Leeham News and Analysis
There's more to real news than a news release.
Leeham News and Analysis
- A350-1000 or 777-9? Part 3 April 25, 2024
- Boeing CEO promises company is turning around…again April 24, 2024
- Solid start for stand-alone GE Aerospace despite cuts to LEAP output April 23, 2024
- SPEEA, Boeing at impasse over safety program, union says April 23, 2024
- Better transparency needed on Boeing’s 1Q earnings call April 22, 2024
Bjorn’s Corner: Why did Ethiopian Airlines ET302 and Lion Air JT610 crash?
By Bjorn Fehrm
March 22, 2019, ©. Leeham News: Last week we covered what we knew about the Ethiopian Airlines Flight 302 crash.
In the passing week, more facts have been revealed. We also have the first lead why both the Lion Air and Ethiopian Airlines flights finally dived to the ground.
Figure 1. The FR24 speed curve of the ET302 flight. Source: FlightRadar24.
The similarity with Lion Air JT610 crash
The data from the Flight Data and Voice Recorders have been read out by the French Bureau d’Enquetes et d’Analyses (BEA) and sent to the Ethiopian authorities, who lead the investigation.
The Ethiopian transport minister said the data shows “clear similarities” to the Lion Air crash six months ago.
The conclusion is then we have another Angle of Attack (AoA) fault of 22 degrees, which invokes stall warning at rotation and subsequently MCAS trimming once flaps are retracted.
The trim jack of ET302 was also found with the trim position full nose down. Why the crew didn’t switch the trim system off we will know in due time.
How JT043 was saved
We now know the crew which did switch the trim switches off, the flight before JT610, did so because a third Pilot from the sister company Batik air, flying clap seat in the JT043 cockpit, could observe the cacophony of actions an AoA disagree of 22 degrees invokes.
He had a free head as he had no flight role. He was the one which proposed switching the trim switches off after having seen the usual trimming from Speed Trim after takeoff not stopping. It was also trimming in the wrong direction (Speed Trim helps the Pilot with the feel of the aircraft by trimming in the background during takeoff and initial climb, mostly trimming nose up).
The Captain switched the trim off, check how this felt, then switched it on again and finally decided the switches off were better. He did not reach this conclusion because he observed a trim runaway.
The constant trimming in the background when flying manually is a normal state for a 737, especially after takeoff. Speed Trim is at work. Trim Runaway is when the trim is running full speed in one direction only. This did not happen, neither when Speed Trim was active (before flaps up) nor when MCAS took over.
What the JT610 Pilots worked on until they crashed
We now know the Captain of JT610 was calm during the fatal flight. He flew the aircraft and asked the First Officer (FO) to go through the Quick Reference Handbook (QRH) which contains the Emergency checklists, to find the relevant emergency procedure for the strange behavior of the aircraft.
As the FO couldn’t find anything which fitted to their situation, the Captain handed the FO the control of the aircraft (after line A in Figure 2) and took the QRH to see if he could find a cure for the sick aircraft.
The Captain had successfully counter trimmed MCAS 21 times and probably told the FO to do the same. The FO trimmed, but he did it in too short periods, B in Figure 2. Gradually the MCAS got the trim moved more and more nose down (the top A in Figure 2).
Figure 2. The Flight Data Recorder traces released to the parliament for JT610 crash. Source: Indonesian authorities.
I know from pilots who have tested to fly a 737 in the simulator that you can keep the nose up with the Pilot controlled elevator, even against a full nose down trimmed horizontal stabilizer.
So why did JT610 and ET302 dive and crash? The pilots held against as the simulator pilots did? We know this for sure for JT610 where we have the Column force traces (C in Figure 2) and can assume this for ET302.
MCAS didn’t crash the aircraft, Blowback did.
The cause of the final dive has bugged me since the Flight Data Recorder (FDR) traces from JT601 were released. I couldn’t find a plausible answer. I tried different theories but none was convincing.
This week a poster in the Professional Pilot’s forum revealed the Boeing 737 has a blowback elevator problem at high dynamic pressures (thanks Dominic Gates of the Seattle Times for pointing me to this post). Now the penny dropped.
I know all about blowback problems of elevators. It was the most dangerous shortcoming of the fighter I flew, the SAAB J35 Draken. Even more dangerous than its famous “Super stall”, a Pugachev Cobra like deep stall behavior the aircraft would only exit from if you “rock it out” of the stall (more on this some other time). While “Super stall” is scary, Blowback is deadly.
Blowback means the elevator is gradually blown back to lower and lower elevation angles by the pressure of the air as the speed increases. The hydraulic actuators can’t overcome the force of the air and gradually back down if the force of the air grows too strong.
If a blowback phenomenon is confirmed for the 737 at the speeds and altitudes flown, this is what happened at the end of the JT610 flight and probably ET302.
When a pilot experiences a stall warning like a stick shaker, his reaction is to lower the nose and increase the speed. He wants to build a margin to an eventual stall. If he simultaneously has “Unreliable airspeed” warning, the built margin will be larger.
In both of these cases, the pilots are flying faster than normal at the low altitudes they flew (5,000ft pressure altitude for JT610, 9,000ft for ET302). This is to build a safety margin while sorting out stall warning and flight control problems.
As they pass 300kts they enter the area of elevator blowback according to the poster. As the FO is losing the nose due to short counter trims against MCAS at B in Figure 2, the speed increases at the same time as more angle is required to keep the nose level.
As blowback stops him from getting the elevator angle he needs, the aircraft started a dive at D and speed increased further. The FO pulls harder but nothing happens (C in Figure 2). The Captain now stops reading the QRH and pulls as well. It’s too late. The elevator is gradually blown down to lower and lower angles as the speed increases and the dive deepens.
What could have been done?
The only remedy to the blowback induced dive would have been a full nose up trim application, for a long time (throttles to idle and air brake would also have helped). But the reaction to trim is slow and the aircraft was now heading for earth. The reflex is not to trim but to pull for all there is, by both pilots, you have seconds to stop the dive. It didn’t help.
If this is confirmed as the scenario for the end of both JT610 and ET302 I wonder why the danger of flying to fast at low altitude, while sorting out a raiding MCAS, was not communicated when the MCAS Airworthiness Directive was released after the JT610 crash.
MCAS forcing the horizontal stabilizer to full nose down should not have doomed JT610 or ET302. Their applied speed margins did.
The JT610 crew knew nothing about MCAS and a potential blowback problem. The ET302 crew knew about the MCAS problem but not about the danger of flying to fast while sorting MCAS.
I have checked with longtime pilots of the 737. They have not heard of a Blowback problem when flying at elevated speeds at low altitude. And before MCAS there was no reason to, it was beyond normal flying practice.
But the JT610 investigators saw what can happen when you run into the MCAS rodeo. Why didn’t they warn to keep speeds within normal speed range for the altitude?
Damn, this is shocking! Do ANY 737 pilot know about the blow back problem?
I too read the professional forum you mention, and I’ve also read this posters description of this blow back problem, but now that you put it into context regarding these two crashes it becomes clear that it was not only the MCAS, but also the blow back problem which was another hole in the cheese which lined up.
But even before this MCAS, the blow back problem was there. What about the other accidents where a 737NG has plummeted to the ground at high speed, wasnt there one in Russia a few years ago during a failed go around?
Could the blow back problem be the final nail in the coffin for that crash too?
Blowback is NOT a 737 specific problem. Please read Bjorn answer to ‘Knuffi’ below.
Blowback is a normal and known effect. Simple physics. The engineers design the actuators so that blowback doesn’t occur in the normal flight envelope. If the aircraft operates outside its published flight envelope, blowback can/will/and is expected to happen.
Imagine driving with your car on an icy road at 300km/h through a tight turn. Would you be surprised if you crashed? Would you call it a “problem” of model X of brand Y? I guess not.
Thanks again for this great analysis Bjorn!
Can you estimate whether the blowback is intended to happen to limit the aerodynamic forces on the elevator (plus stabilizer and whole structure) or if it is a design flaw? I guess that under “normal” circumstances (without the horizontal stabilizer beein in full nose down) the 737 would still be controllable at high speeds, despite the blowback effect.
Blowback is a fact of life in aircraft design. It will happen at some speed and altitude combination or you are over-designing the aircraft. The rule is to design to not have it happen within the aircraft’s published flight envelope. If it does, you have a problem and it shall be clearly spelled out to the operator and their pilots, so they don’t fly into it.
In this case, as far as we know, it’s happening beyond normal operating practice. So it’s OK not to point it out, but only until the JT610 crash. If they ran into it while trying to sort the aircraft (and their speed and altitude is logical given the circumstances) a warning should have been given in the AD.
Yes you are right about blow back. The blow back is to prevent the structural destruction of a control surface when design speeds are exceeded, with surface in fully deflected position. Some actuators have a relief valve to prevent its force exceeding limits, if for any reason the power control units (PCU) gets stuck in its full travel. But I am not sure about the B737 have these built into the PCU . This is very credible explanation why the pilots in the end lost the battle.
Thanks for your reply above, Bjorn. Really helpful.
Yet, I’m not quite d’accord with the statement that “the Boeing 737 has a blowback elevator problem”. This sounds like it is another design flaw of the 737, while it isn’t. As you said, blowback applies to every aircraft out there, if it is operated out of its published flight envelope. Just like Mach tuck. Or structural damage from overspeed. Normal, expected behaviour.
I fully agree with you to give a warning about it to make everyone aware of it.
But formulating it as a “Boeing 737 problem” might lead to additional bad press about the type in less technically knowledgeable media.
Just my 2ct. Thanks for your work.
Good point Steven, I changed to “phenomenon” in the text.
No. I’m really sorry. But no. Base aerodynamics is now very well understood. In our time it wasn’t. But now it is. Blowback can be avoided. Really no.
Time doesn’t stand still. Really no.
The laws of physics are immutable however, so in string theory, time can stand still, run backwards or even side ways.
Really sorry for the off-topic, but since you mentioned you have flown the J35 Draken, can you please tell us what it was like? I don’t think many of us know enough about it. It’s a very exotic design, seemingly very ahead of its time, with impressive maneuverability. Judging by some demonstration flights, maybe it would have owned the F-4 and the Mig-21 in a dogfight. Strange that the USAF ordered some, but only for extreme maneuvering training.
Thanks
J-35 Draken: F104 done right?
Not really, it shoud have had an all moving separate elevator, some would have preferred a J-79 engine and a better gun than the old british Aden. Still for its time pretty good, fast and reliable.
One can suspect that the Aerion SSBJ will repeat most F104 Starfighter problems. It might be saved by its 3 engines taking you out of arodymanic problems with engines in alt mode giving max rpm in an instant. Hopefully GE will program the FADEC to rev up really quick.
Nice analysis Bjorn.
So, how does the OEM decide what is omitted from the QRH? And if they included all scenarios currently omitted, how would this affect the QRH (eg would it be twice as long or just a page longer? Would it add to pilot confusion and so make getting to the root of issues currently included slower?)?
Also, which agency would have been aware of the issue and in a position to notify of it? Indonesia NTSC alone, US’ NTSB alone or both?
The OEM and FAA/EASA… decide jointly what shall be in the QRH booklet and what shall not. It has to be manageable, a too extensive QRH is counterproductive.
As to Blowback read my other reply. Boeing and the FAA should have informed about it.
Thank you Bjorn.
Wow – this is enlightening at least.
With all our technologiy an intelligent systems (I’m working on machine learning techniques for productions systems) some chain of causitions are just – WOW.
Very, very convincing.
Does it apply only to the MAX or does it apply to the previous iterations of the 737?
With regard to flying too fast. It’s a bit hard to throttle back when you are riding a raging bull that’s just come out of the gate. So it’s never surprised me that both airplanes went into powered up dives.
The previous versions of 737 shouldn’t put you in this situation. We have 50 years of 737 flying with this not coming up, so no I don’t think it’s relevant for normal 737 piloting.
But when sorting the original version of MCAS, which is unique to the MAX, it is.
Waht about the Flydubai 981?
From Wikipedia;
At a height of 900 m, there was a simultaneous control column nose down input and a trimming of the horizonal stabilizer to a nose down position, from -2.5 deg (6.5 units) to +2.5 deg (1.5 units).
—-
The result was that after the aircraft climbed to about 1000 m, it then began a rapid descent with negative vertical acceleration of -1g. The subsequent crew attempts to recover were not sufficient to avoid an impact with the ground.
At 00:41:49, the aircraft hit the runway approximately 120 m from the threshold with a speed of over 600 km/h and a nose down pitch exceeding 50 degrees.
End of Wikipedia.
At that speed and with the stabilizer at 1,5 units it seems that elevator blowback could have been at play? Or no?
On a side note, there’s an interesting piece on certification failings in the EU re the diesel engine crisis at https://www.theguardian.com/environment/2019/mar/22/dirty-lies-how-the-car-industry-hid-the-truth-about-diesel-emissions and in the same paper today is the first mention I’ve noticed of Leeham being quoted in a non-US paper (Bjorn at https://www.theguardian.com/business/2019/mar/21/doomed-boeing-737-air-max-planes-ethiopia-indonesia-crashes-lacked-two-optional-safety-features-report)
Very interesting. Does this clear the “third world “(non American) flight crews?It seems to me that they did all that can of been expected.
Obviously, they could have always done better. The experience of JT043 shows that, even with no knowledge of MCAS, it is possible to diagnose and manage the problem, given enough highly-competent cockpit resources.
However, you can’t design a safe aircraft or training program on the assumption that you will always have an above-average flight crew. That’s a mathematical impossibility. The FAA/US carrier knee-jerk response of, “Well, our flight crews are better than those guys, so everything is totally safe here,” demonstrates a lackadaisical attitude towards safety that will not perpetuate the current excellent aviation safety record.
Thank you for making this point. I have been very concerned that American pilots seem to believe they are so infallible that they need not concern themselves with the design and saftey of the plane itself.
I think we should not call them third world or even TPLACs sthe authorised term is developing nations
Good point and I will try to use that myself in the future.
There but for the grace of place go I.
Hmm, that would seem to debunk the narrative coming from Boeing apologists that clueless “third world” pilots caused the crashes because they didn’t move the STAB TRIM switches to CUT OUT, while being seemingly clueless on how pilots can, in fact, keep the nose up with the yoke controlled elevator, even against a full nose down trimmed horizontal stabilizer — and offering no insight into the dangers of flying too fast at low altitude.
Hence, in order to counter a nose-down movement, a pilot’s natural reaction would seem to be using his/her yoke, moving the elevator. What pilots have not been told, though, is that after a period of time, the elevator is going to lose, and the stabilizer is going to win if the airspeed exceeds 300 kts at low altitude.
What concerns me is “in the simulator” could it be confirmed that this is also definitely the case with an aircraft in flight, especially the MAX.
When BA was verifying the flight envelope with the MAX, would they have verified that this was the case ? If so is the data freely available ?
I’m not convinced that the simulators are close enough to the real world (they ought to be). If MAX simulators really don’t have MCAS, I do wonder just how accurate simulators are.
Apparently, the 737 MAX simulator was not designed to replicate failure modes of the MCAS system.
https://www.reuters.com/article/us-ethiopia-airplane-simulator-exclusive/exclusive-ethiopian-crash-captain-untrained-on-737-max-simulator-idUSKCN1R20WD?feedType=RSS&feedName=newsOne
@Bjorn
Is there any way out of an elevator blowback problem ? Pilots should most certainly be made aware of the issue, and given training to avoid / escape such a situation however rare it may be.
The obvious question is, does the engine position, and geometry on the MAX have any effect on increasing speed when the aircraft is trimmed nose down ?
Will the MAX gain speed more rapidly than an 800 when nose down, and if so how much more rapidly ?
“Trim Runaway is when the trim is running full speed in one direction only” possibly the key to why pilots didn’t identify the issue, and hit the cut out switches, it didn’t look in the confusion, like it was Trim Runaway.
Can anyone explain why Trim Runaway in the classic sense is even possible ?
I understood the point of simulators was to simulate the aircraft accurately. I’ve seen posts that suggest that the MAX simulators do not include MCAS, is this true, and if so why ?
Trim motors are driven in one direction or other by electrical relays by FCC or from Thumb switches on control yoke. Trim Runaway can happen if the relays that finally control the power to the trim motor gets welded for any reason. The same can happen if thumb switch contacts remain closed due to malfunction. These are very rare occurrences even on a ten year old aircraft. Probably has never occurred even. On a new aircraft, these are extremely remote chance of occurring. Hope this answers your question.
@Tech-Guru
Thank you, yes that’s very helpful.
In simple terms the answer is yes. The effects of blowback can be negated by resizing the stabiliser/elevator, but an alternate is to reprofile the tail. For example, extending the tail causing a less severe pressure wave is enough.
Fifty-sixty years ago it wasn’t understood. Now it is! Can’t agree with anybody who says othrwise!
Then I won’t try.
@Transworld:
“Then I won’t try.”
Don’t worry, some folks are just highly resistant to the reality of physics and are simply biased. Extending the example of the automotive world a commentator used earlier here, it means some folks here believe the loss of control of a vehicle traveling @ 300kmh around a curve on icy road surface can be “negated by resizing the” tires & suspension/chassis – Theoretically possible only if resizing to a size/scale that is impractically huge/bulky but possibly still won’t be able to maintain adhesion as soon as the same vehicle hit say, 301kmh….design limit/boundary of the operating envelope of any complex machine/gadget(regardless of whether it is designed in Everett or Toulouse) has to be drawn somewhere and all will always hv a DO NOT ENTER zone.
Bjorn sum it up well here in 1 of his replies:
“It will happen at some speed and altitude combination or you are over-designing the aircraft.”
My own interest in this series of air “accidents” was originally established with the report of a skilled diver (Syachrul Anto) drowning whilst searching for recording machines from the remains of Lion Air flight JT 610.
That particular death could be included in with the total of the lost souls from the two recent Boeing 737- MAX airplane mishaps. An unnecessary demise, solely connected to all the others via a common product (one of the said airplane type) with blame for it to be laid wherever the authorities responsible for recording it lay it.
Subsequently I too took great interest with the further analysis of the aforementioned “accidents” through reading (only) the posts on the very same professional forum that’s mentioned in the Bjorns’ article above.
So much so that I decided to join this forum just to make one point clear that had not been discussed by the professional aviation people there.
I was (after several attempts) able to post my point of view of one aspect of the whole sad events and received one response to it, actually from the guy/gal there who so knowledgably explains to others the technicalities of the said flying machinery and its controls. His/her location is stated as being Seattle ?? and his/her forum name ends with 84.
As already included in my post, my status was viewable as an interested passenger, not an aviator. 84’s reply to my post, which I then tried to reply to, in no way, addressed what I’d posted but rather supplied me with information that I’d already gleaned from reading, up until then 105 pages of. My reply to 84, saying so did not get to being “aired” and I received notice that I’d been banned from the forum for 3 days. My original posting and 84’s reply to it were then removed from the thread.
My original posting was intended to be an out-of-the box view as to how Boeing will, in a couple of years’ time, when all of this gets to court, be able to drag their necks out of a noose and put others into it. Especially those necks that are not going to be able to present any opposing views of the tragic “accidents” cause.
My post was about product liability and an unnecessary piece of equipment in the cockpit that if mis-used by an aviator will cause such disasters to occur. Its’ mis-use will CAUSE disaster. And Boeing will be able to prove its’ mis-use. Its’ usage/mis-usage has been digitally recorded.
That piece of equipment is Boeings’ “get-out-of-jail” quick card. They fit it to lots of aircraft in their product pallet. And airmen know they do.
Some advice: you might want to make your questions brief and to the point, starting with the most important question/sentence first.
Like… this post here is a full page and and in the end I’m not really even sure what your question is. May reduce your chances of getting banned next time.
Agreed , we can only assume it was off topic.
I have had Scott warn me, he is pretty forgiving if a bit harsh in wordage at times.
I have seen him work hard to let someone know why he is being the way he is (interjecting logic to someone who has none)
Outright ban clearly has to go over the edge.
He also has this open to commenters, he does not have to and while I don’t agree with him a lot, I have no disagreement it is his right to ban, shutdown or throw all of us out.
Precisely and succinctly. One theory, one question with one answer.
THX Brian 22. March, THX Transworld 23. March
Important sentence first.
For flight deck crew members amongst the readers.
MCAS is forcing the nose down.
You’re “stab-trim switch blipping” the nose up time and again.
MCAS is running 10secs/operation (moving the stabilizer a long way per each 10sec op)
The stabilizer is not returning to where it originally was prior to each 10sec op.
Your blips are soon losing ground in this battle and you’re now also busy pulling 60kgs more than usual (the 60kgs “more” being supplied by MCAS) on the yolk.
The airplane is getting faster because those upward tilted motors (now pointed down a bit, more parallel with the forward trajectory) are really getting going because they’re able to move more air.
With increasing airspeed, the stabilizer is running away and running away towards getting jammed-up.
You remember the switches that turn off all of the power to its motors and you decide to use them.
Now, you’re only left with having to find and fold out a handle and with it turn a wheel a lot of times in the correct direction to get this mess sorted out quickly.
And if you don’t complete that part of the exercise in the manner that Boeing have explicitly advised and trained you to then it’ll be your fault that an unfortunate controllable air incident changed to something more serious.
Recordings will later be able to prove that you didn’t do as had been advised.
The trim wheel usage and/or rather its mis-usage will become the OEM’s get-out-of-jail card. The trim wheel they leave in to so subliminally remind you each and every flight that you are an aviator and, as such, are capable of flying this airplane both safely and manually.
Question:
How did the Lion-Air flight deck crew of eventually three pilots make it home?
Answer:
One of that crew remembered to switch off the power (or maybe even not) and then six arms and six legs were available to share the turning of the wheel and the pulling of the yolks.
Thoughts?
Mike
Thanks for your assessment of the accident and Trim Operation. Could you tell us how many years you flew the 737 and which models?
Congratulation, very interesting.
thanks
Antonio
“When a pilot experiences a stall warning like a stick shaker, his reaction is to lower the nose and increase the speed. He wants to build a margin to an eventual stall. If he simultaneously has “Unreliable airspeed” warning, the built margin will be larger.”
I don’t understand two things about this explanation;
– The AoA sensor does not provide airspeed information. What’s the connection between a failure in that system and the simultaneous uncertainty over airspeed?
– If the crew did not have good airspeed information, why did they retract the flaps?
Not only that, but the Indicated Airspeed System on the 737 is triplex redundant, one for P1, one for P2 and a standby system (which I think does not go through an Air Data Computer, though I may be wrong).
Apart from that I get it, the trim system commands full nose down because of a faulty AoA, the crew fight that with the elevator, the speed increases and the dynamic pressure on the elevator eventually returns to neutral as its blown back by the high airspeed.
MCAS currently does not work unless the flaps are up.
So as soon as flaps got up it kicks in if the single AOA on the pilot flying side is high enough.
I believe Lion Air had speed issues and no knowldege on Ethiopian . MAint did work on Lion Pitot system and possibly damaged it doing so.
And yes, there are 3 speed inputs, one is for the backup instrumentation.
Not sure why you could not tap all 3 and display it on both pilots screens if two out of the three agree.
So if the aircraft is all good up to the point where the flaps are retracted, where did the uncertainty in speed come from? The AoA sensor malfunctioning precipitates inappropriate trim inputs via MCAS, that’s understandable, but the AoA system has no effect that know on any IAS system, far less three.
So why was the aeroplane being flown so fast that the elevators were blown back by the airflow? Was it that simply that repeated nose down inputs increased the speed beyond what the pilots would have intended or desired and until hydraulic pressure could not overcome the aerodynamic forces?
Chris: It goes to the heart of the issue.
AOA not only triggers MCAS, it also triggers stick shaker an the stall warning.
Its the odd nature of the 737 logic system changed to modern day ops, the two sides of the cockpit are Independence from each other.
The AOA on the side that is flying the aircraft (either side) dictates the stall. AOA is a good stall indicator.
As the other side is independent its stick shaker and alarm will not go off.
Speed alone is not capable of dictation stall, airflow over a wing is and that is what AOA is supposed to do.
Better is an alarm on the wing as it looses lift (which is what we had when I was fluxing)
Once the move to AOA was made then its a spiraling issue as to using it though its not great and the fact that due to the basis of the 737 control you are not supposed to mix side of the aircraft.
Some like AOA and swear by it, I don’t think it adds anything to the aircraft and causes issue.
There is a complet sepe inrumention system to refer to (basics) that has its own airspeed and attitude (what your nose look like on an artificial horizon) and vertical speed.
Cross check that to see which system is lying to you and its not an issue.
Civilian aircraft don’t fly at stall, military fighters and fighter trainers do and AOA is something relevant to them.
Anything that has moving parts is more subject to failure than something that has none (ring laser gyros)
So my opinion is the AOA put this on a slippery slope and lousy to worse programing and logic took it over the edge.
Chris-Lee. AoA or IAS disagree: It is not like in old gen aircraft (B737 classic, B727, B747 classic etc)where the pitot probe and static port are directly connected by tubing to the airspeed instruments on a pilots panel. At high angle of attack of the wing the airflow near the pitot probe gets distorted and this affects the SPEED sensing accuracy. On new Gen aircraft to correct these errors, the pitot sensed speed is modified or corrected as a function of AoA in the ADIRU. Hence if you have a very large error in one AoA sensor, there will be an error in the IAS for the same side. So this can result in speed indications showing a disagree. That is only my inference from the way the system is designed to work.
So you’re saying that Boeing designed an aircraft where a single failure affected three independent IAS indications in the same way?
I doubt that. By my reading of the regs, that would not be certifiable;
§25.1333 Instrument systems.
For systems that operate the instruments required by §25.1303(b) which are located at each pilot’s station—
(a) Means must be provided to connect the required instruments at the first pilot’s station to operating systems which are independent of the operating systems at other flight crew stations, or other equipment;
(b) The equipment, systems, and installations must be designed so that one display of the information essential to the safety of flight which is provided by the instruments, including attitude, direction, airspeed, and altitude will remain available to the pilots, without additional crewmember action, after any single failure or combination of failures that is not shown to be extremely improbable; and
(c) Additional instruments, systems, or equipment may not be connected to the operating systems for the required instruments, unless provisions are made to ensure the continued normal functioning of the required instruments in the event of any malfunction of the additional instruments, systems, or equipment which is not shown to be extremely improbable.
Chris. I did not say that. It affects the system on the side that has the erroneous AoA sensor. There are two ADIRUs and they are independent. The stanby instruments, have it’s own source and method of computing.
It is a theory, but a very convincing theory.
When the Viggen was built nobody bothered about base aerodynamics. So it’s not surprising what Bjorn said.
Base aerodynamics is all about shear forces when flows converge again after separation. It is often referred to as base drag.
The pedantic definition of blowback is pressure wave reversal leading to flow reversal. But it’s also used to describe a significant slowdown in the airflow relative to airspeed. This I think is the theory here.
The slow down is such that the elevators become ineffective. But it would also mean the stabilisers become less effective. I’m not saying the stabilisers are stalling. That’s too strong. But I think they are less effective. That in turn reduces the moment arm.
This then comes to the engine/wing mounting. I’ve always taken the view that the base aerodynamics of the wing/engine mounting is causing a pitch up moment. In other words, the mounting is causing the airflow to slow down under the wing, moving the centre of lift forward.
To contrast it with the A330neo. Aitbus are very proud of the pylon. But the pylon is not just about preventing shock waves. It’s also about ensuring smooth convergence of the airflow at the end of the pylon and at the trailing edge of the wing to address base aerodynamics – the shear forces when the flows come back together.
If blowback at the tail is always present – Bjorn, I don’t think is saying that – reducing the effectiveness of the stabiliser then the base aerodynamics of the wing/engine mounting and at the tail are combining to significantly affect the pitching moment.
So I still have the concern that the stabiliser/elevator doesn’t have sufficent margin. Yes it was a false AoA reading. But what happens in climb out – the nose up – when there are strong vertical currents or gusts, where the AoA reading is right.
I refer again to the Times of London who interviewed a 737 MAX pilot. The pilot said the nose has the tendency to go up when power is applied. Pilots must perform climb out so they must continue with power up after flap retraction. And the nose must be up.
I also refer back to another commentators words in a previous article. The words registered but I didn’t reply. The commentator suggested that the wake caused by the wing/engine mounting was affecting the stabiliser. Those words may very well be right.
Anyway this article offers a very good theory. But issues with base aerodynamics aren’t just present at the tail . In my view, they are present at the wing/engine mounting.
Elevator blowback has nothing to do with base aerodynamics.
Where exactly do you think reverse flow is happening when the airspeed is 350 kts and the AoA is close to zero?
Good luck Mike B:
Appreciate it.
Mike: Sall right.
I don’t comment on nuclear physics because I don’t have a clue other than E+MC squared and what it implies.
My brother had an accelerated degree in it (Navy) and he and another friend who did have the degree in it used to talk about it. I could only sit and listen.
The stab situation is outside my experience as well. Small aircraft don’t (mostly) have those.
I do have experience trying to tune heating coils to deal with a -20 to 45 degree range.
Its a bugger as the dynamics change so much.
There are some possible solutions out there but it takes some heavy control theory and strategy.
I can see what we might try but it takes some serious programing levels I am not close to.
I was wrong the stab could overcome elevators, not easy but they can (and accept Bjron fully knows what he is talking about)
In affect MCAS put them into a speed situation it could not and ironic the end affect was the same.
Many thanks for your wonderful analysis Bjorn!
@Philip
I suspect you may be correct about engine mounting. Have a look at https://www.youtube.com/watch?v=TlinocVHpzk around 10 minutes in (Entire video is interesting), when recovering, you have to be careful when adding thrust as this does pitch the nose up.
It appears that the simulator they are using is standard 737, not MAX, I do really wonder about the accuracy of these simulators, but if you watch around 14 minutes in you can see how sensitive adding thrust is. (Beware of secondary stall)
He does emphasise how important it is to control the speed.
My question to Bjorn “Is there any way out of an elevator blowback problem”, I wonder specifically in the MAX due to the engine position, if full thrust would actually have helped them get the nose up. Counterintuitive as it is to increase speed when you already have too much.
Simulators for the type are 100% accurate.
You also get into the computers that adjust the feel, if MCAS works you would not get that push up feel at stall.
If its disabled then you would
You can program a simulator to flip form one aircraft to another, but it has to have the same displays and buttons, switches and other controls
FedEx did hat with what the called the MD-10 when they put the glass cockpits in. Those were 100% duplicate of the MD-11.
What do the simulator manufacturers based their designs on? CAE has a 737 MAX simulator, would Boeing have provided detailed MCAS documentation to them so that they can model the behaviour?
> Simulators for the type are 100% accurate.
I don’t often reply here but this comment is so ludicrous I couldn’t stop myself.
Not every computer in the world running in parallel could perfectly accurately model, in realtime or anything close, the complex aerodynamic and mechanical forces being discussed in the article and comments here. Fluid dynamics and materials calculations are astonishingly complex and challenging and what these simulators provide is, at best, a very rough approximation.
Implying that realtime simulation of anything but the simplest of physical scenarios is currently even possible, yet alone “100% accurate”, is an absolutely laughable statement. The fact it was made with such blithe confidence makes me wish for a button to hide all further contributions from this commenter – there is nothing to be learned from someone who doesn’t even know what they don’t know.
For the love of god man, just stop. You don’t even know the broad strokes of what you’re talking about.
Simulators are only as good as the information provided. So for the love of god read what’s being said.
hk:
Simulators have levels. I did not say I was talking about Level D (US).
What they do is duplicate the movement and feel of a real aircraft.
If it does not, its not rated Level D.
Level D is as close to real world as it gets and if the simulator has problem (mechanical or control or program ) it is down-rated until that is corrected.
In a Level D you could theoretically bring a pilot up to what used to be called ATR with no flight time.
While you don’t understand them, they use various motions to fake out human senses.
You will feel a turn though the simulator is in fact not leaning or turning.
One of the issues they had was that when extreme attitudes were introduced into simulators after AF447, they did not have the motions for them.
They did not have stall programed into them though usually stalls were not part of the training.
They do now. They don’t do loops and barrel rolls but they do go to the edge of the enveloper exactly the way the real aircraft does with the motions need to simulate that and the various noised the aircraft makes (which is another aspect, the noise environment has to be accurate to real world as well)
You can’t even guess what they are doing. I have asked and had it explained to me what looked like a full stall was a landing.
Its an amazing science.
See @OV-099 above, I’ve seen other mentions as well. I wouldn’t be so sure they are 100% accurate.
The 0.6 degree to 2.5 degree revelation after the Lion Air crash has made me think it’s very likely even if the simulator manufacturers had implemented MCAS in their simulator, it wouldn’t be the same as what was actually in the air.
Have they implemented the the change to the control column being pulled back not cutting out the trim as it would in a NG aircraft ?
If a pilot understands that difference, he’s less likely to be confused when he is having to consult the QRH while he’s trying to save the aircraft, and everyone on board.
Accidents are very often chains of events, if you can break even one link in the chain it may be enough to prevent the accident.
CAE, and others presumably just implement what BA, AB or others give them, I would hope it’s as accurate as it can possibly be.
I’ll take a Missouri Position on that claim.
(Missouri calls itself the Show Me state.)
Accuracy depends on:
– fullness of data on actual airplane performance
– fidelity of simulator (which is limited in accelerations due limits of travel, tricks are played to fool the pilots)
– quality of design and fabrication and testing
Recall the fiasco after the Lauda Air 767 loss from unwanted T/R deployment, a simulator misled Mr. Lauda in trying to figure out the cause.
Data on abnormal conditions is difficult to obtain.
An amusing case – now at least, involved Rediffusion’s simulator for Pacific Western Airlines 737s.
Ace Chief Pilot Russ Revel snagged the effect of rudder displacement on the airplane, so Rediffusion fixed that.
Then he considered that engine out climb performance was better than expected, we did timed tests confirming that.
Eventually it came out that Rediffusion’s turkeys had fixed the rudder snag by moving the engines inboard in the model instead of changing the proper parameter, that kludge reduced drag from rudder displaced to counter the yaw, thus climb performance was better than reality.
Russ and the technician supervisor Ron Stunden wrung that simulator out much more than previous Redifusion customers had theirs. (Need such dedication in many endeavours in life, from airplane work to finance and more.)
Yes, that was before even more critical use of simulators for training, before ‘level D’ etc.
One issue that has not received much attention is the high rate of AoA failure with such a small number of aircraft flying.
After thousands of hours of flying Boeing aircraft with AoA, I cannot recall ever having an AoA failure, nor having reviewed the log books for the previous 3 to 5 days write-ups ever seen an AoA failure.
Who manufactures the AoA sensors on the Max and is it a different company from the manufacturer of previous AoA sensors?
Hi Bob,
I have been writing for some time I’m not sure it’s a sensor failure, for the very reasons you give. Peter Lemme is on the same line and has done some additional thinking:
https://www.satcom.guru/2019/03/ethiopian-et302-similarities-to-lion.html
Thanks Bjorn,
If the problem were in the software, wouldn’t occur all the time on each aircraft and probably on all aircraft?
I only have questions, not deductions but it seems to me that there should be very intense interest in the investigation on the AoA sensor’s manufacturer, design & software.
Of course, a single AoA reading should not cause activation of MCAS
Bob M:
Yes same question I keep coming up with.
It seems the AOA was indicating high on taxi as well but I assume in Lion maint not.
Boeing stupidity was single AOA could do that.
One of the fixes is that MCAS is disabled if there is a significant AOA disagree (and a light to warn pilots)
I suspect if the AOA disagree, auto pilot will not engage or drop out if it is.
If it is an intermittent software bug (some specific but rather infrequent sequence of data events cause a particular flow of software decisions), might that explain why a few pilots have reported behaviors that seem at least somewhat related, though seemingly not exactly an MCAS incident?
https://www.politico.com/story/2019/03/12/pilots-boeing-737-1266090
the puzzling thing is that a computer is programed to get data from and Analog Input in this case.
As that is not subject to a software but hardware data, its baffling that it could be software.
I can override my AI at work and maybe there is a provision in testing for them to do so,.
An arching short or wires wrong etc is possible as well, but it would have to be at such a current or voltage value to be still in the allowed range of input (otherwise it come up as ?????)
But clearly it is an aspect in this though it does not look to be an issue when the fix is in.
And it seems to be on the same side.
Could it be the setting for 22.5, that Peter Lemme mentions, is the default software setting during AoA sensor replacement? Then if that software module is rebooted after installation, the value is reset correctly.
I would think if it was a default, it would be zero as that is safe.
Generally we don’t program defaults in even when its possible as it can be erroneous if it sticks.
Need more information.
Are there any hints that the AOA sensors themselves are not functioning correctly? Maybe its not a hardware but a software issue. According to the FDR data that Bjorn posted, the sensors are in sync relatively to each others right after take off, “just” with this difference of 20deg in absolute numbers. Is it even possible or likely to have a constant 20deg “physical” deviation in a 200kt+ airstream?
Could the explanation be, that there is some kind of AoA-calibration going on before take off (while the airplane is known to be leveled) and this calibration somehow fails? If the AoA value right before take off is regarded to be zero (or slightly positive), and the difference to the actual (or somehow calibrated, maybe false) reading from the sensor is considered as an correctional offset that is applied after talke off during the flight, than – at least I guess – you would have this constant offset that the FDR data shows.
Just curious, since it might answer Bobs question – if the sensors are the same as in previous 737 models but the handling of its values by the software is different.
There are no auto tune routines in the system.
Calibration is done on the ground.
Does this mean that – when the FDR shows the left AoA sensor having 25deg and the right 5deg – the AoA vanes really where in this position? Or would you still consider a failure in how the data was processed by the flight computer yielding the difference?
Presently there is no way to tell.
If the flopped to full up on less than takeoff speed, both should be flopped the same.
How these work, what portions they go to when no significant airflow is all unknown to other than ATR pilots.
Possible to even have a test command drifting around in the system
The two comput3ers are programed by two different teams (its a method of ensuring no code is written duplicated to the computer that is identical so their is not a dual failure under the same circumstances)
that said, it seems the two issue were both pilot side so there may be something in that coding on that side.
Swap to the other side for control and it should go away but Lion it did not, so just more questions.
Hi Bjorn;
Very creative thinking – outside the box!
Normal response to theory is testing to find out if results and established facts verify or modify the theory.
I believe MCAS is essentially a software solution and has no physical installation. I believe it uses the (mechanical) STS system, so it is likely that any NG simulator could be used to begin an examination of the theory.
Like simulating aircraft behaviour in the stall, it would have to be determined if NG simulators’ software are programmed to simulate elevator blowback. On the surface it makes sense. Some posters have asked about other accidents, (FlyDubai) which may be explained by the theory. It’s a good insight. Now it needs testing.
So, is this fixable?
MCAS, sure. Boeing has the fix and I’m sure it’s good. Second time around you don’t do the initial mistakes.
Re Blowback. Not so easy to fix it. Just tell the Pilots to not go there. You are restricted in all airliner flying to stay below 250kts below 10,000ft so you should not go there unless you have declared an emergency. And then, if you know of the limitation you can handle it. Analyzing aircraft problems at low altitude at or below 300kts should be OK.
Bjorn: Comment at the end as well.
You are not supposed to stall but a fix.
You are not supposed to go over speed but no fix.
Odd stuff.
Alaska 261 still had elevator control. I would assume on all commercial aircraft the trim can overpower the elevator.
Ted: Per Born, Trim cannot beat elevator, I though ti could but no.
AK made the mistake of trouble shooting in the air and the mechanism actually broke.
Ergo, My take is that a new edict should aplly and that is onec stable, quit, no matther how bad the control is and put it on the ground
That is the lesson from in flight fires. The guidance prior to the Swiss MD-11 crash was to find a good field to divert to.
Now its find any field and if you are over the ocean ditch it. It can propagate so fast that you are crashing anyway.
That was the MO for a run away propeller on the DC-6, we had one ditch off our Island because of that. The end result if you did not land or ditch, it would tear the engine off the wing and you crashed.
I recall that the stabilizer on the fated Alaska Airlines MDxx went beyond the normal physical limits of travel.
The jackscrew broke, and the fail-safe rod inside it could not handle the load so it broke.
Beware there is contradiction among online pundits as to how many jackscrews the 767 has (in blathering about the sudden pitchover of a 767 near Houston).
The confusion may arise from a fail-safe rod inside the main jackscrew.
Have to apply salt to everything – even Air Force Magazine can’t get MCAS on the 737MAX right, in reporting that the KC-46 has an MCAS like system to assist pilots when CG is shifting due to fuel offload (its function is much less aggressive).
Bjorn’s theory looks compelling. I agree that the MCAS was not the sole cause of the crashes but, however unwittingly, it is complicit. I understand that MCAS takes input from the angle of attack sensor and that it is not active when the autopilot is engaged. However, there have been a couple of reports to the NASA maintained complaints website of 737 MAX aircraft suddenly pitching nose down whilst under autopilot control.
The angle of attack sensor would appear to have no redundancy and if at fault could mislead both MCAS and autopilot. In addition to a software fix Boeing might want to improve AoA and associated systems redundancy.
I have a nagging suspicion that we have been here before; that the FAA was too trusting of Boeing’s self assessment; and that Boeing, unfettered by scrutiny, implemented a mission critical system without testing all possible failure modes, yet deemed it ‘safe’.
Very interesting, indeed.
Let’s say that (since I don’t know the real MCAS system): MCAS uses Angle of Atack AND Air Speed in order to calculate the theoretical limit for the pitch-up stall (because of the engine difference). I must suppose that at different air speeds, the AoA that could produce a stall should be different
Then you have in common in BOTH crashes:
Unreliable airspeed, nose up (they were both during climbing).
MCAS kicks on AS SOON AS they the flaps go to 0 (since Autopilot could or should not be engaged because of the unreliable airspeed). Pilots, on the other hand, are trying to get as high as possible in order to avoir terrain and gain some altitude. So the wrestle begins. MCAS tries to get the nose down, pilots try to get the nose up and also to gain speed, so they are not messing with the thrust.
With nose down, speed increases. If the pilots get the nose up again, speed STILL increases, because they are perhaps in TO-GA mode? They are trying to fly back to the airport, Stick shacker IS still shaking (due to the unreliable airspeed data), I pressume pilots are trying to get to a speed that is safe enough. Real speed is too high, while the indicator of air speed said is too low.
Once again MCAS kicks (time after time), nose go down, speed now is too fast, and it looses the ability to counteract it, (blowback). Then, all way down, with little time since altitude is not enough to try to recover (and maybe the pilots were never trained for something like that).
Perhaps, the AoA problem with LionAir is just one of the fail-safe modes missing with the MCAS. Perhaps the airspeed + AoA are the 2 things that are intermixed.
Even worse, perhaps 2 crashes that were produced trying to avoid a pitch-up stall, because of the unreliable airspeed data?
Does the 737 pitch up under thrust more than other aircraft? Where is the line of thrust, center of gravity, and center of drag? I would assume the A220 or E190E2 have a higher pitch up moment as the engines appear to be further below the center of gravity. How far “forward” the engines are mounted doesn’t affect this. The MD-80 had engines on the tail. Fore or aft is not the measure that affects moment, it is the distance normal to the thrust vector to the center of rotation. The 737MAX may well be much better than the A320 or 787 in this regard.
What about malfunctioning speed trim on the 737 NG? What would that look like and has it ever happened? Could it be intermittent like the MCAS failure, and could it be caused by faulty input? I suppose the answers to those question is yes. We don’t hear about speed trim problems on the 737, or the automated trim systems on all modern FBW aircraft, because they are robust and don’t malfunction.
I assume all modern aircraft have speed trim engaged on take-off. Not much room for automated system malfunction.
Hi Bjorn,
As usual for you, an excellent, professional analysis. Thank you.
Not being an expert on these matters, I was among the few who thought the elevator authority was exceeded by the full stabilizer trim so that no matter how hard the pilots pulled back on the yoke, they would not have been able to get the nose back up. I was not aware of the “blow back” problem, which from hindsight appears natural to include on all designs, to prevent the aerodynamic load on the elevator exceeding the design load. Be that as it may …
One could argue that this scenario at high speeds (and low altitudes, since it is the dynamic pressure q that is involved in aerodynamic loads) is still equivalent to not having sufficient elevator authority to correct the steep dive problem. Whether it is due to excessive q or something else should not matter. Pilots flying any aircraft should never encounter a situation where the elevator authority is inadequate to overcome a dangerous, high speed dive into the ground. In these two accidents, it is the MCAS that indirectly made it possible to exceed the elevator authority. In other words, absent MCAS, there would have been no problem. If this is true, then Boeing is responsible for not only making this situation possible within the “normal’ flight envelope during takeoff, but also to make more money, did NOT offer the AOA sensor and disagreement indicators standard! These two airlines chose not to install these “options.” Any certifying agency responsible for safety of the aircraft should have demanded that these be made standard and not options. Too late Boeing has offered to do so NOW. That won’t bring back the 300+ lives lost.
It appears to me that Boeing’s reputation is going to suffer, rightly so IMHO.
Bjorn, any thoughts on this line of thinking?
Differences in how much stab trim you are trying to overcome.
A small amount is easy, more trim one way or the other that harder to overcome.
I had though stab had more but apparently the elevator has enough more movement vs the stab – so even Elevator is smaller it can overcome a full stab position.
I believe there is some kind of breakout feature in the yoke as well. Pull too hard and it lets go and has to go forward to reset.
Its stunning to have a fix for one mode of flight you are not supposed to be in and have no answer but ok per AHJ for another mode you are not supposed to get into.
Re your last paragraph:
You are neither supposed to get into stall nor to get into overspeed (blowback). Both are outside the design flight envelope.
MCAS, stick pushers and shakers help you not to get into stall.
An orchestra of flashing lights and bells and whistles helps you not to get into overspeed.
Where does your confusion come from?
(Of course there would be an answer to blowback: design the actuators bigger so that they can withstand the higher speeds. But why? You’re never supposed to fly at that speeds anyway and it would only add unnecessary weight/cost.)
Steve:
You have two flight condtiosn you are not supposed to be in.
One just has alarms
The other has active overridden (even when its wrong data) to push the nose down.
So yes its a fair question, why is one considered more an issue than the other?
Why not have reverse MCAS to put the nose UP when too much speed (and throttle the engine back) ?
Why focus on something that has a fix (alarms and stick shaker) and ignores an issue that does not?
Are we so focused on stall bugaboo we never updated the certs to deal with speed?
MCAS is not about fixing something that is wrong, its about making the MAX handle the same as an NG at high pre-stall AoAs.
Mike: Slightly different take here
http://www.b737.org.uk/mcas.htm
Its to correct a not allowed under cert vs 737NG feel.
TransWorld,
One would think that the MAX feel would need to be fairly close to the NG feel to support a common type rating, but I’m really not familiar with the requirements.
The point is that while MCAS may be needed for certification (proper stick forces) it is not a stall prevention device.
that Uk sitw gave a description:
http://www.b737.org.uk/mcas.htm
This seems a different explanation to some pilots here who mentioned MCAS was ‘part of
“I believe there is some kind of breakout feature in the yoke as well. Pull too hard and it lets go and has to go forward to reset.”
That safety feature has been removed from the MAX, is how I read the link Bjorn posted about AoA sensor failure.
Since it seems it isn’t fully understood what happened I wouldn’t trust Boeing’s fix yet. Also Boeing saying it was safe to fly after the second crash doesn’t help me trust their judgement.
Hi Kant,
the authority of the elevator versus a full nose down stab was always a question mark for me. I got the info this week it had been flown in 737 sim several times and it’s fully controllable. I then asked if it was at all speeds. The flights were at normal speeds ie below 300kts, essentially a takeoff, climb, downwind and landing.
Blowback will happen at some point on every aircraft with a 100% servo boost of movables (and every present airliner is a 100% boost aircraft AFAIK), it’s just a matter where in the aircraft’s flight envelope (inside or outside the normal envelope). My problem is if it is indeed correct you have blowback at the speeds and altitude JT610 flew (they were outside the normal envelope, it’s <250kts at 5,000ft) there was no warning for it in the AD. The ET302 loss might depend on this omission.
Bjorn:
Is the 737 Elevator not a mechanically control via the Yoke or is that fed into to a hydraulics system that does the movement?
Bjorn
I have great respect for your experience and writing, but I have to disagree with your conclusion. I have Type Ratings and extensive experience in the 727, 737, 757 and 767 and each one has a non-normal procedure for unwanted/uncommanded stab trim operation, disable the system with the switch.
The aircraft did not crash because of blowback. It did not crash because of the MCAS, the AoA failure or the pitot blockage.
The lives were lost because of inadequate crew training and inadequate crew experience. Contributing factors were the failure of maintenance to ground the aircraft after crew write-ups, MCAS software and airline management.
@Capt Webber. Nobody will dispute that it’s always good to have better trained and experienced crews. But the fact of the matter is that crews with the training and experience levels of the JT610 and ET302 crews have operated millions and millions of flights on the 737NG and A320ceo/neo with a safety record that is 100x better than what the MAX has achieved. The MAX, in its current state, is simply not safe. Telling passengers that they should feel comfortable flying on it as long as they have a good crew is not a solution.
To expand upon my previous point, if you study enough aviation accidents you quickly see that most accidents require an entire chain of unfortunate events to occur. E.g., the flight was operating in poor weather that precluded visual flight, and poor maintenance led to a faulty sensor, and the aircraft was not designed to deal well with failure of that sensor, and the crew was poorly trained or overtired, and ATC was not monitoring the position of the flight, etc. Fixing any one of those factors prevents the crash, so it’s tempting to just address one. But if you’re serious about safety, you attack all of them, because you understand that it’s impossible to fix any single factor with a 100% guarantee of success.
As someone said earlier, all of the holes in the cheese need to line up for a crash to occur. Trying to plug up just one hole (e.g. crew training) is, IMO, a lackadaisical attitude towards safety. The true safety-first approach is to try to plug them all.
I think Jonathon Webber take is from a well trained and experienced pilot.
In this case MCAS unknown, untrained for and not the same signature as a run away stab.
Once confusion is put into the mix then all bets are off.
I was beyond fortunate to survive mine.
Crew training is not a fix to problems that may or may not require fixing and that may occur in one form or another for various unforeseen reasons in the future. Crew training provides a safety net when a problem may develop. When a trapeze artist falls from a rope on which he or she is balancing and plunges to the ground, the cause of the fall is the rope failure. If the safety net isn’t under the rope or the net fails and the artist is killed, the cause of death is the net issue. Yes…the cause of the accident is the rope; before the next show, the rope issue would be addressed. And the artist would have survived for the next show if an adequate net were beneath the rope. Perhaps the rope failure could have been averted with a thicker rope. How thick is adequate…how thick is safe? If you choose a thickness, my guess is that I could choose a thicker still rope that would be safer still. And my guess is that increased thickness will bring into play another set of problems….problems that are hopefully less likely than those caused by a thinner rope.
I am hugely ignorant about flying airliners, but how many living pilots have experience in dealing with a lethal problem?
There are carriers where most if not all their pilots are veterans of their Air Forces. The poor Ethiopian co pilot with only 150 hours of flight hours , probably a very gifted person , would never have managed to land an aircraft on the Hudson River.
@David Kramf
Is it so difficult to get your facts straight?
https://twitter.com/flyethiopian/status/1107312179705991169
–
Now, as for former military pilots now flying civilian airliners; I’m not sure if super-duper Top Gun type pilots would be able to successfully land a Boeing on the Hudson.
https://www.thedailybeast.com/the-unsung-hero-left-out-of-sully?ref=scroll
No disrespect to Capt. Sullenberger or any other Airbus driver, the flight crew community is far from agreement that the AB joystick is better then the B column and wheel.
Nikki Lauda’s comments at a press conference in Salzburg, Austria, comes to mind. At the request of Lauda Air, in preparation for delivery of Lauda’s first 777, the Boeing European sales tour of the of the 777 in the summer of 1997 included a stop in Salzburg, Austria, to provide Nikki the opportunity to show off his new “baby” to the Austrian press at a small, remote airport. The press conference was uneventful until one reporter asked Nikki why he was spending money buying old technology when he could be buying state of the art fly by wire products from Airbus. Nikki calmly replied that the difference between the 777 and A330/340 was merely a reflection of the different flight deck philosophies between Airbus and Boeing and that one was not necessarily better than the other. He then continued with the comment that as a pilot he preferred the Boeing philosophy because it provides him with both visual and tactile feedback of the other pilot’s control inputs, whereas the joystick provides neither.
Some pilots prefer the joystick, others prefer the column and wheel, that’s all.
Also, this is a fallacy.
Unless its an older mechanical system, both Airbus joystick can be programed to act like a Boeing Yoke or the Yoke can be set to act like a joystick,
Its what they do, I call Airbus bump and steer, a yoke is a sport care.
I hated bump and steer (heavy equipment)
I like analog function.
I could run both but preferred analog.
Regardless is in the programing not what the device is.
In some cases the bump thing works and in some cases the yoke works better.
Accident rates between the two types are identical (737 and A320) .
Boeing has a moving auto throttle, Airbus does not.
I liked the MD-11 moving auto throttle, suited me just fine.
Boeing drops the Auto Throttle out as a secondary command in FLCH – Airbus does not.
I like feedback and Airbus does not give you that.
Anyone competent can be trained to fly either system.
@TEW @TransWorld
It appears that both of you may have some serious difficulty with reading comprehension.
The issue here was the ditching of an airliner in the Hudson River — something @David Kramf claimed would have been an impossible task for “the poor Ethiopian co pilot” — and not which FBW system is better.
Just because it appears it might be easier to successfully ditch an Airbus FBW aircraft than a Boeing FBW aircraft in the Hudson — which, BTW, is a supremely rare occurrence — doesn’t mean that the Airbus FBW flight control system (A320, A330, A340, A350, A380) is better than the Boeing FBW flight control system (777, 787).
OV-099:
Perhaps its better to say you have a problem with presentation?
I see your point. I don’t know why any pilot would have a problem flying a 2.5 deg nose up but….
You do know that Sullenberg turned on the APU so he had full control? That is not in the checklist.
Also you have to be aware that it can kick you out of protected mode if the Control Law steps down one step down from Full Control law.
If it did that then full back would be full back.
I don’t have any knowledge if the A320 reverts down one or not.
Movies are often hyperbole.
The movie also has the NTSB as an adversary trying to convict Sullenberg for not turning back to the airport.
That is not their job and it did not happen.
You are at severe risk of spiraling out from fact if you take a movie over the actual events.
That’s like saying some pilots are good welders, its not the problem they were facing. Southwest ex F18 pilot sounded impressively calm ,this obviously helps but only one pilot is known to have beaten this trap, and he was Indonesian and not actually flying the aircraft at the time.
It’s hard to believe that real pilots are throwing dead pilots under the bus like this.
The pilots of the first occurrence e flight (1 of 3) on Lion air also got around it.
Grubbie: As a pilot (or ex anyway) I am sorely conflicted.
I think it was recoverable le but I also feel they should not be put in that position.
Ethiopian had less altitude to work with so that is fully open.
Lion Air 610 had a chance when he pulled the flaps up it went nuts, when he put them down it stopped.
I get the confusion and the issues, but at that point why not get back to the airport?
Is it a fear for job and felt he had to continue and to do so he had to be able to cruise without flaps?
And why not put them down again?
It in no was excuses what Boeing did and how they set the system up.
Standing along it was &^%$ piece of work.
I do agree. It was a calm, clear day with a clear horizon.They should of got the airplane home but the airplane wouldn’t let them do it and them had no training to do it.
Lucky you have the training. But I’m NOT sure you would have got the airplane home.
Captain,
As an experienced and well certified real world pilot with (I assume) thousands of hours behind you, I feel that this is a completely unnecessary and uncalled for comment. You as a certified ATP should know to wait for the outcome of the investigation before calling out culprits.
Also I wish to know is
1.Who certifies these training centers and instructors
2.Who provides the requirements for the training materials
3.If so under qualified, why do these pilots receive licences and is permitted to fly into international airspace?
Aviation laws differ from country to country but an aircraft is standard so training material should all correspond. So should requirements for training periods and required hour completion before being allowed on such an aircraft.
Why only after Lion Air fell to the sea did Boeing say “oh sorry we should have told you about this new feature”
Why only after Lion Air did they put out directives about the operation and overriding of the newly installed system
I’m sorry that our “third world pilots” will have to wait till the inevitable happens before we get notified by the “1st world manufacturers, instructors and regulators”.
It’s not personal Captain, but please wait for at least the prelim report before making assumptions on guilt.
EXACTLY!!! And the impact of the news media picking up on a variety of issues that are “true-true-unrelated” to the immediate cause has led to, if not virtually irreperable, certainly long-standing damage to Boeing, to the credibility of the FAA, and, more importantly, to the hysteria of the public hearing the equivalent of “fire!” being shouted out in a crowded theater.
Hi Jonathan,
we have on average 100,000 airline flights per day in the World. A crew flies something like 3-5 flights per day. This means we have 50,000 pilots flying these aircraft every day, and with rest and vacation rules applied we are probably at 250,000 active airline pilots in the world.
For our air transportation system to be safe we need to design the aircraft and the training to cater for the least capable of these 250,000 pilots when they have a bad day.
The world has changed, air transport is a mass transportation system. The days of getting specially selected and trained pilots for these 250,000 are gone. You have no guarantee on the background of a pilot in all countries of the world and how these are selected and trained. Hence the aircraft cannot put too much onus on the pilots for a safe flight.
If the technical management of the aircraft OEMs/Authorities and their test pilots, who act as proxies for the 250,000 pilots and design our air transport aircraft, doesn’t realize this they shall have other jobs.
Bjorn
You definitely have a point and Airbus has identified that need and builds to it. Boeing does not and perhaps that is a flaw going forward, but I don’t want to get into that debate.
I find it odd that so many people (pilots) with no experience or knowledge of a particular aircraft and its systems are more than willing to weigh in on fault and causation of an accident.
It is true that I have a great deal of experience and have flown over 30 different aircraft in my career as a pilot, so that gives a broad view of handling, performance and perspective.
Systems fail. Procedures are designed to compensate. No AC will ever operate at 100% reliability and even programmers make mistakes so those of us in the cockpit have to be on constant guard for faults in maintenance, personnel and systems.
If a system fails and the crew does not follow the procedure published by the manufacturer, is it the fault of the builder, the designer or the crew? I would submit that the 250,000 pilots who fly every week are doing great work, following company guidelines and manufacturer procedures for system failures or abnormals. Those that do not won’t have long careers.
CJW: I don’t remotely have your level of skill, but I have followed this for a long time
What I do see is day in and day out some realy egregious mistakes by pilots. And I am talking about LCA not weekend types or even regional s., 737/A320 main line pilots and larger aircraft.
Air Canada trying to land on the SFO taxiway not that long ago and got waived off by the planes sitting on the ground seeing them line up on them.
Pilots landing at wrong airports. Pilots programing in the wrong conditions into the computers.
Mexicco a pilot lets a totally untrained person do the take off. AF447.
Are they doing a great job or are we skirting on the edge of disaster?
I know that new pilot training is being done to unusual attitudes as well as the unexpected (speed loss at 35k and the FBW dumping the airplane into he pilots lap)
Indonesia does not meet that standard nor does Ethiopia.
But you back track incidents and you see some pilots got away with a lot over a long time before it bit them (and with a pax bird it bites the passengers)
We had one pilot who insisted he was safe despite endorsing an unsafe continuing operation of the 737 when two crashes had occurred because he did not have Legal Full Jury 100% proof.
That is not safe, that is basically nuts. Its not like adding 1 = 1 and you always get 2.
Its, I don’t like where this is going and I don’t have to crash to stop it going there.
@Capt Jonathan Webber, “The aircraft did not crash because of blowback. It did not crash because of the MCAS, the AoA failure or the pitot blockage.
The lives were lost because of inadequate crew training and inadequate crew experience.” Sorry to say that the crew through the absence of information about MCAS and therefore no training was given in relation to MCAS failure. The crew of Lion Air did not even know about MCAS installed on their plane let alone take steps to disable it. The added problem due to lack of altitude did not give them enough time to go through the checklist and do what is necessary. For the time they had, everything had been done fighting an unknown gremlin, the MCAS system. The crew had a small percentage contribution towards the crash but not solely responsible. If there was no MCAS failure then the crew would not have to combat it to maintain climb and altitude. Putting the blame solely on the operating crew is irresponsible to say the least!!!!”
Captain, now that Boeing has admitted their flaw, do you not think it is appropriate to apologise for your remarks?
The more that is revealed, the more infuriating.
Boeing seems to have not understood what they had designed, and very clearly hadn’t tested the system to fail limits. *Maybe* that was excusable before Lion Air.
In the months after, Boeing failed everyone, miserably. It sure seems the company doesn’t fully understand the product they sold. Or they were so busy covering up for their negligent design that they couldn’t get useable, complete documentation out to MAX owners and their pilots.
Despicable. My confidence in Boeing is gone.
Boeing told the FAA that MCAS was only going to adjust the trim by 0.6 of a degree, but it ended up at 2.5 degrees. This Implies to my unknowledgeable mind that the Aerodynamic issues that they encountered were much more severe than they originally anticipated.
People are getting worried that this is an accurate summary of the situation. If you strictly follow the logical chain of consequences of through, starting with “I don’t trust Boeing or the FAA they’ve seemingly broken too” , you end up with grounding half the world’s airliners and freighters. Not in a years time, but today.
That is probably why the DoT, DoJ, FBI are now involved. Uncle Sam cannot let this one fester by itself, and probably has months at most before others like the EASA start making their own minds up about the trustworthiness of FAA certifications for all types, not just the MAX.
Essentially the US and world economy needs Boeings to be flying, except Boeing and the FAA between them have created a situation where that’s far from guaranteed. I think what we’re seeing is the beginnings of the mother of all stable cleaning operations, driven by the US government who will not want to have to nationalise Boeing to keep it viable.
Ok. That sounds far fetched but as Scott has now realised, these events are unprecedented.
Meanwhile, it looks like Uncle Sam is seriously worried about the future prospects of the MAX in China. Here’s a hit piece from Richard Aboulafia:
https://foreignpolicy.com/2019/03/20/boeings-crisis-strengthens-beijings-hand-737max-faa-caac-aviation-regulators-trade-war-china-xi-trump/
–
So, the fact that you’ve got two examples of nearly new aircraft crashing within five months of each other, within the first couple of years of service, is not a strong outlier?
You don’t need to be a statistician to see the rate of accidents for the MAX is much greater than for the 737NG.
Whereas government regulators around the world decided to ban the MAX from their airspace as a precautionary measure, the FAA and Aboulafia waited for “compelling evidence”. This diametrically opposite narrative illustrates the difficulty of making such a decision in the U.S., where Boeing, the largest exporter in the nation, has a clout it does not enjoy outside the U.S.
Here’s more from Mr. Aboulafia:
https://www.youtube.com/watch?v=i28g-TKKyng&t=5m50s
Mr. Aboulafia is set in his culture.
Invariably people judge actions of others
in scope of their own toolbox.
He is telling us how the US( and/or US corporations ) would act in a reversed situation.
“I think what we’re seeing is the beginnings of the mother of all stable cleaning operations”
One can only hope so.
What saddens me the most is that it probably wasn’t even the fault of the engineering staff, but the management’s. Boeing’s engineers know how to safely design planes and their history speaks for itself. But when management dictates unrealistic deadlines (to catch up with Airbus’ Neo, save costs or for whatever reason), you literally ask for mistakes to happen.
As Seattle Times reports, FAA managers sometimes blindly signed off documents, when the engineers said they didn’t have the resources to thoroughly check them. I guess it wasn’t different at Boeing.
So for a “low staff” Boeing engineer it must be really hard to see his company’s reputation being wasted by failed higher management.
I am hugely ignorant about flying airliners, but how many living pilots have experience in dealing with a lethal problem?
Quite. None.
Eric Winkle Brown, famed RN test pilot, had more than a few scrapes. He attributed his survival to 1) copious preparation, really studying the theoretical behaviour of the aircraft before flying it, and 2) being small enough to curl up into a foetal ball in a cockpit during crashes (ejector seats being uncommon back then).
Why is this relevant? It was multiple eyes on the aircraft design, nothing was held back, a well informed pilot was making a sober judgement as to whether or not to fly, having the knowledge as to what might go wrong and how to tell if it is going wrong and what to do if it does.
Guess what happens without those things?
The more that this deepens, the more sickening it becomes.
And there’s potentially more to it than this. What are the odds that someone (FBI?) is going to take a serious fresh look at the allegations about 737NG bear straps being defective? Pretty high, and maybe there’s the potential for an exposé, or crashes. I mean, right now would you take Boeing’s or FAA’s word for it?
What about the allegations simmering below the surface in the rumour forums about large scale fraudulent paperwork for possibly defective parts all over the industry? No one is currently investigating that one AFAIK, but perhaps it’s best someone goes and has a proper look see.
What I’m suggesting is that this is probably blowing up into a full scale scandal for Boeing and the FAA, and it’s getting blown open by the FBI, DoT and DoJ, not the FAA or anyone else in the industry. That’s a major industry failing. And there’s plenty of potential for another 2 just like it, or worse, extending to the whole industry, which again the industry seems to have no interest in looking at properly. My observation is that if these are properly addressed within the industry it’ll be a lot better than if it’s the FBI unearthing it, with or withhout any more crashes.
Can you even begin to imagine the public reaction to learning that 3 major scandals slipped through the global aviation industry’s safety nets? This current one, if it does mature into a full blown public scandal, is bad enough.
Remember that US prosecutors are on a bonus scheme, top ups for positive results. Word starts going round that the aviation industry is rich pickings for ambitious young prosecutors with high impact factor news coverage, and well you can imagine that for yourself.
My view is that the judiciary are still to some extent in thrall to the aviation industry and the magical ability to take flight. There has been a consistent thread of OEMs being given the benefit of the doubt in the event of accidents. Sometimes this is warranted.
I have always disagreed with the get out of jail free card.
No one asked me though.
If it was criminal, then there should be criminal penalties.
Exon Valdex captain claimed his notification to CG they were aground was self reporting and he should be held blameless.
Drunk, hung over, and he walked.
WOW! It is like a positive feedback issue. Seems like that the wings and engines were changed, but not the elevator and horizontal stabilizer to be resized for new aerodynamic loads?
Good summary! This is mess!
On one of the aviation forums I read that the Brazilian authorities had identified risks for the 737MAX around the MCAS at service entry and mandated specific training to counter.
Not sure if this is B*ll.. Anybody in the know?
I have read that they didnt like that the MCAS was not included in the pilots manuals. They demanded that Boeing included a description of the MCAS system in pilots manuals so the Brazilian pilots turned out to be the only one beeing aware of the existence of this system. Quite possibly they demanded additional training too as you are suggesting. But any sim training on MCAS was not done due to obvious reasons. (lack of Max sims with MCAS functionality to mention one reason)
Whether the authorities didnt like the MCAS system in its own I do not know.
Thank you Steinar. Let’s assume that the Brazilian response was limited to the addition in the pilot manuals as you mentioned, shame that this did not filter through the international network to other agencies..
And more so, get Boeing’s attention.
I suspect they did not think of it, that is why. Engineers are not pilots..
The TOP task set to engineers was “get the MAX certified” and probably not create a save plane even if it would require a new type certificate. Boeing builds planes for profits and not for pilots :-))
They have this nose heavy beast with the huge aero effect of engines (I assume if they were worried about the nose up tendancy, the nose down tendancy is just as bad or worse) will they have to redesign the entire tail plane? They need full enevelope protection for this thing.
“will they have to redesign the entire tail plane?”
They already redesigned the tail cone for better aerodynamic efficiency ( openly for efficiency reasons bringing 1% )
but under the hood probably as stealth improvement on stab authority.
We probably have to revisit all things “done to improve on cost” for hidden stealthy tasks set via the aero problems of the 737MAX.
What about he existing -700? Would the 7MAX based on the -700 have these downsided in an elevated manner?
Is that another reason to derive the 7bMAX from the 8MAX and only shorten it by a lesser amount?
It is fun lifting lids and see the boils 🙂
Do the engines have the same effect of accentuating a dive as they do a climb? This could also explain why they plunged!!!
Only way the engines could cause a pitch down moment is if they were throttled back so they no longer produced enough thrust to maintain the flight condition. Remember, the the thrust force is acting below the aircraft CG.
yes but the plane is designed to fly level under power and takes into account the thrust. So when it is at a high – angle of attack would they not act like an additional aerodynamic surface and push the nose down? (just as they do in a climb and why the develeloped MCAS)
Just like the engine contribution to the positive pitching moment only becomes significant at large positive AoA, the engine contribution to the negative pitching moment only becomes significant at large negative AoA. Transport aircraft are not a all designed to operate at large negative AoA, so it is not really possible that the anti-lift of the engines contributed to the dive. Even in steep dives the AoA is typically close to zero for transport aircraft. Fighters are a different story.
Its possible that I will get a million dollars in 5 minutes but not likely.
I am not sure why this spiral out to assess aerodynamics on an airplane when there is no facts to support it is taking place?
Ref AoA sensors reading incorrectly on the ground. They probably will. There’s little slipstream to move them while taxiing. And on the aircraft type I fly, I often notice during the pre fight walk around check that they have been fully deflected if reverse thrust was used on the previous landing. The Max has engines mounted further forward that earlier B737 types. I wonder if reverse thrust is damaging those sensors.
All these comments remind me of the proverb “a little knowledge is a dangerous thing”
You nailed it, TEW!
Bjorn does these phenomenal write-ups and so few of the comments reflect any understanding of the content.
The only stupid question is the one that isn’t asked.
MCAS based one one input, nobody asked is that really a good idea ? Maybe it would have been considered a stupid question.
Thinking out of the box often is triggered by a seemingly irrelevant idea or question.
@TEW
Your response to my comment up-thread (i.e. landing in the Hudson), reminded me of the proverb “I’m only responsible for what I say, not for what you understand.”
Next Prediction:
With the Mueller report out, Boeing gets a break, the fix goes in and its back in the air in another 6 weeks (there is some deep irony here of course)
Maybe 3 months to load the fix, training, put in the light or activate it and unravel the grounding around the world
Stay tuned.
Did the pilot retard the thrust levers from climb thrust? If they did not that would explain the high speed and eventual inability to counter act the misplace stabilizer trim. My experience is that most pilots today can manually control the pith and roll but not manage the thrust at the same time, they’ve become auto throttle cripples. Will be interesting to know what the flight data recorder reports regarding thrust lever positions.
If they had reduced power to a normal N1 setting for say 250 knots clean wing, perhaps they could have made th3 return to base.
The analysis and many comments are very interesting, but, in relative ignorance, it seems to me that the most proximate cause of the accident is raised in an earlier posting by Bjorn with respect to the accident: “Why the pilots didn’t use the trim cutout switches to shut down MCAS trimming, we will learn from the voice recorder read-outs.” It seems to me that whether the trim problem is a runaway trim or an improper MCAS input commanding activation of the trim resulting in an adverse situation despite, I presume, no other indication of a problem, the solution is to shut the trim off as was done in the flight before JT610. Certainly the analysis is more than interesting,,,it’s vital for improving the system and decreasing the probability of a recurrence. Unfortunately though accidents will always happen and widgets will malfunction. It seems that unless a “smoking gun” is uncovered that relates to Boeing and/or the FAA, if Boeing has complied with the certification process and regulatory requirements, the hatchet job that is being done to Boeing as well as the fear and hysteria being created in a public more ignorant than I is unwarranted. Yes…fixes may be needed, but if an airplane requiring 2 pilots is effectively being crewed by a single pilot and that pilot may not understand, whether through a training deficiency or some other factor, that when a system malfunctions, the first step might be to turn it off, when a malfunction does eventually occur, trouble will ensue.. And how safe is “safe?”
For as long as I can remember its always been we need the CVR or the DR and that solves it all.
All the CVR will tell you is the pilots were confused.
More useful in most if not all cases would be cockpit viedo to see what they did.
While the data channels are so chocked full, we know exactly what the system saw.
That is not necessarily what was done (767 crash, yes the system saw a nose down command, but what caused it?)
Clearly the pilots did not recognize what was going on nor were they trained for or on it and then its up to someone being able to detach themselves enough to make the logic leap and turn off STAB.
One crew did, another crew had help, two crews did not.
And as it was two different airlines?
With higher US standards and training maybe avoided here but we don’t know as non occurred here.
We have seen some well trained pilots do some god awful stupid things.
Hi Bjorn, good analysis. You may be on to something.
I do have a question though. I thought the crew could always trim against the MCAS. In fact, toggling the trim switches was supposed to stop MCAS action and reverse the stab movement caused by MCAS.
If this is true, how did the jack screw windup at the limit of its travel, stab nose up, airplane nose down?
With the crew trying to pull the nose up, they would have been holding a considerable aft column force. Wouldn’t the crew have been trying to use the trim switches to relieve the column force by moving the stab nose down?
Moving the stab would have been away of overcoming elevator blowdown due to high dynamic pressure. Or do you think the stab was in an aero lock as well?
Hi Bob,
we have the FDR traces for JT610 and we know why it didn’t work for them, too short blips on the trim switches by the FO. IMO it’s difficult to feel when the aircraft is trimmed when the AoA goes to >22° as you have stall ID and the Synthetic feel system displaces the neutral point forward and increases the stick force first four times but then more if I remember correctly. So your natural Yoke feel for when you are trimmed is gone, you have a strong forward stick force even when trimmed neutral. It’s difficult to fly nose level with a miss-trimmed aircraft, now imagine your problems with a deliberately moved center point and stick forces making “flying the aircraft difficult” (JT043 FO comment, read the report). The system says not only you are close to stall (MCAS goes active say above 10°) but you are deep in a stall (stall at 14°, you are at >25°), so the 737 is forcing you to nose down with all its means and you must hold against while the Stall warning is rattling and the Master Caution is blinking. The MAX is also a very noisy cockpit and you are now flying fast at low altitude (= high dynamic pressure) so the wind noise is very loud. It’s a hell of an environment for thoughtful analysis of what to do.
Why the ET302 crew lost the game we will know in due time but I think the above can at least show the Captain with a rather fresh FO didn’t have may seconds for thinking. He did what the pilot mantra says “Aviate then Navigate/go fault finding”. It didn’t work this time, IMO Blowback caught him out before he had the altitude to start being clever.
Still, if you look at the JT610 traces you supplied, the Captain trimmed continuously and seems to have remained in control of the situation. As you point out, when the First Officer took over, pilot initiated trimming was more limited and the situation rapidly got out of hand. Why did the First Officer stop trimming in the same fashion as the Captain had done?
In any case, the frequency of AoA failures is troubling. The apparent failure rate is so high it probably invalidates any number of certification failure analyses.
As with any accident, there are undoubtedly many factors involved and it would be best to wait for the final report before speculating too far.
We will never know for sure why the Co pilot did not trim aggressively.
We do know there is major confusion withing the event and the Pilot may well have had a better handled on the aircraft orientation and the co pilot much less sure.
The third jump seat pilot on the previous flight saw what was occurring and got the STABs burned off.
In the case of AF447 the Chief Pilot did not see what was going on until way too late.
No training on what they had and the confusions leaves you in tghe leaps of comprehension that are extremely difficult and impossible under the circumstances to reach.
Lino Pilot put the flaps down and stopped it on the last flight only to pull them up again never to put them down again.
I can’t answer why he did that either, he got it stable with flaps down with equipment and its a mantra to me, once its stable don’t screw with it,)
You will see a training aspect that has pilot trouble shooting rather than hold the door now and let em trouble shoot it on the ground as well.
Below are two excerpts from previous of my comment posts to different articles on this subject on this fine web site. I am now starting to think that the answer to the first is negative responses to the second.
If it was learnt some time ago as a result of the Lion Air accident that flying with a certain faulty sensor can result in inputs to a certain airplane system that results in enough difficulty controlling the airplane to cause an accident, and that if that certain airplane system for any reason creates difficulty in controlling the airplane it can and is to be shut off a certain way to allow control of the airplane, then how could another repeat accident take place? One would think that knowingly flying with the certain sensor being faulty would be precluded, as well as having the certain airplane system cause difficulty controlling the airplane for any reason for any significant instance also precluded.
With all the freshly minted A320s and 737s being cranked out, is there always a seasoned or freshly minted set of QUALIFIED pilots for each plane when it is in service? Both airplane production lines are pumping out planes at record and increasing rates. Have the increases in numbers of qualified pilots to operate them been able to keep up? Same question can be asked about maintenance personnel.
Hi Bjorn. Although it can be demonstrated that in the sim elevator authority for pitch up still exists at the nose down trim stop, do you think it would be less likely to be actually attained in the presence of the EFS, multiplying the required column force by several times? My understanding was that in JT610 the AoA fault had also triggered EFS. Could this be contributing as well as blowback?
Hi Wayne,
EFS is a feel system, nothing else. It shouldn’t limit elevator travel, you just have to pull against a higher force if stall ID is triggered. But if you feel the aircraft is nosing over, be sure these guys can pull the Yoke to the stop, it’s just the stop will be earlier and earlier due to blowback if your dynamic pressure is high enough. In the Draken we got 2G instead of normal 6G when coming into blowback territory which was over M0.92 (if you were in a half loop it wasn’t too nice).
I am surprised to know that the elevator in the 737 cannot fully override the trim in normal flight conditions. In all the light airplanes I flew as a private pilot it can.
This video by a B737 captain states this with these very words and mentions that in the 747 the elevator CAN override the trim.
https://www.youtube.com/watch?v=xixM_cwSLcQ
It seems like a slam-dunk requirement, since the trim can “run away” and crash the plane quickly, especially at low altitudes. The instinctive reaction of *any* pilot if the nose is point up/down in the wrong direction is to use the yoke to correct it, regardless of what else is going on for you may not have time to troubleshoot problems.
Indeed, my reading of FAR PART 25, sections 173, 239 and notably 255 seem to indicate that.
My question is this: why has the B737, including the NG, been certified if it clearly breaks this assumption?
FAR §25.255 Out-of-trim characteristics.
(a) From an initial condition with the airplane trimmed at cruise speeds up to VMO/MMO, the airplane must have satisfactory maneuvering stability and controllability with the degree of out-of-trim in both the airplane nose-up and nose-down directions, which results from the greater of—
(1) A three-second movement of the longitudinal trim system at its normal rate for the particular flight condition with no aerodynamic load (or an equivalent degree of trim for airplanes that do not have a power-operated trim system), except as limited by stops in the trim system, including those required by §25.655(b) for adjustable stabilizers; or
(2) The maximum mistrim that can be sustained by the autopilot while maintaining level flight in the high speed cruising condition.
(b) In the out-of-trim condition specified in paragraph (a) of this section, when the normal acceleration is varied from +1 g to the positive and negative values specified in paragraph (c) of this section—
(1) The stick force vs. g curve must have a positive slope at any speed up to and including VFC/MFC; and
(2) At speeds between VFC/MFC and VDF/MDF the direction of the primary longitudinal control force may not reverse. (c) Except as provided in paragraphs (d) and (e) of this section, compliance with the provisions of paragraph (a) of this section must be demonstrated in flight over the acceleration range—
(1) -1 g to +2.5 g; or
(2) 0 g to 2.0 g, and extrapolating by an acceptable method to -1 g and +2.5 g.
(d) If the procedure set forth in paragraph (c)(2) of this section is used to demonstrate compliance and marginal conditions exist during flight test with regard to reversal of primary longitudinal control force, flight tests must be accomplished from the normal acceleration at which a marginal condition is found to exist to the applicable limit specified in paragraph (b)(1) of this section.
(f) In the out-of-trim condition specified in paragraph (a) of this section, it must be possible from an overspeed condition at VDF/MDF to produce at least 1.5 g for recovery by applying not more than 125 pounds of longitudinal control force using either the primary longitudinal control alone or the primary longitudinal control and the longitudinal trim system. If the longitudinal trim is used to assist in producing the required load factor, it must be shown at VDF/MDF that the longitudinal trim can be actuated in the airplane nose-up direction with the primary surface loaded to correspond to the least of the following airplane nose-up control forces.
As Bjorn quoted in the article:
Obviously, different 737 pilots do not agree on whether or not the elevator can still pitch the nose up when the stabilizer is in the full trim position forcing the nose down. Bjorn makes it abundantly clear that the answer to this question depends very much on airspeed and altitude.
If you read my article you will see there is disagreement regarding the elevator being able to hold a full nose down stabilator trim. I have talked to airline’s flight safety departments who has rigged a 737ng simulator like Mentour pilot’s with full nose down trim from takeoff, climb, downwind and landing. You can control the aircraft. I have watched Mentour pilots videos, they are well made and he’s a good teacher, worth watching. But I’m not sure he meant uncontrollable after takeoff and in a typical low altitude circuit. His stall video is at FL350 which is a totally different ball game to circuit altitudes.
Ask him if he has really flown the full nose down trim at airport circuits heights and speeds in the simulator (high air density and adapted speed), then we need to find out why one airline says it’s controllable and he says it’s not. But no shadow on him, good stuff.
I have the same questions regarding showing compliance to 25.255. I am not well versed in these aspects and have no knowledge of the Boeing tests or results. The FDR data should show any elevator loss of authority to command Versus aero loads. I expect the Indonesian Final Report on JT610 coming this summer will have data and analysis on these points. The removal of the aft column cutout switch for MCAS allowed the stabilizer to “mis trim” in spite of pilot column input, which opened the door for the loss of control. That alone would have likely prevented the nose-dive and avoided any concern over flyability in a high speed dive. The failure to trim nose up in the dive appears to be human factors.
Thanks Peter: I have been reading your site on this as well.
The stabilizer trim cutout switches are on the _centre_console_ aft of the throttles, near the right stabilizer trim wheel, on all 737s and probably earlier Boeing narrow body jetliners.
Check http://www.b737.org.uk/mcas.htm for example.
The pilots’ trim command switches are on a horn of each control wheel, which is on top of the control column. There are two that must be activated together, that’s a safety feature in case
On the center console just aft of the throttles are two stabilizer movement wheels, IIRC with fold-out handles (note the spring in some photos of them), to trim if electric power is lost. (So I expect that the crew can still move the stabilizer if power to the jackscrew motor is removed by the cutoff switches.)
I’m still struggling with the issue of proximate cause of the accidents. It seems that, as has been pointed out, that every accident will have multiple factors, many of which might have contributed to and, if previously identified, averted the accident. Everything in Life, including airplane design, is about iteration and tweaking systems. All of the discussion is grist for the engineering mill. Should they have been addressed before the accidents?…after JT610? Perhaps. Presumably that will be argued in one court or another. As for the problem faced by the pilots in the two accidents given the design at the time of the accidents and as for all the discussion about redundancy and AOA displays, I am reminded of a line in the movie Bridge of Spies in which someone is facing possible capital punishment; when asked by his attorney if he’s at all nervous, his response is “would it make a difference?” So while tweaks to the MCAS system and other possible factors such as what has authority over what and when may have made a difference, it seems to me that the bogus contention that Boeing puts profits over safety because this or that indicator wasn’t provided except as a paid-for option does not address the proximate cause. If an airplane experiences a rapid decompression and the pilots fail to don O2 masks, is the immediate cause an engineering deficiency in a window design or the failure to reflexively react to an emergency as trained? Is the MCAS failure significantly different from a runaway trim so that the response should be different? Won’t blowback occur in a 737NG with an unaddressed runaway trim? To quote Bjorn:
“Why the ET302 crew lost the game we will know in due time but I think the above can at least show the Captain with a rather fresh FO didn’t have may seconds for thinking. He did what the pilot mantra says “Aviate then Navigate/go fault finding”. It didn’t work this time, IMO Blowback caught him out before he had the altitude to start being clever.”
Isn’t blowback an equivalent of a rapid decompression with similar consequencs if not reflexively addressed? I am in awe of Tammie Jo Shults….but then all she really did was perform as she had been trained to perform.
Thank you for your enlightening analysis.
Also, see Bjorn’s reply to Kant up thread.
https://leehamnews.com/2019/03/22/bjorns-corner-the-ethiopian-airlines-flight-302-crash-part-2/#comment-261568
There is something disturbing about some of these comments that in essence say, “Pilot error. Case closed.”
If your goal is finding who to blame, that’s a fair argument. But if your goal is to prevent as many crashes as you can and save as many lives as you can, you should be concerned with whether parts of the design make pilot error more likely (clearly it does starting with mismatched engines).
Humans as fallible, even with the best training. The best think we can do to save lives is shut as many holes as we can while the aircraft is on the ground.
Anastasia… Yes. There should be more than one goal…to understand and to correct possible issues that led to the malfunction…to understand what, in the face of the malfunction, caused ground impact. I would maintain that, in the interest of overall “safety,” that while these issues are being sorted out, another goal of responsible people is to not create a degree of panic by providing statements that may be accurate but which, in being stated in a certain way, is creating an impression that may be untrue (or possibly true…time will tell). Holes should be fixed on the ground, yes. But just as humans are fallible and will always be fallible (at least for the foreseeable future), holes will always exist. My sense is that no matter how many holes you may find and fix, I will be able to find one more. David Kramf states above in referencing ET302: “The total flying time of the First Officer is 350 hours. Moreover; the Pilot in command is a senior pilot who has accumulated 8,100 hours.
According to ICAO regulations any CPL holder can act as F/O in multi engine jet commercial flight up on successful completion of the full Type Rating training on the type of A/C. According to ICAO, it only requires a maximum of 200Hrs to hold CPL. Ethiopian airlines in its effort to enhance safety established a crew pairing policy where by a less experienced F/O flies only with highly experienced Capt and vice versa.”
Perhaps pairing a novice F/O with a senior captain is sufficient for nominal conditions as a method designed to provide apprentice experience and instruction. But is it sufficient in non-nominal conditions? How useful is an inexperienced F/O in a situation possibly requiring reflex reaction? How did ICAO determine the 200 hour requirement?…based on what? Just as for every hole you might be able to find, I could probably find one more to plug, for every minimum flight time requirement, my sense is that if I increased that requirement by one additional hour, I would make the crew incrementally safer especially in the event of an adverse event. I would maintain that had the MCAS problem with ET302 occurred but didn’t result in ground impact as a consequence of the failure of the crew to react properly in an emergency, holes would have been plugged…on the ground. Perhaps not with the same urgency but plugged nonetheless. I would further maintain that the holes would have been plugged with far less unjustified hysteria and damage in so many ways that was created by false impressions based on factually accurate statements taken up by a press hungry for sensationalism and conspiracy theories. I would maintain that flying safety would not have been compromised by plugging the holes without providing “true-true-unrelated” statements. And if you truly want to plug holes that led to the loss of lives in addition to those that would better tweak MCAS, perhaps you should look to the issue of ICAO required pilot experience. Perhaps a 200 hour F/O in the cockpit of a 737-whatever when a malfunction occurs is just not sufficient. But, while I’ve heard comments about the experience level of the F/O, the intensity of those comments has been rather muted in contrast to many other comments. If one is serious about plugging holes, perhaps this is a non-equipment one that should be addressed as well and which is possibly more relevant to the outcome of ET302.
I just don’t see the logic in this argument, training is what counts.A green FO who has been properly trained on the function of MCAS is much more likely to be useful than a grey haired veteran who has completed thousands of flights and didn’t even know it existed.Bjorn used to be a test pilot and he is only just beginning to understand what happened. The other thing is that there are things that no humans can do when they are under pressure and something isn’t working as expected no matter how experienced and calm in a crisis.
Nolo contendere. But Grubbie, while I certainly agree that training is key, clearly experience counts. One surrogate for experience in flying is hours flown…it’s used for many aspects of qualification. Would you be comfortable with a 40 hour pilot sitting next to you who had 40 hours of training?…50 hor pilot? You pick a number. Your argument would suggest that hours of experience should not be used at all. You may be correct, but given my experience and observations, that seems to me to be illogical. Nonetheless, it doesn’t alter my questioning about the minimum qualifications for F/O as defined by ICAO. That said, while training may be important, it seems to me that the experience of someone who has “been there, seen that” might also be important regardless of hair color. Perhaps the combination of training and experience? And don’t you think that even if someone who. hypothetically, hadn’t been “properly trained on the function of MCAS” but had seen a bunch of ducks in his/her life might be in a better position to utilize the duck test when observing and reacting to a problem not specifically previously encountered?
What do I know?I’m not a pilot but for an experience to be of any benefit first you have to survive it,I very much hope that there aren’t too many airline pilots who have almost crashed.When driving a car you learn with experience to look both ways when merging onto a one way street,I would like to think that there are very few or no opportunities for an airline pilot to learn from near disaster or a crash where no one is hurt.From reading these articles, I gather that trim runaway is either a very rare or a non existent problem.I would have thought that a freshly trained young pilot would be just as likely to remember what to do as a veteran who had never encountered the problem.
Grubbie…. What you should understand is that the grey-haired veteran has to go through recurrent training with the same frequency and involving the same emergency procedures as the young F/O who is “freshly trained.” I, for one, if encountering an emergency, would want the assistance of someone less freshly trained but more repeatedly trained. Repetition leads to habit patterns and rapid reaction in emergency situations.
Hours of flight means nothing, 8,000 hours in cruise mode is not the same as 8,000 hours in a challenging take off and landing environment.
As for old gray hairs, we have also been through and survived a life times worth of incidents that we have survived.
It does not man a young guy is better or an old guy is worse or visa versa.
I will take the old calm guy any day of the week.
Fighter pilots were best when they had a couple hundred hours of combat flying under their belts even though the US side they tended to ave 300 non.
Newbies dies fast or learned.
The other side which has low time pilots lost them like quail in a hunt where the flock is surrounding by shot gunners.
New infantry dies fast or lived. Old guys stayed away from them (until they became old guys)
Good fighter pilots survive and bad ones become extinct. There is not the same opportunity for evolution for an airline pilot they don’t have sufficient attrition rate and most never even experience a really hairy incident.There is a small attrition rate from sacking,but I don’t think that it’s enough to make much difference. Having had the experience of landing on an aircraft carrier like the South West pilot is probably helpful in remaining calm and focused in a stressful situation but it’s also a sign that you were selected for your superior talents in the first place.I am not saying experience is of no value at all,but I don’t think it’s going to make much difference to my chances of survival as a passenger.
You might want to query Sullenberg passengers!
Realist its some and some. The good ones are good and the bad ones can be bad.
The C-17 crash at Elmendorf was a case of an experienced pilot taking it close and closer to the edge until he stalled it out.
I had the total no joy of doing helicopter insertions on a survey. The hot dog guy fresh home from Nam almost killed us once and tried to be a weed whacker with the blades another time.
The older non combat guy never came close.
Good hard simulator training should sort it out but it has to be aggressive where you are looking to see how they handle a totally unknown and unexpected crisis.
And what do you do with and about the shrinking pilot pool?
Actually the more that I think about it logically, the less I worry about not having a superstar,legendary veteran pilot.The odds of having to land on water are incredibly slim and the odds of surviving it are much slimmer,with all of his skills and experience Sullenberg was lucky to get away with it because the water was flat.
The matter is progressing rapidly from one of, “what made these planes crash?”, to, “what has gone so badly wrong in the certification process?”.
It’s now very clear that there’s major problems with MCAS and that its misbehaviour can precipitate disaster. Bjorn’s article is likely the best explanation yet as to what the chain of events are.
The fact that it’s Bjorn working this out, and not the FAA / Boeing doing so, is the problem. Boeing should have known about this before they even began to think about certification. The FAA should have worked it out too as part of certification, and rejected it. Both should have been able to work this out as part of the Lion Air investigation, but didn’t (or didn’t warn pilots at anyrate), probably a major contribution to the most recent crash in Ethiopia. Neither after the Ethiopian crash saw reason to ground the aircraft, despite clear evidence being available immediately that the two flights had a lot in common, therefore a common cause could not be discounted.
When you start adding in other factors like Boeing misinformed the FAA about the extent of MCAS’s authority, and what you have is total uncertainty as to whether or not the aircraft is ever going to be fit to fly. What else didn’t Boeing mention? What else did Boeing not know?
So in a sense MCAS itself is now irrelevant. It’s the poor certification process that’s the real problem. And what that means is that the aircraft may never fly again. It also raises concerns about other certification campaigns – 737NG, 787, the new 777x. By strict rights, other authorities like EASA could justify grounding all Boeings built since the mid 1990s, because there’s now questions to be answered about the FAA’s competence to oversee a manufacturer like Boeing who, let’s face it, have had persistent rumours of poor practices circulating around them over the past years (737ng bear straps being one example).
The fact that the DoT, DoJ and FBI are now looking into it with some haste probably means Uncle Sam has sensed the danger to Boeing, realised that Boeing must be saved, but probably can’t be saved whilst the current management are in post and the allegations are not cleared up or proven.
It’s going to be a rough ride.
I agree with much of what Matthew writes, but…. Much of this discussion might fall into the category of Monday morning quarterbacking. Yes…it would have been great if the problem would have been addressed before the game. Perhaps the airplane should have been grounded after JT610. I don’t think so, but perhaps. It has been grounded now. I disagree with a decision that seems to be accommodating the public’s fear, but perhaps I’m wrong. While the analysis here is relevant and a rational analysis of the MCAS problem, I don’t quite understand why Mathew believes that the FAA and Boeing has not worked out the problem as well. Did I miss something? Perhaps the DOJ’s investigation will investigate whether “Boeing should have known about this before they even began to think about certification” and whether “[t]he FAA should have worked it out too as part of certification, and rejected it.” Or maybe they did know about it and suppressed the information, a contention to feed that conspiracy theory fire. Does anyone know about other problems that have developed to other airframes and systems post-certification that shouldn’t have been known prior to certification? And did I miss the fact that “Boeing misinformed the FAA about the extent of MCAS’s authority?” As for addressing the issue post-JT610, isn’t that what FAA emergency Airworthiness Directive (AD) 2018-23-51 did? Were the pilots not trained on addressing a runaway stabilizer? Did they not know that when there’s an obvious system malfunction the proper approach is to shut off the system? I for one find that most instruction manuals that come with items I purchase are replete and, in many instances, are only about warnings such as “electricity may cause a shock” or “the saw may cut you.” Duh! It seems to me that if I have a space heater that’s smoking, I wouldn’t refer to the operation manual or throw water on it or grab a fan to cool it down. I’d pull the plug! Obviously the heater is malfunctioning, but I’ll analyze that after I pull the plug! Perhaps we’ll discover that will indict Boeing or the FAA. I personally doubt it but don’t know. It’s hard for me to believe that Boeing, as has become the mantra by some, puts profits ahead of safety since Boeing’s safety record is directly related to profits…they’re one and the same. We’ll see. But, as for what immediately led to both ET302 and JT610 impacting the ground, it’s because no one pulled the plug.
Fred:
I will address the last part first. Profits vs Safety.
This has been done so many times that I don’t understand that you don’t get it. Its not alwyas on the levels of 347 (counting the dead diver) dead, but it happens.
As for Mathew: We have seen a great deal if wrong understanding even when specific data is delivered.
People spiral it out of what is there into their own agenda and belief system.
Some call the 737MAX unstable when in fact its proven to be highly stable. Someone they take on spot in an extreme edge of maneuvering no pilot will see in his lifetime and contravert it into apply to the aircraft at all times.
Or theories about the tail undergoing new hither unheard of aerodynamics with less than zero evidence of any sort to support it. The same person does not understand stabilizer and elevator operations.
You can only sum it up.
To speculate is human and to make wild extrapolations with no supporting data.
To come up with conspirator theories follows in its footsteps.
Causing Death:
Ford with the exploding Pinto gas tank that they covered up. China where they put pure poison in the food (knowing it will keep people and the backlash that engenders) – it happens all the time, one little bean counting saved expense and off it goes.
Maybe the Psychologists have a word for it, but the reality is it does happen and happens often and regularly.
Training:
The Post Lion 610 did address it, but it looks like it did not take. Thee is no simulator that was programed for MCAS (and maybe they still are modeling all the behaviors ). It has to work exactly like the real thing to be effective. Ethiopian pilot was supposed to be trained but his last sim session was before Lion 610. So it looks like a paper exercise.
Wow , and now we ground every Boeing ever made.
This truly has gone off the rails.
Trans… I am not naive. I understand the force of profits and many of the possible examples of the profit pressure from Pintos to airbags. However for Boeing profits have to be synonymous with safety. Part of the problem with respect to all issues when we use words such as “safety” is how to define the word. As I’ve asked before, how safe is “safe?” Your safety might not be mine. I feel certain that I could define a measure to make anything you define as “safe” incrementally safer. In certain instances we can define “safe” by a statistical analysis of outcomes and where we can define the discriminatory line between what we accept as safe and what is not. In other instances we don’t have the statistics fully developed and have to make inferences. But there will always be unanticipated untoward events and unintended consequences of the fixes for the untoward events. A college mathematics professor of mine was the chairman of the committee that investigated Three Mile Island. At the conclusion of the investigation, during the conference that ensued, he asked the question, “how much are you willing to pay for an extra decimal point of safety?” So, yes, there is a possible inverse relationship between profits and safety. But the question he asks also asks the implied companion question…how safe is “safe?”
As for the sim and training issue, it seems to me that Emergency Airworthiness Directive (AD) 2018-23-51 addressed the problem and essentially defined it as a runaway stabilizer, certainly an event for which the pilots should have been trained even prior to JT610.
Perhaps there but for the grace of god…because I make far too many mistakes and use far too many erasers. And when I go to the bathroom my stuff smells like anyone else’s. But I resist the temptation to blame the toilet bowel for the stench.
Bjorn’s analysis has been extremely helpful in understanding the forces at play. And I am reminded of my involvement of an accident investigation in which I was involved when in the Air Force. It was an F-101 that plummeted into Lake Erie after experiencing pitch-up during an exercise. The pilot recovered by pulling the chute but then apparently tried to unload the jet a bit too much and reentered a pitch-up condition this time without the chute which had separated. The WSO ejected when he saw the 15,000 ft min ejection altitude. The pilot did not. Only a single person died, but was it the fault of the airplane that he died? Should there have been a second chute to pull? Seems to me the solution was to eject at 15,000 ft.
I take it your descriptive phrase “Monday morning quarterbacking” is referring meaning my post is largely hindsight? Yes, I freely confess to that; I’m not in the industry, so I don’t get prior sight of the inner workings of the Boeing / FAA gestalt, etc.
However, as an experienced systems engineer, I know full well the value and importance of doing things like FMEAs during development. They’re a standard tool for gaining foresight into what a system might do. One does them to save money, make sure the system will do what you want it to, and will behave in known ways when things do go wrong.
MCAS is pretty simple minded, so doing FMEAs for it is pretty easy. For illustration – there’s been many commentators in these pages point out the lunacy of running this thing off just one AoA sensor.
Yet everything I observe in organisational behaviours and information disclosures for MCAS gives a strong hint that Boeing / FAA are themselves playing catch up with the role of MCAS in aircraft safety. They’re behaving as if they’re operating without the benefit of any foresight at all.
Now forgive my presumptiveness, but my understanding of the job of the FAA and Boeing’s engineers is partly to gain as much foresight as possible into what an aircraft will do. That’s what certification is supposed to be about.
The implication is that the certification process just isn’t working as it should do, nor is the incident management side of things either. And when one digs around a bit, it seems that this is actually a commonly held view. You also dig up the NG bear strap stories, 787 issues, etc.
The EASA, etc grounding MAX was unprecedented, and can be interpretted as them effectively giving Uncle Sam an ultimatum; sort out the FAA and it’s certification prowess, or we’ll be forced to reach our own conclusions for ourselves. That would be guaranteed to kill Boeing commercially, which in turm would be a disaster all round.
@Matthew
I think both Canada and the EU have lost all faith in the FAA. They already announced that regardless of FAA approval, they will do their own, in depth analysis and review of the new plane and the fix. They specifically mentioned concerns over fitting the new large engines on a plane model designed 60 years ago and having to use software to compensate for the forward placement of the engines
thanks Mathew. At the outset, I confess I’m not an engineer. I also confess that I’m also not well versed into the workings of MCAS, but… Redundancy is virtually always desirable. But it seems to me that redundancy with respect to keeping a system functioning is always desirable but that redundancy in input to a system may not be desirable. It may be that MCAS monitors a variety of inputs related to AOA to confirm a valid result. In that case, I would admit that an additional AOA input would be desirable in the confirmation algorithm. But if it only uses input from AOA, it would seem to be that if there were a discrepancy between the two, I would want the system to default to the one providing information that can deal with the more critical situation. In the case of the two accidents, another AOA input would not have made a differnce. Admittedly I may be wrong since it seems Boeing is going to modify the system for two AOA inputs, and I can only surmise that there are therefore other inputs to the MCAS to confirm which input will be the valid one. I guess I don’t quite see the lunacy though depending on the system design since, as I say, I would want the default to be to the input reflecting the more critical situation, an input the pilot could disregard (i.e. shut the system off) is not fully confirmed.
I’m not certain what leads you to believe that failure analysis was not adequately performed in advance of certification. Is it that the system failed? It seems to me that if FMEA insures no failures, there would be no failures of systems that went through FMEA analysis. Is that your contention?
We commentators are commenting with incomplete information. I put myself in that category. And as for the chain-reaction gounding, I attribute that to many of the shoot-from-the-hip comments that are picked up by the media that lead to fear that leads to peiple not wanting to fly in a perfectly safe (my definition) airplane. The press creates perception which becomes reality. And then the perception, if the airplane isn’t grounded, is that the regulatory authorities don’t give a damn about the safety of passengers. On top of which, Boeing is in a no-win situation since any comment (if they could make a comment in the face of a variety of actual and potential legal actions) would be interpreted as being naturally defensive about an “unsafe” airplane. Again, perception is reality. It seems that the default position that everyone in Boeing is either an idiot or is sleeping with the FAA…or both! The feeding frenzy has created an injured and bleeding company based on the accurate fact that 2 of its airplanes crashed leading to the possible falsity that the crash was a direct consequence of unsafe airplanes.
Its about ready to test
https://www.voanews.com/a/us-airlines-visit-boeing-as-faa-awaits-737-max-upgrades/4845663.html
We should simply let this play out.
FAA and Boeing are going to and are now getting raked over the coals.
We hopefully will come up with a review process that looks at a certification’s at least to the degree Brazil did.
Is anyone saying Canada, EASA, Japan can’t do what Brazil did?
There is a difference between rubber stamp and accepting a different process that achieves the same end.
EASA etc should not get a pass either. FAA, Japan should review tier conclusions and tests and data.
Once the fix is implemented, there is nothing that has emerged that says they can’t fly the MAX just fine.
Review should continue as will the investigation.
If any ting is found then assess the criticality and act accordingly.
My brother had an oil pump that was a known failure in his engine (small two seat )
They found the issue after the engine had been overhauled. They assessed and allowed 1600 hours before it would need to be replaced.
If they found one fail at less than 1600, they would amend it.
A320 has an odd issue that was allowed to fly with for years while they worked the install of the fix.
I disagreed with that but they got away with it.
I had one guy insist they had to inspect solid parts to ensure they did not fail.
Said part had never failed before and only failed as a failure of another part that was done wrong.
Address the cause and the other part can’t fail.
If we did each problem the system would grind to a halt.
At which point the worlds economy would as well.
I am not in the class of most commenters here, but has anything been said why AA, UA and WN did not experience this problem and what were the hours of the two cockpit crews and was their training lacking? Just asking.
Most likely explanation is that they didn’t experience an angle of attack indicator failure and the most likley reason for that is maintainence procedures.Could easily just be pure luck.
“Rick Ludtke, an engineer who helped design the 737 Max cockpit and spent 19 years at Boeing, said the company had set a ground rule for engineers: Limit changes to hopefully avert a requirement that pilots spend time training in a flight simulator before flying the Max.
maybe the repeated problems with angle of attack indicators had a deeper cause
“A technician who assembles wiring on the Max said that in the first months of development, rushed designers were delivering sloppy blueprints to him. He was told that the instructions for the wiring would be cleaned up later in the process, he said.
https://www.nytimes.com/2019/03/23/business/boeing-737-max-crash.html
Quite right, I don’t want to throw African maintainence technicians under the bus either, they seemed to cope just fine with the NG.Lots of knowledgeable people are questioning whether there might be a fault.
“A technician who assembles wiring on the Max said that in the first months of development, rushed designers were delivering sloppy blueprints to him. ”
Blueprints ?? BLUEprints ?
Suspect the journalist used a very old term for the online drawings, or the mylar drawings or the laserprinted paperwork involved ( probably veryt little of the ‘paper” varity.
And what other ancient or old terms or wrong concepts are in the NYT- which seems to have a poor record for accuracy ?
BTW- I’ve seen no mention of AOA sensor(s) being damaged by birds, ramp bending or jamming or maybe a bad batch due to grease assembly errors, etc
I find some of the post to be petty, made by some very small people hiding behind their computers. Nobody on here knows all of the facts. I am 52 and as a former combat Marine I will tell you, until you have been in a life threatening situation, you have NO idea what you will do. Blaming the pilots without having the facts shows a lack of moral compass and basic human decency, especially true for the pilot who holds certification for all of the Boeing planes. You flat out do not know what these dead pilots did or did not do. You have no idea what failures of equipment or lack of information/documentation that had to deal with. You know nothing.
I am not going to go into all of the failures on Boeings side, that will come out during the hearings and criminal investigations but we do know they made mistakes in both design and execution. We also know these pilots flew previous 737 just fine. In the operations world when things go wrong, you look at what has changed, it was the plane, not the pilots. Regardless, I cannot imagine what these poor souls went through. A sudden loss of elevation as the nose of the plane pitches down, alarms going off, screams from the passengers, the pilot fighting the controls as the computer keeps reengaging and pushing the nose down, harder and harder, a pilot and copilot frantically trying to save the lives of 175 people as the ground comes rushing up at them.
Seriously, I am sure some of you have Boeing stock but be a decent human being.
We can say with absolute certainty that pilot aptitude, training and experience levels have nothing to do with the lack of an accident at WN,the largest operator with the most flight hours. Their CEO has publicly stated that they haven’t had a hint of a related problem, so their pilots have not had the opportunity to prove how they might have coped.
There are essentially two avenues of complaint here. The first is what caused the Lion Air crash and was this also responsible for the Ethiopian Airways crash. The second is why was the FAA slow to ground a new aircraft type.
Addressing the second point first. We, fortunately, live in an era in which air accidents are very rare. To have two identikit air crashes within months of each other is statistically unlikely in the extreme. Just to be on the safe side either Boeing or the FAA should have called an immediate halt until such time as a common cause was ruled out. This would have maintained the facade of credibility.
Addressing the first point. It is important that supposition, conjecture and surmising, in the absence of hard facts, not snow ball out of control. Given the circumstances of both air crashes it appears, on balance, that the cause for the accidents lies with the failure of aircraft systems rather than with pilot failings.
Boeing should thank its lucky stars that the grounding was forced upon them. Had the plane continued to be allowed to fly and had a third accident occurred under similar circumstances the repercussions would have been extremely difficult for Boeing.
The current investigations into the FAA and Boeing ought now to be viewed as an opportunity to clean house. I believe everyone at Boeing is well intentioned but that the management structure perhaps needs an overhaul. The Challenger disaster illustrated how a NASA management prioritising its own agenda overrode the advice of its engineers to the detriment of safety.
Given the sort of commercial pressures that managers are under at Boeing it is not difficult to imagine instances in which FMEA processes were not as exhaustive as they should have been. Put crudely, money before safety, The FAA should have policed Boeing’s processes with greater scrutiny but its authority has been badly eroded to the detriment of safety.
I will disagree with the first crash.
Clearly there was an MCAS issue, an AOA issue and the Pitot was affected (prior or by the maint that was done?)
The new MCAS should have been implemented and tested and installed and and training in place.
They took a risk with peoples live and people lost their lives as a result (in both cases)
House cleaning is definitely needed but also staffing for FAA.
I am not familiar with MEL procedures in Indonesia, but in the West, there is a reference we call the Minimum Equipment List (MEL) that spells out what procedures are required with inoperative equipment as well as defining N0-Go items. Pitot-Static and A0A are NG items and the Lion Air flight should not have departed after several flights of problems involving those systems.
On Nov 7, 2018, Boeing issued EAD #: 2018-23-51 to all operators of the 737 Max outlining mandatory steps to be taken prior to flight, effective upon receipt and mandatory within 3 days.
Runaway Stabilizer
In the event of an uncommanded horizontal stabilizer trim movement,
combined with any of the following potential effects or indications
resulting from an erroneous Angle of Attack (AOA) input, the flight crew
must comply with the Runaway Stabilizer procedure in the Operating
Procedures chapter of this manual:
• Continuous or intermittent stick shaker on the affected side only.
• Minimum speed bar (red and black) on the affected side only.
• Increasing nose down control forces.
• IAS DISAGREE alert.
• ALT DISAGREE alert.
• AOA DISAGREE alert (if the option is installed).
• FEEL DIFF PRESS light.
• Autopilot may disengage.
• Inability to engage autopilot.
Its not definitive of course but this is AA take on how long.
https://www.kwtx.com/content/news/American-Airlines-extends-737-Max-related-cancellations-507588251.html
I can see US release to fly in a short time.
Rest of the world will need to review.
Right now, my guess for AA, WN, and UA would be May 1, Canada July 1, other places, longer. But there is a lot of uncertainty, US could stretch out all summer, I’d give that a 1 in 4 odds as well.
Question now is…should the 787 certification be reviewed? With the max certification so problematic, what shortcuts, if any, were taken with 787?
Right now, no. As an exercise , no problem.
Its got a good track record so hard to make a case
We know about Boieing’s aut0 throttle drop out that they won’t do anything about.
But then there is no standard for Auto Throttle. Should be.
I think that the fundamental issue is Boeing’s insistence that pilots would need no simulator training to fly the MAX. That was purely an economic decision that would make the plane more attractive to their customers but it was the reason that MCAS was not communicated to the pilots, or even that the MCAS system was originally required.
This has been an awful situation revealing many problems with the process of designing the MAX but I think that this insistence was the first domino in the chain of events.
Safe flying demands well trained pilots who know their planes intimately. That is not the place to cut corners.
I wonder if Boeing put pilots in simulators and exposed them to MCAS failures to see if they would invoke the existing run-away trim procedures?
If they have evidence of say 20 pilots coping just fine that would provide a basis for the position they took.
Was there even a Max 8 specific simulator ?
Out of curiosity, a few questions within the context that the 737MAX had been in service since May 2017: Given what is currently known, is it felt that the 737MAX should have been grounded after JT610? If the answer is “yes,” is it the belief that any airplane type should be grounded after any fatal accident? If the answer is “no,” why should not compliance with Emergency Airworthiness Directive (AD) 2018-23-51 have been sufficient to have averted the ET302 crash under the assumption that is was due to an MCAS malfunction until a more definitive fix to the system was effected? (I feel somewhat confident in believing that any fix to any system will not guarantee a malfunction to that system and that the procedure in Airworthiness Directive (AD) 2018-23-51will still be valid after any fix to MCAS.)
The MCAS is an extension of the Speed Trim system that has been in existence for 30 years. Perhaps that is why the engineers believed that no explanation or dissemination of information was provided. I don’t know.
I would not want to defend their decision and the software design was definitely flawed in that it allowed sequential nose-down trim actuation to the full extent of travel.
I would not be surprised to find out that the A/T were still in TOGA mode from departure. That would help explain the increasing AS after departure. Normal procedure is to call for a Vertical Mode, VNAV or LVL CHG after cleanup which would reduce the power setting to Climb mode from TOGA. It is also possible that believing they were close to a stall, the throttles were advanced to max forward or Firewall Power.
Time will tell.
Here’s a basic question:
Is there one switch to shut off trim, that shuts off the auto control of trim from speed trim, mach trim, and MCAS, while leaving the thumb switch still able to control the trim motor?
Good question.
I am not fully sure of the correct answer, but i think that on the NG you CAN switch off automatic trim and leave the thumb switch operational. On the MAX you switch off all electric operation of the stab jack leaving only manual trim by the trim wheels. This is true for any of the cut off switches, both pri and sec.
That would not be correct.
If you turn off STAB, its off period for all modes.
You are killing the main power to the relay.
Trim may active the relay, but nothing there to work with.
STAB is intended to kill that and revert to the wheel from mechanical trimming by hand.
And in fact there are two STAB switches as there are two stab motors. .
From the start I was amazed there is a automated pitch compensation trim so powerfull a pilot can’t override by fully pulling the yoke. I seems the softwarefix solves this, it will reduces the MCAS maximum trimming power. Could that not be the reason for the nose down elevator problem? Instead if blowback?
I’d be curious about the maximum settings on the trim. When the trim is deflected nose up, I believe it is about 10 or 12 degrees relative to the fuselage. I assume the fuselage would be at that angle. What is the angle of the wing root at the fuselage? 10 degrees? So at maximum setting, the wing root is at AOA 20? Slow speed, maximum lift of the wing at high angle before stall, and little margin for higher angle before stall. How does the NG compare to the MAX when the moment versus AOA graph crosses the neutral axis in this configuration? Only Boeing and the FAA know how much the stability line stays nose down before stall. Those graphs are a key piece of evidence. Short of that, it is all speculation.
Since the trim goes to negative two, when does that come into play? At high mach numbers when the center of lift moves forward, or to counter the engines when they’re on full?
What was the range of tailplane the MCAS flight regime was valid for? ten degrees down only? Was it even relevant at five degrees down? By that point, shouldn’t the natural nose down pitch stability of the aircraft clearly kick in on the graph?
Why wasn’t the MCAS limited to the range of incidence on the tailplane, where the instability existed?
On a side note to the main investigation it might also be an idea for the FAA to rule what elements of safety can be described as ‘Optional Extras’ and those that are compulsory.
Think the marketing and bean counting boys have got a little bit carried away at Boeing in this regard.
‘Optional Extras’ that are apparently not necessary “all primary flight information required to safely and efficiently operate the 737 MAX is included on the baseline primary flight display.”.
So why would an airline pay extra to add these unnecessary items ? What possible benefit could they see to having them? Why would BA even offer them?
Does anyone know if any of the other manufacturers offer ‘Optional Extras’ that could aid safety?
I’m also wondering about the legal position, if the final certification documents do not contain for instance that MCAS could move the stabiliser 2.5 degrees, but only had the original 0.6 degrees, was the certification legally valid?
Does the certification have any bearing on the insurance of the aircraft. Usually the slightest misdeclaration on an insurance document is enough for it to be considered null, and void.
“Boeing continues to have full confidence in the safety of the 737 Max. However, after consultation with the US Federal Aviation Administration, the US National Transportation Safety Board and aviation authorities and its customers around the world, Boeing has determined – out of an abundance of caution and in order to reassure the flying public of the aircraft’s safety – to recommend to the FAA the temporary suspension of operations of the entire global fleet of 371 737 Max aircraft.”
“to recommend to the FAA the temporary suspension of operations” what does this say about who’s in charge of who.
Its all BS Spin.
And in reality the light does you no good unless you know what it means (don’t pull up the FLAPS!!!!)
So by definition, by hiding MCAS of course you don’t need the light or the display it has no relevance unless you do know about MCAS which you don’t need to know about.
Its all very simple.
Legal spin,in a couple of years people will have forgotten how hard Boeing fought to stop the grounding (including the incredibly immoral act of trying to call in a personal favour from POTUS) but the record will show that they did it voluntarily.
Looking the groundspeed chart from ET302 the speed increased continiously until up to around 380kts (Would be interesting to know WHY, since it seems highly unusual to me). JT610 Data on the other hand shows a fluctuating airspeed between 250 and 300kts – only when the plane has already started the dive does the airspeed exceed 300kts.
If we presume Elevator Blowback would be possible on the 737 starting at above 300kts ias, then it could potentialy have played a magnifying role in starting the ET302 dive (MCAS pushing nose down, Elevator Blowback preventing sufficient countermeasure with the joke)
but not really on the early stage of the JT620 dive (MCAS pushing nose down, but joke input should have been able to counter since speed not significantly above 300kts)
If I understand right, Boeing stated that in their MCAS fix, they wanted to make sure Elevator keeps authority over maximum MCAS stabilizer trim. This has led many to believe that the MCAS caused elevator trim on both planes was so extreme “nose down” that this was the MAIN reason that the yoke elevator “nose up” commands could not prevent the lethal final dive (and not elevator Blowback).
Due to the reasons mentioned above, to me the “MCAS didn’t crash the aircraft, Blowback did.” statement is not convincing. I could imagine however that Elevator Blowback played a magnifying role in the dive, while MCAS caused it.
Marcus
Imagine that you have briefed an ILS approach, Single Channel, Flaps 30 Landing.
You are on approach and when you call for flaps 15, you notice that suddenly there is a significant roll force to the right. Do you call for Flaps 25? Or do you stop at 15 and land at that setting? If you do continue to flaps 30 and lose control of the AC due to uncontrollable roll, is it the flap failure that caused the crash?
Yes, the MCAS induced an undesirable nose down force in the AC, but systems fail and pilots have to deal with those failures, whether it is an engine fire, a flap anomaly or a pack overheat. That’s what we train for. A professional pilot knows the AC and its systems. Prior to MCAS, all the earlier versions had Speed Trim which served a similar function – reduce the nose up force at slow speed, high angle of attack.
Unwanted trim activation is a simple fix. Turn off the offending system-Main Elec or A/P Trim. The trim operation is indicated by rotation of the trim wheels, one on either side of the pedestal and two inches inside of the pilot’s knee. If rotation of the wheel is slow, it is the AP trim motor. If it is fast, the Main Elec trim motor.
Boeing absolutely failed the pilots in not publishing the change to the AC system in the MAX, but the response to unwanted trim activation remains unchanged.
Jonathan,
I agree with the points you are making.
Since I am new on this forum/comment section, before I continue let me mention that Leehamn News and the comments here are my main source for trying to understand what happened on both of these flights. I find both the Original articles as well as most of the comments here to be very qualified and interesting – yours included. I have not found any other publicly available place with such good and in-depth reporting and commenting.
Concerning my post, maybe I phrased my conclusion wrong: to me it seems unexpected significant MCAS action – coupled with a disability or failure on the pilots side to counter this (by reasons unknown to me) was the main reason for the fatal dives of both aircraft. The possible elevator blowback at above 300kts looks to me like it may have also played a significant role in the ET302 crash, but I can not see this as having played a main role in starting the final JT610 dive. Also the Vmo of the 737 is listed at 340kts, so since VMO is the airplane maximum certified operating speed one would think elevator blowback should not occur before exceeding 340kts ias. If it did, then the certification of this airspeed would probably have to be put in question.
I still see many other unanswered questions however.
Like you hinted in your first point with the flaps – Pilots often play a huge role in how a could be desaster turns out. In the JT610 Crash, I can somewhat understand why the main Trim Motor switches were not triggered. Like you said it is a know-how and training issue. If these pilots did not know about MCAS and did not think Runaway Trim was the issue (because the electric trim wheel was not only moving in one direction but still allowed pilot input on the yoke switch in the opposite trim direction) – they may have chosen to leave the motors on because then they could counter the nose down trimming with the yoke trim switch, and did not have to manually turn the trimwheel in an already very stressful situation. If this was their assessment, then we know now it was not the best possible one and could have been prevented by knowledge about MCAS and – even better – training on how to deal with MCAS failure due to wrong AOA input.
However, the ET302 flight really confuses me. Since this flight happened after the JT610 crash, it seems likely the pilots knew about MCAS and its shortcomings. If this is so, then it seems the pilots would turn off the electric trim motor as an early counter measure to an unwanted nose down trim by the airplane. Are we sure the pilots of the JT610 flight did not turn off the trim motors? Just because the stabilizer was found in max nose down position in the crashed airplane debris, does this neccessarily mean that the pilots had the trim motors still enabled? If there is evidence that the pilots did not turn off the trim motors, the question would be why did they not – even though they must have known about MCAS? These switches are well accessable and not hidden.
Also on this flight the constantly increasing airspeed is a mystery to me.
Who in their right mind would fly an airliner at close to 400kts ias? As mentioned earlier the Vmo of the 737 is 340kts ias and I presume the pilots would know this and would also know that exceeding Vmo can lead to serious problems – both structurally and in handling. (Maybe leading to the Elevator blowback mentioned in the article)
Pilots do get trained on how to fly an airplane with unreliable airspeed readings, so even if the indicated airspeed was wrong they would have initially decreased throttle to around 70%?
One last thing, please forgive me if my wording and spelling is not great – English is not my first language. Thanks!
@ Marcus;
Excellent observation regarding the Vmo/Mmo. Totally agree: the elevator should not experience any blowback at speeds lower than the Vmo/Mmo – this must have been demonstrated in test flights for the NG, if not for the MAX. It is more likely that the blowback was not due to the free stream air (i.e. moving at <340 kcas), but due to the engine plume impingement on the horizontal tail. The plume would be moving significantly faster than the free-stream air with the engine at takeoff thrust levels. Given the close integration of the engine on the MAX and the expanding plume, I wouldn't be surprised if the horizontal tail ends up in the plume as soon as the airplane pitches up a few degrees.
Yes, when does the tailplane end up in the leeward shadow of the wing?
Isn’t this a big issue on T-tail aircraft?
After some research, it appears that the limiting speed for elevator control authority at low altitude is the dive speed (V_D/M_D) and not VMO/MMO. That would mean the low altitude airspeed limit is really about 400 kts, and not 340 kts which is VMO/MMO at low altitude… The airplane almost certainly did not exceed V_D.
Marcus
Firsts let me praise your use of English. It is excellent.
I think at this point, there are more questions than answers and we will likely have to wait for the full investigation to conclude before the riddle is solved.
And we see Bopeing continue to deny.
https://www.seattletimes.com/business/boeing-aerospace/boeing-begins-new-737-max-pilot-training-and-defends-the-jets-cockpit-displays/
Amazing, wipe the slate clean, admit you screwed up, with the Mueller report taking the oxygen for the next two weeks you have a get out of PR jail free card.
But noooooooooooooooooo.
Notice you don’t have to pay for the optional display now either?
TW
I received this moments ago from another pilot (non-airline), about a Quantas accident. It makes one wonder if the regs are helping or hurting, same with the computers.
https://m.youtube.com/watch?v=2cSh_Wo_mcY
For those who do not think some really stupid things can happen to any airline operation.
https://www.bbc.com/news/business-47691478
And now you put your order in and you are back in the air!
https://www.bnnbloomberg.ca/boeing-tells-airlines-to-get-ready-for-free-737-max-software-fix-1.1234330
Well a little bit of training as well.
Thanks @Bjorn This makes sense. I myself was surprised/puzzled that the plane did such a heavy dive. I had a theory that the pilots suspected an airspeed error and the pilots thought the speed was too low / slow flight and they dived the plane for more speed and lift. But I couldn’t quite get it right either, because the wind noise is high at high speed, so the pilots should be able to hear that they were in high speed.
I see that Boeing are offering a free software upgrade for angle of attack sensors to their 737MAX customers. Apparently the MCAS will use both AoA sensors instead of just the one previously. In addition, if the AoA sensors show disagreement a light will appear on a display to alert the pilots.
By way of contrast the interesting article below details an AoA issue on a A321 flying from Pamplona, Spain to Germany in 2015. Airbus apparently have three AoA sensors and have a system that ignores the odd one out. However in the instance cited two of the AoA sensors both malfunctioned and the flight computer ignored the remaining, presumably, accurate one. By the way, flight 4U9525, mentioned in the article as being possibly affected by faulty AoA sensors, actually crashed due to the pilot committing suicide and killing all on board in the process.
https://aviationweek.com/commercial-aviation/german-investigators-cast-wider-net-frozen-aoa-sensors-pamplona-dive-incident
Airbus with the latter A300 and newer aircraft with full FBW also had to move to computer logic safety system vs the old 737 Mechanical/relays logic system.
So the vote for the 2 out of 3 as a tie break assumes only one will go wrong.
If two disagree and are of the same value then you have an issue.
At some point there are steps to reduce the Control Laws (mode protection) to alternative and then none.
Each system has its issues to overcome, but no system should depend on a sole flight device to do what MCAS did.
Text from Pamplona Report…apparently no one is perfect.
German investigators studying the cause of an uncommanded pitch-down of a Lufthansa Airbus A321-200 near Pamplona, Spain, in November 2014, hope to discover the probability of similar events linked to frozen angle-of-attack (AOA) sensors as the investigation continues. In the interim, both the European Aviation Safety Agency (EASA) and Airbus have published directives alerting pilots of the issue and the workarounds.
In a new update on the A321 incident, the German Federal Bureau of Aircraft Accident Investigation (BFU) says data from two of the three A321’s AOA sensors locked into a climb attitude following takeoff from Bilbao, Spain, on the flight to Munich. Airbus says the two sensors, which have heated, moveable vanes on the exterior of the aircraft and are used in the automatic stall-protection system, froze about 8 min. into the climb, at approximately 19,500 ft., and remained frozen for more than 90 min. The sensor manufacturer, UTC Aerospace Systems, in a post-incident inspection found no “indications of contamination, damage or defects” either in or on the sensors that would explain the blockage, the BFU says.
Each AOA sensor on A320-family aircraft is connected to an Air Data Reference (ADR), and the three ADRs feed two Elevator Aileron Computers that use voting logic to eliminate any “out-of-family” sensor. Neither ADR1 nor ADR2—the electronics tied to the frozen sensors—were rejected, as values were similar. The measured AOA is compared to an “alpha protection” threshold that decreases as speed, or Mach number increases, and also when the autopilot is disconnected.
The BFU says the co-pilot on the incident flight disconnected the autopilot when he noticed an irregularity in the speed characteristics on the airspeed scale on his primary flight display. When he began to level out and accelerate when approaching 31,000 ft., the static AOA values and increasing Mach number tripped the fly-by-wire aircraft’s AOA-protection limit and automatically injected a nose-down command into the elevator control, a reaction designed to prevent aerodynamic stalls.
The stall-protection action pushed the aircraft’s nose from 4.5 degrees above the horizon to 3.5 deg. below the horizon, resulting in a 4,000-ft.-per-minute plunge, despite the co-pilot pulling the sidestick rearward through more than 60% of its available travel. The aircraft dove from 31,000 ft. to 27,000 ft., at 4,000 feet per min., before a full-rearward stick input by the captain resulted in a net elevator command that leveled the nose. The captain continued to hold “more than 50%” rearward stick in stable flight for a period, but with help from technicians on the ground, the crew was able to reconfigure the automation into the aircraft’s alternate control law, rather than its normal “direct” law. The action removed the alpha-protection checks and canceled the nose-down input. The aircraft then continued to its destination.
Given the unexplained descent that preceded the crash of Germanwings flight 4U 9525 on March 24, there is some speculation that the same problem may have played a part. The sequences of events have notable differences, however. The Germanwings aircraft leveled off in cruise flight for several minutes before the ensuing dive. In addition, Germanwings upgraded the protection system software, and a source with knowledge of the situation says the carrier also replaced the AOA sensors on its fleet.
Regardless, the crew should have been familiar with a workaround to the problem. Airbus in early December issued a Flight Operations Transmission and Operations Engineering Bulletin to all A320-family aircraft operators noting that “if two or three AOA probes are blocked at the same angle, an increase of the Mach number may activate high-angle-of-attack protection,” which results in “continuous nose-down pitch rate that may not be stopped with backward sidestick inputs, even in the full backward position.” The recommended fix is to turn off two of the three ADRs, which puts the aircraft in alternative control law, deactivating the high AOA protection. Information was to be added to the Flight Crew Operations Manual, Aircraft Flight Manual and Quick Reference Handbook. EASA one day later issued an airworthiness directive on the same issue, calling for making the changes to the flight manual prior to the next flight.
Meanwhile, BFU continues to collect and analyze data to help quantify the problem’s scope. The agency says that during the investigation, it received “data analysis results” collected by airlines as part of regular flight-operations data analysis. “These analyses should show how often in the past individual sensors provide inappropriate constant values during a flight,” says the BFU, noting that more work will be required to understand the “algorithms and context” of the data.
“Based on these values it is part of the further investigation to determine the probability of occurrence of a similar serious incident,” the BFU says.
For those that think its just the 737 MAX
“The 757 and 767 ran into that problem too, but in that case it was the wing downwash coming into play on the horizontal stabilizer. Pitch Augmentation Control System (PACS) was designed to add a small increment of stabilizer to offset the pitch up. In flight test, vortex generators were found to be adequate, by virtue of favoring the wing tip Versus wing root, the center of lift moves outboard and necessarily aft, providing a pitch down effect. PACS was removed.”
Airbus likely has these as well and worked out with a fix in design/test or control adjustments int he FBW system.
For older vehicles designs, Power Steering was a major benefit in control (skids could be reacting to much faster and easier)
Nothing wrong with the basis of the 737, execution failed and its not only possible but happened on the 787 as well.
MCAS was added to the KC-46 as well, not sure why an obscure part of its flight envelope needed protection but maybe the short fuselage and tail boom refuelling process throws these things up that werent needed on the 767F
Can you provide a link to a source? I would appreciate it because I’ve done a lot of reading about the KC-46 and have never come across this. Thanks.
See MRO network, quite interesting history, has been on 767 tankers for 8years and uses 2 AOA sensors.
http://airforcemag.com/Features/Pages/2019/March%202019/USAF-Reviewing-Training-After-MAX-8-Crashes-KC-46-Uses-Similar-MCAS-System.aspx
What other aircraft have stability system on in this realm? Perhaps the 737 is not alone. 787 and A320neo, were they certified in this region of flight with all auto flight systems off?
What if the A320neo is a quote unquote, unstable aircraft?
Duke: MCAS was not added to the KC46, it is part of the 767 system.
Transworld, apparently not.Read the MRO network article.
possibly addressing some questions… http://www.b737.org.uk/mcas.htm
Terminology alert!
Appears to be confusion about what Bjorn means by ‘blowback’, between:
– high airloads push control surface back toward neutral, because actuator is not strong enough (have to understand 737 boost system to grasp that as it is a fly-by-cables airplane but rudder system may be different, I forget what little I knew once, I remember the 737 Classic had a backup hydraulic source for rudder and thrust reversers).
– airflow reverses behind the airplane and does something to the control surfaces (which doesn’t make sense because that would push a deflected control surface to greater deflection).
And the word ‘base’ could mean back end of the device or mistyped or mistranslated ‘basic’.
(You have to watch subtleties in languages.)
Regarding AOA sensors:
‘Back in the day’ I expect AOA sensors would have used ‘synchro’ devices to transmit angle to using devices. The 737 does go back to those days.
Synchros have three-wire stators and two-wire rotors, the stator providing signal output whose leg-leg voltage varies with rotor position, the rotor provides excitation. There are 12 ways to wire a synchro, only one is correct for the installation.
Note that 22.5 degrees is 1/16 of a circle.
I’d have to dig into my files and memory to calculate what the output error would be if one stator wire broke, off the top I think it it would depend on the angle the synchro is physically at.
(And it’s easy to get reverse rotation with a synchro, by flipping excitation wires or reversing sequence of the stator wires. A certain airliner manufacturer once gave an instrument maker the wrong specification, so had to change airplane wiring to match. It’s akin to getting understand pinout of a connector correctly – are you looking at the face or rear (wire side) of the connector, and which side of the connecting pair?)
You also have to get phasing of excitation power to transmitting and receiving device matching.
The output of a synchro can directly drive an indicator that has a synchro connected to the pointer, or be interpreted by circuitry.
Note as well there are bearings in the AOA vane used on A320s, thus hypothetically sticking from unwanted material in it. And I suppose damage is possible from outside, the vane is exposed to ground equipment.
(See the BEA accident report on the Airbus airplane whose sensors stuck because water got into them and froze. Airplane washed without protecting the sensors which must have a small gap at the skin to be free to move though gap may have been designed too large. Not the case here because temperature was not low enough as the airplanes did not get very high.)
BTW, as for checking that AOA vane positions match on the ground, if the vane is free floating couldn’t a difference be caused by side gusts or crosswinds? Even without that, I ask how fast the airplane would have to be going to have accurate vane position, my guess is well before V1. (Perhaps by a thrust check point of 60 knots that at least some pilots use (and ASIs may start their scale at).)
How was the speed trim interacting with the MCAS? From what I can gather, speed trim is operational from 10 seconds after take off, to mach .6, and similar to MCAS it is shut off for five seconds with the use of the trim toggle control switch.
What does speed trim do? As far as I can tell, it keeps the aircraft to a constant speed by adjusting the trim and the AOA. This means that lift and altitude are not held constant. It looks like it’s purpose is a constant speed on climb system.
If there was a speed input malfunction on the two flights, what was speed trim doing, and if conflicting direction to move the trim, which one takes authority, speed trim or MCAS?
This has got complicated!I don’t suppose that these accidents would have happened otherwise.
I am wondering if blowback happens to a FBW plane?Or is it capable of stopping the pilot getting into that situation in the first place?
Reply to;
Capt Jonathan Webber
March 25, 2019
Mike
Thanks for your assessment of the accident and Trim Operation. Could you tell us how many years you flew the 737 and which models?
Just one interested paying passenger Capt. Johnathan.
Luckily for your chosen industry there’s plenty of us about.
Even some that can spell yoke correctly.
Awaiting an official outcome of the investigations.
Thanks for the response. Safe flights Sir.
Mike
“don’t believe everything you read on the internet” -Abraham Lincoln
Two off switches? Two trim motors? Do the two switches shut off the same thing? ‘primary switch, back-up switch’ How many switches have a back-up switch in case the first one breaks?
Are there in fact two motors as has been alluded to earlier in this thread? And, are the switches identical in function?
Yes there are two motors.
Yes each switch turns off the main power to each of the motors.
Switches can fail. These are seldom used and may well have fail open features.
One actuator (motor-driven jackscrew), two switches, one for manual control, the other for autopilot control. The Runawy trim checklist has you turn both switches off simultaneously, regardless of what is causing the runaway. Why they didn’t do that immediately I don’t know.
Blowback is a high speed phenomenon and if it were a factor could have been solved by slowing down.
A Southwest MAX 8 being ferried to Victorville this afternoon for long term storage had to return urgently to Orlando where it made an emergency landing!
http://www.fox35orlando.com/news/local-news/southwest-boeing-737-max-makes-emergency-landing-at-orlando-international-airport
According to flight tracks the flight only lasted 11 minutes and the aircraft only attained an altitude of ~2,000 ft. I wonder if the problem was MCAS related since it occurred during the same phase of flight as the doomed Lion Air and Ethiopian Airlines flights. Whatever the cause it must have been very urgent for the pilots to put it back on the ground so urgently. SWA8701 A MAX flight headed to Victorville this afternoon had to return to Orlando where it made an emergency landing! According to the flight track the flight lasted only 11 minutes and only reached an altitude of 2000 ft which could suggest a problem with MCAS – whatever the problem it was obviously very urgent that they get back on the ground
https://flightaware.com/live/flight/SWA8701
Hopefully it was MCAS/AoA related and the possible failure will provide some insight into the cause of previous failures.
There has been quite a history of A0A failures on several different aircraft types. Let’s get to the bottom of this soon.
Problem was the right engine heating up.
Is it confirmed that it’s an engine issue and not MCAS?
I have some limited experience with Boeing high reliability software procedures that seems to conflict with the emerging details of the MCAS implementation. I believe that (somewhere) there is a notebook containing the MCAS implementation plan including acceptance test procedures, notes on possible failure modes, details of failover subprocedures, test data including but not limited to possible failure modeling and random GIGO (garbage in garbage out) results.
To understand the MCAS contribution to this failure the FAA/NTSB/BEA should be able to reference this documentation, and I wonder if any of it is available, and maybe significantly, are there any details of the credentials of the software subcontractors and reviewers? Generally you get highly qualified people on the review boards.
Thanks for the excellent discussion on this topic.
Pingback: Bjorn’s Corner: Why did Ethiopian Airlines ET302 and Lion Air JT610 crash? | Jano's notes
I think this is Boeings “Comet” moment. I wonder if contingiencies for production pause are being discussed right now
It would be interesting to have a look at the G graph on the FDR……..
In Rostov they had -1G ! and still waiting for the final report.
This video may be of interest it shows inside the unpressurised tail compartment of a 737NG and you can see the trim stabilizer jackscrew and control cables , and the elevator control cables.
https://www.youtube.com/watch?v=J7l_DSj6zUo
Personnel background Aviation Ground Engineer.
No experience on B737 aircraft.
Does the B737 not have a “feel unit” within all the powered flying control circuits. If it has this would be the cause of the pilots not being able to obtain full longitudinal authority from the elevators, not elevator blow back. I before retiring 17 years ago as a Licenced Aircraft Engineer with British Airways & before that on production & flight trials with BAC, forerunner of BAE, I had considerable experience of flying control installation, rigging & functional checks over a span of 46 years on around 10 types. In every powered flying control circuit would be a Feel Unit to prevent the pilot from “breaking the darn thing”. At 300 plus knots, if applied to pitot & static ports during testing, the control column was all but solid without to much deflection of the surface, especially at low altitudes. Had the pilot had full authority at those speeds the thing would have broken in mid flight rather than on the ground or become an aerobatic display. Fighters are different they probably don’t have “feel units” within their control runs & the airframes are built for high “G” forces that civilian aircraft are not. So comparison between the 2 cannot be compared. Military aircraft need full authority in all channels full time to be as manoeuvrable as they are for combat and of course during those sort of manoeuvres maybe blow back would come into play and maybe part of the design to stop overstressing the airframe rather than a feel unit.
But of course it should never have got to that stage.
Of course there is a lot of conversation on many fronts with the situation, but my opinion is that Boeing is in a “Tsunami” of trouble that they have never been faced with before. To me the aircraft is a disaster and another waiting to happen. It is too naturally unstable with those large engines and been over engineered to extinction, I’m afraid they are up the creek without a paddle whatever software they come up with, it needs to be aerodynamically changed.
A very interesting video for pilots training on automation and non-normal situations. I pre set the video time to the elevator trim runaway section. This is just the opposite of the MCAS problem. It had a stuck UP trim situation and how they deal with it
https://youtu.be/WfNBmZy1Yuc?t=1669