Alaska Airlines flight forced to make an emergency landing... 82

[Alistair_Heaton]

From what I can tell the FAA didn't actually know or realise what MCAS actually did or the effects of a failure in the big system picture to the normal operations.

The certifiers had white washed its effects or failure modes.

The trim window was special from a certification POV. If the NG had been certified less than a month later than it was then it couldn't have been certified.

The real killer for the trained pilot should have been able to cope was actually put to rest by a series of sim sessions in at the time in one of only two world wide simulators that was a MAX simulator. Everyone else only had access to NG simulators which were deemed sufficient due to the certification paper work put in to the FAA about training etc.

The FAA ran I think it was 12 737 experienced 737 NG pilots through it with a MCAS event.

The pilots were 6 from FAA system and 2 from EASA and the rest from other pilot geographical groups.

It was very quickly put under zero information disclosure rules.

By all accounts it really wasn't pretty with no real link between training backgrounds. That's where these percentages of less than 50% of normal line pilots started being quoted.

The real killer was when the FAA director at the time who was a very experienced 737 driver from classics through to NG and as a check airman was getting so much conflicting opinion he went and did it himself.

Literally with in minutes of him coming out of the sim the tone and process of the FAA completely changed into the hardcore that is seen today on the subject. And has continued since he left the role.

Again it was completely locked down from a public disclosure POV.

Most of us are pretty sure he crashed and burned in a quite spectacular fashion.

There are still people that have the POV that it was purely a pilot incompetency issue but I haven't seen anyone in the power circles even mention it since the grounding. In fact by far the bulk of the "chat" has been the NG should have never have been certified. And half the MAX problems are linked to its certification and the major changes rule.

 

[Alistair_Heaton]

The PIA is the complete management and running of everything from the regulator down failure.

There may well be design changes that could have legitimately stopped the chain of events.

The PIA is a true big picture failure of the whole system. Not just the people involved on the day who don't get me wrong were at fault completely.

But as far as I understand the SMS is meant to track and rectify issues in the big picture not just deal with individual events.

 

[SWComposites]

Spar - no I don’t think the FAA will yank the ODA. Probably should, but it won’t happen without a completely worse incident.

There is a reason PIA is banned from flying to many countries. Complete system failure.

 

[waross]

I wonder;
Why should Congress and the tax payers pay for FAA inspections.
If I do an electrical inspection, The permit fee more than covers the cost of inspections.
If inspections are a necessary part of aircraft assembly, why is Boeing and the final customer not paying the cost?
The present inspection system is a de-facto government subsidy of the aircraft industry.
Congress can solve a large part of the problem by cutting the subsidies and allowing the FAA to charge Boeing for the cost of inspections.
This will reduce improve safety and reduce costs to the taxpayer.


--------------------
Ohm's law
Not just a good idea;
It's the LAW!

 

[3DDave]

Since the results of the simulations was 100% covered up I assume that it was only to cover the last 30 seconds of the flight. Prove me wrong.

Every pilot going into the test would have heard and known about the trim problem, so the only test would be for the last 30 second.

One reason to cover it up was the CAA that declared the last crash pilots made no mistakes; to find that it was avoidable would be to blame the pilots of the last crash and we all know there is a tremendous pressure on pilots to never do that. The other reason was to dodge the responsibility the FAA had - they had the means to understand MCAS but chose not to. MCAS was already known - Boeing told the FAA. The director needed to save the FAA.

Edit - On top of which, the FAA had just approved the Emergency AD, which the Ethiopians had claimed they followed exactly. This left the FAA directly responsible for issuing a document that clearly, if the Ethiopians were believed, caused ET-302 to crash. The FAA head had to shift all that blame somewhere and the public and Congress already disliked Boeing because of the false statements, so it was easy to just pile on.

Th NG has had an exemplary safety record. Odd that anyone would argue for not certifying a successful plane.

Everyone knew all about MCAS after the Lion Air crash. Don't care at all what happened before that. Doesn't matter. Until the Lion Air crash it was a latent problem. The first crash did not lead to the big stink. The false story about the ET-302 crash did.

I don't understand about the simulators - no simulators had the ability to produce a false AoA sensor reading to feed the MCAS software. Ethiopia owned at least one MAX simulator and had to reconfigure it after the crash to do their investigation. They clearly did not do simulator testing after Lion Air and before their crash because they could not have done so and, had they tried, they would have reported that to Boeing. No one had considered that to be a failure mode so it was not part of the simulator software or would ever have been part of the training.

 

[3DDave]

waross - there are two levels of inspection in play. There is the design inspection - validating every aspect of the design, and the fabrication inspection.

One problem I can see is this. Suppose the FAA comes in and they say we need to have 10,000 engineers, full time, to review all your design work and they are going to bill at $1000 per hour each, full time. Maybe the FAA also says all certification testing will be done by FAA test pilots. Being a regulatory agency what happens? Well, clearly no company can afford that level of oversight. Either Boeing closes the doors or they get Congress to intervene. Congress makes limits and then the FAA bitches and moans they cannot attract enough qualified people and cannot do all the work - and here we are.

For fabrication inspection you have an experimental plane the FAA might inspect it for free, but if you aren't near an FAA inspector you can hire a designated airworthiness representative (DAR) and they will charge whatever they will charge. It may include mileage to and from your location and can be a few hundred to a couple of thousand dollars.

 

[Sparweb]

Hi Bill,
My comment about "there's Boeing and there's everyone else" is meant to apply to your question. The rules are fair, but the powers aren't fair.

Through all of these failures (the MCAS, the door, the quality errors) I keep finding that the rules in place would serve, if only they were applied fairly, or applied at all.

 

[Alistair_Heaton]

It would be an extremely strange SIM setup if it was the last 30 seconds. You can't reset slew into the air.

It wouldn't save any time.

The whole ground airborne logic would be completely confused.

The accident CAA's wasn't involved with this point.

It was pure Boeing and the FAA with the FAA deciding on the emergency grounding and if the piss was being taken by Boeing. And it was yes and yes

 

[Alistair_Heaton]

Was looking for the details on Sims.

Turns out at the time there was only one SIM that could do the mcas which was the Boeing SIM for certification.

Found this article which some might find interesting. There is stuff I didn't know in it.

Just to note a level D SIM is a bit of a strange beast. I am not going to attempt to pretend that I have a clue about them.

From what can tell it's an aircraft with simulated data inject to replace the sensor inputs.

https://www.afacwa.org/the_inside_story_of_mcas_seattle_times

 

[3DDave]

That article was from well before the real reason for the ET-302 crash was published.

Pilots who pull back forcefully on the column — sometimes called the stick — might suddenly feel a slackening of resistance.

That's incorrect. What they would feel is that the stick load wasn't increasing as fast at the G load, not that there was ever a slackening - the stick force continued to rise.

The failure analysis didn’t appear to consider the possibility that MCAS could trigger repeatedly, as it did on both accident flights. Moving multiple times in 0.6 or 2.5 increments depending on the speed, it effectively had unlimited authority if pilots did not intervene

In fact - the only reason for multiple triggering is because the pilots intervened. MCAS evaluated the trim when the trim changed. If the pilots stopped pressing the trim button MCAS stopped reacting. When the pilots press the trim switch, they had priority to set the trim, giving them time to disable the trim motors.

The pilots’ struggles to control their planes before both MAX crashes suggest that the FAA’s three-second guidance for expected pilot response time, upon which part of Boeing’s system safety analysis was based, needs to be carefully reassessed.

All three flights had pilots responding before the 3 second mark and had far more than 3 seconds to make suitable corrections. It's simply the case that the FO on Lion Air and both pilots on ET-302 never made a correct decision. An hour would not have been long enough for them.

Interesting, but too many holes in the article to be reliable when compared to the actual FDR data.

.....

A pilot in the simulator can fly the defective profile to the same condition as the last 30 seconds and then see what can be done. A test pilot would certainly be aware of the trim condition, particularly since that was well known before these tests were made. The pilots they lined up

Not sure what you mean - the accident CAA reported they had MAX simulators in their final report. It doesn't matter that the FAA was doing tests independently. What matters is if the simulator had an input for AoA other than the SMYD system. The article doesn't answer that.

The FAA had a motive to prove that they had no blame for issuing the Emergency AD, that the flight were completely unrecoverable, even though the first MCAS incident proved they were easily managed, once the pilots recalled the existence of the trim motor disable switches after getting the plane in trim.

What I indicated - that Ethiopian never trained their pilots because they could not train them on the sensor failure because the software they had could not manage the failed, but still valid, AoA input. Knowing this, they went ahead and flew a plane with a known defect and a newly out-of-school First Officer.

A level D sim is a cockpit full mock-up on a motion platform; it's not an aircraft. It has no sensors so of course the inputs are simulated.

 

[Alistair_Heaton]

Level D is not what you state.

The driver of the responses is the actual aircraft hardware it is not a software generated response.

It's single core single thread 286's and 486 processors

 

[Alistair_Heaton]

The certification owner pulled the certification.

The debate stops there. What ever the accident regulator says.

There is over 27 violations stopping further max variants being certified.

The list of AD for the NG must be having some accountants putting dates in calenders for bankruptcy.

The electric system on the NG is an utter mess currently. Your talking 2000 plus hours next D chech

 

[hokie66]

AH, you're sounding more and more like a Boeing hater, rather than an interested observer.

 

[3DDave]

"Level D is not what you state."

It is according to makers of Level D simulators. Perhaps the word "mockup" is what triggered you. A fully operational mockup or replica? Would that be calming? They don't necessarily have all flight-qualified controls, they just appear and act the same.

The hardware from the plane runs software, so everything they do is a software generated response. You are making an unimportant distinction.

I said, quite clearly, that the inputs are simulated because there are no sensors. Look at the Level D simulators and you won't see externally mounted AoA sensors or pitot-static systems nor is it located inside a pressure capable wind tunnel.

https://www.cae.com/civil-aviation/...g-equipment/full-flight-simulators/cae7000xr/

"CAE 7000XR Series Level D Full-flight Simulator"

 

[Alistair_Heaton]

We have procedural simulators which are purely computer hardware and everything is generated by the computer model input, reaction and output.

The level D's are sensor data injected to the real aircraft hardware giving the same response as one that fly's. Be it digital or analogue sensor. As I stated.

And the room that you never see pictures of which is usually bigger than the box on legs has all manner of stuff in it. It doesn't have a wind tunnel but older sims did used to have AoA vanes actuated by servo motors to move them.

The level D's I have been in have OEM serialised parts from the aircraft, in fact they take from functioning aircraft to fix them sometimes.

It is neither a mock-up or replica.

The CAE7000 is what I spend 8 hours in every 6 months.

 

[3DDave]

It's a mock up of the plane, a replica of the flight deck. It is not an actual plane or a real flight deck. It is a simulator even if some parts are flight hardware.

Mince words all you like. I don't care what simulator you use. It's not a MAX simulator and has no bearing on this topic.

There has been no suggestion anyone considered or made provision for putting into the 737 MAX simulator system a different AoA than via the AoA sensor system, so no one could have simulated the Lion Air crash sequence.

You seem to have a blind spot that the aircraft external situation was not represented by any sensor input because you say "The level D's are sensor data injected to the real aircraft hardware" That's the point. The conditions of the three incidents had a difference between what the aircraft actually experienced and what the sensors claimed was happening. The simulators weren't designed to simulate that input and no one saw that as a requirement that they do.

Since that was the case they could also not have verified the Emergency AD instructions worked. Since that could not be done, it was irresponsible of Ethiopian, in possession of a MAX simulator, to put a new grad into a 737 MAX when Boeing itself announced that the software would be updated. They could have parked the plane and waited or they could have flown with manual trim control and no autopilot. Instead they got two pilots who cannot handle a stall warning procedure to literally save their lives. How did they get through training?

On top of that the FAA issued that Emergency AD without verification, so when the FAA did their secret testing it was motivated to show that the instructions didn't work; but I bet every pilot had no problem and they buried that result. Or maybe it would show the FAA pilot certification sucks and pilots are given licenses who should not have them. The great thing about secrets is everyone can speculate and since the truth is the first crew, completely unawares, flew 90 minutes to a safe landing, it's clearly only a basic skills issue.

Either result would relieve Boeing of responsibility and put the FAA on the spot for not requiring 50 repetitions of trim runaway training over 4 weeks before being allowed back into the front seats.

 

[Alistair_Heaton]

It is a real flight deck same components, we even have to take into account which firmware the components are.

There are 2 real Fadecs in the room downstairs.

But I agree that the fundamental issue was that the sensor failure was never considered. As the article

https://www.afacwa.org/the_inside_story_of_mcas_seattle_times

states.

But I actually agree the crew skill profile was not taken into account as well in certification. The 3 seconds reaction time is completely out the window now. Which is one of the many issues with the MAX 7 and 10.

The skill profile has changed in the 20 years I have been flying. I am unusual in my peer group. it is completely different to the skill set which could be presumed when the 737 was first certified.

I spent 5000 hours driving a none autopilot analogue turboprop. I have muscle reactions that the straight to jet pilots just don't have. Also the number of system failures dealt with on the Jetstream 31/32 was colossal in comparison to the J41, Q400 and A220.

I also spent 900 hours teaching stalling and the basic "skills" in piper tomahawks PA38's.

There are a few of us with similar backgrounds that mess up the sim profiles due to our reactions. Call it a third sense of impending doom which triggers a power plus attitude equals performance solution. It is considered by some that we ditch the automation to soon. And its just annoying that we are able to fly out of it without the automation. But the ability to do that is 10's of thousands of flights.

Even at the time instructing I could see the difference between pilots trained on a Cessna and those trained on a Tommy. The Tommy was considered brutal and dangerous by a lot of instructors and pilots. I thought it was brilliant for teaching the basics apart from the stupid trim system.

Training these days is done on FADEC controlled engines and glass cockpits. And the aircraft are significantly more reliable.

And the fatality rate is a fraction of what it was 30 years ago.

Reading about something on paper is not the same as experiencing it. And real life is significantly different to simulated even on these level D's you just can't generate the physiological changes which occur in a, you can't screw this up situation.

I would expect the reactions of a 737 Classic or 757 pilot would be different to a 737 NG only pilot.

And no its not Boeing hating. I have an issue as well with Airbus and their refusal to rerun the Software, hardware, liveware interaction of their system (SHELL model). How many crashes need to occur because of the thrust levers not moving giving tactile feedback of power setting.

Airbus also have an issue with the Angle of attack sensor system. They do have 3. But there is something seriously going on with it currently. And it may very well be linked to the skill level of the pilots.

Currently I suspect the group of pilots with the most reactive skill set for dealing with issues is more than likely the Russians. They are dealing with system down grades and events daily due to no spare parts and running at less than the minimum equipment list.

 

[Alistair_Heaton]

if anyone is interested in airbus issues with AoA

https://www.flightglobal.com/analysis/analysis-how-airbus-fought-its-own-pitch-battle/132358.article

 

[SWComposites]

And now the NTSB is pissed at Boeing for withholding and deleting info on the door removal/installation. Cripe.

 

[3DDave]

Meh - I doubt that Boeing has or had any information about handling the door. Boeing did not touch it nor did they ask anyone else to do so. At best they have a sign-off that the door was correctly installed when it arrived with the rest of the fuselage. The only Boeing information that appears to be deleted are factory security tapes that are on a 30 day loop. They aren't a construction record so they aren't expected to be retained.

What is more interesting is that Spirit did not direct-hire the workers who did the rivets. They appear to have come from one or more of several contract employee suppliers. Spirit should have information about the door. They are responsible for installation of the door as well as it's subsequent removal and re-install and NTSB has gotten no documents from them nor the names of the workers who did the rivet work.

Spirit has had enough time to raise ducks from eggs and get them in a row, so I don't know what they gain by delay. I think it is clear that no matter what or when, this is going to hurt. They need to get it over with now.

My guess. Delays while some executives negotiate their separation packages.