Leeham News and Analysis
There's more to real news than a news release.
Leeham News and Analysis
- Solid start for stand-alone GE Aerospace despite cuts to LEAP output April 23, 2024
- SPEEA, Boeing at impasse over safety program, union says April 23, 2024
- Better transparency needed on Boeing’s 1Q earnings call April 22, 2024
- Bjorn’s Corner: New engine development. Part 4. Propulsive efficiency April 19, 2024
- Boeing unlikely to meet FAA’s 90-day deadline for new safety program April 18, 2024
Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 3.
November 15, 2019, ©. Leeham News: We continue the series on analyzing the Lion Air JT610 crash. We now analyze the initial part of the flight. In the last Corner, we analyzed what went wrong in the aircraft. The left Angle of Attack sensor had a 21° bias failure.
How such a rather limited failure could bring a new Boeing 737 MAX down is what we try to understand in this series. To assist us, we have a detailed final accident report from the Indonesian Safety Board.
The initial part of flight JT610
We will look at the initial part of Flight JT610, the accident flight, in this Corner. Then we continue with the final part in the next Corner. We will compare the accident flight, JT610, with the previous flight, JT043, to gain more insights, as this flight flew with the same problem but managed to complete the flight.
We will specifically discuss the pilots’ reactions to the effects the single Angle of Attack (AoA) wrong bias could have for these flights and how such a limited problem could finally bring down a modern airliner. The facts around the subjects are taken from the final report, and I add my thoughts and conclusions.
The flight before JT610 and the state of the handed over aircraft
We know today the aircraft had exactly the same configuration and problem on the flight before JT610, flight JT043. The fault messages seen during this flight were unreliable airspeed (IAS DISAGREE) and altitude (ALT DISAGREE) on the Captain’s Primary Flight Display (PFD) and a roof placed warning light for a problem with the flight control feel pressure (FEEL DIFF PRESSURE).
All these failures stemmed from incorrect AoA values as the ADIRU (Air Data Inertial Reference Unit) uses the AoA to correct the values for Airspeed and Altitude for measurement faults due to the AoA. The wrong correction for the left side instruments gave a difference in the values to the right side instruments and the difference was detected by the safety functions of the avionics system.
The 737 MAX, unlike the 737 NG, didn’t have a functional AoA disagree warning for the pilots’ displays. It should have been there but due to a programming failure by the Flight Control Computer (FCC) supplier, which also did the software, it was not displayed on MAXes that didn’t have the option for the AOA display on the pilots’ displays. It wasn’t recognized until the aircraft had entered service. Then any change was too late and the introduction was scheduled for the first Avionics software update 2021.
This meant the JT043 pilots had not been able to analyze what was wrong with the aircraft. The maintenance log listed the three warnings which had been shown, but did not reveal the aircraft was difficult to control nor that the crew used the trim cutout switches to stop a repeated trimming nose down of the aircraft.
The Captain thought it was Speed Trim which was confused by the erroneous airspeed which was trimming. He wrote in Lion Air’s flight crew incident system after the flight “ Speed Trim trimmed in the wrong direction”.
With the aircrews having no information about MCAS, this was the most plausible explanation for what happened. The crew did not classify the trimming as “Trim Runaway” as this is when the trim runs uninterrupted in one direction until one stops it. Here MCAS trimmed for seven to nine seconds (dependent on Mach) and then stopped, started again, then stopped in an endless repeat cycle.
The accident flight
The aircraft was handed over as repaired by the flight line mechanic to JT610’s Captain. The mechanic had done the cleaning actions of the pitot system as mandated by the maintenance manual based on the communicated fault indications from JT043.
There was no discussion of the flight control problems on the previous flight as there were no comments from the crew in the aircraft maintenance log other than notes about IAS DISAGREE, ALT DISAGREE and the FEEL DIFF PRESS warnings.
At rotation, as the values from the AoA sensors become valid (they are unreliable at lower airspeed), the left stick shaker activated for the Captain who was flying. He notified the First Officer (FO, the Pilot Monitoring, PM) about it.
After a short while, IAS DISAGREE appeared on the Captain’s display. He asked the FO to read out the memory checklist items for “Unreliable Airspeed”. The FO didn’t have the checklist in memory and it took a while until he found the checklist in the Quick Reference Handbook (QRH) and started reading it.
Item number eight on the list says “Crosscheck left, middle (backup) and right airspeed indications when the aircraft is trimmed and stabilized”. By now, the flaps were up and the Captain was fighting MCAS. Hence no stabilized condition was reached and no airspeeds were compared (they only differ with about 10 to 15 knots on displays showing 200 to 250 knots so you need a calm aircraft and a careful analysis to reliably identify any difference).
The non-completion of the IAS DISAGREE checklist meant it was never established which ADIRU system caused the warnings. The crew, therefore, could not realize the problem was one-sided and the FO could have flown the aircraft on his display with the middle backup display as a backup.
In the JT043 flight, the IAS DISAGREE checklist could be completed and the airspeed difference could be traced to the Captain’s side. This was possible as the FO held against MCAS without trimming which gave the calm to do the readings. A third pilot on the clap seat helped with the analysis of the problems as well. The FO said he could almost not hold the aircraft (he had a stick force of 105lb which is very high) and the Captain subsequently told him to trim.
Once the fault was isolated the Trim Cutout Switches were tried, it stopped the trimming. Then they were re-engaged and the nose down trimming re-appeared. The switches were then put in the cutout position for the rest of the flight. The use of the switches to quiet a confused Speed Trim was not documented in the Maintenance log after the flight, as “fixing the IAS DISAGREE problem would fix the Speed Trim confusion” according to a follow-up discussion with the JT043 Captain.
The JT610 Captain held against MCAS nose-down trim each time it triggered and then trimmed to neutral stick force. As the Captain trimmed, MCAS was reinitialized and it trimmed nose down again after a five-second wait. His reaction time before trimming was first 10 seconds then faster, finally settling at three seconds (he countered MCAS 22 times before handing over the flying to the FO).
Conclusions
We will halt at this point and draw the first conclusions:
- A major contributor to the ultimate loss of JT610 is the missing AOA DISAGREE display on the pilots’ displays. It would have shown the JT043 crew the AoA system had problems and these problems would have been logged in the aircraft maintenance log. The mechanic would have seen the AoA problems were not fixed by the AoA sensor change and he would have discovered the bias problem as a mandated SMYD (Stall Management Yaw Damper) self-test would have discovered and flagged the bias fault (consequently this test can’t have been done (it was mandatory) by the AoA install mechanic).
- MCAS intermittent trimming, similar to Speed Trim, caused the crew of JT043 to think it was the cause of the nose down trimming. The Captain, who wrote about it in his log, has explained he tought it confused by the faults behind the IAS/ALT DISAGREE. With no prior knowledge of MCAS, the crew only knew “it’s the same aircraft as the 737 NG” system wise and the only system they know with this behavior was Speed Trim.
- The Speed Trim behavior of MCAS didn’t lead the JT043 crew to an immediate “Trim Runaway” checklist which listed a “Trim Cutout Switch” action. The report also states Boeing didn’t think using the Cutout Switches was necessary. It’s written in its safety analysis of MCAS before certification. Holding against and trimming should be enough, and this is the natural reaction of a flight crew. Using Trim Cutout Switches was an additional action that was available but not needed. Boeing and FAA changed this after the JT610 accident in their issued AD (Airworthiness Directive). Now the use of the Trim Cutout Switches was made mandatory.
- Boeing gravely missed the recognition and reaction time for the trimming. The recognition of the problem and the reaction time for the JT043 crew took 3 minutes and 40 seconds. Boeing assumed four seconds in its safety analysis. The JT610 Captain trimmed after 10 seconds after the first MCAS activation. This later shrunk to three seconds. The recognition plus reaction time was key in classifying an MCAS rough activation as a “Major” safety hazard, allowing a single sensor trigger and no deep safety analysis (with for example a complete FMEA, Failure Mode and Effects Analysis). The report is very critical of Boeing’s use of four seconds as a combined recognition and reaction time. This is what pilots achieve in an undisturbed environment. Here the stall warning was continuously on and there was a multitude of alerts requiring the crew’s attention.
In subsequent Corners, we will analyze the final part of the JT610 flight, which is from where the First Officer was given the control of the aircraft.
” It wasn’t recognized until the aircraft had entered service. Then any change was too late and the introduction was scheduled for the first Avionics software update 2021.”
In the semiconductor industry
“${Product} Known Errata Infomation” listings
are distributed as soon as deviations from published
data comes up.
https://www.pcjs.org/pubs/pc/reference/intel/80286/b2_b3_info/
Unknown concept at Boeing?
First, in no way is this intended to put the blame on the pilots, it vaslty on Boeing with MCAS 1.0. I have alwyas felt pilots were the last chance to deal with a problem, and MCAS 1.0 was a maor problem.
What bothers me from the pilots end, they did have the major indicators and failed to regnoize it.
I doubt an AOA deisagree woul dhave done this crew anyh good as they had the other alerts going and with MCAS 1.0, it would have been only one of many alarms and alerts going on (Sitkc shaker)
Theyh did have two other indpeindeisi displays, Bakcup and the FO display to do a comparison to which would have corroborated FO as the one to go to.
That does not include the flaps up, it starts, flaps down, away it goes. Why not fly flaps down as this is clearly dicey with the severe nose down issue?
simply leaving flaps down and the heck with anything else and a turn back.
Latter in the flight they switched to the FO controls but then quit that as well. He had no stick shaker. If he had trimmed to neutral it wold have stopped.
It was savable, not a slam dunk but it was savable.
“” flaps down, away it goes. Why not fly flaps down as this is clearly dicey with the severe nose down issue?
simply leaving flaps down and the heck with anything else and a turn back. “”
Boeing and FAA had over 100 days time to mention flaps for ET302 but didn’t.
Maybe flaps 1 was not enough or FCC was too slow, at flaps 5 were many auto AND, STS masking MCAS when they didn’t know about MCAS. DAMN not to tell about MCAS.
23:22:33, flaps reached the fully retracted position and the automatic AND trim was active for about 10 seconds
23:22:41, Captain instructed the FO to select flaps 1 and flaps started to move.
23:22:48, flaps reached position 1
23:22:54, automatic AND trim activated for 8 seconds
23:23:00, flight crew selected flaps 5 and the flaps began to travel from
position 1 to 5. During this time, the AND automatic trim ended.
23:23:07, flaps position was at 5.
23:23:15, automatic AND trim activated for 1 second and activated again at 23:23:18 for another 1 second.
23:23:18, automatic AND trim activated for 2 seconds and activated again at 23:23:23 for another 2 seconds.
23:23:23, automatic AND trim activated for 1 second and activated again at 23:23:26 for 1 second
23:23:26, automatic AND trim activated for 1 second and activated again at 23:23:32 for 2 seconds
23:23:48, automatic AND trim activated for 1 second
23:24:52, flaps started retracting from 5 to 1.
23:24:59, flaps were at position 1.
23:25:13, flaps started traveling from position1 to 0 (UP) and reached position 0 at 23:25:27.
23:25:27, automatic AND trim activated by MCAS for 2 seconds
23:25:40, MCAS activated for 6 seconds.
While it is somewhat logical to wait till the next software upgrade to correct the lack of AOA disagree warning- IMHO there is simply NO excuse for NOT notifying all immediately on discovery of the error such that all buyers including those not yet delivered were 1) aware the light did not work, why, and the possible- remote impact.
But of course the cost of a re exam of the possible impacts, and the cost of bcrats and legal wording games, and the cost of distribution and paperwork and someone having to rubberstamp or even sign such a document was the prime focus.
Just a guess, the cost of such notification would be maybe 150,000 all told, and whose budget or that of the vendor would have to take the hit.
Bubba et al, my guess is that within the transportation industry, software updates are not advertised until release, due to the additional legal liability incurred by control systems, which are different than standard software.
Airbus also does not release an errata sheet in advance of the update release. Nor does the auto industry. So I think this is standard practice.
Internally, software defects are evaluated and prioritized prior to remediation. They always exist, so the question becomes how quickly they are addressed. Boeing prioritized this one as not-critical, but it turned out to have played at least some role in the two crashes.
I have written control software for experimental engines, test stands, and wind tunnel testing. I required an exemption of liability because I could not accept the liability of a flaw in my work, in controlling a multi-megawatt facility. I got them started, but the customer took over development because their employees were covered by the organization’s liability.
I have never had to do that for non-control software applications, there isn’t much concern about legal action beyond general liability.
The issue was incompetent maintenance crew and incompetent pilots.
That you Denis?
WTH
“I am also one of the few who have flown a Boeing 737 MAX Level D full motion simulator, replicating both accident flights multiple times. I know firsthand the challenges the pilots on the doomed accident flights faced, and how wrong it is to blame them for not being able to compensate for such a pernicious and deadly design.”
http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/
Perhaps re-read https://leehamnews.com/2019/10/11/jatr-study-damning-to-boeing-faa-new-york-times-says/ carefully.
The Lion Air pilots were not even aware that MCAS existed !
“did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS” again from Capt. “Sully” Sullenberger same link as above.
Accidents are usually a chain of events, beak one link, and the accident doesn’t happen.
I shall now stop feeding the trolls.
Ask yourself just one question: If MCAS had not been active on either flight, would those aircraft have crashed ?
Why do I smell sulfur when you go about rubbing AstoTurf?
“four seconds as a combined recognition and reaction time. This is what pilots achieve in an undisturbed environment.”
Is this an undisturbed environment when the pilots are also not expecting any issue? Or with expecting an issue but not what? Or expecting an issue similar to what happens? And is it for test pilot standard or for ‘average’ pilot or for lowest pilot sandard widely found worldwide?
Human Factors tells us that several problems can develop.
”Tunnel vision” (i.e. too much focus on certain details while overall perception is degraded) can easily occur when under stress.
”Time distortion” – perception is that too much time has elapsed
“Memory degradation” under stress. Critical details can easily be forgotten. Eg turning of auto throttle for ET302 even thought first officer called the stab cut out procedure correctly.
“Workload overwhelm” consider the multiple alarms and multiple checklists.
The automation needs to be more robust, especially in relation to sensor redundancy, diversity.
@William
James T Reason has for many years studied and written about Human Factors, and he found that even when you have several layers of protection, each layer may have a ‘loophole’, and in certain scenarions ALL protection layers failed; as was the case in the Lion Air accident (such as MCAS design, maintenance, previous flight crew reporting, pilots’ capability….). Search Wikipedia for ‘Swiss Cheese Model’ , and you see what I mean.
Perhaps we need to add even more layers of ‘Swiss cheese’ and try to find, and seal, existing ‘loopholes’. I wonder if airliner pilots will have less and less ‘hands-on experience’; and if so we need to make the control systems so the airliner is on autopilot all the way. Today some pilots execute gear-up and autopilot on, in ‘the same go’ – and opposite when landing – so we are close to achieve this
it’s me again; – with some week-end readings for those who wonder why accidents and incidents take place:
https://www.eurocontrol.int/eec/gallery/content/public/document/eec/report/2006/017_Swiss_Cheese_Model.pdf
The Chilling Part is early in the write-up
“Often these vulnerabilities are
“latent”, i.e. present in the organization long before a specific incident is triggered. Furthermore,
most of them are a product of the organization itself, as a result of its design (e.g. staffing, training
policy, communication patterns, hierarchical relationship,) or as a result of managerial decisions. ”
I tend to believe they are ALWAYS present.
While that is true for people in general, pilots should be able to overcome that.
The fact that they often do not speaks volumes about pilot selection and training.
All my training was focused on “deal with it” We were supposed to handle emergencies correctly and without erratic results.
I think there is a bit of nostalgic, rugged American individualism here. Both flights required problem solving for a problem that couldn’t be solved in the allotted time and not by an uncordinated team. The third person made the difference in the case of the flight that survived activation of MCAS. In reading about both crashes, the captains seem to begin to rely on their judgments alone — which in the case of ET302, were formed by substantial experience flying planes (which were supposed to be negligibly different) from that airport. A communications breakdown occurs. The last thing you need is John Wayne in the cockpit. Sully may have declared, “my aircraft” but he trusted the first officer to go through the checklist in helping make the ultimate judgments. He cross checked his judgments! In AF447, the two pilots lost complete faith in their instruments and their response was uncordinated, sometimes registering dual inputs. The man piloting the plane was absolutely certain of his mortal judgments. Despite intense and constant training, people always make mistakes in judgment — especially when that have just a few seconds to get it right. It’s interesting to note that after surviving such ditchings or crashes, very experienced commercial pilots don’t seem to exhibit a high from the thrill of a near death experience — instead, they walk away from commercial flying.
Real Steve:
When the Captain says its my aircraft, that means he has shifted to the PF role.
That in turns tells the NFP his is he support role.
Int he case of sully, he alwyas was PIC and he had a vast reservoir of military experiences.
He knew he had CRM with his First Officer. Any captain would do the same thing.
AF447 had nothing to do with instruments, it had all to do with having lost their collective minds. It was like they never had seen instruments or trained on them.
We are not talking John Wayne here, its basic piloting that you learn from the start.
Clearly its not learned and its not second nature the way they turn pilots out now.
That needs to change. Badly.
AF447 has certainly taken over your mind TW, you pluck out snippets of the accident report,more often your own opinion, out of context and unrelated to the topic here.
Bjorn – Would Boeing’s 4 second recognize & react time have been valid if the AoA Disagree caption appeared on the EICAS?
Without knowing about MCAS? What are you thinking? Nothing of the “insidious” nature has changed.
AoA in the preceeding NG design had no real execution power.
Thus AoA disagree can’t trigger any trained in reflexes.
What I’d like to know in this context:
How high is the probability of real “trim runaway” on reasonably “fresh” NGs ? ( i.e. the malfunction that has trim running uncomanded continously
that the mentioned checklist was designed to handle.)
I contend i you do not know what the ramification (MCAS 1.0 kicking in) of an AOA disagree it is just another miner alert amongst all the others and a so what.
Uwe, from Peter’s Satcom Guru site for the 737 (all models):
“With sparse reporting to draw from, it can be surmised that a stabilizer runaway or failure occurs about once a month, with a jam about once a year (world-wide)”
first order estimation then is:
0.5 resp 0,04 instances per million FH.
(9000 frames(NG and older), 8h per day, 30 resp 365 days ..)
My tentative guess was/_IS_ that this was a more pronounced issues with the jurassic and classic versions and no longer of much relevance on the NG.
i.e. the average pilot 10..20kFH lifetime ) never sees a “Trim Runaway”
Uwe, the span of data from which this was derived, was 2000 to 2019, so last 20 years.
The rate of occurrence for NG model was 75%. but this reflects the NG being the dominant plane in service, with earlier models being retired during that span.
The estimated average 737 flight time in this span is 3,500 hours per year. This means the probability of a trim malfunction/runaway is about 2.5 per thousand flights. So 1 in every 400 flights.
As Peter notes, the vast majority of these are reported as logged “flight occurrences” or maintenance issues, rather than as potential accidents.
I think this is why the runaway trim procedure is required to be a memory item for pilots, by most regulators. There is a shift away from memory items as flight deck automation has advanced. Manuals in electronic form can be quickly searched and may be more reliable.
That goes to the question that TW has noted, in that there is a trade-off between the immediate availability of inherent pilot skill and knowledge, and the delayed response due to reliance on automation.
That’s something we have to figure out going forward, as automation will only increase, not decrease.
An example might be NASA astronauts, it was recognized early on that they must maintain their manual flight skills on a monthly basis, to keep their acuity sharp, even though those flight hours have little to do with the craft they actually operate in space. It’s more to do with maintaining mental sharpness and edge.
Before automation, pilots did this naturally. Military pilots are also more likely to do this naturally. Even civilian pilots may come by this more naturally. So maybe there are some lessons there for commercial aviation.
Sorry, I got the terminology wrong there, it should have been roughly 1 in 400 aircraft per year, out of a fleet of roughly 5,000 aircraft.
Aircraft make thousands of flights per year, so 1 in 400 flights makes no sense at all.
Like TW says, always cross-check!!
General Hours Comment:
Flying through the air on long flights adds hours but it adds no experience.
The best pilots tend to be the short hop guys who may not even use the automation.
Its too soon to see how the new sim practices (or supposed to) are working out for keeping pilots fully sharp.
FedEx as an early adapter even before this as they had realized the pilots had eroded emergency skills and had gotten used to the rote sim runs and they were not being challenged (and their accident rate was high but they are least realized it and took action)
I am not sure that they should not revert to full basics and single engine prop training with no automation.
What I can say was when we had a chance to fly in a full cloud condition, I had no issues with doing so.
Pure trust of instruments and scan.
Screw the alarms, fly the airplane first .
The best part of the film, “Sully” (2016) is after they listen to the cockpit voice recording, and Sully and and Skiles step out of the room and huddle together:
Chesley ‘Sully’ Sullenberger : What did you think?
: Hearing the CVR just now?
: Let me tell you what I think.
: I’m just so damn proud.
: And you, you were right there, through all that distraction. With so much at stake.
: We did this together. We were a team.
Jeff Skiles : Thanks, Sully.
Chesley ‘Sully’ Sullenberger : – We did our job.
Jeff Skiles : – We did our job.
This seems to be the one thing somewhat missing in both accidents — a coordinated, problem solving response on the part of both the Captain and the First Officer with absolute trust in each other and each other’s professionalism. This might be why a third person made the difference in on JT043. When such coordination is well done, it minimizes the “human factors,” I think.
In the cockpit during a flight, don’t pilots throughout the world speak to each other in English — even if they speak another language and the same mother tongue? Could this affect speedy coordination in a crisis?
Possibly, but more than enough poor piloting in full English cockpits would belie that.
A 757 flying into Ireland had pitots freeze up and the pilot dumped the nose and exceeded safe air speeds. Major damage to the aircraft.
All training is to maintain your instruments scan and the VSI and altimeter will tell you if you are not maintain airspeed as well as the Artificial Horizon.
US and EU are working to a program where they throw totally unexpected at pilots (no rote stuff) to see if they know the basics.
The problem is eventually that can become rote and if you don’t get it, you should not be a pilot.
In WWII they were merciless, if you con’t cut it you are OUT. Same here, if you can’t do it, be gone.
Bjorn rated Captain Bhavye Suneja as an above average pilot, Sullenberger reckons that the MCAS crash scenario would have probably got him.
Captain Suneja did an admirable job of dealing with the MCAS failure, interrupting and counteracting it effectively. Bjorn said he will cover the last portion of the flight in the next Corner, with the first officer in control.
What’s an EICAS, is it like ECAM “electronic centralised aircraft and monitor”. B737 MAX doesn’t have one since Boing applied for and was granted an exemption to much of FAR 25.1322.
JT043 was lucky to have a 3rd pilot monitoring without other duties and still it took 3 min 40 sec to recognize. The JT610 pilots were just too busy fighting MCAS and checklists.
I’m not a pilot, but if I have to fight AND again and again, wouldn’t I try to stop the source, cut the motor. Not good to pilot when being ill I’m sure. I don’t blame the pilots. Training was by far not good enough. There should be much more attention on training. Thinking about pilots flying over my head are not trained makes me sick. And all these checklists and memory items, on an expensive and NEW plane, this all should be with automated help.
I would say JT043 and JT610 are a good example why the MAX can’t be flown with only two pilots with that training, need THREE. Boeing was far OFF.
Beside that there is a gorilla ape needed to pull the column. An ape flight attendant might fix this and passengers will know everything they need to know. I’m waiting for this joke to be certified, certified again from this Third World FAA.
Leon:
At issue is how people react (not pilots)
My issue is I believe they are not weeding out people who should no be flying.
Its not just a non Western issue
AF447 has 3 highly touted Western World pilots with a lot of experience and the Captain was back into the cockpit in plane of time. The FO did not follow ANY of his training.
Neither the NFO or the Captain could look at the instruments and recognize e a stall though it was glaringly obvious.
There were something like 13 recorded loss of speed incidentals prior to AF447.
Almost all were handled wrong.
So while its training, its pilots and the selection process. Some people simply freeze up, panic when faced with a situation and should not be in a cockpit.
US and Europa are workign to correct that but I continue to wonder if like the old flying schools, the first effort should be to eliminate those who simply do not belong in a cockpit.
High altitude stalls seem to be a special ‘thing’ , even Qantas in different circumstances, found its training for pilots wasnt adequate , and this was long after the Air France issues were high lighted
https://flightsafety.org/qantas-incident-prompts-new-stall-warning-recovery-training/
While your overall comments on AF447 are right , its wise for armchair analysts to consider all the factors:
“The stall warning deactivates by design when the angle of attack measurements are considered invalid, and this is the case when the airspeed drops below a certain limit.
In consequence, the stall warning came on whenever the pilot pushed forward on the stick and then stopped when he pulled back; this happened several times during the stall and this may have confused the pilots.” Wiki AF447
So pushing nose down gives stall warning, while pulling nose up stops the warning Is there something Ive missed?
Duke, that is a really good point. In that case multiple safety systems were integrated without fully exploring the end result if they were in use simultaneously.
In some sense that is similar to MCAS. It was meant to provide safety but provided the opposite due to lack of full integration.
Vasco raised this in the context of the human-machine interface, and I agree that is the right way to view it. What will all these systems mean for the human sitting in the pilot seat? Not just in the context of one system being tested, but when they operate together? Do they provide consistent information or contradictory?
If the answer is contradictory, then the pilot requires time to sort that out. So there should be a model for reaction time that includes the effects of contradiction.
When I was in engineering school, human factors was just getting started, in the wake of the Three Mile Island nuclear accident. Operators got confusing readings and did not understand that the core was being uncovered, until it was too late. So people were doing theses on the presentation of information in control panels (gauges, dials, and graphing instruments at that time, computer graphics were only rudimentary).
That has advanced now to the presentation of information on glass displays. They have much more flexibility, really only limited by our imagination, in terms of how they can represent information. Which means there is a lot of room for growth and improvement.
Additional info from the final BEA AF447 report, which has relevance to the JT610 situation
https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
” 2.1.3.1 Safety Expectations ( last phase of flight)
The crews’ expected reaction time is of the order of a few seconds. Examination of the documentation has not brought to light a technical call-out associated with the implementation of actions.
Other than during initial training, as mentioned above, a pilot is unlikely to encounter an approach to stall more than a few times during his or her career, and is even less likely to have to deal with a fully-developed stall. The safety model thus assumes that the abilities to identify the signals indicative of the approach to stall, and to recall the expected actions, remain sufficient over time, despite the low levels of exposure.”
Approach to stall is a few times during an entire pilot career and go on to handle a fully developed stall even rarer. These are for commercial airliner pilots.
Duke:
As I have noted repeatedly.
You don’t fly by a single instruments nor do you accept single inputs as valid – they are alwyas cross checked.
In the case of AF447, they had multiple aspects that should have gotten full attention as they all confirmed the same thing.
1. VSI is negative 10,000 FPM (that is on the PFD) It reason for being is to give you an instantaneous figure of what your vertical motion is.
500- 3000 negative is a normal decent though 3000 is high 1500 wold be normal (not an airline pilot, 1000 w0ld be high for a prop job) but we did not fly at even 10,000 feet.
Negative 10,000 only occurs with steep nose down or stalled.
2. PFD is showing you are at 20 degrees up angle. Ok, with VSI cross check along that is a stall.
3. Cross check further, altimeter is showing a high rate of decent, its not as good as VSI but you can see it winding down fast. You now have 3 reliable measurements saying you are stalled.
All other instruments agree and you can see the backup saying the same thin (if you look as you should) as well as left seat primary instruments. .
Dump the nose.
All pilots know you can have a full power on stall, its a basic maneuver done repeatably in Flight School (called an accelerated stall).
What is in questioning if you ar going to have a warning why it would go away when you got too slow?
Ahh the wonders uf sucky programing and the Almond Joy thing, Sometimes I feel like a help and sometimes I don’t.
If the gear is up and you are that slow, then stall should never go away.
Granted it all gets ignored so I don’t have any idea if it does any good, all indicators are it does not.
But again, basic piloting says and beats into you, fly the instruments and cross check all data.
While it takes discipline, its not that hard.
Tens of thousand Americans were taught to fly in WWII and did so amazing successfully (casually rate was not to minimized)
Even the Brits with some of their lethal takeoff birds like the Mosquito , and Tempest/Typhoon trained pilots to operate successfully.
You take a huge cross cut from city to grunt farm labor and they could be taught to fly in the most extreme conditions and do well.
Any regular pilot not fling combat should be able to assess and manage.
I don’t excuse Boeing in any way but pilots are an issue as well.
It used to be a pilo0t was there to save things when it went wrong, not when everything was going right.
Read the CVR transcripts and tell me where they weren’t flying the plane. In JT610 , the Mcas was countering the pilots controls and the AF447 the instruments weren’t reliable and the warnings were contradictory and they didn’t understand the FBW mode they were in because of above, which led to complete confusion and brain fade.
Certainly a list of “known bugs” should have been documented and provided. Some technicians would have had the curiosity to make use of it. I can imagine 3 reasons for delaying the software upgrade. 1 It would have been expensive and at Boeing’s cost, or 2 the software package with fixes would need to be tested and certified as a “whole” which would take time, there is a valid concern that software patches can introduce new bugs 3 the software anomaly was incorrectly rated as not being critical to safety which meant. The AOA disagree alert might have sent the maintenance staff down different repair route. It’s disturbing that it wasn’t rolled out within 2-3 months of the Lion Air crash ( October 29th 2018) since the preliminary report was out on time and surely there should be a mechanism to do a simple modification like this. ET302 crashed March 10 2019, about 130 days latter.
The US Goverment shutdown might have delayed a release of new Boeing SB’s and checklists.
One could argue that EASA should have taken over from the FAA during Goverment shutdowns due to effects of safety as they later discovered in Ethiopia.
Not their job or are they in the loop to do so.
They can run all the separate they want but Bovine is owrking with FAA not EASA though once FAA is dealt with they will shift to EASA.
Non critical parts of the US Government may have shutdown (much of the FAA didn’t) but Boeing certainly didn’t shutdown. They have normal and direct communication channels to their customers. They can issue advisories. The point I’m making is Boeing is supposed to do this kind of thing by the initiative of its own systems.
Update getting through certification in 2-3 months?
Not on this planet.
The alert was not considered critical so was added to the planned update. That update would be for new features, and non critical bugs (annoyances).
And the schedule for that update probably included 12 months for certification once the update was “finalized.”
This stuff isn’t like a patch from Microsoft or Google.
I’m afraid one of the major culprits in this whole thing might by a deep, abiding, 20th century mistrust in fly by wire. A friend of mine recently said that if you’ve experienced a great landing, it was probably automated. If you experienced a bumpy one, it was probably the pilot. Is it possible to imagine that a pilot or a group of pilots monitoring or using a joystick to control a flight 1,000 miles away, might have the much better reflexes, judgment, and knowledge needed to save an airplane in a crises? It’s a fact: fly by wire is here and it’s not going away. Not if Hal can help it (sorry, I didn’t write that. Autocorrect)! The 737 prolonged a bygone and perhaps more dangerous era.
We have had FBW for 30 years or so. I don’t see that.
Issue is a 737 mechanical an modern setups and how to deal with it.
FBW crash at the same rate as the 737/767
Bjorn rated Captain Bhavye Suneja as an above average pilot, Sullenberger reckons that the MCAS crash scenario would have probably got him.
That is where I do disagree with Bjorn and its a shame we can run some testes.
I think Sullenberger is underestimating himself.
Cross checks and scans of the instruments should have been enough to maintain stability in both cases. That baffles me.
The only thought is that so much has been put on\ b automaton and looking at alarms they have failed to teach the first law of flying and that is always fly the airplane.
How much time do you have to cross check the instruments and act? You just took off, closed the landing gear and retracted the flaps. How high are you? about 400 feet? How much altitude do you have, to react? Don’t forget, the landing strip behind you and the altitude above you won’t help you.
You aren’t fast enough and high enough to have a look at your instruments with a clear head. ET302 pilots, even when they were *expecting* this to happen, could not save the plane. Heck, Boeing, assumes 4 seconds to diagnose and remedy the problem. You cannot “crosscheck” your instruments in 4 seconds and come to the correct conclusion.
MCAS problem would never have happened at altitude. It was designed to hit you during takeoff or landing, when you are close to the ground with low speed, when flying manual, and it wasn’t even documented.
“” ET302 pilots, even when they were *expecting* this to happen, could not save the plane. “”
Did they trained it on their sim but then when they wanted to turn the trim wheel in flight it wasn’t working. Boeing made too many mistakes.
There are hundreds of drone pilots taking Reaper, Predator and Global Hawk RPV unmanned aircraft on flights leaving normal runways going through normal air traffic each day. Only need to port to passenger aircraft. Happening going to happen.
Imagine if both crews could have turned over control to a Boeing testpilot on standby, sitting in a room somewhere with a powerful computer monitoring instruments, running scenarios, suggesting alternatives, and placing them in absolute control.
William:
The accident rate of the drones is very high.
They also do NOT co habitate with regular traffic.
Its not allowed. As they have none of the approved system for ops in that environment, they can’t mix. Eighter operated in areas of the world where there is no commercial traffic or in test areas where they are the only traffic and no commercial traffic.
They have no redundancy to loss of comms let alone any that are approved in mixed traffic or the TCAS systems.
I suspect things have changed since Vietnam era Ryan Firebee target drones were adapted as recons and dropping a single bomb and you were listening to “Fortunate Son” on 45rpm vinyl😁 Global Hawke maintains 6 high bandwidth data links to 6 Iridium satellites. It won’t takeoff unless two are working. A second Independent set of backup links is available to the separate Inmarsat satellite system. In addition there is a line of sight link Probably good to 500km/300m from the base, usually Dryden but I think USAF has one in Japan as well. https://directory.eoportal.org/web/eoportal/airborne-sensors/content/-/article/global-hawk
If all satellite links fail I imagine the Global Hawke will complete its mission autonomously and fly to say Dryden AFB and orbit within range of the direct link. Global Hawke pilots can talk to local ATC air traffic control via a radio on the Global Hawke using voice carried satellite links. Since they usually operate at 55000-65000 feet traffic conflicts are rare. NASA Global Hawkes sometimes descend to low altitude to gather atmospheric data. The FAA has granted the Global Hawke certificates to operate in US airspace.
https://news.northropgrumman.com/news/releases/global-hawk-becomes-first-uav-to-receive-national-certificate-of-authorization-to-fly-in-national-airspace
Any limitations to use of the Global Hawke in commercial airspace is a limitation of the aircaft in commercial airspace. I believe such UAV are as safe or much safer than passenger aircraft. This is because if a simple set of sensors or systems fail on an aircraft automatic Control deactivated and control is sloppily handed over to fallible human pilots. The UAV guys will figure out multiple back up system. You can fly an aircraft without pitot-static, altimeter, variometer, alpha sensor data using many permutations of data from gyros, thrust, INS or GPS. It’s a bit like veterinarian surgeons being way ahead of human doctors in treating many illnesses. Australia has purchased several Global Hawkes and one landed at Avalon Airport for the Airshow.
I think a remotely piloted B787 would be possible now simply by software modification, no hardware changes required, since the aircraft already has high bandwidth satellite links. There would of course be a lot of software to certify and redundant. The issue is probably more that we need a new kind of air traffic control system (now being developed in US and Europe) where flight plans are generated automatically and filed automatically, de-conflicted and then continuously monitored and deconflicted during flight. That’ll be needed with the massive increase in delivery drone style traffic followed by EVTOL taxi. I would Expect passenger jets to follow.
Going to happen ? With these numbers it isnt even near to that
” Last year,[2016] though, set a record for Air Force drone crashes. All told, 20 large Air Force drones were destroyed or badly damaged in accidents last year, the worst annual toll ever, according to a Washington Post investigation. Driving the increase was a rise in mishaps involving the Air Force’s most advanced “hunter-killer” drone, the Reaper.
https://www.washingtonpost.com/graphics/national/drone-crashes/database/
They still have pilots sitting in a sort of cockpit , just not on the plane, they aren’t ‘unmanned’
Thanks, though I’d rather not waste any time on dodgy sources such as Washington Post or The Guardian. The data from this article comes from dronewars.net, an NGO dedicated to opposing the militarization of drones. I do not trust NGOs as the money behind them is usually hidden and it’s usually a nefarious individual posing behind a good cause. In this case it seems to be above board and critical to examine though I don’t know who they are. This is their report:
https://dronewars.net/wp-content/uploads/2019/06/DW-Accidents-WEB.pdf
It’s obviously going to be somewhat negative but it’s well referenced and honest as can be. I’m ok with it.
Just looking at the data most of the crashed Group 3 drones (those above 600kg) are from the General Atomics Predator/Reaper series. About 62% are drones failing in mid flight, propellors falling of or tails breaking. Another 20% happens in landing and is mostly such things as collapsing landing gear. My conclusion is General Atomics is terrible at designing aircraft probably because the reactor core people are inexperienced in the area or they are not building to manned aircraft standards. The control systems need to be at least triplicated (preferably quadruplicated) and within each of those triplicated systems the processors must be duplicated. The approach Embraer took with the E195-E2. Sensors must be triplicated or quadruplicated. Hydraulics and actuators duplicated at least. The lowest model of high availability automation is the duty/standby system where one system is in control and the other in standby with either a human or a 3rd system monitoring. The transition takes time, often is not smooth or doesn’t happen. The Global Hawke is much better but there has been two incidents. The possibility of combat damage also needs to be looked at.
Reliable cooperation with regular air traffic”
That was one of the “project lethal” noncomformances with the Euro Hawk procurement AFAIK ( and a manufacturer who couldn’t be bothered with providing documentation. bit like Boeing 🙂
Just wanted to add a note: examining one of the Reaper crashes. The single engine driven generator failed. The systems were then dependant on the battery (28VDC I assume). The crew switched of all unneeded electrical loads. Battery voltage dropped to 24VDC anyway. The drone was turned out to sea and deliberately crashed. This drone, second generation, should not be allowed to fly in controlled airspace. There was no backup power supply for an aircraft completely dependant on electrical power such as a second generator, a massively oversized battery, a RAT or a thermal battery. That lack of redundancy lets you know all there is to know about this aircraft.
I, for one, never want to get on a “drone” airplane (I get the heebeejeebies at airports with self-driving shuttle trains!). But, I’m also uncomfortable with fly by wire. But I also like vinyl records. The contemporary pilot is the Manager of an Information System. As we have seen the system can make much quicker and more accurate judgements — if the inputs are reliable. And if the inputs aren’t reliable, at 30,000 feet and 570 mph, then all is lost because there is no input from the pilot’s sensorium upon which they can rely. But theoretically, shouldn’t all fly by wire system be able to be controlled remotely? And I imagine such remote control, and the fact that on most flights nothing goes wrong. But in the small percentage of fights where something does go wrong, imagine a highly trained test pilot in concert with a powerful computer doing the 3 second problem solving in an isolated room, far, far away. It seems like it could be a much safer system, though less romantic; less fun. And I like the fun. I like Boeing and the hard core connected yokes, and the tactile connection to control surfaces. And I like windup watches and vinyl records.
@William
James T Reason has for many years studied and written about Human Factors, and he found that even when you have several layers of protection, each layer may have a ‘loophole’, and in certain scenarions ALL protection layers failed; as was the case in the Lion Air accident (such as MCAS design, maintenance, previous flight crew reporting, pilots’ capability….). Search Wikipedia for ‘Swiss Cheese Model’ , and you see what I mean.
Perhaps we need to add even more layers of ‘Swiss cheese’ and try to find, and seal, existing ‘loopholes’. I wonder if airliner pilots will have less and less ‘hands-on experience’; and if so we need to make the control systems so the airliner is on autopilot all the way. Today some pilots execute gear-up and autopilot on, in ‘the same go’ – and opposite when landing – so we are close to achieve this
Here is some interesting readings:
https://www.eurocontrol.int/eec/gallery/content/public/document/eec/report/2006/017_Swiss_Cheese_Model.pdf
Its been well documented and AF447 is the worst example.
but they also did not shift to the immediate response they should have.
Its being worked on.
One area is the KEY alert. All the rest is spun off that, so those should be snubbed and only the one at issue displayed.
But in the case of MCAS 1.0, you also have to know what it means.
Many airlines insist on that SOP for their pilots, like you said -once the gear is up and the other side, only turn off autopilot/automation once they are at decision height during landing.
https://en.wikipedia.org/wiki/Air_Canada_Flight_624
They are working on it changing but its not across the board nor really successfully implemented yet.
Clearly with low hour FO per Lion and Ethiopian you don’t even have half way decent CRM.
Pilots should be trained to save aircraft when things go wrong.
MCAS is an extreme case of programed to go wrong but it was still possible to save if you fly the plane the way a pilot is supposed to be taught.
And clearly from AF4476, so complacent they forgot all their basics and that is an area that needs constant emphasis.
I think the main issue here is the complete failure – at outrageous level- of own simulation tools and simulation procedures at Boeing.
Why you temporarily stop production of Boeing 737-Max? There is always a solution for every problem on hand. Please check the steep turn condition! That could be a solution for this problem. Glad to hear that you have completed 814 test flights for Boeing 737-MAX with updated software. It is an excellent progress. But did you test 737-MAX for the extreme circumstances like steep turns and speed so low approaching stall? Because ET-302 Captain Yared Getachew had informed the air controllers in Addis Ababa Bole international airport that he faced a flight control problem and requested a clearance to get back to the airport. Since the plane was under takeoff procedure, this shows that the plane was making a steep turn to get back to the airport, and hence MCAS was activated. Please test the steep turn condition to be 100% confident on MCAS system.
On Seattle Times newspaper dated November 15, 2018 I read “Bjorn Fehrm, a former jet-fighter pilot and an aeronautical engineer who is now an analyst with Leeham.net, said the technical description of the New 737-MAX flight control system – called MCAS (Maneuvering Characteristics Augmentation System) – that Boeing released to airlines last weekend makes clear that it is designed to kick in only in extreme situations, when the plane is doing steep turns that put high stress on the airframe or when it’s flying at speeds so low it’s about to stall. ” It is because of the above statement that I raised my point.
Ethiopian Aircraft Accident Investigation Bureau preliminary report indicates that ET-302 was in an airworthy condition and the crew possessed the required qualifications to fly the plane. The takeoff procedures were normal, including both values of the AOA sensors. However, shortly after takeoff, the similarities between two crashes in Ethiopia and Indonesia became clear. AOA sensors started to disagree – the left sensor reached 74.5 degrees, while the right sensor indicated 15.3 degrees. This shows that Captain Yared Getachew was making left steep turning back to Bole International airport to get a fix for the flight control problem he reported to air controllers shortly after takeoff and due to this steep left turning the left AOA reached 74.5 degrees and hence MCAS was activated. ET-302 plane was traveling to Nairobi which is located South of Addis Ababa, but the plane had crashed in the North – East direction relative to its original path of travel. This shows that the plane was making a steep left turn to get back to Addis Ababa, Bole International Airport.
Similarly, Indonesian Lion air final report indicated that the Digital Flight Data Recorder of flight JT610 showcased a difference of 21 degrees between the left and right Angel of Attack sensors. This shows that the captain was making a left/right steep turning back to the airport to get a fix for the flight control problem he reported to air controllers, shortly after takeoff, and due to this steep left/right turning the difference between left and right AOA sensors reading reached 21 degrees and hence MCAS was activated. On the preliminary accident investigation report of JT610 it is clearly indicated that, about a minute after taking off, the pilots reported to the terminal East traffic controller, asking for permission to some holding point, as they were having flight control problems.
Hence, before stopping the production of these planes, Boeing has to perform the steep turning condition on 737-MAX planes, and address this problem with a scientific approach. Stopping the production is a pessimistic way for solving this problem. Boeing is a big company armed with the required knowledge, skill, manpower, equipment and finance, and hence can solve this problem and make unforgettable history. GO BOEING!
Wait till the ET302 report and analysis comes out, it just muddies the water when we are concentrating on the first crash JT610 as this goes to the heart of the Max issues
Who says Boeing is not testing them in steep turns?T.
Actually they have to do it in steep turns and into stall.
In fact they have been testing quite a lot, check BOE1 B37M flights, linked flight was on 7th November, but there’s more flights where the regimes of interest appear to be tested. The regular NG appears too more recently, maybe for comparison purposes.
If a MAX stabiliser jams at the full nose down position, is it doomed?If so, would it be any different to any other airliner?
If the stabilizer reaches a full nose down deflection (zero units) and cannot be moved, the elevator forces on the control column would be extreme, and probably not have enough authority to recover or handle sufficiently for controlled landing.
This would be true for most all-moving stabilizer aircraft (variable incidence tail-plane). There might be some exceptions based on the particular elevator vs stabilizer area and deflections in the design.
Pilots are trained to respond to runaway trim quickly to arrest the travel as soon as possible, in case it jams and cannot be brought back.
Fortunately most stabilizer jams are not at the full deflections positions.
Thanks. This has got me reading about the Alaska DC9 crash. Particularly interesting is the tale of aircraft mechanic John Liotin,Boeing are going to get away with this.
This is a great example for bad maintenance in 3rd world countries. FAA had no clue already.
Why would regulations allow a crash?
Leon, I don’t think the regulations “allow’ a crash, but jamming of any control surface has the potential to be a non-recoverable event. So the regulations try to ensure that common or foreseeable causes for it are avoided.
On Peter’s site, he has photocopied pages from articles written in the 60’s, where pilots described the all-moving stabilizer as having a potential “monster” on your tail, due to the large control forces it could exert. So there has always been recognition of this. They also discuss the roller-coaster or yo-yo method that might be required to unload the stabilizer or elevator.
There have been cases where the stabilizer has been used as substitute elevator, when the elevator was jammed or broken. In those cases it was a benefit.
I think the regulations try to balance the benefits of technology against the potential failings. In the case of MCAS, the potential failings were never properly identified.
Reading this I get a bit pussled , it doesent seems like Boeing is near a working solution.
https://www.bloomberg.com/news/articles/2019-11-08/delays-in-boeing-max-return-began-with-near-crash-in-simulator
JMA, those tests occurred in June. They were an attempt to force an MCAS-like malfunction in the flight computer, by flipping bits (intentionally introducing undetectable errors), as well as intentionally introducing a delay in pilot response time, to see if the pilots could recover. They mostly did, but not by an acceptable safety margin, and at least one of them crashed.
Based on this more stringent test, Boeing is changing the architecture of the two flight computers, from master-standby to dual-master. Each master will monitor the other and in that way can detect bit-flip errors, alerting the pilot to a problem immediately rather than waiting for the pilot to react to aircraft behavior.
This is a major change and has taken some time. It required a large number of test flight hours. It’s separate from the MCAS software problem they had already resolved, but Boeing has used the extra time to further test that as well, and also taken further input from stakeholders on that issue. Boeing feels it is nearing completion but we have to wait to see what the regulators say.
It’s part of the major scrutiny the MAX is receiving by all parties. Regulators, safety boards, airlines, pilot associations, all have a vested interest in seeing the MAX is truly safe. So overall it’s a good thing, and hopefully will drive home the point that everyone is watching.
Well, I don’t know if I agree. I think there are many things they highlight in this article about taking a 50 year old design and trying to use computer based automation on it.
JMA, the article is pretty accurate in characterizing the scope of the flight computer change. It’s also been reported elsewhere, as early as August, for example in the Seattle Times.
All modern versions of the 737 have used computer automation, in the form of dual flight computers. The change here is that they will be both be active simultaneously so as to monitor each other for potential errors. That is a non-trivial change but it has been done before. It greatly increased the amount of flight testing that is needed, which we have seen in Boeing completing nearly 1000 hours, and added a several month delay.
There has been tension because the tested scenarios were viewed as extremely unlikely by Boeing (focusing 5 simultaneous bit flips in the stabilizer circuits), and also the documentation requirements have been heightened. Pilot response times also have been lengthened, as a result of the accident investigations. This reflects the current power dynamic. The FAA wants to be a stronger regulator and Boeing needs to be open to broader regulation. So that is what you see happening.
The key question now is how soon it will be reviewed and accepted by the regulators. Boeing is anxious for this to happen but the regulators have said there is no deadline. However they have also said they are moving along and they expect certification to occur at some point. I guess time will tell, we just have to let them do their work.
While I have no issue with the computer cross check, it seems a theoretical reason to drive it there. Unlike AOA which has a significant track record of real world failures I don’t know of an instance where a computer went out due to the flipped bits.
Agreed the FAA is on track for stronger.
Boeing I think is giving it lip service as wanting to be open to it is laughable.
You will note that Mulenberg said he wanted to leave the inspectors program in place reporting to Boeing not the FAA.
Its now in Boeing DNA to push the edges to see what they can get away with.
I saw the same thing at work. It was so toxic that people would scurry around when caught sloughing off, then as soon as the manger was out of site the cell phones came out and the Tic Tac began.
That only changes when the manager is as accountable as the workers and its a fair process.
I just see Boeing complying because its under the spot light.
Cockroaches in upper management will come out as soon as the light shifts.
TW,
In other, much earlier posts, you had an opinion about the actual work load of programming the computer cross check and the capacity of the computers doing that type of work. Do you still feel the same way about it?
RealSteve, the initial reports of the reasons for the reprogramming, as reported in June, were performance related. The computers were reported to be too slow for the conditions imposed on them.
That was subsequently reported to be incorrect, in a Seattle Times report from August. The true reasons were the bit-flip errors (cosmic ray testing) that showed the pilots might not recover with sufficient margin, from an artificially introduced error in the flight computer.
Rob,
didn’t EASA found that it was too slow to engage and disengage autopilot. I guess this was tried on different events and had nothing to do with bit testing.
Leon, the autopilot concern appears to be based on the same reporting of slow computer performance. It was raised in the July time frame but I can find no reference to it since then.
The argument was that the column electric trim switches were slow to respond while autopilot was engaged, so the pilot’s trim commands were not immediate.
It’s hard to know exactly what goes on because the reporting is so sparse. The EASA has set conditions on return to service on several occasions, but then has backed off on some of them, coming into closer agreement with the FAA over time.
One that has been interesting is the demand for no delegation. EASA implied in September that its relationship with FAA would be damaged if the ODA program continued in the present form. That appears to have softened since, but we haven’t seen the FAA’s proposed changes, so I’m sure EASA will have a role in that. I suspect a lot of negotiations are going on in the background.
The EASA has also said they are willing to do somehting new, which is transitional approval with the understanding that further improvements will be made to the MAX. I think that may signal that EASA has a wish list to make it safer, that don’t necessarily pertain to the two crashes.
Just to add. The rumor about a slow trim response because of a too busy FCC was totally wrong, not the least because the manual trim doesn’t involve the FCC. It goes direct to the trim motor via relays. So the media reports had it 100% wrong this time. It was artificially introduced faulty bits in the FCC which caused the problem, a simulation of cosmic radiation messing up the hardware of the FCC (a very remote case was tested).
Although I had PPL, I’m not really familiar with MAX controls. Is the trim indicator on MAX the same as NG? Then, looking at that would be sufficient to see it’s not trimmed properly.
On the other hand, the MCAS motor speed and manual trim speeds might be different too. Looking at the placement of the trim indicator and trim wheels, you have to take your sight off from horizon and look down to see what it is. I think in general the modern cockpit needs a thorough overhaul, to provide the vital information on a HUD and the rest on MFDs/gauges. There is too much clutter in B737 cockpit.
Hi Bjorn
How to explain the erratic reaction time of the captain (JT610)? The second commitment of the MCAS is countered in two seconds. The third action of the MCAS is stopped after 6 seconds; the fourth after 7 seconds, etc … why would he wait 7 seconds before acting on his trim?
On Flight 302, after the second activation of the MCAS, the Captain asks the first officer to act with him on the trim … Strange asks if his trim works normally …
@Francois,
I read the DFDR as follows: The stick-shaker ‘took off’ at rotation, and speed and altitude readings for the two pilots show different values, – alarms were given. My observation (1): the pilots did not know (from memory) the correlation between stick-shaker (most likely AOA failures) and speed and altutde readings. They did not (2) manage to read the third group of instruments, – to see that the FO had the correct values. They seem to get occupied with this not so serious situation (tunnel vision).
The flight established CLIMB (3), and after some time the flaps were retracted. Then, at flaps in, MCAS kicked in, and reduced climb / leveled flight. The captain counteracted by ANU command. This went on for a good while. Most of these (13-15) ‘serve changes’, kept the flight between level and climb. So, on this background it was not strange that the pilots thought it had to do with the Speed Trim System (STS) – this is STS territory – and MCAS was not known.
(4) Still occupied with the speed/altitude readings the captain handed controls to the FO, and the captain got occupied with the QRM. The FO,who did not find anything in the QRM about the speed/altitude, subsequently failed to counter the MCAS AND commands.
And we got another sad, and in many ways unnecessary, accident.
(5) Observation: the pilots had minutes to identify the problem and take proper action, – so they had more than the ‘much talked about’ 3-4 seconds reaction time.
In addition, the captain did not declare a pan-pan or mayday to indicate he thought the aircraft was in an emergency situation. He requested a holding pattern to determine if the problem warranted a return to the airport.
Also this is speculation, but the captain mentioned having the flu. So pitch instability could easily lead to further distraction if you had a stomach or intestinal problem. People tolerate rolling motions fairly well but not pitching motions.
The 4 second reaction time was Boeing’s expectation that a pilot would trim against a trim malfunction. The data show the actual time was more like 10 seconds before the first trim commands were issued. But they were still issued in plenty of time by the captain.
The captain did not share his understanding of the circumstances or his intent verbally with the first officer. Bjorn said he would address the first officer’s actions next, it was in that phase of the flight that control was lost.
@sveinSAN, @ROB,
Thank you for your answers.
I have linked below, the period of the statement DFDR that I evoke. I added the time of each activation of the MCAS. The red vertical line represents the moment when the captain transfers orders to the pilot officer. Sorry, some additions are in French (my language).
I observe that the captain against each MCAS activation with his trim. What I do not explain is why will he wait up to 7 seconds to tell the MCAS while previously he cons in 1, 2 or 3 seconds?
Bjorn says manual trimming (yoke) does not go through the FCC. OK, but the MCAS goes through the FCC and there is only one trim motor.
I wonder about the actual availability of trim when activating the MCAS. I guess manual trim is a priority, but I can not believe it when I see the captain “wait” 7 seconds to activate his trim while fighting for a while against the MCAS DNAs.
I hope you understand what I mean.
https://enperspective.pagesperso-orange.fr/jt610.jpg
I don’t know that we can explain exactly what the captain was doing, or the times he chose to activate electric trim. I’m sure he was trying to reason through the problem, without having knowledge of MCAS, among other tasks ongoing simultaneously.
If you are suggesting that he did attempt electric trim sooner but the system had a delay in responding, I don’t know how we could measure that from the information we have. It would depend on what action is recorded by the FDR.
I would say that for the captain to be responding within 10 seconds would be a reasonable expectation, given the circumstances and workload.
I agree with Rob, we shouldn’t focus to much on second by second activities; – the pilots were occupied. Tomorrow Bjoern comes with part 4, and it start at the point when the FO took the controls (until this point the aircraft’s pitch was ‘okay’),
In the meantime I recommend Peter Lemme’s site – http://www.satcom.guru
Peter has many interesting articles on the subject – here he looked at the preliminary report:
https://www.satcom.guru/2018/11/first-look-at-jt610-flight-data.html
@Rob & sveinSAN
Thank you for your answers.
Yes, that’s what I suggest.
Ten seconds seems to be a reasonable time, it is also the time that will put the captain to react to the first occurrence. But I can hardly believe that after more than 15 occurrences, he waits 6 and 7 seconds before acting while trim is his only real possible action (except cut stab trim).
With each activation of the MCAS, the force necessary to maintain the attitude increases a lot. The use of trim is the only way to relieve him and he would wait 7 seconds after 4 minutes of combat?
Flight JT043 exhibits the same symptoms of erratic reaction time.
On the flight ET302, the second activation of the MCAS, the captain asks the pilot officer to trim with him. But orders do not add up.
It is true, however, that the workload is high.
Yes, Peter Lemme is one of the references on these accidents.
I think I have read all his articles on this subject. Those of Bjorn too.
TW, a return of the ODA designees reporting directly to the FAA, is not viewed as a viable solution, either by Boeing or the FAA. The FAA doesn’t have the resources to assure compliance without help from the industry. It has defended the ODA program and its overall performance.
Here is an article from a certification consulting firm that covers the history of the designee program, dating back almost 80 years. It’s interesting to note the staffing level of the FAA vs Boeing.
https://jdasolutions.aero/blog/what-faa-delegation-does-how-and-why/
MCAS was obviously an exception and the problems that permitted it to slip through need to be corrected. There will be some changes to the oversight process and escalation of potential safety issues. The FAA has not yet released it’s plans for that, but I think a lot of people will be watching carefully. Probably a review of FAA staffing levels as well, to be more realistic. That will have to be funded by the politicians.
Atlantic article:
https://leehamnews.com/2019/11/15/bjorns-corner-analysing-the-lion-air-jt610-crash-part-3/#comments
Atlantic article on Boeing:
https://www.theatlantic.com/ideas/archive/2019/11/how-boeing-lost-its-bearings/602188/
@RealSteve,
Steve, not new information, but interesting article. I wrote once something similar in the LHN commentariat, but my story started with Jack welch – the root cause. The management was singing like ABBA: Money-Money (comes first)
And the article agree with me, in that the way that the MCAS was implemented doesn’t have anything to do with time or money; it is/was all about lack of engineering influence, – ‘finance’ runs the business.
Let’s hope things change for the better