I have been trying to find out why the Indonesian 737 Max survived in the flight JT043 the day earlier but not the later flight JT610. I superimposed some lines over the MCAS events in doomed JT610.



It seems the Indonesian pilots were attempting to fly the plane at 5 pitch trim units a value the same plane flew successfully the day earlier to its destination to about 25,000ft.

After the flap was retracted for the second time there were 25 cycles the JT610 pilots used the power-assisted trim, which I believe was from the switch at the column yoke, to cancel the nose down actions from MCAS. The plane was successfully flying an average 5 pitch trim units except for the last four MCAS nose down commands which drove the plane into the Java sea.

The JT610 pilots fought about 7.5 minutes with MCAS and failed. They could not over-trim the plane to get out the difficulties as the plane would gain altitude when it was supposed on their way back to the airport.

The day earlier the JT043 pilots on the same plane fought with MCAS for about 6 minutes too but survived. They did so by throwing the two Stab Trim Cutout switches and completed the rest of the journey by flying the plane manually. In fact after the MCAS was disabled the pilots only manually trimmed the plane just once for the whole journey.

One important factor for the survival could be the JT043 pilots made the decision to fly to destination instead of aborting the flight by returning to the airport. The 737 Max on that day was able to climb out of the difficulties and continue the journey after halting MCAS.

JT610 and the later Ethiopian ET302 pilots both considered the flight control problem to be unsafe to continue with the journey, sought and got permission to return to the airport, stopped gaining any more altitude and suddenly MCAS took control to pitch the plane to the point of no return.

The altitude the two doomed 737 Max were flying did not have enough headroom to survive the known MCAS malfunction with a faulty AoA sensor. JT610 was finished by the last four MCAS activation and gone in 50 seconds while it was flying a pitch trim averaging 5 units at 5000ft. ET302 was knocked off in just 24 seconds by just one MCAS nose dive command while flying steadily at 2 pitch trim units at 7000 ft.

It seems any MCAS update has to be safe for the 737 Max to do emergency return to the airport at low altitude ready for descend/landing. It is a frightening that MCAS could suddenly destroy the two 737 Max in less than a minute.

Given the legitimate need for MCAS due to the engine location I agree it'd be a major backpedal to "just remove it".

It seems like the some of the bigger issues were the lack of redundancy on the AoA sensors, MCAS' apparent inability to ignore or react to bad data, and the lack of pilot awareness/training on MCAS.

Bear in mind that "just remove it" and "switch it off" (manually via the existing stab trim cutout switches) and proposed MCAS automatic switch-off due to any future fault-detection scheme, all result in an airplane that is in the air without functioning MCAS. If the plane does not have acceptable flight characteristics in that situation ... hmmm.

saikee -

The crash of JT610 was due failing to trim following the hand-off off of the trim task from PIC to the SIC. This hand-off was to allow the PIC time to look through a manual. The SIC apparently noted that tapping the switch stopped the trim motors, but did not understand that the altered trim was not restored to its previous state. This is why the manual inputs are so short and completely ineffective at the end.

What's not clear is why the PIC and SIC did not turn off the trim motors. They hit the trim button nearly 30 times. They should have known the plane was flyable with the trim wheels.

The one pilot input to manual electric trim on the survival flight was on the ground, weight on wheels.

First rule of problem solving:
Identify the problem!
Second rule of problem solving:
Make sure that you have identified the problem.
Third rule of problem solving:
Don't address the symptoms, fix the problem.
The problem is an inherently unstable aircraft.
MCAS is not fixing the problem, it is covering up a symptom.
Maybe it is time for Boeing to bite the bullet and stop pushing an old old design to greater performance.
The problem is not with MCAS. The problem is a flawed design change that should not have been approved in the first place.

Bill
--------------------
"Why not the best?"
Jimmy Carter

The 737 is not and has never been unstable; there is no normal envelope area where there is positive feedback that causes divergent flight. This repetition of this untruth is not helpful. As for covering things up, that's the primary design philosophy of Airbus in order to make all their aircraft appear to have similar handling characteristics and completely isolating their pilots from the feel of the actual controls.

For an expert write-up see http://avherald.com/h?article=4c534c4a/0045&op...

In particular "... the first and foremost being the startle effect, in particular with a permanent stick shaker activation that does not stop despite lowering the nose in an instinctive reaction. The added stress of the continuous noise and rattle must have contributed to further confusion - and this scenario has never been trained for, no pilot has been prepared for such a scenario yet, in which a faulty AoA value could cause a permanent stick shaker. Therefore it appears likely to me, that the focus of the crew was to keep the aircraft flying and clear of terrain while trying to get rid of that noise and stress."

The primary problem in these crashes is crews unable to deal with the stick shaker, a symptom of an AoA system failure. Thus leading the Ethiopian Air crew to allow an overspeed condition which produced higher than usual control forces, especially to the trim wheels

3DDave, waross, it seems you guys are arguing from extremes. We're engineers, let's argue from the middle. Some most likely rational yet apparently misguided people at Boeing got onto a slippery slope of meeting a specification that required no re-certification or major re-training for the 737Max, and let that cloud their judgement regarding how to compensate for the undesirable aerodynamic effects of the engine mounting configuration.
It seems that some regrettable decisions were taken.
It remains to be seen whether the 737Max can yet be tailored to meet the specification, no re-certification or re-training as a core requirement, or whether these requirements get thrown overboard, along with possibly the whole project.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

I must admit the unable to cancel stickshaker has me a bit confused. Unless it's another grandfather difference between current certification standards.

I though there had to be a way to cancel the stick shaker. Its normally in the spurious stick shaker qrh checklist. For the three types I have flown you just press the stall caution light when it's flashing and it kills it until you do a full power kill reset on the ground. The stick push which is the next level up of protect and you pull through it requires a reset by a technician in the hydraulics bay.

Oh and for some of our procedures you are meant to pitch until the stick shaker triggers and hold it there. Windshear being the main one.

Windshear the MCAS wouldn't be functioning because the flaps would be out.

What phase of flight did the previous event occur? Dealing with something at fl350 is completely different to at 1000 ft.

The flight that survived started with symptoms at takeoff just like the flight the next day. It appears they engaged Autopilot a minute after takeoff and that Autopilot was cancelled a minute after that. The FO tried again and it was cancelled almost immediately.

The accident flight seems to have delayed retracting flaps and gained more altitude before the first MCAS input; they continued to gain altitude as the PF continued to counter the MCAS input.

Part of the underlying issue is the large size of the leap engines. They moved the engines forward and up to get the ground clearance they needed.
Why, I asked, did they not just extend the landing gear and put the engines under the wings.
Apparently there are a lot of reasons that they can't extend the landing gear.
It wouldn't fit in the existing wheel wells.-
This would void type approvals.-
And maybe a few other reasons.
Then they had another problem with the Max10.
Possible tail strike on takeoff.
What did they do?
Well they found a way to lengthen the landing gear and still fit it into the existing wheel wells.
https://www.flightglobal.com/news/articles/video-b...

Bill
--------------------
"Why not the best?"
Jimmy Carter

The other reason is the 737 can operate by ground crews handing luggage into the fuselage. Longer gear would mean that it can no longer be usable at many of the airports it's used at now. Only the Max 10 the main gear lengthens only during landing and takeoff to avoid tailstrike on the lengthened fuselage.

I suspect also if it was higher off the ground they would have to fit wing slides for the overwing emergency exits.

The 800 they select max flaps as part of the evacuation checklist before killing the engines. Then the punters using the overwing have to slide down the flaps.

A requirement for wing slides would be a collosal hit on dry operating weight and service maintenance. I think they have to come out every two years and weigh 100kg but could be wrong. So 200 kg and 100k $ every two years. For every extra 1 ton of load on a 737 classic it's an extra 50kg of fuel per hour.

It looks like the landing legs basically extend another 9.5 inches only and then retract when the gear is stowed. That might be enough for the tail strike issue but for the engines?? The static height of the plane looks to be the same as before.

Also adds a level of complexity as the wheels need to retract that extra distance using some linkages. more weight and potential to go wrong which needs to be designed out.

Also from the video it looked like the wheels just extend their travel as the load lightens as the plane accelerates but on landing have the same height once the entire plane weight is on the wheels which would be no use for the engines. I guess this way they don't have to change anything height related ref escape slides etc.

I must admit I've always thought it a bit "sketchy" to have to basically slide off the wing onto tarmac or whatever from those mid wing exits via the flaps which the pilot has hopefully remembered to lower in the middle of dealing with whatever crisis has happened at the same time

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

It could be one of these grandfather deviations that's the only reason they get away with it.

To be honest the holds on the 737 are lower than the hold on the q400 and some places they load the q400 without a baggage belt. I just avoid being present when they are putting 100kg pallet of dangerous goods on.

Why are we obsessed with the height of the landing gear or any part of the bad design that works?

I thought we are looking at the faults of the design like MCAS that most likely caused the plane crashes.

It is the engineer's role to make things work. Just like one can put an engine in the front, middle or back of a vehicle. None of the position is ideal but one live with its characteristics and arrangement.

Saikee,

If the 737 sat higher off the ground normally (through taller landing gear for example), they likely wouldn't have needed to change the location of the engines to a location that necessitated MCAS. The Airbus version sits higher naturally, so they didn't have to move the engine placement (their LEAP engines are even larger).

RVAmeche,

I understand what you said but is the landing gear the root cause of crashes or is it a major contributory factor?

Unless the landing gear has a major design fault contributing to the two crashes I doubt if the investigator could recommend a change in its design. A bad design is not always a faulty design.

Has it become obvious that MCAS, assuming it were the root cause, will never work no matter how much engineering is thrown at it?

Saikee,

Like LittleInch said, the landing gear itself didn't cause the accidents but its design, combined with the new engines, forced a new engine placement that was inherently unstable. Therefore they developed MCAS to counteract the engine placement. Unfortunately it seems the MCAS system was poorly implemented and even more poorly explained to pilots because, as Boeing said, "they should never see its operation".

Quote (Saikee19)

It is the engineer's role to make things work.

Uh... it most certainly is not.

The engineer's job, first and foremost, to ensure the safety of life. Period. Any other approach is irresponsible.

'Just make it work' is the exact attitude that lead to the situation Boeing is now in.

Quote (Saikee19)

Has it become obvious that MCAS, assuming it were the root cause, will never work no matter how much engineering is thrown at it?

No, I don't believe that has become obvious, and I don't believe that to be true. I don't think anyone who is knowledgeable about this situation thinks that either.

I have been with this thread long enough to know landing gear limitation. I thought LittleInch has put it to bed.

Quote (LittleInch )

Because the landing gear needs to retract.
Longer gear need a bigger hole in the plane which isn't there.
Longer gear has more drag so impacts landing and take offs.
Longer gear will create larger moment forces from the braked wheels needing stiffer mounts.

Sorry if I exhibit too much respect to others' design. Over the years I come to respect designer's arrangement irrespective how good or how bad it is. For a bad design it is easier for me to find faults and shortcomings. The bottom line is, when I am charged with reviewing a designer's work, it has to work as stated.

I believe the real problem of 737 Max isn’t its engineering but the shattering of our confidence in its manufacturer.

The original intention of hiding MCAS, the resulting faults so fundamental to safety, the amount of bad and risky arrangements in the flight control system now laid bare in front of the public, the delay of admitting and fixing the fault that might have saved the second crash, the hoodwink from the initial claim of making a safe plane even safer and its relationship with FAA to get certification are something much deep rooted and may take a very long time to put right if that can be done at all.

Whenever I traveled for business in the past I was in a Boeing plane more often than I was not. Now suddenly that manufacturer no longer the hallmark for safety and engineering quality. It is like one discovering a bank cheats one’s deposit. In this case the manufacturer renowned of safety is suddenly found putting lives at risk!

jgKRI ,

your last implies Boeing will not be able to fix MCAS so we either have new 737 Max without it or no future 737 Max at all. Is my interpretation correct?

It is difficult to find an acceptable working design that is unsafe in structural engineering. May be in mechanical an unsafe design can be accepted as a workable solution. I suppose a consumer can always purchase a badly designed product that can endanger its end user but I wouldn't say such product works because its design intent has not been fulfilled.

I don't doubt Boeing will experience some effects from less consumer confidence, but I don't think you can say there are no other legitimate problems with the plane? Obviously we'll see what the final reports conclude.

MCAS as it was originally designed and implemented only looked at one AoA sensor at a time and had no ability to ignore erroneous data. That's not a good design. Not to mention the minimal pilot training (or even awareness of the system prior to the first crash).

Quote (Saikee119)

your last implies Boeing will not be able to fix MCAS so we either have new 737 Max without it or no future 737 Max at all. Is my interpretation correct?

No.

What I said implies that I think MCAS as a concept is fixable, if proper engineering processes and controls are applied.

There's only three real 'endgames' available to Boeing here:

1) MCAS is 'fixed' or replaced by a supplementary system that performs the same function but in an acceptable way

2) Boeing removes the Max 8 from the market, and does not offer a high efficiency narrow body jet to compete directly with the 320neo

3) Boeing re-designs the Max 8 wing, landing gear, and fuselage to accommodate a conventional engine placement (negating the adverse aerodynamic effects of the relocated engines and negating the need for MCAS entirely). This triggers re-certification of the airframe and all that entails.

Numbers 2 and 3 are not an option for Boeing.

"The engineer's job, first and foremost, to ensure the safety of life. Period. Any other approach is irresponsible."

This is a rather absolutist view of engineering. The fact that you have to leave the ground, riding on a tank of aviation fuel, in the company of turbines spinning at high speeds, with wings that have to flex and change shape, imposes many conflicting requirements against safety of life. No engineer, nor company, can afford to design something that is absolutely safe, since it's likely that such a craft would either be too heavy to take off, or only carry a much smaller amount of cargo. We don't see many airplanes with redundant landing gear, albeit most have some level of manual control, and there is a risk analysis associated with that was deemed to be acceptable. The McDonnell Douglas DC-10 had a fatal flaw that passed through such a risk analysis; its tail engine turbine failed and flung turbine blades through the one place in the plane where there was no redundancy for the flight control hydraulics, resulting in the loss 111 passengers, and had it not been for the fact that an FI was on board as a passenger, the entire plane might have been lost.

The engineer's job is to design, to the best of their abilities, for a calculated and acceptable risk. The design/risk analysis process failed in this case; sadly, though, this is often how processes get improved. As with certain other failures, this is how we wind up with realistic risk probabilities and consequences to do the next risk analysis.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

There is a load more...

To be honest it's spiral argument everything revolves round not triggering recertification. And not triggering differences training in the SIM or new type rating due cost the customer.

Once the customer hits training costs then a change in OEM is on the cards. And the single isle medium haul market is huge.

Loosing 5 years certifing a new type when the only opersition has something already flying with 20% fuel savings means your dead in that market and will struggle to recover you market share as type ratings die only 2 years after you flew a type.

Its this grandfather certification trigger which is causing the issue. I am pretty sure the design engineers would have preferred not have had to bodge a software fudge instead of doing it properly. But that would have meant tripling the development costs and at least doubling the timeline.

This incident and design though has definitely shone a Grade A searchlight into places previously kept pretty much in the dark apart from those dealing with it on a day to day basis, i.e. the FAA oversight (or lack thereof) and certification. That is a much bigger issue and the forming of the Joint Authorities Technical Review which hasn't yet started and could be a very difficult beast to please.

This is what the 737 technical site says ( I assume they mean will meet for the first time on ....)
and is a direct copy of the FAA news site https://www.faa.gov/news/updates/?newsId=93206&...

"Joint Authorities Technical Review panel

The JATR panel was convened by the FAA and first met on 29 April 2019. The FAA said about the JATR: “The JATR team will conduct a comprehensive review of the certification of the aircraft’s automated flight control system, The team will evaluate aspects of the 737 Max automated flight control system, including its design and pilots’ interaction with the system, to determine its compliance with all applicable regulations and to identify future enhancements that might be needed.”


The JATR is led by veteran NTSB investigator, Chris Hart and has is comprised of representatives from the civil aviation authorities of Australia, Brazil, Canada, China, the European Union, Japan, Indonesia, Singapore and United Arab Emirates.

The group is expected to take up to 90 days to conclude, which suggests that the 737 Max will be grounded until at least August."

So not just the MCAS software patch but the entire flight control system and design,

And also certain practices like charging a phenomenal amount of money for "extras" like the AoA indication and AoA disagree light and reliance on single instruments.

My money is on an eventual return to service, but it could be the end of 2019 and might decide it needs sim training or extra mods.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Alistair; Thank you for your patience and courteous replies.
We I am trying to work through the 5 whys, or as many whys as needed.
Another old trouble shooting maxim: Don't fight the problem.
I agree that the 737 is a great airplane, until the Max series.
Design is often a compromise. Adding engines that won't fit under the wings involved compromise.
Please bear with me as I ask some more silly questions.
Why did they want to use the Leap engines.
I understand they burned less fuel. That is acceptable.
Yes the use of those engines involved compromise. Instead of defending a system that has cost over 300 lives, destroyed two planes and resulted in a world wide grounding of a fleet of new aircraft, can we explore the idea that MCAS may not have been the best compromise?
I have asked a number of questions. Not all the first answers are holding up.
How many billions of flight hours have been accumulated by the existing 737 fleet without the problems of the Max8?
The landing gear on the Max10 only extends on rotation.
It is higher and it will fit in the wheel wells. Don't fight the problem. Try harder.
I am not saying that longer landing gear is the solution. I am pointing out that MCAS may not be the only solution.
Does the Airbus have over wing exits?
How much extra weight is involved in the longer pylons to mount the Leap engines in the new position? A good part of over 2000kg.
Link
"The MAX is approximately 3,000kg heavier than its equivalent NG. This all stems from the LEAP1B engines each of which are 385kg heavier than the CFM56-7. This extra weight requires stronger (and therefore heavier) engine struts, wings, fuselage and landing gear."
Comments on the credibility of this site are welcome.
What's in a word? I may have been in error in choosing the words "inherently unstable" to describe a flight characteristic that is outside the flight envelope that is accepted by the FAA.
I am suggesting that there may be sound engineering solutions to correcting the flight characteristics without implementing MCAS.
I am suggesting that the focus on MCAS is an unreasonably narrow view point that may preventing the consideration of a solution of the original problem, in which case the MCAS will become a moot issue.
Pop quiz in regards to longer landing gear:
Why won't it work?
How can we make it work?
Pick one.

A quote from an engineer and pilot who knows very much more than I about aircraft.

Quote:

The should stop any more interations of the 737 using the old certification grandfather rights which is based on a 1960's design.

New certification to modern standards not just fundging things so they don't have to comply with modern standards or do a full certification testing program.

Note the limiting dimension on engine size may be the fan diameter. The Leap engine fan has an increased diameter of 8.4 inches over the NG engines. That would seem to be within the possibilities of longer landing gear.
Please consider that MCAS may be covering a symptom rather than the root cause.


Bill
--------------------
"Why not the best?"
Jimmy Carter

I never share Boeing's optimism of fixing just the MCAS would cut it.

The FAA credibility is now at stake and it covers its back side by dragging more people into the firing line. The JATR would therefore want to know if the 737 Max has other issues in the flight control so the entire system will be looked at bits by bits, section by sections, module by module and the way the whole thing is put together. This is a good development but the process could slow down 737 Max returning to service.

So instead of being certified by itself Boeing now has to bite the bullet to satisfy other aviation authorities that 737 Max is safe to fly. Technically it is a brilliant idea as Boeing will no longer be able to hide something like MCAS again, the certification cost is shared out internationally and ultimately the plane should be safer with more parties involved in its review.

waross,

Despite the two fatal crashes 737 Max had been flying more than a year with over 350 operating world wide. If the AoA sensor did not fail in the last two cashed plane we probably would not know MCAS's short coming for a while yet.

The two plane crashes do not make the public suddenly become better plane designer than Boeing.

This Forum provides opportunity to exchange ideas. Our combined effort and technical knowledge can peel off the problem layer by layer so that mistake is understood.

To re-design any part of the 737 Max one needs access to many information and constraints which are not available to the public.

From an outsider's perspective, it seems like something like this was somewhat inevitable due to the self certification and heavy avoidance of reclassifying the plane at all costs. As it's been discussed in the previous threads, these planes (not just the 737 MAX) have been upgraded heavily since their initial release. This iteration finally pushed it over the limit.

Actually, I think even spatulas have gone through some iterations, because there are those of us that often use spatulas to cook things, and burning spatula material is not conducive to human health, even if it were wood and not some sort of plastic.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

what do you mean IR, the spatula is the best tasting part of my cooking

The main issue is not a Boeing issue it's more a regulatory issue.

And the issue is not an FAA issue, it's all the regulators.

And the cost of the joint committee will be paid for by Boeing not the regulators. They will all be staying in 5 star hotels with first class transport home every week for two days off. Early knock off Friday and late start Monday. This cost will either be passed onto the unit cost or taken as an accounting hit. Every single minute spent on it will be billed to Boeing.

I will not comment on the technicalities of changing the gear. Just don't know enough about the ins and outs of it.

What I do know is that fuel accounts for 80% of every airlines variable costs. If you can reduce that by 20% by flying a certain type compared to your competitors then you can under cut them and the consumer will always go for the lowest price ticket. You just need to under cut them by 1% so you remain in profit and they are not covering costs and they will be out of business inside 6 months.

They can hedge fuel for a year, after that then oil fluctuations can add insult to injury.

I burn 5 tons a day 20 days a month on average all year round. That's 5200 tons of fuel a year on a 72 seat turbo prop.

632$ a ton that's 3 239 000 $ per year. We have 3 crews per aircraft. So call it 10 million $ per aircraft. 20 % saving per aircraft 2 million. We have over 10 of my type....

A fleet of 100 neo's against 100 ng's 800 your talking 350 million $ difference in variable operating costs for fuel alone in a year. That will easily pay for 600 type ratings plus tech ratings which is in the region of 25 million.

I'd bet a few $$ that Boeing was leaning on the MCAS to stabilize the MAX without adding the two 'draggy' wide-ventral-fins that were added onto the 737AEW&C [E-7 Wedgetail], lower-aft fuselage.

It appears these wide-span ventral fins were added to this 737 variant to enhance aero-stability at extreme-AoA due to [mostly] destabilizing effects of the 'wide-blade' antenna on the upper-aft cabin... on what 'looks' like a shorter body 737

Regards, Wil Taylor

o Trust - But Verify!
o We believe to be true what we prefer to be true. [Unknown]
o For those who believe, no proof is required; for those who cannot believe, no proof is possible. [variation,Stuart Chase]
o Unfortunately, in science what You 'believe' is irrelevant. ["Orion", Homebuiltairplanes.com forum]

Quote (Alistair_Heaton)

And the cost of the joint committee will be paid for by Boeing not the regulators. They will all be staying in 5 star hotels with first class transport home every week for two days off. Early knock off Friday and late start Monday. This cost will either be passed onto the unit cost or taken as an accounting hit. Every single minute spent on it will be billed to Boeing.

I find this hard to believe as it implies even FAA has been fully paid by Boeing to certify their planes. In that case Boeing owns all the aviation regulators' representatives in the JATR.

I would have thought the JATR representatives would be salaried staff from foreign regulators and their work and visits will be paid by the foreign regulators who can an arrangement with FAA. I don't believe the public would accept the time, accommodation and all expenses of certifying a plane is the plane manufacturer's liability as in such case the FAA can operate with a zero budget and has no necessity to ask for funding from the Congress.

If Boeing has to pay every minute of time for the FAA staff to certify their plane that might have driven Boeing to go for the grandfather certification to minimize the cost and indirectly contributed the two plane crashes.

Quote (WKTaylor)

I'd bet a few $$ that Boeing was leaning on the MCAS to stabilize the MAX without adding the two 'draggy' wide-ventral-fins that were added onto the 737AEW&C [E-7 Wedgetail], lower-aft fuselage.

I've always wondered at how few control and stabilizing surfaces were on commercial airliners. I'd imagine that there are many stability and safety benefits to various unused stabilizer technologies and control surface redundancies that could make airframes an order of magnitude safer. I'm sure it is mostly due to matters of fuel efficiency which is a sad trade off.

Yes the OEM's pay for everything with certification by the regulator. They provide the test data and then the regulator used to sign it off. Now keeping a load of suitably experienced and qualified certifiers on pay roll is highly expensive and they are not used that much. So the regulators don't want to pay for it. So they try and shift the certification signatures to the OEM's and reduce the payroll. The OEM's always complain about the costs of certification so are more than happy to allow an employee to make the signature and then have paper work checks that all the required documentation has been done. So the regulator takes on more of a box ticking exercise than an actual engineering certification role.


FAA is only one regulator. They have to convince all the others as well unless they are happy with the max flying internal in US airspace. The others used to accept FAA certification now that's not the case.


Some 20 odd years ago when you had a ramp inspection it was an experienced pilot with ATP/ATPL and a licensed engineer that did the check. These days its a admin ops person who has been trained up what documentation to check and someone that sort of knows what an aircraft looks like and is more interested in various stickers and service dates on lifejackets and fire extinguishers than knows the difference between a hydraulic weep and a leak. Getting a clean inspection quiet often is a gauge of the Captains Bullshitting skills than compliance.

Its the same with air operators certificates. The company wanting one is liable for every minute spent on it. Something wrong in your manuals a revesion notice is issued and you pay for them to look at the manuals again.

Last AOC I was involved in getting it was 1.5 million UK pounds for an A to B limited to europe operations for a Saab 2000 sized aircraft . World wide operating and your looking at another half a million.

As far as I know, the FAA and EASA have drastically different cost of doing business.
The FAA represents the interests of one nation, based on the economic value of aviation industry that benefits that same nation. So fees for certification work are generally low or non-existent for many services. This is well aligned with the economic philosophy of the USA.
EASA represents dozens of nations, so the cost of its administration is covered partly by national contributions and partly by fees paid by the users. No single nation benefits, so no single nation would volunteer to pay for it all. And there are lots of things they want you to pay for. You might say that this, too, is well aligned with the economic philosophies prevalent in Europe.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Ok the none FAA people on the committee will be on first class tickets home and 5 star hotels and billing by the min with a sizable daily allowance. At Boeings expense.

The FAA people will be in the holiday inn and eating at MacDoanlds on federal allowances.

EASA creates the requirements the regulators enforce them if that makes sense. I very much doubt that central EASA carrys the skill set to be able to deal with the issues so will have to sub contract it out to a selection of people from various regulators.

So they will send over a selection of nationality's to represent EASA and then report back.

You guys will know better than me if the FAA is struggling for funding.

Quote (Alistair_Heaton )

The FAA people will be in the holiday inn and eating at MacDoanlds on federal allowances

I doubt that will be the case.

To a layman it would be fair to expect the team doing the certification of a new plane will have at least

(1) a top professional engineer with knowledge on the mechanical components
(2) a top professional engineer with knowledge on airframe structure
(3) a top professional engineer with knowledge on instrumentation and controls or avionics
(4) a top professional in aircraft safety
(5) a top pilot with experience on aircraft similar or close to the one to be certified
(6) a lawyer experienced in enforcement of safety regulations in aviation.
(7) a project manager for the team

This group of professionals will have status commanding remuneration equivalent the highest paid pilot. If they eat at a MacDonalds on business expenses it would not be the norm.

If what you have said previously some years ago it costed 2 million GBP to certify a Saab 2000 sized aircraft to fly world wide and a time scale of say 3 months (similar to the current JATR on 737 Max) I would venture to estimate the cost per above professional 2,000,000/3/7 = GBP 95,238/month or 1,142,000 per annum charge out rate. Assuming a ratio of charge out rate to raw labor rate of say 4.5 the annual salary of such a professional would be about 0.25 million pounds which is not far off from what I expect. For mundane electrical and mechanical engineering consultants the charge out rate to raw labor is about 3 to 3.5 in other industries and I know a newly qualified pilot can command 0.12 million pounds remuneration with a medium size carrier.

These people doing certification will be top dogs and will be fully compensated by their regulatory agencies. Theoretically at such remuneration level they should be immune from any conflict of interest with Boeing.

Are you referring to professional engineers or Professional Engineers? Given that aviation is an exempt industry...

Cheers

Greg Locock


New here? Try reading these, they might help FAQ731-376: Eng-Tips.com Forum Policies http://eng-tips.com/market.cfm?

the 2 million was for what's called an air operators certificate which is for when you want to charge money to the public to transport them from A to B.

It has a part for it which includes maint standards and procedures. But also covers training operational control etc etc.

The aircraft used comes with its own certificate of airworthiness which starts life with the OEM certification as it comes out the production hanger. Then its history stays with it until 5 years past its removal of service ie scrapped or written off or parted out. If the paper work history disappears then its virtually impossible to use the aircraft again for public transport.

The systems run in parallel. One for operating the aircraft and the other its physical health and maint. The two are linked and need each other.

Highly paid pilots quite often have to resort to petrol station and fast food on expenses.... usually because they are the only thing open when you finish work at some disgusting hour in the middle of the night. BTW its a bit of a myth that pilots are highly paid these days. The conditions of the First officers are to be honest quiet disgusting you would earn more as a brick layer.

GregLocock,

Not familiar with if PE is mandatory in the design of aircraft in USA but I would have thought the people selected to certify a new plane would need to have considerable experience as well as in-dept technical knowledge in the subject if not already the leader in his/her field.

Certification shouldn't be a one-pass process as the regulatory representatives can refuse certification justified by reasons that can stand up in court. The manufacturer can of course choose to carry out amendments/changes/modifications to seek compliance if it can't fight the technical/safety argument.

Professional Engineering license is not a requirement in Aerospace engineering. Instead of following code compliance, aircraft systems undergo extensive testing.

My opinion is that MCAS got to where it did because one person made a sufficiently compelling case for the limited evaluation that it was never submitted for evaluation outside of creating the software and wiring specifications. I do not believe the potential for pilots to be caught out was ever evaluated and then dismissed for cost savings reasons. Knowingly building a systemic flaw into an aircraft would be insane.

The only way to catch this is to have a parallel team that has no contact also designing an aircraft to the same initial requirements and note where the two teams don't come to the same answers.

Otherwise there comes the problem that the work of the first team is trusted. It takes a particularly hostile team to do nothing but question every decision and it takes a gifted team to understand whether the answers are correct and a team with access to similar levels of resources to verify those answers. By which I mean, another full-up aircraft development company with meaner and smarter people.

But where would those people come from? Boeing and Airbus should already have hired the smartest people interested in designing aircraft. People hostile to aircraft development would be unlikely to have expertise.

I'd suggest that Boeing create their own version of IBM's Black Team. https://www.themarysue.com/ibm-black-team/

Quote (3DDave)

I do not believe the potential for pilots to be caught out was ever evaluated and then dismissed for cost savings reasons. Knowingly building a systemic flaw into an aircraft would be insane.

I would agree with this statement. I'm suspicious that the reasoning for, let's say, a 'reduced' level of exploration/validation of the MCAS concept may have been related to engineering time and budgets, but I do not think that someone saw a hazard and ignored it.

I have a great deal of respect for the engineering done by companies like Boeing and Airbus, and naive or not I think they are all doing their level best. If any of my previous posts have implied that I think there was some negligent or malicious decision making happening at Boeing, that wasn't my intent.

I do hope that this results in the right parties, be it at Boeing or the FAA or wherever else, taking a long look at the approval and validation process for software fixes like this. Developing robust software is an immense challenge, and it's also a significantly younger discipline than mechanical or electrical design. Happenings like this make me think that as far as we've come, we're still not 'there' yet.

Professional engineering in aerospace:
There are so many differences, I don't know where to start. The ICAO member nations have their own professional accreditation system. Every nation is different, though EASA does carry a very wide umbrella. FAA is very different, while Canada, Australia, China, Japan, Brazil do their own thing when it comes to how they manage the credentials of personnel charged with aircraft and product certification. I should only speak from my personal knowledge; Canada's federal government ministry of transport relies on aerospace engineers who maintain their professional credentials with local professional associations in each province. But some of the provinces are... well... "provincials" who know nothing of aerospace matters and some don't have such a classification on their membership roll. It's best not to talk of such things in the esteemed community such as Eng-Tips.

FWIW, it has always been, and still is, a system geared toward human examination of all decisions, but growing in complexity. Software, and perhaps all digitally controlled hardware, is growing in capability at an exponential rate. Can we ask if it has evolved to the point that there aren't enough humans to go around to review every critical decision, every assessment, every assumption, every test result in proper context? If someone says something about adding more humans to review the analysis then I can easily reply to let the complexity grow more, until yet again there still won't be enough people to go around.

I respect what 3DDave just said, but I'd rather amplify what jgKRI wrote. I believe it's actually just a combination of oversights that led to this problem.
As Alistair as mentioned before, the "swiss-cheese" in the failure barriers lined up, but in this case not in operational practice, but the holes were in the design and conception of the system in the first place. Those holes should have been plugged by compliance with the Fault Tree Analysis if they had done a proper evaluation (SAE ARP 4754 or RTCA DO-178/254) but the system sailed through an analysis that normally supposed to prevent these kinds of errors from getting through.

Which leads to a strange kind of "failure analysis"... what is the likelihood of failure of an engineer to identify and resolve a potential design flaw when conducting a functional hazard analysis?

I swear, if you're an aerospace engineer, you are ROTFL right now.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

A series of observations that may provide some general insight

According to a senior engineer from Transport Canada complaining about the grand fathering on the 747-8 series, Boeing spent 1200 hours of meetings (not man hours apparently) with the FAA negotiating the certification standard for the 747-8 Series. So this might not be the only airframe type with a few grand fathering issues.

When representatives from the FAA turn up to the design / certification conferences they have here in NZ every couple of years, they seem to express a preference for the EASA system of Company based design approvals than the Designated Engineering Representatives (DER) system currently used (principally it appears due to what they perceive as unwieldiness of the current DER system). Having worked in the NZ system where its sort of a mix of both systems, I don't think there is really any difference, its more about the level of engagement between the FAA and their DERs that matter. I certainly won't trust any NZ companies to run an internal design personal approval program with no oversight.

There are many in the US who would like the FAA to go a fee based system as currently it appears the FAA's certification resources are somewhat rationed (often one open STC application per company, etc).

Its funny, none of the aerospace engineering job titles mentioned so far relating include "certification", because that's typically at-least half of the job.

Quote:

The FAA tells CNN it received the four hotline submissions on April 5, and it may be opening up an entirely new investigative angle into what went wrong in the crashes of two Boeing 737 Max commercial airliners -- Lion Air flight 620 in October and Ethiopian Air flight 302 in March.

Among the complaints is a previously unreported issue involving damage to the wiring of the angle of attack sensor by a foreign object, according to the source.

Boeing has reportedly had previous issues with foreign object debris in its manufacturing process; The New York Times reported metal shavings were found near wiring of Boeing 787 Dreamliner planes, and the Air Force stopped deliveries of the Boeing KC-46 tanker after foreign object debris was found in some of the planes coming off the production line.

Other reports by the whistleblowers involve concerns about the MCAS control cut-out switches, which disengage the MCAS software, according to the source.

https://www.cnn.com/2019/04/26/politics/faa-hotlin...

Quote (verymadmac)

When representatives from the FAA turn up to the design / certification conferences they have here in NZ every couple of years, they seem to express a preference for the EASA system of Company based design approvals than the Designated Engineering Representatives (DER) system currently used

There are two sides to that particular coin.
DER's usually have more authority granted than the individual members of an ODA (organization design approval),
The ODA's have management systems that oversee the members, which is often missing from DER's in independent practice,

So when the FAA interacts with DER's they are dealing with an independently-minded person with more authority that is based on experience, business practice, and personal risk management. When the FAA interacts with ODA members, they are dealing with a bureaucratic organization much like their own, and many ODA members are isolated from the customer's project nor concerned with the outlook of their company. Do I need to ask you who the FAA engineers find easier to talk to?

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Boeing CEO statements during a recent shareholder meeting

This video is the best one I've seen showing how a runaway trim looks like in the cockpit and the forces they have to fight to keep the aircraft flying: https://youtu.be/aoNOVlxJmow

Didn't see this posted here so forgive me if this is a repeat.

Ian Riley, PE, SE
Professional Engineer (ME, NH, VT, CT, MA, FL) Structural Engineer (IL, HI)

It was posted before. Not a big deal; worth repeating.
Now you owe 2 stars to the first member to post that video, though.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Found them and gave them two stars. Should have guessed, they post in this thread a lot.

Ian Riley, PE, SE
Professional Engineer (ME, NH, VT, CT, MA, FL) Structural Engineer (IL, HI)

atta boy Teh!

Keith Cress
kcress - http://www.flaminsystems.com

TME, SparWeb (and Alistair_Heaton).  As nothing more than an academic experiment, I put the partial URL
    aoNOVlxJmow
into Eng-Tips's seach capability.  It surprised me by finding the two posts.

Denial; About 2 years ago we got a nicely tuned-up search engine going.

Keith Cress
kcress - http://www.flaminsystems.com

Thanks TME!

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

:D we call the sim the sweat box.....

As an aside and give some background on the training side of pilot life.

In 3 weeks time I have what's called a LPC/OPC check.

It comprises of 1 4 hour session training called LOFT which we have a couple of made up story's which will result in various hardware emergency procedures being run and between the two of us victims we have to work out what's going on and deal with it.

Second day is a license type rating renewal of the instrument rating which is required to fly in Class A airspace and when you can't see out the windows due cloud.

We have loads of engine failures and flying around on one engine, go-arounds, rejected takeoff's evacuations etc. These are done with all the automation working and also what we call raw data which is just the pilot interprating what they see on the instruments and hand flying.

This year is hydraulics and gear failures for me along with the normal engine failures. Which no doubt will have me landing with no flaps at some 175 knts and only emergency brakes which at 28 tons will be 3 km of runway required.

At the end its doing the low visability qualification which allows us to takeoff in 150 meters visibility and land when its cloud at 100ft and visiual range of 300 meters.

And that will be until Dec/January when the next check will be in the sim. We basically have a full proffessional skills check every 6 months.

http://www.b737.org.uk/mcas.htm#techdes

seems to be a good summary

Also the statement

"Boeing has said in a statement on Monday 29 April that an error on their part meant that the AOA DISAGREE alert was only enabled on aircraft in which the customers had selected the optional AOA indicator. The alert was intended to be enabled on all MAX aircraft as standard.

“The disagree alert was intended to be a standard, stand-alone feature on Max airplanes,” the company said. “However, the disagree alert was not operable on all airplanes because the feature was not activated as intended.”

Note that the MAX will have a software update (CDS BP?) to allow the disagree alert to function without relying on any optional systems as it does on the NG. This of course is in addition to the FCC update for MCAS. "

Thanks for the A_H update.

Keith Cress
kcress - http://www.flaminsystems.com

How would that alert have worked if you didn't have the optional indicator?

The 'indicator' is not a separate gauge on the panel, it's just a software switch that, when enabled, displays a digital readout on an otherwise blank spot on the primary flight display. Not enabling this option doesn't prevent error reporting on the PFD or elsewhere.

No AoA indicator:



w/ AoA indicator:

Is that little orange wording at the bottom the AoA disagree that Boeing are talking about or is it supposed to be a separate yellow or red standalone light??

If it's only the words that looks like it could get very easily missed to me if there's all sorts of stick shaking and alarms going off at the same time.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

If I were involved in the design, Instead of the yellow AOA DISAGREE text which is not co-located with the indicator, I think I would prefer something like this, due to the critical nature of angle of attack:

When the DISAGREE condition is sensed, the indicator on the PFD face (which I would consider easier to notice during the PFD portion of the pilot's instrument scan rather than a distant text message) should turn flashing yellow to indicate the condition. Then there would be a pilot acknowledgement (pushing a button, moving a switch, etc.) and after successful acknowledgement, the indicator would stop flashing but would remain yellow.

By remaining in view but yellow, then each pilot could still refer to their own PFD for AOA but would realize that one or both indicators may be in error. If they come to a conclusion that one of them is accurate, then they could agree to use that one good indication for flight path control but the constant yellow would remind them to be cautious.

This would be as opposed to a red flag and removing the data which generally is only used for a confirmed hard failure or a critical failure that threatens loss of control.

Of course I am an engineer but NOT a pilot so actual pilots may have a better method to make sure they are notified when they should not trust the AOA.

So the MAX has (2) AOA sensors standard?

And the AOA DISAGREE alert was intended to be enabled on all MAX planes but was not by some mistake?

Was there additional code that MCAS would not operate when there was also an AOA DISAGREE alert? If this were the case at least the design didn't intend to rely on one sensor.

If they got a mismatch on takeoff before v1 it would be a mandatory high speed rejection.... Blown tyres etc.

In air if they had known about the mcas system they could of turn off the electric trim problem solved.

Forgive the dumb question, but I thought the second plane knew about MCAS?

AoA disagree was an "extra" but now Boeing are trying to say it shouldn't have been.

~There was no code about AoA disagree, just a warning. The MCAS system worked with the FCC on whichever side was in action at the time ( either pilots or FO side, but only one AoA input into the MCAS.

The second plane seemingly knew about the issue and managed to disable the electric trim after the initial operation, but for reasons unknown didn't manage to trim the plane back to where it needed to be before disabling the electric trim and as it sped up things seemingly got worse and the plane was clearly not in stable flight.

As far as the evidence released to date shows it appears then then re-energized the electric trim to try to gain control, but then the MCAs kicked in again and at the high speed they were now travelling at they couldn't hold the dive ( after going negative G)

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

The Max 8 was to be designed within management restrictions that may have prioritized profit and sales over good engineering.
Engineering by management decree is not always a good thing.
I experienced that at one company. Within a year after I had left, every designer who I respected had left.
The founders last words to the CEO were to the effect:
"I've had it with you, you SOB. Have your lawyer contact my lawyer and arrange to buy me out. I'm out of here."
How many tries and how many mistakes has Boeing had with MCAS?
How much have they saved?
Costs to Boeing are estimated at One Billion. This will probably go higher.
Costs to three Airlines are estimated at $600, Millions. (corrected, thebard3)
Total costs to all Airlines will be most likely be several Billions.
I expect that most of them will try to recoup these losses from Boeing.
And Boeing management is still in denial.
Every week there seems to be another MCAS issue surfacing.
Is this an example of the last stages of the Peter Principle?


Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (waross)

Costs to three Airlines are estimated at $600,000.

Did you forget some zeroes?

Brad Waybright

It's all okay as long as it's okay.

To balance that, it appears that some airlines have also prioritized profits and cut corners on pilot training and that thousands of uneventful flight hours are not a substitute for learning how to manage an uncooperative plane that is still controllable.

In the total there are several billion decisions that went into building those planes and putting those pilots in those seats and only a couple were required to get MCAS where it was and a bunch more were required to get leave the pilots unable to cope.

Consider the accident chain that put the Indonesian flight into the ocean that included 3 pilots failing to inform anyone that they had to shut off the trim motors to shut off, for them, random trimming, not even mentioning that there was a third pilot who made that specific decision in the preliminary report. Putting a fundamentally crippled plane back into the air with another spin of Russian Roulette choice in pilots isn't Boeing's fault.

Boeing and the airlines share responsibility for this and Boeing engineers can ensure they are not the source of this problem again; the airlines, on the other hand, seem to have done nothing noteworthy to fix their contribution.

Quote (Debodine)

If I were involved in the design, ..... make sure they are notified when they should not trust the AOA.

Caution alerts in highly complex aircraft like this one follow a very regimented system. The AoA disagree state would cause a master caution, indicated by the separate master caution light on its own panel. This indicator tells the pilot several things, all at once:

1) there is something wrong
2) light state (color, etc) indicates the severity of the fault, there are multiple levels
3) Subsystem indicator (the shortened titles next to the caution light) indicate which major system is affected, which tells the pilot which diagnostic procedure to follow or which panel to look at for specific information

None of this stuff was seat-of-the-pants by Boeing. The AoA mismatch would be part of the main caution process flow just like airspeed mismatch would be, as long as the option is correctly activated in the software which they are now saying was not the case.

Of course an airline would take a new plane w/ minimal training compared to a new plane with substantial training. That's not their fault it's their prerogative.

However, Boeing and their too close relationship with the FAA (or lack of oversight), meant that Boeing was inclined to ensure that a new plane needed minimal training. The fact that no one knew enough to call them out and not allow this, or didn't look at all, is the major issue IMO (potential design faults excluded).

I've seen old fashioned 'steam gauges' on aircraft where a checkerboard curtain was drawn across the gauge (hiding the indicator) to not only clearly indicate system failure, but also inherently hide the bad indication.

The same happens on modern efis displays as well. If there is any doubt in the data it changes colour. Then you go on the standby instrument reconfigure things then it changes colour again to make sure you know that your in a degradation mode and you need to manually cross check with the standby instrument.

The "closeness" with the FAA is not the source of this problem. It's that someone developed a convincing case that MCAS was a minor tweak to manage stick-feel; the sort of case that would have also been acceptable by anyone, including the airlines that bought the plane.

The failure seems to be one of imagination, much like what led to 9-11, where no one reasonable thought that hijackers would not need the pilots and that the planes would be used as cruise-missiles.

I keep wondering how much maximum correction the lift from the engine trust and placement needed.
Is there a flying condition where the plane is not stalled, but full trim down is needed to counteract the engine lift effect?
If the plane was flyable with the maximum needed correction, it may have made sense to limit the authority of MCAS to needed correction rather than full trim down.
This could have been done in either software or hardware.

Bill
--------------------
"Why not the best?"
Jimmy Carter

BIll; I believe as the plane climbs out the steeper the climb the more out of trim it gets, a classic feed-forward problem. The MCAS system designed to prevent a decaying feedforward AoA problem was throwing in 10 seconds of trim and then seeing that wasn't enough and throwing in more. Then more. The system thought the plane was climbing at a progressively steeper angle, as we now know a totally bogus problem unfortunately.

Keith Cress
kcress - http://www.flaminsystems.com

3DDave,

Sounds like we're splitting hairs. If Boeing didn't have the "closeness" that they have, the FAA presumably would've more thoroughly reviewed the design and raised questions. Even if that's not the case, why didn't Boeing's internal safety reviews show anything? Or did they not consider it because "the pilots should never know it's operating"?

I understand that, Keith.
As understand it, MCAS was not intended to correct a high AoA.
MCAS was intended to linearize the control "feel" at High AoA.
There may big difference in the amount of trim required.
I understand that the 737 has flown for over 50 years without MCAS.
My point is that MCAS was implemented to counteract the extra lift from the engines at high AoA, not to correct a full stall condition.
There are other systems to warn of an impending stall.

Bill
--------------------
"Why not the best?"
Jimmy Carter

"I understand that the 737 has flown for over 50 years without MCAS."

I think the big point is that the 737 that's been flying for 50 years is, essentially, a different aircraft.

The fact that the trim system (horizontal stabilizer) can exert greater tail authority than the actual primary control surface (elevator), under any circumstance, seems telling. I'm sure it tells an expert more than it tells me.

Its normal that the trim can do this

There are huge changes in trim required when the flaps move from lift flap to drag flap. And there are automatically trim changes occur to counter this effect. But they are standard amounts so if you select flap 35 it will automatically trim forward by say 5 units. If you then select flap 15 it will trim back by 5 units and the time it takes is about the same as it takes the flaps to travel.

So if you were in trim before selecting then you will be in trim afterwards as well.

Quote (TenPenny)

I think the big point is that the 737 that's been flying for 50 years is, essentially, a different aircraft.

Yes, a different aircraft flying under 50 year old certification.
Designed to management criteria that may have been unrealistic.
I wonder what the turnover rate of the better designers is at Boeing?
I don't think that the joint review panel will be quite as compliant as the FAA.

Bill
--------------------
"Why not the best?"
Jimmy Carter

charliealphabravo - I wouldn't say under any circumstance. At one point in the Ethiopian flight the stabilizer went full down yet the pilots maintained reasonably level flight until they trimmed the stabilizer back up.

There are lots of "ifs" relating to the Ethiopian flight along with the corresponding question of why. For examples:
#1. If the pilot had trimmed the stabilizer to the proper angle before using the cutout switches then they wouldn't have been struggling with the controls and might have been able to put their focus elsewhere.
#2. If the pilots had not let the plane speed increase to too high a speed then the struggle to hold the yoke wouldn't have increased to the point they felt the only option was to enable the trim again and take a chance on it working correctly.
#3. If the pilot had not let the plane speed increase to too high a speed then they might have been successful at re-enabling the stabilizer and trimming the plane.

As with most plane accidents, there are a number of thing that go wrong before the crash finally happens. Blaming the crash solely on MCAS is being short sighted. The MCAS system mis-operating is serious, but ultimately the mishandling of the MCAS failure is what caused the plane to crash. Of course, this doesn't mean the crash is only the fault of the pilots. Boeing's needs to build a plane that makes it possible for the pilots to successfully troubleshoot failures of the various systems so they can do whatever is possible to keep the plane safe. The various regulatory bodies need to have rules and requirements in place so the pilots are required to get enough training.

Quote (LH)

If the pilots had not let the plane speed increase to too high a speed...

A lesson from US Airways Flight 1549 is that it's not reasonable to assume that pilots can always react instantly. Famously, the 1549 crew were granted an allowance of 35s analysis and reaction time. Thus it was concluded that landing in the Hudson was the optimum decision.

This MCAS incident may be somewhat similar in that regard, i.e. expectations of reaction timing. Ultimately, system designers need to account for a range of human responses.

Quote (VE1BLL)

...system designers need to account for a range of human responses.

Well, actually, they do. I can think of some abnormal & emergency situations where the minimum pilot reaction time is published directly in the advisories that designers are supposed to refer to. Fires and cabin decompressions quickly come to mind.
Delay in pilot reaction time is expected and planned for in so many scenarios, that it would be a significant error to omit this consideration from the MCAS trim system design.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Quote (VE1BLL)

This MCAS incident may be somewhat similar in that regard, i.e. expectations of reaction timing. Ultimately, system designers need to account for a range of human responses.

I'm not sure what the first part of your post has to do with what I wrote or the part you quoted. The plane certainly didn't accelerate to above Vo speeds instantaneously. As for this, so you agree with what I wrote later in my post but worded differently?

Quote (LH)

The plane certainly didn't accelerate to above Vo speeds instantaneously.

The word choice "instantaneously" makes this a 'straw man argument'; because I explicitly referred to allowable pilot analysis and reaction times on the order of 35 seconds.

[I'd used the word 'instantly', so I'm guilty of the same thing.]

Also, "too high a speed" may be lower than Vo. The 737 runaway trim simulator video (linked elsewhere; hopefully everyone has seen it) demonstrated how the trim wheel forces can be extreme, and I won't repeat all the complicating factors here.

"... agree with what I wrote later in my post...?"

Yes.

Except that we know who downplayed the differences between the 737 variants, and thus instigated the lack of training.

The speed versus time, given a reasonable crew reaction time, and the resulting forces on the trim wheel, it all seems like a recipe for disaster.

So my point was just that "If the pilots had not let the plane speed increase to too high a speed..." may be somewhat related to the reasonable expectations of reaction timing.

Which is clearly a valid point, and I thought worth mentioning.

Quote (SparWeb noted)

Delay in pilot reaction time is expected and planned for in so many scenarios, that it would be a significant error to omit this consideration from the MCAS trim system design.

My post was in the context of the quotation that I had included at the top.

Quote (LH)

If the pilots had not let the plane speed increase to too high a speed...

Clearly this -^ is directly related to reaction time.

Here's the 737 Runaway Trim simulation video mentioned above (it's not a 737 Max, but is still quite informative). I believe that this video was previously linked elsewhere in these threads.

It seems to be essential viewing, in terms of context.

Acknowledge in advance all the other contradictory factors that I'm not going to bother listing here.

The link below is cued-up at 10m05s. Rewind if you would like to see the introduction.

https://youtu.be/aoNOVlxJmow?t=605

Swept wing jets are very slippery. You can easily go from stall speed to busting Vmo inside 35 seconds with the power off never mind power on.

If you think the plane goes from 0 to 135 knts inside 2000 meters in 10 seconds on take off. Going the rest of the way to Vmo doesn't take long straight and level. Add in potential energy conversion descending and it's under 10 seconds.

Reuters is reporting that the AOA disagree option was supposed to be enabled on all aircraft by default, but wasn't due to a bug. Boeing knew of this and chose not to disclose the issue for 13 months.

So if I'm reading correctly the pilots would have expected a warning indicator on the MFD, would not have seen one, and could have concluded that there was no issue with the AOA sensors. Of course they weren't told about MCAS either, so this probably wouldn't have saved anyone but it certainly wouldn't have hurt!

interesting article about DERs and ARs:
https://www.seattletimes.com/business/boeing-aeros...

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Had they paid attention to the instruments they had, all three sets of pilots would have executed the unreliable/disagree airspeed protocol. None did.

Concern over adding another warning is a red herring to draw blame to things that would have made zero difference.

The Ethiopian pilots knew about the MCAS, but failed to follow the AD as issued and failed to trim the plane before shutting off the trim system.

Over at pprune it's now about 50/50 on whether the pilots are to be trained and accept responsibility for operating a plane that is otherwise controllable. With the crash of the Russian plane I think the scales are tipped farther.

Smacks of O riñgs and space shuttles and cold weather.

Some decision making history, this info from Boeing.

Approximately 2 minutes from stick shaker until Vo is reached. Then, about 2 minutes more until the pilots decide their only available course of action is chancing the activation of the electric trim again. 4 minutes total goes well beyond needing to give the pilots 35 seconds to make a decision about the plane speed.

Do I need to point out that it should be common knowledge among pilots that stick forces increase with airspeed? This fact isn't something new that was introduced with the MAX. A plane accelerating (or decelerating) when the pilot doesn't pay enough attention to maintaining speed isn't new to the MAX either. So, not controlling the plane speed can't be blamed on the lack of MAX training.

Quote (VE1BLL)

Also, "too high a speed" may be lower than Vo.

Which is EXACTLY WHY I wrote too high a speed instead of Vo in the initial post you felt necessary to take issue with.


Apparently it's a touchy subject to point out the pilots contributions to the accident.

Quote (IRstuff)

https://www.seattletimes.com/business/boeing-aeros...

It would be completely naive to believe that the certification process for any other plane didn't also involve a whole lot of schedule pressure and management pressure.

I've NEVER been under schedule or cost pressure...





NOT

The whole AR thing was news to me, since I had the DER system was still in place.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

No pilot is going to run the unreliable airspeed checklist if they don't have airspeed missmatch flag and P1 and P2 and standby airspeeds are within 5 knots of each other.

I have seem nothing to indicate that there was any deviation between any of the three airspeed indications in either crash.

In general pilots can deal with two on going processes. The third usually kills you.

The amount of conflicting info must have been saturating. Stick shaker going which usually means stick the nose down. Over speed warning going off which contradicts the stick shaker. The egpws giving it whoop whoop pull up terrian terrian. The control forces getting heavier and heavier when you do pull back on the stick.

There we have the killer three all lined up.

There were 2 times GPWS made “DON’T SINK” calls when the stabilizer moved nose-down before the cutout switches were thrown, not a continuous call-out and not terrain pull-up.

The airspeed indicators deviated by about 20-25 kt according the report.

Not being able to acknowledge and stop the stick-shaker seems to be about as dumb a feature on the MAX as the MCAS system.

If no airspeed mismatch and agreeing with the standby then it's just adding to the conffusion.

You have to plan for a pilot to hit this issue having not slept for 18 hours and be on the 6 the flight of the day.

If the information load and trouble shooting capacity is beyond that it will always end with people dead

6 knts is the max for a airspeed miss match caution nothing reported on that front.

Its a mandatory master caution abort on takeoff.

I am European trained and get 50 % more yearly SIM time and 100% more ground school than legal mins. And my Boeing 737 classic pilots are the same. None of us are even nearly trained to deal with this crap on takeoff.

Btw I have never heard of Vo it means nothing to me. What does it mean?

"It would be completely naive to believe that the certification process for any other plane didn't also involve a whole lot of schedule pressure and management pressure."
Sure but how much pressure is too much?

Quote (Seattle Times)

In 2016, as Boeing raced to get the 737 MAX certified by the Federal Aviation Administration (FAA), a senior company engineer whose job was to act on behalf of the FAA balked at Boeing management demands for less stringent testing of the fire-suppression system around the jet’s new LEAP engines.

That June he convened a meeting of all the certification engineers in his unit, who collectively agreed with his assessment. Management initially rejected their position, and only after another senior engineer from outside the MAX program intervened did managers finally agree to beef up the testing to a level the engineer could accept, according to two people familiar with the matter.

But his insistence on a higher level of safety scrutiny cost Boeing time and money.

Less than a month after his peers had backed him, Boeing abruptly removed him from the program even before conducting the testing he’d advocated.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Vo: maximum operating maneuvering speed

Ref FAA regulations

If you begin to cost your employer significant amounts of time and money, they will do something about it.
Sometimes the squeaky wheel gets the grease, sometimes it is removed and replaced with a ready spare.
If the FAA needs someone to act on their behalf, that person should be an FAA employee.

BBC News item

I believe that this BBC news item is related to the Boeing item that I'd previously posted above (6 May 19 10:27).

Quote (Alistair_Heaton)

6 knts is the max for a airspeed miss match caution nothing reported on that front.

Its a mandatory master caution abort on takeoff.

The mismatch certainly was in the report, it mentioned both the 20-25kt speed variation and also a comment that the airspeed, altitude and flight director pitch bar values deviated with the left side values lower than the right side values. No cautions about it were mentioned so either left out or the MAX doesn't give a caution with that much deviation for some reason.

The deviations started after take-off, so no way to abort by then.

Quote (waross)

Sure but how much pressure is too much?

How much caution is too much?

Quote (VE1BLL)

BBC News item

I believe that this BBC news item is related to the Boeing item that I'd previously posted above (6 May 19 10:27).

Is there anything that shows how having the disagree warning would have helped?

"The mismatch certainly was in the report, it mentioned both the 20-25kt speed variation and also a comment that the airspeed, altitude and flight director pitch bar values deviated with the left side values lower than the right side values. No cautions about it were mentioned so either left out or the MAX doesn't give a caution with that much deviation for some reason."


So another master caution going off we are up to 4 now.


Those symptoms are usually present in a bird strike. Maybe its a bird strike took out one sides pitot system and AoA vane.

The flight directors are usually split until we are doing an approach and we are locked onto a ILS. Then they link and do the error checking.


Vo... ok its the speed that you can use the full deflection of the controls without damaging the airframe. Takes me back 16 years to when was a FI. But its not the max operating speed. Its usually only defined for light aircraft. And is usually linked to the rudder and tail strength. There are 3 cats Normal, Utility and aerobatic in light single engine aircraft.


Cat A commercial aircraft have lockouts to prevent full usage of the controls in certain configurations eg normally we have 9 deg of rudder when the aircraft is clean. When we select flaps then it goes up to 14 deg. But we can use the full range of controls up to Vmo which is max operating speed when clean. With flaps out then we are limited by the flap speed which takes into account the increase in rudder power.

The max operating speed Vmo may be a structural limit. Or it could be a limit due to transonic flow over part of the aircraft or it could be due to some certifcation limit of testing eg the windscreens for bird strikes.

https://aviationglossary.com/v-speeds/

Are the icao ones for these cat A machines.


The aircraft is protected from the pilots mostly allowing full control usage. What you can't do though is cycle the control inputs. ie use full left rudder then go full right and then back again. This was the reason why the tail fell off the airbus just after 9/11. There are slightly different historical philosophys between US pilot practise in realtion to stalling and upset recovery. US used to teach not more than 100ft height loss in stalling, Europe we try an minimise it but lowering the AoA is more important and preventing secondary stall. Upset they used to teach to use the rudder to pick a wing up using secondary effects.


Basically the dash crash got NASA and the FAA looking at it and they should be teaching the eruopean method now for stalling.


And the airbus tail falling off also got them to change things to the european way of correcting upset using the primary control inputs.


But there are loads of old time instructors and pilots that still use the old US methods and teach them. European pilots that get trained across in the US have to have them punched out of them. If those tendencys are spotted in the sim its a fail.

Would a Disagree Warning help?

Pilot overload can be an issue. So it's a valid point about one more warning.

But it can be argued that the AOA Disagree should automatically disable, or at least apply limits on the actions of, the MCAS.

Why allow MCAS any authority (during AOA Disagree) when there's such high odds that its input is bad?

The science of how aircraft automation and the interface with human pilots, to eliminate 'battles' and ensure optimum synergy, especially in abnormal or emergency situations (when the automation itself may have partially failed), clearly remains an immature field.

Furthermore, it's my opinion that this narrow field is at least 10 years behind where I'd expect them to be. These sorts of incidents, very generally, have been happening since 1988.

It's a subtle topic, and these comment boxes don't really enable a complete dissertation on this. So, apologies in advance for any incompleteness on my part here.

Quote (VE1BLL)

Would a Disagree Warning help?

Pilot overload can be an issue. So it's a valid point about one more warning.

But it can be argued that the AOA Disagree should automatically disable, or at least apply limits on the actions of, the MCAS.

Agreed. Considering the authority the program has and only two sensors to potentially read from, if there's a significant discrepancy the software should disable any action and throw an alarm (AoA disagree).

Is this how the optional feature Boeing offered worked? I get the impression it just gave an AoA disagree alert but didn't actually have logic to shutdown MCAS.

While too many problems can be a problem there is also the case where a human mind is very good at patterns. If all information is provided often a glance at it will distill out in a mind 'the pattern' providing fast recognition of the fundamental problem.

I know most of the time that there isn't enough information to solve complex problems. We cast about over long periods trying to match the symptoms to an already understood and mentally categorized failure. Lacking enough data we have to begin hypothesizing and running logic and real tests to gather more data until the correct neural paths light up with full recognition. The hypothesizing / examination process takes a lot of time. So to me - dish up everything known post-haste to pilots with a problem.

Keith Cress
kcress - http://www.flaminsystems.com

How is it that the flight controls are not tested through a battery of situations like monte carlo or some extremely thorough checklist? I have a hard time imagining that there are an unmanageable number of scenarios? Even something like 500-1000 scenarios should easy be testable. It would take time but it is very doable. For two planes to have crashed and at least two reports in the U.S. of this planes behavior, the situation could not have been that odd for so many people to have stumbled into it.

------------------------------------------------------------------------------------------
If you can't explain it to a six year old, you don't understand it yourself.

I don't think it's as easy to test as people seem to think; these are not discrete event simulator type problems; the exact and entire immediate flight history leads into any specific flight failure condition.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

But there must be some sort of defined testing/simulator envelope? Ensure the plane can takeoff/land in xyz worst case scenario, what happens if x system goes out, etc.

Or am I just being too naive and optmistic since all that would cost precious money?

Sure, but that's all real-time simulation, which means that even the two crashes under discussion would take hours to configure and vet, and they are simply two out of possibly thousand of similar, but different, scenarios that might require simulation.

Moreover, such simulations are only as good as the person coming up with the faults to test, which is why there are so many latent zero-day exploits in browsers. How many people would think that a buffer overrun would be a backdoor into an operating system?

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

I see your point but an AoA sensor fault/failure seems like a pretty basic parameter to test, especially given this new control scheme.

"If you begin to cost your employer significant amounts of time and money, they will do something about it.
Sometimes the squeaky wheel gets the grease, sometimes it is removed and replaced with a ready spare.
If the FAA needs someone to act on their behalf, that person should be an FAA employee."

That in response I believe to the Seattle Times article quotes posted by waross. The article got into the FAA Authorized Representative (AR) situation a little deeper, and noted how the rules had changed, and not to the better:

The old model was: FAA appoints a Boeing engineer as a AR. Boeing pays his salary, he reports on design changes to the FAA, but does not have anybody at Boeing "managing" him. Any retaliatory actions against said employee by Boeing is dealt with harshly by the FAA. New model is Boeing appoints the AR, pays his salary, and said employee is managed by Boeing. Worse, some of the anti-retaliation stuff got written out of the laws/procedures, or at least is being ignored by the FAA.

see https://www.seattletimes.com/business/boeing-aeros...

The episode underscores what The Seattle Times found after a review of documents and interviews with more than a dozen current and former Boeing engineers who have been involved in airplane certification in recent years, including on the 737 MAX: Many engineers, employed by Boeing while officially designated to be the FAA’s eyes and ears, faced heavy pressure from Boeing managers to limit safety analysis and testing so the company could meet its schedule and keep down costs.

That pressure increased when the FAA stopped dealing directly with those designated employees — called “Authorized Representatives” or ARs — and let Boeing managers determine what was presented to the regulatory agency.
“The ARs have nobody supporting them. Nobody has their backs,” said one former Authorized Representative who worked on the 737 MAX and who provided details of the engineer’s removal from the program. “The system is absolutely broken.”

FAA-designated oversight engineers are supposed to enjoy protection from management pressure. Removing one who proves a stickler for safety regulations will inevitably produce a chilling effect on others who see the consequences of being too rigid about safety concerns, said John Goglia, former member of the National Transportation Safety Board (NTSB).

“It negates the whole system,” said Goglia. “The FAA should have come down on that really hard.”

Quote (HamburgerHelper)

For two planes to have crashed and at least two reports in the U.S. of this planes behavior, the situation could not have been that odd for so many people to have stumbled into it.

By the time of the second accident, Boeing had delivered about 325 of these aircraft.

March 10, 2019, is the 72nd day of the year.

737s fly mixed length flights, so let's be semi-conservative and say they make an average of 3 turns per day. I think this is probably low but I'm not a pilot. Alistair, have an opinion?

If all the above is true, from the first day of 2018 to the day of the second crash, 737 Max airframes flew approximately 426,000 flights. That's 426,000 takeoffs, 426,000 landings, Probably at least 1.5 million flight hours, and more than 100 million air miles flown.

Two crashes and two known incidents is a rate of 4 in 426,000- that's a rate of 0.0009%.

.0009% is pretty odd.

"but an AoA sensor fault/failure seems like a pretty basic parameter to test, especially given this new control scheme."

Sure, but there are probably hundreds of "basic" parameters that would also need to be tested, and, note that the AoA disagree warning was supposedly erroneously implemented, and probably doesn't even match the simulator, so testing on the simulator might not have shown any problems anyway.

Note the simulator is a truckload of code written around a simplification of the real plane. There are lots of opportunity for the simulator to diverge from reality, particularly in the tiny "basic" things. Just making sure the simulator matches actual hardware implementation down to that level is whole separate vetting task.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Quote (RVAmeche)

...an AoA sensor fault/failure seems like a pretty basic parameter to test, especially given this new control scheme.

From the link that VE1BLL provided, Boeing is basically doubling down on their original design philosophy for the MAX (retaining commonality with the NG). And maybe they are reversing the CEOs initial statement that they would "own it" or whatever was meant by that. They are clearly stating that the AOA related indicators are supplemental and, by implication, that even failure of the AOA sensors themselves does not present a scenario that pilots are not readily equipped to handle.

Quote:

On every airplane delivered to our customers, including the MAX, all flight data and information needed to safely operate the aircraft is provided in the flight deck on the primary flight deck displays. This information is provided full-time in the pilots’ primary field of view, and it always has been.

Air speed, attitude, altitude, vertical speed, heading and engine power settings are the primary parameters the flight crews use to safely operate the airplane in normal flight. Stick shaker and the pitch limit indicator are the primary features used for the operation of the airplane at elevated angles of attack. All recommended pilot actions, checklists, and training are based upon these primary indicators. Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane. They provide supplemental information only, and have never been considered safety features on commercial jet transport airplanes.

The Boeing design requirements for the 737 MAX included the AOA Disagree alert as a standard, standalone feature, in keeping with Boeing’s fundamental design philosophy of retaining commonality with the 737NG.

It will be interesting to see how this plays out for Boeing. It looks like classic corporate triangulation. Watching the CEO give his latest statement to the shareholders was like watching Scientology's David Miscavige with the affectations and the excessive confidence and the obtuseness when answering questions. I guess I'll be a project engineer for life.

"Two crashes and two known incidents is a rate of 4 in 426,000- that's a rate of 0.0009%."

Of course, the math works the other way too.

"0.0009%" multiplied by some big numbers equals two major crashes in relatively quick succession.

Both are accurate, but the perception of one is encumbered by some human cognitive bias about seemingly 'small' numbers.

Accident rates are done fatal accidents per million flight hours.

The max is over 3 most swept wing jets are in the 0.2 to 0.5 region. Turbo props are 0.4 to 0.8.

Ng 737 is less than 0.1 the classics are higher.

Concorde is over 11 with only 1 fatal accident.

Quote (VE1BLL)

Both are accurate, but the perception of one is encumbered by some human cognitive bias about seemingly 'small' numbers.

My point was in response the the implication that this failure mode was, quote, "not that odd" i.e. not rare.

The point I was making is that 4 incidents in 400,000+ is the definition of a rare event, which you could not expect to reliably catch in any type of test plan that had a reasonable duration.

I think that we as a group are perhaps crossing a little too far into armchair quarterback territory. It's pretty easy for us to sit back and say "WHY DIDN'T THEY TEST THAT" when we already know the failure mode.

Let's not forget, this is a device with more than a quarter million parts and more than a half million fasteners. Design, development, and execution of robust and comprehensive testing schemes is very, very hard.

Alistair, in your information,"Accident rates are done fatal accidents per million flight hours.", would the Max 8 count as 2 fatal accidents or as 346 fatal accidents?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Boeing's advantage is a contractor's dream.
Just think, if you don't like an inspector's ruling, just replace the inspector.
What a great way to stay on time and on budget.

Bill
--------------------
"Why not the best?"
Jimmy Carter

FWIW the comments below are of some interest

https://forums.theregister.co.uk/forum/all/2019/05...

"Why didn't they test that?"

Of course, formal proof of compliance for large projects is (these days) usually tracked and managed within a requirements tracking database tool such as DOORS. Everything should be linked from the specification requirements at one end to the test (or inspection, demonstration, or analysis) evidence at the other end. This process is supposed to ensure that nothing is missed, unless covered off with a waiver or deviation.

Those involved are supposed to track everything (aided and enforced by the database tool), pretty much leaving a 'defective specification' as the only escape.

Software development should be managed under DO-178 or equivalent. It's highly prescriptive, with traceability as its core.

Testing will prove compliance of even those requirements that would never be exercised in the real world in a million years, but they're still tested. Perhaps using an automatic test bench in mere minutes.

As an example of how waiting is not used, when an engine OEM needs to test the turbine blade containment system, they don't wait for a blade to fail by itself. They wire up an explosive charge to cause a blade to become detached on command.

Waross,

I think the numbers are calculated based on fatalities per million hours?

http://www.airsafe.com/events/models/rate_mod.htm

Here is a site which gives numbers and also the method of calculating them.

We get per million flight hours from the safety officer at work but can't find any on the web using that method with description.

I susepct it per million flights penilises the long haul types who do 8-12 hour plus sectors.

It's about perceptions, but note that the MAX and the SST have extremely low total flight counts, which drive up the rates significantly. The DC10 numbers look tolerable, but there was a span of two years with 4 events in 1978-1979, which drove the rate up significantly. As you read through the major incidents, there will also be descriptions such as "design was dangerously flawed," that passed all inspections and testing.

When companies want really low accident rates, they'll use deaths per million passenger miles, as there tends to be fewer incidents in the middle phase of a flight, and long-haul planes tend to carry more passengers.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

40+ minute investigative report.

"Rogue Boeing 737 Max planes ‘with minds of their own’ " '60 Minutes Australia' via YouTube

"Liz Hayes investigates the disaster of Boeing’s 737 MAX jetliner. Why two supposedly state-of-the-art and safe planes crashed killing 346 people; why pilots now fear flying the 737 MAX; & whether Boeing could have averted the catastrophes."

I'm just about to watch it, so no comment on it.

http://www.airsafe.com/events/models/rate_mod.htm

^ This is the accident rate per million flights, not million flight hours. That's a big difference and explains why the rate per million flight hours posted before seemed way too high. The fatal accident rate per million flight hours for the Concorde should be under 1.

It doesn't matter how they fiddle the numbers on the stats the max has got it's place in history on the same page as the comet.

Even that russian coal burning heap of an aircraft the ssj has better stats.

Interesting; From The Red Deer Advocate
"Transport Minister Marc Garneau recently said he’d like Canadian pilots to undergo flight simulator training related to the 737 Max software revision, a step beyond an FAA-appointed board’s proposal for computer-based training.
Air Canada says it is the only North American airline with Max simulators, which could lead to swifter resumption of Max service when the grounding ends."
Link

Bill
--------------------
"Why not the best?"
Jimmy Carter

Quote (Alistair_Heaton)

It doesn't matter how they fiddle the numbers on the stats the max has got it's place in history on the same page as the comet.

That's overstating it really, Comet was a lack of engineering knowledge (plus a touch of company culture), the 737 is company culture issue & a touch of peter principle. One would expect it to be more like the DC10/MD11, the 737max's will make a very successful narrow body freighter.

Seems that convincing the pilots that its safe is the easy part.....

The cabin crew unions are not happy flying in it.... and technical arguments won't work with them. Hell we can't stop them putting coffee down the toilet or galley sinks and it turning to concrete so trying to get them to trust the aircraft now after two have crashed will be and extreme struggle.

"he 737max's will make a very successful narrow body freighter. "

I suspect that will be correct. But the market for them is incredibly small. I think there is under 100 737-800BCF on order after it was released in 2016.

Funny you should mention the MD11 quiet a few old timers say that the route cause of this issue was the merger of Boeing and MD back in 1997. Boeing was run and controlled by Engineers, MD wasn't. After the merger MD mangment style prevailed.

Boeing have only recently gone back to have an Engineer in charge Dennis Muilenburg from 10 years with James McNerney in charge. The last Engineer in charge was Philip M. Condit in 2003 but he was replaced by a MD person Harry Stonecipher.


I agree about the Comet, I have actually flown in a comet airframe..... Nimrod years of hard service without the huge windows.

"It doesn't matter how they fiddle the numbers on the stats the max has got it's place in history on the same page as the comet"

Not really, the entire 737 line has logged 239 million flights (MF) with 0.23 FCpMF, while the MAX is 0.65 MF with 3.08 FCpMF, which means that if it gets 10 MF without any further incidents, it will be in the same range as the entire model line. Conversely, the entire line had 55 total fatal crashes, so it's likewise a small percentage of the entire product's crash history, assuming it gets past this.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

It won't be judged on pure accident stats.

And to be honest now I can't see the rest of the world touching them apart from the US market.

Although the line did manage to survive the rudder hard over issue.

We shall see.

Nope Alistair. You need to re-think that.

Remember Airbus had a highly publicized slow motion plow into a forest terminating in a huge fireball caught on video. That was due to idiotic software and control decisions made by Airbus designers. There were none in service at the time so no huge vested interest by airlines. It went on to be the popular A320.

A320 Auger-in

There isn't a trace of doubt (for me) that this plane won't be flying everywhere in a year. There is too much history of the 737 line, too much money sitting on the ground in brand new aircraft, owned by too many different airlines, to all turn their financial backs on a perfectly good plane that had a single poorly thought out software issue. Would you turn your back on a billion dollars worth of hardware sitting on your books even if it cost you 20 million in simulator time? I can't see bean counters doing that.

Keith Cress
kcress - http://www.flaminsystems.com

The airbus didn't kill any pax. And it was a one off.

We shall see what happens.

They are going to have to heavily discount them.

Alistair,
How is this remotely true - the Airbus design philosophy has killed hundreds of people by isolating the pilots from what the controls are doing. Every suggestion for "fixing" MCAS would have been applicable to AF447. You can't tell me that a plane in a deep stall should automatically shut off the stall warning because the AoA is out of range for normal flight. That software killed the entire complement of people for no reason. Where was the FMECA on that? Where was the control input disagree warning for the pilots to tell that one was pushing forward and the other was yanking back? That seems like a very critical flight safety system that Airbus saved some money not including.

I must admit I am not impressed with the airbus flight logic either especially the push a button to get control logic.

Or for that matter the cm1 cm2 everyone is equal nonsense on the flight deck which the OEM procedures force on you.

As I have said previously I see this issue being mainly a regulator developed issue. They just haven't done their jobs properly. And its global not just the FAA.

Although the airbus does have 3 AoA vanes.

The regulator has given the OEM's enough rope to hang themselves with. And boeing was the first to slip off the plank.

Any argument that the MAX series is finished has no merit whatsoever. The last numbers I saw had over 4500 MAX's still waiting delivery. I only know of the one cancellation for 49 planes from an Indonesia airline.

Airlines BADLY want more of this class of plane and there simply is no other readily available substitute. The only other realistic option for airlines would be to get in line behind the customers who are already waiting for Airbus to deliver the 5500+ NEO orders still pending delivery. Giving Airbus an optimistic delivery of 400 planes a year, they already have over 13 years of order backlog. Do you really think an airline that is scheduled to take delivery of their MAX planes in the next year or 2 will instead wait over 13 years for a NEO?

"Airbus does have 3 AoA vanes."

Redundant sensors are arguably necessary, but are insufficient to avoid incidents. System and software design errors can still overcome redundant sensors.

E.g. Flight QF72 (2008), an Airbus A330-303 with three AoA sensors.

Wiki summary "...[two] sudden uncommanded pitch-down manoeuvres that severely injured many of the passengers and crew." The flight landed safely after the two upsets.

---

Big picture: The overall design and certification process clearly has holes in it, and I suspect that those sorts of gaps are inherent (endemic to humans).

If so, then totally new design concepts are required. But that'll take significant time. So, regrettably, this forum is going to be quite busy for the foreseeable future.

Here is the orders and delivers list.

Max

https://en.wikipedia.org/wiki/List_of_Boeing_737_M....


Neo


https://en.wikipedia.org/wiki/List_of_Airbus_A320n...

Most airliines pay 20% of the price upfront on order to get in the Q. And then there is a funny leasing system to dodge paying tax and the owners don't loose the aircraft capital if the airline goes bust.

I am niether a Boeing or airbus person. Its no skin off my nose which way things go.

Its 54 per month for single isle neo 's by this summer which is what the supply chain is set up for. So its 650 per year and they are increasing the size of the Mobile operation due to the likely trade war doubling the output to 120 a year for the american market.

The A220 is a substitute for the max 7 but its production rate is quite low.

In fact the thing thats going to limit both party's deliveries is getting thier hands on the leap engines. With one big player not delivering and most engines being power by the hour leased onto the airframe for the delivery it should be relatively easy for production rates to take advantage of this. I know some guys at Hawarden and the autoclave is never off and they are rolling in over time.



yep the A330 QF incident. One out of 3 ADIRU's went out and started putting out spikes. Seems the regulators haven't learned from that incident to enforce mission critical flight control software testing standards for anything that has direct input to the flight control surfaces without limits.

I must admit I am none to keen on the airbus philosophy, but mates say its not to bad once you get used to it. Just like most other pilots away from A and B I just want a well maintained aircraft that will do the job with a minimum amount of fuss and gotchas to bite you when your on your 4 the sector of the day of a 12 hour shift and its blowing max xwind for your runway and 20 gusting 50 knots.


It seems to me that the regulators are reactionary instead of grabbing the whole issue by the tail and enforcing proper design standards and testing.


They may even have regulations on the subject now.... but as most new models are based on grandfathered rights from aircraft designed in the 60's and put out in the early 70's we are all stuffed and have to live with the fact that people are going to have to die to find out what the faults are.

"...enforcing proper design standards and testing."

Of course, that approach can help and is therefore essential. Not to mention legally required. So there's no argument against it.

But after several decades of these sorts of incidents (incident category: automation being unhelpful), I suspect that the usual approach (even 'turned up to 11') isn't going to be sufficient.

New concepts will be required. It's going to take twenty+ years.

It wouldn't take 20 plus years if they said no more grandfather rights from tomorrow. And you are allowed 2 stretches, so 3 variations on a type.

It's a hard road for the regulatory agencies to go for that, the FAA, e.g., has a dual mission to regulate AND promote US aviation industries. Likewise for most countries' equivalent aviation agencies.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

BTW I am advocating the same standards for everyone. This is a global problem not just A and B, you have the Jungle Jets the Canucks at the moment. Personally I think the Q400 was taking the pee on the grandfather rights as well and I am qualified to comment on that type.

The Asia market is huge and still developing and they will start producing there own aircraft types.

The Russian market is huge as well but political transfer of tech will limit things. There local produce is suspect and years behind the rest.

As one of the sausage munchers at work said at least airbus has access to VW coders those lady's know how to code properly so nobody knows something is screwing with the control system....

"Likewise for most countries' equivalent aviation agencies"

Pretty much unique to be honest.

And they have royally screwed it up now.

There are only really 5 countries/EU producing civi air transport cat A aircraft. They used to be working towards mutial recongnition. And the rest of the ICAO states were following for training and hardware certifcation. Thats out the window now.

As i have said previously i expect the max to be able to be flown again by sept/oct this year in US airspace. Outside that no chance until Jan/feb, more likely a year from now. 50% tech reasons 50% political

http://www.b737.org.uk/runawaystab.htm

here is the history of the QRH for trim runaway for the 737.

Its gone from 3 lines to 3 pages in the QRH since the 1960's and BTW the 3 line version worked like a treat on the 737-100.

Greatly eliminating the grandfathering ability would likely push air travel back to something only the top few percentage of wealthy people could afford and also put most of the airlines and plane manufacturers out of business.

On the bright side, the regulators could do far more oversight on whatever is left with their current budgets.

Frankly, the whole argument on what should be allowed or not when upgrading an existing plane is completely pointless. I have only picked out one person here who has enough knowledge to intelligently comment on this, and it's not the outspoken pilot.

I don't think there's anything inherently wrong with grandfathering. In fact, grandfathering embodies the inherently conservative approach in commercial aviation, which is a good thing. But grandfathering should not be perverted to disguise an adversely mutated DNA, whatever the reason for the mutation. Just like Mother Nature, Aviation will allow/cause non-viable mutations to die off.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

Quote (Alistair_Heaton)

The airbus didn't kill any pax. And it was a one off.

The A320 didn't kill anybody?
Air France Flight 296 The stunt with passengers onboard killed 3.

Another poster mentioned AF447. That was a A330 not A320 but it was a over-complex automation caused crash.

What about Indonesia AirAsia Flight 8501? Very similar to AF447. Pilots can fly years in an Airbus without actually knowing how to fly an aircraft. The automation breaks and they crash it.

Airbus can even be a contributory factor in a crash of a Boeing. Asiana Airlines Flight 214 First two times a pilot with years of Airbus flying tries to actually fly an airplane he has the controls yanked from his hands, and the third time he crashes it.

Quote (Matt)

The A320 didn't kill anybody

Actually; he said "didn't kill any passengers". Well other than the people declared AI baby sitters er.. flight crew (in that case). :)

Keith Cress
kcress - http://www.flaminsystems.com

From https://en.wikipedia.org/wiki/Air_France_Flight_29...

Quote (Wikipedia)

Air France Flight 296 was a chartered flight of a new Airbus A320-111 operated by Air France
Passengers 130
Crew 6
Fatalities 3
Injuries 50
Survivors 133 (136 initially)

... three did not escape. One was a disabled boy in seat 4F who was unable to move. Another was a girl in seat 8C, who was unable to remove her seatbelt (her younger brother had removed his own seatbelt but was carried away by the rush of people before he could help his sister). The third was a woman who had reached the front door and then returned to help the girl.

There's also countless instances of set screw shaft couplings that operate just fine, indefinitely.

The coupling you're describing is subject to very low levels of torque. I suspect if the application called for splines they would be there.

Yet again, we're hip deep in armchair quarterback territory.

Most of the time a setscrew sets against a flat spot or even sometimes a recess in the shaft, which would require a little bit more 'looseness' for it to actually come apart.

Brad Waybright

It's all okay as long as it's okay.

"There are countless references relating to failures of various set screw held devices that are said to have failed due to incorrect tigtening torque."

So, nothing wrong with the setscrews, per se.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Satcomguru has a good discussion about the AoA failure:
https://www.satcom.guru/2019/04/what-happened-on-e...
https://www.satcom.guru/2018/12/angle-of-attack-fa...

There are a number of takeaways:
> AoA disagree -- Boeing supposedly has that fixed in the new software
> Absurd AoA reading -- the AoA faulty reading was larger than supportable from other flight parameters; unclear whether anything is being done about absurd data
> Absurd AoA dynamics -- the AoA went from relatively nominal to absurd in such as short timeframe that is patently impossible; again, unclear whether there's anything being done about that.

So, while there might have been a physical hardware/electrical failure in the AoA sensor, what the rest of the aircraft did with the information, in context, was also a massive failure. The logical failure is possibly still unresolved; sometimes, you need to kick everyone involved off the program and start with a completely new set of eyes and brains.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

A justification/excuse for not adding the AoA disagree feature was that it would trigger re-certification.
Dollars over safety again.
Will the fix be re-certified?
Why is this the first 737 to have MCAS?
As I understand it, it is because of unacceptable flight characteristics caused by the location of the Leap engines.
Is anyone else concerned that while MCAS may be meeting the letter of the rules, it is avoiding the spirit and possibly the intent of the rules?

Bill
--------------------
"Why not the best?"
Jimmy Carter

IRStuff - the same problems are lurking in Airbus software no doubt. What control software would let a pilot tear the tail off an airplane or stall one 30,000 feet to the ocean. To do otherwise requires a full dynamics simulator that compares all inputs to a real-time model to see if there's a mismatch.

But what to do when there's an error in the on-board simulator? Maybe independently develop 3 different simulators; but how much tolerance can there be allocated for inevitable differences? And what if 2 of 3 developers misread a portion of the spec and develop a simulation that is actually wrong, potentially voting off the correct one?

I suspect that avoiding an infinite swirl of endless complication is why MCAS used only one AoA indicator - all faults coming from there are handled the same way. Set pitch and power and shut off the stab trim if it keeps trimming in a direction the pilot doesn't want. KISS.

If there's a fundamental problem it is in the training. When Boeing mentioned "continuous" they failed to mention how long "continuous" needed to be evaluated before pulling the plug. Apparently 5 seconds is too long; that's the amount of time the ET pilots let it go before shutting off the trim motors, and long enough to be insurmountable during airspeed runaway by just pulling hard on the yoke. A secondary problem is the false stall warning and stick shaking that distracted the pilots, and their inability to ignore it after a full minute of that nonsense had gone by. I would probably add a check for the actual stab trim as part of pre-flight with a schedule for climb-out.

"And what if 2 of 3 developers misread a portion of the spec and develop a simulation that is actually wrong, potentially voting off the correct one? "

Not a "what if," we had that happen on a relatively tiny project, where we designed a processor and a data recorder reading data from a bus, and a simulator to test them; all designers misread the ICD, so all the hardware worked fine with each other, and the simulator, but crashed on the actual flight system.

But, you point to only one of the issues with the AoA problem; when the AoA data goes faulty, there ought to be something that looks at the data and says, "Gee, that's stupid data, I should ignore it or switch to the alternate AoA sensor."

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

"As I understand it, it is because of unacceptable flight characteristics caused by the location of the Leap engines."

But, I don't think that's true; the plane flies fine without MCAS being activated; it's only an issue if the plane is already flying outside its normal mode. It was meant as a safeguard, not as a part of normal operation.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

It seems to me, any way you slice it, it boils down to a top level system engineering failure.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

The departure trim setting is set from the trim details from the load sheet during the before start checks unless you get your final load sheet via ACARs during taxi. If the trim is set outside the normal range when you bring the power levers forward of flight idle by more than 20-30 degs then a config warning will sound. And takeoff is abandoned.

The inability for either the electric or manual trim to be able to trim the aircraft in the event of a 5 second trim runaway is now up for discussion if the whole system meets certification standards whether or not the mcas is fixed to be more fault tolerant

BTW I too have no doubt that airbus has similar gremlins lurking as well in its control software.

Quote (IRStuff)

"As I understand it, it is because of unacceptable flight characteristics caused by the location of the Leap engines."

But, I don't think that's true; the plane flies fine without MCAS being activated; it's only an issue if the plane is already flying outside its normal mode. It was meant as a safeguard, not as a part of normal operation.

MCAS does exist because of unacceptable flight characteristics- in one very specific area of the flight envelope.

Yes, the plane 'flies fine' without it. But MCAS is a safety system- not a primary flight control system. It was, obviously, not implemented extremely well but that doesn't mean it isn't a necessity on aircraft configured with those engines.

Did not say or imply it wasn't necessary, just that the statement "As I understand it, it is because of unacceptable flight characteristics caused by the location of the Leap engines." was overly broad, and the implications of the more narrower, safeguard, function of MCAS implies a different type of scrutiny than it if was primary flight equiment.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Does mcas save lives? Are there numbers that show the world is better for having mcas even if it doesn't work the way that it should sometimes?


How come there is no agency like the FAA that certifies "driverless" vehicles? Similar issues have or will come up with these system.

------------------------------------------------------------------------------------------
If you can't explain it to a six year old, you don't understand it yourself.

The electric trim had the ability - the pilots chose not to use it in the same way they chose not to retard the throttles, the first step in several procedures.

How does a pilot not notice the level-flight control force go from 0 pounds to maybe 30-50 pounds and increasing and think, nope, I'm good for the next few hours, no need to trim that out? How do they never look down and see what the trim indication says? This is a fundamental pilot training failure, independent of MCAS.

Those rhetorical questions might just as easily be posed to demonstrate that the actions were surely attempted but were ineffective due to problems with the equipment.

Where are we anyway with the investigation of the two incidents? I only remember hearing about the preliminary report from the second.

"How come there is no agency like the FAA that certifies "driverless" vehicles? Similar issues have or will come up with these system."

There is, the US DOT. The problem is that, unlike the FAA, which has dealt with basically the same stuff for 70 years, DOT hasn't dealt with this subject for more than about 2 or 3 years, and there's zero precedent for the level of validation, particularly when it's 100% software with no analytical validation tools

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

The investigation will take at least another 12 months possibly longer.

The actions were effective when tried. The data traces showed a match between trim switch use and both stab trim change and MCAS action suppression on both accident flights. One suspicion on the Ethiopian flight is that because of the excessive speed that the trim inputs caused large shocks to the cockpit and the pilots were afraid of the shake it produced. What isn't explained is why they did not immediately return the trim motor switches back to the off position.

It's also important to note that even though there are cutout switches specifically identified to counter trim runaway, actual trim runaway is not trained in all phases of flight, including when exceeding Vmo.

As I understand it, 50 years of 737 flying had no need of MCAS.
However the 737 Max series had issues with characteristics.
"MCAS does exist because of unacceptable flight characteristics- in one very specific area of the flight envelope."
Actually the area of the flight envelope is either steep nose up or tight banked turns.
MCAS is NOT the problem. MCAS as deployed is one solution. There are other possible solutions.
There are hardware solutions, and soft ware solutions.
Why was MCAS chosen?
I surmise that in order to get part of the orders for new planes that would otherwise go to Airbus, Boeing promised delivery dates that may have been challenging.
MCAS could be implemented in software and looked to be cheap, quick and light.
With costs to Boeing and the airlines at over 2 Billion dollars and possibly ending up several Billions more, cheap isn't working very well for Boeing.
With the Max fleet grounded worldwide and possibly a slowdown in production, quick didn't pan out either.
The first crash was a regrettable tragedy that never should have happened.
I can't find the words to express Boeing's subsequent actions in regards to MCAS up to the second crash.
It may be time to reevaluate the order of priorities.
The present priorities seem to be.
1. Beat the competition.
a/ do it cheaply.
b/ Do it quickly.
2. No new certifications.
3. No new training other than an hour on an I-Pad.
a/ Don't mention MCAS as then it may require more training.
4. Definitely no simulator training.
a/ Again, don't mention MCAS as then it may require more training.
5. Safety. Not an issue if it will impede a higher priority.

I accept that to be competitive more efficient engines must be used.
I accept that the engine of choice is the Leap engine.

Some of the factors involved in using the newer, larger engines:
The cost in dollars.
The cost in time to market.
Fly-ability of a new design.
The cost in weight.
The cost in safety.
The cost in training.
The cost in company reputation.
The cost in certifications.

Going back to priority number 1, which isn't working that well anyway;
How would the market have responded to a kit to install leap engines on existing 737s?
It is probably doable. The landing gear on the Max 10 is probably not usable as is, but it demonstrates that longer landing gear may be developed to allow the engines to be mounted under the wings.
Make it fast.
Make it Cheap.
Make it safe.
Pick two.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bill, you can keep posting long indignant rants about how Boeing did it cheap and they should fix the plane without MCAS but the simple facts are that the plane won't be changing any further and Boeing won't stop production and give up almost 5000 orders so a new version of MCAS will remain in use on the MAX.

The likely reason MCAS was not mentioned was not to make the plane cheap and fast to market but rather because it was determined that MCAS was part of the motorized stabilizer control and there already was pilot training and troubleshooting documentation in the manuals on runaway stabilizer. So be it MCAS or another system causing runaway stabilizer movement, the procedures to handle the failure already existed.

Excuses or not, when you examine many plane crashes you will find that the pilots were distracted by the issues and made it their main focus instead of having flying the plane as their main focus. The second crash story might be different if the Ethiopian pilots had either electrically trimmed the plane properly first before throwing the switches or pulled back the throttles and kept the plane at a reasonable speed before attempting to manually trim the plane.

The point that I am trying to make is that MCAS is not the problem.
MCAS is one of many possible solutions to a problem.
I am trying to suggest that it may be prudent to consider other solutions to the base problem.
I see that you are playing the "Blame the pilots" card.
Shades of Captain Sullenberger. 35 seconds in a cockpit panic made the difference between a goat and a hero.
Boeing has shown a willingness and the ability to remove engineers who management does not agree with on safety issues.
This is an interesting statement:
"The likely reason MCAS was not mentioned was not to make the plane cheap and fast to market but rather because it was determined that MCAS was part of the motorized stabilizer control and there already was pilot training and troubleshooting documentation in the manuals on runaway stabilizer. on runaway stabilizer."
The other point of view is that:
The likely reason that it was determined that MCAS was part of the motorized stabilizer control and there already was pilot training and troubleshooting documentation in the manuals on runaway stabilizer and that MCAS was not mentioned was to make the plane cheap and fast to market."
Another interesting statement:
"So be it MCAS or another system causing runaway stabilizer movement, the procedures to handle the failure already existed."
Yes, for 50 years pilots have been handling runaway stabilizer events in the &#& with no problems. What changed?
No training.
No pilot awareness of a new system.
Trim runaway may now be caused by bird strikes.

One extreme view is that MCAS is a perfect system. It just needs tweaking a little.

The other extreme view is that the plane should be scrapped entirely.
Interestingly, that is the track that Boeing was on until Airbus beat them to market with a new model.

I am not advocating scrapping the Max. I am suggesting that we should be taking a broader look than just the MCAS system.

Can we agree to disagree that fixing MCAS may not satisfy a Five Whys investigation?
There is more than one way to view this whole situation.
Forgive me for playing devils advocate.



Bill
--------------------
"Why not the best?"
Jimmy Carter

I have watched a lot of episodes of "Air Disasters" on the Discovery Channel. There seems to be a running trend of planes crashing because someone didn't understand the auto-pilot or some other automation or the automating system was disabled unknowingly. In a lot of these cases where this happens, the pilot is put into a bad situation while not having full control of the plane and too much is going on to figure out in a timely matter what the problem is. Are there that many situations where the control systems need to operate automatically? Are automatic controls adding to safety?

------------------------------------------------------------------------------------------
If you can't explain it to a six year old, you don't understand it yourself.

Hi HH. One example of "situations where the control systems need to operate automatically" was given by Alistair and relates directly to stabilizer trim.
As the flaps and slats are deployed the aircraft trim changes significantly.
The stabilizer trim automatically adjusts to maintain the trim as the flaps and slats extend and retract.
This has been working on the 737 for 50 years.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Seems the FAA is going to release the max to fly next week in US airspace. No news yet about training requirements.

There is a meeting in 3 weeks time with the other major world caa's to discuss getting the bans from thier airspace.

I have no reference for this I am currently in the SIM center and some Ng pilots that flew the max are in doing their checks on the Ng SIM and were chatting in the coffee bar.

Quote (HH observed)

There seems to be a running trend of planes crashing... ...automation...

The distinction of this trend can (if you like) be viewed as follows:

These newer style incidents are where the aircraft is in very nearly in perfect condition, right up to the moment of impact.

They're quite distinct from the old style incidents which typically started with something going bang; where the aircraft had a million dollars damage at the very outset of the incident.

With the new style of incident, perhaps it's just a sensor that is defective or clogged. Perhaps some software is acting in a strange manner. Perhaps the pilots are confused by a flood of error messages. Perhaps the training is inadequate for the subtle complexity of the new systems.

If these incident aircraft could be gently caught in a hypothetical net, then they could be dusted off, sensors fixed or cleaned, pilots training improved, system design re-considered, and software re-coded.

Viewed in this manner, these two separated trend lines seem to be moving in opposite directions. The old style incidents are generally on a downward trend since forever. But these new style incidents are (partially) backfilling the gap over the past 30 years or so.

The AOA sensors are the same as on the classic and Ng types there has been no change to the AoA system sensing since the 60's. The what takes the data changed but the actual sensor is the same. And they are not lifed so in theory there will be ones out there that are 50 years old.

Good summary on BBC

Satcomguru ruled out the possibility of the vane coming loose, since the counterweight would cause a different data output, and IIRC, he felt that no mechanical problem, per se, could cause a constant AoA error that showed up in the FDR data.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Some of what I read connected the AOA sensor failures to QA problems at the north carolina assembly plant. [edit that doesn't make sense b/c the NG's are made in seattle]

Flaws in flight simulator.

"The failures that these sensors DO experience is, by an overwhelming percentage, due to bird strikes of the sensor blade. That failure has nothing to do with the shaft coupling inside. "

The other failure mode is that they have a heavy duty heater in them that stops ice forming on them in clouds like the pitot tubes have. I don't have a clue how that system is wired on the 737 but there are situations when the power to the tube either gets shut down or the heater its self burns out. For my type its when the associated AC bus comes off line. Which would require the AC bus tie to not be able to remain in so wouldn't just be a generator failure.

As ice builds up on them the reading goes out and may trigger the Stick shaker. Its covered in our QRH though when the caution light for that system/side comes on.

The bit I can't understand from the various issues associated with bad data is the there doesn't appear to be any conditioning of the data. I.e. inputs which are physically impossible to achieve ( e.g. 5 degree AoA going to 70 in less than a second), random bad data ( I think the airbus which violently dipped in Australia they pinpointed to a single data point which changed by some huge amount in a millisecond).

Other complex process control systems which control process plants, nuclear power stations etc can manage this and alarm/alert operators and ignore that data in the safety systems. Why don't aircraft control systems do this?

Ultimately Boeing made an airplane with different flying characteristics in certain modes, but then attempted to solve the physical issue by software. Then somehow ignored their own rules about the level of redundancy required for critical systems and equally somehow didn't analyse the impact of bad data. And let the system repeat itself time after time with no easy kill switch which didn't disable the whole trim system. That was the real killer. IMHO.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

I understand that the pilot's indignation is because they were not told that MCAS existed.
If they didn't know about it they didn't have to be trained on it.

Just when you think that it's over, it gets worse.
Drilling down in the link posted by VE1BLL:
New York Times.

Quote (New York Times)

Every day, there is new news about something not being disclosed or something was done in error or was not complete,” said Dennis Tajer, a spokesman for the American Airlines pilots union and a 737 pilot.---
Boeing recently discovered that the simulators could not accurately replicate the difficult conditions created by a malfunctioning anti-stall system, which played a role in both disasters. The simulators did not reflect the immense force that it would take for pilots to regain control of the aircraft once the system activated on a plane traveling at a high speed.---
"On the Ethiopian flight, the pilots struggled to turn the wheel while the plane was moving at a high speed, when there is immense pressure on the tail. The simulators did not properly match those conditions, and Boeing pilots found that the wheel was far easier to turn than it should have been.---
But it's likely that pilots will be briefed on it via additional personal computer training, since there is just one 737 MAX simulator available for training use in the U.S.---

(And one in Canada)
Now it looks as if there are NO valid flight simulators available for Max 8 training.
Just another minor software glitch from Boeing.
It looks like even if the pilots had successfully completed simulator training, they may have still crashed.
How could Boeing provide adequate training when their own simulator was flawed?
Given that the pressures exerted on the tail were much greater than programmed into the simulator, is it reasonable to consider a re-certification of the tail assembly?

What's next.
I wonder if smoking gun memos will surface.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Is it necessary to correctly simulate a condition that the pilots should never allow the plane to get to and, if they have, why would there be the assumption they could ever recover from it? By the time the Ethiopians got to that point they'd already blown past a half dozen "don't do this" actions.

What Boeing could have done is a trim wheel force study over IAS vs elevator, which would have told the pilots of the accident aircraft nothing they could use. They are already trained not to exceed Vmo, what would some other "Don't do this" would make a difference?

So a reminder memo could be issued, and the fleet immediately released for flight?

Perhaps I'm not reading what you meant.

What I meant is that leaping onto the simulator for not simulating a condition the pilots should never allow to develop is a waste of time. It's just gathering more firewood to burn someone at the stake and cannot make anyone any safer.

Tragically, releasing a memo doesn't help because the Ethiopian airline apparently chucked it into the trash.

Bill; Would you please start using the QUOTE FUNCTION. Your posts are so hard to read I'm starting to give up on them.

People quote in their posts then you come along and quote them with your quotes which is mindfuddling. Quoting them with quote marks makes readers struggle to understand what's your writing and what's other's. Use the quote function:
.

Always put other people's writings in a quote box, it's easy. You don't need to identify the other poster if you're quoting a post that's only 2 or 3 posts back. If it gets farther back than that it helps to add their name when the Quote Function asks for it.

Keith Cress
kcress - http://www.flaminsystems.com

"I see that you are playing the "Blame the pilots" card."

Not playing any cards. There is plenty of blame to go around. Boeing could have make the system more robust and lkely avoided continually moving the stabilizer nose down by making different decisions. The planes could have been successfully landed if the pilots had made different decisions. More robust pilot training (not just on the MAX but in general) might have helped the pilots cope with the issue and bring the planes back safe.

To be blunt, pilots don't get trained on the technical details of how the various plane systems work. They get trained on how to fly the plane and what to do when certain failure conditions present themselves. Pilots certainly don't get trained on how the software in fly by wire planes is written and how it decides to move the various controls? They don't dive down into the code level and subroutine level. This is why I don't understand the indignation at the MCAS system not being technically explained. Boeing had believed a malfunction was handled as part of the runaway stabilizer procedure the exact same way as all kinds of other failures have procedures.

As for the simulator. What is "high speed"? I just don't see it being a huge screw up if "high speed" is exceeding Vmo. Should the simulator always be accurate even when the pilots fly the plane out of it's flight envelope?

Apparently a 737 flight simulator can be programmed and some have been programmed to replicate the control forces experienced by the Lion Air pilots.
There was a You Tube video up for awhile demonstrating that the forces on the control surfaces could become greater than could be overcome manually.

Drilling down in the New York Times further we find:

Quote (New York Times)

By Jack Nicas, James Glanz and David Gelles

March 25, 2019

During flight simulations recreating the problems with the doomed Lion Air plane, pilots discovered that they had less than 40 seconds to override an automated system on Boeing’s new jets and avert disaster.

The pilots tested a crisis situation similar to what investigators suspect went wrong in the Lion Air crash in Indonesia last fall. In the tests, a single sensor failed, triggering software designed to help prevent a stall.

Once that happened, the pilots had just moments to disengage the system and avoid an unrecoverable nose dive of the Boeing 737 Max, according to two people involved in the testing in recent days. Although the investigations are continuing, the automated system, known as MCAS, is a focus of authorities trying to determine what went wrong in the Lion Air disaster in October and the Ethiopian Airlines crash of the same Boeing model this month.

The software, as originally designed and explained, left little room for error. Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.

Less than 40 seconds. That does not leave much of the 35 seconds of decision time that was deemed to be reasonable in the investigation into Captain Sullenberger's landing.
Don't forget that one system was forcing the aircraft down and another system was warning that were sinking.
Captain Sullenberger knew that he had hit a flock of birds and lost his engines. He had to make a choice of landing options.
He wasn't getting conflicting information while a system that the pilots had not been properly trained on was trying to crash the plane.
Face it. Boeing sold something that they didn't have and then couldn't deliver on schedule. A lot of airlines trusted Boeing and lost their place in the Airbus delivery schedule.

A question for the aviation experts:
When an aircraft is diving steeply is there any way other than nose up to slow it down? When the aircraft is diving at an extreme angle will shutting down the engines have much effect on the speed?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Swept wing jets have spoilers on the wings which are quite good at getting rid of energy at high speed.

On jets shutting an engine down doesn't produce much drag. Turbo props shutting one down without feathering the props gives huge amounts of drag.

Taking the power off when you already have issues with the nose going down usually makes matters worse due pitch power couple. So you have conflicting effects. Overspeed take power off... Power off nose will go down alot and you can't lift the nose.

Don't know if applicable to the Max but some previous 737 models allow for gear extension as part of emergency descent procedure. Still going cause more pitch down.

waross - that 40 seconds includes failing to notice that holding pitch has changed the control yoke force from a pound or two to (estimating from pprune comments as I haven't seen what the actual force was) nearly thirty pounds. It's not like the fire on the Concorde or the hole in the space shuttle wing where some structural effect is happening that cannot be felt by the pilots or a sudden explosion of an engine disk or loss of an engine entirely, it's an increasing tug which both crews on the Indonesian planes countered successfully with electric trim for a reasonably long time until, in the accident flight, the copilot failed to understand that just stopping the trim wheel from turning by a short click on the button wasn't what the primary pilot had done the nearly 30 times before.

If you were on a mountain road with a tire losing air and it kept tugging the steering towards the cliff, but you had an inflation button to push and knew from experience that low pressure is what the tugging was from, you'd have a similar experience. As long as you pushed the button the steering would not pull to the side. Let the tire go flat enough and off the cliff you go. It may be that a system is installed that automatically deflates the tires for better traction, but a sensor has failed, and that's what's happening, or the tire has a nail that sometimes hits just right to let air out - doesn't matter which, it deflates, tugs at the steering and the driver either pushes the button or muscles up and holds the car straight until they can't hold against the pull anymore - which is what the Ethiopians effectively did. In addition, the Ethiopians kept the throttle to the floor, making the pull worse.

And yes - a tire system on a car or MCAS on the airplane is not acting the way it should and should be changed, however in either of these cases it isn't catastrophic until human inaction lets it move from an annoyance to a disaster.

Sullenberger's problem is significantly different. The MCAS accident planes were fully functional. They had all surfaces working and thrust available, the two items required for powered flight. Sullenberger had half that completely gone and had only enough energy to make it back to an airport if there were no problems, such as a headwind. To do that calculation in a few seconds is much different than feeling the yoke tug away from where you want it. Setting trim is the primary control on a plane and should be as second nature as breathing. Just like the car tugging, there's no decision to make. Either muscle it or push a button that is just under the left thumb.

That's what is so vexing about both the crashes. Even if they just kept up what should have been a petty slap-fight between MCAS starting trim down** and the pilot immediately stopping it with a bump of trim up, they should both have had hours to call in to their chief pilot for suggestions. Instead the pilots acted as if this was their first day handling trim on their own. It's very possible it was.

**MCAS takes almost 10 seconds for a full increment; at any time the pilot can push a trim button which instantly stops the trim increment; holding the trim button allows the pilot to set the stab trim anywhere he likes. He can exactly counter the fraction of increment, exceed (move it so it requires a yoke push to hold the pitch), or use less (so it requires a pull to hold the nose pitch). As long as the pilot continues to adjust pitch and for 5 seconds after any trim change, MCAS does nothing. The amount of time to disaster is, I expect, the amount of time MCAS takes if completely unchallenged at the speed the plane will reach at near 100% throttle to either tear off it's own control surface or for the pilots to run out of elevator authority with full aft yoke.

You do know that Captain Sullenberger made the best decisions he could and successfully put the plane down in a manner that saved all on board. It certainly seemed that his main focus was figuring out how to get the plane down in 1 piece right from the start and he didn't feel he could get back to a runway so he took the only other path available. Sure, simulations showed the plane should have made it back, but would anyone making that claim want to try it in real life when knowing that coming up short puts you down into buildings in a fiery crash? Overall, it was a hell of a flying job.

Not holding the trim up button long enough to counter the stick forces - not so much.
Not reducing power so the plane doesn't exceed Vmo - not so much.

If you want to keep making such comparisons, then a simulation should be setup not to duplicate what happened but rather show a successful recovery simply by putting the spoiler back to a trimmed position before using the cutout switches. Then, it could be easily proven that the plane could have been landed just like they "proved" that Sullenberger could have got his plane back to a runway.

You do realize that while the Ethiopian plane was flying at a reasonable speed that MCAS moved the stabilizer to within a few tenths of a percent to full down (over 1/2 a degree further than the movement that caused the crash) and yet the pilots had little difficulty recovering from that? You also realize it was more than 40 seconds after they shut off the electric stabilizer control before they got further into trouble by allowing the plane speed to get above Vmo?

I agree with the above that trimming a plane should be second nature to a pilot.

I always question how much of a decision it was. You have three possible outcomes: making it to an airport, crashing it in the middle of a the city, or putting it into the river which likely will mean everyone on the plane gets killed but no one additionally on the ground. As soon as it became a question if the plane could even making it to an airport, landing or crashing it into the river becomes the moral choice.

------------------------------------------------------------------------------------------
If you can't explain it to a six year old, you don't understand it yourself.

Very good summary.

Vestigial design issue clouds 737 Max crash investigations - The Air Current (2019-Apr-04)

Right off the bat the article misstates what the pilots were supposed to do, critically leaving out step 1: Trim the aircraft with the trim switches. Then shut off the motors. Then use manual trim.

"the crew's initial by-the-book efforts" is a lie, as the article is in response to the released preliminary report that clearly shows the crew didn't follow anything in the FOM or the AD.

3D dave - I disagree. The pilots did follow the AD, but crucially both the AD and their action didn't specifically state that they should initially trim the plane back to the same angle it was before the MCAS. From the report IIRC, they only trimmed it back to about half of what it was before MCAS intervened, before they flipped the cut outs. This left them with an increasing load on the stick as the plane increased in speed.

They then appear to have tried to trim it manually and failed due to the load on the jackscrew so turned on the electric trim again but got a severe jolt when they tried to trim the aircraft as it was going rather fast at that point. When MCAS deployed again they were apparently into negative G and were probably off the seat for a few seconds. Then it was too late to do anything.

Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

Quote (FAA 2018-23-51)

Required by AD 2018-23-51
Runaway Stabilizer
Disengage autopilot and control airplane pitch attitude with control column
and main electric trim as required. If relaxing the column causes the trim to
move, set stabilizer trim switches to CUTOUT. If runaway continues, hold
the stabilizer trim wheel against rotation and trim the airplane manually.
Note: The 737-8/-9 uses a Flight Control Computer command of pitch
trim to improve longitudinal handling characteristics. In the event of
erroneous Angle of Attack (AOA) input, the pitch trim system can trim
the stabilizer nose down in increments lasting up to 10 seconds.
In the event an uncommanded nose down stabilizer trim is experienced
on the 737-8/-9, in conjunction with one or more of the indications or
effects listed below, do the existing AFM Runaway Stabilizer
procedure above, ensuring that the STAB TRIM CUTOUT switches
are set to CUTOUT and stay in the CUTOUT position for the
remainder of the flight.
An erroneous AOA input can cause some or all of the following
indications and effects:
• Continuous or intermittent stick shaker on the affected side only.
• Minimum speed bar (red and black) on the affected side only.
• Increasing nose down control forces.
• IAS DISAGREE alert.
• ALT DISAGREE alert.
• AOA DISAGREE alert (if the option is installed).
• FEEL DIFF PRESS light.
• Autopilot may disengage.
• Inability to engage autopilot.
Initially, higher control forces may be needed to overcome any
stabilizer nose down trim already applied. Electric stabilizer trim can be
used to neutralize control column pitch forces before moving the STAB
TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be
used before and after the STAB TRIM CUTOUT switches are moved
to CUTOUT.

Really emphasizes turning off the Electric Trim, which I understand includes both MCAS and trim switches.

It does offer "can be used", which is not really aligned with some opinions.

3DDave, LionelHutz;
Thank you for taking the time to compose your courteous responses.
Thank you for allowing me to play devils advocate.
I am sure that there are a few people who are silently sharing my bias and attitude.

You will be happy to know that I have just deleted a lengthy post.

As far as we Know, 7 pilots have been involved in a MCAS runaway trim.
Of the 7 pilots, only one, the pilot deadheading on the flight that survived, could handle the emergency.
The score:
Pilots 1, MCAS 6.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I have a few questions for the those familiar with the 737.

Electric trim versus manual trim with the trim wheels:
Apparently electric trim may be over-ridden by holding the trim wheel.
Does this imply that the manual trim wheels are more powerful than the electric trim?

This leads to another question.
When the forces on the stabilizer are too great to allow trimming with the hand wheels, are the forces also too great for electric trim to overcome?

And this leads to another question.
As I understand it, in the later stages of the event the electric trim was turned back on but that the switch was not held long enough to correct the trim. As I understand, the switch was activated for several short times.
Does the flight log record commands to the jack screw or actual jack screw movement?
I can visualize the co-pilot attempting to use electric trim when manual trims was not possible.
When using manual electric trim the hand-wheels spin.
If the hand-wheels did not move when electric trim was tried, it may be reasonable to use several short applications in an attempt to jar the electric trim loose.
Comments?

More a comment than a question;
I have trouble understanding the instructions. Manual operation? Is this manual with the thumb switches or manual with the hand-wheels or both? Is anyone else confused by this or is it just me?

Recovery from a stabilizer runaway. Given enough altitude, is a runaway trim always recoverable, or is there a combination of speed and dive angle from which it is not possible to recover?



Bill
--------------------
"Why not the best?"
Jimmy Carter

FAA AD states, "If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually."

The above extract implies that the human can overpower the electric motor.

Quote (waross)

This leads to another question. When the forces on the stabilizer are too great to allow trimming with the hand wheels, are the forces also too great for electric trim to overcome?

Bill, that's a very intriguing question.

I wonder if there's a simple explanation?

A comment on design;
Now it seems as if the Max 8 simulator has been improperly programmed.
The 737 NG simulator may be programmed to replicate the control forces resulting from a runaway trim down condition but apparently the Max simulator does not replicate the extreme control forces experienced with a runaway trim.

Apparently the wings of the Max series have been strengthened to withstand the greater torque exerted on the wings by the uplift of the engines and the greater MA of the longer engine mounting pylons.
Apparently the tail has also been strengthened.

This may have serious implications related to the flawed simulator.
Simulators are programmed with flight data supplied by the manufacturer.
Was faulty data supplied to the simulator manufacturer?
This may call into question the forces calculated during the re-design of the wings and tail.
Are there any reports on the source of the flaw in the simulator?

Bill
--------------------
"Why not the best?"
Jimmy Carter

The assumption that the simulator can accurately simulate every possible flight state, including every possible control force state, etc is a false premise. That's not a goal of flight simulation.

"...false premise..."

But in this case:

Quote (Boeing statement)

"Boeing has made corrections to the 737 MAX simulator software and has provided additional information to device operators to ensure that the simulator experience is representative across different flight conditions."

Straight from Boeing (reportedly this is an exact quote).

'representative' does not mean 'an exact, perfect replication'.

So we're clear, the point I'm making here is that an inability to perfectly replicate extremely high control forces during certain coffin-corner areas of the flight envelope, especially those which the designers of the airframe would not anticipate end users encountering possibly ever, does not indicate that the simulator is 'flawed' as others have stated.

I'm not saying that the simulator is perfect- I'm just saying that the simulator, is a simulator.

The other questions raised in the last few posts (trim actuator authority at extreme AoA, flight performance data potentially used to build software models, etc) are valid/interesting/worth thinking about and discussing. This bit about control forces in the simulator is jumping at shadows.

Quote (Waross)

This leads to another question. When the forces on the stabilizer are too great to allow trimming with the hand wheels, are the forces also too great for electric trim to overcome?

I believe (but do not know with certainty) that the answer to this question is 'no'.

I found a drawing at one point in this discussion that showed a detail of the trim jack screw and trim wheel mechanical layout. I'm attempting to re-find it and if I do I'll certainly post it here.

I'm pretty sure that turning the trim wheel manually in either direction, or holding it against torque supplied by the drive motor, causes the drive motor and jack screw to decouple.

If anyone else knows better please correct this or link to the drawing I'm talking about.

If I'm remembering incorrectly and the actuator doens't have enough authority to overcome the forces generated in these situations, that's obviously REALLY bad for Boeing.

Satcom Guru has some info.

It's worth noting that Flight Simulators are apparently used as evidence in inquiries, so one would hope that they are representative and accurate in the corners of the flight envelope where incidents occur. If not, hopefully the limitations are explicitly documented.

Perhaps we can agree that the simulator was not "flawed", but they certainly are making "corrections " (<- their own exact word choice).

I'm not sure how one could describe what sort of thing it is that is being 'corrected'...

(This is so far down into the semantic weeds that it's not very interesting from a technical point of view.)

As for the simulator.
We have seen video's of older simulators set up to demonstrate the extreme forces caused by trim runaway.
We have seen a report from I think the New York Times that Boeing test pilots reported that their Max 8 simulator was developing forces far below what it should have produced.
Putting together the published reports it seems as if only the Max 8 simulator does not reasonable reproduce the forces produced by runaway trim.
I understand that Boeing has recognized this.
So why is it only the Max 8 simulator that has a problem?
Back to the question; What is the source of the problem. Did the simulator make a mistake or did Boeing supply the wrong data?
I don't expect the simulator to be perfect but I do expect it to be pretty good within the flight envelope.
I see the flight envelope as between stalling and crashing.
Once an aircraft is in a non recoverable situation, there is no need for the simulator to simulate. It's too late.
How can pilots be trained to recover from a trim runaway in a simulator that does not reasonably reproduce the extreme control forces?
Apparently they can be trained on a 737 NG simulator, just not on a 737 Max simulator.
It can be done, it has been done. Why wasn't it done this time.
This is not Boeing bashing, this is a serious question. The answer may uncover yet another problem that should be rectified or at least checked.

Bill
--------------------
"Why not the best?"
Jimmy Carter

About the checklist, I'm wondering why it isn't something like the following (change in italics):

Quote:

Required by AD 2018-23-51
Runaway Stabilizer
Disengage autopilot and control airplane pitch attitude with control column and main electric trim as required.
Check for erroneous AOA input.
If erroneous AOA input is indicated, ensure that control column pitch forces are neutralized using main electric trim.
If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT.
If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.

Note: The 737-8/-9 uses a Flight Control Computer command of pitch trim to improve longitudinal handling characteristics. In the event of erroneous Angle of Attack (AOA) input, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds.
In the event an uncommanded nose down stabilizer trim is experienced on the 737-8/-9, in conjunction with one or more of the indications or effects listed below, do the existing AFM Runaway Stabilizer procedure above, ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.

An erroneous AOA input can cause some or all of the following indications and effects:
• Continuous or intermittent stick shaker on the affected side only.
• Minimum speed bar (red and black) on the affected side only.
• Increasing nose down control forces.
• IAS DISAGREE alert.
• ALT DISAGREE alert.
• AOA DISAGREE alert (if the option is installed).
• FEEL DIFF PRESS light.
• Autopilot may disengage.
• Inability to engage autopilot.
Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.

The existing AD indicates to do one procedure (the existing AFM Runaway Stabilizer procedure) and only mentions the higher control forces and the need to mitigate them at the end (IE, not part of the procedure). Why wasn't the procedure section modified if the procedure could change? If the pilots are trained to follow checklists to resolve problems then the resolutions to known problems should be in the checklists!

Quote (Waross)

How can pilots be trained to recover from a trim runaway in a simulator that does not reasonably reproduce the extreme control forces?

There's a very important distinction to be made here- trim runaway produces extremely high control forces when allowed to proceed uninhibited for a long time.

The trim system acting strangely does not in and of itself produce high forces- the high forces are the result of the aerodynamic forces generated by the control surfaces being moved into certain positions, and those movements take time. There are also other factors at play that have an effect on the control forces, such as the current pitch attitude and its rate of change, as well as vehicle speed etc.

The Ethiopia flight in particular is a case where the pilots experienced extremely high control forces, because they (for whatever reason) seem to have lost track of airspeed, AND failed to identify the runaway trim condition until it was well developed. If they identified the runaway trim condition earlier, managed airspeed earlier, or both, they very possibly would not have crashed.

Point is, they were operating in a part of the flight envelope where:

1) Had they correctly followed all their procedures, they would not be

2) Had they made other mistakes but had identified trim runaway more quickly they would not be

In either case, they were operating in an area of the flight envelope that those developing simulators and curriculum for said simulators could reasonably have not anticipated the need to simulate.

People developing simulators don't (can't!) assume that in every possible scenario, the pilot in control of the aircraft will disregard every safety or operating procedure in order to reach dangerous areas of the flight envelope and then use those resultant limits to define the envelope for the simulator to operate in.

Remember that a flight simulator is used to train commercial pilots. The goal of a simulator is to provide a way to train people to fly planes in a way that is more cost-effective than actually flying the real planes. Yes there are other uses, but ultimately a flight simulator is not used to exactly replicate every possible operating state of an aircraft- because it's not only not the primary goal of their development, it just isn't possible.

And yet, the flight simulators in this case are being "corrected"; as per Boeing statement.

--

"...exactly replicate every possible operating state..."

Did anyone claim that except you? Usually one doesn't provide one's own strawman arguments. That's something others do, and then you call them out on it.

--

"...failed to identify the runaway trim condition until it was well developed. If they identified the runaway trim condition earlier..."

I understood that the Trim Wheels on each side of the center pedestal plainly rotate when the trim is in movement, from any cause. If there was anything wrong with the crew reaction, then it's probably not from missing the two spinning trim wheels.

So this theory would need further work.

Quote (VE1BLL)

Did anyone claim that except you? Usually one doesn't provide one's own strawman arguments. That's something others do, and then you call them out on it.

Well..

Quote (waross)

I see the flight envelope as between stalling and crashing.

In any event- the point is that it is not a surprise that there are areas of the flight envelope which the simulators are not designed to simulate, or are not capable of simulating at all.

That an area of the flight envelope which requires several successive violations of procedure as well as airframe performance limits to reach would be one of those not within the realm of normal simulation should not be a surprise to any of us.

Quote (VE1BLL)

I understood that the Trim Wheels on each side of the center pedestal plainly rotate when the trim is in movement, from any cause. If there was anything wrong with the crew reaction, then it's probably not from missing the two spinning trim wheels.

So this theory would need further work.

The trim wheels do turn when the automatic or electric trim adjustments are happening. They spin rather slowly but are marked with a white stripe to make the movement easier to see. Their location, however, isn't really in the direct line of sight all the time.



With a big 'ol adrenaline hit, confusion in the cockpit, stick shaker whacking away, cautions/alarms/vocalizations sounding, and the rapidly approaching ground quickly filling the view out of the windows, yeah I think it's feasible that movement of the trim wheels would be easy to miss.

All this back and forth about the simulator is a rather moot point unless the pilots actually train on runaway stabilizer and using the manual wheel. In other words, training that includes the roller-coaster maneuvers to get the trim back to where it needs to be. From every source I have read, this training was dropped many years ago (by the 80's).

The timeline in the Ethiopian crash report says that the pilots couldn't move the manual trim wheel yet the electric trim motors moved the stabilizer just fine in the trim up direction right before MCAS moved it down again. So, that pretty much kills off any conjecturing about the trim motor not being able to put as much force into the jackscrew as the manual wheel.

The Ethiopian plane had the first MCAS misapplication at 5:40:00. The cutout switches were thrown right around 5:40:40. The overspeed indicator first started at 5:41:21. The stabilizer started working again right around 5:43:10. This adds up to about 40 seconds from first runaway until cutout thrown. Then, there was 40 seconds from cutout thrown until overspeed warning and 2.5 minutes from cutout thrown until they turned the cutout switches back on dooming everyone on board.

From the above, the following can be determined,

The pilots only had 40 seconds to react claim in the Times article seems like nothing more than sensational BS reporting.

The pilots did successfully identify the runaway trim rather quickly.

The pilots didn't successfully identify that they could and should have re-trimmed the plane before using the cutout switches, even though the electric trim switch was working just fine.

The pilots had about 2.5 minutes after throwing the cutout switches to try and figure out what the plane was really doing. 2.5 minutes to do the roller-coaster. 2.5 minutes to realize the plane was climbing and accelerating which meant the stall warnings were in error. 2.5 minutes to realize they needed to get the plane speed back under control so the control forces would be controllable.

All the above would indicate the pilots didn't do any difficult runaway trim training. If Bill's claims are correct and the NG simulator does properly simulate the forces, then NG simulator training for runaway trim would have transitioned just fine to the MAX. Remember, there was no simulator training for the MAX, it relied on the previous NG training.

That's a great link, VE1BLL.
If you follow down to the section ELEVATOR FEEL CONTROL it gives some answers.
Not WAG speculation.
The elevator is no longer directly connected to the controls.

Quote (Satcom Guru)

The elevator feel computer changes the control column forces as the airspeed changes and the horizontal stabilizer moves.

All the statements about a simulator not replicating the forces exactly also apply to the actual plane in flight.
The elevator forces on the control column are not the real feel. The elevator control column forces are generated with hydraulic pressure controlled by the elevator feel computer.
When the elevator feel computer in a simulator is fed the same airspeed information, the same elevator position information and the same stabilizer position information as the elevator feel computer in a plane in flight the control column forces should be exactly identical to the aircraft in flight under the same conditions.


Bill
--------------------
"Why not the best?"
Jimmy Carter

Lionel,in regards to your statement:

Quote (Lionel)

The timeline in the Ethiopian crash report says that the pilots couldn't move the manual trim wheel yet the electric trim motors moved the stabilizer just fine in the trim up direction right before MCAS moved it down again. So, that pretty much kills off any conjecturing about the trim motor not being able to put as much force into the jackscrew as the manual wheel.

I'm not arguing, rather asking for clarification.
Did the flight recorder actually record stabilizer movement or did it record a command for movement?
Thank you in advance.

Bill
--------------------
"Why not the best?"
Jimmy Carter

_{Edit to add: This is in response to jgKRI (Mechanical) 22 May 19 03:25. Since the thread got busy while composing reply.}

----

And yet, Boeing *is* correcting the simulators.

(Because they need to be.)

QED.

--

"...movement of the trim wheels would be easy to miss."

You might wish to review the Aircraft Accident Investigation Preliminary Report (PDF) No. AI-01/19, dated March 10, 2019.

The sequence of events on pages 10 to 11 clearly indicate your speculation is not what happened. The crew were working the trim issue from the outset.

--

On some of these points, we're now looping without making progress. So I may abandon further discussion on those points.

Quote (waross)

The elevator is no longer directly connected to the controls.

That's not correct. The feel computer is a filter for the forces transmitted from the hydraulic circuit that drives the elevators back to the control columns- but the control columns are still connected to the elevators directly with cables.

If they weren't, a failure of A and B hydraulics would mean complete loss of elevator control.

Quote (VE1BLL)

The crew were working the trim issue from the outset.

I've read the report... did you actually read to the end? One of the last actions the pilots took was to reset the trim cutout switches. After their last manual electric ANU trim input, the automatic system applied the final, fatal AND input over a period of, per the report, 5 seconds. This was discussed days/weeks/pages ago in this thread, and it's not conjecture. It's very clear.

They didn't recognize they were in a trim runaway situation, and either missed the manual trim wheels moving during the last automatic AND trim movement, or did not understand the implications thereof... Had they known what we know, and turned the system off using the cutout switches after their last manual electric trim command, it's possible this story ends with a not-so-fun emergency landing as opposed to hitting the ground at 40 degrees nose down and 450+ kts.

Quote (LH)

The timeline in the Ethiopian crash report says that the pilots couldn't move the manual trim wheel yet the electric trim motors moved the stabilizer just fine in the trim up direction right before MCAS moved it down again. So, that pretty much kills off any conjecturing about the trim motor not being able to put as much force into the jackscrew as the manual wheel.

Agreed.

But then it leaves the other question. How do the pilots stop the powerful trim motor with their hand on the trim wheels?

Ref. As mentioned in procedures.

It has the appearance of nontransitive strength, like Rock > Scissors > Paper > Rock > etc.

Quote (VE1BLL)

How do the pilots stop the powerful trim motor with their hand on the trim wheels?

There's a gearbox which mixes inputs from the hand wheels and motor, and outputs to the jack screw. The torsion coupling inside decouples the drive motor from the jack screw if a certain torque input is applied by the manual trim wheel. It's like a mechanical relay.

by all accounts using your foot is quite successful for stopping the trim wheel on the 737. If you use your hand your going to loose bio mass and add blood into the equation.

When the trim wheel goes its very noisy and gives huge vibration right next to your knee. And if your knee is against it when it goes you will be limping for a few days afterwards.

"...torsion coupling inside decouples the drive motor..."

Thank you for the explanation on that point.

According to SatCom Guru:

Quote (SatCom Guru)

The Boeing 737 uses Power Control Units (PCU), a hydraulic actuator, to drive the elevator. The indirect control introduces the need for an elevator feel computer, to artificially provide "representative aero loads" onto the pitch control yoke with a variable "neutral shift".

The elevator control cables move the ELEVATOR PCU INPUT POGO.
The PCU input POGO moves a control valve on the PCU. The only feel on the cables is the small constant pressure needed to operate the valve.
Please read the links before commenting on the information from them.

Bill
--------------------
"Why not the best?"
Jimmy Carter

_{edit to add: this is in reference to Bill's discussion of the Elevator.}

But the Trim operates on the Horizontal Stabilizer via the Jack Screw (in the middle of the diagram posted above).

The Elevator is kinda/sort-of separate (emphasis on kinda/sort-of).

Am I confused?

No the elevator is only the rear portion of the tail plane some 25% of the area.

The trim effects the whole angle of attack of the tail plane.

There is also a balance tab on one side.

It's easier to see if you look at a picture of it.

Quote (waross)

The PCU input POGO moves a control valve on the PCU. The only feel on the cables is the small constant pressure needed to operate the valve.

The elevator PCU acts as a booster to forces on the cables- it does not terminate them. It's exactly like power steering in your car. You can't draw conclusions from the simplified schematic.

Think about it- if the elevator activation was purely hydraulic and the ONLY control column cable forces (and thus the only forces in the control column) were the pressure required to move the valve, there would be no huge control force increases due to aerodynamic loads, which there are.

Hi VE1BLL;
This post is part of the discussion on simulators versus real world control forces and the generation of the feed back forces related to elevator action.

As I understand the drawing and the related information in the link that you posted, without compensation of some sort, when the stabilizer is moved the elevator would stay at the same angle to the fuselage. The connections between the stabilizer and the elevator linkage called the "ELEVATOR NEUTRAL SHIFT RODS" has the effect of keeping the elevator at the same angle to the stabilizer.
If the elevator PCU were anchored inside the rear of the stabilizer this compensation would probably not be needed.
Boeing chose to anchor the elevator PCU inside the fuselage and compensate for stabilizer movement.

Bill
--------------------
"Why not the best?"
Jimmy Carter

It was almost 50 years ago when I had a ride in the cockpit of a 737.
The first officer grew up next door to me and we went to school together. I rode in the navigators fold down jump seat.

The part of the trip that still stands out in my mind is the spinning trim wheels.
They spun quite fast, faster than they could be turned by hand.
The white stripes created a strobe effect that drew my attention no matter what I was looking at before the wheels started spinning.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bill, do you really think you'r the right person to be posting comments about reading links before posting? You continue to refuse to read the Ethiopian initial accident report but rather chose to post conjecture which is starting to give off a rotten stink.

"At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two
momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in
the ANU direction from 2.1 units to 2.3 units."

The FDR recorded both the command and the resulting movement.

As for and elevator feel computer, does anyone actually think this would be a sophisticated electronic device on a plane that went into service in 1968? Feeling the force via a device that takes the mechanical and/or hydraulic pressure required to hold the elevator in position as feedback sounds about right considering the tech available at the time of the 737 development.

Quote (Lionel)

The FDR recorded both the command and the resulting movement.

Thank you for your information Lionel.
I was not trying to put you on the spot.
I was respecting your greater familiarity with the accident report, and rather than make a mistake, I asked you.

As far as reading links, I have read a lot in the link to SatCom Guru's site posted by VE1BLL.
He has a lot of information on the various systems on the 737.

Quote (Petter Lemme aka Satcom Guru)

Pioneering airplanes like the Boeing 707 used a mechanical control system to drive the elevator trim tabs.

The Boeing 737 uses Power Control Units (PCU), a hydraulic actuator, to drive the elevator. The indirect control introduces the need for an elevator feel computer, to artificially provide "representative aero loads" onto the pitch control yoke with a variable "neutral shift".

Like power steering but there are many types of power and hydraulic steering.
In an automobile the percentage of the steering force relayed to the steering wheel is a percentage of of the actual force on the steering mechanism, up to a limit.
The limit is often related to the strength of a small spring in the control valve.
In an automobile it is usually possible to steer with great effort in the event that the power steering system fails.
On agricultural and industrial equipment there are at least two other hydraulic systems in use.
In one system the steering wheel is mechanically linked to the steering system but the ratio of actual force to feedback force is so great that it is impossible to steer if the hydraulic system fails.
In another system there is no mechanical connection.
The steering wheel turns a rotary valve that commands steering action.
Feedback from the steering system rotates an internal part of the valve tending to stop the flow of hydraulic fluid.
Imagine a hydraulic cylinder with the control valve mounted on the ram. Pushing on the valve causes the ram to extend which moves the control valve further from your hand, tending to stop the movement of the ram.
This principle has been incorporated into a rotary valve which is used on some heavy equipment.
There is zero force feedback and it is impossible to steer without hydraulic pressure.
I have been reliably told that some new road graders no longer have a steering wheel. They are steered with a joy stick.
The grader operator who told me that missed his steering wheel.
I believe that industrial control computers were available and in use at the time that the 737 was being developed.
Electronic PID controllers were available and in use before the early 70s.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I noted in an earlier post a passage quoted from the Boeing team that the AOA information was never primary information but supplemental. I understand how supplemental information could be useful to establish a warning for the flight crew to look at something that could be a problem, even without redundancy.

And yet I would ask Boeing, why did they design to allow supplemental information to assume priority command of a critical flight control? Not only was there no redundancy of the sensor input, but there was obviously no "reasonableness check" of the incoming information! The AOA input value spiking back and forth to unreasonable values in an unreasonably short time should have triggered an internal filter to say, NO WAY AM I USING THIS DATA.

Note that my question is simply rhetorical and there is likely no one satisfactory answer. This forum has provided many potential answers such as profit motive, regulatory oversight failure, budget constraints, ego, hubris, etc. I recognize the true answer probably encompasses most or all of the potential answers presented on this forum.

Quote (waross)

Like power steering but there are many types of power and hydraulic steering.
[long paragraph about hydraulics]

I'm not trying to be rude here- but what you're saying just isn't correct.

All 737s have manual elevator control capability. It's in the manual. You can read all about it whenever you want.

If what you're saying was accurate, a failure of A and B hydraulics would result in zero capability to operate the elevator.

That is not what happens. During a complete failure of the hydraulics, elevator control is maintained (albeit with very high control forces) in a manual reversion mode. Period.

Bill - what does steering on a wheeled vehicle have to do with a plane? There's really no point to any of that.

Just to make my point about this "computer" clear - I would bet against it being electronic. Trying to say that it's an electronic system because you read the word "computer" and then further implying that Boeing stupidly screwed up the simulator because it should have been easy to transition an electronic algorithm to simulator land is silly conjecture when you have no clue how the whole elevator system actually works.

That's why I didn't comment on how it's possible that the trim wheel could over-ride the electric motor even though the electric motor can provide more turning force to the jack screw. I don't know why and it's pointless to post random conjecture to try and explain it.

Quote (jgKRI)

All 737s have manual elevator control capability. It's in the manual. You can read all about it whenever you want.

I'd like to. Can you post a link?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Lionel:

Quote (jgKRI)

The elevator PCU acts as a booster to forces on the cables- it does not terminate them. It's exactly like power steering in your car. You can't draw conclusions from the simplified schematic.

Responding to this comparison.

Bill
--------------------
"Why not the best?"
Jimmy Carter

See below.

Quote (Boeing Document Number FCT 737, Revision 8, October 31, 2008)

Manual Reversion

With both hydraulic systems A and B inoperative, the ailerons and elevator are controlled manually. A noticeable dead band will be observed in both of these controls. High control forces are required for turns and the control wheel must be forcibly returned to the aileron neutral position.Both electric and manual trim are still functional. Do not over trim. The airplane should be trimmed slightly nose up and a light forward pressure held on the control column to minimize the effects of the elevator dead band.The rudder is powered by the standby hydraulic system. Caution must be exercised to not over-control the rudder.

Bill - doesn't really matter, I still don't see the whole point of your blurb about power steering or the grader without a steering wheel since none of it has anything to do with how a 737 works. Besides, I think you're reading that statement way, way out of context.

The PCU is nothing special to be honest and does work on the same principles as power steering but has a couple of other inputs which are electronically calculated ie the yaw damper to stop dutch roll.

I can't find a diagram of the elevator system but here is the rudder PCU set up.




The elevator per say is not trimmed its the tail plane/horizontal stabiliser which is moved for trimming via the screw jack. This then sets the base point and the elevator allows input from there.

A common misconception is that trimming sets a control force for an attitude its actually trimming for a speed at which the control forces are zero at a given power setting. It doesn't set an attitude.

Because the PCU gives through direct control as well the amount of additional power it can give is linked to the piston size and hydraulic system pressure which is 205 bar.

The only additional inputs for the elevators is the mach trim and feel unit. The mach trim compensates for mach tuck and lifts the nose. At the levels that the incident occurred I wouldn't expect it to have got involved as they wouldn't have got over mach 0.6 even at 400knts. The feel unit is electronic controlled these days and it will increase the resistance to pilot input as the airspeed increases. This is the diagram for that system for the NG. Its also hydraulically powered. It would have got involved as the speed increased opposing the input of the pilots. But the base setting is the AoA of the tail plane/horizontal stab.


The area of the stab is 32.78 sq meters and the area of the elevators is 6.55 sqr meters. You can't really give the elevators more power or increase the size because the loads will go through the roof and there will be a huge weight penalty for beefing everything up to take the loads.




I can only comment on my own type which has a fixed stab but if the feel system goes off line the autopilot is then off line and your limited to 200 knts and you have to be extremely carefull you don't bend the tail. And it feels extremely wierd while your hand flying in fact its easier to fly it via the trim instead of direct control inputs which is usually extremly bad practise. Personally I use a thumb and index finger touch on the control and then adjust with trim. 12 mile finals and stabilised fully configured and trimmed by 2000ft. The last TRE that gave me that exercise said I know your flying by trim I can see it on the board but I can't argue with the results so we will leave that debrief point at that.

"FAA head says Boeing 737 MAX will return to flight, but timetable is uncertain
May 22, 2019 at 5:00 pm Updated May 22, 2019 at 8:09 pm
Dominic Gates By Dominic Gates
Seattle Times aerospace reporter


FORT WORTH, TEXAS — The head of the Federal Aviation Administration (FAA) on Wednesday insisted there’s no fixed schedule for lifting the order that has grounded Boeing’s 737 MAX since March 13.

“It takes as long as it takes,” said Acting FAA Administrator Dan Elwell. “The 737 MAX will fly again when we have gone through all of the necessary analysis to determine that it is safe to do so.

“If it takes a year to find everything we need to give us confidence to lift the order, then so be it,” he added. “I’m not tied to a timeline.”

Though the plane could still potentially return to service in the U.S. as early as August, that fast-track schedule privately suggested last month by both Boeing and the FAA may have been delayed by technical hitches and by public unease.

Ahead of Thursday’s meeting of top officials from civil aviation authorities around the globe to discuss what’s needed before the MAX can fly again, Elwell said Boeing has still not submitted its final proposed software fix for the flight-control system that erroneously activated on Lion Air and Ethiopian Airlines 737 MAXs and led to two deadly crashes — despite Boeing’s announcement last week that the software fix was “completed.”

An FAA spokesman on the sidelines of the meeting said the safety agency has a clear idea of the main elements of Boeing’s fix and knows the steps that need to be done to certify and validate Boeing’s work. How long those steps will take remains fuzzy.

Daniel Elwell, the acting administrator of the Federal Aviation Administration. Daniel Elwell, the acting administrator of the Federal Aviation Administration.

Elwell said Boeing had earlier committed to deliver its software fix on March 26, but at the last minute decided it needed to make adjustments after an independent internal Boeing review found problems that needed to be addressed.

Fifty-seven delegates representing civil aviation authorities in 33 countries have gathered for the meeting Thursday at the FAA’s southwest regional office in Fort Worth — including officials from Indonesia and Ethiopia, the two countries leading the investigations into the two fatal MAX accidents that killed 346 people.

“We will be sharing with them the safety analysis that will form the basis for our return-to-service decision,” Elwell said.

At his side during the press briefing was Ali Bahrami, the FAA’s head of aviation safety, who called this “a very extensive review” of Boeing’s software fix.

Elwell was asked how this safety analysis will be done differently than the FAA’s safety analysis of the original flight-control system, an analysis that, as the Seattle Times reported in March, was largely written by Boeing engineers and missed several crucial flaws that are now being fixed in the software update.

He responded only by saying that during the MAX’s initial certification the FAA followed the same proven procedures that have been used for 50 years.

The FAA has confirmed that among other issues, the original safety assessment, as detailed in the March Seattle Times story, did not take into account an increase in the authority of the problematic flight control system, called MCAS (Maneuvering Characteristics Augmentation System).

Boeing found during flight tests that for certain flight conditions, it needed to allow MCAS 2.5 units of movement instead of 0.6, quadrupling its power to move the jet’s tail and push the its nose down. Many FAA technical staff who worked on the MAX were never made aware of this change, and the system safety assessment done during original certification was never updated to include it.

An FAA spokesman said that the higher authority was designed only for “high angle of attack, low-speed turns,” and that “the change to MCAS didn’t trigger an additional safety assessment because it did not affect the most critical phase of flight, considered to be higher cruise speeds.”

However, at a crucial moment during the doomed Ethiopian flight, MCAS moved the tail 2.5 units and pushed the nose drastically down, even though the aircraft was moving at higher than normal speed.

The politics of getting international consensus as well as restoring the confidence of the traveling public may prove lengthy.

Elwell conceded that there may be a crisis of public confidence in Boeing’s jet “right now,” but said that the longstanding and proven processes of his agency that have produced the unrivaled U.S. aviation safety record over the past two decades will restore that lost confidence over time.

“I’m not worried about the future of public confidence, because I’m not worried about the future of aviation safety.” Elwell said.

He described the purpose of the international meeting as information sharing, so that a consensus may emerge.

“The idea is that we are working globally from the same sheet of music,” Elwell said. “So that when we are ready to lift the prohibition (on the MAX flying), there’s absolutely no question in any country’s mind why we are doing it and how we got there.”

He said the FAA will “explain our understanding of the risks that need addressed, the steps we propose to address those risks and how we’ll propose to bring the 737 MAX back into service.”

Though the U.S. safety agency typically takes the lead in the aviation world, consensus could be elusive after regulators in other countries decided to move first in grounding the plane and then learned of flaws in the FAA’s certification processes.

Countries such as China have indicated that they want to study the safety of the new system for a longer period and do their own assessment of it rather than just following the FAA.

It’s unclear if the FAA would move forward without key players on its side, including the European Union Aviation Safety Agency (EASA) and the Canadian civil aviation authority. But Elwell seemed to suggest that the US will take the lead and move first.

Because the U.S. is where the MAX was designed and issued its initial certification, which was then separately validated by regulators around the world, the ungrounding of the aircraft must follow a similar pattern, Elwell said. When its analysis is complete, the U.S. will certify the fix and lift the grounding, then other countries must validate the FAA’s work and make their own decisions, he said."

On a separate note this is what's going round in the pilot circles in Europe.

https://www.eurocockpit.be/news/boeings-max-return...

Ouch.

We could make a fortune on canvas plane covers...

Keith Cress
kcress - http://www.flaminsystems.com

Meanwhile, no airline has grounded all their pilots or all their mechanics until it's proved that they are all up to the task of operating with or diagnosing any other sensor problem. Those holes are going to remain lined up forever, even when exposed by a hole from the airplane maker.

The airline I work for has fired both pilots and mechanics for not making the grade in the last 6 months.

And 2 first officers have failed command upgrade. And it will be a year before they can start the process again which takes 18 months.

When I joined there was 4 of us doing the type rating with the airline and 3 of us passed the skills test. The guy that failed is still flying to my knowledge but not with us.

Sim checks in Europe are done with a three year cycle covering all the systems on a type in both winter and summer environments. Along with the mandatory single engine work and low viz requalification and the latest thing RNP approaches. These checks occur every 6 months so in the three years that's 48 hours I will have spent in the sim over 12 sessions and every session will include 1-2 known sensor issues, again over the three years all of them will be covered. At least once a year I will have to do a single approach, hand flown, raw data on emergency battery power which means 1 screen out of 5 working and standby artificial horizon, to go around and then landing with 200ft cloud base and 550meters vis. The first officers doesn't have to do that mainly because all there instrument screens are dead and anyway and they are usually too broken after pumping the gear down.

But I agree the holes will always be open. But the idea that airlines don't fire incompetent pilots or technicians is false. But most pax choose their airline by ticket price and trust the regulator to look after the safety. When the regulator doesn't do their job the whole system falls down and holes merge into one huge orifice complete with vortex.

To be honest most pilots would be more than happy to go and prove to who ever you like that they are competent to fly the MAX before strapping into one with paying pax down the back. Just the airline accountants don't want to pay for it. Boeing has fiddled things so they just have to do 45 mins on an Ipad and the FAA has certified that that's all required, and the rest of the aviation authorities have agreed and let them do it.

BTW the pilots in Europe are pushing that until the manual trim can overcome the aerodynamic loads to be able to retrim from full aft or forward limits via the manual trim wheel without having to do the roller coaster yo-yo procedure which needs 8000ft to pull off. Then the plane will remain uncertified and banned from EU airspace.

Alistair,

"BTW the pilots in Europe are pushing that until the manual trim can overcome the aerodynamic loads to be able to retrim from full aft or forward limits via the manual trim wheel without having to do the roller coaster yo-yo procedure which needs 8000ft to pull off. Then the plane will remain uncertified and banned from EU airspace."

But wasn't that procedure also called for under circumstances with the original through NX types of 737? Are they advocating banning all 737s? Is this really just Airbus pushing for banning their competitors product?

Too bad these pilots weren't fired before it became obvious they didn't know how to manage an intermittent trim failure based on the yoke-force alone.

Too bad the Ethiopian pilots failed to prove it. Even the one who had just finished training. Would have taken, what, 3 minutes? I'd say that's ample evidence.

I don't have a clue to be honest.

As none A or B pilot I tend to stay away from the pair of them and the willy waving.

Airbus isn't involved and to be honest have been saying absolutely nothing on the subject that I have seen. They have 7000 orders for the neo and are targeting 63 airframes a month which is the next 9-10 years production taken care of, so what happens to the 737 really doesn't make the slightest bit of difference to them apart from any fall out from regulation changes. I suppose you could argue that the cut in 737 production has allowed them a more constant engine supply which has been an issue with the leap for a while. 10 years is enough to do a clean sheet next type.


What I am presuming the pilot group means is that if there is a system fitted that has the ability and capability of driving the trim to either limit then the pilot should be able to recover from it without performing aerobatics. . As the other variants don't have anything that will have this effect then they are ok. If you look at the MOR's on issues, trim runaway is single digit occurrences every year across all types flown in europe. Bird strikes on the other hand we are murdering thousands of them a month. Engine shut downs are in the 10-20 a month figure. trim runaway is way way outside the 1 in million event status.

Its coming from the scandi pilots, not the central europe ones. Which isn't surprising as you taxi past 3 max's every time you land on 04l at Helsinki and 8 of them every time you go past the 747 hotel in Arlanda I don't know where they are parking them in Oslo. And you don't mess with the scandi unions they took SAS down for 10 days on strike recently and basically wiped out all profits for over a year by doing so.


The only other major single Isle Boeing user in Europe is Ryanair who had their last NG delivered last month. And have delayed their max's until next summer. Between them and norwiegen they have under 250 on order. Its flydubai, lion air, Vietjet and spice jet you really need to worry about. Between those four you have 16% of the orders (800ish). I have heard nothing from the Ryanair pilots on the subject. They are more worried about Brexit than what aircraft they are going to fly next year and if the tax man is going to come knocking at thier door. And to be honest they are that disorganised as a group they would never get a united face for making a statement, they will get a choice of fly it or get another job.

To be honest anything that screws Ryanair up will gather more support across europe from pilots than anything to do with the country of origin of the aircraft type or the OEM. It might be seen as an anti boeing and anti US stance by the european pilots but its really not. There would be parties all over europe if they announced that they were going weld a couple of leaps onto a 757 airframe. There would be zero ground clearance issues if they did that!!!

You do know that Ethiopian pilots are trained and signed off in the US by FAA Boeing examiners for their type ratings?

Its also US check pilots that do the testing after that.

Its one of the few African counties that have stuck with the FAA.

There is nothing in the full 737 NG type rating syllabus issued by Boeing that covers the subject.

And to be honest if you did fire all the pilots in the world that would have crashed in similar circumstances.... aviation would over night become extremely safe basically because the sky would be virtually empty.

If you want to sell product to these countries your going to have to design it so that the locals can fly it and won't kill everyone if a system fails.

All 737's have an electric motor on the stabilizer so all of them could potentially suffer from a runaway trim event that drives the stabilizer to one extreme. It's silly of anyone to claim the manual trim system on the MAX must be built differently because it's the only variant that could suffer such a fate.

It's just a knee jerk reaction since the plane has suffered from trim runaway when that's something that almost never happens and something they generally aren't concerned about or do much training on. I'm doubting very many simulator sessions include trim runaway when there are so many other more likely to occur scenarios to use.

I think it's more because there is a system which generates input to the trim system which you have no indication when itsactive or not.

So before you had an extremely rare trim runaway event which you are correct is very rarely visited in the SIM. And now you have none pilot input to the system which if you don't spot something is wrong inside 5 seconds you have no chance of manually trimming it without doing some pretty hairy control inputs.

So either you give a method of killing the mcas without disabling the electric trim and give it enough power to do the job. Or you enable the ability with the manual trim. Or you get rid of the mcas.

The FAA cleared a commercial pilot with 300 hours? That's where collusion investigations need to be focused.

Also, you have 9-10 seconds. At which time the yoke is pulling hard. And the PIC/PF pushes the trim switch button** until the trim is back to neutral before cutting out the trim motors. And the other pilot is pulling back the power and calling out both the trim and the pitch so the PIC/PF can deal with the controls. Isn't CRM taught anymore?

**Trim switch has higher priority and the main time problem is because of letting the speed get away from the pilots.

I simply don't buy the claim that it must require a minimum of 8000 ft available to be able and manually trim a 737.

Of course, it could require dropping 8000 ft in altitude to manually trim a 737 depending on the flight conditions when you're attempting it. But, it likely shouldn't be attempted during those conditions.

Quote (LionelHutz)

I simply don't buy the claim that it must require a minimum of 8000 ft available to be able and manually trim a 737

That 8000 ft. number is based on a situation where the trim runaway has advanced unadressed for such a long time that:

1) control forces are too high for the pilots to manually trim using the wheels without maneuvering to reduce control forces

2) The elevator is so far out of trim that this procedure must be repeated many times to get the aircraft back into trim

The 8000 ft. scenario is the case where trim runaway starts, the pilots don't notice for many minutes, and finally realize they need to 'yo-yo' to re-trim.

In other words, 'it takes 8000 vertical feet to manually re-trim a 737' is not a wholly accurate statement. 'It may take 8000 vertical feet to re-trim a 737 under very specific conditions when a trim runaway or failure has gone unadressed for a long time' is more accurate.

"...trim runaway....something that almost never happens..."

Unfortunately, it's happened several times in recent months.

I fly with pilots with 195 hours total. I presume under Ethiopian rules 300 is enough for a First officer cpl. Internationally you need 1500 hours and 500 hours multi crew to be an ATPL holder to be a Captain.

The test is not for a FAA license so the FAA will do the test.I believe the 1500 hour restriction in the us is only for commercial transport there is nothing stopping you getting the type rating on a ppl with less hours.

And you forget the stick shaker has gone off and triggered the stall recovery procedure which involves pitching the nose down which is going with the mcas trim change.

So give it 30 seconds Sully delay to figure out what the problem is and your dead. Have a separate warning that mcas is active and AoA mismatch and you might have a reasonable chance that your average crew will pick it up after undergoing SIM training. 45 mins on an iPad no chance.

Stick shaker is something that they are trained to act instantly for and it takes priority over egpws warnings. To get them to first check the trim system before recovery would be fighting against basic training.

As I said if you don't want the locals crashing the machines your going to have to design the machines to the local minimum standard of pilot. If you don't people die and your reputation gets trashed. If you don't want your reputation trashed don't sell them the machines.

Moaning the pilots didn't do the right thing you can get away with once. Two down in 6 months your stuffed.

https://youtu.be/rxPa9A-k2xY

Here is the screw Jack in action full range in 90 seconds.

I'd think it trashes the airline's rep more.

In the case of ET302, the stall warning was with flaps extended and autopilot on, so no MCAS.

That was 90 seconds before they retracted the flaps, so triple Sully's time.

Soon after, the autopilot disengaged and 5 seconds later the first trim-down happened.

It moved down 2.4 units and they trimmed up .3 units. When it later trimmed down another 2 units, they interrupted it when they trimmed up 1.9 units, leaving them 2.2 units nose down from trim.

Which part of that is covered in training? That's when they decided to cut the power to the trim motors.

In roughly 3 minutes they never seem to have monitored airspeed which ran through Vmo.

I'm missing the quality that a commercial airline crew should have before an airline lets them in the front row seats.

Ethiopian Air has greatly expanded recently; I suspect the way they did that was to jettison the former standard of quality that they had.

Quote:

That 8000 ft. number is based on a situation where

It was based on a simulation of the Ethiopian flight where the plane speed exceeding Vmo and the throttles were left at 95% or whatever it was.

Quote:

And you forget the stick shaker has gone off and triggered the stall recovery procedure which involves pitching the nose down which is going with the mcas trim change.

So give it 30 seconds Sully delay to figure out what the problem is and your dead. Have a separate warning that mcas is active and AoA mismatch and you might have a reasonable chance that your average crew will pick it up after undergoing SIM training. 45 mins on an iPad no chance.

Stick shaker is something that they are trained to act instantly for and it takes priority over egpws warnings. To get them to first check the trim system before recovery would be fighting against basic training.

There was minutes, something like 3 or 4, with the stick shaker going off. How long do the pilots need before determining that it's wrong and should be ignored?

Ask your 737 flying buddies how much runaway stabilizer training, which includes having to manually trim the plane, they have taken. Ask them if they sim train for it. I'm betting there is not much if any training since other failure scenarios are much more likely making them the ones that would get training priority.

Lack of trim runaway training, indicator or not, would be my guess as the root cause behind why the pilots couldn't recover from it.

You can't really get more trashed than Lion Air anyway.

The quality is hugely variable around the world.

You just have to look at the Colgan Air Flight 3407 which was a 1st world nation home grown crew. Didn't respond correctly to a stall warning which is definately is trained for.

You can't generate that number of pilots locally especially Captians. They have done it with expats mostly western with a few Saffas and some Kiwis and Auzzies. Two mates have just gone there to fly the Q400.

The strange thing for me is the AP stayed in when the stall warning triggered. It normally disconnects as soon as the stick shaker goes off.

We shall see, Boeings image is getting trashed by more than just the two crashes, that documentary is pretty good at rubing the salt into the raw wound. The FAA isn't looking good either. To behonest most of us in Europe think EASA is a bunch of lawyers and paper pushers without a clue and looked at the FAA as something we could only dream of. Now it seems they are as useless as our own regulators.


The stuff I have seen says it was likely a bird strike just after the gear came up. ASI mismatches, stick shakers and then the third issue with the MCAS. All crew will be able to deal with 1 issue most can deal with two if both are experenced on type and there is no rush to deal with them. Three issues will over load the majority of crews and become fatal.

We can all sit back and in hind sight say why didn't they do xyz.

I still think that the max will be flying in US airspace by about September/oct. Rest of the world earlest Jan/Feb 2020. If any of the others systems are deemed unacceptable for certification which is even chances then it could be into 2021.


you are correct its not part of the training cycle for the systems training. Our type rating syllabus has it in it for intial. Anyone that joins the company who already has a type rating if they haven't done it before they won't during induction.

https://www.aerotime.aero/clement.charpentreau/226...?

I remember a overhearing a construction foreman give his crew a morning pep talk;
"Be real careful out there today.
The Push is on and Safety's gone!"

Bill
--------------------
"Why not the best?"
Jimmy Carter

Alistair, Thank you for your explanation of the interaction between the flaps and the elevator trim.
I have seen a couple of times a reference to an instruction;
"Turn the trim switches off and leave them off for the remainder of the flight."
In this event, will the co-pilot be manually cranking the trim wheel as the pilot extends the flaps for landing?

Bill
--------------------
"Why not the best?"
Jimmy Carter

I don't know for the 737. If possible in the west we stick to one pilot flying and one monitoring. Unless it's physicaly impossible to not control the aircraft with just one. Russians it tends to be normal. In fact you can have two on the stick and the flight engineer on the power levers. This is historical due to russian design giving extremely heavy flight controls and the engine management being a full time job for one person. The old turbo props had 5 levers per engine and X that by 4 engines one person's hands weren't big enough to adjust them all symmetrically.

Quote:

All 737's have an electric motor on the stabilizer so all of them could potentially suffer from a runaway trim event that drives the stabilizer to one extreme. It's silly of anyone to claim the manual trim system on the MAX must be built differently because it's the only variant that could suffer such a fate.

I agree. But this raises an interesting point.
Is this another design flaw that slipped past the regulators?
For that reason there may be a lot of reluctance to make any changes to the hand-wheel trim hardware.
It may be seen as an admission that the original design was flawed and that the whole 737 fleet should be upgraded.
That is not going to happen is it?

Bill
--------------------
"Why not the best?"
Jimmy Carter

Once you know the aircraft the trim amount is instinctively set so if you flight idle from cruise to decend you know it's three spins of the wheel.

But automation removes this from a swept wing jet pilots contious actions. Turbo prop we adjust the power constantly ourselves. The jets the autothrottle is in and the fms controls the target speed and engine settings to minimise fuel burn depending on the cost index.

When people come onto the dash for command upgrade from the jets it can be rather traumatic for them loosing the autothrottle. Which maybe the reason why the power was left on in both the accidents. They are just used to flying with two hands on the stick and the aircraft looking after the power. Where us tp drivers it's definitely one hand on the stick and one on the power levers at all times while flying manually

It hasn't slipped through. Its a 1960's design when such details were not considered important. 50 years later lessons had been learnt and a different opinion is held. And to be fair it hasn't caused alot of fatalities until recently

But due grandfather rights it's never been required to modernise it's design or philosophy. The 777 and 787 certainly don't have this feature.

Quote:

The strange thing for me is the AP stayed in when the stall warning triggered. It normally disconnects as soon as the stick shaker goes off.

The pilot engaged the autopilot while the stick shaker was going off.

Normally you can't engage it with it running, you have to press the yoke disconnect button for 3 seconds which resets the system. Then with the stick shaker going, press the engage button again, it will then come up with mode inhibit on your PFD and it will stay out. This I believe is common on Honeywell EFIS fits.

http://www.737ng.co.uk/737-800%20Quick%20Reference...

There doesn't seem to be a spurious stick shaker QRH card either. If we have it going off we can kill the system by pushing the annunciator light. After doing the AP reset 3 seconds you can then engage it again. Which again seems weird because you really don't want it running while trying to land the aircraft, for noise and communication and for the annoyance of the stick waggling while you trying to land. Again I am pretty sure modern certification standards require you to be able to kill the system.

just posting updated links which are coming through pilot social media.

I also passed on the comment about the AP being in with the stickshaker going to the ECA... the reply was good point, well presented it will go on the EASA list of issues.


https://www.moonofalabama.org/2019/05/boeing-737-m...

It's a continuing surprise that "continuous" means "forever." As in, if the steering on my car broke completely, but only for 9 seconds, that would not be the concern that it would be if it went until I crashed.

Oh. Wait.

9 seconds of broken steering on the highway would probably kill me long before I waited forever to see if it was intermittent or continuous.

The mistrim was obvious in the first 1 second of operation as the yoke force increased. It was grotesquely obvious at 4 seconds.

Something is fishy about the roller coaster maneuver simulation claim. Somehow they come closer and closer to trim and never ever gain altitude in between attempts? Even though they are carrying excess energy into the maneuver. And apparently not pulling back on the throttle to match the ever increasing pitch-up trim to slow the plane to match.

And yet another article overlooking that the Ethiopian had full electrical trim authority and threw that away when the plane was far out of trim by shutting off the motors. Properly trimming should be the default task for all pilots.

It's clear that as long as the pilots maintain trim the plane won't crash from MCAS and that the electric trim is sufficient to do that. There is zero need for any other procedure, though it would be convenient.

Interesting.

Quote (from link, minor typo 'circuit')

...interrupt the electric circle that supplies the motor...

I suspect that the opinion that no changes are required to the design will not be adopted in the final decisions.

Yes - they will be forced to change something.

They are already changing the MCAS software - done deal. No question. Absolutely. For certain. Nothing else to do.

But that's not what the opportunists are looking for to resolve this situation. They want more. More than is offered, more than can be offered. And they will never accept that the pilots have any influence over flying the plane.

"Nothing else to do."

No.

They'll also need to edit the procedures, especially the part where it instructs the crew to switch the electric trim switches to CUTOUT, and "...leave them there for the remainder of the flight."

Acknowledge that the procedure later helpfully mentions that the electric trim "can" be used before switching it off.But in light of the other information, the word "can" perhaps should be replaced with "must".

There will probably be changes in at least a half-dozen areas, not merely software.

Quote (FAA 2018-23-51)

Runaway Stabilizer
Disengage autopilot and control airplane pitch attitude with control column
and main electric trim as required. If relaxing the column causes the trim to
move, set stabilizer trim switches to CUTOUT......

Using the electric trim to maintain control of the plane is ALREADY listed as an action to take before using the cutout switches.

I have read that the stick shaker and IAS disagree would be the pilot's focus. For IAS Disagree or Unreliable Airspeed I have read at multiple places that the pitch should be 4* nose up and thrust 75% N1 if flaps are up. This is supposed to be a memory trained safe setting that will always cause a climb at low altitude or a decent from high altitude which keeps the plane safe. It's not a setting to maintain the current flight altitude and speed.

The very first line of the procedure for both; "Adjust the airplane attitude and thrust. Maintain airplane control."

The pilots never adjusted the thrust to the prescribed level.

It'd be curious to see what would happen to the plane and control column forces at the 2.1 unit trim level with 75% N1 instead of 94% N1.

It would be surprising if the wording and procedures highlighted below would not be implicated as a contributing factor.

Especially where it says, "...ensuring..."

Quote (More complete extract)

Runaway Stabilizer
Disengage autopilot and control airplane pitch attitude with control column
and main electric trim as required. If relaxing the column causes the trim to
move, set stabilizer trim switches to CUTOUT. If runaway continues, hold
the stabilizer trim wheel against rotation and trim the airplane manually.

Note: The 737-8/-9 uses a Flight Control Computer command of pitch
trim to improve longitudinal handling characteristics. In the event of
erroneous Angle of Attack (AOA) input, the pitch trim system can trim
the stabilizer nose down in increments lasting up to 10 seconds.
In the event an uncommanded nose down stabilizer trim is experienced
on the 737-8/-9, in conjunction with one or more of the indications or
effects listed below, do the existing AFM Runaway Stabilizer
procedure above, ensuring that the STAB TRIM CUTOUT switches
are set to CUTOUT and stay in the CUTOUT position for the
remainder of the flight.
...
Initially, higher control forces may be needed to overcome any
stabilizer nose down trim already applied. Electric stabilizer trim can be
used to neutralize control column pitch forces before moving the STAB
TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be
used before and after the STAB TRIM CUTOUT switches are moved
to CUTOUT.

Quote:

Runaway Stabilizer
Disengage autopilot and control airplane pitch attitude with control column
and main electric trim as required. If relaxing the column causes the trim to
move, set stabilizer trim switches to CUTOUT. If runaway continues, hold
the stabilizer trim wheel against rotation and trim the airplane manually.

Note: The 737-8/-9 uses a Flight Control Computer command of pitch
trim to improve longitudinal handling characteristics. In the event of
erroneous Angle of Attack (AOA) input, the pitch trim system can trim
the stabilizer nose down in increments lasting up to 10 seconds.
In the event an uncommanded nose down stabilizer trim is experienced
on the 737-8/-9, in conjunction with one or more of the indications or
effects listed below, do the existing AFM Runaway Stabilizer
procedure above, ensuring that the STAB TRIM CUTOUT switches
are set to CUTOUT and stay in the CUTOUT position for the
remainder of the flight.
...
Initially, higher control forces may be needed to overcome any
stabilizer nose down trim already applied. Electric stabilizer trim can be
used to neutralize control column pitch forces before moving the STAB
TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be
used before and after the STAB TRIM CUTOUT switches are moved
to CUTOUT.

It still reads to back to the top and follow the part I highlighted - "control airplane pitch attitude with control column and main electric trim as required" and then to "set stabilizer trim switches to CUTOUT.".

The part you highlighted in red does not say to set the switches to cutout.

Sure, you could change the text to make it clearer, but saying the text says to throw the switches first before using the electric stabilizer control is simply wrong.

I don't understand the issue with the text saying to keep the switches off for the remainder of the flight since you'd want to do that in a runaway situation.

I think you would be surprised how little jet pilots trim the aircraft both in pitch and roll even single engine. These days they are actively told to keep the automatics in especially when the work load goes up. When the automatics come out in normal ops then the aircraft is already in trim and they only sort out there own changes of airspeed. AP in as the gear lights go out and then off when it shouts minimums at you at 200ft.


BTW there is an absolutely collosal pitch down moment when you take the power off an under wing pod jet aircraft. I will admit i have only flown one in the sim for job interviews and its always a suprise how much it pitches down and up when you take the power off/on. Which is suspect is the reason for the MCAS anyway when they go TOGA for a go-around the manual pitch up combined with the power increase pitch up takes them into the MACS area of triggering. So if they are struggling with the nose going down I can sort of understand the screwed up logic of not taking the power off which will mean further pitch down. Remember the min standard for most pilots for engineer/physics is age 14 high school level. Principles of flight is not instinctively obvious, for some of us flying an aircraft is just a big energy equation. Others its a series of SOP's which when performed result in a safe flight. Problem is when they come out of the SOP's they have nothing to fall back on.

You should see the amount of utter nonsense that's spouted about V minimum control airborne (Vmca) for asymmetric thrust situations.

BTW I have no issue with you saying it would be good for all pilots in the world to get increased training and standards. Accountants would have an issue with it as well as the pax would have to pay for it. It costs my company 10 000 euros a year to keep just one of us current but i will admit thats 1 extra 4 hour sim session above the legal minimum and an extra day in the class room.

In relation to what the finer points of manual writing complexities are. There was a move a few years ago that there should be a minimum level of English for everyone in international Aviation. You usualy see it as ICAO and then a number 4-6. 4 is the min required, 6 is a native speaker. Now in theory every pilot in commercial ops should be at least 4, you only have to look on youtube for tapes of air china in LAX to realise that the varition of level 4 standard has not really solved the issue. Some of the guys at work English is thier 4th langauage! and to be honest they are great at English and I have no complaints. But then again all recruitment is done in English and the minimum standard is ICAO 5 which means they don't have to be tested as ofen as the icao 4's. If someone gets an ICAO 6 then they never get tested again. The mucking about with wording on QRH plates for these low level ICAO 4's to be honest is not going to solve the problem. Using words like "ensuring" will mean they will miss the point. It needs to be binary, alot of QRH's are using flow charts now with yes/no logic and then if they need to go back to reassess, a line takes you back to the approprate point. After working for numerous years with none native speakers these flow chart type cards seem to work better and there is less discussion about what something means.

eg above

1. disengage auto pilot

2. trim aircraft using electric trim.

3. Electric trim switches ......... cut out until landing

4. Is trim wheel moving? Yes hold and trim manually. No. fly manually (do not move cutout switches)


The above is not what the procedure should be, its only a suggestion of how the procedure should be given and the extremly low level of English that should be used. No lists which required grammar knowledge use only "and" or "or" to separate.

Write the cards using KISS principle. Why the hell do they use "conjunction" instead of "addition" or even "and" when they know fine the bulk of their market are none native speakers of dubious ability.

Oh and plan for the pilot reading it at 3 am after 6 days of 12 hours shifts.

"...do the existing AFM Runaway Stabilizer procedure above, ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT..."

This extract can be (mis)interpreted to mandate that the switches are set to cutout while executing the procedure.

By way of explicit clarification of this point: If the wording had also included the word "while" after the comma then it'd be more-explicitly wrong. Now it's merely very badly worded. The present participle (continuous tense) of the word "ensuring" (with the -ing) very nearly includes an implicit 'while'.

The final report will almost certainly make the exact same point as I'm making here. It remains to be seen if this contributed to the incident.

The point that started this was that these procedures are not optimally worded, and they'll be yet another example of something that'll need to be corrected. It's precisely incorrect to claim that there's nothing to fix but the software.

That was an eye-opener Alistair.

Keith Cress
kcress - http://www.flaminsystems.com

So, has the FMEA for this system been disclosed? or are we still guessing as to what Boeing thought it was supposed to do? Putting my conspiracy hat on, fit big engines, write FMEA, find high severity index for high AoA conditions, identify Permanent Corrective Action can be software, define software fix, sign off FMEA. They needed a new FMEA done after that on the fix.

Cheers

Greg Locock


New here? Try reading these, they might help FAQ731-376: Eng-Tips.com Forum Policies http://eng-tips.com/market.cfm?

Thank you Alistair.

Bill
--------------------
"Why not the best?"
Jimmy Carter

I predict, that this MCAS debacle, quite possibly with great enrichment from this thread, will become one of history's object lessons in system engineering (in the largest sense) gone wrong, or perhaps better put, done ignorantly and/or negligently.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

The reason why shall we say the procedures are so immature and geriatric compared to the other cards I suspect is because the original system from outset was pretty much bullet proof.

You have a great big lump of a DC jack screw powered off the emergency battery bus, way more robust than it needs to be mainly because it acts as ballast weight down the back for trim, saves having a lump of depleted uranium in the tail which in the old days when they used it for ballast. Three wires, one rocket switch, CB, and cut out switch (which I suspect was only used by technicians, never in anger). The manual trim system is "fly by wire" all of which are steel and the control runs are over pulleys.

I suspect the whole 737 series has had issues with that trim system that you can count on one hand since the 1960's. Nobody ever used that card so there was never a need to update it. The option of going paperless flight deck like the 777 and 787 was discounted due to grandfather issues. Just finding the QRH book behind the captains seat takes time. Then finding the correct page takes time. Paperless as soon as it see's that the trim has been running more than 5 seconds the QRH card will pop up on the 6th screen. 737 is a Memory item which is never trained for in the sim.

I suspect that a solo software fix onto the screw jack input wasn't the first solution either, a secondary motor onto the trim line with a clutch that could be over powered by the main trim system I suspect was looked at. But they were struggling with weight so that got ditched.
Yaw damper systems (which are used on the rudder to counter act dutch roll) were initially like this screw jack setup, they took the data off the Captains heading double integrated it, and then waggled the rudder to counter act the issue. When it was in the rudder pedals were solid you couldn't move them, to the point I had a US trained FO going into Dubai similar to the calibrator that's crashed recently who hit vortex and ripped his thigh muscle trying to push the rudder pedal to lift the wing. His crime was forgetting to press the AP disconnect twice to kill the yaw damper as well as the AP on a J41.

These days you can use the rudder pedals normally to there full limits with the yaw damper in and you never think about it really until a cap comes up and you have to slow down to the YAW damper u/s limits. To the extent you can actually have an engine failure and if you spot it winding down you can feed in the rudder to counteract the yaw and the AP never needs to come out. The BAe Jetstream rudder system was a wire analogue system. You really didn't want to play with swapping your heading flux valve input though with yaw damper in, this could give instantaneous heading changes which the yaw damper system would drive the rudder hard over to the yaw damper limits. You tended to only make that mistake once.

BTW the MCAS system is only the tip of the iceberg in relation to the Elevator system now. Its what the media and discussions are focusing on because its what's highlighted the issues with the elevator system design. The whole NG series is now under the microscope. If the FAA are making them tackle the elevator size and power and the size of the trim wheel in the cockpit its a whole different ball game. The FAA might have no option if its proved it certified the NG's as compliant when they weren't. The FMEA for the increasing the size of the stab and keeping the same sized elevator and reducing the size of the trim wheel in the front is the one that's going to be interesting. I suspect the MCAS software change has already been done. The delay is dealing with the bigger picture with the whole of the NG series, which is a tyrannosaurus in a china shop issue, there are over 7000 of them out there on the planet. They have an extremely good safety record mechanically. The only thing that pulls them down is the number of pilots that have taken them off road on landing due to poor decision making in regards to weather conditions and/or pushing a unstabilised approach. Personally I see no point changing them. They have proved themselves safe the hard way.

What they are going to do with the max's tail I really don't have a clue. Its a catch 22. The system works fine and pilots don't screw it up as proved by history of type if there is no external input to the trim system. Add in external input and it vastly increases the chances of system irregularities which vastly increases the chances of the pilots screwing it up. The current control and power is more than fine for normal operations and likely failure modes as the NG has proved. The new mode of failure its not. Get rid of the external input problem solved but then the aircraft isn't stable at high alphas. Which to be fair does happen way more often than passengers know or expect. And if your expecting 737 NG pilots to swap between the 800 and max sometimes in the same day its going to bite at some point if there is a change in control forces. There are things called noise abatement procedures which most airports have in built up areas. It requires you to fly a sub optimal profile to try and reduce the noise. It usually has you climbing at high draggy alphas at V2 +10 until 3000ft sometimes with a low level power reduction as well as cleaning up the flaps. This leads to highish alphas but I don't have a clue if they would be in the MCAS zone. here is a link to the Boeing noise profiles. The only time you can deviate from them is if you have an emergency or weather related issue. Zurich in Europe the company will get a 5000 euro fine if you don't comply with them. And if the company doesn't pay then they will come chasing after the Captain for the cash. They are particularly trouble some because they require a hard turn at low level as well requiring a 25 angle of bank as well because of rich powerful locals that live off the ends of the runways. There are something like 30 noise microphones as well dotted about which if you trigger them you also get a fine even if you have carried out the procedure to the letter. So your angle is high anyway to get V2 +10 and increases again because your in a 25 deg banked turn which gets you to within 20knots of Vs which is really high alphas and I pretty certain you would have the MCAS in action if you were stupid enough to try and fly a NDAP2 manually.

http://www.b737mrg.net/downloads/B737MRG_noise.pdf

You just have to look at EK521 777 crash in Dubai, that was 14000 hours experience on the flight deck and they still screwed up something which is trained for and done 3-4 times in the sim every 6 months. Although I have my suspicions that the temperature was way above what the airport was reporting due to local labour laws. Add in variations in control forces into the equation which occur on no other type from Cessna 150 trainer through to 747-800 and its not going to be pretty. Go arounds are not that common at most airports. The likes of Gatwick they are aiming at 1 an hour. If its more than 2 then the controller will be looked at, 0 and they will also be looked at because they are not pushing the traffic in hard enough. 1-2 an hour and they are doing great. But for a pilot you looking at 1 or 2 a year outside the sim for a regional pilot flying 4 sector days and 800 hours.

So I agree Hemi that this will be the subject of case study's for years both from design POV and from The pilot side of things. Hopefully lessons will be learned and money doesn't override safety.

Bloomberg: Pilot warned Ethiopian bosses

That Captain has an interesting history, one which is no fault of his own from what I can tell.

Bernd Kai von Hoesslin is German and had issues in India with Jet Airways a few years ago if its the same guy. From all accounts he is a man of moral fibre and knows his stuff. His name rang a bell when I read the article.

Ethiopian Airlines published a rebuttal to the Bloomberg article on Twitter. Condensed "Nuh Uh"
https://twitter.com/flyethiopian/status/1133680645...

I can see some reason for being disgruntled and for Ethiopian Airlines to keep pointing to Seattle as the entire source of the problem. But I think their cover got removed when they said their crew did everything per the AD, even though the flight data record showed they clearly did not. If this is true and it has the ring of truth to it, no wonder they wanted the spotlight so many miles away.

I suggested a long time ago that the problem may be much deeper than just the MCAS system.
It's looking as if the root problem has some of its origins in changes to the 737 NG series. (Larger stabilizer, smaller hand wheel)

Next issue:
A bird strike takes out BOTH AoA sensors and the internal counterweight causes both to drop to the bottom, and still agree with each other.
Random speculation?
I wonder what Capt. Sulley's thoughts are on multiple simultaneous bird strikes.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Its pretty standard in these situations.

The q400 guys that have gone over there are working a 20 day on and 10 day off roster with 2 single days off in the 20 days and are flying 4-6 sector days and 100 to 120 hours in that 20 days for 7000$ a month. That's an utterly brutal roster.

The none lawyer reply was the better one for them "We complied with the NG differences training issued by the FAA and Boeing" which I have no doubt will be considered insufficient in a court of law but only time will tell.

Its been very quiet on the CVR contents of both crashes which is unusual. There has been more than enough time to get them processed. I suspect Ethiopians joker will be the racket that was going on in the cockpit and there will be a line of phycologists willing to go pro witness saying that the pilots were enviromentally overloaded and couldn't be expected to function trained or otherwise in such a situation. There are a load of NASA study's on the subject which they can quote from. Also the possibility of a bird strike has also been quietly dropped from comment. The CVR contents are what's missing for most pilots now.

To be honest the hang bags a dawn mud slinging between Ethiopian and Boeing is just about who coughs up compensation to the relatives. If the finger is pointed at Ethiopian it will be the Warsaw or Montreal compensation which I think is limited at 250 000 $ per pax. If its Boeing you guys know the likely outcome better than I do. I will admit its not really a subject I have looked into after the basics required in Air law so if I am completely wrong so be it, I will standby to be corrected. In someways the lionair is the relatively easy one to deal with due to the low number of probomatic nationalitys onboard, I believe there was 1 European on board and no North American. The Ethiopian is a completely different mix and problems.

"I wonder what Capt. Sulley's thoughts are on multiple simultaneous bird strikes."

I think you would be surpised how hated Sully is in US airline mamngement circles. He has turned back the clock 30 years and undone billions of dollars worth of lobbying by the airlines. And he is still alive and keeps talking sense and the public consider him a hero. Nobody is stupid enough to take him on. And to note he too didn't do the procedure properly when he ditched. Turned the APU on without being told to by the checklist and failed to run the ditching checklist which resulted in the main outflow valve not being closed which allowed the aircraft to flood more quickly.


Is there any talk about having a Rodgers Commission type investigation into this whole thing?

Comment noted, Alistair.
But, is it reasonable to surmise that in the case of a flock of birds taking out both AoA sensors they may both give false, but agreeing, indications?

Bill
--------------------
"Why not the best?"
Jimmy Carter

yep but its unlikely to happen. It will need to be a pretty huge bird way over the windscreen testing size which would have to hit a AoA vane for it to come off. These things have survived TSA baboons climbing on them to check cockpit windows being closed. They survived the pitot tubes didn't. Your talking migrating geese or albatross sized birds whoe's pack density is much less than a swarm of small birds. I wouldn't like to speculate what the chances are of two of them hitting a AoA vane in just the right place to sheer it off on the same strike.


A goose will cave the radar dome in or destroy the spinnner of a turbo prop. And will utterly destroy a jet engine.

What Sully hit, a turbo prop would have eaten and spat the left overs out the back of the prop for most of it. The bullet proof ice impact panels would have taken a bit of a beating. And because the TP's engines use centrifugal compessors anything that made it to the engine intake would get thrown out the bypass door just like lumps of ice do coming off the blades. After landing the whole aircraft would stink and there would be blood and guts all over it which would have been dried to a not to be moved with a pressure washer state. Been there done that got the t-shirt.

That requires a long chain of events
> multiple bird strikes
> pilots not noticing
> both vanes destroyed
> both vane counterweights misaligned in the wrong direction
> assumption that the software is still stupid (this might still be a good bet, though)
> all happening during the initial climb

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

Just for information here are the flight controls laws you get in Airbus and what you loose between them.


http://www.airbusdriver.net/airbus_fltlaws.htm

And a link that includes Boeings FBW laws.

https://www.skybrary.aero/index.php/Flight_Control...


I can't find anything for the Embraer or C series.

Thank you Alistair.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Of course the issue are deeper than a single malfunctioning system.

From what I can tell;
- None of the 737's are easy to manually trim when starting from far out of trim.
- Stabilizer runaway has been dropped as a regular training requirement, likely because it never happened. At best it might still be a 1-time training thing when first moving to that type.
- Overall, pilot training isn't as focused on flying the plane as it is on operating the plane.

So, there is plenty of blame to go around. The plane was flyable, nothing was fundamentally wrong that made it impossible to keep it in the air, but the pilots didn't know how to keep it in the air.

Personally, I'm doubtful that having bigger trim wheels and/or the original stabilizer size would have made any difference.

Something I didn't understand is the Ethiopian first-officer having 98 hours of flight experience outside of flying as the first-officer in 737's. That makes it appear the minimum required experience is another thing to add to to the list of blame to go around.

"The plane was flyable..."

Agreed. Look up thread (17 May 19 17:37) where the same point was made.

'These newer style incidents are where the aircraft is in very nearly in perfect condition, right up to the moment of impact.'

The original post contained more explanation.

He did what's called a mpl which is very light on small aircraft flying and heavy on multicrew SIM training.

There are more than a few of us in the industry which are not happy with the concept.

But it really doesn't matter if the guy next to you has 100 hours or a 1000 hours in light aircraft you are pretty much on your own as a captain in none normal operations until they get 500 sectors under their belts and one recurrent SIM check.

Apparently, this is a point of contention...my 2 cents...it would seem that had the air framer performed or should have performed a DFMEA for this vintage plane, including the MCAS system/software...they would have at some point had to address the very real possibility of erroneous AOA input, or a failed AOA. Sounds simple does it not...and more importantly, is not one of the cardinal rules for commercial air framer...at a minimum dual redundancy, in some cases triple redundancy? Your thoughts?

dual or triple redundancy is a nice concept, but there's always a limit on how much you need, or want, and how much fuel you burn to carry it around with you and how much you spend replacing everything that dies. For a given MTBF, you get better reliability at the system end, but you now have double or triple the number of components failing per unit time, AND additional testing to identify the failed units that are masked by the redundant unit taking over.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

great points...especially the weight budget, and especially on a commercial workhorse like the 737...but a second AOA and associated harness...a guess 10 lbs?? Your thoughts?

They have two minimum, some types have three, And there is a system that does away with them and uses the pitot tubes to figure out the AOA which then gives three.

Per say adding an extra one seems like a easy job. But in reality it would cost millions and take months because it would step over the line and trigger recertification.

Everything revolved around not triggering recertification and reducing pilot training to virtually nill if you can call 45 mins CBT on an iPad training at all.

My winter ops CBT that reminds me about De icing procedure's and contaminated runways takes an hour plus a 15 min exam. And its only after 6 months since I landed with all the ice protection on. Dangerous goods takes 1.5 hours.

It's a mathematical trade, though, not subject to emotional arguments. The 787 Max has had 2 accidents, but both planes already had redundant AoA sensors, just not the proper processing for that feature.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

With the 737 Max already having two AoA sensors it may be that the lines of code required weight heavy on the mind.

Bill
--------------------
"Why not the best?"
Jimmy Carter

Bad design can still outwit redundancy.

Airbus A330 with triple AoA sensors (etc.) and the aircraft still 'went psycho', ref QF72.

It wasn't a failed AoA sensor with the airbus.

It was data spikes from the databus which were spaced longer apart than the error checking algorithm was coded to deal with. And they had 3 backup computers cross checking each other

It happened to a second A330 in rufly the same place after they issued a notice to aircrew but before the software changes got through. And the spikes were the same spacing etc.

Nearby the locations there is a Military communications/other stuff base for subs. They of course won't say what they are doing or transmitting or when.

After the second event they actively looked for other aircraft getting the same data spikes. It was never to be seen again. No fault was found in the wiring looms. But they did harden the data lines against EM.

There has been another crazy ivan with an A330 which caused alot of injurys including the first officer with a broken spine. It was intially put down to the same thing, then it was discovered that the captain had a DSLR camera out in the cockpit and it had interfered with the side stick. As for his training he was a 25 year pilot officer in the UK's RAF flying the A330 Airtanker.

Its not uncommon for wierd stuff to happen to avionics near military sites. There are 3 places in the UK I won't go near in an aircraft be it light aircraft or commercial. There have been cases of dimond aircraft fadecs going crazy near them. And when we fly into St Petersburg its pretty much standard for the navigation gear to have a epiletic fit a couple of times during the approach.


So you might consider me a conspiricy theroist in realtion to the QF72 but I don't think they actually found out the full issue with that one. If it had happended a third time in the same location I would be certain but twice its just a hunch that all is not as was reported. I know its been a few years since I have done any data aquisition A/D but when I had to deal with data spikes they were pretty much constant if it was a dodgy accelerometer or strain gauge, especially if the test item was getting battered to death on the vibrator. The only time I got weird spikes it was usually down to badly screened cables and big inductors kicking in and out.

"...wasn't a failed AoA sensor..."

Yes. That's why I intentionally included the '(etc.)', "...with triple AoA sensors (etc.)...", to acknowledge in advance that the failure wasn't with the sensors themselves. Sorry if it wasn't clear.

Even though I have zero interest flying an airbus the fact that the qf flight was mentioned made me dig a bit further into the incidents with control issues with them.

They are very thought provoking. Like or not fly by wire is going to be a feature of all clean sheet new types in some form or other.

The airtanker incident was a particular example of pilot unintended collosal screw up.

Just looking at the Miami air overrun sad thing with these overruns is the lesson never seems to be learned. After this macas issue I am pretty certain history won't repeat itself. If we could only find a way of stopping pilots going of the end of the runway with a perfectly serviceable aircraft. Its a credit to the engineering these days it rarely results in fatalities.

I do not think the task of using the second AOA as a verification is trivial (IMHO). A side slip will cause the two AOA's to disagree. Likely this can be programmed but then the aircraft would need a side slip indicator. It's a tough problem to solve.

They all have a slip indicator, its an output from the AHRS which is laser gyros.

http://www.b737.org.uk/flightinstsmax.htm

If you look at the PFD picture and where it says CMD is the roll indicator just below the white triangle pointer there is a rectangular box. That's the slip indiactor and works the same way as a fluid analog ball slip indicator.


Normal ops you don't use it much on jets, turbo props we use it every time we change the power or airspeed.


The jets use it when an engine fails. If you don't have slip indication you will end up with cross controls and huge amounts of drag resulting. Every change in power and speed single engine requires the rudder to be re-trimmed the only instrument you can use is a slip indicator. rudder, roll elevator is the order you trim the three axis in.


To be honest side slip affects the airspeed more than it does the AoA readings.


It is actively frowned apon these days to use sideslip to get rid of energy. Its another lost skill.

Sideslip "...frowned upon....to get rid of energy. Its another lost skill."

Useful skill when gliding into Gimli.

Canadian pilots seem to be experts at gliding long distances in fuel-less airliners.

Boeing statement (BBC).

Quote:

It is actively frowned upon these days to use sideslip to get rid of energy. Its another lost skill.

While flight training in a Cessna 172, on my second solo cross-country trip, I was coming back in to Calgary but must have missed a call-out from the terminal. I had been cleared to approach but not yet cleared to descend for visual landing. I had also been cleared to descend only to 4000 feet (not runway elevation 3550 feet). After a pause where I completed the base leg without descending, I requested confirmation of clearance to descend for landing. No reply. I began to wonder if I was splitting hairs. All previous approaches to Calgary YYC I had been given separate clearances for each step to approach, join the circuit, descend, and land. But one could assume that clearance to approach implies clearance to land... I chose to maintain 4000 feet until cleared to do so, in case there was traffic below me, turned for final approach, and repeated my request.

Finally, as I crossed the fence, the clearance to descend for landing finally came, and by now the only way I was going to touch the runway was a very steep side-slip. I pulled the power to idle, ignored the flaps and just cranked the rudder to the stop, leveling the wings with aileron in a way I had only previously done to demonstrate the meaning of "crossed controls". I was also glad nobody was in the plane to see me do this.
I shed 500 feet shockingly fast, using up 1/4 of the 2-mile long runway 32. Rolled to a stop far past where I would normally turn off to a taxiway, and made a long trundle back to the school's hanger that much longer.

I suspect I had done something earlier in the flight that irked the controller, but I never found out what. YYC was never very accommodating of the student traffic. All the schools have since abandoned that airport.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

Some good news today though for Boeing, the 777-9 had its first engine run with the GE9X engine. No problems reported.

Lets just hope they don't have any issues with the folding wing tip's.

I used to teach sideslip to my ppl students but the youngsters that I work with that have gone through the large sausage machine flight schools have never heard of it.

Alot of tail draggers with large engines use it as standard on approach so the pilot can see the runway.

In distant memory's cessna has an issue with you doing it with certain flap settings because the vortex off the wings disrupts the airflow over the tail. Piper tomahawk or traumahawk as some like to call it that I did most of my teaching in had zero issues doing it :D

The tommy airspeed indicator used to read zero while you were doing it. And due to its alleged stalling characteristics most other instructors wouldn't do it and thought me crazy to even attempt it. Mind you they wouldn't spin the tommy either.

Spar any chance of you setting up the next part, this thread is getting a nightmare to look at on portable devices.

Thanks for the feedback Alistair!

I should have stated an angle of slideslip (AOS) indicator. This would measure the angle of aircraft to the relative wind. Similar to the AOA measurement. I'm not an aero loads guy. I grow crack and perform static analysis but use the CFD loading for finite element models. The CFD reports show oil lines (representing airflow) on the aircraft. I can see that it can change AOA but this may be insignificant as you noted.

I took some flight instruction and did several solo flights. Then school and money got in the way and I never finished my private license. Bleeding altitude with sideslip is fun! My instructor taught this, but it was years ago. He would also open the window on cross wind landings just before touch down to simulate gusts. He was a fantastic instructor.

S'Web … you could have always done a missed approach "clearance to land too late, going around". If you'd pranged it, it would've been your fault.

another day in paradise, or is paradise one day closer ?

RB,
You know me, so you must know I enjoyed every moment of it!
AH,
Your memory serves you well. No flaps permitted during a slip in a 172, which I took care not to do. With full rudder you are already quite face-down to the earth. Extending flaps even by mistake would only add to the discomfort.

Enough about slipping. Time for snipping...

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

THIS THREAD IS CLOSED.

Please continue the discussion at the new thread:
thread815-454283: Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4]

Thank you everyone for this enjoyable discussion.
This topic is being broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices.