Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 5.

November 29, 2019, ©. Leeham News: We continue the series about the Lion Air JT610 crash by now analyzing the final part of the flight.

We try to understand what changed when the First Officer took over the flying from the Captain and why the aircraft subsequently crashed.

The final part of flight JT610

We analyzed the initial part of Flight JT610 over the last weeks, based on the extensive data and information available in the final crash report issued by the Indonesian National Transport Safety Committee.

Now we look at what happened when the Captain asked the First Officer (FO) to take over the flying.

First, why did the Captain hand a difficult to fly aircraft to the FO?

The report describes the events and communication in the cockpit during the crisis. At all times up to handing over to the FO, the Captain was confronted with new weird alarms, indications, and behaviors in the cockpit. For example; at a PFD speed of 306kts the audio warning “ AIR SPEED LOW-AIR SPEED LOW” went off. This is the warning you get before you get stall warning, next thing is stall warning and stall. Stall warning was on but no stall indications like shaking aircraft came.

When he got this warning his own stall speed tape on the PFD (the so-called “totem pole”) met the high-speed warning tape, something you see only at very high altitude (they were at 5,000ft). Overall, it was a constant blaring of warnings and strange indications. The only warning which might have explained the mess had gone missing for Boeing in the migration from NG to MAX, AOA DISAGREE.

Then as the flaps were retracted at 5,000ft it got even worse. On top of all the warnings, disagreements and wild speed tapes, the flight controls went weird.  MCAS started its nosing down and the crew had no information whatsoever something had changed for the MAX. It was the same old 737 and both had more than 5,000 hours on it. They could rightfully think they should know all about it.

From the conversation from the Captain (who was the Pilot Flying (PF)) to the FO (who was the Pilot Monitoring, PM) it was clear he was totally busy countering the attacks of MCAS amid trying to understand what was happening. The aircraft got weirder and weirder.

The First Officer, who was the Pilot Monitoring and by it the one who should work on the fault-finding with the help of the Emergency checklists, made little progress in completing the checklists for the warnings and fault indications the crew had.

Apparently, to shift tasks the Captain asked the FO to take the controls. He didn’t give instructions on how to handle the repeated nose downs from the aircraft, however. This seems strange. There are several possibilities why this didn’t take place (the previous flight Captain didn’t either, see below).

It’s possible the Captain countered MCAS rather instinctively. It’s an automatic reaction for a pilot to neutralize an aircraft nose down with an opposing stick force followed by an instinctive manual trim. This is also what Boeing’s safety analysis concluded. Trim cutout was available in addition but was not a factor in the analysis.

The nose-down was only one weird action of the aircraft among many. We know today it was the key one for aircraft safety. But we have got a full explanation of MCAS and how it works. How should they know? The multitude of faults didn’t make sense as there was no AoA warning. The Captain certainly didn’t understand what was wrong with the aircraft at this point.

The trim worked fine

When one goes through all that happened before he handed over to the FO it’s easy to see why he could not single out erroneous trimming as the key problem. What happened was not a trim runaway situation. The trim worked fine.

Trim Runaway is trained in almost every simulator session for 737 pilots and it means the trim runs uninterrupted in one direction and can’t be stopped with manual trimming. MCAS did not run uninterrupted, the Captain could trim against, then everything was normal. Then the nose got heavy again and it was time to hold against and to counter with trim. Then everything was normal again, …..

To assume pilots would identify this as trim runaway was a clear fault by Boeing and FAA. The Captain who lived to say what he thought it was, said it was “Speed Trim confused by the faults in airspeed information”. This is the logical conclusion when one has no knowledge of MCAS existence.

Re. the Captain’s handover to the FO. The previous flight Captain asked the FO to take over so he could analyze what was wrong. He gave no special instructions for this handover. The FO ran into the same problem as the FO of JT610, he trimmed too short against and got a stick “he could almost not hold”. The Captain then experimented with the trim cutout switches. It stopped the nose down movements.

The Captain of the accident flight never got this far. The FO trimmed against too short a time and the horizontal stabilator gradually outcompeted the elevator. For the pilots, it felt like the flight control system was now forcing the aircraft to dive. Both pulled on the yokes at full might during the final seconds as the aircraft headed down. Why didn’t they trim? It was a matter of seconds and then you just pull. Trimming comes after pulling.

One can conclude a few things from the above:

  • The JT610 never got the stable flight condition to work out what was wrong with the warnings and airspeeds/altitude indications of the aircraft. There were all sorts of warnings but the one indication which could have helped them was not shown: AOA DISAGREE. This was the same aircraft as the 737NG and it should have shown if there was an AoA problem. As it was not shown it was therefore not an AoA problem.
  • The flight control system was behaving strangely but there was nothing that singled out it came from a trim problem (except spinning trim wheels, but how much of this was seen in the indication chaos which reigned). Should then the Captain stop the trim system, his only means of keeping the aircraft afloat from a weird flight control system? It worked fine when he needed it. What if he stopped the system with “Trim Cutout” and the aircraft nosed down with full force again? Could he hold it? Manual trim is too slow to counter something like the nose downs he experienced. The JT043 had a Captain who had come further. He could see it was a one-sided Stall warning/Speed/Altitude fault and he experimented with Trim Cutout and found it helped. But he wasn’t convinced until he had engaged it again then finally stopped it for good. The JT610 Captain never came this far before the aircraft nosed down fatally.
  • Was there a difference in the FO’s capability between the two flights. Not really when reading the reports (the preliminary report is more detailed re. the previous flight). Both FOs ended up trimming too short to counter MCAS and both were quickly sitting with huge stick forces and an aircraft which started to dive. JT043 had a Captain with a free head for longer and a third pilot which he worked with to understand what was wrong. They managed to save the aircraft, yet it was not clear cut. They only hunched “Trim Cutout” could help, so they tried it. They didn’t fully understand why it helped as it wasn’t reported as a remedy to the problem after the flight.

For after the fact pilots to come and say it was obvious what was to do is only showing they haven’t immersed themselves in the no show of the only sensible warning available and the total cascade of non-sensible warnings. In addition, they have a problem imagining how to understand something which they don’t have any information about and the efficient masking of this unknown by its donor process, Speed Trim.

It was far from clear what to do and many flight crews would have ended up where JT610 did in my opinion. In the next Corner, we shall discuss why the fixed 737 MAX is a very different story from the above.

87 Comments on “Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 5.

  1. And Boeing, pointing to JT043 that pilots could manage the failure, blamed the pilots, when Boeing knew much more, and still Boeing could only come up with their stupid Buletin, slaughtering more lives.

    And this is not only the MAX, it’s everything Boeing.

    And EASA compromise with FAA to stop delegation to uncover more mistakes. I can understand that, but it’s not what EASA would do if they would certify alone and would ask for more pilot training.

    • Bjorn:

      While AOA affects the speed output on the PFDs, does it affect the backup display?

      I have looked at the difference between the two PFDs and while off it was not like it was 20 knots off (more like 8 as I recall)

      With a cross check, close enough for now to deal with the issue would seem to be the right pilot response.

      • The backup is not corrected with the same AoA unit so it would have been closer to the right side PFD and then you could single out the left as incorrect. But the fault is not large and you need to be precise and have a calm situation to see the faults as they all show different values in this situation by design (the middle being a separate system with another correction method), just the left would have differed more than the other two. Transport pilots are trained to always follow procedures and checklists. Therefore, as the indications were IAS DISAGREE/ALT DISAGREE and the checklist said read and compare the values when at stable flight, altitude and speed. This never happened, the aircraft was constantly in transition in the few minutes they had while leveling out at 5,000ft to resolve what was wrong. ATC asked them to turn, time after another and MCAS started its roller coaster attacks. It’s all at the beginning of the report.

        • Bjorn:

          Thank you, I think you gave me the insight I needed there. All my checklists were mental and simple.

          I am wondering if they should not shift back to fly the plane first and checklist latter? Follow the procedure but loos the plane as it were.

          This may sound like a ramble but I think it says it well.

          I saw Fire Department adhere to their checklist one time and while I sort of got it as maybe in general, the inability to shift gears to the actual situation was startling.

          Neighbors single floor house was set on fire (kids and matches) and was confined to a bedroom. The kids had closed the door so it was confined, though it had blown out the window and the soffit was afire and roof was catching on fire by the time I got over there (no I was not going into the house, all people accounted for). I had it beaten back into the bedroom with their garden but not making any more progress (not enough water) but holding it there.

          FD rolls up, I go out front, hey guys, all people are accoutred for and out, bring the hose around back and you can kill this thing.

          No sonny, we do it our way. Ok.

          So I go out back again, beat it back from the soffit and roof again and holding it in the bedroom and 8 minutes latter there is a huge woosh of steam.

          Their MO was go to through the front door and the house, mine was to deal with it as was.

          If I had not done my part the whole house was a gonner, the roof would have been fully on fire.

          FD will go into a structures on fire and clear it when they know that most deaths are Firemen going into structures.

          We lost an AWACs up here, and one guy said even if they knew the geese were in the way at that time they would have flown anyway as that was the drill.

          I think in the modern day of aircraft maybe its time to look at it differently.

        • In the Preliminary report on the Lion Air Accident, the FO asked Air Traffic Control to verify their Altitude and Airspeed. Doesn’t ATC just have a data block from the transponder of the aircraft? The Radar doesn’t compute the speed and altitude from the raw radar data. When you shut the transponder of an aircraft off, then the data block on the ATC radar scope goes off (obviously Military radar is different). So, ATC would be showing either the Left (bad) or Right (good) airspeed and altitude? So, Wouldn’t that just confuse the pilots with added data that they already know, or does the transponder have a separate data input system?

          • Correct. ATC only has transponder data from AC, same data the PFD shows. And the pilots should have known that.

            That was brought up in another forum when the report was first released.

  2. For such a powerful flight control, MCAS action on stabiliser trim, one would expect an analysis of the many ways it could fail. There must be such a document, reviewed and signed of by several people, filed somewhere. In that document there would be several sections, say a section for pitot static tube failure and another for alpha sensor failure. Then there would need to be another document analysing the whole aircraft effects if that instruments failed. The pilots of both Lion Air 302 and Ethiopian 610 faced an overwhelming cacophony of alarms and aircaft malfunctions similar to the three mile island nuclear power plant. The root cause of the accident may be that Boeing was granted an exemption from FAR 25.1322 which requires alarms to be managed so as to not overwhelm the pilots. An exemption is appropriate for say an engine change but should not cover introduction of a powerful system like MCAS. Had FAR 25.1322 still been in place the analysis required for compliance certification would have revealed the flawed reasoning in MCAS.

    • It’s exactly the blame you have to give to Boeing, safety cat for MCAS is definitely hazardous, and extensive assessment is needed.

      They should have done a full analysis of MCAS instead of trusting the pilots will intuitively fix a MCAS problem. It’s a philosophy question.

    • William, The Speed Trim system has been using One AOA sensor for years. I think someone may have thought that since the STS was approved, and MCAS was following in STS’s footsteps, no additional analysis was needed. They had a mature, safe system that had been approved and worked for years. They were just going to rip out the safety cutout column switches, and turn it on for 10 seconds and with the high speed trim setting. Just to make sure it wasn’t turned off, they rewired the aisle stab cutout switch to the motor. Some folks really failed in their safety analysis. I blame not enough minds having the system described to them and looked at. The old auditorium design review meetings of the Boeing previously are gone. Where you had to show and tell your system and the changes to a large audience. Yet another reason for Boeing to show more people their MCAS design details, and not keep it secret.

  3. To be clear, I don’t blame the pilots, but in all but one case of MCAS runaway, pilots did not get to the core of the issue which clearly was a stab control problem for whatever reasons. I

    If your auto pilot goes nuts you turn the auto pilot off (and that has been noted by a couple other pilots)

    Actually there was a point of stability and that was when they put the flaps back down.

    Instrumentation cross check would show two of the three in agreement (backup and the FO side)

    I will continue to disagree the AOA disagree or even display would have done anything to alert them with that situation. With all that was going on, two more miner elements squawking?

    You also have a stab readout per position, that was missed though clearly it was a stab control problem of some kind.

    Get it close to neutral and kill it.

    Growing up pilots saved the aircraft when things went wrong, they didn’t just live on it being right.

    • In fact you blame the pilots.

      Which is unfair, as you work it out on a well different basis.
      You have the knowledge it’s a trim issue, has been argued up and down the line.
      The question is if you would have been in that plane instead, would you have acted differently?
      As far as I can judge the situation, that plane was doomed when it left the ground. It would have needed an exceptional crew on an outstanding day to get out of the situation they faced.
      The way better prepared Ethiopian crew couldn’t hold it.
      Many things to blame, Boeing for their design and safety assessment, the maintenance of Lion Air and the documentation, the ill calibrated “refurbished sensor” from Florida, Boeings’ communication policy, etc.

      Hard to blame the crew, they were under pressure in an unknown situation they were not trained for, they never did understand what was happening, they were bombed with alarms, and they didn’t have time.
      This is were humans make mistakes, and it’s very natural.
      I can not even say they made a mistake.

      In their position, how should they realize a trim issue? Out of all the warnings and alarms, where should they find time to cross-check?

      The main issue is, these pilots should have never, never ever been brought in a situation like this. This is where catastrophes happen.

      • @Sash,

        I agree in that we shouldn’t focus to much on blaming individuals, because such an approach would include others; – typically repair shops and maintenance, and perhaps management levels that failed to organize ‘the whole thing’.

        On the other hand the crew on the previous flight seemed to handle the troublesome left AOA, – they even ‘flew away’ to destination with the stick-shaker going and manually operating the Hstab (with an ‘expert (?)’ on the jump seat. So it was/is possible.

        But I am puzzled (repeat comment) about the fact that the pilots didn’t solve the different speed readings, I thought that the connection between speed/altitude readings and AOA was known as a memory item.

        Bjoern is occupied with the AOA disagree, – but when the stick-shaker ‘takes-off’ when the nose-wheel lifts off the ground – four seconds before the aircraft is airborne – a faulty AOA should be the main ‘suspect’.

        The different IAS readings reminds me about the old saying ‘if you have one watch, you have the correct time’ – see segal’s law)

        • SveinSAN,

          On the previous flight, there was one more pilot who was not busy with keeping the plane up, that can put all of his focus on the instruments (and that was all he could do, in his position) and try to deduce what might be going wrong.

          Neither Ethiopean nor JT610 crew did not have the luxury of sitting back and observing the deck. I do not think that any one of us, with their knowledge, experience and expectance level could have done any better.

          • @ Salih,

            I also mentioned in my comment that the the ‘prior to the accident’ flight had an extra person on the jump seat. Whether he was a very useful extra hand, or the ‘right person’ at the right time, we don’t know.

            CRM, and having pilots working together, is the key in situations like this; – that seemed to lack on the accident flight – where the captain handed the flying – which he managed okay – over to the FO without good instructions.

            Four flights where the CRM worked (perfect):
            – Qantas QF32, A330 – control went bananas
            – Qantas QF32, A380 – engine no. 02 exploded
            – Air Canada AC143, B767 – ran out of fuel, Gimli landing
            – US Airways 1549 , bird strike – landed in Hudson River
            The list could have been longer

            One flight where CRM failed (totally)
            – TransWorld 843 – 1992 – (faulty) AOA initiated Stick-Shaker at rotation. – aircraft crashed – total lack of CRM. Search up the accident on the World Library – the accident initiated an avalanche of discussions and recommendations. (I guess our Transworld would have successfully dealt with the faulty AOA).

            So it not about numbers, – it’ about quality.

    • It not clear it’s a stabilator trim problem. You have the autopilot pitch servo working on the elevator which could be the source of the problem. You need a stable situation and a free head to start eliminating different factors to reach a conclusion about what is wrong and take the right action. One thing is sure, it was not a trim runaway situation.

      • Bjorn:

        No disagreement that it was so far off a runaway trim that the pilots would not be expected to react to it as it were. Boeing has (had) that totally wrong.

        It does seem to me that the indicators were there that it was the stab with the counter trim and the indicator on the center stand shown what area the Stab was in.

        But I also take your assessment that dealing with the alarms and checklist was higher in the training that the basic assessment of what should be done first.

        Sash: I would appreciate it if you do not put words in my mouth.

        I have repeatedly said I am conflicted. Clearly pilots are part of this. Bjorn has clarified what is drilled into pilot in a LCA.

        I grew up with a more focus on dealing with the obvious issue and ignore irrelevant aspects.

        In light of what Bjorn presented, the Qantas A380 engine loss and the pilots makes more sense.

        they spent over 1.5 hours assessing and looking at emergency (and also tried to use the auto pilot to land it)

        My take is, we have no idea what the hell is going on out on the wing, screw the procedures and put it on the ground even if it overruns its better than having the wing fall off.

        But that goes against their training. Only the best pilots shift those gears and do a Sioux City or like Sullenberg, start the APU even though it was not on the checklist.

        As we can’t expect all pilots to be as good as the few, then its a matter of, are we doing the right training?

        I don’t think it helped at all to have a right seater with very little training and no CRM.

        • I think what saved JT403 was clearly the decision making process with a third pilot in the jump seat. I think what doomed AF447, for instance, was the absence of a cross checking deliberative process. Instead, one pilot, who was absolutely sure of his judgment, seized control. He was certain they were flying at an incredible speed. He even wanted to deploy (if I remember correctly) airbreaks. So there seems to be an inherent problem, in today’s aircraft, when any single pilot believes they have solved an emergent, complex, befuddling, unrecognized and most likely sensor or software related problem and then heroically assumes control of the aircraft in a crisis. In fact, if I see a major flaw with the behavior of the Capt. of ET302, it seems he might have lacked trust in his FO and that the FO might have been too deferential and inexperienced to work with the captain in solving an unsolvable problem. But it does seem to me that individual and cinematic heroics (no matter how well trained) before solving complex problems (when today’s technology fails) are an old fashioned recipe for abject failure and deadly disaster.

  4. Bjorn, I understand that you don’t want to join the chorus of people that blamed the pilots. The reaction to that has been extremely negative, including accusations of nationalism, superiority and racism. It’s tone-deaf given the loss of pilots and passengers, and de-emphasizes the role of Boeing and the FAA, when that is neither justified nor appropriate. I think all of us here would agree on those things.

    However just trying to understand the record of Lion Air 610, one thing that really stands out to me, is that the captain had developed an admirable level of situational awareness. As you have pointed out, he didn’t know about MCAS, the symptoms did not directly correspond to runaway trim, and the QRH could not help him, as it was missing critical information and procedures. So to him, this situation was completely new.

    Despite this, he had recognized that something was deflecting the stabilizer nose down, but that he could trim against it and maintain control. This was evident in his consistently trimming back to 5 or so stabilizer units, which was about the pre-MCAS value, and normal trim. Also evident in that he began to anticipate the MCAS cycles and interrupt them quickly. I think he deserves enormous credit for this. He was handed a mess and yet he dealt with it more or less correctly. That is exceptional piloting.

    It’s also clear that he identified the issue as a flight control problem, not as a flight emergency. He did not declare a pan-pan or mayday. I don’t think in his mind, at that time, he saw the aircraft as being at risk, since he had mastered the MCAS cycles. He requested a holding pattern to work the problem and see if the flight could continue, or needed to return. He was able to attain that pattern and hold it, so long as he was the PF.

    All of that changed when he handed control to the FO. He did not share his situational awareness with the FO, and we don’t know why. It’s possible he believed the FO would be observing him closely and had learned along with him. But in actuality, the FO was struggling with the QRH, not knowing the information he needed was not there, and probably not observing the captain control the aircraft.

    To me, an admitted armchair pilot, this is the point where things transitioned from a flight control problem into an emergency with the aircraft at risk. I have no doubt the FO did his best, but without the trim awareness or understanding of the captain, as you said he would have been overwhelmed by the elevator forces within a few MCAS cycles, and probably felt helpless.

    We don’t know the dynamics in the cockpit at that moment because so little was said. But I can imagine the FO not understanding why he couldn’t control the aircraft as the captain had, possibly believing he was seeing another new problem. And the captain, caught up as the FO was in the QRH, which he didn’t know could not help him, and not realizing the FO was very rapidly losing control.

    When the FO said he was descending rapidly, and the captain said it’s ok, again we don’t know why. Possibly the captain thought the FO was referring to an MCAS cycle, to which he believed they both knew the solution (trim against to about 5 units).

    So Bjorn, I think to not acknowledge the roles and contributions of these two men, both good and bad, does them and the world a disservice. There was heroic action but also mistakes. That is almost always true in a crisis.

    To say that the aircraft did not need to crash, and that the pilots played a role, is truthful. But we do not need to extend that to blaming them, or use it to absolve Boeing or the FAA, who clearly played an even larger role. The most important thing here is the truth, so that we can improve things for the future.

    I’d be interested in your thoughts on this, especially any corrections you’d like to make to my interpretation. And thank you again for providing your analysis and this forum, it has greatly helped all of us to understand these accidents.

    • Well put and well articulated questions.

      I think its obvious I struggle with this as at least my school was rigrous in flying the aircraft using the instruments, cross scan and ball park recovery and then fine tune it.

      • TW, I think that is one of the lessons learned from this.

        It’s been believed that automation would only enhance pilot responsiveness, but these accidents (and others) indicate that may not be true. Partly due to reliance on said automation, partly due to increasing complexity, and partly due to not as many hours actually flying the plane, or not flying it with skills alone.

        I’ve wondered if dead instruments would be something worth occasional practice, so that pilots would retain a feel for the aircraft. You wouldn’t expect perfection or even necessarily success under those conditions, but the value would be in the exercise itself.

        • This crash wasn’t because of dead instruments, it was multiple contradictory warnings, a missing warning light and and a ‘kranken- augmentation’ system….and that’s just the short list.
          I can’t see airlines allowing as a common procedure , pilots having a ‘manual’ flying session either on a simulator or heaven forbid with passengers. Do you ignore all the established checklists and memory items ? Is there any eststablished knowledge that it will improve safety if they fly like it’s 1959!

          • Duke, obviously the practice flights would be in a simulator or training flight, not an actual commercial flight. The benefit would be the elevation of judgement over technology, so that judgement can be developed.

            This idea may not be practical, but I think the concept of developing good judgement is valid.

          • Rob:

            I assume they do the same as we did in my flying, various system including dead instruments.

            But as noted, we have that automation and if they are trained to respond to checklist on alarms and miss the big picture of flying the aircraft then it can cascade.

            The US and Europe have taken a hard look at this and training is now being shifted to knowing the basics of the aircraft and having totally unexpected emergencies thrown at them (pitots freezing up at 30k) .

            Prior the emegenices were all known, after a few sim session they knew the drill and were no longer thinking, they were follown the drill patch that resolved it (and of course you get asses after so it got drilled into you what the right patch was).

            A lot of emphasis was on takeoff and landings. Almost anyone can take off an aircraft. Ladings you do each flight and some like SW many times a day.

            They looked at that and it was, hmmm, why are we training on routine and not where its needed? Its going to be clear at least once a day that they can land or not.

            Hopefully what will come out of this is we always need to review and update not fight the battles of the last war.

    • Thanks, Rob, I agree with you. What I would add, as you say we were not there. I have been in similar situations and I know how little is left of your capacity to analyze things when you run into abnormal behavior of an aircraft.

      The report zeros in on the FO being a less accomplished pilot with remarks in his checks of not always getting it right. But then we were not there and this is key. You need to immerse yourself and seek clues to how it was. To understand more of the situation I went and checked what was the analysis of what happened from the previous flight and the reaction of the FO when the Captain handed over.

      We get a good indication of how it felt; like if Speed Trim got disturbed and nosed down at the wrong moments. And the same handing over procedure and problem for the FO. Two out of two sharing the same behavior is the best indication we have of how it all was to handle.

      • Would the FO have noticed the Captain trimming with the manual electric trim on the yoke? His own yoke switch wouldn’t have been moving. With all of the other elements going on, he probably first noticed the additional trim needed after his first shot of MCAS. He didn’t know how powerful a response the Capt had been putting in. He had been trying to diagnose things, watching instruments, running checklists, not watching the Captain’s yoke button. That’ the insidious part of MCAS. It hides within the Speed trim movements. For all he knew, he was adjusting to speed trim, not MCAS. He probably never had to override the speed trim as much in all of his flying life. So, he put in less response’s to what he accepted as ‘speed trim’.

    • “I am also one of the few who have flown a Boeing 737 MAX Level D full motion simulator, replicating both accident flights multiple times. I know firsthand the challenges the pilots on the doomed accident flights faced, and how wrong it is to blame them for not being able to compensate for such a pernicious and deadly design.”

      http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/

      “did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS” again from Capt. “Sully” Sullenberger same link as above.

      “These two recent crashes happened in foreign countries, but if we do not address all the important issues and factors, they can and will happen here. To suggest otherwise is not only wrong, it’s hubris.”

      “I recently experienced all these warnings in a 737 MAX flight simulator during recreations of the accident flights. Even knowing what was going to happen, I could see how crews could have run out of time and altitude before they could have solved the problems.”

      http://www.sullysullenberger.com/my-testimony-today-before-the-house-subcommittee-on-aviation/

      Sully has demonstrated that he was able to think clearly under extreme stress, and he flew the replicated flights in the sim with the benefit of knowing a great deal about MCAS and what was about to happen. I don’t know of anyone else who has flown the sim replicating those flights that have a different opinion.

      • JakDak, it’s notable that Sully also said that he felt the experience level of the copilots was too low. The Lion Air 610 flight evidence is that there was a clear difference in skill level between captain and FO.

        Also in that flight, the captain had attained his target altitude and was holding it. He needed time to reach the conclusion that the stab trim cutout switch would stop MCAS. He didn’t get the benefit of the time and relative safety he had created.

        I think Sully was responding, as Bjorn and others have, to some of the people who have felt they (or Western pilots, or American pilots) would be superior in the same situation. He was making the case that the situation was not trivial, as some have made it out to be, and that it would be challenging for anyone. I’m sure that’s true.

        Also I think he was intentionally pushing back, and steering the discussion back onto the flight problems, and away from the pilots. It’s understandable that pilots would be outraged by being handed the blame for the malfunction of a system they didn’t know existed. If I had the platform that Sully did before Congress, I would have driven home that same point.

        • While I do not for a second believe that non western pilots are less able than Western pilots, I do believe there is some issues and as noted, if we don’t look at all of it then we have done disservice to the 347 who died as a direct result of the MCAS (a diver died as well trying to recover the FDR).

          So one is allowing a FO who has few hours let alone good US and Europe Sim training. That is an issue for Indonesia, Ethiopian and other regions.

          So yes the region and its training are an issue as well. Lion has an abysmal fling record.

          Ethiopian has a good record overall, but the modern crash in Egypt they had it was total denial the pilot got disoriented.

          As bad as the Boeing and FAA interaction was and what resulted in MCAS, we would not have an excuse as to the cause in the US or Europe.

          • ET302 pilots had the chance to train on a sim and I’m sure they did that. But the sim wasn’t right with turning the manual trim wheel. If they could have used the trim wheel they wouldn’t have tried electric trim.
            Boeing failed on the sim, failed on the trim wheel, failed on the Buletin.

          • As I recall, they went over it but did not train in the Simulator.

            Actually a real training would be impossible because it would not have been programed for it.

            As electric trim is quicker response there is nothing wrong with use of electric trim to counter and in fact is better (once neutral then you disconnect the stabilizer with the disable switches)

            One issue is that the Ethiopian pilots did not follow procedure and throttle down.

            Agreed Boeing failed every possible way.

            But facts should be kept correct.

          • Transworld,

            In an aircraft with engines slung under the wings, assuming you are flying straight, and level, without altering any other control surfaces, what happens when you reduce thrust ?

          • Nose drops.

            Acualyu per pure Wolfnag, power conrtreosl atitlue, clime or decent.

            Elevator controls attitude.

            Relativist its a mix.

            And yes I know what would happen if the Ethiopian pilots took throttle off but I also know the issue with over-speed.

            You would have to kept trimming until stable, then flip the switches for the stab.

          • Transworld,

            Yes nose drops, but MCAS is already pointing the nose at the ground, and a 737 is a slippery little plane, and gathers speed rapidly downhill.

            I guess my point is that yes, they should have watched their thrust but they were dealing with unreliable AOA, unreliable airspeed, stick shaker, don’t sink warnings, and MCAS at the same time, I’m not certain that reducing thrust would have helped.

            I wonder what Bob Hoover would have done, increase thrust to push the nose up?

            Would he have done a 1g barrel roll timed so that he was inverted as the next round of MCAS attacked?

            I realise how ludicrous the last two sentences are, those pilots should never have been put into those situations! We must learn from those crashes.

            The MAX is likely to still be flying in 20 or 30 years, it needs to be made safe whatever it takes, and however long it takes.

        • Rob, Those low time, foreign pilots seem to have mastered 737-NG’s and Airbus aircraft for quite a while now. 1000’s of those are flying every day with very few accidents. But, in less than a year, Two, new, 737-MAX’s crash, with less than a 1000 of them flying. We’d all like to have 40,000 hour pilots with 30,000 hours of experience in type flying our aircraft, but, that’s not possible. Better training is always worthwhile, but, I think the 737-MAX’s MCAS system relying on One AOA and all of it’s design, implementation and testing, along with hiding the system from the pilots, is much more of a cause than lack of pilot experience, in these Two accidents.

          • Richard, no disagreement that Boeing played the major role. Nothing the pilots did, did not do, or could have done, would have changed Boeing’s role, or their mistakes, or their responsibility for the accidents.

            That doesn’t mean we can’t learn anything from pilot actions. We know that some responded effectively and some did not. There are lessons to be learned from that, for future safety, if we are willing.

            We can also give them credit for the progress they made, against the serious adversity they faced.

            Accidents occur as a chain of events. We shouldn’t be unwilling to look at all the links.

        • Rob

          DGCA “may consider mandating a minimum number of flying hours for pilots of the 737 MAX”

          https://www.reuters.com/article/us-india-boeing-airplane-idUSKBN1Y70ZK

          Seems someone’s listening.

          Good to see they look like they won’t just rely on a number of flying hours. 2,500 hours on a C-172 is not as useful as 300 hours on a 737 perhaps ?

          “The regulator will also make it mandatory for Boeing to set up simulators in India and for airlines to carry out comprehensive pilot training before it allows the planes to start flying, the source added.”

    • Rob,

      No you were not there. So you don’t know. All assumption.

      As I said below, people have been on this web-site claiming that air speed disagree was the right answer and pilot’s with situational awareness would know that. So according to them both sets of pilots got it wrong.

      I think if by some miracle, the pilots of either crash had lived they would have said the flight deck was a casino with Mystic Meg the fortune teller dealing the crap.

      Aerospace engineering is a science not a game of chance.

  5. I admit, after reading the crash report, it came as a shock to me that electric trim was working and indeed electric trim could be used to interrupt the MCAS cycle.

    Why Boeing kept insisting that the runaway trim stabiliser procedure was the right procedure to use beggars belief. The Ethiopian Airlines crash pilots used the runaway procedure. In doing so they turned electric trim off. They turned it back on a again, but too late. In turning it back on, they got a bashing.

    It’s questionable as to whether the Lion Air crash pilots would have got the airplane on the deck. The Captain was giving all his attention to the trim wheel. This means the Captain believed the trim wheel. He could have changed his view. After all it was a crapshoot.

    Anyway the obscuration of Boeing beggars belief. After the Lion Air crash, Boeing could have developed a procedure that allowed pilots to quickly discard runaway trim stabiliser as the issue, reduce speed by reducing power and lower the flaps. No they continued to say runaway trim stabiliser. To my knowledge they are still saying it.

    I admit, I don’t believe a word Boeing say anymore

    • Philip:

      It is a bit heartening to see you actually reading the reports and beginning to get the issues.

      There is no question Boeing was in denial for pure reasons of corporate greed.

      Boeing and FAA did a half ass attempt at informing, and Ethiopian pilot did attempt to follow.

      Unfortunately he also lost situational awareness and speed got out of hand.

      Boeing is no longer saying runaway trim stabilizer, all the info shows they are responding to MCAS changes the way they should have originally (and then some, they are now cross linking computes for error check)

      I don’t know if they get the cutout switch back into the loop but authority is turned back down and multiple other protections added (and what the do with the column switch?)

      We still have the manual trim issues.

      And I don’t blame you in the least in not believing Boeing any more. I believe its lip service and they will try to resume their former ops

      That was pretty clear when Muilenburg said the FAA designated inspectors reporting to Boeing was not an issue.

      It is and it is clearly a form of a path for corruption at best and needs to be eliminated.

    • Philip

      “” The Ethiopian Airlines crash pilots used the runaway procedure. In doing so they turned electric trim off. They turned it back on a again, but too late. In turning it back on, they got a bashing. “”

      Turning elecric trim back on wasn’t the problem. They only needed to know that they directly needed to turn if off again. In the Buletin and AD was written that electric trim could be used till the trim was reversed completely, that was misleading. It should have been mentioned that MCAS kicks in after 5 sec again. And of course the fineprint. Pilots should have trained using electric trim against MCAS on a sim.

      • Leon,

        I know. I was just pointing out the pilots got a bashing.

        The point I was making is that Boeing should have developed a procedure for MCAS going south as opposed to simply saying use the runaway trim stabiliser procedure. The Ethiopian Airline crash pilots did correctly call left alpha vane. So they knew it was MCAS. They then did what Boeing told them to do, the runaway trim stabiliser procedure. It killed them and everybody else.

        • I missed where the runaway trim procedure says fly TO power and exceed Vmo.

          Excessive speed led to the hand wheel not being able to adjust trim.

          • After the Lion Air crash, BA said they had added MCAS, and the procedure to stop MCAS was to do the runaway trim procedure.

            You’d think BA would have made sure that their engineering simulator accurately simulated the flying aircraft, and then put a few random line pilots in the sim, failed the AOA, and checked that the pilots could recognise the “runaway trim” which didn’t manifest as traditional runaway trim, in the required 4 seconds, amongst the stick shaker going off, all sorts of other alarms, don’t sink warnings, and general mayhem.

            You’d think that BA would have made absolutely certain that their solution to invalid activation of MCAS really worked before offering it as the solution.

            Maybe they did check it out, maybe with a test pilot who knew everything about MCAS, and in the SIM, he knew exactly when it was about to be triggered, and had his response ready to go ?

            If BA did simulate invalid activation of MCAS, did they simulate a scenario anything like what happened in reality ? Did the stick shaker go off, did all the other alarms sound, or did they just simulate MCAS performing AND in a nice quiet cockpit ?

            Have another look at http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/

            So MCAS has pushed the nose of the aircraft towards the ground, what is your first priority a) Get the nose up, or b) Throttle back to reduce airspeed ?

            As discussed already on this page, what happens when you reduce thrust on a 737, assuming you are flying straight, and level, and change nothing but thrust ?

            Throttle back the nose drops !

            Now the nose of the aircraft is already pointing at the ground, and the aircraft is gathering speed rapidly, you may be trying to work out why you have unreliable airspeed, and unreliable AOA, stick shaker, and any number of other alarms going off.

            Lets say you do throttle back, the nose drops even further, and airspeed increases anyway. I suspect the pilots may have gone with option a) above as throttling back may have made their predicament even worse.

            Why TO thrust ? Remember where they were, Bole is around 2,000 feet higher than Denver !

            What I am saying is that it’s more complicated than just follow the mantra perform the runaway trim procedure !

            I’d love to run the scenario through a MAX simulator, and reduce thrust immediately MCAS activates, I’d like to know if that makes any difference, I’m really not sure that it would have made any difference at all.

          • JakDak, maintaining airspeed is one of the fundamental principles of safe flight.

            The argument has been made that full power was necessary due to altitude, or to avoid the nose dropping further. But the evidence is that the aircraft accelerated well beyond safe speeds, so it clearly didn’t need that much power. We also know that those airspeeds increased the control loads, that’s why there are maximum safe speeds (250 knots for their altitude).

            No doubt the situation the pilots faced was far more adverse than simply being handed a checklist to run. Even identifying the right checklist would be a challenge.

            It’s understandable that they lost track of throttle in the confusion that occurred. It’s also understandable that when the overspeed alarm sounded, they thought it was part of whatever problem was causing the other alarms. So we have to be cautious and consider that before assigning blame.

            However, we can still acknowledge that it was an error, and maybe help other pilots to not make the same mistake in the future.

          • “” maintaining airspeed is one of the fundamental principles of safe flight “”

            If AoA data is needed to provide airspeed data and if that is fundamental for safe flight, it can’t be relied on a single sensor, what Boeing did, even when an engineer questioned the single sensor failure in 2015. Boeing decided against the fundamental principles of safe flight.

            NG will need a 3rd AoA too and an architecture to provide safety.
            That Boeing didn’t care about safety for decades is unacceptable. Amateurs …

          • Leon, Boeing doesn’t have control of the airspeed during flight, the pilots do.

            Boeing provided dual sets of controls and instruments, as well as a third set of basic instruments for reference, as well as a series of alarms to indicate problems with airspeed.

            The failed AoA sensor introduced an error in one of these airspeed indications. This error was alarmed. The other two indications were still valid. The overspeed alarm was valid.

            So you can’t say that the crew did not have valid airspeed and warnings for the overspeed condition, and that was somehow Boeing’s fault. Even for the affected airspeed indication, the error was not large enough to conceal the overspeed.

            Boeing has a huge responsibility for mistakes made in these accidents, but in order to fix the problems, we have to be accurate and specific about what they were. Having MCAS rely on a single A0A sensor was a serious and critical mistake, but it did not cause an overspeed condition. The pilots did that.

          • JakDak,

            Regardless of whether the nose would drop of not, you should not exceed maximum speeds (nor drop below minimums).

            So Boeing had no reason to test the procedure outside the approved envelope. The envelope is used to limit lots of testing.

            I can promise my vehicle was not tested for me to slam on the brakes at 130 MPH with S rated tires and 500lbs over loaded.

            And no, we now know Boeing did not test a failed AoA sensor and all the ancillary effects. Not before JT610 or after. They tested the stab moving at the rate MCAS used and it being detected as runaway (would be noticed as it was an unexpected movement, faster and longer than speed trim).

    • Given your comments you have not read the JATR report or the Lion Air crash report. Dear me.

  6. So the captain failed to tell the first officer about the repeated auto-down-trim. That is a communication failure, perhaps in a way an understandable one.

    But it seems that the FO, when he ran into problems, also did not talk to the captain. Another communication failure?

    He could easily have said something like, “The thing keeps trimming down.” It is quite likely that the captain would then have helped him, perhaps by telling him to trim up more or explaining what he had done.

    Perhaps pilots can learn from this and make sure that they always tell the other pilot about anything that can be important or even dangerous, rather than quietly struggling.

    • Hans, I agree and that was a conclusion of the Lion Air report as well. Crew resource management is important in an emergency. The report said that the crew did not work together to develop a shared mental model.

      However we know from human factors, and many other accidents, that this becomes more difficult when the crew is stressed. Certainly the behavior of MCAS would have stressed the crew. So rather than a reason to blame the pilots, this should be viewed as a lesson to be learned, as you suggest. The thing that most improves CRM is training.

      • And also training and having higher hour FO with a lot of truly challenge Sim training under their belts.

        Just flying time does not cut it as was shown by AF447

      • The report actually mentioned the Capt. having a record of poor CRM.

        “The Captain training record showed a remark of Crew Resource Management (CRM) need to be improved and one assessment on “teamwork exercise”.”
        page 183, next to last paragraph of section 2.3.4.

  7. To give another view.

    The Captain trusted the trim wheel. Why. No reason. Everthing on the flight deck was wrong or appeared to be wrong. The Captain took a guess and got it right. But the Captain didn’t know it was right to trust the trim wheel.

    The trim wheel readings could have been wrong. The stabiliser movements could have been wrong. The Captain took a punt and got it right. But the Captain wasn’t aware that he was right.

    But then we come to the documentation. Boeing’s documentation. The documentation didn’t say anything about MCAS. Instead it said the Captain needed to take a different action. The action was not known to the Captain. But anyway the action was wrong.

    The First Officer tried to look up the documentation, but failed. The Captain tried to look it up, but the airplane crashed before that happened. But even if the documentation had been retrieved it was wrong.

    The point I’m making is that the Captain’s actions were not situational awareness, they were the result of throwing the dice. The Captain had no other choice. For awhile the dice landed right but then the dice didn’t land right.

    • I believe Bjorn (as usual) has it right in that the issue was the alarms and how they are grained to respond.

      This clearly was not a checklist emergency but that is how they were trained.

      So only a small part of his mind seems to have been focused on the trim and the rest on the alarms (which turned out to be totally irrelevant in the context of where the emergency actually was)

      While not of this consequence, I have cursed myself a number of times the past trouble shooting a problem that the clue was there and I ignored it.

      In those cases a true technical would like to have someone kick him in the butt.

      I have had other cases where a non tech partner would point out something and it was, shoot you are right, I am so busy going down the rabbit hole I took a wrong turn.

      Back to training, the pilot had his situational awareness trained out of him (or so I think)

      My flying was more basic as we only had one alarm, but the emphasis was on flying the aircraft first and worrying about the non lethal stuff latter.

      Yes your engine quit, don’t trouble shoot the engine, establish best glide, see if you have any options and setup for them and then when stable see if you can get the engine going.

    • Philip, this is a pretty awful thing to imply. They didn’t have skill but were just lucky that electric trim worked?

      With the physics of the aircraft in mind, the captain knew that AND can be caused by either elevator or stabilizer. As discussed in other posts, the pilot has full authority of the elevator via the control column. He knows the column and elevator are responding, he can counter the AND, it’s responsive to him in both directions, but the loads are increasing.

      So his attention shifts to the stabilizer. As TW pointed out, he sees the trim wheel spinning, the stabilizer units rapidly decreasing to 2 units or less, which he knows is an extreme AND value. This matches the behavior of the aircraft. The typical value should be above 4. So he does electric trim ANU, and the trim wheels respond, as does the unit indicator, which he brings back into the desired typical range. This means the stabilizer, like the elevator, is also responsive. The aircraft levels out and column forces return to normal.

      So now he knows he has a control issue, but no idea yet as to what it could be. The control surfaces are both working and responsive, and he has a solution that worked.

      But now MCAS kicks in again, and the aircraft goes AND again. So the captain tries the same trim solution again, and it works again. This cycle continues, and he gets better at interrupting MCAS more quickly, thus limiting the AND movement. Also, he always brings it back to above 4 units. This behavior indicates strongly that he understands, and is not just trying random things.

      But he still doesn’t know the cause, and he needs to resolve it before continuing the flight. The FO is not having much luck with the QRH (nor could he since the information is not there), so the captain trades roles to try it himself.

      We all know what happens next. But Philip, say what you will, I commend the captain for his reasoning skills, thinking on his feet and doing what we expect pilots to do. That is skill, and not luck.

      I feel confident that had the FO countered MCAS as the captain had, the captain would have had time to conclude & try the trim cutout switch, and confirm that it stopped MCAS. And there would not have been a crash. With the cutout switch off, control and landing would be perfectly possible.

      It’s important to be truthful about the events that actually happened, and not filter them through the lenses of our individual agendas. I’ve been clear that even though mistakes were made, that doesn’t mean we should blame the pilots, or use them as scapegoats for the many other problems that put them in that situation. But nor should we ignore the facts. We do that at our own peril. There are things to learn here, but only if we have an open mind.

      • In hindsight and Bjorn input, I agree with Rob on the pilot (and the FO had too little experience and Indonesian does not mandate the right CRM let alone sim ops per US and EU).

        The jump seat pilot made all the difference in the previous flight.

        Kudos to the pilot he never panicked, he worked the problem to the end.

        Nothing wrong with his initial response and in fact it would be the right one (neutralize the stab). What he did not know was with MCAS he needed to then kill the stab.

      • I didn’t say or imply what you have said in the first sentence. Dear me, you are sinking to new depths.

        Many have written on this web-site that the Captain should have used the air speed disagree procedure. That puts the flaps down.

        It was a crap shoot. Whatever the Captain did WAS NOT WRONG.

        The pilots of both crashes are entirely blameless. With regard to the Lion Air crash I said that within days of the crash. I did the same with the Ethiopian Airlines crash.

        With regard to your continued use of circular arguments. The Captain used electrical trim and if he had continued to use it the airplane would have landed. That’s my interpretation of your post to Bjorn. A circular argument. Again. Daft to the point of being bonkers.

        Neither pilot knew what was wrong. It was a crapshoot. I’m sure both pilots would agree if they were still alive. Many, many pilots who are alive have said it for them. Quite right too.

        So to repeat, the pilots are entirely blameless for both crashes.

        Your not just scrapping the barrel with your comments, your scrapping the gutter.

        • Philip, you lost me here. You say the pilots are not to blame, and I agree. Then you say the pilots were only rolling the dice, having no situational awareness, and treating the situation like a crap shoot instead.

          When I disagree with that, pointing out that at least the captain understood, did the right things and was on his way to a full resolution, you start up with the insults again. Insults are not arguments.

          Full resolution was use of the stabilizer cutoff switch to disable MCAS. In order to have the time to reach that conclusion, electric trim was needed to counteract MCAS. That is what I said.

          When I try to understand your reasoning, it’s clear that you don’t want the pilots to have had any chance at recovery, because that’s inconsistent with your theory that the aircraft was doomed, regardless of pilot skill. That in turn is consistent with your agenda that only Boeing was responsible.

          One of the things that bothers me about that, is it totally discounts the value and role of the pilots. They were people like us, they had strengths and weaknesses. The captain was clearly better able to adapt to the situation than the FO. This is documented in the FO’s training record as well, as indicated in the accident report.

          In your argument, the captain’s skill has to be swept under the rug. That’s an injustice to him, he did a great job with the odds stacked against him, and that should be recognized. He made mistakes as well, but certainly we are intelligent enough to differentiate between the two, to learn and understand why those happened.

          If we acknowledge these things, we can learn from them and improve things for the future. If we pretend they didn’t happen, that all pilots are the same and all would have been doomed, we learn nothing.

          If I were Lion Air, right now I’d be looking at emphasizing CRM in my training, to break that link in the accident chain. But it’s far easier to say that the link doesn’t exist, then no action is needed.

          • It’s your understanding of English. Situational awareness is about understanding the know and choosing correctly.

            To turn it round. It’s situational awareness is not about the unknown.

            It’s not possible to be aware of something you don’t know exists.

            The Lion Air crash pilots didn’t know that MCAS existed. They didn’t know about the pitch up tendency. They didn’t know that manual trim didn’t work. They didn’t know the elevators would become inoperable. And so on. The list is long.

            It wasn’t much better for the Ethiopian Airlines crash pilots. They did know MCAS existed. But they didn’t know Boeing’s procedure, the runaway trim stabiliser procedure, didn’t work. The rest of the list is the same as the list for the Lion Air crash.

            The truth only began to emerge after the second crash. We still don’t have the truth.

            Pilots must not agree to fly the MAX until they know the truth. Then you and others can start to talk about situational awareness.

            As it stands you are talking about Mystic Meg the fortune teller.

            The pilots are blameless because they didn’t have the information, thereby preventing them from excercising their skill with regard to being situationally aware.

            The piloting skills of both sets of pilots were admirable. If they had been given the information neither crash would have occurred.

            Boeing need to tell the truth, the whole truth and nothing but the truth. Then skilled pilots have a chance when something goes wrong.

            I have to accept that English isn’t Bjorn’s first language. What’s your excuse. Mystics Meg and fortune telling is not situational awareness. It’s a game of chance.

            The pilot’s are blameless.

          • philip:

            You seem some mythical proof on the MAX when in fact the required information is there and no myth.

            Pilots will fly it when their AHJ approves it and the conditions for the MAX to return to flight.

            None of it will be swept under the rug.

            While the MCAS was the trigger to two crashes there are other lessons to be learned and applied.

            One emerging one to me is the alarms and shift to check list to deal with alarms and loose situat9ion awareness of the real issue of flying the aircraft. In some ways per previous but a difference.

            Now if an engine goes that is a useful alarm.

            But you don’t let the airplane go into a dive as a result of shutting down the fuel and pulling the fire bottles either.

            I begin to see why they were going for the checklist but that in turn meant that the aircraft orientation was secondary when in fact the issue on the checklist were not the issue nor the response but took them down the rabbit hole.

          • Philip, the preceding Flight 043 disproves your argument. They had no more knowledge of MCAS than 610, yet they had sufficient situational awareness to resolve the problem it caused.

            The captain of Flight 610 demonstrated that awareness as well, he just didn’t get the time he needed, or help from a third pilot which accelerated the process.

            I don’t think mastery of English has any relevance here, or mastery of astrology. It’s about willingness to accept the facts of what actually happened, whether or not they support your position.

          • @philip

            In your comment you state

            ‘To turn it round. It’s situational awareness is not about the unknown.
            It’s not possible to be aware of something you don’t know exists.’

            Frankly, I don’t understand that logic. The thing is about to absorb all available information – evaluate – conclude – and react. The known is easier, – the unknown more challenging.

            A(n electronic) control loop often consists of three elements, – the Sensor side, the Logic Controller (such as the FCC) and the Final Element (such as the Hstab). Most of the time we observe the FE side – such as the Hstab moving what seems to be ‘uncontrolled’. Then it is up to us, such as pilots, to monitor – digest – conclude – and action. Sometimes, hopefully most of the times, we succeed. The more often you – the group if you like – succeed, the better you are.

            ‘To expect the unexpected shows a thoroughly modern intellect’. I didn’t say that, Oscar Wilde did!

  8. What Bjorn said about time and the aircraft not responding struck a cord.

    When I was getting my commercial license I got the C150 into a spin (solo flight)

    So yes there was a panic as the controls do nothing in a spin, and that is so contrary to all other training as the controls ALWAYS responded (the school did not do spin training as it was not FAA required so no built in response) ailerons do nothing , elevator does nothing, nada, zip.

    I had some things going for me.

    1. I had not liked how the airplane had done the previous stall and I went up another 1000 feet.

    2. I had read Wolfgang Langewiesche Stick and Rudder book on flying and the method to get out of a spin.

    3. C150 is very responsive to the right counter spin technique.

    In fact the one control that does work is opposite spin rudder. Not what you think of first when bizarre thins are happening.

    So I had time to get over my panic (and yes I did panic which Lion never did) and start thinking again. Identify this, as a spin, ok, aircraft spin, aircraft recover, what is the right method to do so.

    Now the book says neutralize the controls and ease in counter rudder.

    Said rudder went full opposite rotation with a stamp (probably a dent in the floor board) and bless Cessna and the high level of construction required for aircraft as it took it just fine).

    • Sometimes, even when rushing through keystrokes, you can write very well too! I was reading your post and I could literally see the airflow reattaching the craft’s surface beginning at the tip of the rudder onwards…nice.

      • Thank you, I get in a hurry and small window and …….

        Not something I ever wanted to repeat, but as long as you fly the airplane you stand a chance.

        One of the guys I flew with got into a severe downdraft on approach to a field.

        He said it was the hardest thing he had done in his lift to put the nose down and get airspeed, but he did it.

        Kind of an messed up landing in the area between the taxi way and runway but no damage.

        All that stuff better done in a Simulator!

  9. @Bjoern,

    I have two questions for you.

    In the last paragraph above, you say ‘It was far from clear what to do and many flight crews would have ended up where JT610 did in my opinion’. – Can you quantify how many – say in percentage – who would manage the AOA failure?

    You also say/indicate that if the AOA difference had been flagged, the pilots would have dealt differently with the AOA failure. Can you describe ‘thought scenarios’ – say step-by-step – how this would have happend.

    The above being said, I am of the opinion that we should design control systems for the ‘least competent’ operator, – with todays technology this can be achieved both from a technological and price viewpoint (and time to design!). But since nothing is 100% in technology, we need to leave a few critical items to the pilots.

  10. Three questions and a thought.
    When the Captain’s stick shaker activated but not the FO’s, if the crew knew the left side stick shaker was driven by the left side AoA vane, and the right shaker by the right side vane, why would that not suggest an AoA issue, without reference to a display indication?

    After he gave control to the FO, surely the Captain noticed the FO was loosing control. Why did the Captain not retake control and yet again use pitch trim to recover?

    Finally, you suggest the crew on JT043, and perhaps JT610, was led astray by thinking the problem was with the speed trim function. But would not that still lead them to the correct idea that the pitch trim was receiving an inappropriate command, and deactivating the pitch trim power would mitigate the problem?

    I am left with the image of the more experienced pilot madly searching the documentation, looking for a heretofore unnoticed procedure that will save the day, while the less experienced pilot was failing to control the aircraft. On JT034, if there had been a second set of manuals for the deadheading pilot to pour through, would they have survived? TransWorld’s comments about pilots needing broader training ring true to me. Canned solutions for anticipated problems are great but if the unanticipated occurs, sole reliance on canned solutions leads to failure.

    • @Elderly Kansan

      Interesting thoughts, -I have asking questions along the same line; – why was it so difficult to locate the root cause for the problem – the airspeed/altitude disagree – what the pilots focused on.

      My conclusion is simple. we need to establish a system that tells the pilots what’s all about. A simple way would be to divert – a parallel circuit to the DFDR – and dump data into an ‘alarm/information unit that would tell the pilots in ‘cleat text’ what it’s all about. – in this case ‘a faulty left AOA’. Such a dump would not load the other systems.

      From Air Accident Reports I have also noticed strange ‘things’, such as: an airliner taking off from Australia for Los Angeles got a ‘tail-scrape’ because the FMC was loaded with wrong fuel information. Couldn’t the FMC, which knows the distance, only accept ‘logical values’? Another mistake has been entering, and accepting, waypoints that are ‘far off’, – into the wilderness, so to say.

      Do we still have ‘a way to go’?

      • I have had a lot of experience with alarms in Building Control system (and yes when its the Flight Simulator building its a crisis only slightly lower than a sort delay)

        The problem was they could set it up and you could have a hundred alarms and the core issue was say with the Chiller (the whole system depended on that to work).

        As I build the alarm system and handled the emergencies, I set it up with what I called Rubber Meets the Road.

        What was the one alarm point that told you what the issue was?

        the problem is finding the key and putting it out and telling all the other people who want something else to get stuffed.

        Maybe AI is going to provide that sort of, look here, but right now the alarms win.

        Qantas pilots spent over 1.5 hours looking at alarms before they decided to just land the flipping aircraft.

        In that time they were incredibly fortunate nothign fatal occurred, they had almost no control over the left wing and both engines were no longer communicating.

        And as the FO did not have control, they did not know if the stick shaker condition would switch when he took control.

        Again there was a clue there but the FO did not trim and the disagree alarms were still there and it was getting worse situational wise.

        Keep in mind that the Captain for AF447 saw all that was going on and did not get that they were in a stall either. An instrument scan should have negated the alarms but not until far too late.

        Its a horribly frustrating field to work in at times and when aircrat worse when lives are at stake.

      • SveinSAN wrote: “From Air Accident Reports I have also noticed strange ‘things’, such as: an airliner taking off from Australia for Los Angeles got a ‘tail-scrape’ because the FMC was loaded with wrong fuel information. Couldn’t the FMC, which knows the distance, only accept ‘logical values’? Another mistake has been entering, and accepting, waypoints that are ‘far off’, – into the wilderness, so to say.”

        You are asking for more intelligent automatons. They will come, but not too soon.

        I believe, one major reason among several is that the manufacturers do not want to take on extra responsibility. If there is no automation at one particular point, then the manufacturer cannot be held responsible when there is a failure at that point.

        I might as well ask (and actually I do), why I have to adjust the fuel-to-air mixture by hand in a Cessna 172. This is truly archaic, and yet the manufacturer does not want or dare to automate this.

        And we are still not close to having General Artificial Intelligence. Human intelligence is still indispensable in complex situations. Some more complex decisions cannot be automated yet.

        • Hans, I agree and one model of automation is to optimize it for the relative strengths of machines and humans, which are quite different, so that they work well together.

          Humans are able to adapt and learn more quickly to unexpected or new situations. That’s why we still have pilots.

          Humans still make mistakes and there can be wide variability between humans. So those are weaknesses that require compensation. Training and experience are among the best compensators. Accounting for human factors in design of automation and machines is also key.

          • @Hans-Georg, Rob and TW.

            I am in the above comment not suggesting more automation, – in the sense that the automation is in control – I may be an advocate for more automation, but not this time.

            My point is simple: why don’t we let the ‘computer’s capability’ help us, that is: asking us if we really want to do what we do, – or find things in seconds we seem to use minutes to find in the manuals.

            When pilots prior to departure enter obvious wrong data – such as loads – into the FMC, undesired things may happen. When you enter 100 metric tons to little fuel, you take-of will almost certainly end in a tail-strike (has happened), Just search the World Library for ‘entering wrong data into the FMC’ – and you will be occupied for the rest of the evening. Can we ask the ‘computers’ to help?

            The Flight Data Acquisition Unit (FDAU) collects data, and is the interface to the DFDR. I can also transfer data to ‘wherever’ (such as the ACMS – aircraft cond,monitoring system – on the ground). With a sample rate of (max) a second. Then, in my view, it should be relatively easy to develop an ‘explanation’ to a Master Alarm. I believe Jeppesen could include this in their EFBs (then keep it in the Boeing family). To indentify the left AOA as the root cause behind the stick-shaker going and the strange speed and altitude readings, should be done in seconds.

            So this time I talk more about getting a computer assistant. In the next version I could ask: Hi Siri, what is all this alarm noise all about?. When Apple Computers can, we should be likewise.

            To conclude: we need to find ways to greatly reduce punching errors, and find the right procedure in the QRH without ‘flipping through a lot of pages’.

          • Svein, all good points. There was some discussion of this in another of Bjorn’s articles.

            People pointed out that newer aircraft have electronic manuals and some ability to present that information to pilots quickly on a screen, based on the alarms that are sounding.

            Also that some systems that have multiple cascading alarms, have a function to show just the initiating alarm, and then step though the succeeding alarms in a timewise fashion. That can help to clarify the initial cause.

            There was discussion of AI as well, some are for and some against, and it may not be mature enough right now, but hopefully will get there.

            Also as you say, there could be more logical bounds checking for human interfaces, to eliminate simple data entry errors.

          • SveinSAN

            “” My point is simple: why don’t we let the ‘computer’s capability’ help us, that is: asking us if we really want to do what we do, – or find things in seconds we seem to use minutes to find in the manuals. “”

            According to The Seattle Times, Boeing convinced the FAA, during MAX certification in 2014, to grant exceptions to federal crew alerting regulations, specifically relating to the “suppression of false, unnecessary” information. DeFazio said that Boeing considered adding a more robust alerting system for MCAS but finally shelved the idea.

  11. JT043 did survive, they successfully used the trim cutout switch as suggested by the deadheading pilot.

    Your image of the final moments of JT610 is correct, but we may never know why, or why the captain did not react more strongly to the FO’s loss of control.

    The issue you raise about mitigating trim malfunction is central to the debate. Boeing claimed MCAS malfunction would be recognizable as runaway trim, but the flight experiences, as well as expert opinion here, is that the two were not sufficiently similar.

    I believe that the difference was enough to delay the initial recognition, but as you say, with time you’d recognize a malfunction with trim and disable it. That happened in JT043.

    As far as the left & right side controls, I don’t know enough about how a pilot would interpret that. They were getting other alarms as well, so possibly it wasn’t immediately clear. But it definitely was a clue to what was wrong, in terms of AoA.

    However even if they understood the AoA failure, they would not have known the link to trim via MCAS, since they had no knowledge of MCAS. So that goes back again to recognition of the stabilizer behavior being abnormal.

    • It seems the alarms were the issue and what they had been trained for and reacting to.

      Clearly the Trim was not a runaway as it was defeated off and on and it can go up or down not just down. So clearly it was not runaway up and it did not act like runaway down.

      On more than one occasion I have wanted to smash a audible horn as I could not think over it and it would not silence (or come right back on)

      The one hope would be that if the pilot maintains his scan he sees the situation.

      That would be the stab is not where you want it, nose is not high (mostly) and stick shaker is going off so its not a stall, VSI is going up and down per the stab condition, the Artificial Horizon does not say stall (not solid but its a good indicator as long as you are under 15 deg nose up you are not stalling) and the speeds and altimeter really are not that far off.

      So with all the squaking is the issue in the alarms or not?

      I think my mentality is such that I would say screw the alarms and go with the instruments as the issues are nit noid.

      JT403 with the jump seater was able to see that.

      And that then in turn did not get written up the way it should nor the ground repair done right (and it should have had a test flight after repair which was also not done right to confirm)

      Ethiopian got overwhelmed despite the pre warning.

  12. Above, Philip got into trouble when he said: “I think if by some miracle, the pilots of either crash had lived they would have said the flight deck was a casino with Mystic Meg the fortune teller dealing the crap.” Many called this a backhanded criticism of the pilots.

    What I find missing is what seems to me to be the logic of MCAS on the 737Max. I’m under the impression that there is nothing exotic about this type of software function in the economy of a fly by wire system. It seems, however, an anomaly in the architecture of the Max.

    And this is how I understand Philip’s comment. In both cases, the pilots were told they were essentially flying 737s and not a hybrid system with some fly by wire attributes. In the Qantas Flight 72 accident, a similar system took control of the Airbus A330 — a fly by wire system. The problem was caused by erroneous sensor data.

    Now, here’s what I understand from all of this. In a true, fly by wire system (or let’s say instead: “automated”), when you encounter such a problem with sensors and automation, there is nothing the pilot can really do except trust the technology. Trust the redundancy. Trust the computer — although they have just lost all trust. The Qantas pilot literally felt Hal900 was in charge, and that it was trying to kill them. But ultimately, he decided to stop fighting the system, let go of the stick and let the system right itself, through the robust redundancy of its computer architecture.

    The Max, however, lacked (and perhaps still lacks) such architecture. Within a properly redundant system, if the computer seizes control and starts making decisions based on false data; it is being cross checked by at least two other independent systems that have the ability to identify rapidly the problem. There was no system on the Max — with the exception of the pilot — designed to respond to this. So, instead of doing nothing, the response is to turn it off (if they know it’s there). And then the question eternally arises. Why was it there in the first place and should it be easy to turn off?

  13. RealSteve, I think it’s been well-established that Boeing relied on the pilots to handle MCAS malfunctions, when they could and should have done much more to add safeguards and protections. That is being addressed in the revisions that are underway.

    Svein has it right above, in that we don’t want to point fingers at the pilots, because there are a lot of fingers that could be pointed elsewhere as well.

    However we also know that aircraft recovery was possible, so we should learn from that, to help pilots be better able to deal with unexpected situations in the future.

    If we didn’t carefully review the errors that Boeing made, that would obviously be wrong. It would be no less wrong to ignore the errors made during the flights.

    We have to look at every link of the accident chain.

    • I’m not sure there’s much to learn in this case. It seems like a smokescreen. Programming problems don’t obey the laws of nature. Meanwhile, the system wasn’t designed with the conventional redundancy to account for this. It seems like the Max is a design oddity. It appears to be an archaic system; a cheap hybrid. Creating training and procedures for it will probably be unique and mostly non-transferable. It seems that throughout the accident chain each problem from maintenance to piloting was a catastrophic problem because of the unforgiving design of this unique, 50 year old aircraft design updated with modern engines that don’t fit.

      • There’s a lot to learn in the actions of the pilots, but first you have to be willing to learn. If you start with the presumption that there is nothing to learn, that pretty much guarantees you won’t learn anything.

        Accident investigators are trained to consider the entire event cascade, in order to establish the links in the accident chain and hopefully break them for the future. You can’t do that if you preclude and refuse to consider the links you don’t favor.

        The Boeing design was not automatically catastrophic. The pilot’s actions were not automatically catastrophic. It took the two together, along with several other factors, for the catastrophe to occur.

        Saying this truthfully does not absolve Boeing from the numerous mistakes that they made. They own a very large contribution to the accidents. But it wasn’t the only contribution. That’s just common sense.

        • RealSteve:

          Its clear you and many others have not read the history of aviation let alone engineering.

          While I don’t deliver it as an excuse, Boeing was often ahead of the regulation in past aircraft and pioneered the interpretations (though with actually intent at safety)

          Sadly things like the 787 Battery and the MCAS became hubris that we alwyas are right not that we need to present this as a path forward we feel is correct (and the engineering backing for it)

          In fact while the Russians the Brits were wallowing around with engines in the wing and tail driven options, Boeing had pioneered the pylon mounted engines and that has proven to be the right architecture to this very day for LCA and even regional aircraft.

          Yes the process went badly wrong, but we also have to share that guilt as voters we have allowed the system to be corrupted.

          What I want is to get all possible failures both understood and if possible corrected out of this. Pilots end are a personal thing as I am one.

          That does not mean the pilots are to blame and I get Bjorns clear explanation that they were doing what they were taught to do.

          I think that is a aspect from early aviation that has taken on a life of its own and with an amazing number of alarms, its not longer the right path (and at one time a flight engineer was there to sort through that)

          That does not excuse the core issue of MCAS 1.0.

          It does mean there are other issues that in total focus on MCAS 1.0 will kill people (there have been a number of disorientation crashes of perfectly good working aircraft that have been swept under the rung and those are bad training and or poor pilots)

  14. Imagine the cacophony if this were a truly complex series of events. It is not. Fehrm has done a great service by showing this in relatively few words.

    I’m not sure if any of you had skin in this game, like my family did. It comes down to a few salient points and for all who have helped focus on those, thanks.

    There is no chain of events. Eventually, someone will do a proper analysis, which will not resemble a chain.

    It is a simple fact that on both flights, the pilots had options. We have the luxury of tracing those options now. The thrust reversers did not activate mid-flight, nor similar.

    Many commentators here can solve the following probability problem in their heads: given that a failure to mitigate an erroneous MCAS activation resulting from bad AoA data would lead to a catastrophic loss, what was the implied probability that the pilots would do all of the correct analysis and proper active steps envisioned by Boeing and the FAA?

    And, in anticipation of Fehrm’s analysis of ET302, consider the critical difference between the two crashed flights: the AD+bulletin. In any rigorous assessment, one has to analyze the possibility that it actually made the situation worse for ET302.

    Reality is a special case, in the end. We don’t even have N=2 cases here. This all demands a look from way above that, which is where it all went so wrong.

    • tem:

      I did not have anyone close or known involved. So yes I am detached.

      That does not mean I don’t care. I am sorry for the loss you are living.

      My dad and a close friend died as a result of a bad decision on his and the friend part and a mechanic who put a part in wrong.

      If my dad and the friend had not made a stupid decision the direct course of 8 people would have changed and I don’t know how many more affected. Only two people died (and latter a third) not 347 – that meant every bit as much to us though.

      Its clear that only some pilots would have saved either aircraft and in both cases did not (one prior flight was saved and a different group of people died)

      I don’t know if the AD made things better or worse. I do feel the MAX should have been grounded until Indonesian crash was understood properly.

      Some will chime in you have to analyze first. That is wrong. Each situation is different and it was clear early on there was something really twisted about the Lion air crash that justified and immediate grounding.

      As the MAX was allowed to continue to fly, misleading information by Boeing was put out.

      Clearly just reading over a bulletin was inadequate to deal with the situation for X percentage of pilots.

      Safety going forward is fixing the Boeing issues that lead to the MCAS 1.0 debacle, it also is justified to learn the other lessons.

Leave a Reply

Your email address will not be published. Required fields are marked *