Bjorn’s Corner: ET302 crash report, the first analysis

Bjorn’s Corner

April 05, 2019, ©. Leeham News: The preliminary accident report of the ET302 crash was released yesterday. It confirmed what we wrote about earlier in the week, the pilots followed the prescribed procedure to stop MCAS. Yet they didn’t make it.

Part of why we presented Wednesday. Here follows additional analysis after studying the information in the Preliminary Crash Report.

Figure 1. The general Flight Data Recorder trace from ET302. Source: ET302 preliminary report.

The report confirmed our assumptions

The report released by the Ethiopian Ministry of Transport is a preliminary report. It follows the structure of the Lion Air JT610 preliminary report.

It confirms what we wrote about earlier in the week, the Flight Crew followed the procedures prescribed by FAA and Boeing in AD 2018-23-51. And as predicted the Flight Crew could not trim manually, the trim wheel can’t be moved at the speeds ET302 flew.

The traces from the report is Shown in Figure 1 and 2 (click on them to make them larger).

Figure 1 shows the general Flight Information traces whereas Figure 2 shows the specific information around MCAS and the signals which affect MCAS.

Figure 2. The Flight Data Recorder trace from ET302 which deals with MCAS related data. Source: ET302 preliminary report.

I have decided to spend a minimum of time on basics, which we’ve gone through several times, and focus on what everyone is now asking themselves: Why did the Crew re-engage the trim and why didn’t they then trim more themselves to combat any MCAS trim?

First the basics.

The activation of MCAS and how it was stopped

The events are very similar to Lion Air JT610 but not identical. At rotation, everything is normal this time (the high AoA was present at rotation for JT610) but 10 seconds after rotation, at 05.38.45 in the traces, the left Angle of Attack (AoA) went high, Figure 2, 10 seconds after line A.

Observe the values are different from JT610. I assume we have the un-corrected AoA values (the Vane values) in this FDR (Flight Data Recorder) trace whereas we had the recalculated Wing AoA values presented in the JT610 FDR traces (raw angle values are higher for the Vanes as explained in previous articles. The airflow along a fuselage nose is curving upward at positive angle against the wind, more so than for the wing).

Stick shaker activates at A but the flight continues pretty normally until the Flaps are raised at B, Figure 2. The trim commands before Flaps up are normal trims from the Pilot Flying (PF, the Captain, Trim Man trace). Autopilot and finally Speed Trim System trims on the Automatic trim trace (to understand Speed Trim and the reason for MCAS, read here and select among the list of articles at the end of the text to learn more).

After Flaps up at B, you have the first MCAS nose down at 1 which stops at 2 (the FFC, Flight Control Computer, trim trace). Between 2 and 3, PF trims against. This causes MCAS to reset and trim again at 3 and it gets interrupted by PF trim at 4. Now MACS is identified and the Pilot Monitoring (PM, the First Officer) cuts trim with Cut Off switches after 5. We know this as the next attack from MCAS at 6 has no effect on Pitch trim units (the trace below FCC trim). Now the fight with MCAS is over and the crew starts turning back to the airfield after 05.40.45, Figure 1 Heading Disp (Displayed) trace.

The Crew finds however they can’t correct the nose heavy trim with the manual wheels, contrary to what is stated in the AD and in their Checklists. Speed is now at Vmo, the maximum design Indicated Air Speed (IAS) for the aircraft, 340kts.

The throttles are left at 94% thrust for the whole flight. This is higher than normal but this is a high takeoff. At 7,600ft it is a full 2,200ft higher than Denver, which is the US Benchmark for high takeoffs. And with Stick Shaker and IAS disagree you keep high thrust and fly a slow climb (the IAS disagree is present in the traces but not mentioned in the report specifically. We don’t have all the Crew callouts and discussions present in the report is my conclusion).

The high speed of 340kts indicated airspeed and the trim at 2.3 units causes the Stabilator manual trim to jam, one can’t move it by hand. The crew is busy trying to hand trim the next two minutes but no trim change is achieved.

At 7 the aircraft nose is dipping (see Pitch Attitude Disp trace) because PF can no longer hold against the Yoke forces we discussed Wednesday (Ctrl Column Pos L/R). PF decides he needs Electric Trim to stop the aircraft from diving. Cut Off switches are put to Electric Trim active. PF successfully trimmed against the last MCAS attack, he can do it again.

The insufficient trim mystery after re-activation of Electric Trim

After 7 PF commands Electric Trim Nose Up in two short cycles. I asked my selves (as did others) why these short trims? They are fighting to get the nose up to the extent they risk switching in the Electric Trim again. Then why not trim nose up continuously or for at least long cycles once Electric Trim is there? It took me several hours to find an explanation. Here my take:

To understand the blip trims one must have flown fast jets at low altitude. At the speed ET302 is flying, 360kts, it’s hypersensitive to trim. The least trim action and the aircraft reacts violently. Any trimming is in short blips.

As PF holds the nose up with a very high stick force, now for a long time, he’s sensitivity to release stick with trim is not there (this is what Pilots do when they trim nose up, otherwise the aircraft pitches up fast). He trims therefore in short blips and has difficulty to judge the trim effect he has achieved. His is not flying on feel. He can’t, he is severely out of trim, holding on to the Yoke with a strong pull force.

Anyone who has flown a grossly out of trim aircraft at high speeds knows your feel is compromised. The sensors you have to rely on are your eyes, not your hands.

PF has the horizon glued to read the aircraft. The result is the short nose-up trims we see. The nose goes up and the stick force needed is reduced. His judgment is; this is enough for now, it was a powerful response. Any MCAS attack I now trim against, then I correct my trim if I need to.

But the aggressive MCAS, trimming with a speed 50% higher than the pilot and for a full nine seconds, kicks in at 8 with a force they didn’t expect. Speed is now at 375kts and MCAS was never designed to trim at these Speed/Altitude combinations. Dynamic pressures, which governs how the aircraft reacts to control surface movements, is now almost double it was when last MCAS trimmed (Dynamic pressure increases with Speed squared).

The Pilots are thrown off their seats, hitting the cockpit roof. Look at the Pitch Attitude Disp trace and the Accel Vert trace. These are on the way to Zero G and we can see how PF loses stick pull in the process (Ctrl Column Pos L). He can barely hold on to the Yoke, let alone pull or trim against.

His reduced pull increases the pitch down further, which increases the speed even more. At 05.45.30 the Pilots have hit the seats again (Accel Vert trace and Ctrl Columns force trace) and can start pulling in a desperate last move. But it’s too late. Despite them creating the largest Control Column movement ever, pitch down attitude is only marginally affected.

We have Control Column displacement this time, JT610 was Force. If the elevator reacts to these displacements, at the Dynamic Pressure we have, we should have seen the diving stop. The lack of reaction to the large Control Column displacement of two Pilots pulling makes me think we now have blowback. This is not a design fault, we are well beyond Vmo. But it explains the rapid dive, unhindered by the Pilots’ actions.

It’s easy to say “Why didn’t they trim then?”. Because they are going down at 20 degrees nose down (which is a lot, a normal landing approach is 3°) and at 400kts. Then you just pull for all you have. And the aircraft is not reacting to the largest Control Column displacement since takeoff. This makes them pull even harder, the aircraft is unresponsive and they are fighting for theirs and all the passenger lives.

A final reflection: Once again we have been given no elevator trace. Why? It’s there, why can’t we see it. It would have given us a better understanding of what’s happening in the last part of the flight.

224 Comments on “Bjorn’s Corner: ET302 crash report, the first analysis

  1. Thanks for this analysis Bjorn!

    When you write “I assume we have the un-corrected AoA values (the Vane values)” do you think that those are the actual positions the vanes were really in (since the left one goes from +75deg after takeoff to almost -75deg right before impact) or would you rather believe that those values are still somehow corrected – maybe by the AoA-sensor itself or later “before” those corrections targeting aerodynamic offsets caused by the aircraft and the vanes positions are applied.

    • Those values are way off the mark, something broke in the sensor. The vane, the power went awry or bad earthing or signal corruption. +-75° is not normal values.

      • Why did the PF leave the auto-throttles on? (I assume a constant N1 of 94% until impact – procedure step 3 is disconnect auto-throttles, or if he did he never reduced thrust). Blowback would not have occurred with slower aerodynamic forces if their power were pulled back. While MCAS was off, then they could have flown a know pitch & power setting (there’s a BA procedure for this). Airspeed got away from them, and I view this as they got sensory overloaded, with the yelling of a stick shaker since takeoff, the clacker going off since Vmo, and the many warnings of “Don’t Sink”. The Ethiopian Government saying they followed the BA procedure does not presuppose they never followed the first procedural law of actually flying the aircraft. They, the pilot’s, put this aircraft in no-mans land by high power settings throughout the flight which was causal to Blowback and loss off control. Never did he attempt to COMMAND with the ‘B’ Auto-pilot either. Another thing is a stick shaker at lift-off is indicative of a no-flap takeoff (procedure is to set flaps 1, but he had flaps 5. We know MCAS doesn’t activate with Flaps extended, so why did he suck them up at 400 feet, and not just re-extend them??).

        • Mark
          May I ask you how long it took you to come to the conclusions you did? You were presumably looking at Bjorn’s graphs in the comfort of your home or office, there are no mountains ahead of you, your not 1000 feet above the ground and in an aircraft that wants to go down. The stick shaker is activating and alarms are going off around you.

          A better question in my opinion would be to ask why was the plane in the air in the first place? The sad fact is that the pilots did the absolute best job they could possibly do and paid the ultimate price. The whole idea of risk analysis during design is to avoid putting pilots and people at risk in the first place. Allowing the aircraft to continue to fly after the Lion Air disaster without fully understanding what the root causes were is in my opinion, an absolute failure of the system designed to keep people safe.

          I’m absolutely sure the pilot of both aircraft if they had an opportunity (like you do now) to do it again with the information you have in your hands they both would have been here to tell the tail.

          • Bob:

            There was no MCAS simuilaotr trining and in the end they put the MCAS back on line to try to trim the Stabs.

            They also do not appear to have trained that the Stabilizer locks up pretty much mechanically with aerodynamic forces under some scenarios.

            In essence what you are saying is Mountain Climber train for emergencies and then they should be able to survive the avalanche that comes down on top of them.

            I sure as *&^ would not want to try that in an airborne aircraft at 1000 feet.

          • Stab trim lockup is said to have been in the manuals for early 737s, not stated if that was original, classic or both, but deleted from NG and MAX manuals. I’d love to see a post from any, old, pilot who can confirm this.

        • Finally, a comment that is beginning to make sense. I won’t argue the MCAS issue, single point failure, lack of redundancy. I will submit though that there was, prior to any uncommanded stab trim due to MCAS activation, a non-normal that all Boeing 737 Pilots train for—unreliable airspeed.

          Erroneous AOA Results in calculation errors of airspeed that is displayed to the pilot on the side with the failed AOA. It also sends a signal to the stall warning system to alert the pilot he is approaching stall (stick shaker only on the side the side that has the failed AOA). Differences in airspeed between the 2 sides of the cockpit cause an airspeed disagree alert. Hence, the pilot flying calls for and the pilot not flying executes the Unreliable Airspeed non normal checklist.

          That checklist drives the crew to set pitch and power, in this case with flaps down that initial pitch target is 10 degrees nose up and 80% N1. No place in the checklist does it direct the crew to raise the flaps. MCAS can not fire with flaps down.

          Nowhere in the preliminary report does it document that this checklist was called for or executed. The crew actions (leaving the power up at takeoff thrust for the whole flight, not setting the pitch attitude prior to flaps up in accordance with the checklist, raising the flaps) indicate they did not execute the checklist. Instead, they raised the flaps. As soon as the flaps are raised with the autopilot off, the MCAS function is enabled and now they are subject to uncommanded stab trim.

          You can argue the characteristics of MCAS driven stab trim are not classically trained runaway stabilizer trim, but anyone who has duties flying a MAX since the Lion Air accident has had insight into the MCAS characteristic, as well as the alerts that go along with it if caused by erroneous high AOA. The change to every operator’s manual has required the crew to execute the Runaway Stabilizer non-normal checklist in this event of this issue. Nowhere in the report does it highlight that that non-normal checklist was called for or executed. Every pilot that flies the 737 MAX has been trained in this since November.

          Finally, at the end of the day, the pilots left the power up, the aircraft oversped and the Mach warning clacker (aural alert) sounded adding additional confusion. They had trouble manually trimming due to airloads on the elevator and aileron. This is not new, not limited to the MAX, and it is trained. Boeing’s Flight Crew Training Manual has a discussion on trim technique and flying the aircraft with manual trim. I know it is extra work on a journalist to research everything, but the reading public is eating up every sound and written byte. Research is only extra work if you do it, and if you can sell papers and clicks without it, why not save the extra work. It appears that that is how we operate these days.

          Any journalist that writes about the system must include the pilots and their training in the system analysis. Without telling the whole story, this is simply sensationalized irresponsible journalism. This is not without consequence, sensationalized journalism hurts us all.

          • 100% agreed. “ET302 followed Boeing checklist” is all we are being told by the media, and it appears the pilots did several things outside of MCAS to worsen the situation. Including not handling the initial AOA disagree correctly in the first place, that would prevented MCAS from even coming into play.

          • Thank you for this comment, especially about the media coverage. I completely agree.

          • While I also think that the pilot initially misdiagnosed the AoA disagree situation, I think this is YET ANOTHER EXAMPLE of the bad design in the 737 that the Stick Shaker safety feature is overloaded to also show AoA disagreement (mind you, one that gets RARELY EXERCISED as well, so yeah, doubly taxing cognitively).

            I also don’t think it is necessary for you to cast aspersions on reporters. FWIW, they may not know the fine details, but I think their focus is on the RIGHT causes of the crash. You can argue this would have prevented or that, but you know hindsight… guinea pigs… Boeing recommendation…

          • @ Bob Strahm : you propose “at the end of the day etc”, but it wasn’t “at the end of the day”, quite the opposite = it was early in the morning in daylight and in clear weather so both pilots could actually see the horizon, so they knew that with the attitude/speed of their MAX there was no reason whatsoever to fear any stall when the first unwanted AND stabilizer input occurred. And both pilots knew equally well that in the event they would have to fight against wild AND inputs from the stabilizer trim system (it seems as if they were expecting this, cf the recent Lion Air accident and recent FCOM/QRH updates etc) then the physical efforts they’d be exposed to would be proportional to the speed^2, so when PF decided he wanted to return to Addis Ababa, normally he should have reduced the throttles and not let the airspeed diverge towards Vmo and beyond.

            This is not wise hindsight but rather basic airmanship … there is no excuse for the flawed MCAS etc, but it appears that, precisely, these pilots may have been obnubilised by the occurrence of trim trippings etc so they became immediately and totally involved in QRH matters and simply forgot to fly the MAX ? (RIP)

          • Another one of these assasination attempts to the benefit of Boeing? ( includes the chorus line )

          • Not good enough, Boeing added a system with a single point of failure with more trim authority then the elctric trim. MCAS was supposed to be a safeguard. It was MCAS that was the trigger points for the sequence of events. Also making the warning light and AOA monitors optional was not a good thing.

          • Right! Since every sim session trains for stick shacker activation right after take off at a density altitude of more than 7000 feet with mountains ahead, sure as hell is to be expected that all of you would have saved the day.

            Your comments are disgusting because you assume that calling for a checklist before you have even gotten to a safe height to execute checklists (remember YOU CLIMB BETTER WITH FLAPS UP DUUH!), is all the crews fault.

            I agree the media are morons in many cases where they have no clue, but the fact that you super heroes who would probably save every doomed aircraft in history of mankind by your sensational skills, cannot appreciate the complexity of having several things going off at once in the MOST vulnerable place (immediately after take off), reveals an usympathetic and deranged attitude.

            If the ET302 crew had 1. aviate 2. navigate 3. communicate set as their priority, then they did everything right: Gain height, retract flaps to do so faster, you are at low energy, you might crash if you dont.

            But sure, next time I get a stick shacker, caution lights and speed disagree @400 ft AGL in a density altitude of over 7000 feet out of Addis, I will leave the flaps, set N1 @ 80% and pitch up to 10 degrees.

            Forget all abot conserving eneregy and gaining height.

            Oh, and of course Boeing is not to blame the least bit. Two crashes with similarities on brand new machines are to be expected! Its a part of the process, right?

        • Agreed for the most part their throttle setting is what clouded the event. But as to deploying the flap again not if they are already at vmo. They likely wouldn’t deploy those speeds.

      • The vane appears to have become disconnected from the counterweight. The counterweight then flops about depending on the applied vertical acceleration (g). Possibly vane snapped off or some sensor designs have vane and counterweight connected by a simple clamping grub screw on to an apparently cylindrical shaft!!!

        https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-162.html#post10439255
        “Left side AoA sensor vs vertical acceleration (g)”

        https://www.pprune.org/showthread.php?p=10439299
        “Miraculously I have found the diagram of an AoA sensor”

        Quotes to assist in finding posts since pprune pointers are a bit unreliable.

      • Satcom Guru noted that the left AOL sensor heater cut out at the same time that the left AOL sensor diverged to 75 deg and the left stick shaker activated. This occurred exactly two thirds down the runway (WOW Air is half way down the runway). This makes me think that it was a bird strike.

  2. Amazing, hence flying much slower at less EPR would have helped. Fly-by-wire would have kept the Aircraft within operating limits and reduced required forces to normal values, now it sounds like a B-17 event from the 1940’s.

    • fly by wire is just as susceptible to bad sensor inputs as fly by cable, perhaps more if you look at the AF443 flat stall into the atlantic.

      this is not an FBW/FBC issue as much as you would like it to be, this is a sensor/automated systems issue. the sensor gives the governing computer bad data (be it a frozen pitot as the AF case or a bad AOA value in the boeing case), the computer does something stupid, people die.

      insufficient redundancy and poor automation logic killed hundreds of people in both cases.

      • You can more easliy incorporare more senors and logic into a fly-by-wire Aircraft or a fully FADEC Engine than in a 737 or JT8D type of Aircraft/Engine.
        Some modern engines has software in the FADEC from the cycle deck and has calculated values for each sensor, as one or more sensors give bad data comapared with the “digital Twin” their output is rejected and calcualted values ae used instead.
        All new Aircrafts designs in this class except the 737MAX are fly-by-wire.

      • Adding to the points made by claes; on the aerodynamically unstable 737 MAX the horizontal stabilizer is powered by a single electric motor (driving the jack screw) for manual trim or by the Autopilot. Manual trim is via cables (mechanical) from the two trim wheels in the cockpit.

        The A320, on the other hand, runs on 3 separate hydraulic systems which in emergencies can be combined to perform as one. The 3 different systems are the green, yellow and blue system. In the event of a complete loss of electrical flight control computer signals, the airplane reverts to a mechanical mode. The side stick is inoperative, pitch is controlled via pitch trim wheel, roll and yaw are controlled through the rudder pedals. Pitch control is achieved through the horizontal stabilizer by use of the manual trim wheel if hydraulic (green or yellow) power is available.

        Thus, in an emergency situation on the A320 pilots don’t have to fight an anachronistic control column and impossible-to-move trim wheels with brute strength and raw muscle power — in a time-critical situation — where the correct decision-making is of utmost importance.

        • Yes, all the new single aile aircrafts/bizjets of similar size and age like ERJ190E2, Airbus A220, A320neo, G500/G600/G650, Global 7500 are all FBW and some have active sidesticks (that I think should be a requirement making the pilot and copilot knowing each others stick movements, positions and forces). All widebodies in production execpt some older Boeing models like 767, 747-8 have FBW. Boeing switched with the 777 but did not install it into the older type certificate aircrafts as they got new dash numbers.

          • )VO-099:

            Then why prey tell are there TWO STAB CUTOFF SWITCHES?

            There are two stab motors, not that it makes any difference.

        • “… on the aerodynamically unstable 737 MAX …”

          Would you be so kind as to point us to the appropriate Boeing, FAA, and/or EASA documents which show the 737MAX to be “aerodynamically unstable”? Thanks.

          • Agreed for the most part their throttle setting is what clouded the event. But as to deploying the flap again not if they are already at vmo. They likely wouldn’t deploy at those speeds. Or rip off if they did deploy.

      • “AF447, a bunch of more or less false info”
        Is this intentional misinformation or do you just not know any better? Read the BEA report. Not watch Air Crash Investigations, the Series.

        • @Uwe: what exactly was false about frozen pitot causing the aircraft to do something stupid (followed by the pilots doing lots of stupid, in particular the co-pilot holding full aft stick all the way to the ground)? I’ve read in detail all the AF447 (pardon the typo above) articles here on Leeham.

          • Trhe aircraft didn’t do something stupid. It realised it had a problem, and handed control back to the pilot’s. That’s *sensible*, as they’re the ones who (in theory) can fly the aircraft on back up instruments.

          • Both:

            This is a controls philosophy thing that has nothing to do with logic and all to do with opinion and is the drawback of Envelope Protection .

            First the pilots had no time flying an aircraft by hand. That at the time was not allowed.

            Second, there was no simulator training ever done for the speeds at altitude, we all know landing and takeoff are the most important, ergo the rest of the time is fine.

            Now, the ugly part of the highly lauded FBW with envelope protein (you can have FBW without it by the way)

            It takes a routine issue at cruise and level and its sees no speeds. It then shift to alternative control laws (envelope protection reduced)

            The reduction is in the pitch (nose up or down) , the wing level is still in affect.

            Now why a pilot would pull back on a speed loss is pure weird – but it is one of two reactions you see.

            So, you could also program the system to simply not do anyting other than a ping that the speeds are off and maintain as is

            Or you could program it to shift to the mode that allows a safe flight, (3 to 5 deg I forget which) nose up and 85% engine thrust.

            But no, you dump it onto a pilot who has never trained on that aspect of flight

            So yes, the pilot screwed up, but the system set him up to do so.

            Of all these freeze ups, most were handled wrong.

            That tells you the system is screwed up – you can sit there and say pilots should know better (and I can). But you can either do that or accept that you kill people doing so and FIX it or watch people die.

            They are now fixing it, teaching the pilots basic airmen ship what was assumed and training in all those odditries that are more than talk and done in a Simulator.

            If someone never gets it you wash them out. Some people simply auto panic, the rote training before did not show any of that. They knew what was coming, they knew what they had to do and it was not the least stressing their brains.

            I call it reality based training. You can rant and rave what is perfectly or you can accept its not with pilot (or a lot of other area) and fix it, not talk about how it should be.

            Boeing has their FLCH Trap that is equal stupid, but they stand by it because that is what someone decided not because it makes sens or there is any logic.

            This is no longer the 50s, the training until AF447 occurred was 50s training.

            Its now getting past that, but is it keeping up fast enough with all the STUFF they add in?

            And that is the issue as well, you have to have a program that keeps ahead of what is happening not behind.

            ps: An American Airlines 757 pilot had the pitots freeze up going into Ireland. Not a nmountin in sight.

            His reacion was to push nose down to get speed.

            While its the right reaction for loss of airapeee it was the worng one for the sitaiton because ther is NO WAY (see note) you can loose airspeed like trhat.

            note: The only way you can loose airspeed once second to the next is to hit a mountain.

            If you hit a mountain you are dead. Ergo, you have not hit a mountain ofr you would be dead and you simply maintain until you resolve the airspeed situation or revert to your alternative air speed loss checklist for that SITUATIONAL (descending in that case)

          • @Transworld, you’re delving into an area of concern that I have questioned previously too.

            Back when FBW was introduced, the piloting population was comprised of people with many hours flying unaugmented aircraft through all sorts of weather, faults, etc. A pilot had burly arms, a whole heap of hands on experience, and could wrestle with a recalcitrant aircraft and land it despite everything.

            On the basis that two such people would be in the cockpit to take over if required, FBW + envelope protection was approved.

            Pilots now don’t have the same type or range of experience, and the FBW safety case has effectively evolved towards one along the lines of, “they’re not crashing”. Which is fine, up until they do start developing complex faultsMK

          • I’ve seen this in industrial gas turbine systems as well. The modern (post-2005) fully computerized systems are at least 2 orders of magnitude better than their mechanical and electo-mechanical predecessors in terms of providing better efficiency, reduced emissions, faster startup times, startup and ramping with less service life consumption, better maintenance information, etc.

            Right up until something goes wrong – then the system dumps full control back to the human operator who is supposed to figure out on the fly how to handle a problem a quarter million person-hours of controls engineers were not able to solve and add to the software.

            And in the Year 2019 the operator is 30 years old, her father and grandfather have retired from the plant, and she has never seen or operated one of the old manual systems and therefore doesn’t have the basis of experience that was used to design the new system. I’ve never been sure how that is supposed to work.

          • co-pilot holding full aft stick all the way to the ground)?

            You have the page in the BEA report to support this?
            ( i.e. I think you haven’t read it.)

          • @Uwe:
            per the report, the copilot (bonin) who was the pilot flying, held aft stick, putting the plane in a 40 degree nose up orientation from 35000 feet until it was far to late to recover. “all the way down” is a simplification, but effectively true:
            “At 02:10:05 UTC the autopilot disengaged because the blocked pitot tubes were no longer providing valid airspeed information, and the aircraft transitioned from normal law to alternate law 2.[48] The engines’ auto-thrust systems disengaged three seconds later. As pilot flying, Bonin took control of the aircraft via the side stick priority button and said, “I have the controls.” Without the auto-pilot, the aircraft started to roll to the right due to turbulence, and Bonin reacted by deflecting his side-stick to the left. One consequence of the change to alternate law was an increase in the aircraft’s sensitivity to roll, and the pilot’s input over-corrected for the initial upset. During the next 30 seconds, the aircraft rolled alternately left and right as Bonin adjusted to the altered handling characteristics of his aircraft.[49] At the same time he abruptly pulled back on his side-stick, raising the nose. This action was unnecessary and excessive under the circumstances.[50] The aircraft’s stall warning sounded briefly twice due to the angle of attack tolerance being exceeded, and the aircraft’s recorded airspeed dropped sharply from 274 knots (507 km/h; 315 mph) to 52 knots (96 km/h; 60 mph). The aircraft’s angle of attack increased, and the aircraft started to climb above its cruising level of FL350. By the time the pilot had control of the aircraft’s roll, it was climbing at nearly 7,000 feet per minute (36 m/s)[49] (for comparison, typical normal rate of climb for modern airliners is only 2,000–3,000 feet per minute (10–15 m/s) at sea level, and much smaller at high altitude).

            At 02:10:34 UTC, after displaying incorrectly for half a minute, the left-side instruments recorded a sharp rise in airspeed to 223 knots (413 km/h; 257 mph), as did the Integrated Standby Instrument System (ISIS) 33 seconds later[51] (the right-side instruments are not recorded by the recorder). The icing event had lasted for just over a minute.[52][53][54] The pilot continued making nose-up inputs. The trimmable horizontal stabilizer (THS) moved from three to 13 degrees nose-up in about one minute, and remained in that latter position until the end of the flight.

            At 02:11:10 UTC, the aircraft had climbed to its maximum altitude of around 38,000 feet (12,000 m). There, its angle of attack was 16 degrees, and the engine thrust levers were in the fully forward Takeoff/Go-around detent (TOGA). As the aircraft began to descend, the angle of attack rapidly increased toward 30 degrees. A second consequence of the reconfiguration into alternate law was that stall protection no longer operated. Whereas in normal law, the aircraft’s flight management computers would have acted to prevent such a high angle of attack, in alternate law this did not happen. (Indeed, the switch into alternate law occurred precisely because the computers, denied of reliable speed data, were no longer able to provide such protection—nor many of the other functions expected of normal law).[55] The wings lost lift and the aircraft stalled.[3][page needed]

            In response to the stall, first officer Robert said “controls to the left,” and took over control of the aircraft. Robert pushed his control stick forward to lower the nose and recover from the stall; however, Bonin was still pulling his control stick back. The inputs cancelled each other out and triggered a “dual input” warning.

            At 02:11:40 UTC, captain Dubois re-entered the cockpit after being summoned by first officer Robert. Noticing the various alarms going off, he asked the two crew members, “er what are you doing?” The angle of attack had then reached 40 degrees, and the aircraft had descended to 35,000 feet (11,000 m) with the engines running at almost 100% N1 (the rotational speed of the front intake fan, which delivers most of a turbofan engine’s thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft’s computer due to the high angle of attack.[56] The aircraft had its nose above the horizon but was descending steeply.

            Roughly 20 seconds later, at 02:12 UTC, the pilot decreased the aircraft’s pitch slightly, airspeed indications became valid, and the stall warning sounded again; it then sounded intermittently for the remaining duration of the flight, but stopped when the pilot increased the aircraft’s nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35 degrees. From the time the aircraft stalled until its impact with the ocean, the engines were primarily developing either 100 percent N1 or TOGA thrust, though they were briefly spooled down to about 50 percent N1 on two occasions. The engines always responded to commands and were developing in excess of 100 percent N1 when the flight ended. First officer Robert said to himself, “climb” four times. Bonin heard this and replied, “But I’ve been at maximum nose-up for a while!” Captain Dubois realized Bonin was causing the stall, causing him to shout, “No no no, don’t climb!”

            The aircraft was now too low to recover from the stall. Shortly thereafter, the Ground proximity warning system sounded an alarm, warning the crew about the aircraft’s now imminent crash with the ocean. Bonin, realizing the situation, said: “Fuck! We’re going to crash! This can’t be true. But what’s happening?” The last CVR recording was captain Dubois saying: ” degrees pitch attitude.””

          • f-cp090601.en.pdf page 96, figure 96.
            PF side Stick pitch position is all over the place
            _except_ for the very last moments.

      • You mean AF447? don’t remotely compare that to this crash .The FO did some incredibly bone headed panic driven things. If he had done nothing it would have been all good.

        • the point was that FBW vs FBCable has nothing to do with the issue, it is a combination of a bad sensor and bad programming, and since FBW is 100% programming driven it is no less susceptible to bad sensor than FBC.

          • You apparently can’t grasp the difference.
            It is layer cake versus a clean design.
            FBW changes can be integral.
            737 piggy only allows multi layer lipstick application.

    • So the guy who lauds fly-by- wire technology still thinks that we set thrust using EPR gauges? Risible!

  3. It’s doubly sad because the pilots were so close. It they had just been ready to react to the onset of mcas by trimming up, they and passengers may all need scared but alive now.

    By the way, could they have tried reducing throttle or applying air brakes to slow down the aircraft tto then allow manual wheel trim?

    • Perhaps, but I share Bjorn’s sentiment. As soon as they found the manual trim immovable, contrary to the expectations instilled by Boeing’s AD, they really were on a wing and a prayer with very little hope of achieving something positive given the myriad controls at their disposal. Maybe (others can confirm or correct as appropriate) throttling back causes a pitch down, which you’d not want.

      All in all, the AD now seems to be horrifically poorly thought through by Boeing and the FAA. That’s inexcusable.

  4. Very good explanation Bjorn, thanks.

    It is very clear the pilots did an amazing job to try and save the aircraft. WE have the ability to look back over weeks when the pilots had only seconds to make decisions and understand what was going on.

    Given this article and your previous articles it would be interesting to see the thought process Boeing and FAA went through after Lion Air to believe that they had correctly address the issue with the AD.

    Since the MCAS was supposed to make the Max feel to the pilot at high AoA the same as the NG (rather than prevent stall) one has to wonder if MCAS was actually needed except to prove to regulator that the plane was essentially the same as the NG and therefore no training required. It it is required then training to manage is required, if it is not required, then training is required to demonstrate pilot can manage the extra lift at real high AoA situations. In both cases simulator training would be required.

    I have great sadness for the families and friends of those killed in both accidents despite the pilots giving everything the had to avert the inevitable.

    Thanks again

    • Exactly. What were the quantitatively based results on the plane’s flying characteristics such that MCAS was proposed. In other words how bad was it? Were there other solutions? Must not be too bad if a decimated MCAS is now proposed.

  5. Thanks for the continuing excellent analysis. A few questions;
    1. Do you think that the aerodynamic forces were so high that even the electric trim couldn’t move the stabiliser in the ANU direction in the blips before the final dive?
    2. In the period where the cutout switches were off there is a small movement of the stabiliser in the AND direction. Do you think this was crew action (perhaps to check that it wasn’t completely jammed when they found that they couldn’t manually trim ANU) or is it possible that high loads could cause the stabiliser to self trim?
    3. In light of the difficulties with the manual trim as an effective backup, do you think a software fix to MCAS will be sufficient, or will a hardware fix to provide an effective backup trim system be required as well?

    • @1: Looking closely at the pitch trim graph, it appears that there was slight movement following the manual (electric) trim command.

    • 1. No, I think it could be moved. But the mantra is “Aviate, then Navigate and Communicate”. Aviate means to control the aircraft with the stick, trimming is for later, it’s a convenience function.
      2. No, we are looking at a movement sensor trace. This is movement of the stab from the air forces IMO.
      3. I think the software fix plus instructions+sim training re. the speeds to be flown in different emergencies will be fine.

  6. Well explained, thank you. Especially the reason the pilots couldn’t properly trim.

  7. IMJ, the industry should take a (long) hard look at the primitive 737 mechanical flight control system. It’s quite atrocious that due to an antiquated flight control system gone rogue, pilots on two passenger-carrying MAX aircraft have had to fight the control column and an impossible-to-move trim wheel with brute strength and raw muscle power.

    In an emergency situation pilots shouldn’t be put in a situation where they have to use all of their strength to maintain backpressure on the control column while at the same time trying to handle an impossible-to-move trim wheel — in a time-critical situation — where the correct decision-making is of the utmost importance.

    In the year 2019 the international civil aviation community should not accept an aircraft like the MAX — that is dependent upon an antiquated flight control system grandfathered from a design that first flew in April, 1967 — and they should therefore demand that Boeing will have to significantly re-design the aircraft in order to bring it up to current standards. That means a MAX Mk2 aircraft should — at the minimum — be outfitted with a Fly-By-Wire (FBW) flight control system using Electro-Hydraulic Servo Actuators (EHSA).

    In fact, all passenger aircraft designed in the west since the 737 have flight controls that can’t be controlled without hydraulic power (from the 747 and onwards). Of course, if there is loss of all of the hydraulic systems on a large commercial airliner, the flight controls are uncontrollable. However, that’s only occurred three times since the EIS of the 747 — the Japan Airlines Flight 123 out of Tokyo in 1985, the United Airlines Flight 232 that crash-landed at Sioux City in 1989 and the 2003 Baghdad DHL A300 attempted shootdown incident where, incredibly, the pilots managed to land the aircraft*.

    * https://en.wikipedia.org/wiki/2003_Baghdad_DHL_attempted_shootdown_incident

    Now, all of the 737 MAX aircraft in service that’s been grounded and the ones that have not yet been delivered by Boeing — in addition to the MAX aircraft that’s currently in production — should be re-designed and brought “back” to near NG standard using the CFM-56 engine instead of the LEAP-1B engine. All of the LEAP-1B engines that’s been manufactured could be put on a MAX Mk2 version.

    • Primitive, atrocious, antiquated. I’m fascinated by the adjectives deployed in criticisms of Boeing’s design philosophy. Newer and shinier does not necessarily equal better.

      • This is not about newer and shinier ( for that watch Randy@Boeing’s PR happy hour )

        This is about KISS as in “Keep It Simple, Stupid!”

        KISS is always better than CONVOLUTED SPAGHETTI KNOT.
        One reason being the fact that analysis is easier or even possible at all. Look at the 737 triggering unanticipated interacting design limits in galloping horde fashion.

    • Charles: Yes its safe. Yes they hae corrected the MCAS debacle, its not unknown though we wold have though not in this day and age.

      It has some aspect Boeing needs to get into the simulator training so the pilots can handle similar emergencies.

      The A320 and modern 737 have close to the same accident rate. Usually its pilot mistakes that have caused them.

      This is a rare case of not only a problem software but compounded with other aspect of how a 737 perform to push it over the edge.

      What will result is not just the fix for the software but increase pilot training in that stabilizer freeze up and how to deal with it.

      • Can I have some of those rose tinted glasses too? .. and the tranquilizing euphorizer pills that seem to come with the glasses?
        :-))

    • Flaps? Certainly not at the speed they were flying.

      Other suggestions about reducing thrust are off as well – the first reaction of the plane to reduced thrust is to nose down – the last thing they needed at their altitude.

      • Certainly not indeed, and especially not as (pointed out elsewhere on these pages) there’s clutches in the flap drive specifically to prevent flap deployment if the airspeed is too high. Select flaps down and nothing will happen.

      • So just keep the power maxed out to the point you have control issues? Let’s not exaggerate how much it would nose down by reducing thrust when the plane would still be moving fast.

  8. If the high altitude of the airport affected the required throttle setting, did the post AF447 instructions re AoA take high altitude airports into account? All? Most?

  9. Reuters give a different analysis :

    “How excess speed, hasty commands and flawed software doomed an Ethiopian Airlines 737 MAX”

    “Flying faster than recommended, the crew struggled with MCAS. But the high speed made it nearly impossible to use the controls to pull the nose up.”

    Why did they fly faster than recommenced ? The captain was 28 years old!!! Is that normal?? Is that reasonable ? The young copilot only accumulated several hundred flight time . Shouldn’t these facts contribute to some uneasiness toward Ethiopian Airlines which recorded its fourth crash?

    Shouldn’t manufactures make sure lunch customers are western like Airbus done when it switched A320Neo launch customer from Qatar to Lufthansa which conducted a lengthy process of acceptance before the plane was delivered to other customers?

    • You can’t trim even at normal speeds for the situation they were in, we proved this Wednesday. Boeing’s and FAA’s clear instructions were: “Hit cutout, then trim manually”. You can’t in a large part of the approved speed envelope. No word about the speeds to fly in the AD or Checklists associated with MCAS. So now coming and quarterbacking about why this speeds? This is 20-20.

      PS For those were English is not the first language, like for me:
      The definition of a Monday morning quarterback is someone who is always criticizing and saying how he would have done something better or differently after the event has passed. DS

      • Bjorn,

        Do you know the speed at which you need to be the Incredible Hulk to perform manual trim. In other words at what speed is manual trim no longer viable

      • This is disingenuous. The entire point of crash investigations is to “Monday Morning Quarterback.” And the vast majority of these classified by the NTSB and other agencies – not me – as “pilot error.”

        Whats the point of investigating a crash like this. Why not just blame MCAS 100%, shut down Boeing, ground the Max forever – that’s easy. Just read the clickbait articles, that’s all you the justification you need.

        InsYou analysis in this article is highly detailed, but to dismiss steps that put the jet in more danger, like putting the flaps up when you have a known AoA disagree and a stick shaker…..leaving the throttles at takeoff power throughout the flight….not trimming against the MCAS for long enough…cutting the stab trim switches with the aircraft in a nose down position and at way too high a speed….

        All that needs to be considered in why the jet crashed so that future pilots can have the information they need to not make the same mistake. Otherwise lets shut down the NTSB and be done with it.

        • >This is disingenuous. The entire point of crash investigations
          >is to “Monday Morning Quarterback.”

          That’s not right. A Monday morning quarterback didn’t play in the game on Sunday, and wasn’t picked for the team for a very good reason…

          In contrast, crash investigators really do know how to go about their business. Bjorn knows his stuff very well indeed too, having “played in the game professionally”.

          We can all support Bjorn in seeking to ensure that his carefully considered article isn’t sullied by idiotic offensive commentary from an actual Monday Morning Quarterback.

          • If “quarterbacking about why the speed” is not allowed then I suppose it’s Boeing’s fault for not designing the plane so that it could be flown at 500 knots without any control issues.

          • Or it’s Boeing’s fault for designing an aircraft that can heap hard to manage problems on its pilots quicker than they can deal with them and for which there is no accurate sim training available, compounded by unrealistic ADs, inexplicable design changes between NG and MAX concerning switches, and inadequate redundancy in an automatic and exceptionally abrupt flight control which has poorly thought out functionality and cannot be disabled without effectively removing all powered trim options from the pilot. And it wasn’t even mentioned in the manual.

            Take your pick.

    • @David

      As Bjorn has said “And with Stick Shaker and IAS disagree you keep high thrust and fly a slow climb” Bole airport is over 7600 feet altitude, and it’s fairly warm average 24 to 30 degrees Celsius at the time of the crash i.e. hot, and high.

      Also if you read the report, they were ” Ground Proximity Warning System (GPWS) “DON’T SINK”” warnings, the pilots had “a high workload environment” to deal with, throttling back would not be uppermost in their mind.

      I think there are very few pilots, if any that would have fared any better.

      BTW Ethiopian Airlines actually has a 737 MAX simulator, how many of the Western Customers so far have one ? Some US airlines have then scheduled to be delivered at the end of this year !

      A link to the report is on this site, it’s worth reading it.

      Hi Bjorn, regarding “You can’t in a large part of the approved speed envelope” surely that has to be addressed as part of the fix ?

      • Is it just a MAX simulator or one that actually knows about MCAS.? ( Elsewhere I read that the commercially available simulators do not represent MCAS functions properly.. if at all? )

        • I read that as well — that MCAS isn’t represented in the MAX simulator.

    • @David, 28 (or 29, according to AV Herald) is not that young, and “ATPL, 8122 hours total, B737NG experience 1417 hours, B38M experience 103 hours” does not sound inexperienced to me, but industry experts might give a better assessment.

      Re: This being Ethiopian’s fourth crash, I have no idea how you counted. Wikipedia lists more accidents and incidents, including quite a few hull losses over the years. However, in the past 20 years, discounting for hijackings, I see only one potentially troubling accident, Ethiopian Airlines Flight 409. Overall, Ethiopian has a rather good reputation, and I do not see a worrying safety record.

      Re: Airbus switching neo launch customer to LH – are you sure that was completely Airbus’ choice and not because Qatar’s famously picky leadership did not want to take the first a/c? Also, of course, I do not see “Western” carriers being in any way superior to Qatar, of all airlines…

      • Qatar did not want to take delivery of the first 320NEO due to an issue with the P&W GTF requiring extra cooldown, so LH took delivery

    • A bit too busy shoving people that can’t talk back under the bus to Boeing’s perceived advantage.

    • David very unclever use of true statements to project your bias, let google set you free.

      “Shouldn’t manufactures make sure lunch customers are western like Airbus done when it switched A320Neo launch customer from Qatar to Lufthansa which conducted a lengthy process of acceptance before the plane was delivered to other customers?”

      Airbus did not switch launch customers from the Skytrax 5 star airline to a European legacy carrier. Qatar didn’t accept the operational limitations imposed regarding the engines at service entry.

      https://www.flightglobal.com/news/articles/pw-fix-will-cut-pw1100g-start-up-delay-in-half-424321

      As for the lengthy process of acceptance with LH, that’s because they wouldn’t accept anymore aircraft.

      https://www.reuters.com/article/us-lufthansa-results-a320/lufthansa-says-a320neo-engine-improving-but-not-there-yet-idUSKCN0WJ1YY

      Perhaps Boeing should tell their customers whether Western or “Third world” the changes they have made to the plane that they have bought, so they too can make informed decisions on whether to accept an aircraft.

  10. Dear Bjorn, NO the flight crew did not follow the procedures Boeing requires of pilots. First of all they did not carry out the unreliable airspeed memory items. According to the report the CP did not only have stick shaker but also deviating airspeed indications from the right side. This calls for AP off, AT off, FD off and Pitch 10° and 80% N1 based on Flaps extended. This would also have prevented the airplane from reaching VMO. These memory items are not a recommendation but MUST be carried out by the crew in this situation (there are no obstructions for at least 40NM for a 07R straight out departure). Following these memory items the crew would then have entered the checklist once the AC is stabilized. According to the checklist no configuration change should be made until you figure out which IAS indicator is reliable. To summarize there would not have been a need to ever retract the flaps and MCAS would never have engaged. Instead the CP attempted 3 times to engage the AP on his side (the one with the stick shaker). He finally succeeded the third time at 1000 FT when the AP engaged for 33 seconds. Engaging the AP on the FCC A side which obviously has sensor issuers as shown by the stick shaker demonstrates very little situational awareness. I could go on with many other points in which the crew did not react as Boeing advised the pilots after Lion Air 610 but instead I will just mention one more thing. When they finally did try to move the stab trim manually their speed was already 340 IAS according to the left side ore more likely at least 360 IAS acc. To the right side. That the man stab trim will not work anymore at this point is not a surprise. The pilots should never have let the airplane get to that state. If my engine fails and I do not apply ruder immediately to counter the adverse yaw, then at some point I will not be able to recover the airplane anymore. It is the pilot’s responsibility to not let the airplane get to that point. With this post I am not saying that Boeing isn’t largely to blame for these two crashes but to state the pilots followed the prescribed procedures… based on the facts presented in the report that statement simply isn’t true.

    • Could you provide a reference for this. At 50ft off the ground, it’s a very interesting set of memory actions to do even if the stick shaker was telling the truth. In other words, is there a minimum altitude for these actions. My view is that it would cause the airplane to sink, perhaps by more than 50 ft. In other words, it would crash.

      I think the pilots had a right to ignore the stick shaker as a false, untruthful, warning from the FCC. Afterall, the AoA registered ~75 degrees left seat and ~15 degrees right seat.

      The pilots correctly understood that they had flight control problems, which means they decided CORRECTLY not to accept the stick shaker warning.

      The question is could they accept any air data readings for they appear to be all over the place? As another commentator said in the article that posted the report: There is more to this, or words to that effect.

      I’m still trying to take in the graphs, not had time to do it. Bjorn has clearly put in a lot of work. Great article.

      • The reference is the Quick Reference Handbook that contains non-normal checklists and also performance data as well as information on emergency maneuvers such as stall recovery or whind shear escape maneuver amongst others. The QRH generally doesn’t explain to the pilots why certain actions are required. For a better understanding the pilot can look into the technical Manual or the flight crew training manual. Concerning airspeed unreliabe it says: “Memory items for target pitch and thrust must be accomplished as soon as it is suspected that airspeed indications are incorrect. The intent of having memorized pitch and thrust settings is to quickly put the airplane in a safe regime until the Airspeed Unreliable checklist can be referenced. The memorized settings are calculated to work for all model/engine combinations, at all weights and at all altitudes. The flaps extended settings will be sufficient such that the actual airspeed remains above stick shaker and below the flap placard limit. The flaps extended pitch and thrust settings will result in a climb.”
        The trigger for carrying out the memory items is not the stick shaker but the difference in airspeed indication which they had. These memory items would not have been carried out in 50 FT. The airplane climbs a lot faster than your comment suggests you believe. By the time the memory items are completed I assume the airplane will be at least 1000 Ft high already and will then continue to climb (as written above) As I mentioned already there were no obstacles for at least 40 NM on their flight path straight ahead.
        It does go against the procedure to not carry out the memory items but if the pilots are convinced they know what the problem is (which you can never be at that stage in the flight so one shoud carry out the memory items), then they should decided to make the FO the pilot flying and also use Autopilot B which receives it’s commands from Flight Control Computer B which has seperate sensot inputs than the left A system. It certainly does not make any sense to attempt to engage Autopilot A with obviously faulty sensor information as I already stated.
        About all the comments basically stating the pilots couldn’t have done anything better. It doesn’t help anyone to state they did everything perfect and then lay all the blame on Boeing. All the causes of this accident must be looked at in order to prevent a similar event from happening. If it turns out that the pilots could have done something better this must be addressed. Systems will continue to fail and if pilots are having trouble regaining aircraft control in these cases, then training needs to focus on improving those skills. The same is true for adherence to memory items.

        • The FAA and Boeing had 5 months to update the emergency AD to address your words if they thought your words were correct. We can then add university aeronautical engineering departments all over the world. A cast of thousands versus two pilots.

          The pilots were told to treat it as trim stabiliser runaway. Your saying treat it as a stall. If the cast of thousands thought you were right, I’m sure they would have said so.

          The problem I have is that the FAA emergency AD didn’t work. Which means it wasn’t tested even though Boeing and the FAA had 5 1/2 years of development to test it with a cast of thousands. Two pilots were given just a few minutes to test it whilst riding a raging bull straight out of the gate. They then found it didn’t work. Whether you like it or not, that is unforgiveable.

          Mark, you set very high standards. I sure you meet them. I think not!

          • Please read my comment again. I said according to the situation they were in, they should have carried out the airspeed unreliable memory items. That has nothing to do with stall recovery. The need to carry out these memory items was also highlighted in the Lion Air preliminary report. I explained quite clearly using official Boeing 737 manuals why they should have been carried out. About the stab trim runaway memory items: Those need to be carried out once the stabilizier trim wheels start to run away. However, this should not even have occured as I already explained now. If you think that crews adhering to established procedures is a very high standard then your bar for a high standard is set quite low in my opinion. ET302 is a very unique accident because prior to it we already had one crew with the same problem who solved it and then another crew who tragically crashed. Under those circumstances, I find the actions of ET302 difficult to understand. Nonetheless, I do agree with you that Boeing should have provided more agressively more information to the pilots on how to avoid this type of accident. Also a quicker software update -maybe at first just having MCAS rely on both Sensor signals (and the adding a more advanced update later)- would have prevented this accident.

          • “treat it as trim stabiliser runaway”

            You seem to be of the view that the problem started when MCAS activated. They had unreliable airspeed before then and it was the failure to resolve THAT by setting appropriate pitch and power that’s the root problem here.

            I’ll add that Boeing’s checklist for trim stabliser runaway boldfaces “not” in do not toggle back the stab trim cutout switches yet they did so anyway.

            Mark is 100% on the money here.

        • John

          I said I wouldn’t respond. But, the pilots could not order a 10° pitch up. The FCC would respond with a 65° pitch down or at least suggest it because of the AoA reading of 75° .

          Sorry, but the option you are suggesting was not open to the pilots. Give them credit. They called it and they called it right. What they were instructed to do didn’t work.

          So no, what you say just puts the airplane into the ground. But regardless this airplane was going to crash.

          No.

          • Phillip,
            You lack a basic understanding of how the systems work. The ADI which is used to set the pitch is not affected. You just fly the plane manually and set pitch and power and go from there. Gives you time to analyze the problem.
            Makes me wonder if this is a language barrier thing. When we are talking about setting a pitch it’s not a knob or something you turn in the cockpit. You pull/push on the yoke until you have the correct pitch on the attitude indicator or look out the window. The Attitude indicator was showing correct information.
            In the US we don’t rely on automation to the extent that is seen in other parts of the world. A pilot used to manually flying the airplane would’ve had much better odds at a successful outcome in this particular emergency.

        • Cut back the power to the engine from 94% so that they flight at expected speeds would help allow manually trimming the aircraft as expected

          • Reducing thrust would result in the nose dropping. They simply didn’t have the altitude to spare in order to try it.

      • Marks assesment is absolutely correct. Initially what they had was unreliable airspeed as a result of the faulty AOA probe. This first develops into a flight control issue after they decide to raise the flaps which in turn activates MCAS.
        They wouldn’t be dealing with this at 50’ but at a safer altitude of 1000’ agl. It’s not a memory item although most pilots probably have it memorized, but an item on our Quick Reference Card QRC. Normally you would reference this before changing flap configuration and especially considering the stick shaker was going off, I would be very wary of raising the flaps.
        The crew was overloaded for sure, so it’s understable mistakes happen, but Marks assesment about them not following the correct checklist initially is correct. After that leaving the throttle at N1 causing the speed to get out of control is what makes this unrecoverable.

        • Mark & John

          To the pilots, all the air data was unreliable. So they could have picked any one piece of data and acted on that one piece of data.

          You have isolated the air speed data and said that takes precident. In doing do you are absolutely saying the airspeed data was wrong. Perhaps the air speed data was right.

          The pilots were told to pick the AoA by the FAA and Boeing. As one AoA reading was 75° pitch, I think it’s safe the AoA was wrong. So the pilots carried out the runaway trim stabiliser procedure as set out in the FAA emergency AD.

          If you are right why didn’t the FAA and Boeing add it to the emergency AD. Perhaps they knew that invalid AoA data invalids all air data. FCCs have correction charts. It’s already been mentioned, that the AoA sensor is subject to a correction chart. The same applies to the air speed sensor – AoA does affect the pitot, the air speed sensor. Get my drift.

          Anyway adding your suggestion to the FAA emergency AD is easy, N1 80%, pitch 10° – but what is 10° , the AoA is wrong. Then the flaps, keep them extended. Out of interest how do you land? In other words, at some point the pilots must make changes to get their airplane on the ground.

          I think we can all agree that if the pilots had continued the climbout to a safe altitude and 200 knots with flaps extended and kept it there; then did a go round at that airspeed and flaps extended; then did a power up, flaps extended, high speed landing; remembering that at all times they couldn’t trust the air data? Yep, they would all be alive.

          It’s John Wayne. Not real life.

          Have a word with the FAA and Boeing. The cast of thousands have it wrong. You have it right.

          After 5 1/2 years of development they didn’t test the trim stabiliser runaway procedure. If they had they would have know the trim stabiliser can overpower the elevators, without coming anywhere near pushing the envelope. If they had they would have known manual trim needed super human strength, again, without coming anywhere near pushing the envelope. Inexcusable.

          As you say poor situational awareness.

          • Hi Philip, addressing your points below:
            They had no idea what their AOA was doing. The readouts you have on the recorder was not visible to the pilots. There are two safety features that are optional on the 737 MAX. An actual AOA indicator or just an AOA Disagree light. Their Airline had purchased neither of these options. Boeing will make the AOA disagree light standard in the future, but the AOA indicator will remain a paid for option.
            You wrote “pilots were told to pick AOA by the FAA”. Where are you getting that from?
            The AD addresses MCAS activation. You first apply the ADs procedure if you have an unwanted MCAS activation. If the Flaps are never raised you will never see this and hence never apply the procedure.
            Setting 10 degrees of pitch is done on your Attitude indicator which were working fine in these accidents. Even if they had an AOA readout, which they didn’t, you don’t use that to set the pitch.
            T/O flap setting in this case was 5 had they opted to keep The flaps down, they would just have left them there and set more flaps for landing.
            If the speed is kept under control it is not a problem manually trimming the 737. We practice this in the simulator. You can even fly the plane level with full nose down trim as long as the speed is reasonable. If the throttles are left up and speed gets out of control, not so much. Both the airspeed unreliable and the Runaway Stabilizer checklists includes a step to disengage the auto throttle to prevent this from happening.
            Like I said before. They had a lot of stuff going on and mistakes are understandable. Just don’t agree with the statement they followed procedure.
            The AD specifically also states not to reenage the CUTOUT switches. Most likely an act out of desperation on their part because they couldn’t turn the trim wheel manually, but it ended up being a fatal mistake. Only thing that would’ve helped at that point was slowing the jet down and minimize the control forces. This would’ve allowed level flight and the ability to turn the trim manually.
            This was definitely a complex emergency and a handful for any pilot. I’m sure they did what they could given the tools they were provided (faulty system, experience level, training, automation dependency etc. etc.)

          • Philip, Based on your three comments here it is obvious that you have very limited knowledge about procedures for flying an airplane in non normal situations and the overall technical issues involved. As the non pilot you seem to be, you have every right to participate in these discussions. However, if you are going to argue stating things which are wrong and basically only demonstrate your lack of knowledge, then this discussion will go on endlessly for no good reason.
            You are confusing angle of attack and pitch attitude to be the same thing – it is not. The aircraft’s pitch attitude is displayed by the air data inertial reference unit. There is one ADIRU for the CP side and one for the FO side. Angle of Attack is one of several sensor inputs the ADIRU receives and does not affect the display of the airplane’s pitch attitude on the pilot’s primary flight display. Boeing points out in the airspeed unreliable checklist that the following indications are reliable: Pitch attitude, N1, Ground Speed, Radio Altitude.
            The airplane can be flown with only setting established pitch and power values. After the memorized pitch and power values have been set depending on flaps extended or retracted (10° 80% or 4° 75%) and the airplane path is stable the pilots can refer to the QRH and find all the required values based on their aircraft’s weight in order to fly level, carry out the approach and land with a normal landing flap setting (Flaps 30/40) the plane again. I can assure you the captain of ET302 has practiced this in the simulator several times.
            In the case of ET320 there probably would not have been a need for that. Once they would have compared the QRH values to the IAS indications on the FO side, I assume they would have seen those are reliable. They could then have switched everything to the FO side and landed again, even using Autopilot B for part of the approach. There would not have been any need to retract the flaps from Flaps 5 at any time during this process.
            Ignoring everything I have said prior, had they countered the nose down trim caused by MCAS sufficiently with electric nose up trim which is exactly what Boeing states and then disabled MCAS they could have continued flying safely as well. From reading the report it doesn’t seem like they actually carried out the stab trim runaway memory items and all the considerations Boeing highlighted in the AD. Instead they just thought of setting the stab trim cut out switches to cut out without trimming out the control forces first, disconnecting autothrottle etc. From the operating instructions from Boeing after Lion Air 610: “Initially higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces BEFORE moving the stab trim cut out switches to cut out.” It seems to be an inconvenient fact to some people but please remember that the crew prior to Lion Air flight 610 did exactly that and they landed the airplane safely afterwards. Th ET302 crew even had the benefit of reading all about this flight and the Lion Air 610 flight.

          • John & Mark

            Orwellian behaviour. Choose information that supports your agenda and give it supremacy. Then discount all other information on that basis. You have given air speed data supremacy for the purpose of supporting your agenda.

            I’d agree if the FAA and Boeing agreed by amending the emergency AD. They had 5 months to do it with a cast of thousands in support.

            By the way the pilots called out left alpha vane at 05.42.54. So your suggestion that they didn’t know it was the left AoA is wrong. Read the report, it’s very good. I know it doesn’t support your agenda, but you can’t have everything.

            The Lion Air report is less informed. But it is to be expected. The pilots didn’t know that MCAS existed. Equally the FAA and Boeing only began to own up after the Ethiopian Airline crash. They have an awful lot more owning up to do.

            I am by the way an aeronautical engineer (Machester University), but who cares. I can’t go through all your points. So I’ll just choose one, the critical one. Setting the pitch at 10°. To do that, the FCC must reference the AoA. The pilot doesn’t have to, but the FCC must. Otherwise there is no reference point.

            In other words, pilots can deal in absolutes but FCCs must deal in relatives. This is why airplanes need to be calibrated using a flight test programme. The flight test programme creates correction charts to ensure the references are accurate, among many other things.

            So the FCC must reference the AoA to move the pitch to 10°. As the AoA was saying 75°, the FCC would push or recommend pushing the nose down by 65°. Isn’t that what happened?

            Remember John Wayne didn’t go to war. In both crashes the pilots were at war with airplanes that were raging bulls straight out of the gate.

            I won’t reply again. I think I made my point. The pilots called it correctly at 05.42.54. The pilots were James Stewart, there’s a real war hero!

          • Phillip,
            You are correct about the call out, so they must’ve bought the option, but that doesn’t change anything. It’s still a case of unreliable airspeed at that point.
            The AD is not suggesting otherwise. You don’t apply Runaway Stabilizer checklist unless you get uncommanded horizontal stabilizer movement combined with one of the other indications (AOA disagree being one of them)
            The AOA disagree light doesn’t necessarily mean you will run into MCAS problems although of course it’s possible and did happen in this instance. It does however mean there is a chance you will get Airspeed and Altimeter errors which would trigger the need for unreliable airspeeed checklist.
            There are so many misunderstandings in your posts. You seem to not understand that AOA and pitch are two completely different things. If you are setting 10 degree pitch on the ADI, it doesn’t matter what the FCC is thinking you are doing. That’s why you kick the automation off and revert to known pitch and power settings when you have unreliable airspeed.

          • John

            Pitch is the vertical rotation of the nose about the point of neutral stability. For aitplanes the point of neutral stability varies slightly in a flight but is close to the centre of lift. For symmetric missiles the point of neutral stability is the same as the centre of lift. Airplanes are not symmetric, that’s why the point of neutral stability moves slightly from the centre of lift.

            How is the pitch calculated? It uses alpha vane sensors. If there’s another sensor, then please tell.

            One clarification. Inertial referencing units. The 737 MAX has two. They have accelerometers in pitch, roll and yaw. They are an alternative sensor. But have latency, so alpha vane sensors are still the primary sensor for calculating pitch.

            I entirely understand that pilots dial in numbers for pitch, speed, altitude and direction. So pilots deal in absolutes. But the FCC must deal in relatives, it must translate the absolute into a relative change. A delta. So if the current pitch is 5° and the new pitch is 10°, the delta is 5°. Control surfaces are then moved according to the delta.

            Sensors are reference points. They provide the raw data that the FCC uses to perform it’s calculations for the purpose of determining the delta.

            The alpha vane offered a value of 75°. That’s not possible. So the pitch calculation will be wrong, very, very wrong. Any delta calculation would then be wrong. So dialing in a pitch of 10° will cause a delta that will put the nose down.

            As all of the air data was wrong, it’s best not to trust any of it. Best to look out of the window at the horizon to judge pitch, altitude and speed. But keep the power on.

          • Sorry,

            Forgot to explain AoA. Technically it depends on the which part of the airplane you are talking about. Wings, fuselage stabiliser for thry are all different. But typically the wing is used to determine AoA. So the mean chord line of the aerofoil’s angle to the airflow.

            The AoA is also calculated using the alpha vane.

            Typically there isn’t a great deal of difference between pitch and AoA, so people do tend to use the words interchanageably. I’m fine with that.

            The key point is that both are calculated using the alpha vane. That was registering 75°.

            So no.

          • Phillip,

            I give up. You have no idea what you are talking about.

        • John

          Otherway round. Look it up in any technical journal. First year longitudinal stability at Univerity. Even Wiki have good articles. In particulsr, look up ststic margin, for that is at the root of 737 MAX problems.

          So, in summary, the alpha vane is used to calculate both the pitch and the AoA. It is also is used to calculate true air speed because of the effects of AoA on the pitot. Your offering a procedure that uses the one sensor that failed. Stupid. The pilots knew it was stupid.

          I don’t think you and Mark knew what an alpha vane was which is why both of you claimed the pilots didn’t call left AoA (left alpha vane). See your comments.

          You said I didn’t know the difference between pitch and AoA. If what I said is wrong, you could have corrected me. You can’t correct me. I could of lied and you wouldn’t have known.

          I also give up.

          • Pitch is measured using a gyroscope (in the old days a conventional one, nowadays usually a ring-laser gyroscope) inside the Inertial Reference Unit, not by the angle-of-attack vane. Every book on aircraft instruments will tell you so, and this is also taught in aeronautical engineering programmes. The following link is an interesting read if you want to know more about inertial navigation: http://www.aerostudents.com/courses/avionics/InertialNavigationSystems.pdf

          • Philip,

            I have been a pilot for the last 30+ years and have flown a lot of different aircraft all from small aircraft to fighters to B737s. I know what I’m talking about.
            My initial comment about them not having any idea what the AOA was is correct. The only thing the Left Alpha Vane light tells them is that the left AOA vane is no longer heated (ANTI ICE)
            In an Airspeed Unreliable scenario, one of the instruments you can safely rely on is the Attitude Indicator (To set the pitch) The others are N1, Ground Speed and Radio Altitude.
            Ref: B737MAX QRH 10.1 if you need to look it up.
            You need some studying up on how an attitude indicator works. That’s the instrument you use to set your pitch in case you were wondering. You could of course also just look out the window.

  11. I appreciate the easy to understand explanation of the raw information in the preliminary report. I have two questions though.

    1. Does the 737 not have an auto-throttle function that would keep the speed within normal limits? Or was that not turned on? Or is it an option that this aircraft did not have?

    2. Although you explained why the high throttle setting is normal for that airport, were the pilots too busy paying attention to the continuosly increasing speed? Or would a reduction of thrust lead to a further pitch down momentum that the pilots did not want to deal with?

    Reading your article makes it very clear that there was not much if not anything at all that you could call pilot error, yet on other forums so many armchair pilots blame the two pilots for all kinds of ommissions and errors. That’s really disturbing.

    • To answer question number 1:

      1. All 737s are equipped with an autothrottle system. However, during climb it is usually in N1 mode and it is the pilot’s responsibility to control the speed using pitch control when the autopilot is not engaged. During level flight (in MCP SPD/FMC SPD) mode the auto throttle would keep the speed to a set level on the Mode Control Panel.

      I agree that many armchair pilots (or even non-pilots) rush to conclusions, instead of respectfully analysing the data we have.

  12. I wonder, was the AoA conneted to the left(captain) or right(co-pilot) at take off, a manual take off from the left but with the auto pilot on two minuts later would take the MCAS on the right AoA. That is trouble. If the AoA was connected to the right, the flying pilot has trouble to the left. No connection. Any input has to come from the right.
    Is this so, Björn.

  13. Yes, if they have put the flaps back at 5, it would have stopped many things. But pilots are trained to follow a strict regime, and so may not have experimented here, by lowering the flap when the speeds are above the limits for flaps DN. (Just a thought why)
    But I still cannot figure out why the crew did not reduce engine power, when the speeds were going to Vmo. That could have reduced the column forces, and also reduce the sharp nose down movement of aircraft when the MCAS kicked in again at 8. Why they did not immediately counter by manual trim at 8? I think it is too much to expect when they are fighting for their life with the aircraft pointing towards mothers earth.
    Very sad indeed and more I read about this incident, it brings tears to my eyes. An avoidable accident if only FAA and Boeing had taken more aggressive action after Lion air.

  14. This might be a stupid question, but would engaging the autopilot have helped the pilots? MCAS is cut out when autopilot is in. Could they have engaged the autopilot in this situation?

    • From my understanding of how the Autopilot works, the AoA sensor disagree would cause it to cut out and be unavailable to the pilots.

  15. Thanks for the great analysis Bjorn.something I don’t get and this might sound like a really really stupid question , at one point you mention :
    The Pilots are thrown off their seats, hitting the cockpit roof. Aren’t the pilots wearing their seatbelt ? The 5 points seatbelt is mandatory at takeoff ( as mention in one of mentour pilot video) I think after that they can take the shoulder strap off but aren’t the pilot obligated to keep the remaining 3 strap at all times while they are piloting the plane ? Again this might be a case where the answers is staring right in my face and I don’t see it.

  16. I have yet to see anybody comment about this:
    From 05:40:42to 05:43:11 (about two and a half minutes), the stabilizer position gradually moved in the AND direction from 2.3 units to 2.1 units.

    Trim was cutout … so this must have been from by-hand … but why AND?
    Perhaps the (relatively new) co-pilot was able to spin the wheel … but went the wrong direction?

    • Maybe the copilot found that the wheel was stuck when he tried to trim it ANU and then tried it AND to see if it would unstick the wheel. Perhaps this was the point when the pilots realized that the forces on the jackscrew were simply too large to trim it ANU?

    • It is hard to tell from the graph data if what you are seeing is real. Airspeed was increasing during this time frame. A truss leads forward from the stab to the jackscrew. It occurs to me that increasing aerodynamic stresses on the stab could cause the truss to bend as airspeed increased, resulting in the slight decrease in recorded stab units in the AND direction? I’m neither a pilot nor engineer, yet I do know that ball bearing lead screws will pretty much plant in place under really high loads if the ball bearings are harder than the lead screw or the lead which contains the ball bearings. Any very slight machining defect in terms of the pitch of the lead screw and the ball bearing races will exacerbate this. For example, I don’t like what I hear starting at 1:11 in this YouTube video: https://bit.ly/2WUrXej

    • I’m very happy to notice someone points this one out. Keep exploring that path, sir; maybe, just maybe, you might eventually consider a second failure. Well, as long as you will agree degradation of performance can be called a failure. And then, go look back at PT610 data.

  17. Thanks for the great analysis. It’s refreshing to read an in-depth article that does not have the intention to throw the pilot under the bus . . .

    With respect to elevator trim point 7 and 8 (and perhaps also the end of 5), is it possible for aerodynamic forces being so high that even the trim motor was no longer able to turn the jackscrew? Is there perhaps a (hidden) overload cut out on the trim motor that kicked in at these points?

    While the graphs may suggest the pilots stopped nose-up trimming, perhaps in reality some other mechanism was cutting short the electric nose up trimming, preventing the PF from balancing the elevator.

    It seems strange that at point 5 nose-up trimming stopped well before the elevator/control column was even close to being balanced in pitch.
    If the PF felt the trim response on the control column, why wouldn’t he continue with the nose-up trimming, if there still was significant nose-up force required on the control column?
    Perhaps not wise to trim all in one go, but certainly after 5 – 10 seconds what would be stopping him from doing another 5-10 second nose-up trim burst, replicating point 5?

    This all suggests that some other mechanism (aerodynamic loading?) was in place preventing the trim motor from reaching balanced elevator condition.

  18. Any idea why this happens: “there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes. These oscillations continued also after the autopilot was disengaged.”

    • Maybe the MCAS/AoA data also provides input into the load alleviation system, which is also deflecting spoilers, perhaps asymmetrically, causing these oscillations.

    • I think that this is because the left stick shaker was active the entire time. Pilot, with his mind in overdrive, instantly reacting to every little nuance?

  19. I find human factors incredibly interesting and I think a lot of commentators (and possibly Boeing)badly underestimate them.
    How does 10,000 hours experience of nothing bad happening benefit a pilot when a problem does eventually arise?On the other hand we have muscle memory which takes thousands of hours until you do something instinctively.
    A good example is controlling a skid in car.The average person can’t do much more than bury the brake pedal and point the car in the direction they wanted to go when under extreme pressure .Only those who have spent a lot of time and money burning tyres can instinctively straighten the steering and release the brakes.I just can’t see how a limited amount of time on an iPad or even a simulator can get a pilot out of a counterintuitive situation.

    • I guess the answer is that that what simulators are for. Pity there are none on which they could have been trained.

      I also wonder if Boeing actually has any real understanding of their own aircraft, never mind the human factors involved in flying it. Given that the stiffness of the manual trim seems to have come as a widespread surprise, one can only surmise that there’s no one in Boeing with any really deep experience of using it. If there were, or if they’d flown it, that AD would never have seen the light of day.

      I suppose that had Boeing actually gone and flown the AD themselves, there’s a good chance that they’d have crashed too.

  20. Hello Bjorn,

    thanks for the excelent coverage.
    What would the DFDR record as manual electric trim input?
    – Activation of column switches
    – Energizing the electric motor
    – Movment of electric motor drive shaft

    Would you expect the electric trim motor to be able to move the stabilizer?

    If it was choke by aerodynamic counter forces, wouldn’t it be very natural to toggle the switch hoping it would break loose?
    How would toggeling look on the DFDR, i.e. what is the DAQ rate?

    There seem to be MCAS trim commands up to 9s. Wasn’t it communicated to kick in for 5s with a break of 10s?

    Thanks
    Benjamin

  21. Pontification:

    i) 2024-25 EIS for the NMA feels more and more remote if MAX grounding lasts over 90 days. And the MAX certification review recoils may push the grounding to the 3-6 months time line. And the NMA certification will be no cigar. That we know now.
    BA may be losing up to 6-12 months of NMA mindshare in this unfortunate chain of events.

    ii) AB can ponce hard with their 321XLR or 322 perhaps investing in new wing/etc. I’d accelerate/invest on this right now in their shoes, assuming that not what’s happening. They can push the nail deeper in the MAX debacle that way.

    All new single aisle not viable as per engine tech. BA won’t do that investment-wise. NMA becomes even more urgent.

  22. All I can say is Holy ***K!! Poor guys, RIP. Thanks for the haunting but clear analysis Bjorn. 🙁 They were on a bucking bronco and it killed them.

  23. I think many are concentrating on the fact that power was not reduced allowing the speed to build up.

    It’s not part of the FAA emergency AD to reduce power. The same applies to engaging flaps once speed is reduced.

    Anyway Bjorn said that manual trim becomes inoperable at much lower speed. How low I don’t know. But I can imagine that without a motor it could be as low as 200 knots or less. 200 knots is enough to cause significant dynamic pressure at ~8000 ft.

    Somebody said that the motor for manual trim was removed with the 737 NG. So it’s wires and wheels, 1940 style. Why?

    This comes to the elevator. Why were we not allowed to see the elevator deflections as made clear by the article. It would be useful to know at what speed the elevator becomes inoperable. Bjorn’s returned to blowback. But the speeds do need to be up for blowback to occur.

    To me it looks as though MCAS 2.0 is going to have to severely restrict the deflections of the trim stabiliser to ensure the elevators remain operable. As I said a long time ago elevators maneuver airplanes not trim stabiliser. As Bjorn said, but with my interpretation, trim is nice but elevators are a must.

    This then poses a question. If the trim stabiliser is severely restricted what will prevent the aggressive pitch up/nose up tendency?

    • I share your concern about MCAS 2.0.

      Boeing have said that it’s been added to. In Systems Engineering speak, they’ve added more functions. One of these is to disable MCAS under fault conditions.

      I would say that this new function is “safety critical”. Anything that’s keeping MCAS from doing a bad thing is surely safety critical. We’ve seen twice now what unconstrained MCAS can do. In otherwords, this function really, really must determine that there is a fault with 100% reliability, otherwise it might not disable MCAS when it really should.

      The bet-the-company question is, whether or not the right hardware resources (multiple computers to redundantly host the function) already exists on the aircraft. I don’t know. MCAS was originally categorised as the next safety category down, and read one single sensor, so perhaps there was no facilities made for redundant implementations and executions of the software. If so, this new function cannot be made “safety critical” through just a software patch.

    • “It’s not part of the FAA emergency AD to reduce power”

      They had a problem before MCAS activated, namely unreliable airspeed, which called for reducing power and they didn’t do that.

      In any case, having flight control problems calls for a reasonable power setting regardless.

  24. I’m not going to dive into the conversation here on all the alternatives the pilots could or could not have done, I think repercussions for Boeing and the USA are more interesting.

    First off FAA has lost their high ground, I imagine every single avaition authority in the the larger, developed markets relying far less on on FAA air worthiness recommendations. Boeing planes will take longer to certify outside of the USA.

    The max should loose its type certication vis a vie the NG and pilots be trained as though it was a new type: an app on an IPad is no longer sufficient, fix or not. This should extend to subsequent plane evolutions going forward, Boeing or otherwise.

    Finally I can see China using this as a way to promote their own planes in development, at least at home.

  25. My understanding is a lot of the issues with the MAX (and 737 generally) don’t arise with FBW aircraft – manual trim is not a thing in such an aircraft, no?

    An interesting potential outcome of this would be countries adopting bans on non-FBW aircraft by their carriers. E.g. China & India and others announcing that, with some lead time, their carriers will no longer be able to acquire aircraft that are not FBW.

    Not saying it will happen, saying that it’s not out of the question. So far as I can tell, the last significant commercial pax program that is not FBW is the 737. 777, 787 – FBW. All Airbus programs, FBW. E-jet FBW. 767 is still in production, but not for pax applications. 747 no longer commercially relevant. Etc.

  26. I suppose it isn’t that helpful for me to add this, but it seems Boeing has produced a dangerous aircraft that they ast the manufacturer don’t fully understand.
    They issued an AD to pilots that did not protect the crew or passengers.
    In my angry opinion as a frequent flier, BA senior management should resign in disgrace. Their corporate culture is deeply wrong.

    • As I understand it the second issue concerns the flaps, described as a minor issue, but one that is critical to flight safety.

      Oxymoron anyone ?

      • Indeed. This is where Boeing (and the FAA) having lost considerable credibility, cannot rely on a ‘trust us when we say it is minor’ stance. It may very well be, but doubt is the fair reception.

        • Well I think we can allow this is going to get a clean scrub by both.

          Not that it should have come to this.

          Software wise the new control system that was added seems more likely.

          Spoilers? Flap erons? I know they did a FBW change on something on the wing.

          • Trim wheel certification, they put a computer between the pilot and the elevator, without a workable, throughout the certified IAS envelope, alternative. That is the most worrying thing.

    • I’d wager a week of Bjorn’s salary that if a technical audit team dug into the control systems of any airplane flying with the goal of digging until they find something wrong they will succeed in finding something wrong. That exercise can be repeated n! times where n is the number of tokens (words) in the source code and an error will be found each time. Much as we love our processes and procedures and “CMMI Maturity Levels” we as human beings really aren’t very good at designing complex systems and proving them correct. Even if we get close to correctness the physical implementation can still go awry…

  27. For all those Pilot Critics:

    When you are not trained in that situation you have no idea how you will react.

    Telling someone to turn Stabs off is fine, then the speed can bite you in the butt and you are trying not to loose your 1000 feet of altitude.

    And you alternative procedure sucks because you can’t trim it meanwhile the way they said.

    • Other software, flaps but seems more likely the new spoiler .

      “The MAX does contain a fly-by-wire system, controlling the spoilers. The spoilers are auxiliary flight control surfaces on the upper wing that help with roll control and act as speedbrakes on touch-down. They are not required for safe flight, but do make it easier and less onerous for the pilot.”

      • Back to my comment above, you MUST, and I never use caps, be able to fly the airplane.without a computer interferring if you have to. Which means trim it the computer has taken it outside the normal situation.

  28. BA today announced a 737 production rate cut from 52 to 42. Where will that number fall to, one wonders?
    Will any MAX customers try to switch back to NG? Would BA and suppliers be able to make that change as a way to avoid totally loosing frame sales to Airbus (or others)?

  29. There is a controversy about Auto-Throttle within preliminary report. Ethiopian is standing by pilots “Correctly followed all procedures” however Runaway stabilizer memory item requires to also disengage Auto-Throttle. There is no single line about that in preliminary report. That is really controversial. On one side bold statement about pilots following all procedures – including Runaway stabilizer memory item and on the other side not mentioning that in report. I can only speculate that this will be Boeing defending their ‘Flight Crew Operations Manual Bulletin TBC-19’ as sufficient

  30. I have gone beyond the technical, the analysis of Bjorn amongst others give fascinating insights but to me this is not the issue. Fundamentally Boeing has been pursuing profit at the expense of safety. I remember reading about the quality of the B707 or the B747 or the B777. Each of these platforms took the development of the whole aero industry forward. What we saw with the MAX was a retrograde step where a cynical approach of patching up a much iterated aircraft was seen as acceptable and simultaneously it had to be seen as the same as an NG for pilot compatibility. Both angles were purely self-serving and took an airframe to the limits, or beyond them. To me this is gross malpractice as Boeing knew precisely what they were doing. They knew the issues, they knew the limitations.

    So the were willing to develop a substandard or second best aircraft. This is where it gets nasty. Why they should be held criminallyculpable is that they took a marginal design and then:

    1 developed the product very quickly
    2 pushed the FAA in a manner wholly unacceptable
    3 decided to use a substandard approach to managing the unacceptable pitch up
    4 attempted to blame the 3rd world pilot
    5 attempted to ignore the first crash as an anomaly
    6 tried to bully Trump into stopping the grounding
    7 still maintain the ‘make a safe aircraft even safer mantra

    This goes on and on. The corollary is simply this, Boeing senior management are culpable of death. They have put profit in front of safety, you know it, I know it and so do they. The fact is that they do not care as they have become big people and believe they are now beyond reproach.

    Some deaths arise due to unknown factors but the MCAS fiasco was totallly foreseeable, I say this as the fundamental issues (landing gear and engine size) were much debated when the MAX was first mooted and subsequently.

  31. A few questions about the mauaul trim for Bjorn or anybody else who knows. The trim system, as originally certified, wasn’t capable of trimming the aircraft in some situations. Allegedly this was mentioned in the early model’s manuals, but it got certified, presumably it was ok, for 1967.
    1: Presumably when the 737 was stretched the system was modified. More linkages,changed loads, whatever, does that mean it should have been recertified? Does anybody know if the actual force and time reqired to trim, manually, a MAX is the same as that required for the 731?
    2: When the aircraft was fitted with modern automatic systems, MCAS, presumably auto/speed trim or auto throttle, how come the only ‘alternate law system,’ to borrow from AB, wasn’t required/examined for workability?
    3: Do you think EASA China et al will allow MAX back into the air without some changes to the trim system to allow the crew direct control of the el motors controlling the stab. jackscrew, if needed?.

  32. Hi Bjorn. While I concur with most of your analysis from the point of MCAS activation to impact, I do believe it is a bit thin on information with regard to the 0-1000’AGL segment. You are discussing in great detail why this flight ended up in a “low level coffin’s corner” – based on the crew’s and the aircraft’s actions but you appear to skip addressing the crew’s INaction when it comes to the Unreliable Airspeed situation below 1000’AGL. Mark’s account above seems to be a needed complement to your narrative. Not because of hindsight and quarterbacking or apportioning blame but because it is vital for the pilot community to try to get the full picture. And because we don’t have the luxury to wait a year or two for the full reports – as already proven in the most troubling and sadest ways.

    • Indeed. A pilot that hasn’t memorized the appropriate initial pitch and power settings to be used during unreliable airspeed shouldn’t be flying.
      On the very first page of the QRH!

  33. It has been interesting over the past weeks watching as both pundits and commenters on websites relating to these two 737 MAX crashes have slowly come to the realization that the Boeing/FAA solutions from back in November weren’t all that clear about how to handle this situation. Slowly people are coming to see that the yoke switches actually do or did or could have priority over MCAS. The Boeing and FAA directives included this information but more as an aside, not as an important and featured step to take before using STAB TRIM CUTOUT switches.
    The Lion Air data clearly shows that the pilot used those switches repeatedly and successfully to keep MCAS at bay. Lion Air 610 was lost when the First Officer took control and failed to use the yoke switches to counter MCAS.
    In the Ethiopian crash it appears that neither the pilot nor the first officer figured out how to do that. Unlike in the Lion Air data, the Ethiopian data shows no indication that either of the pilots repeatedly overcame MCAS commands using the yoke switches. Had they caught on, they probably would be alive today.
    But the tragedy begins with poor communications between Boeing and 737 MAX pilots. Boeing should have issued clear and concise steps for neutralizing false trim from MCAS before turning off all electric stabilizer trim. Especially after the Lion Air crash, Boeing must have known a lot more than they were willing to pass along to pilots about how to fly and recover these airplanes in that situation.
    Still that doesn’t absolve pilots from researching and discovering and passing on good information to their peers. The information was out there in the public domain. Yet months after Lion Air lost Flight 610 pilots had no understanding at all of how the yoke switches would override and correct erroneous MCAS inputs.
    It’s a Pandora’s Box that has been opened here, a real mess.

  34. Also, I cannot understand the reliance on an angle of attack sensor. Sensing the angle of attack for an object is a tough thing. I recall from fluid mechanics the concept of upstream communication stating at subsonic speed the air molecules can sense the object thanks to a pressure wave and deflect to avoid the object.
    Also, the angle of attack on the side of a plane is not the angle of attack on the wing.
    Even the angle of attack along the wing is not constant with wingtip vortices and other effect affecting the streamlines.
    Why so much reliance on such measurement that is so complicated.
    Some are asking why Boeing only had one. Me I am asking why did they rely on one to do a critical task.
    Also, the critical angle of attack at high Mach number varies due to compressibility effect. We all learned at flight school that the critical angle of attack does not change for a plane. But that is not true; when the compressibility effects increase the critical angle of attack decreases (AF443 is an example).
    For me, the flaw is to rely on the angle of attack to do a critical task.
    I remember my work on a wind tunnel where you had to determine the flow field, by varying the incidence or external condition like a gust everything changed unexpectedly.

  35. Putting aside the lack of redundancy of the AoA sensors and the inability to disable the MCAS software for a moment, I still cannot understand why the MCAS input upper level is unbounded. Is a + 75 degree AoA reading even physically possible in a commercial airliner during normal flight? If so, is it safe to assume that such a steep pitch would be an extreme and unusual circumstance? In such a circumstance, is it prudent behavior to add an additional uncommanded variable to a system already in an rare and extreme state? Was MCAS ever tested in real world or simulation at a + 75 degree AoA? If not, why would such software ever be released to production?

  36. Is the AOA disagree rate similar to the NG? If not, that is one problem to solve.

    Two, since there is a possibility of an AOA disagree, then Boeing has to do a test flight with a take off with an AOA disagree and do a youtube video for the world to watch.

    • You are right, but I think you had your beer goggles on. Be that transparent? That will be the day!

      But it should have already been tested. Invalid sensors should always be part of the flight test programme. In other words, they should have known how MCAS would react if the left AoA went into meltdown. But they didn’t.

      But it’s worse. As it’s software they could have used simulation. So they could have fed MCAS AoA data that represents a meltdown to see what happened. But they clearly didn’t do that either.

      And so on. As I’ve said a number of times. Boeing don’t know the envelope of the 737 MAX. It must not go back into service until it is known and known not to be dangerous.

      • One would think they do know the envelope, but do they? One would assume with a vast organization with lots of people with Bachelor of Science of Aerospace Engineering on their resume, there would be far greater knowledge than I have. But then there is the design of MCAS, which was clearly a sloppy and poorly checked work product. Then, after LionAir, look at the AD? This is what that vast organization brought their best and brightest to produce?

        Boeing has still not explained the details of what MCAS is for, or the exact parameters of the fix. If it is a part of speed trim, what are the exact parameters of speed trim? I can look on sites and see speculation, but I’d rather hear it from the horse’s mouth.

        What are those two switches for? Peter Lemme says there is one motor. Why two switches, why were the labels changed from the NG? In the event of a speed trim glitch, where is the switch that cuts the power to the speed trim computer, but leaves the trim motor available for the pilots? Or just, “runaway trim”, use the hand cranks…? Some people call it a jackscrew, others say it is not a jackscrew, it is a ballscrew, what is the generic name, actuator? Linear actuator? Accuracy and precision of language and extensive explanation by Boeing’s engineering staff is what I look forward to.

  37. First of all, thank you Bjorn. I for one was shocked by your description of blowback several days ago. It said, “The controls are not adequate to recover from an emergency in which the plane is flying beyond “normal” conditions. That’s just when you need controls to save your life.

    When I step back and take a broad view of the situation faced by designers of airliners it seems that they are asked to tread right on the edge of a cliff.

    Start with the engines: Closer tip clearance for the turbine and fan blades increases efficiency. But too close and they scrape and the engine blows up.

    Now the aircraft. Make the tail size and surfaces adequate to control the aircraft, but not too large because that adds weight and aero drag and decreases mileage – which is the sales point for new aircraft vs old.

    Ditto for the servos. And ditto for a lot of other components.

    I get the feeling that these airliners are designed to work in “normal conditions” only.

    Bjorn. Is this true?

    Alan

    • >I get the feeling that these airliners are designed to work in “normal conditions” only.

      Alan

      Yes & no

      All engineered items are designed to work within a range of “normal conditions” only. For an aircraft this “normal” is strictly defined most famously by the flight envelope. This is a region on the speed/elevation graph within within which the aircraft has been tested and behaves in a specified way. Outside the enveloper the aircraft may be uncontrollable or breakup. So it is in this sense that the aircraft is only designed to work in “normal” conditions.

      Now the flight enveloper is much larger than the region encountered during everyday flight. On top of that the region of failure is usually even further out. So if “normal” means the everyday, then in this sense the aircraft of designed will beyond the normal.

      This brings us to MCAS. It is needed because within the flight enveloper (within the certified normal, but far from the everyday) there are conditions where the aircraft was found to not behave quite as it should and hence the maneuvering characteristics needed to be augmented before it could be certified.

  38. The annual meeting of shareholders of the Boeing Company is on April 29, and shareholders can vote with their shares now, online or by mail, with ballots they received.
    I am VOTING OUT ALL of the members of the BOARD of DIRECTORS of this company.
    I suggest for all shareholders to do the same
    It does seem their oversight is NULL.
    Only after LIVES are lost, and just TODAY, the CEO (also Chairman of the Board), is saying that the BOARD has just now formed a committee to review the company’s policies and processes for designing and developing new airplanes.
    SHOULDN’T OVERSIGHT OF POLICIES AND PROCESSES BE A PROACTIVE ONGOING ACTIVITY OF THIS BOARD?

  39. Unreliable airspeed is defined as an IAS disagree of 20kts or above.
    If IAS disagree is below 20kts it is not defined as unreliable airspeed.

    If you look closely at the provided graphs you will find that the airspeed disagree was just around 20kts. It may have been 18 or 19 kts, so below the threshold for unreliable airspeed.
    Even if it was just barely at or above 20kts, the pilots may have judged it to be the lesser of their arising challenges.

    Looking at the FDR Data graph again it can be seen that there was three different simultaneous inputs to the pilot at 05:38:45 (This is the time of failure of the left AOA sensor):
    – Stickshaker (The main perceivable input)
    – Altitude disagree
    – IAS disagree

    Only 1 second later the master caution goes on:
    “05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR.” (From the preliminary report)

    Shortly after:
    “05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted and the pitch trim position decreased to 4.6 units.”

    Following this, the pilots engage LVL change mode on the autothrust (This is before any MCAS action):
    “05:39:42, Level Change mode was engaged. The selected altitude was 32000 ft. Shortly after the mode change, the selected airspeed was set to 238 kt.”

    Explanation: Under normal conditions, the airspeed and climb would now be in check. The aircraft would adjust pitch of the airplane to reach/maintain the set speed (In this case the airplane would enter a climb with nose pitched up and an IAS of 238kts, with throttles remaining at 94%) – With the IAS disagree from the diagram this would be real IAS somewhere between 218 and 258 kts (Which would have been OK).

    Of course just 18 seconds later the first MCAS pitch down command kicked in – lasting close to 10 seconds – and the drama began…

    • Sorry, the above post was meant as a reply to Brian Dell’s post
      as to why the pilots did not execute the unreliable airspeed memorized items/checklist.

    • Hello Marcus, as you pointed out correctly the pilots had an IAS disagree indication. According to the Boeing FCOM IAS disagree will show when: Indicates the Captain’s and F/O’s airspeed indications disagree by more than 5 knots for 5 continuous seconds. An IAS disagree indication is a trigger for carrying out the unreliable airspeed memory items. After the memory items have been done and the pilots refer to the QRH it says that if an airspeed indication differs more than 20 knots or 0.03 Mach from the values in the tables provided, it should be considered unreliable. If you look at the value for example for 5000 Ft, and 70 Tonnes, Flaps 1, and gear up, 6° pitch and 65%N1 should give you Vref40+50 knots. Having set those values you compare your three airspeed indicators and you can then consider them reliable as long as they do not differ more than 20 knots from Vref40+50. Do you have all the Vref speeds for varying flaps settings and different weights memorized so you can determine within seconds if your airspeed indicators differ by more than 20 knots or not? You have misinterpreted what Boeing is saying. An IAS disagree requires unreliable airspeed memory items and is obviously the safest course of action if you have any indications that your airspeed indicators are giving you differing or unusual values. Later on during the process comes the time to determine which one can be trusted.

      In any case out of all the actions the Captain could have taken in that situation, attempting and later succeeding in engaging Autopilot A is possibly the worst action of all to take. You seem to know something about the 737 so you must know that under no circumstances is it ever taught to engage the autopilot immediately in a non normal situation. On the contrary most of the memory items call for a disengagement of the autopilot and the autothrottle. As I already mentioned several times engaging Autopilot A when you have a stick shaker on that side shows that there was a complete lack of understanding of the situation. There are only two reasons why the stick shaker would go off: Either you are approaching a stall, in that case the maneuver calls for disengaging the autopilot and lowering the nose. Another reason for the stick shaker (and this is obvious if you have it only on one side but might take some time to figure out) is that there is some type of sensor or system failure causing it to activate. In either case the Autopilot stays off. As the FCC A controls Autopilot A and receives some of the same sensor signals as the SMYD (stall management yaw damper computer) it must not be used if the sensor integrity is in doubt. This is of course also the reason why the autopilot A did not engage the first two times the Captain tried to engage it and also disconnected again 33 seconds after the third successful attempt. They only way I can explain the Captain attempting to engage the autopilot on his side is because he has been trained with a reliance on automation and fell back on his usual behavior which was to engage the autopilot shorty after lift off. This is of course pure speculation on my part… I am just trying to understand why he would have done that.

      • Again, you are offering a procedure that requires the left alpha vane to be functional. It wasn’t functional. Everything else was working. Perhaps the pilots knew that.

        Afterall there was asymmetric stick shake just after take-off (50 ft). That’s a very good indication that there was something wrong with the left alpha vane, especially in the aftermath of the Lion Air crash.

        With regard to conflicting airspeed. True air speed is modified using the left alpha vane and the right alpha vane. So perhaps the pilots also knew that.

        Try and give the pilots credit!

  40. Norwegian CEO says Boeing software “seems foolproof “.Fools are ingenious and it Boeings making the black smoking holes.

  41. Boeing should have done a clean sheet design rather then put lipstick on a pig.
    Taking off from an altitude over 7000 feet you don’t want to have a malfunctioning plane and particularly not one with undocumented features.

    The next time Boeing makes a new model they should include more than just an iPad for the training. Maybe they should include some american pilots because they seem to be some kind of super humans that can handle whatever you throw at them.

  42. What is the regime of MCAS? I see that the range of stabilizer incidence is 0 to 10 degrees down. Now, I understand why MCAS would kick on at 10 degrees down and elevators up. But on the ET flight, it kicks on at 6 degrees down, and 2 degrees down. Was this even the regime MCAS is addressing? How unstable is the airplane with the stabilizer at 2 degrees down?

    What’s MCAS, what regime is it for, what does it do on the 767-2C, and why would they deviate from that design?

  43. Apology for jumping in without context: Boeing announced the cockpit light to come on when the discrepancy between two sensors is over 5 degrees. If the stall occurs at or around 10 or higher degrees than 5/10 = 50% of dynamic range of stall range. Is that acceptable to use such a large value? Calibration accuracy between two sensors is normally kept very small. On non-crashing type machines, it is around 1.5-3.0%. Again, my apology of this was answered already.

  44. Is it possible…
    Bjorn, I wonder if I might suggest a few alternative interpretations of the flight data. I have noticed a few things that don’t add up if I see them the way you do or even the way the preliminary report does.
    In the Ethiopian Flight 302 data there are four instances of MCAS inputting pitch down commands. In only one instance, the first of the four, does the MCAS command reach its designed 9 plus seconds.
    The second MCAS command lasts only about 6 seconds at which time MCAS was overridden by the pilot’s electric manual trim (yoke switch) pitch up command.
    The third MCAS command, if you look closely, doesn’t reach the full 9 plus seconds either. Something interrupted it as well. But what? There is no pilot-initiated electric manual trim (yoke switches) command at this point in time. So what cut short this third MCAS command?
    The report seems to conclude that about the time of that third MCAS command initiating, the pilots switched off the STAB TRIM CUTOUT switches, yet the only evidence they cite is the discussion to do so which took place 6 to 8 seconds before this third MCAS command initiated.
    Further complicating the data is the fact that there was no observed change in stabilizer position during that third MCAS command interval.
    I have not seen any suggestion that it may have been that the first officer actually physically held the trim wheel to prevent it from turning during this third MCAS command cycle yet I have watched videos that clearly demonstrate how this can be done. This would explain why the MCAS command shows up in the data but the stabilizer did not move. If that was the case, then it is reasonable to conclude that this third MCAS command functioned only until one of the pilots flipped the STAB TRIM CUTOUT switches to CUTOUT. First they decided to do the runaway trim procedure. They waited with hands on the trim wheel to verify that MCAS was still active. Then one of them held the trim wheel to keep it from further pitching down, and about 9 seconds later flipped the cutouts, just slightly abbreviating that MCAS cycle.
    The fourth MCAS command lasts only about 4 seconds before it is interrupted, but interrupted by what? My guess is that once again they hit the cutout switches during the MCAS command cycle and cut that cycle short.
    That seems to me like a more accurate interpretation of the available data. Everything fits this way, no hanging mysteries. This is all physically possible but it is also highly probable. To me, what this would indicate is that these two pilots worked as a team. They had talked this all over before and understood their version of how to proceed. They were probably familiar with the Lion Air cycle of events. The one thing that never dawned on them is the one thing I have found it almost impossible to point out to anybody and that is that electric manual trim overrides MCAS and should be the first thing used to recover from MCAS. Recover, then disable stab trim, not the other way around.
    You see the same thing happening during the fourth MCAS command which lasted only about 4 seconds before it was overridden by something. Since there is no electric manual trim (yoke switches) input corresponding to the end of this fourth MCAS command that would have overridden MCAS, it suggests to me that for the second time, MCAS was cut short by the use of the STAB TRIM CUTOUT switches.

    • Thanks, just thanks. People need to keep writing what you have written.

      Philip

  45. Thanks for an excellent analysis.
    Between your A and B the PF trims up twice with the thumb switch for appr. 3 s each. This results in appr 1 U uptrim stab movement, twice.
    At 5:40:15 after the first MCAS ND he trims again up for appr. 3 s. The stab movement is barely visible now on the chart. Then, unusual:
    At 05:40:27, the Captain advised the First-Officer to trim up with him.
    Why? Is his switch not working right?
    The trim up together or by the FO is the only long one in the entire FDR recording, followed by STAB TRIM CUTOUT.
    Is it possible that the PF had a broken trimswitch?

    • That seems possible, or the trim motor was overloaded by the aero loads?
      When the trim motor is on, the manual wheel can overpower the trim motor, or the pilots are supposed to grab the trim wheel to stop it, but the manual trim can be overpowered by the aero loads? I don’t quite get the heirarchy of trim strengths and what can overpower what, except that it seems to be some Escher rock, paper, scissors, where aero loads overpower manual trim, manual trim overpowers motor trim, and motor trim overpowers all aero loads. That doesn’t make sense.

  46. How can you say the crew followed the procedure while later saying they were over speeding the aircraft. Overspending nullifies many procedures so why not highlight what they did out of perameter and the potential ramifications of such an action before confusing the events with they followed the manufacturers procedure when clear they hadn’t to begin with……

  47. A bunch of questions from a simple, private, single engine plane pilot.

    Is MCAS used in any other commercial planes?

    How do other commercial planes produce the required feedback for pitch / control column forces?
    I would think other planes using bad AOA’s would have encountered this problem before or have
    a better system design that can be compared against for the required fixes.

    I keep wondering why MCAS currently forces the nose down, rather than just adding hydrolic back
    pressure to the control column, IF the only reason for MCAS is for augmentation to make the MAX
    feel like classic 737’s? Is there some other, more fundamental, reason for MCAS, concerning the
    placement of the engines?

    Boeing keeping this new control system, initially a secret from pilots, is clearly poor practice, and I hope the proper adjustments to keep this from happening again, will be put into place.
    The same goes for the design and testing process. A complete public release of the software code,
    original and changed, system design flow, fault analysis, and testing criteria would be a good starting point. It’s tough to trust the same people that originally designed, tested and certified the faulty system
    in the first place to also fix the errors with no independent review. Clearly there are faults in the management process that need to be exposed and corrected.

    Are the stab trim cutout switches the only way to control a runaway MCAS? Is there any circuit
    breaker to disable MCAS without disabling the ‘normal’ electric trim, or is MCAS tied too tightly into main flight control computer? If so, should it be isolated, to be able to be disabled easily? I’ve heard some pilots changing their normal takeoff profiles in order to keep MCAS ‘out of the loop’ for as long
    as possible. (i.e. keeping the flaps in place longer that normal)

    In the flight that did survive a MCAS fault, they had a non-flying pilot, that presumably saved the day.
    With more computer driving aircraft, should we have a “flight computer engineer” as the third member of the cockpit? Especially with GPS, TCAS, ADS-B, and computers even replacing approach plates. When the electrical totally fails, you’re back to a compass and a peanut sized gyro.

    Can Boeing use their new extending landing gear on the 737-10 MAX, and retro fit onto the current
    MAX’s? They’d have to quite a bit of re-engineering to move the engine back into place, and, I assuming the new 737-10 MAX design doesn’t use MCAS?

  48. Bjorn,
    Thanks for the vivid analysis. I think there are a number of contributors here that fail to realise how suddenly events can overwhelm the senses of even seasoned pilots. Sure, given time, one can look at the evidence and suggest possible avenues of action that might have resulted differently. However we were not there and the pilots reacted to a series of unscheduled events that happened in quick succession. There is little doubt from your analysis that the aircraft MCAS system put the aircraft in peril. Had a passenger hacked the flight system to create these events then that passenger would face the gravest legal penalties for their actions.
    The MCAS/AOA failures have become significant because the loss of life That resulted. However these cannot be the only incidents. Perhaps there have been other MCAS events /AoA failures at altitude, reported to NASA’s ASRS and elsewherewhere, wherein those involved got a hell of a fright but lived to tell the tale. Perhaps such events should be viewed much more seriously as ‘canary in the coal mine’ warnings.

  49. Is it possible to have stall condition of 737 with IAS-A and IAS-B in agreement over 250kts? If not, that should be another filter for MCAS, not to engage over 250kts

  50. I don’t understand those who, based on a preliminary report, have concluded in this tragic accident, going far to blame the pilots. I think they should listen to the chairman of the US National Transportation Safety Board instead, who is being quoted at Flightglobal.com: “I thought the report was very thorough and well done,” Robert Sumwalt told reporters following the Aero Club luncheon in Washington DC earlier today. “I applaud the Ethiopian government for coming up with it within not a lot of time, which was 30 days,” adds Sumwalt, calling the report “a very comprehensive job”. Sumwalt, however, urges the industry to refrain from speculating on the cause of the 10 March crash, telling the audience at the luncheon: “The only caveat i can put on that is that it’s a preliminary report and things can change.”

    I have just passed thirty years of flying 737’s, all generations except the Max, and with the privilege of looking at the flight in hindsight, I can think of many things they maybe could have done, or things they maybe should not have done etc. – if I had understood what the hell was going on! And if I had been aware of the inability to move the trim wheel manually because of high control forces and/or aerodynamic forces at high speed – something I must admit I was not. But I was not there, and none of us know all the details yet. I will never know if would have been able to save the situation myself. And neither will any of those who have already made the premature “pilot error” conclusion.

    I would like to comment on one item some people here focus on however: IAS disagree/-unreliable. Where is this big airspeed disagree right after takeoff? It doesn’t show on the small scale graph. If I get an IAS disagree warning right after takeoff, without being able to see any real big difference, and both IAS indications seem within reasonable range, I would certainly not pull the thrust back to 80% and lower my nose to 10 degrees – at low altitude with a heavy aircraft in the beginning of a climbout from a high density altitude airfield.

    Boeing and the authorities are now focusing on a software update, which is obviously needed, but I believe they also really need a big black and yellow switch in a prominent place in the cockpit that can shut down this MCAS system completely!

    • Finally a response from someone who’s a professional 737 pilot who knows what he’s talking about.
      Thank you for this thoughtful and learned explanation.

    • Hello Geir, what risks do you see in reducing to 80% N1 and setting pitch 10°? You have good visibility, no obstacles as already stated for 40NM and the airplane will continue to climb, it is just going to be at a slower rate. You could even keep 15° pitch and TO thrust a little bit longer to gain more altitude if it makes you more comfortable but at some point the idea of setting the memorized pitch and power values -as I am sure you know- is to get the aircraft into a safe profile. Boeing states: “The goal of these pitch and thrust settings is to maintain the airplane safely within the flight envelope.” This is the safest course of action in a confusing situation where you have IAS disagree, stick shaker, and possible invalid altitude readings. At my company and the two previous ones I have worked at, I am trained for carrying out these procedures should I face this situation.
      About laying blame on the pilots: I am looking at these accidents because I am a Captain on the 737 NG expecting to fly the 737 MAX soon. Since I have heard about the Lion Air crash I have been trying to find out as much as possible about this accident and the same is true for ET302, since I want to know for myself what kind of airplane I am going to be flying soon. I am also going to have many passengers who will be afraid to fly on the 737 MAX due to the media reports stating many inaccuracies among others making people believe the airplane is inherently unstable and can only fly with the help of a software constantly working to keep the plane in the air. I can understand that passengers want to believe pilots do not make mistakes and it is more reassuring to think the only reason these planes crashed is because Boeing made a terrible airplane. However, that is not the truth and the final investigation for Lion Air 610 and ET302 will reveal that these were typical accidents. Typical in the sense that several things went wrong: maintenance issues (Lion Air), bad luck (bird strike AOA Vane), mistakes by the manufacturer (MCAS system), and finally pilots who weren’t able to maintain airplane control after systems failed despite procedures in place which would have prevented the accident. This may frustrate people but it is the truth. The Ethiopians will deny this of course as they did with flight 409. To everyone who prefers to say the pilots did their best and cannot be blamed: Believing that pilots do not make mistakes was common in the aviation industry for a long time and is still an especially complicated issue in certain parts of the world. If we don’t try to look at what mistakes the pilots may have made then we cannot learn from them in order to prevent them in the future and we also cannot try to figure out why they happened. There is a very interesting book on this subject I can recommend to anyone interested in this subject called “The naked pilot: The human factor in aircraft accidents.”
      By the way, it goes without saying that the pilots in these accidents tried their best to save the passengers and any pilot can end up in a situation that is overwhelming and will lead to mistakes being made.
      For anyone reading these comments worrying about the 737 MAX. Check out the videos of mentour pilot. He will give you very accurate, unbiased facts about the 737 and flying in general. He claims that the 737 Max will be safe to fly on, once the MCAS software issue has been resolved. If you watch his videos I am sure you will find that he is a very trustworthy source to make this statement and I find the information he presents a very refreshing and necessary counterweight to the media reports about the 737 MAX.

      • It’s difficult to see from the graph how much the IAS disagree they got in the beginning (after the left Alpha vane failed), but it doesn’t look like much, and I am not sure the crew noticed this at all (and you have the startling effect from the stick shaker activating right after takeoff). But that’s speculations, so I will leave it there.

        Yes, all accidents are the result of several things going wrong, and there is always a chain of events. And yes, of course pilots make errors – that’s why we have at least two pilots and several protection systems. But there can’t be any doubt that the root problem in these two accidents is the MCAS system. I don’t fly the Max, and I see there is a discussion around how much information the pilots have been given after Lion Air, and how they should act to recover from an MCAS upset. But looking at the procedures from Boeing showed in the preliminary report, they seem inadequate to me. The Non Normal Checklist for runaway trim is exactly, word for word, identical with the one for the NG, which doesn’t have an MCAS system. There is no warning about the need to unload stick pressure to be able to move the trim wheel manually, and for the Max I think it should have pointed out clearly the possibility to break MCAS with the trim switch. (If releasing stick pressure and/or retarding the throttles in this accident would have brought the nose down beyond recovery I won’t speculate, but it is a factor that I believe has to be counted for by the investigators.)

        I won’t be flying the Max, since my airline is about to start retiring the B737’s and replace them with A320 Neo’s (and I am probably to close to retirement to switch anyway…), but I’m sure they will be able to fix the Max and make it safe again. The 737, particularly the -700 with 24K engines, is a fantastic short haul machine in the rather demanding conditions we face in parts of our network. One of the problems with this old design, from my perspective, is that they are giving it longer range for every generation, something the airlines of course will utilize. I can’t help feeling sorry for those who will be sent out to fly trans-Atlantic routes in that noisy and cramped cockpit…

    • Geir, I am a non-pilot, but worked in aviation as a mechanic. Maybe that’s why I find your admission that you were not aware of the aerodynamic forces affecting manual trim as very surprising. Especially because you say that you have been flying Boeing 737 for over 30 years. You didn’t practice the runaway horizontal stabilizer trim procedure in the simulator? I thought that this specific training item is mandatory! I’ve heard some other pilot saying that he trained this in simulator and always had been aware of the aerodynamic forces because of his simulator training. And in addition, the AD after the Lion Air disaster mentioned the conditions under which the manual trim must me accomplished in case MCAS failed. I hope that the investigators take a very hard look at the pilots’ training.

      • I’m sure I must have tried it in the simulator once, but it has to be a very long time ago, since I can’t remember… But you are right, it should definitely be trained for! I suspect it has not been prioritized because it has been such a small problem prior to the Max, and that it has been regarded as an easy situation to solve. In my thirty years, I know of one instance in the two companies combined I have worked for, and that was in a -500 or -400 (“Classic”). They had their hands full, but brought the aircraft safely back on ground.

        I guess training departments at all 737 operators will now take a close look at the training for runaway trim situations though, even if they only operate Classics or NG’s, since I know I’m not the only one who hasn’t been thinking much about how hard it can be to trim manually with control loads and/or aerodynamic loads on the stabilizers.

        • Geir, thank you for very informative and relevant response. In my opinion, the Lion Air disaster should have been a game changer as far as training the crews of MAX aircraft for symptoms of MCAS failure, which includes manual trim correction. I think it was Mentour Pilot who showed on YouTube that it took both pilots to move trim wheels effectively and other conditions were apparent, such as reducing speed, etc. And if I add what Bob, John and Mark posted here, I am convinced that the Ethiopians didn’t practice this scenario in simulator enough if at all. Furthermore, it is obvious that Ethiopian government will resist by all means any findings that will point to pilots’ performance and it looks like the preliminary report shows exactly that by leaving out the unreliable airspeed procedure.

          In my view, the first disconnect was before the first Lion Air crash. How come the information of MCAS malfunction event wasn’t passed to the crew that crashed the plane? And as far as the Ethiopian crash, to what extent the pilots trained in simulator addressing the symptoms of MCAS failure in Lion Air? And what about maintenance, what did the mechanics do to check the Ethiopian plane making sure that the AoA vanes are in good order? Because if I am a mechanic and know that the type of aircraft I am servicing crashed because of malfunction of certain component, I make a darn sure that this is not the case of the aircraft I am servicing. The investigation then must focus on the pilots’ training and also mechanics and how the airline management addressed AD after the Lion Air crash.

          I want to know this despite I am no pilot, because I want to know when I fly as a passenger what is going on and especially the level of professionalism of the pilots. And of course, this is affecting me since the costs of MAX grounding are passed to me as a consumer.

    • https://theaircurrent.com/aviation-safety/vestigal-design-issue-clouds-737-max-crash-investigations/
      +++++

      In an extreme nose-up out-of-trim
      condition, requiring almost full for-
      ward control column, decelerate. ex-
      tend the flaps and/or reduce thrust
      to a minimum practical setting con-
      sistent with flight conditions until
      elevator control is established. Do
      not decrease airspeed below the mini-
      mum maneuvering speed for the flap
      configuration. A bank of 30″ or more
      will relieve some force on the con-
      trol column. This. combined with
      flap extension and reduced speed,
      should permit easier manual trimming.
      If other methods fail to relieve the
      elevator load and control column
      force, use the “roller coaster” tech-
      nique. If nose-up trim is required,
      raise the nose well abovethe horizon
      with elevator control. Then slowly
      relax the control column pressure and
      manually trim nose-up. Allow the
      nose to drop to the horizon while
      trimming. Repeat this sequence until
      the airplane is in trim.
      If nose-down trim is required, slow-
      ing down and extending the flaps will
      account for a large degree of nose-up
      pitch. If this does not allow manual
      trtmmini then the reverse “roller
      coaster can he perforned to permit..

      from

      FCT 137 (PTM)
      February 1, 1982

  51. In FDR data there is disagree in airspeed and altitude in the same moment when erroneous AoA data from left sensor came. But deviation of airspeed is just opposite that I would expect. If Pitot tube is not parallel to the air flow, it measures only a projection of airspeed to the longitudinal direction of the plane = cos(alpha) (i.e. underestimates the real airspeed). So, after correction from AoA sensor it should show higher number than measured by Pitot tube in case of very high (most of the flight) as well as very low (end of the flight) angle of attack signal. Deviation in altitude suggest that the correction from AoA is probably connected with static port input (and not with Pitot input). Could you explain me, please, physical basis of AoA correction, or point me to appropriate “Bjorn’s Corner”, if it was explained here earlier? I was not able to find the answer. Thanks.

  52. What am I to make of the “Roll Attitude Displacement” reading going from 30 to -30 degrees in the last 20 seconds of flight? Perhaps my bigger question is why was it at 30 degrees?

    I understand the pilots were trying to make it back to the airfield so some amount of roll should be expected but 30 degrees?

  53. I thought the Boeing CEO characterized the situation well. Boeing has an obligation to design systems that are sufficiently understandable to not contribute to pilot overload and task saturation in crisis situations.

    When controls or instruments fail in flight, pilots have a matter of minutes to get things under control. This is a stressful event and I believe pilots try their best to avoid an accident, but human factors are always present, so everything possible should be done within the design, to help them achieve that outcome.

    This can include pilot training and education, but above all else, what the A/C does or is doing, should be made crystal clear to the pilots, to the greatest extent possible, so they can make the best decisions possible. That is the design challenge and where Boeing failed in this case.

    Pilots are human and will always make mistakes, same as everyone else, but their mistakes have greater consequences, so that should be the motivation to make a greater effort to provide them with clear information that they can process quickly and correctly.

    I believe mistakes were made in this case, but it wasn’t from lack of effort or motivation. So we should keep that in mind when assigning blame. Still, as Mark says we have to expose and face those mistakes to learn from them. That will save lives in the future.

    Thanks to everyone here for an informative discussion, I wish the mainstream media had this level of understanding.

  54. Bjorn
    I have to wonder what the motivation is for ignoring all of the errors and omissions by the crew of Et3o2 and they are significant and glaring.

    First and most serious, the crew ignored four separate and extended Stab Trim engagements which is completely abnormal for the AC.

    Finally when the FO suggested disabling the system, it required more force than they could muster individually and due to the AND forces, someone had to maintain back pressure on the yoke.

    Thrust setting was left at takeoff power for the entire flight which, as you pointed out, put them in the regime of elevator blowback from which they could not recover. There is no justification or reason for thrust to be left that high.

    Main Electric Trim was available to counteract the ignored AND trim inputs, but not utilized and after disabling the Electric Stab Trim, the system was restored in conflict with the EAD of 06 Nov.

    Any sufficiently trained, experienced 737 crew would have reacted to the abnormal trim inputs in order to maintain normal control forces immediately. I have yet to speak with any experienced, qualified 737 pilot who does not agree.

    In contrast, it seems that everyone who has no experience in the aircraft is more than willing to offer their opinion with conviction.

    As a former fighter pilot, you must be familiar with the idea of hands-on flying, in contrast to the current trend of Autopilot On at 500 AGL. How is anyone every going to develop flying skills on the AP? It breeds good Operators and System Managers, but systems fail and as we saw with AF447, ultimately, a qualified, experience pilot is required more than an Operator.

    • There is a stall warning and a stick shaker triggered by the erroneous AoA indication. Plus there is MCAS nose down. Throttling back in response to a stall warning and a nose down situation is completely counterintuitive when you are but 3000 feet off the ground. You cannot blame the pilots for the throttle position. You can sit in an armchair and pass judgment. Spare a thought for what they were dealing with.

  55. https://theaircurrent.com/aviation-safety/vestigal-design-issue-clouds-737-max-crash-investigations/
    +++++

    In an extreme nose-up out-of-trim
    condition, requiring almost full for-
    ward control column, decelerate. ex-
    tend the flaps and/or reduce thrust
    to a minimum practical setting con-
    sistent with flight conditions until
    elevator control is established. Do
    not decrease airspeed below the mini-
    mum maneuvering speed for the flap
    configuration. A bank of 30″ or more
    will relieve some force on the con-
    trol column. This. combined with
    flap extension and reduced speed,
    should permit easier manual trimming.
    If other methods fail to relieve the
    elevator load and control column
    force, use the “roller coaster” tech-
    nique. If nose-up trim is required,
    raise the nose well abovethe horizon
    with elevator control. Then slowly
    relax the control column pressure and
    manually trim nose-up. Allow the
    nose to drop to the horizon while
    trimming. Repeat this sequence until
    the airplane is in trim.
    If nose-down trim is required, slow-
    ing down and extending the flaps will
    account for a large degree of nose-up
    pitch. If this does not allow manual
    trtmmini then the reverse “roller
    coaster can he perforned to permit..

    from

    FCT 137 (PTM)
    February 1, 1982 and also take a look at

    737-200A FCOM

    doc number d6-27370 -200A-TBC september 15,1999 revision number 17 revision date april 9 2008

    copyright was 1995

  56. About manual trim and ergonomics- has anyone seriously thought about improving/changing/modifying the trim wheel system to provide better or more reasonable mechanical advantage to turning the wheel ? granted it shoul NEVER be needed- but if that is true- then why give false security by providing an awkward- impossible to use device ( fold out handle ) for use only when one pilot really needs it ? Not talking about the visual example of minor trim and hand minor trim – but when the effluent hits the turbine we have this impossible to use handle-wheel so the pilots can be like the passengers – bend over ( grab the handle ) and kiss your posterior goodbye . !

  57. By looking closely at the preliminary FDR data, one can see clearly that up until the last dramatic MCAS activation which commanded the fatal unrecoverable dive, pilots were actually doing a good job controlling the pitch attitude fighting against the 2,5 unit horiz stab setting (which corresponds to nose down) by pulling on the yoke (aft column inputs graph). At this stage and for at least a couple of minutes after they hit the cut-out switches the plane continued to climb. But it appears that during this period they were unable to correct the trim using the manual trim (turning the handle of the trim wheels) probably due to a combination of high speed and severe out of trim situation. So they decided to engage electric trim once again. How desperate were they at this stage ? They must have known that MCAS would have kicked in again. But they were still climbing (not in a dive !) at this point. Except out of exhaustion, I can’t really understand why they would go against established procedure (not re-engage electric trim for the remainder of the flight), please note that I’m not a pilot and have no clue about the forces involved here. Furthermore, it seems that the couple short manual nose up electric trim inputs had some (moderate) effect on horiz stab position. A good understanding of MCAS would have told them that they could have expected another MCAS action 5 seconds after releasing the electric switches on the yoke. Could they perhaps have hit the cut-out switches once more in that interval ? Then activated it again a few seconds later, give another short nose up inputs and cut them again ? I’m just trying to understand if they were doomed anyway or if in a perfect world they could have somehow recovered ? Again, from the prelim FDR data, the plane was still climbing up until the last MCAS activation.

    • I think due to the overspeed of the aircraft, the pilots needed additional control authority and so re-enabled electric trim. At that point they would have been physically struggling with the control forces, and about to be overwhelmed, which is a certain crash. So dealing with MCAS inputs again might have seemed the lesser of two evils.

      We can only speculate but I’m sure it was a very tense and difficult situation. Physical exertion and time pressure would have distracted the pilots from calmly reasoning out all the possible options, as we do here.

      Ironically MCAS helped to create the situation it was designed to avoid, with the pilots finding they lacked control authority to recover. MCAS was intended to prevent that in high-thrust, pitch-up movements that would lead to an unrecoverable stall, due to lack of authority at high AoA.

      There are probably many pilot reaction scenarios that would have a different outcome. So as we consider that, the focus should be on enhancing the pilot’s ability to achieve that good outcome, with better information and better tools.

  58. I wonder if there might also be supersonic airflow involved?

    If:
    1 The stabiliser is trimmed to bring the nose down: it is pointing up.
    2 The elevator is set to bring the nose up: it is pointing up.
    This would make the underside of the stabiliser/elevator combination highly convex. At that speed and altitude, might this create supersonic airflow?

    With a shockwave at the rudder hinge there might be flow separation on the underside of the elevator, making the elevator less effective.

    What do you think?

  59. As someone who lost a close family member in a 737 Max crash, it is important to me to have the whole truth come out. Many thanks to Bjorn Fehrm for his in-progress analysis – especially highlighting open questions. Likewise thanks to Peter Lemme and others. This is going to take considerable time.

    People such as pilot Mark, who insist that they have the answers and proportional underlying causes sorted out, are simply doing a disservice to their own considerable – though limited – actual knowledge. They pay lip service to wanting to learn, but their biases are clear and their willingness to jump the gun at this early stage is alarming. They know better than the investigators.

    Mark writes:
    “Typical in the sense that several things went wrong: maintenance issues (Lion Air), bad luck (bird strike AOA Vane), mistakes by the manufacturer (MCAS system), and finally pilots who weren’t able to maintain airplane control after systems failed despite procedures in place which would have prevented the accident. This may frustrate people but it is the truth.”

    He apparently thinks that the “mistakes by the manufacturer” solely involve the MCAS system. Can he describe that system in extent and in detail? Can he describe the development of the 737 Max in detail? Can he explain why the MCAS is essential?

    Mark knows with certainty that procedures were in place that would have prevented the accident. If so, this would merit more than a simple comment. Would he care to elaborate in an extensive report of his own, publish it under his name and take comments? But I see – it’s simple.

    Mark assumes that the Max will fly again with the software fix (which is so extensive as described in outline by Boeing that one would think the radical change would cause him more of a pause for reflection in his assignment of proportional causes to the crashes – overwhelmingly stating pilot error in so many words). Does he stop to recognize that the reliance on a single AoA sensor for critical input is mad? And with no bounds ruling out clearly erroneous readings?

    While ranting about the sensationalist news media, does Mark take the time to consider the on-the-record comments of the actual operations analyst, Ludtke, who worked for Boeing on the Max? Or is this too far afield from being focused on “flying the airplane” and basic black box trust in the manufacturer. I am glad to see that not a few 737 pilots are very unhappy looking back at Boeing’s poker face regarding the Max when it first came out, relying on its feel to carry their sales. Then there are even higher levels factors such as the pilot shortage, low pay for new pilots (even US pilots with considerable military experience), over-production of commercial airplanes due to worldwide government subsidies and so forth.

    Perhaps some basic questions would help shed more light on the 737 Max, such as the following: after the new engines were specified and placed in the design, could the plane have been built to fly safely with the NG tail design conserved and no MCAS installed (but with a type rating change and mandated training)?

    It is still early in our attempt to understand all aspects of this crash. We have to carefully consider the possibility that a salty pilot with an intuitive feel for what caused the resistance to the manual trim wheel and knowledge of how to release that could have saved ET302. Perhaps such a pilot would never have been in that situation in the first place because he would have followed the standard checklist that Mark references. It’s a bad sign, though, to see so much expressed certainty about that, again, as though it was all so clear and easy. (See Peter Lemme’s discussion of the takeoff configuration.) Such a rush to judgement is more acceptable in the news media on deadline than in a pilot.

    But let’s say that Mark had been the PIC on ET302, and that everything had therefore gone swimmingly, with no crash, no “MCAS” being spoken by millions of lips, my family intact. Where would that have left us?

    We now know the beginning outlines of the true answer to that question: it would have left us with an insanely defective flight control feature being furiously re-worked by Boeing under wraps, with a flawed regulatory process, and with another plane in the air somewhere that may very well have gone into the ground and killed all on board.

    • Tem, I am truly sorry for your loss. Nothing that is said here can bring your loved one back, or any of the lives lost in the two crashes.

      In defense of Mark, I don’t think he was trying to exonerate Boeing or assign sole blame to the pilots. He was saying that all possible factors must be considered, in order to learn as much as we can from an extremely tragic loss of life.

      A failure of this magnitude is an event cascade, a chain of events which, if unbroken, leads to tragedy. It’s up to the world now to consider how the chain might have been broken, to achieve a different outcome. In order to do that well, we have to examine every link, and learn as much as we can.

      Obviously many of the links belong to Boeing, and each one of those needs to be carefully considered. But some also belong to the pilots, and those too are important.

      Maybe the difference, though, is the pilots lost their own lives trying to save the lives on board. So as we look at their links, we should keep that in mind and be respectful. If we see an option that they didn’t, we have the benefit of extended time, knowledge, hindsight and comfort, which they didn’t have. I know I have spent many hours researching these issues. The pilots didn’t have that luxury, disaster was upon them and I’m sure they did the best they could in the brief time available.

      Again I’m sorry for your loved one and all the people who died. I hope that we can all keep an open mind and realize that all knowledge derived from a tragedy has value, no matter where it places responsibility or blame.

    • Thank you kindly Rob, but I guess I failed to make my point(s).

      It’s one thing to say that you have an open mind – and then proceed to blatantly blame the pilots. It’s quite another thing to HAVE an open mind and realize that issues around the Boeing MAX operate at several different levels, including but not limited to the following:

      1. The actual accidents, N=2, provide only specific illustrations of failure modes, human factors, pilot error, sensor failure, airline operations, etc. Here we will know the chain of events fairly precisely and we will be able to identify at least one, but probably several events that could have broken the chain. It is good to focus on pilot actions because that spotlights what those pilots had in front of them, not hypotheticals of what Boeing might have done differently. In other words, we can assert that had the cutout been bifurcated (cut MCAS but maintain electric trim; see Peter Lemme’s discussion) as in prior models, the pilots would have been able to mitigate the situation but we cannot know that for certain. In contrast, we might eventually know for certain that had the pilots done x,y,z in short order, flight 302 would have been saved. Here is my key point at this level: once we know this, pilots and others will be able to make a fairly honest assessment of what percentile of actual pilots worldwide would have been capable of mitigating the situation. (Here I find pilot Geir’s admission above to be refreshing.) If it’s a low percentile, we have a serious problem in pilot training…which does tie back to Boeing’s imperative for the MAX: no new training (that is a fact, not conjecture).

      2. The POTENTIAL for accidents in the MAX, which includes but would expand well beyond the specifics of the N=2 accidents. This higher level of a chain of events incorporates the decision making at Boeing during the development of the MAX. In Boeing’s own words, MCAS is

      “not a stall-protection function and not a stall-prevention function. It is a handling-qualities function. There’s a misconception it is something other than that.”

      Therefore, we know that the OEM tried to match the feel in the MAX to the NG. Some pilots have, and some will continue to, insist that they could have flown the plane perfectly safely with the changed center of gravity if simply trained for it. This is a highly defensible position even for me as a non-pilot because…it is what pilots have ALWAYS done over many decades.

      In sum, I am willing to accept the possibility that pilots exist on this Earth who could have made it through the ET302 difficulties. As many have said, if we could talk to the deceased pilots themselves, they might easily recognize their own tunnel vision. But we are FAR from having all of the relevant facts that explain what they were confronting in some very short minutes.

      In the bigger picture, though, we have an unimpeachable initial understanding of how Boeing risked lives with its sales and marketing imperative of no new training. That refers to real actions that we know with certainty. Pilot Mark may be good at his job, safely carrying passengers, but with their comments, pilots like him demonstrate little capacity for understanding the bigger picture which is what a true professional ethic demands.

  60. both preliminary reports are now published.
    with care we can draw some basic conclusions.

    the first crew confronted with the secenario
    produced an impressive blueprint how to deal
    with the situation of multiple false alerts .
    this is explained right at the beginning in the report
    from indonesia.
    if this exact sequence of events and crew actions would have been explained
    to every 737 pilot by detailed written or video information,
    followed up in a simulator, ……
    1.) stick shaker and ias disagree at 400 ft
    a very demanding situation in a simulator not to speak in
    real flight. with throttle at full thrust and pitch at 15deg and
    initial climb speed at v2 +20 a instrument x check shows
    a false warning. left shaker and left speed indicator are
    affected.
    on aircrafts with shaker plus pusher the pilot fears a false
    pusher in this low altitude and will push the stick shaker/
    pusher switch to off asap. there is no such switch in a b737.
    the b737 stick shaker will continue vibrating and rattling.
    the wrong ias indication connected to aoa sensor inputs
    is strange, as ias receives inputs from pitot static system.
    the b737 trims nose down during stall instead of a pusher.
    a false shaker activation might trigger as well a false
    trim down signal.
    in the published graph this happened 2 times before? flaps
    retraction.

    2.). control of the aircraft was switched to the right pilot
    to continue normal climb speed and pitch and
    due to wrong trim inputs nose down, the trim system
    was switched off.
    the right pilot resumed operation without autopilot
    and autothrottle and was trimming with the manual
    trim whell .

    in a simulator event this outcome has to be seen as
    successfull and good performance.
    but the chain of events can unfold totally different as
    we all know , due to many disturbing factors .

    4 major problems were involved step by step

    – false stall alert. stick shaker not mutable
    – false airsoeed information
    – false trim down inputs
    – flaps overspeed limit warning
    – throttle at max thrust
    – excessive speed at low altitude
    – inability or difficulty to trim manually at high speed

    confronted with all those problems in a very short time period
    man crews might not be able to get out of the situation.
    only simulator training can offer solutions and experience
    building to cope with multiple system problems.

    the crew which handled the situation, mentioned right at the
    beginning of the indonesian report, might had received
    some advantages to act properly.
    the aoa sensor problem was adressed before flight and
    as media reports suggested a third pilot was on the jump
    seat who might have helped with positive timely inputs.

    the tragic accidents will change training concepts
    and aircraft design.

    a minimum of 3 sensors will compare each other.
    false warnings will be depressed and muted automatically.
    situational information will be displayed clearly for the pilots.

    training will upgrade to multiple system failures and
    false and nuisance warnings and increased manual
    flying without autopilot and autothrottle.

  61. NYT story April 11, 2019:
    Changes to Flight Software on 737 Max Escaped F.A.A. Scrutiny

    “The more we know, the more we realize what we don’t know,” said John Cox, an aviation safety consultant and former 737 pilot.

    To prevent stalls at lower speeds, Boeing engineers decided that MCAS needed to move the stabilizer faster and by a larger amount. So Boeing engineers quadrupled the amount it could move the stabilizer in one cycle, to 2.5 degrees in less than 10 seconds.

    “That’s a huge difference,” said Dennis Tajer, a spokesman for the American Airlines pilots’ union who has flown 737s for a decade. “That’s the difference between controlled flight or not.”

    “In creating MCAS, they violated a longstanding principle at Boeing to always have pilots ultimately in control of the aircraft,” said Chesley B. Sullenberger III, the retired pilot who landed a jet in the Hudson River. “In mitigating one risk, they created another, greater risk.”

    Even Boeing test pilots weren’t fully briefed on MCAS.

    “Therein lies the issue with the design change: Those pitch rates were never articulated to us,” said one test pilot, Matthew Menza.

    Mr. Menza said he looked at documentation he still had and did not see mention of the rate of movement on MCAS. “So they certainly didn’t mention anything about pitch rates to us,” he said, “and I certainly would’ve loved to have known.”

    [note: the article continues to characterize MCAS as an anti-stall system, contrary to Boeing’s own description of it.]

    • The article also notes that the change was made during flight testing and after initial certification, when it was determined the original MCAS control authority was not sufficient. Also that it’s common for changes to be made at that stage, that are not necessarily re-incorporated into the original certification documentation, and do not trigger an additional review, although they are reported to the FAA. So you might not expect to find it there. Those procedures may be changed after the investigation is complete, if they are found to be a contributing factor.

      Not excusing Boeing here. There are many other significant issues, such as the fact that MCAS was allowed to make cumulative corrections (multipliers of the cited trim correction angle). That feature is being removed in the software update, MCAS will have limited authority to initially pitch down on approach to stall, after which its safeguard function is achieved, and it will be up to the pilots from that point forward.

      Also the fact that MCAS was not explained well enough for pilots to recognize, identify and understand its operation. And that it was lumped into the category of “runaway trim” for false activation, when the 10-second period of repeatedly applied and advancing correction was clearly very different (and more confusing) than other trim malfunction scenarios. Not something the pilots would be expecting, which warranted a clearer presentation. In the flights that survived false MCAS activation, only 1 crew identified runaway trim, and only because a third pilot present assisted them in the diagnosis.

      MCAS has been in use in military tankers for awhile, and is a safe implementation that’s been well documented for pilots (although on a different KC-46 airframe). Tankers face a similar risk of approach to stall with insufficient authority to recover, which MCAS is meant to address. Some of the updates to MCAS are coming from the military side. A question Boeing will have to answer, is how they justified the change in implementation and documentation for commercial use.

  62. A week ago or so I came across the construction details of the AOA sensor used by boeing on the 737- has not changed for years. Of note is that the vane attachesto a counterweight and a sensing coil. Both attachments are typical of attaching things to round shafts by a simple set screw ! Works fine for old time record players and cheap toys. But for a significant sensor in daily use for hours, IMO using a ” D” shaped end of shaft or even a three sided flats on shaft for three set screws would be more appropriate.
    This would ensure no slippage or mis mounting/adjustment of attachments.
    Of course the argument is well its worked for decades with a – xxx percent failure so why change.

    I cant seem to find the cutaway of the sensor used basic unit was by rosemount as I recall . ..?

  63. From AviationWeek:
    “The briefings continue to emphasize that the MCAS, which was added to the speed-trim system to standardize handling qualities with those of the 737 Next Generation, is “not a stall-protection function and not a stall-prevention function,” says Mike Sinnett, Boeing Commercial Airplanes vice president of product development and future airplane development. “It is a handling-qualities function. There’s a misconception it is something other than that.””

    So this software had a sales and marketing purpose first and foremost – easy as pie, no new training needed. Clearly there is all kinds of software at work in other planes, and I fly in Airbus A320s frequently and know what is in the cockpit. Muilenburg, the Boeing CEO, has a high degree of comfort with a software patch, coming from the military side of Boeing.

    A good way to put your mind into a corral is to assume the MCAS is necessary at all for the MAX. An alternative view is that pilots could fly it safely with the NG tail and same interface, but without MCAS.

    • I can’t speak to the issue of the NG tail as an alternative for the MAX, I don’t have any information on that and could not find a reference to it.

      On the Aviation Week quote. that seems to be a Boeing spin. MCAS pitches the nose down momentarily to help avoid the approach to stall. You could say this is a protection intended for former 737 variant pilots, as the MAX has different characteristics at the approach to stall. So in that sense it does modify handling qualities for those pilots.

      Bjorn did a great job of explaining why it was felt that MCAS was needed for the MAX, in his series on pitch stability. The area of concern is where the MAX may not have sufficient control authority to recover from an impending stall, with the usual methods. Pilots could unexpectedly find themselves in that situation, based on their experience with previous 737 variants.

      MCAS was to function like a goalkeeper, who deflects the ball when it nears the goal. MCAS was to deflect the aircraft as it neared the region of flight that might be dangerous for 737 variant pilots. That was the basic idea & purpose, however it is now being spun.

      You could also say that MCAS helped maintain type certification for the 737 series, since it avoided a regime of flight where the characteristics were different for the MAX.

      If the NG tail provides greater control authority, then that would be a valid question to ask, about the justification for modifying the MAX tail.

      • “Pilots could unexpectedly find themselves in that situation, based on their experience with previous 737 variants.”

        This is one of the crux issues, if not THE crux. To repeat my open question: would the structural aerodynamics of the 737-Max have permitted pilots to be trained to fly it safely without the MCAS. With training, presumably the clearly discussed stall issues would all but eliminate the unexpected (but make the sales and marketing harder).

        Since I have no technical expertise, when I say NG tail, I am referring to the pilot having the same control over flight as the NG. It seems that basic column functions were changed on the MAX. If Bjorn discussed those in detail, I managed to miss it.

  64. “Pilots could unexpectedly find themselves in that situation, based on their experience with previous 737 variants.”

    This is one of the crux issues, if not THE crux. To repeat my open question: would the structural aerodynamics of the 737-Max have permitted pilots to be trained to fly it safely without the MCAS. With training, presumably the clearly discussed stall issues would all but eliminate the unexpected (but make the sales and marketing harder).

    Since I have no technical expertise, when I say NG tail, I am referring to the pilot having the same control over flight as the NG. It seems that basic column functions were changed on the MAX. If Bjorn discussed those in detail, I managed to miss it.

    • dear tem
      multiple system failures are rare
      but can happen any time.
      if for example a false stick shaker warning
      can not be muted or stopped the crew will be
      highly stressed.
      if now other malfunctions are added
      the risk is rising that the crew will be distracted
      from safely operating the aircraft.
      stick shaker
      wrong instrument readings
      trim runaway
      …each problem can be adressed step by step
      but , like it obviously happended cumulative,
      the outcome can be tragic.
      it is up to regulative authorities to evalate whether
      single, dual or multiple sensors are mandatory
      or false alerts are accepted not mutable..
      a stick shaker/nose down trim off switch , available on most
      aircrafts known as stick shaker/ pusher off switch,
      would have helped the crew to silence the false warning
      and to concentrate on flying the climb profile
      and to deal with the trim runaway if still present..

      the scenario of multiple failures can occur on every aircraft
      with any system but the risk can be reduced significantly by
      using 2 or more sensor inputs and creating a software which
      mutes or inhibits false warnings due to faulty sensors.
      from the hardware side system off switches are necessary
      to resume a basic manual mode in case of computer problems..

      the loss of air france due to pitot static sensor problems
      shows that even with 3 sensors something can go wrong.
      false warnings should have been muted.
      false instrument readings inhibited and
      a pilot assistant should have been displayed suggesting
      pitch and power values on the screen.
      until now such systems are not integrated.

      aoa indicator instruments are a big independent advantage to compare
      with air speed instruments. within seconds pilots would have confirmed the deep stall situation .

      unfortunately until today aoa indicator instruments are
      not mandatory. ( optional on the 737max )

      the tragic accidents of airbus and boeing will change
      the design of automatisation and human interface.
      nuisance warnings are the biggest threat to safely
      operating an aircraft and this problem has to be adressed
      in detail..

      many questions remain why this massive accumulation
      of severe failures and false warnings could happen.
      the investigation is ongoing and will be critically observed
      by the public worldwide.

  65. I agree, I think the need for MCAS and the need to maintain 737 type certification are linked. MCAS made the latter more likely. That should be one of the things scrutinized in the investigation.

    The column function that was altered (also from the military version) was that pulling back on the yoke did not disengage MCAS. I suspect the logic behind this was that pulling back strongly was likely to put the aircraft in the flight regime that MCAS was meant to avoid. So the pilots were not allowed to override in that way. Instead the assumption was they would use either the electric trim buttons or the cutout switches.

    But when that was choice was made, then the pilots also needed to be clearly informed and trained. That is one of the chain links that needs to be examined. It appears that the new software update and revised procedures do address this.

  66. Tem, Boeing originally made the decision to ‘patch’ the aerodynamic differences with software on the 737-MAX, rather than redesign the plane to accommodate the larger engines. They were planning on a new aircraft, but, decided to shorten the design cycle because of market forces vs. safety. This decision has tarnished Boeings reputation. And their doctrine of keeping the pilot in ultimate control. Originally, not informing the pilots of how MCAS operates and takes control of pitching the aircraft. (I’m not sure if they’ve really fully told them yet). Only Boeing and maybe the FAA has the data and answers to your question of if the 737-MAX, can safely fly without MCAS or some other ‘fix’ to the plane. The details of the wind tunnel tests, done in England, and other data hasn’t been released to the public as far as I know. Boeing has a lot to answer for. And how, in the future, will they attempt to repair the trust of their customers and international flight safety organizations. Will they put forward only a software ‘fix’? Or, will they redesign the landing gear, to enable the engines to be placed more conventionally? Will the flying public avoid the 737-MAX and then lose airline orders? I have my own opinions, but, I don’t have the data that Boeing and the FAA have regarding the aerodynamics of the aircraft. So, we have to infer from pilot experiences and any comments from Boeing and the FAA at this point. I’m sure Boeing will have to answer a lot of questions from a lot of groups before the 737-MAX takes to the skies again.

  67. Thanks Rob, Richard Davenport and Henry.

    “The column function that was altered (also from the military version) was that pulling back on the yoke did not disengage MCAS.”

    But did it not only disengage MCAS, but also possibly accelerate it since the software seems designed to interpret pulling back the yoke as a stall is imminent (whether input is true or false) as an action to be circumvented?

    “Originally, not informing the pilots of how MCAS operates and takes control of pitching the aircraft. (I’m not sure if they’ve really fully told them yet).”

    (…) = critical.

    As for who has the answers on the aerodynamics, great points. It would be important for all concerned to be as transparent as possible here. If Boeing is once again supremely confident, what would they have to lose?

    • with the known facts it might be true to say
      that the lessons learned from the AF447 accident
      did not find their way into modern cockpits until now.

      False Airspeed and Altidude Informations triggered
      nuisance warnings as all 3 pitot static sensors failed.
      a very rare event. one false warning might have been
      a false overspeed warning, a reason why the pilot pulled
      the nose up in the first place…

      The airbus was flown into a stall and until the end
      pilots were not able to adress the stall and to perform
      the recovery procedure. they obviously didn t trust the
      aural warning STALL STALL…….

      in the aftermath many aviation experts suggested
      to install 3 aoa indicators into pilots view, easy
      to realise and to display as sensors are already in place.
      within seconds pilots would have visually compared the
      aoa indications and would have confirmed the stall with the ongoing aural warning…..and possibly recovered the situation.

      so far we know, the demand for 3 aoa indications
      in addition to the 3 air speed indicator did not find the
      way into new regulations.
      aoa indicator remains an option in the cockpit.

      in the case of the lion air and ethiopian accident
      aoa indications would have assisted the pilots
      to recognise the stall warning as false. in a short time.
      due to the rattling and vibrating stick pusher
      and false airspeed indication on the left pilots side
      the normal reaction was to lower the nose and trust the warning,
      as data suggests the left pilot was under the impression
      of an ongoing stall, even as he accelerated toward 300 kts
      in almost level flight, as he never reduced the thrust
      and followed the normal climb profile .

      swift comparison of 3 aoa indicators would have confirmed
      a false stick shaker and a normal climb profile would have been possibly continued, as the first crew mentioned in the indonesian report did one day before the accident.
      the ias disagree procedures , flying pitch and power
      according to the present flight phase was implemented after
      the air france accident and was designed for the loss of all
      3 airspeed indications. with aoa indication a safe speed
      regime is easy to identify and the aircraft can be flown
      in all phases with a safe and accurate limit from stall speed
      using pitch and power only as a rough back up.

      In this matter the accidents are directly connected.
      Pilots need help to identify opposing warnings
      like overspeed and stall at the same time .

      3 aoa sensors and indications !! should be mandatory.

      stick shaker must be mutable by off switch in every aircraft.

      aoa simulator training should be implemented
      to identify real or false stall indications and to
      fly the aircraft manually with this instruments in all
      phases of flight.

  68. Tem, I could be wrong but I don’t think MCAS reacts to column inputs, only to the pitch of the aircraft as reported by the left-side AoA sensor. After the update it will use both left and right sensors and not activate if there is significant disagreement between them, among other changes.

    I have not seen it reported that the software update will allow MCAS to be deactivated by pulling back on the column. Instead, the control authority of MCAS will be limited such that column inputs are sufficient to override the MCAS inputs. In other words, pilot authority will exceed MCAS authority.

    That was not true in the first implementation. Electric trim had the ability to compensate but those inputs would be counteracted by MCAS at the next activation cycle. The cut0ff switches were required to fully disengage and override MCAS.

  69. From Boeing’s web site .. the fuzzy specifications that are suggested are as of today…

    “The additional layers of protection include:

    Flight control system will now compare inputs from both AOA sensors. If the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate. An indicator on the flight deck display will alert the pilots.
    If MCAS is activated in non-normal conditions, it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs.
    MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column. The pilots will continue to always have the ability to override MCAS and manually control the airplane.

    These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

  70. I would suggest we resist any attempt to find one cause of the accident. There is usually a chain of events. Here we have the initial event, the AOA failure and stick shaker surprising the crew. Their initial reaction may have been to lower the nose somewhat. However it would seem that their next reaction should have been to crosscheck airspeed indicators. (After all, they had just called out V1,VR, & V2).) That should have led them to conclusion that the stick shaker was an erroneous indication. This should have led them to the airspeed unreliable checklist (PM) while the PF should have stabilized the aircraft in is present configuration.

    I have often seen pilots forget about manually setting power when the auto throttles are either inoperative or some abnormal occurs. I believe this is why Boeing’s procedure for unreliable airspeed has you disengage A/P and A/T. Had the crew done this they never would have been exposed to the MCAS nose-down trim.

    There certainly are issues with the MCAS system logic. It appears Boeing has a fix for that. But we must also address the need for better training of “abnormal” incidents, starting with disengaging automation and manually putting the aircraft in a know pitch/power state when conflicting warnings/data are presented.

    The airlines must find the money to spend more time on this type of training.

    • Yes, I completely agree. In the design of the control systems, instruments and sensors, and continuing through to pilot training, we should follow the “principle of least surprise”.

      In military terms, surprise is considered an advantage because it disorients, adds confusion & delay, and will both induce & enhance the probability of responsive error.

      So we want the pilots to be able to immediately say “ah yes, this is “A”, now I do “B”, “C”, and “D”. Been here, done this before. No surprise.

      We should make whatever investments are needed to get to this point. This is one of the principle failures of MCAS implementation on the 737 MAX.

      Safely flying in a known pitch-power state is something all pilots know and practice. Yet it was not used in the fatal crashes. Why?

      Surprise, disorientation, the brain trying to comprehend and compensate for erratic behavior without an obvious cause. Not immediately knowing that partially extending flaps would end it. Not immediately knowing that trim cutout would end it. Not immediately knowing that autopilot would end it. Not being provided with the correct information, either in training or during the flight.

      The good news is we can fix this, but we have to be honest about it first and committed to the idea that pilots need support throughout the entire process (starting with design, then end-to-end to the actual flight), if they are to fly an incredibly complex machine safely.

    • I had decided that I wouldn’t comment any more here, as I thought I had said what I wanted to say already, but I can’t resist when there are still claims about this particular item…

      “This should have led them to the airspeed unreliable checklist”

      I have tried to envision the situation right after takeoff, and I don’t agree that it would be natural to jump on that checklist. If the stick shaker activates as soon as the wheels leave the ground, my heart would jump wildly and I would immediately think “oh my God, did we take off without flaps (even though we have a warning against that when we advance the throttles for takeoff), or was the VR speed wrong (too low)??”, and the first thing I would look at was the airspeed indicator, and I would probably lower the nose a little (as it looks like they did). The airspeed seemed to be normal, and from the graph, the IAS disagree seems to be negligible at this point. And for those who doesn’t know the 737: There is no light or sound warning about IAS disagree – just this small text message at the lower left hand corner of the PFD: https://photos.smugmug.com/photos/i-TbkjmsX/0/cd4eef0b/M/i-TbkjmsX-M.jpg. Easy to overlook in a stressful situation.

      With the control column shaking and afraid my airspeed is too low, the last thing I would do was to throttle back, just a few feet of the ground! As for the actions further on, I leave that to the investigators to judge. We only have a preliminary report, and we don’t know all the details yet.

  71. Classic comment above by D2, let’s wait for the multiple causes…but here’s the main cause. (Read about the takeoff configuration and consider Geir’s opinion among others.)

    There is a chain of events within each crash.

    There are larger order chains of events at higher levels: Boeing’s process, FAA oversight, market forces, response to the Lion Air crash and so forth.

    But we know this with certainty: Boeing kept pilots in the dark about critical details of the flight control system. If the second Lion Air crew had managed to save that flight. If ET302 had been barely saved. Where would those near misses have lead us?

    Regarding the flight control laws themselves, MCAS, column input, etc.: in a great deal of reading I see only an incomplete understanding available to pilots and the general public (which includes a large number of extremely smart engineers who are not in aerospace but neither was Richard Feynman in the business of flying space shuttles). Boeing needs to come clean on all of the details for ALL to see and judge. Secrecy on their part is not to be tolerated after 346 deaths. After all, IF the Max remains a 737, I cannot imagine but that the 737 line ends here and they go to clean sheet (certainly already in progress anyway according to reports over years).

  72. From Seattle Times November 13, 2018

    “The description of MCAS provided by Boeing states that the system is designed to activate only “during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall” and that it is “commanded by the Flight Control computer using input data from sensors and other airplane systems.””

    Other airplane systems. What are they? Control column inputs?

      • Speed trim is an automatic pitch control system engaged at lower speeds during manual flight, to help relieve pilot workload. It maintains optimal attitude (AoA). It’s important when the aircraft is accelerating (takeoff), as the pilot does not have to constantly adjust trim as speed changes.

        Autopilot may make small changes to trim through the elevators, but I believe the pilot still trims manually on the 737, with autopilot engaged (no speed trim).

        Mach trim does the same thing as speed trim but at cruising speeds, to avoid the tendency to pitch down (Mach tuck). I believe it is active during autopilot.

        Speed trim, Mach trim, and MCAS are all pitch control systems, but cover different regimes of flight. Speed trim would have been engaged but overridden by MCAS in the flights with failed AoA sensors.

        I don’t believe speed trim interacts with the throttle, but it would react to changes in throttle made by the pilots, to maintain AoA.

        Others can please correct me if I’m wrong.

        • Rob, Thank you for your explanation. So, STS would get it’s inputs from the Pitot system (ram air pressure) and feed it’s output to the same pitch control system as MCAS? But, at most parts of the flight, at normal flying speeds, STS wouldn’t be affecting the pitch control system that much?

          • Yes, I believe that is a reasonable way to view it. Speed trim is present on many aircraft. Fully fly-by-wire systems may also call it auto-trim, and it may be active during more regimes of flight.

            Pitch control is basically the elevators (flaps on the rear tail) which are controlled by the pilot control column or by autopilot. Then the rear tail section itself (stabilizer) which rotates as a whole and is controlled by the trim systems. These include the electric trim buttons on the column, the manual trim wheels, and the trim control systems such as MCAS, STS, MTS.

            The functions of elevators and stabilizer are separated so that the pilot will retain control authority regardless of the state of trim. However since the area of the tail section/stabilizer is larger than the area of the elevators, it’s possible in some situations for the elevators to be swamped by the stabilizer. They can also be swamped by high thrust, or by high speed. The purpose of MCAS was to help avoid those situations.

            Bjorn and MentourPilot have pointed out that in the simulator, it was possible to retain control (marginally) with elevator and stabilizer in complete opposition, but the situation becomes uncontrollable at high speed due to the high forces on the surfaces. That was unfortunately what appeared to have happened in Ethiopia.

    • The AoA at which flow separation (leading to stall) will occur is fixed for a given wing configuration. That critical AoA cannot be exceeded without stall. But stall can occur at various speeds depending on AoA and other factors, as Boeing has noted.

      The load factor is lift divided by weight. So high load factor may mean the aircraft is trying to climb, which in turn means it will operate with a higher AoA. Also as the aircraft weight increases or the air density due to altitude deceases, that increases the required AoA for a given load factor.

      Turning/banking are known to increase the load factor as well, and also the airflow conditions on the wings become unequal. One wing (or section) can stall before the other. Here is a good explanation of the physics:

      https://www.experimentalaircraft.info/flight-planning/aircraft-stall-speed-1.php

      All of these things can mean the aircraft is operating closer to the stall condition. So I suspect that MCAS looks at several flight parameters in addition to AoA. But if the AoA value falsely indicates that the critical angle is exceeded, then that is going to dominate MCAS actions, regardless of any other input. This is what apparently happened on both flights.

      Since MCAS was designed to override/assist the pilots at approach to stall, it probably did not consider column inputs. But it clearly had too much authority, and the repeated cycles and advancing corrections were clearly confusing for pilots. If MCAS was meant to be a protective measure, it clearly went beyond that role when provided with a bad input.

      The upgrade as described by Boeing, should restore MCAS to protective status. It will make one correction and stop, and pilot authority will be sufficient to compensate for an unwanted correction with the control column. Also it will not respond to a bad AoA value from one sensor.

      I don’t believe the 737MAX is an inherently unsafe airframe. Pilots apparently don’t believe this either. Airlines ordered them in large numbers even though they are an older design, based on the safety record of the entire 737 fleet.

      But Boeing messed up with MCAS, so it remains to be seen whether that will be representative of the entire aircraft in the minds of airlines and the ticket-buying public. A lot depends on if other buried problems are uncovered in the safety review.

      Pilots are standing back and waiting to be convinced that MCAS has been addressed, and the culture at Boeing that produced it, has been improved. I think that is wise and we should give weight to their opinions, when they decide. The entire world is watching closely now, which is as it should be. What’s tragic is that it took such a large loss of life to get here.

    • Tem, It looks like the “other airplane systems” are .. new data from Simon Hradecky’s website https://www.avherald.com/h?article=4c534c4a/0045&opt=0 On Ground squat switch, N1 = Jet engine fan speed (thrust), Flap setting, Calibrated Air Speed, MACH number, Vertical Speed, Roll Angle, and Angle of Attack. (I hope I interpreted everything correctly.) All of these would help determine an impending stall condition. (from sketch on page 165) This makes it look like there would be readings from both the Left and Right AOA sensors available, so why did MCAS only use the Left?

  73. Groups:
    A) Airplane Company: CEO / Designers / Engineers / Test Pilots
    B) Government Agencies: FAA / EASA / ICAO etc.
    C) Airlines: Safety Dept. / Pilots
    D) General Public searching the internet

    1) Who knew BEFORE the first crash that only ONE AOA sensor was used as input?
    2) Who now knows AFTER the first crash that only ONE AOA sensor was used as input?

    3) Who knows NOW which other systems use only ONE sensor for critical inputs?
    4) Who should know in the FUTURE which other systems use only ONE sensor for critical inputs?

    Would the mistake of depending on single point of failure, be found out sooner, if more people had
    access to the design?

    • Having only one sensor isn’t necessarily wrong. It depends on the probability of sensor failure and the way it fails. The failure of a single sensor can be handled by validation of the sensor data. In this case the AOA seems to have jumped 70 degrees which probably should have been handled by MCAS going into safe state (i.e. disabled).
      Regarding the sensor, we actually don’t know if there was a sensor failure, a wiring failure, an MCAS circuit board failure or a software failure.
      Not all systems that can cause a catastrophic failure are doubled. Double vertical stabilizers are for example seldom seen.

      • Canardian, you have an excellent point. The previous flight to ET610 had airspeed indicator problems. The aircraft mechanics had worked on the issue two flights before ET610 and replaced the AOA vane. So, either two AOA vanes in a row were bad, or some other part of the system failed. So, they had an airspeed issue with this plane, looked at the pitot system, replaced the left AOA vane and still had airspeed issues, along with trim issues, (maybe caused by software?) Flew again, and airspeed issues were still there with a newly installed AOA sensor (maybe a bad connector, maybe a shorted wire?) And then the fatal ET610 crash. So, again, it boils down to looking at the design and any data. Boeing has the design. The investigators and government agencies have the crash data and the airline has the repair data. We on the ‘outside’ without any data to go by, can only guess and infer from deductions from lots of unknowns. I’d like more transparency, before and after, to help avoid future accidents. I know that will generate a lot of useless noise, but, hopefully, more understanding of the possible problems would emerge. The process is broken in a few places for this accident to happen. Until the process and problems are found, reported and fixed, I’m not comfortable trusting the same system. It could happen to another aircraft company. I’ve lost trust in the current “trust us, we know best” attitude.

  74. I think the issue with MCAS was that it was classified below the level of systems with common flight engagement, and was therefore subject to less scrutiny. It was thought to engage only at the approach to stall. But since it was an automatic system, it should have been subject to the same review as any system that engages in normal flight, since that was always a possibility.

    In the military MCAS version, it was reviewed adequately and safeguards were in place. So it may have been that the technology was borrowed from one classification, but then assigned a lower classification that didn’t require the safeguards.

    As an engineer, if I borrowed a system I would borrow it completely to maintain compatibility, and also to not inadvertently lose the expertise that went into it. So one question will be whether there was influence to reduce the classification of MCAS in order to maintain type certification. Other explanations are possible, it could have been overlooked in the rush to bring the aircraft to market. Or it could be human error (engineers make mistakes too).

    Both Boeing and the FAA signed off on this, so there is plenty of blame to go around. But this will need to be investigated thoroughly before the 737 MAX returns to flight.

    • Thank you Rob and Richard.

      I think it is still an open question whether pull up yoke input actually accelerated MCAS in the MAX when AoA inputs indicated a stall condition.

      Some see little point to assessing blame within Boeing’s development process, if all – especially pilots – eventually agree that future Max flights can be safe, i.e., as in the above opinion that there is no inherent lack of safety in the airframe.

      But if we trace the development of the MCAS in this plane, and its power and extent are greatly reduced for future safe operation of the aircraft, one could hardly develop anything but an extremely damning view of the original process at Boeing. It will mean that the process was rushed for sales and that safety was not a primary concern. It would seem that commercial MCAS development was incomplete, a work-in-progress at best. In other words, Boeing’s take – making a safe airplane ultra safe – is rubbish.

      I am very interested to learn more about this:

      “In the military MCAS version, it was reviewed adequately and safeguards were in place.”

  75. There are several articles published on this, as well as a mention in Wikipedia. Just search on KC-46 MCAS.

    For a tanker, pitch problems can result from imbalances as fuel is off-loaded in flight, which is a constant activity. So MCAS was designed as a necessary safeguard. As mentioned before, many of the 737 updates are coming from this system.

    Why they weren’t copied to the 737 in the first place, is a question Boeing will have to answer.

  76. I see, thanks. I had thought it was installed on a military version of the Max. Still quite interesting to review. As you say, dynamic CG changes on a refueling tanker seem to be a significant challenge well beyond a loaded commercial flight, yet the MCAS on the KC-46 provided much more pilot control from what my search yielded. The Air Force is taking another look.

    A completely different arena that I find nonetheless instructive, the Hyatt Regency hotel walkway failure in 1981, involved (a) a flawed initial sketch by the engineer of record interpreted as a final design by the fabricator, (b) a change made by the fabricator to the already flawed initial design and approved over the phone by someone in the office of the engineer of record, and (c) errors in fabrication, where welds on critical box beams were split by the load bearing axis. Source: Wikipedia.

    Returning to the current issue of the Max and orders-of-magnitude more complex design challenges, those problems with the MCAS that are completely independent of any pilot error or airline responsibility are proving to be so egregious that they beg questions about such basic issues such as workflow, degree of testing, and whether a clear understanding ever existed even at Boeing and the FAA of what they had released to airlines and on the flying public. It is clear that managers and higher executives at both the FAA and Boeing bear the vast bulk of the responsibility for the deaths that occurred even as pilots and airlines will be assigned some portion of that.

Leave a Reply

Your email address will not be published. Required fields are marked *