to determine its compliance with all applicable regulations and to identify future enhancements that might be needed," the FAA said.

Hart told reporters earlier this month the review is in response "to the growing need for globalization ... because these airplanes are all over the place" and to the need for a “uniform response."

American Airlines and Southwest Airlines Co have canceled flights into August as a result of the grounding.

Boeing Chief Executive Dennis Muilenburg said Wednesday the manufacturer is making "steady progress" on the path to certifying a software update to the grounded 737 MAX and has made the final test flight before a certification flight."

I susepct though they may dig up other issues as well in the process.

That may not be as good as it sounds.

Quote:

The team will evaluate aspects of the 737 MAX automated flight control system

Why do we have MCAS in the first place?
I'm sorry. That question is outside the terms of reference of this inquiry.

Remember the Piper Alpha?

Quote (Wiki)

An explosion and resulting oil and gas fires destroyed Piper Alpha on 6 July 1988, killing 167 people,
The total insured loss was about £1.7 billion ($3.4 billion)

I was on a project when the project manager dictated that we would NOT be using locks on switches.
A paper lockout system would be used.
I suggested that the Piper Alpha disaster could have been avoided by the use of a $5.00 padlock on a motor starter rather than a paper lockout system.
The project manager denied this and provided me with a url to what he claimed was the official inquiry.
I found the report online and in the first paragraph found words to the effect:

The purpose of this inquiry is to investigate the 'domino effect' where one problem led to another, and help develop standards for the layout of future platforms with a view to avoiding similar disasters in the future.
This inquiry will not investigate the root cause of the disaster.
No need to read further.
With 3.4 billion in insured loss in the balance you can expect some powerful lobbying and pressure when the terms of reference are set.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Actually Les one of the Piper OIM's that was killed on the RIB pulling people out the water was my Scout master. There was quiet a few kids without dads that week at school in Aberdeen.

I also taught one of the guys that jumped from the helideck and survived how to fly.

But more similar to this situation is the Chinook crash off Shetland. A change in transmittion component without suitable testing and analysis led to its failure and desyncing of the blades.

Here is the Cullen inquiry reports if you want.

http://www.hse.gov.uk/offshore/piper-alpha-disaste...

And the accident report on the chinook


https://www.gov.uk/aaib-reports/2-1988-boeing-vert...

One of the results of Five Whys is listed the executive summary, a failure of a process; communications, documentation, and following existing process/documentation.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Alistair; I apologize for triggering what must still be painful memories.
Thank you for sharing the links.
I have spent some time reading the Cullen report. It will take a lot more time to read completely.
I am impressed with the quality of the report.
The Cullen report was definitely not the report that I was given.
I may have been given only one chapter of the Cullen report, in which case the disclaimer may have applied to that chapter only.
I haven't found it yet.

And in regards to helicopters there was the crash of Cougar Helicopters Flight 91.
The pilots were not aware that the aircraft gearbox did not meet the 30 minute "run dry" standard. They assumed that they had time for a return to St John's International Airport. The gearbox failed 8 minutes later.
In 2003 the S-92A initially failed a FAR/JAR-29 additional oil system loss of lubrication test (sometimes called the "run dry" test) conducted to determine whether it could sustain 30-minute operation without main gearbox lubrication, failing after 10 minutes.[27] Subsequent design changes implemented an oil cooler bypass valve to eliminate what were seen to be the most likely sources of leakage, the cooler and external lines and fittings. Certification was obtained without meeting the 30-minute test as the chances of oil loss were calculated as being "extremely remote",[28] a statistical chance of failure of approximately one in every 10 million flight hours. This was based on the erroneous assumption that all leaks would occur from the oil cooler, and so did not represent the type of leak that occurred to Flight 91 or to a CHC S-92A in Australia the previous year.[29][30]
Link

Bill
--------------------
"Why not the best?"
Jimmy Carter

Don't worries mate. NO apologises required.

I am up to 14 pilots now that I have known that are now dead due various accidents. The commercial side of things that I do now is very safe we often say the drive to the airport is the most dangerous bit of the day. The pre multicrew days were not anywhere near as safe. All of the fixed wing where killed burning petrol not Jet A. All experienced and knew what they were doing but a combination of events (including them screwing up sometimes by not pressing a single button) meant that they aren't with us any more.

I was 16 at the time of Piper and to be honest in the 70/80's in Aberdeen it wasn't that uncommon for kids to get pulled out of class because their dads had been killed or had life changing injury's. In fact the year before that I had started labouring in oil yards and while slinging pipe one of the wire strops broke and dumping the string. The guy I was working with tried to run away from the lorry and I went under the axles. I am here now to tell you about it he isn't. Very changed times, the last time I was in an Aberdeen oil yard in 2006 where if you walked up a set of stairs without using the hand rail you got a written warning. And if that was combined with coming out the toilet not wearing your high viz, safety glass and hard hat you were out of a job. If it was a singular memory of that type of event then it would be a painful trigger but unfortunately its not.

And its worth finding the Ladbroke Grove rail crash report which Cullen chaired as well. He also did the Lockerbie report.

Being an Aberdeen lad the trials and tribulations of the mechanical palm tree's I must admit I do follow.....from a distance. I would never get in one or allow a family member into a helicopter, intrinsically dangerous devices 6 out of the 14 pilots I have known killed have been due to them and I know probably in the region of 40-50 fixed wing pilots for every rotary pilot.

To be honest something breaking and killing them is easier to deal with than knowing that they screwed up (which unfortunately is most of the time). The closed coffins and dealing with their relatives is also a big issue. We know as pilots that if you hit the ground at 200 knts plus the harness just acts as cheese wire and cuts your body up. Closely followed by the instrument panel acting as a garlic crusher to puree the rest when mill seconds later you hit it.

So the most traumatic part of the proceedings is listening to someone's mum complain about the undertaker who is apparently heartless not letting her see her boy/girl for the last time. We all know that what they have managed to recover will have been put into the coffin from a bucket, double bagged if there was a fire and the weight made up with gelatine bags. But you can't tell her that... You just make a point of having a quiet word with the undertaker saying as a pilot you know the reasons and thankyou for looking after our mate.

oh and I must admit I am not a great fan of locking out controls either. You either have them to be used or you design in interlocks to prevent the use in certain situations.

In aviation we use guarded switches which are also colour coded. So all the important ones which are irreversible require you to lift then press. The control handles are also textured and shape coded as well. So the gear handle is shaped like a wheel. The prop condition levers have a wave a effect on them and on complex petrol aircraft the mixture levers are a square block. The J41 the condition levers also had red lights in them which lit up with the fire alarm so you didn't grab the wrong one to shut the engine down which actually worked extremely well.

When I am talking about locking out equipment it is because the equipment is down for some reason. It may be partially disassembled, some-one may be working on it or for some other reason it should not be used.
I had an idiot who visited me and who I told that I was working on a circuit and to not turn it on, then go directly to the switch and turn on the circuit. (I left. Don't know and don't care who finished that job.)
I have had a supervisor tear off my "Do Not Operate" tag and that of my partner and close the switch.
I saw a supervisor who looked at a machine and was told that the machine was not yet ready to run and that a worker was adjusting the gears, then go and start the machine.
In the Piper Alpha disaster, apparently managers started a pump that was missing the safety valve. (PSV)
They either misunderstood or ignored the paper work.
Had there been a lock used, they would have found the off duty worker who had the key and been told why the pump was out of service.
I understand from the Cullen report that the rig was having serious problems but starting the pump did not help and may have been the trigger to the disaster.
I have seen too many managers put their personal convenience ahead of safety. You cannot bypass apadlock quite as easily as you can bypass a piece of paper.
I like locks.
This brings back memories:
"The guy I was working with tried to run away from the lorry and I went under the axles."
I was unloading a logging truck and the load had shifted badly. I could see the logs starting to move as I released the last restraint. I dove under the truck and was crawling under the trailer axle as logs cascaded down both sides of the truck.
I had a two step rule in those days:
1 Where will the danger area be when something breaks.
2. Don't be there.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Update:
The FAA is accepting for now the assertions from Boeing that the system modifications can reduce the hazards. It also seems that the largest pilot's unions in the USA are on board with proposed (non-simulator) training changes. The scope of the training changes seems to be growing beyond the 737-Max but to include all 737's. This is expressed as an oversight, or inadequacy in the procedure on all of the models that can be corrected at the same time as this one. Training on simulators is not being pursued. Training the flight crew responses to AoA sensor equipment failures does not seem to have been discussed.
https://www.bloomberg.com/news/articles/2019-04-16...

For their part, pilots from American Airlines say they have tested the proposed fixes from Boeing in simulators, but AA does not plan to offer simulator training to all pilots flying the 737 Max. Depending on the articles I read, it seems that the community of airline pilots are not fully behind the union's position that simulator training is not required.

I am relieved to see that Canada has the right person in the lead of this case:

Transport Minister Marc Garneau said on Wednesday that the planes would be grounded “for as long as it takes” and pilots should experience the fixes Boeing is devising in simulators instead of relying only on more basic, computer-based ground training.

The stance of Transport Canada, if it's maintained after the US reintroduction of the 737-Max without sim time, could become a painful competitiveness issue between our countries' airlines. I personally support Garneau's position. The "modern" analytical method has failed, so the "old" simulator method of training should be adopted. It will be far more effective at restoring public trust than another analysis. It may also assert some reality check on the assumptions in the safety analysis, which, who knows, may still be flawed. If the regulator imposes simulator training on the air carriers, which presumably would include response to system failure, then the back-and-forth decision about training costs gets taken away from airlines.

I am curious to see the results of simulator scenarios based on the new MCAS, especially the results from pilots who are subjected to the MCAS behaviour with an AoA sensor (or other type) failure. And I would want to see it done with airline pilot crews, not just Boeing's company test crews. Comparison with the simulator test of an original MCAS failure would give everyone a much better understanding of the level of improvement that can actually be achieved. I do wonder how many crews in the sim will crack up on their first try, before getting the procedure down and steadying the plane out.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

One would have thought every 737Max pilot would be interested to see the difference between the old and new MCAS at least in a simulator?

Sim's are fun and valuable learning tools. And expensive. The pilot's union may be more sensitive to the cost than individual pilots.

Here's a demonstration of what an out-of-trim situation looks like in a 737-800 "Next-Gen" simulator.
They purposefully mis-trim the aircraft for the demonstration, but the result of the situation looks authentic.
The right-hand pilot has a lot of difficulty dragging the trim wheel around, in either direction.
If you watch the whole video, you can get a pretty good explanation of the opposing forces on the stabilizer when mis-trimmed at high speed (probably better than the explanation I attempted a while ago).

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

First thing I thought when I saw the sim stuff was that's Innsbruck horn that they are trying not to crash into.

This is where its going to become political. There is no other options apart from Airbus in the MAX's market. And the Unions will not want to be blamed for the MAX turning into a dodo.

There is only one sim in the world loaded with the MCAS flight model... And its Boeings in Seattle. And the purchase of the sim model costs millions per sim. Which is why they more than likely want to link the fix to the 737-800 as well.

I haven't seen anything from EASA yet and Ryanair isn't saying anything in regards to the training side of things.

The certifcation issues need to be sorted first completely before the training can be looked at. I still suspect that the FAA will recertify the MAX but the rest of the world won't in the short term. So it will be flying again internally in the USA. Quiet how the public will react to that I really don't know. Most won't have a clue what type of aircraft they are boarding until they see the emergency brief sheet.

The way they pay pilots in the USA is different to most other areas. We get paid a salary for a certain number of hours and overtime above that number. If we fly less than the contract hours we still get paid the same. In the US they get paid by the airborne hour. If you don't fly you don't get paid a dime. Also we get paid for time in the simulators and training etc. US pilots don't, it doesn't even get counted towards rest time for flight time limitations. You do your training in your own time, unpaid, and if you fly for 6 days then are in the sim for a day then fly for another 7 days thats all legal because the day in the sim is counted as a day off. So I am not really suprised the pilot unions don't want thier members to loose money having to go to the sim. A conversion course would be a couple of days in the class room and 2-3 4 hour sessions in the sim so 7 days with no salary.

I might add that the above is a general statement there are some companys who have a more progressive and safety minded culture and do things differently. Fedex is an example that bucks the norm.

I don't have a clue how they do it in Canada.

Edited to add this articel


https://www.nytimes.com/2019/04/20/business/boeing...

Pilots being unpaid to learn to fly safely has to be one of the most scary things that I've just learned about. That and low junior pilot pay and sick rules, that makes me think of flight 3407 (one of the pilots was sleep deprived and sick because she couldn't afford to be sick) which crashed on the opposite of the airport approach that I live under.

I just had a chilling thought.
It is acknowledged that the engines will provide not just added lift but also a trim up effect at high angles of attack.
Is the converse true?
Will the engines provide an added trim down effect when a bird takes off an AoA sensor and MCAS does the "dive of death"?

Bill
--------------------
"Why not the best?"
Jimmy Carter

no they won't, its basically a newton effect of flat face in an airstream, the angle gives it a force vector. if the nose is pitched down the face that the vector is on is internal to the engine and will have its airflow changing the vector.

The trim up effect is due to the point of pressure from the engine vector being forward of the Centre of gravity. There will be the same effect on other engines configurations but because they are not as far forward the moment will be less. Also they have a more rounded shape so the vector is smaller.


There is a huge what we call pitch power couple anyway due to the centre of thrust from the engines being below the CoG. This is considered normal for every under wing jet and pilots just have to deal with it and its acceptable for certification although some makes and models now automatically trim for it. Which I suspect is half the reason why MCAS was needed. I don't see it really for takeoff. Its a go around its for when your set up on approach and then you hit TOGA and the power goes from 30-40% N1 to 100% and you will be manual flying. Flaps cause a nose up pitch when they are retracted.

So you have multiple additions to pitch the nose up anyway. Just that the force to increase Alpha with all these effects increases the nearer you get to the critical angle alpha they stay constant. Problem with the leap engine configuration is the force vector increases the moment with alpha so the control forces decrease.

Oh and although they seem to have missed it completely in the Colgan accident report and just say they didn't follow stall recovery...

They did actually follow a form of stall recovery. That of the elevator stalling which normally happens just as you select the next stage of flap. And the procedure is pull back on the stick and remove flap... Thing is we don't have a warning system for elevator stalling. It just happens due to ice build up on the tail. You pull back on the stick and remove flap get her flying again and then find a runway long enough that you don't need flap to land on. But its not normal for pilots these days to be taught about it. The only reason why I know about it is because of that week flying with Tim the auld test pilot.

The real problem was that the US used to have a test criterial of only loosing 100ft during a stall which the rest of the none FAA world didn't have and actively taught the opposite. So FAA pilots would always try and power out of the stall which works okish when its just the stick shaker because that's warning you your approaching but your not actually stalled yet. When your stalled the only thing that will allow you to recover is to reduce the angle of attack. They have since changed things but there are a lot of old instructors and examiners still teach the old method.

I always thought the Me-262 must have had a serious nose-up tendency due to the position of the engines.



Edit: At the risk of going TOO far afield I post this stunt as a classic example of center of thrust below center of mass:

I still find myself questioning the use of software to correct a hardware anomaly. I am aware that the military sometimes designs fighter jets that are inherently unstable/unflyable unless the computer controls the aircraft by comparing the flight envelope limits to the pilot's input request, but those pilots have ejection seats when the software becomes unavailable.

Having read several reports about MCAS, I would ask the following questions of whomever signed off on this system.

1. Since the hardware anomaly is always present (the nacelle shape and location does not change, ever) then the instability always exists in the dangerous part of the flight envelope. So what protects the aircraft when MCAS cannot if the aircraft enters that dangerous region of the envelope with MCAS out of the picture due to opening the stab trim cutout switches?

2. Since MCAS only operates in manual flight mode, does that mean it is impossible for the autopilot to command the aircraft into the dangerous part of the envelope?

3. Since MCAS only operates with flaps retracted, does that mean it is impossible to manually fly the aircraft into the dangerous part of the envelope with the flaps extended?

The above questions are why I consider a software fix to a hardware anomaly inadequate when the occupants (crew and passengers) have no escape path (ejection seats) if the computer is not available (stab trim cutout) to protect the aircraft from bad flight control inputs.

Thank you for taking the time to explain that, Alistair.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Is MCAS really "software," as opposed to "firmware?" In military systems, that's a big difference; firmware is basically hardware and essentially always loaded and running, while software has operating systems, possibility of CPR errors, interrupts, etc. If MCAS is mission critical, then one would think that it'll be firmware and subject to the same reliability analysis as any other of the critical avionics systems.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

That may be so but it seems like a nuance since as far as I understand we haven't been discussing malfunctions of the MCAS code within its normal parameters.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

"1. So what protects the aircraft when MCAS cannot if the aircraft enters that dangerous region of the envelope with MCAS out of the picture due to opening the stab trim cutout switches?"

absolutely nothing....

"2. Since MCAS only operates in manual flight mode, does that mean it is impossible for the autopilot to command the aircraft into the dangerous part of the envelope?"

The trim system does not rely on force feedback to know what its doing. And yes it can take the aircraft into all extremes of the flight envelope. When it does and it hits a limit and triggers an alarm be it over speed or underspeed it then gives up and gives control back to the pilots to sort out.

"3. Since MCAS only operates with flaps retracted, does that mean it is impossible to manually fly the aircraft into the dangerous part of the envelope with the flaps extended?"

No it doesn't and there is a standard stall setup which replicates exactly this when you have landing flap and its practised in the sim, but this is where it gets interesting for me flight dynamics wise. And thanks to the test pilot week I understand it these days.


When you deploy flap it has several effects on flight stability. And to note its flaps and slats. Flaps are on the trailing edge and slats are on the leading edge.

It moves the centre of pressure of the wing inboard making the aircraft less stabile in roll.

Its also moves it rearwards increasing stability.

It increases the wing area as well.

Now this alters the pitch moment force diagram. The lift generated by the engines will be constant with alpha. The flaps/slats cause a pitch down moment so they are working opposite to the engine pitch. When you increase the alpha the nose down forces will increase thanks to the flaps. I presume the moment increase from the flaps/slats will over power the opposite effect of the engines so there is always an increase in control force with higher alphas. Now this is the nice version...…

Nasty version is that there is no certification standard for control forces with flaps extended so they decided to just turn it off when they are selected as there are not required to meet any standards on it.

Quote (IRstuff)

..."software," as opposed to "firmware?"...

The distinction is blurred. Even between "software" and "hardware", the boundaries are fuzzy.

Some policies have had to retreat to "field loadable". Even that distinction is unreliable, as the OEM may only acknowledge that capability when they suddenly decide that they need help in fielding an unexpected update.

Would deploying mimimum flaps have disabled MCAS and made the aircraft flyable with pilot controlled electric trim still operable?
Would it have been safe to deploy minimum flaps when they got into trouble?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Yes it would disable MCAS, but it would probably not have saved them. The pilots were so focused on the false stick shaker that they let the plane approach sonic speeds at low levels which would likely have torn any flaps that weren't stowed right off. The main problem is they only countered half the first MCAS increment leaving them with around 30 pounds force to keep the nose up, a force that would increase with increased speed, hence their ineffective attempt to trim again by re-enabling the trim motors without FIRST pushing the nose-trim-up switch.

What would have worked is following the disagree memory checklist to limit the speed and therefore the force required on the elevators and then the trim runaway procedure where they would have used the manual trim switch to return trim to nominal before shutting it off. None of the three crews that encountered this problem did any of that; the first group lucked out by having a pilot fully retrim several times before the pilot in the jump seat suggested shutting off the trim, apparently believing some flaw in the Speed Trim System. That flight went on another hour with the stick shaker hammering away. The second, crash flight, the pilot retrimmed nearly 30 times in response to MCAS without thinking to shut the trim motors off; his turning control to the second in command and not telling him to maintain the stab trim was fatal. The Ethiopians took a short stab at trimming and then just gave up; as if they read about the MCAS problem but not understanding what it meant to establish trim -before- shutting the motors off. They skipped a bunch of steps and got to the end even faster than the others.

I started writing what was wrong with the IEEE article but there's too much. Owning a plane and understanding aerodynamics are separate things as demonstrated by the large number of small plane pilots who slam into the dirt a half mile from the runway while yanking back on the stick trying to stay up longer when the motor failed or the ice built up.

Yeah, I thought some of the IEEE article looked off and I took flight dynamics in 1997 or 98.

3DDave,

You seem to suggest there is a way to work around the existing MCAS against a faulty AoA sensor. In that case I don't understand why Boeing need to bother with another update? Just tell the pilot to read the appropriate section of the manual and fly the plane.

If there is something so simple a pilot can get out of the dire situation in 6 to 12 minutes, as experienced by the pilots in the two crashed planes, the aviation industry must be stupid wasting billions on grounding the 737 Max and cutting back its production.

saikee,

It is simple, but it's also obvious that pilot emergency training is poor and it is easier and more certain to update the software than to depend on pilots to do the right thing when it's avoidable. I read both reports and in all three incidents the pilots failed to follow their training. Even with the updated AD from Boeing that said if the pilots ever turned the trim motors off to leave them off, the Ethiopian pilots turned them back on and crashed seconds later directly because of that. Had they continued as the were they would have gained enough altitude to do a series of small pushovers to unload the stabilizer and use the manual crank handles.

You seem almost personally offended, as if you think the pilots were helplessly lashed to a bomb. The first incident showed that was not true and that pilots had all the tools at hand to cope, which they did in just a few minutes. It only became a dire situation on the accident flights when pilots did not delegate (Cockpit resource management) to have one pilot concentrate on guiding the plane while the other concentrated on determining if the alarms are right or not and going through the procedures.

In the first incident the pilots never let trim stay more than one degree from nominal. On the accident flight the pilots let it drift 2 degrees before a transfer of control allowed it to reach minus 5 degree stab trim change. In the case of the Ethiopian flight the pilots let it go almost 3 degrees and failed to monitor airspeed, reaching Vmo* in just 3 minutes and also letting trim reach -5 degrees from nominal by failing the AD procedure and enabling the trim motors.

*Vmo = Velocity Maximum Operating.

Its trim units not degrees. These days they have got away from raw numbers because the numbers for the 800 will be different to the max. So the give us flap 1 2 etc and none dimensional units.

The emergency training or lack of it may be correct. But the amount of conflicting information in the cockpit would have been collosal. And there was no singular alarm to tell them that there was a problem with the AoA system which could have led them to the appropriate check list. There was an option for a AoA mismatch indicator but that would have added a 6 figure sum to the airframe price.

This human interaction and interpretation of data in the cockpit is a huge subject. It doesn't sit with engineers because the results are unpredictable and subject to a distribution curve. Experience,age, fatigue and the big one cultural all have an effect.

The fact is two airframes in the space of six months have killed lots of people on a new type which is 18 months old. One which major selling point is that it requires 1 hour on an iPad to fly if you can fly the 737-800 Ng. A type I might add that fly's 10 000's of hours per day using the same pilots without crashing using the bulk of the same parts and systems.

Quote (saikee19)

Just tell the pilot to read the appropriate section of the manual and fly the plane.

"just read the iPad for 45 minutes and then go fly the plane" is exactly what 4 dead pilots were told to do.

Thank you everyone for your enthusiastic contributions!
This topic is being broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices.

Please continue the discussion at the new thread:

thread815-452000: Boeing 737 Max8 Aircraft Crashes and Investigations [Part 3]